While top U.S. businesses are pressuring Congress to advance a federal privacy bill, a Senate hearing on Wednesday highlighted the difficulty that lawmakers will face in crafting such a measure.
Representatives from Google, Twitter, Amazon, Charter Communications, and AT&T agreed on a few basic requirements for the legislation, namely that it should be less prescriptive than the European privacy law that went into effect earlier this year and preempt the California law slated to go into effect in 2020, as well as any similar laws that other states may choose to enact.
The bill, the executives said, should also contain a legal definition for what constitutes personal identifying information, create consistent requirements across businesses of all sizes and types, ensure that consumers are in control of their own data, and that the Federal Trade Commission is in charge of enforcing the measure.
Support for specifics beyond those broad contours, however, becomes murkier, and the tepid backing for some proposals is indicative of the challenges in winning broad support.
One key question that lawmakers must answer is how to define personal identifiable information.
Google views it as any data that directly identifies an individual user, Chief Privacy Officer Keith Enright told the panel. That would exclude information like browser or purchase history or other information that companies like Google use to customize advertisements to a specific individual. Opinions are sure to split around whether to extend the definition to include such data, as the European law did.
Executives at the hearing were also asked whether they would support an opt-in requirement for data sharing, which would force companies to obtain consent before using any personally identifiable information to cater offerings to consumers.
Rachel Welch, senior vice president at Charter Communications, said such an approach “is the best way to empower consumers.” But representatives from Google, Apple, Twitter, and AT&T were less enthusiastic.
“Opt-in, we think, is very appropriate in many circumstances, but maybe not all,” said Bud Tribble, vice president for software technology at Apple. “There’s some risk of going overboard here.”
Google’s Enbright said an opt-in requirement “could really impair the usability” of services that his company offers and “disincentive users from engaging.”
Even in areas where there is broad agreement, the officials were hesitant to give a full-throated endorsement. While they all said the FTC should remain the regulatory body in charge of enforcing any new privacy law, none of the five panelists were able to say whether the it should be given enhanced rule-making authority.
“We are always worried about unfettered discretion in an agency,” Andrew DeVore, vice president and associate general counsel at Amazon, told the panel.
Any privacy framework from Congress is months away, if not longer. The outcome of the 2018 midterm elections in November will help shape the agenda for the next two years, and any discussion on privacy legislation could change dramatically if Democrats win the House, the Senate or both.
The Trump administration can move forward unilaterally — and is doing so as it solicits comments from stakeholders on a privacy proposal — but would be limited in creating a mandatory policy.
Previous voluntary frameworks, like former President Barack Obama’s “Consumer Privacy Bill of Rights,” faced stiff opposition. And the panelists at Wednesday’s hearing all agreed that any new regulations must be mandatory and apply consistently to all businesses, regardless of size or industry.
But when Sen. Richard Blumenthal pressed the panelists on why Congress should not adopt the basic principles that are consistent across both the California law — which several of the companies opposed — and the European law, no one weighed in.
“I think that question lingers here, it will linger after this hearing,” the Connecticut Democrat said. “I really hope that you will be at the table sincerely, seeking to frame answers that protect American consumers.”
