A big privacy law is moving through Congress. So why do privacy hawks hate it?

Privacy legislation is the white whale of American politics, at once obsessively sought after, and frustratingly out of reach. A bipartisan, bicameral bill called the American Privacy Rights Act, which is being considered by the House Energy and Commerce Committee on Thursday, promised to change that. The bill would give people the ability to access and delete data collected on them, limit the amount of data that can be collected on people in the first place, and include new requirements for data brokers.

And yet, despite its potential to overhaul some aspects of internet privacy, a new version of the bill has provoked an outpouring of opposition from all corners of the privacy and civil rights community, including groups like the ACLU, the Lawyers’ Committee for Civil Rights Under Law, and the Center for Democracy and Technology. The latest draft of the bill, opponents argue, has been disastrously watered down and would roll back data protections that states across the country have already put in place.

At the core of critics’ concerns is that the draft no longer includes a key anti-discrimination provision that would bar any entity covered under the law from collecting, processing, retaining, or transferring certain data in a way that would enable discrimination on the basis of people’s age, race, religion, or other protected characteristics. Such anti-discrimination provisions have become table stakes for any major piece of privacy legislation of the last several years, including a similar proposal that cleared this same House committee handily in 2022. 

But according to some of the new draft’s critics, the provision ran up against significant conservative opposition, to which the bill’s co-sponsors, apparently conceded in order to move the bill forward. “It was a bad bargain because the bill just fundamentally does not work without civil rights protections,” says David Brody, managing attorney of the Digital Justice Initiative at the Lawyers’ Committee for Civil Rights Under Law. “You need some guardrails to ensure that data doesn’t get used for harmful and predatory purposes, and that’s the function that the anti-discrimination provision serves.”

The Lawyers’ Committee joined dozens of other civil society groups in a letter this week asking the House committee to postpone a markup of the bill planned for Thursday. “Our number one goal here, in addition to providing really meaningful protections for privacy, is to also ensure that these protections don’t cause more harm down the road or have unintended consequences,” says Cody Venzke, senior policy counsel in the ACLU’s national political advocacy department, which also signed onto the letter.

In a statement, a spokesperson for the Energy and Commerce Committee said, “We’ve heard loud and clear from our constituents, parents, businesses big and small, and advocacy groups across the political spectrum about how critical it is that we empower Americans with the right to privacy. We are fully committed to doing the hard work necessary to get it done.”

Other provisions that were stripped from the latest version of the bill include a line item that would have required algorithms that are involved in “consequential decisions” to go through periodic impact assessments. This would have included algorithms that decide whether people get access to housing, educational opportunities, insurance coverage, healthcare, and more. Another nixed line item would have allowed people to opt-out of letting algorithms make such consequential decisions altogether. “If you release an algorithm that’s going to systematically, say, prevent women or people of color or people with disabilities from being considered for jobs, that could have discriminatory effects at a mass scale before you realize the harm that you’re causing,” says Venzke.

It’s worth noting, as the ACLU and others have repeatedly argued, that algorithmic discrimination isn’t exempted from existing civil rights laws. But Venzke says new regulations are required since the laws already on the books often rely on whether someone was intentionally discriminated against. Proving intent can be difficult when the discriminatory decision is made by a machine. The important thing is protecting people from receiving disparate treatment by those machines. “These new provisions would provide a more flexible standard to ensure our traditional civil rights protections are applicable in the 21st century,” he says.

While the erasure of civil rights protections from the bill inspired an explosion of opposition over the last week, other aspects of the bill have long been points of contention. The most notable is the fact that the bill would preempt a broad swath of state privacy laws that are already in effect. Since 2018, more than a dozen states across the country have passed privacy laws. Business groups have argued for years that this trend is creating an unworkable patchwork and have called on Congress to intervene with a federal privacy law that would create one unified set of rules for the whole country. Privacy groups have, meanwhile, pushed back against preemption provisions, saying they would effectively put a lid on states’ ability to respond to new threats.

“All Americans deserve strong privacy rights, but if the [American Privacy Rights Act] passes, it would weaken existing privacy protections in the states,” Ashkan Soltani, executive director of the California Privacy Protection Agency, which administers California’s data privacy law, said in a statement. 

It’s not just generalized state privacy laws that are at risk, argues Venzke, but laws that are specific to a given region as well. One such law he says would be undone by the federal bill is New York City’s Tenant Data Privacy Law, which puts limits on how landlords and third parties can use data from tenants’ keyless entry systems on apartment buildings. “States should be able to provide protections for specific sectors that have unique concerns, and states have been doing that for decades,” he says.

While the committee’s markup of the bill is expected to go forward Thursday, there’s still a good chance the bill will die before ever reaching a full House vote. According to Politico, House Speaker Mike Johnson and Majority Leader Steve Scalise asked Chair McMorris Rodgers to remove their own disfavored provisions of the bill before moving it forward, including a section that would allow individuals to sue businesses for violating the law. McMorris Rodgers, who is retiring this year, has made passing data privacy legislation a key priority before her time is up. 

But if the bill is bound to die in committee, critics argue, all the more reason to put the current draft back on the shelf. “If it’s dead on arrival on the House floor,” Brody says, “then there’s no need to waste any more of the committee’s time.”

https://www.fastcompany.com/91147238/a-big-privacy-law-is-moving-through-congress-so-why-do-privacy-hawks-hate-it?partner=rss&utm_source=rss&utm_medium=feed&utm_campaign=rss+fastcompany&utm_content=rss