House Hearing on Federal Privacy Law Takes Aim at GDPR, CCPA

A U.S. House of Representatives hearing on consumer privacy largely dismissed the EU’s General Data Protection Regulation and the California Consumer Privacy Act as the basis for future federal privacy legislation. But there was consensus that the status quo is unsustainable, with some arguing that the nationwide adoption of certain GDPR and CCPA principles is necessary in the U.S.

Many at the Consumer Protection and Commerce subcommittee hearing "Protecting Consumer Privacy in the Era of Big Data stressed" the need for federal action in the face of growing instances of data misuse by Silicon Valley. However, there were adamant calls, mainly by Republican members on the committee, that the U.S. should not follow in Europe’s footsteps in enacting a regulation as far-reaching as the GDPR.

Rep. Cathy McMorris Rodgers, R-Washington, for instance, argued that the GDPR is detrimental to the free market and has tipped the scales in favor of large tech companies.

“Millions of dollars in compliance costs aren’t doable for startups and small businesses, and we have already seen this in Europe where GDPR has helped increase the market share of tech companies while forcing smaller companies offline,” she explained.

Rep. Greg Walden, R-Oregon, added that the GDPR has also burdened consumers with a host of required notices. “We should avoid creating a system that floods people’s inboxes with privacy policies they do not read,” he said.

In addition, other witnesses and committee members stressed how the law has prevented access to certain newspapers, such as the Chicago Tribune, and to the WHOIS domain registration database in the EU.

With the pushback on the GDPR, it was little surprise that many also dismissed the CCPA, which was drafted in line with the EU regulation’s principles, as a way forward for U.S. privacy.

Testifying at the hearing, Roslyn Layton, visiting scholar at conservative think tank American Enterprise Institute argued, “It’s not fair that one state gets to dictate privacy for everyone else.”

Dave Grimaldi, executive vice president for public policy at Interactive Advertising Bureau, also stressed that the California law could lead to higher litigation costs, singling out one of the law’s provisions requiring enterprises to hand over personal data to consumers upon request under a specific timeline.

“And if it doesn’t meet the timeline, it is in the violation of the law,” he said, noting that, with the potential for thousands of requests, “that’s something smaller companies wouldn’t be able to deal with.”

Grimaldi called for a single federal privacy law to replace the patchwork of state privacy laws, which he said “have incredibly negative effects on the digital economy”—a sentiment echoed several committee members throughout the hearing.

But even with the pushback against the GDPR and CCPA, there was acknowledgement, primarily by Democrats on the panel, that some of the laws’ protections were needed in the U.S.

Rep. Jan Schakowsky, D-Illinois, who is the chairwoman of the subcommittee, pointed out that the current privacy notice and consent system in the U.S. is far from consumer-friendly. She said that vague and inaccessible privacy policies are “the limitation of the notice and consent system we have right now. … A person should not have to have an advanced law degree to not be taken advantage of.”

In her opening statement, Nuala O’Connor, president and CEO of the Center for Democracy & Technology, also noted that current consent processes for many programs and applications is too passive and automatic. “Notice and choice are no longer a choice, and any privacy legislation that currently cements the status quo of the notice and consent is a missed opportunity.”

In addition to consent processes, the hearing also highlighted shortcomings in online discrimination protections. Brandi Collins-Dexter, senior campaign director at online civil rights organization Color Of Change, said that, under the current legal paradigm, companies are able to collect data on consumers in order to charge different prices or market certain products to a particular racial or socioeconomic group.

While Collins-Dexter noted that there are “are certainly issues with GDPR and improvements to be made with CCPA,” she said an opt-in data consent requirement is needed in the U.S. to force companies to be more circumspect with the data they collect. “I think we should be looking at all of this right now. Companies have financial incentives to collect as much information as they can and store it forever.”

To be sure, the dearth of federal laws regulating how companies can operate in the digital economy was not lost on many committee members.

“There is no general federal law that requires a company to have privacy policy … and no general federal law to require companies to protect data,” said Rep. Kathy Castor, D-California. She added that, while the Federal Trade Commission, can to go after companies for data misuse, it is only under the narrow purview of “deceptive or unfair acts.”

For some committee members, the agency’s limitations is of significant concern. “The FTC's enforcement actions have done little to curb the worst behavior in data collection and security,” Schakowsky said. “It is important to equip regulators and enforcers with the tools and funding’s necessary to protect privacy.”