Bipartisan Draft Bill Would Fortify Children’s Data Privacy (3)

House and Senate committee leaders released draft bipartisan legislation on data privacy on Friday, the first sign of movement on the issue after years of stalled negotiations.

The draft measure from House Energy and Commerce Committee Chair Frank Pallone (D-N.J.), ranking member Cathy McMorris Rodgers (R-Wash.), and Senate Commerce, Science, and Transportation Committee ranking member Roger Wicker (R-Miss.) includes robust enforcement mechanisms and a focus on children.

It reinvigorates the prospects for a privacy law after talks faltered at the end of 2019, with the federal government trailing behind state legislatures in enacting rules. Technology companies and consumers alike are eager for a uniform data protection regime in the country, as people fret over how their data is used.

The draft legislation lacks support from a crucial lawmaker—Senate Commerce Chair Maria Cantwell (D-Wash.)—jeopardizing the chances of the draft bill’s formal introduction and final passage. A spokeperson for Cantwell said her office was still reviewing the bipartisan draft, and took issue with a four-year delay on private rights of action.

“In the coming weeks, we will be working with our colleagues on both sides of the aisle to build support and finalize this standard to give Americans more control over their personal data,” the three lawmakers said in a press release.

Earlier: Tech Companies Couldn’t Force Arbitration Under Draft Bill (2)

Private Right of Action

The “three corners” bill allows people to sue technology companies directly four years after the bill’s enactment to allow businesses to get up to speed with the new requirements, and to give consumers time to understand the law.

The issue of private rights of action had been a major sticking point in talks. Cantwell, who has her own draft privacy bill, also continues to differ from her counterparts regarding how to prohibit companies from imposing pre-dispute mandatory arbitration on consumers, which is typically seen in terms of service agreements.

“For American consumers to have meaningful privacy protection, we need a strong federal law that is not riddled with enforcement loopholes,” Cantwell said in a statement on Friday. “Consumers deserve the ability to protect their rights on day one, not four years later.”

Cantwell’s bill would prohibit such mandatory arbitration in cases of “substantial” privacy harm, defined as harm to an individual worth $1,000 or more, or certain physical and mental harm. The effort is meant to give consumers the choice to resolve disputes in a public court of law instead of through a paid arbiter, which some see as favorable to companies.

The bipartisan bill only states companies wouldn’t be able to enforce pre-dispute arbitration agreements with respect to minors, a narrower definition. It would also allow private right of action for specific claims, including those alleging violations of kids’ privacy.

Children’s privacy became a major bipartisan concern after whistleblower Frances Haugen, a former employee of Meta Platforms Inc.‘s Facebook, testified before Congress last year that social media was harming underage users.

The draft bill bars companies from targeting advertising at children 17 and younger, and from transferring the data of kids aged 13 to 17 to third parties without their express affirmative consent. It would also establish a Youth Privacy and Marketing Division at the Federal Trade Commission to enforce its provisions.

Common Sense Media, a nonprofit focused on children and technology, said it is urging lawmakers to come to an agreement this year.

“We have been disappointed that this issue, which the vast majority of Americans believe should be addressed, has eluded agreement for too long,” Jim Steyer, the group’s founder and CEO, said in a statement. “This draft should include stronger protections, but that there is a lot here, and certainly enough for leaders in the House and Senate to do the hard work now and reach a landmark privacy agreement this year.”

The FTC would also be required to study the feasibility of a one-stop-shop for consumers to opt out of targeted advertisements across multiple websites—and create one if it’s possible.

Duty of Loyalty

Duty of loyalty, which means companies place the interests of their consumers before their own, was a second area that led to an impasse in talks between Cantwell and Wicker, according to a source familiar with the negotiations.

Cantwell’s bill includes broad placeholder language that would prohibit companies from engaging in deceptive or harmful data practices.

“Americans also deserve a law that imposes a duty of loyalty on the companies that collect and monetize personal data so that the companies cannot abuse that data,” she said in her statement.

Duty of loyalty language in the bipartisan bill would have companies commit to collecting and using only the minimum amount of data that is necessary to provide the service requested by consumers. The FTC would define what is “reasonably” necessary.

The duty of loyalty provision also puts more rigid restrictions on the use of certain sensitive data, such as Social Security numbers and intimate imagery.

To contact the reporter on this story: Maria Curi in Washington at mcuri@bloombergindustry.com

To contact the editors responsible for this story: Anna Yukhananov at ayukhananov@bloombergindustry.com; Loren Duggan at lduggan@bgov.com; Robin Meszoly at rmeszoly@bgov.com