Congress

Details still elusive on possible federal data privacy standard

data protection (Ditty_about_summer/Shutterstock.com) 

There appears to be growing bipartisan consensus across multiple congressional committees, the Federal Trade Commission and tech companies that some national data privacy legislation is needed in part to harmonize with European rules, eliminate the confusing patchwork of state-level laws and protect U.S. consumers against Equifax-style breaches. But as ever, details and a timeline on new legislation remain unclear.

All five FTC commissioners testified at a Nov. 27 hearing of the Consumer Protection, Product Safety, Insurance and Data Security subcommittee of the Senate Commerce Committee.

According to FTC chairman Joseph Simons and other commissioners, the agency doesn't have enough resources or authorities to go after abusers of consumer data.

"In my view, we need more authority" in order to carry out enforcement against data misuses, Simons said, adding that any federal privacy law must include three elements: the ability to seek civil penalty for unlawful conduct, jurisdiction over nonprofits and common carriers, as well as rulemaking authority.

Subcommittee chairman Sen. Jerry Moran (R-Kan.) said that the FTC needs "additional authorities…to accomplish greater levels of privacy and data security in this country… I can be convinced — and may be already convinced — they need more financial resources to appropriately perform their duties today."

Committee Democrats want to make sure that any new federal standard includes consumer protections that are on par with the General Data Protection Regulation in the EU or in California statutes.

Rohit Chopra, one of the two FTC Commissioners appointed by Democrats, said that federal law should respect those states which have elected to enact strict data privacy laws.

"We need some clear rules of the road at the federal level," Chopra said, but added that "broad preemption [of state laws] would be a huge mistake."

Moran said the California and EU provisions offer "a way to at least have negotiations about a national standard."

Both Blumenthal and Moran said they want significant bipartisan support on legislation and expect a bill to be introduced early next year.

Some privacy advocates are less keen on turning to the FTC for data privacy enforcement.

Caitriona Fitzgerald, chief technology officer and policy director at the Electronic Privacy Information Center, noted in past cases of data protection, the FTC has "has failed to use the authority it already has."

"Given the enormity of the challenge, the United States would be best served to do what other countries have done and create a dedicated data protection agency," she said.

About the Author

Chase Gunter is a former FCW staff writer.

Featured

  • People
    Federal CIO Suzette Kent

    Federal CIO Kent to exit in July

    During her tenure, Suzette Kent pushed on policies including Trusted Internet Connection, identity management and the creation of the Chief Data Officers Council

  • Defense
    Essye Miller, Director at Defense Information Management, speaks during the Breaking the Gender Barrier panel at the Air Space, Cyber Conference in National Harbor, Md., Sept. 19, 2017. (U.S. Air Force photo/Staff Sgt. Chad Trujillo)

    Essye Miller: The exit interview

    Essye Miller, DOD's outgoing principal deputy CIO, talks about COVID, the state of the tech workforce and the hard conversations DOD has to have to prepare personnel for the future.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.