The American Data Privacy and Protection Act, or ADPPA, would create the first nationwide rules for collection, retention and disclosure of personal information by technology companies and other organizations, including nonprofits. It would require them to disclose the type of data they collect and what they use it for and would allow individuals to access and correct personal data, block use of certain types of sensitive data and prevent use of their personal information for advertising.
The measure would also prohibit personal data use that discriminates on the basis of race, gender or sexual orientation. For example, when a bank uses technology to determine who is eligible for a mortgage, employers use artificial-intelligence tools to review job-seekers, or a college relies on those methods to admit students, ADPPA would forbid procedures that disproportionately screen out members of under-represented groups. And, two years after becoming law, it would allow individuals whose rights were violated to sue for damages.
With bipartisan support, the bill was approved by the House Energy and Commerce Committee Wednesday on a 53-2 vote. Both opposing votes came from California Democrats, Reps. Anna Eshoo of Palo Alto and Nanette Barragán of Hermosa Beach ( Los Angeles County). Both said the measure would hurt Californians by pre-empting Proposition 24, the privacy initiative approved by California voters in November 2020.
The ADPPA "threatens Californians' right to access, delete and prevent the sale of their information by overriding California law," Eshoo said in a statement after the vote. "While I'm sensitive to industry concerns that we don't create a patchwork system of regulations, Congress has historically addressed this by allowing states to enact stronger protections when practicable and compatible. States need flexibility to respond to changes in technology and expand rights where necessary."
Newsom expressed similar concerns in a letter Tuesday to the committee chair, Rep. Frank Pallone, D- N.J. While the bill was "an important policy step to protect privacy," the governor wrote, "it should not come at the expense of the fundamental protections Californians already enjoy."
California Attorney General Rob Bonta issued a similar statement, leading a group of chief law enforcement officers from 10 states.
"We urge the federal government to enact legislation that creates a floor, not a ceiling, and which will allow us to continue building on state privacy laws that currently exist," Bonta said in a letter to members of Congress.
But the committee rejected Eshoo's proposed amendment that would have allowed states to enforce their own data privacy laws once the federal law took effect. Attorney David Brody of the Lawyers' Committee for Civil Rights Under Law, which supports the ADPPA, said passage of the amendment would have killed the bill because of Republican insistence on a uniform nationwide standard.
"Pre-emption is what is necessary for bipartisan support, and only a bipartisan bill can get 60 votes in the Senate," Brody said.
California's Prop. 24, approved by 56% of the voters, strengthened an existing state law that allowed consumers to require businesses to delete their personal data or prevent them from selling it to others. The initiative expanded those categories of data to include information about a person's health, genetics, race, ethnicity, sexual orientation, sex life, union membership, religion, philosophical beliefs and precise location.
It was opposed, however, by the American Civil Liberties Union and the Consumer Federation of California, which said it did not go far enough. One objection was that Prop. 24 left intact a state law allowing businesses to charge higher prices to customers who refused to have their data sold.
The ACLU gave a mixed review this week to the proposed federal law, saying it contained important protections but had the same price-increasing flaw as Prop. 24 and should be amended to let states enact stronger laws.
But Brody said analyses by his organization and other advocates of privacy rights have concluded that the federal legislation is stronger than California law in most ways. For example, Brody said, the ADPPA has much tighter restrictions than Prop. 24 on the collection, use and transfer of a person's health data and other personal information. He said it also has stronger protections against discrimination and goes further in allowing suits by individuals whose rights have been violated.
Compared to the California law, the federal legislation is "clearer on minimization, with strict regulations on what businesses can do with sensitive data and on advertising uses of data," said Alan Butler, executive director of the Electronic Privacy Information Center, which also supports ADPPA. And in response to state officials' requests, he said, the federal bill was amended to authorize California's Privacy Protection Agency, created by Prop. 24, to enforce the federal law in the state.
©2022 the San Francisco Chronicle. Distributed by Tribune Content Agency, LLC.
