Congress

Details still elusive on possible federal data privacy standard

data protection (Ditty_about_summer/Shutterstock.com) 

There appears to be growing bipartisan consensus across multiple congressional committees, the Federal Trade Commission and tech companies that some national data privacy legislation is needed in part to harmonize with European rules, eliminate the confusing patchwork of state-level laws and protect U.S. consumers against Equifax-style breaches. But as ever, details and a timeline on new legislation remain unclear.

All five FTC commissioners testified at a Nov. 27 hearing of the Consumer Protection, Product Safety, Insurance and Data Security subcommittee of the Senate Commerce Committee.

According to FTC chairman Joseph Simons and other commissioners, the agency doesn't have enough resources or authorities to go after abusers of consumer data.

"In my view, we need more authority" in order to carry out enforcement against data misuses, Simons said, adding that any federal privacy law must include three elements: the ability to seek civil penalty for unlawful conduct, jurisdiction over nonprofits and common carriers, as well as rulemaking authority.

Subcommittee chairman Sen. Jerry Moran (R-Kan.) said that the FTC needs "additional authorities…to accomplish greater levels of privacy and data security in this country… I can be convinced — and may be already convinced — they need more financial resources to appropriately perform their duties today."

Committee Democrats want to make sure that any new federal standard includes consumer protections that are on par with the General Data Protection Regulation in the EU or in California statutes.

Rohit Chopra, one of the two FTC Commissioners appointed by Democrats, said that federal law should respect those states which have elected to enact strict data privacy laws.

"We need some clear rules of the road at the federal level," Chopra said, but added that "broad preemption [of state laws] would be a huge mistake."

Moran said the California and EU provisions offer "a way to at least have negotiations about a national standard."

Both Blumenthal and Moran said they want significant bipartisan support on legislation and expect a bill to be introduced early next year.

Some privacy advocates are less keen on turning to the FTC for data privacy enforcement.

Caitriona Fitzgerald, chief technology officer and policy director at the Electronic Privacy Information Center, noted in past cases of data protection, the FTC has "has failed to use the authority it already has."

"Given the enormity of the challenge, the United States would be best served to do what other countries have done and create a dedicated data protection agency," she said.

About the Author

Chase Gunter is a former FCW staff writer.

Featured

  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

  • Cloud
    cloud migration

    DHS cloud push comes with complications

    A pressing data center closure schedule and an ensuing scramble to move applications means that some Homeland Security components might need more than one hop to get to the cloud.

  • Comment
    Blue Signage and logo of the U.S. Department of Veterans Affairs

    Doing digital differently at VA

    The Department of Veterans Affairs CIO explains why digital transformation is not optional.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.