{"id":3876,"date":"2021-04-07T09:00:43","date_gmt":"2021-04-07T14:00:43","guid":{"rendered":"http:\/\/blogs.luc.edu\/compliance\/?p=3876"},"modified":"2021-04-07T09:00:43","modified_gmt":"2021-04-07T14:00:43","slug":"federal-bill-may-soon-make-privacy-regulation-patchwork-a-thing-of-the-past","status":"publish","type":"post","link":"https:\/\/blogs.luc.edu\/compliance\/?p=3876","title":{"rendered":"Federal Bill May Soon Make Privacy Regulation Patchwork a Thing of the Past"},"content":{"rendered":"

Lydia Bayley<\/em><\/span>
\nAssociate Editor<\/em><\/span>
\nLoyola University Chicago School of Law,\u00a0JD\u00a02022<\/em><\/span><\/p>\n

While the COVID-19 pandemic undeniably pushed many legislative agendas to the backburner, some seem to be heating back up. With the 117th<\/sup> Congress now in session, data privacy is once again moving to the forefront of federal legislative debate. For decades, the United States has been governed by a patchwork of data privacy laws and regulations. But that may soon change. On March 10th<\/sup> Representative Suzan DelBene (D-WA) introduced the Information Transparency and Personal Data Control Act (\u201cITPDCA\u201d), the latest bill aimed at tackling data privacy regulation on a national scale. And as state laws like the California Consumer Privacy Act and the Virginia Consumer Data Protection Act continue to make headlines, Congress seems to be feeling the pressure to deliver comprehensive data privacy regulation.<\/span><\/p>\n

<\/span><\/p>\n

\"\"<\/a>
Photo by Dan Nelson on Unsplash<\/span><\/em><\/figcaption><\/figure>\n

The need for comprehensive federal legislation<\/strong><\/span><\/p>\n

While federal law currently provides a partial foundation for data privacy regulation, statutes such as the Health Insurance Portability and Accountability Act (\u201cHIPAA\u201d) and the Gramm-Leach Bliley Act only target specific types of personal information, leaving a significant amount of consumer data at risk. And despite calls for comprehensive data privacy regulation on both sides of the aisle, Congress has yet to pass the necessary federal legislation.<\/span><\/p>\n

In the absence of federal guidance, a number of states have introduced their own comprehensive data privacy laws. And as the number of states implementing their own data privacy regimes continues to grow, so does the burden of ensuring compliance. Despite many similarities, each of these state laws have distinct variations concerning the types of businesses that must comply and what protections are granted to consumers. These discrepancies leave consumers confused about their rights and businesses with the burden of meeting each state\u2019s unique requirements. Comprehensive federal regulation would help address both of these issues by giving consumers a uniform set of rights and streamlining compliance requirements for businesses.<\/span><\/p>\n

Requirements and enforcement under the ITPDCA<\/strong><\/span><\/p>\n

While existing federal laws focus privacy and protection on specific types of data, the ITPDCA will apply to a wide range of personal information including financial, health, genetic, biometric, and geolocation data, as well as information regarding individuals\u2019 sexual orientation, citizenship and immigration status, social security numbers, and religious beliefs. In addition, businesses and websites would be required to provide clear and understandable privacy policies, written in \u201cplain English.\u201d<\/span><\/p>\n

The ITPDCA would create a unified national privacy standard by preempting conflicting state laws. And while the legislation parallels many aspects of existing state legislation, it includes several key requirements. The bill aims to make privacy the default, requiring companies to provide consumers with an opt-in consent form before collecting sensitive information such as financial, health, and location data. It also gives individuals the ability to opt out of having their personal data collected at any time and requires companies to tell consumers if and why their information is being shared with third parties. However, under the bill\u2019s liability shield provisions, companies will not be held responsible if third-party contractors fail to provide opt-in or opt-out consent. Additionally, companies using over 250,000 individuals\u2019 personal data per year would be required to obtain and publish a privacy audit\u00a0every two years\u00a0from a neutral third party.<\/span><\/p>\n

While the ITPDCA does not provide individuals with a private right of action, it puts enforcement front-and-center. The bill charges the Federal Trade Commission with enforcing the legislation and promulgating additional regulations as it sees fit. State Attorneys General would also be authorized to pursue enforcement when the FTC chooses not to act on a violation. If passed, the law would provide the FTC with $350,000,000 in additional funding and order the agency to hire 500 new full-time employees to facilitate enforcement under the Federal Trade Commission Act\u2019s existing unfair or deceptive acts or practices regime.<\/span><\/p>\n

A promising step towards federal regulation<\/strong><\/span><\/p>\n

The bill is widely considered to be business-friendly and has already received support from industry stakeholders and trade organizations including the National Retail Federation, the\u00a0Main Street Privacy Coalition, and the\u00a0U.S. Chamber of Commerce. Additionally, the legislation is in a strong position to gain bipartisan support due to its federal pre-emption provision and lack of a private right of action, making the ITPDCA a strong adversary on the path to federal data privacy regulation.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Lydia Bayley Associate Editor Loyola University Chicago School of Law,\u00a0JD\u00a02022 While the COVID-19 pandemic undeniably pushed many legislative agendas to the backburner, some seem to be heating back up. With the 117th Congress now in session, data privacy is once again moving to the forefront of federal legislative debate. For decades, the United States has …
Read more<\/a><\/p>\n","protected":false},"author":64,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[571,573,833,1205,1623,1690],"class_list":["post-3876","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-data-privacy","tag-data-regulation","tag-federal-regulation","tag-journal-of-regulatory-compliance","tag-cybersecurity","tag-regulation"],"_links":{"self":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/3876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/users\/64"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3876"}],"version-history":[{"count":0,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/3876\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}