Details still elusive on possible federal data privacy standard

There appears to be growing bipartisan consensus across multiple congressional committees, the Federal Trade Commission and tech companies that some national data privacy legislation is needed in part to harmonize with European rules, eliminate the confusing patchwork of state-level laws and protect U.S. consumers against Equifax-style breaches. But as ever, details and a timeline on new legislation remain unclear.

All five FTC commissioners testified at a Nov. 27 hearing of the Consumer Protection, Product Safety, Insurance and Data Security subcommittee of the Senate Commerce Committee.

According to FTC chairman Joseph Simons and other commissioners, the agency doesn't have enough resources or authorities to go after abusers of consumer data.

"In my view, we need more authority" in order to carry out enforcement against data misuses, Simons said, adding that any federal privacy law must include three elements: the ability to seek civil penalty for unlawful conduct, jurisdiction over nonprofits and common carriers, as well as rulemaking authority.

Subcommittee chairman Sen. Jerry Moran (R-Kan.) said that the FTC needs "additional authorities…to accomplish greater levels of privacy and data security in this country… I can be convinced — and may be already convinced — they need more financial resources to appropriately perform their duties today."

Committee Democrats want to make sure that any new federal standard includes consumer protections that are on par with the General Data Protection Regulation in the EU or in California statutes.

Rohit Chopra, one of the two FTC Commissioners appointed by Democrats, said that federal law should respect those states which have elected to enact strict data privacy laws.

"We need some clear rules of the road at the federal level," Chopra said, but added that "broad preemption [of state laws] would be a huge mistake."

Moran said the California and EU provisions offer "a way to at least have negotiations about a national standard."

Both Blumenthal and Moran said they want significant bipartisan support on legislation and expect a bill to be introduced early next year.

Some privacy advocates are less keen on turning to the FTC for data privacy enforcement.

Caitriona Fitzgerald, chief technology officer and policy director at the Electronic Privacy Information Center, noted in past cases of data protection, the FTC has "has failed to use the authority it already has."

"Given the enormity of the challenge, the United States would be best served to do what other countries have done and create a dedicated data protection agency," she said.