CONGRESS FIRST tried to pass a privacy law in 1974. Lawmakers succeeded, but lobbying from financial services companies ensured that it applied only to the government, not private firms. Impetus to regulate privacy in the private sector waxed and waned over the next 30 years, building with the first tech bubble, then evaporating in the horror of the 2001 attacks. In 2012, Barack Obama tried again and failed.
Almost half a century after their first effort, politicians are having a fourth go, triggered by the Cambridge Analytica scandal. Some have already offered their own bills, and work is now under way to knit all those into a bipartisan offering. Ranking Republicans and Democrats held two hearings on Capitol Hill this week with the explicit goal of informing the federal privacy bill. The discussion was familiar to privacy wonks—how transparent data collection should be, what limits there should be on it, how to avoid burdensome regulation—but the environment in which it took place suggests it might be fourth time lucky.
Big tech companies are on board, owing to a mixture of self-interest and a sincere feeling that something must be done. Their policy teams regularly meet the congressional staffers who are drawing up the legislation. A bill is expected to be introduced before the August recess, probably in the Republican-controlled Senate. What all sides do not yet agree on is what the bill should say.
The core controversy is over whether a new federal law should override what some states have already done. The disagreement hinges on California, which adopted a new privacy law last year which will go into effect in 2020 and is broadly aligned with European regulations. Republicans and tech companies want the federal law to supersede California’s rules, replacing them with a something more permissive. Democrats want any federal law to match California’s standard.
California is not the only state threatened by pre-emption. It would also kill a law in Illinois regulating the collection of biometrics. In Vermont, rules that regulate the opaque business of data-brokers would disappear. Rules that are in draft form in at least ten state legislatures would be wiped away. Those who oppose pre-emption see this as a step backwards, away from strong privacy rules. Those in favour think it is good to try to harmonise a complicated patchwork of state rules.
Including pre-emption in the federal bill presents a political problem, regardless of beliefs about the correct level of privacy regulation. Any federal law must pass through a House presided over by Nancy Pelosi, from California’s 12th district. It is hard to imagine the House, which contains a powerful bloc of Californian Democrats, undermining the Speaker’s state.
The regulations are not just a domestic concern. European courts, both national and supranational, are examining whether American regulation measures up to that in Europe. If it does not, that would mean that the personal data of Europeans cannot flow to America for processing, hurting American internet companies. A set of regulations which keeps Europe happy is therefore in the interests of both politicians and tech companies.
It seems likely that some common ground exists. There is broad agreement that a level regulatory playing field would be good for companies and citizens, while the need to keep the American data-processing market open to Europe is obvious. Even so, disagreements about just how sharp to make America’s new privacy rules may yet derail their creation.