What do the US midterm election results mean for a federal privacy law?
Spoiler: it may hinge on California's voting block
Analysis America's midterm elections didn't result in the widely predicted Republican red wave, but the results show there will be interesting times ahead for American privacy.
After an arduous week of vote counting, Democrats narrowly won control of the Senate, although depending on the outcome of the Georgia runoff in December they may need Vice President Kamala Harris to cast the tie-breaking 51st vote.
Meanwhile, after winning key races late Monday night in New York, Arizona and California, Republicans remain just one seat away from claiming the House, all but guaranteeing a split-in-half legislative branch for the next two years.
For the bipartisan American Data Privacy and Protection Act, now stalled in the House, this sharply divided Congress could mean lame-duck lawmakers are more likely to compromise on a privacy law instead of rushing appointments and more partisan issues through the process. Or, it could signal the death knell for the ADPPA, and stronger data privacy.
Attorney David Saunders, a partner at McDermott Will & Emery, falls into the latter group. "What the midterms really do spell is likely the end of the ADPPS in its current incarnation," he told The Register.
After passing out of the House Energy and Commerce Committee in July — which is the farthest that a federal privacy proposal has ever made it in the legislative process — the bill has been held up in the US House of Representative by House Speaker Nancy Pelosi, who has issues with the legislation because it doesn't provide protections that are as strong as those legislated in her home state of California.
More on that a little later.
A House divided
Saunders said he expects the bill to remain stalled as Democrats will probably prioritize other legislation.
"Let's assume a divided Congress," he said. "We can likely expect gridlock for the next two years, and as much as we all want privacy to be a priority, it's hard to envision that being the case when we expect very little to move. That's not to say that we don't anticipate any movement post-election. We will probably see a few brave representatives and senators try to take up the issue, but it likely will be difficult."
On the other hand, Alan Butler, the executive director and president of the Electronic Privacy Information Center (EPIC), said the bipartisan nature of the privacy bill gives it needed resiliency, especially in a lame-duck and divided Congress.
"There really should be an opportunity here to get this done," he told The Register.
Or, if not before the session ends, then shortly after the newly elected lawmakers are sworn in, said Samir Jain, director of policy at the Center for Democracy and Technology (CDT).
"Assuming control of the Senate and House is split, and if ADPPA does not pass in the lame-duck session, it should still be one of a relatively small number of bills that can garner enough bipartisan support in both chambers to pass," Jain told The Register. "Both parties should have an interest in having at least some accomplishments during the next Congress, and ADPPA should be on that list."
The one thing that everyone does seem to agree on is that California, and to a lesser degree the four other states with their own privacy laws, poses a bigger hurdle for the federal legislation than whatever political party ends up controlling the House.
The California problem
For the bill to pass the House, or even make it to a floor vote, "you have to get the California delegation on board," Saunders said. "I don't see that happening any time soon."
If or when the proposal makes it to the Senate, it faces a similar challenge from Washington Senator Maria Cantwell (D-WA) who has also criticized the federal privacy law for being too weak — especially if it has the power to override more stringent state laws such as California's.
"None of the issues is a hold up in the same way that the preemption issue has been," Butler said.
California's privacy law provides stronger data protection rules than ADPPA would, and at issue for the state and others is that the federal bill would preempt the state's laws. In addition to California, Colorado, Connecticut, Utah, and Virginia have also passed their own privacy laws, and others have similar consumer protection rules on the books.
"Congress should adopt a federal baseline, and continue to allow states to make decisions about additional protections for consumers residing in their jurisdictions," wrote attorneys general from California, Connecticut, Illinois, Maine, Massachusetts, Nevada, New Jersey, New Mexico, New York and Washington, in a July letter to Congress [PDF].
A month later, the California Privacy Protection Agency sent a letter [PDF] to House Speaker Nancy Pelosi and Minority Leader Kevin McCarthy opposing the ADDPA because of the preemption clause, and urging the lawmakers to do the same.
"Preemption is a really big deal, and it's not just California who thinks that," EFF Director of Federal Affairs India McKinney told The Register. EFF has also been lobbying Congress to allow states to enact stricter privacy rules on top of a federal baseline.
"The state of California has has come out and said we are opposed to this bill unless the language changes, full stop, and California has a lot of delegates," McKinney continued, noting that this won't change regardless of which party controls the House. "Whether Speaker Pelosi or McCarthy, they are still from California, and the California delegation is a really big block of votes."
- Republican senators tell FTC to back off data security, surveillance rules
- National data privacy law for the US clears first hurdle
- US border cops harvest info from citizens' phones, build massive database
- World Cup apps pose a data security and privacy nightmare
The fact that lawmakers and having the fight over preemption — as opposed to the need to protect privacy in the first place — makes her hopeful that a federal bill will make it to the president's desk to be signed into law, McKinney said.
"Fighting about preemption, and about some of these other big sticky wickets are actually the important fights, and that's what makes me think a version of this bill is going to pass," she said. "We are trying to figure out what the solution is for the American people.
Even though it may seem like we are miles apart, when you are trying to come up with a compromise bill that is a bipartisan bill, that is a big shift in the way we do things in the US, and that is actually a really good thing." ®