Big Tech Clashes with Brick and Mortar Group over Liability in Privacy Hearing

Big companies providing technology services shouldn’t be able to hide behind their consumer-facing customers when seeking compliance with bipartisan federal privacy legislation, according to a witness who spoke in favor of provisions being considered by the House Energy and Commerce Committee. 

“We think there are some innovations in this bill that are extremely helpful, that is, it spells out in statute what the various responsibilities are,” for various entities in the internet ecosystem, said Doug Kantor, general counsel for the National Association of Convenience Stores. “Some previous bills have left those things to contract. And that's just a prescription for saying the bigger company with more market power will decide who's liable and how these responsibilities get doled out.”

Kantor testified before the committee Tuesday on a draft of the American Data Privacy and Protection Act, which has the support of leading House Democrats and Republicans as well as Sen. Roger Wicker, R-Miss., the ranking member of the Senate Commerce Committee. 

Kantor and fellow witness John Miller, senior vice president of policy and general counsel for the Information Technology Industry Council, both acknowledged the significance and credibility of the legislative effort given the span of partisan stalemate that precedes it over issues like the preemption of state privacy laws. 

The compromise bill preempts all but a few specific state laws, including one that governs biometric information in Illinois. It describes responsibilities for “covered entities,” including the implementation of data protection measures deemed reasonable by the Federal Trade Commission. And covered entities are described as “any entity that collects, processes or transfers” the data—including personally identifiable information—to be protected. 

But those functions are pretty broad, and one prominent policy measure that fits the dynamic Kantor described is Europe and the United Kingdom’s General Data Protection Regulation. 

“The [draft American Privacy and Data Protection Act] does not carefully distinguish between the different types of entities that use data or their obligations,” Miller said. “In particular, the draft does not clearly differentiate the responsibilities of covered entities, or ‘data controllers,’ and service providers, or ‘data processors.’ This so-called controller-processor distinction is made clear not only in the GDPR, but in all five state laws. Given the complex and variable relationships between entities using data, it is essential to clearly delineate between the roles and responsibilities of controllers and processors for privacy law to function effectively, including to apportion potential liabilities, and the draft should be modified to more clearly define these entities rather than lumping them in their obligations together.” 

While GDPR distinguishes between data controllers—entities making decisions about how the data is used—and data processors, which have fewer responsibilities under the law, it does describe situations in which multiple entities act as “joint controllers.” That should sound familiar to customers of cloud service providers struggling to implement a shared responsibility model with their vendors for ensuring cybersecurity.

Kantor said, while the bill takes a significant step in preventing big tech companies from negotiating away their responsibilities in the contracting process for joint control of data, with what are often “boring old brick and mortar businesses,” it should be further improved.

“We appreciate that you've avoided that pitfall,” he said. “We do think that there's more that can be done in this bill to spell out those responsibilities, so that it's clear everybody needs to comply with each part of the bill … There are ways in which some of these big technology companies, as service providers, will not need to fulfill those responsibilities. And that responsibility may fall on the brick and mortar business or other consumer facing business. And that liability we don't think is right. And frankly, we don't think—for consumers—that they should be put in the position of not getting the rights that it looks like they should have in the bill because those service providers can hide behind the customer facing business.”