‘There Will Be Movement’: What to Expect for National Privacy Legislation

Along with myriad other issues facing President-elect Joe Biden and the 117th Congress, businesses are still pushing for a federal data privacy law that will both protect consumers and provide businesses with uniform guidelines in all 50 states.

Dan Jaffe, group executive vice president of the Association of National Advertisers (ANA) in Washington, D.C., said even without a national pandemic and civil unrest, a bill with this breadth would be difficult to pass. However, he and the ANA have some suggestions for lawmakers. Jaffe spoke to Treasury & Risk sister publication Corporate Counsel about the difficulties in passing federal data privacy legislation and what should be in such a bill. (This conversation has been edited for length and clarity.)

Corporate Counsel:  Is it fair to say the Association of National Advertisers is in favor of a federal data privacy law?

Dan Jaffe:  We have, for some time now, been pushing for national privacy law. We think it’s critical that a value as important as privacy be handled on a national basis rather than depending on where you are [in the country].

It doesn’t make any sense that your privacy rights would diminish because you cross borders. We believe another thing that could be very serious is if we have the balkanization of inconsistent laws that would make it very hard for businesses to effectively use the internet and mobile. When you’re on the internet, you’re international, and to have each state have its own rules is going to add tremendous cost and be anti-competitive for smaller entities. That would be bad for consumers as well because consumers will not really know their rights.

CC:  Would you expect that, in the absence of federal law, an increasing number of states will put forward their own data privacy legislation? Do you think those laws would mirror each other? 

DJ:  There is no reason to believe they would necessarily mirror each other or even closely mirror each other if you look at the kind of legislation that is being pushed forward. Some states are focusing on opt-out approaches, which are very different from opt-in approaches. Their definitions of similar terms are inconsistent. We think it is quite possible that we may be facing more than half of the states looking at privacy laws if last year was any signal.

A lot of those bills were delayed because of Covid-19, and we think they will resurface. Right out of the box, we’re already seeing Washington, Virginia, and New York having privacy bills just about to be pushed forward. Without a national law, this will clearly proliferate.

Just having a national law will not solve this problem. You need to have a national law that is strong and that both consumers and businesses believe is adequate. You need federal preemption if national is going to really be effective and create any kind of consistency.

CC:  Are you confident that a bill for a national data privacy law will come up for a vote this year? 

DJ:  I’m not confident about anything about what will happen in Congress. It is too early to make a solid prediction on how this will go forward. But I believe there will be substantial pressure on Congress to do something in regard to privacy.

What we have been pushing is something called “Privacy for America.” We developed an extremely detailed draft law as a model for what the national law could and should be.

As a part of that law, we substantially increase the authority of the Federal Trade Commission (FTC) to enforce privacy breaches and to have easy rule-makings and to have more funding. We create a new bureau within the FTC that is just focused on privacy. We also have to deal with the fact that the privacy shield was found inadequate. One of the reasons the European Union found the privacy shield rules in the United States were inadequate was because they felt we didn’t have a comprehensive national law.

CC:  In your experience, are businesses in favor of an opt-out model or an opt-in model for consumers? 

DJ:  If there is a choice between opt-out or opt-in, I believe the business community in general, not completely, would prefer an opt-out approach. That is not the primary focus of the Privacy for America proposal. What we’ve done is try to move away from putting the pressure on consumers to be making choices constantly.

We state, more explicitly than it has ever been done before, what types of uses of data are violations and what types of activities are okay. We give the FTC the authority by rules or guidelines to state what they feel about those areas that are gray. We think that is a better approach.

We have opt-out and opt-in approaches in the bill as well. We require opt-in where you’re dealing with personally identifiable sensitive data. We believe that there are places where both approaches work.

CC:  What are the challenges you foresee in Congress working to pass comprehensive federal data privacy legislation now? 

DJ:  Trying to pass any legislation that has a real breadth and serious coverage is difficult. Privacy would cover a tremendous amount of business activity and communications with consumers. It is always hard to pass that type of legislation.

You first have president-elect Joe Biden having to see his heads of cabinets pushed through. Then he’s going to have to try to get new heads for the Federal Trade Commission, the Federal Communications Commission, and other regulatory agencies. He’s got to deal with the pandemic.

I can’t remember in any administration such a pile-up of major issues right up front. At the same time, you have a 50-50 split in the Senate, and a closer split in the House except for three other times since 1945. Everything is going to be complicated.

But on the other hand, you have tremendous pressure to get all of these things done. The pressure for moving pandemic legislation is high. I think that possibly the crisis that we’re facing may force action.

I think the shocking events in the last few days may have people wanting to show unity. Privacy is such a high priority that I’m willing to bet that within the first two years of the Congress, there will be movement with regard to privacy. There have been a lot of bills that have been drafted, so it’s not like they are starting from scratch.

See also:

• Covid-19 Presents New Data Privacy Threats
• Companies, Trade Organizations Seek to Postpone CCPA Enforcement Date
• Under the CCPA, Start Tracking Employee Data Now
• The Europeans Are Winning the Global Privacy Debate
• How GDPR May Actually Be Good for You

From: Corporate Counsel