Is Federal Privacy Legislation On The Horizon?

With a new presidential administration scheduled to take over in just a few short weeks (as well as a revamped Congress), employers nationwide would be wise to anticipate a continued push for federal consumer privacy legislation.

Over the last several years, in the absence of comprehensive legislation at the federal level, we’ve seen a proliferation of state-level regulation of consumer data privacy. Most notable among these has been the California Consumer Privacy Act (CCPA) which, for good or bad, has served as a model for other states considering similar regulation of consumer data.

We recently considered what a Biden Administration may mean for employers generally, and recently took a deep dive into expected privacy legislation specific to healthcare employers. But it’s also prudent to take a closer look on what federal legislative activity we can anticipate overall.

Contact Tracing Likely Immediate Focus Of Activity…

Like almost every area of public policy, federal discussions around privacy in 2020 focused primarily on COVID-19 implications, particularly concerning privacy issues associated with contact tracing. In fact, we saw dueling proposals from Senate Republicans and Senate Democrats. In April, Republican Senators introduced the COVID-19 Consumer Data Privacy Act, which would have required certain companies to obtain affirmative express consent from individuals prior to collecting, processing, or transferring their personal health, geolocation, or proximity information for the purposes of tracing the spread of COVID-19.

The next month, Senate Democrats introduced their own proposal – the Public Health Emergency Privacy Act (PHEPA). This proposal would have protected personal data collected in connection with COVID-19 from being used for non-public health purposes. PHEPA also contained both public and private rights of action, increasing the litigation stakes for businesses.

While neither of these proposals advanced in 2020, the ongoing nature of the pandemic makes it likely that Congress will focus immediate privacy attention on issues related to COVID-19, contact tracing, and other related issues.

It’s too soon to tell what might be included in such legislation, but taking a look at the prior Senate Republican and Senate Democrat proposals will be telling. This legislative discussion is likely to come up very early in the Biden administration.

…But Comprehensive Privacy Legislation Also On The Agenda

Aside from legislative proposals specifically related to COVID-19 and contact tracing, most observers anticipate that more general consumer privacy legislation will be high on President Biden’s agenda over the next four years.

As discussed above, the lack of comprehensive federal privacy legislation had created a vacuum for states to step in. This had led to a patchwork of state privacy laws that can create a compliance challenge. Therefore, it is anticipated that there will be a strong push for federal legislation during the Biden administration. Here are two keys issues to look out for in any federal proposal:

• Preemption – A key question will be whether any federal privacy legislation preempts state laws (like California’s CCPA). Employers and businesses (especially those who operate in multiple states) would likely favor one comprehensive federal framework. But other key stakeholders have expressed concern about any preemption of state laws that may go further. For example, a majority of the California congressional delegation has expressed their intent to oppose any federal privacy legislation that preempts state laws. This is likely to be a key aspect of the federal debate.
• Private Right of Action for Enforcement – Another key question will focus on enforcement. Will businesses merely have to worry about agency enforcement of any privacy legislation? Or will Congress open up the proverbial “can of worms” by authorizing private rights of action against employers and others by private plaintiffs? This outcome will play a key role in determining the potential financial impact of any federal legislation on businesses. Will the costs be merely compliance? Or will this be added to the laundry lists of other areas in which businesses need to fear private litigation?

Conclusion

Only time will tell which legislative proposals are brought forward in the Biden administration and which, if any, are enacted into law. But the overall likelihood of federal action has definitely increased. Congress will likely tackle COVID-19 related privacy matters first, but the overall privacy discussion is not going away. Keep in mind that Vice President-Elect Kamala Harris made consumer privacy a cornerstone of her efforts as a Senator (and before that, as California’s Attorney General).

Fisher Phillips will continue to monitor what is sure to be an eventful four years and provide updates as appropriate. Make sure you are subscribed to Fisher Phillips’ Alert System to get the most up-to-date information. For further information, the attorneys comprising the Fisher Phillips’ Privacy and Cyber Practice Group are ready and equipped to assist as you navigate the ever-changing landscape of data privacy legislation.