Even before the death of George Floyd added urgency to issues of racial equity, it has been clear that federal privacy legislation cannot and should not pass without a provision bringing to bear civil rights laws on how personal information is used. This is why a May 25th, 2022 letter from major civil rights organizations, joined by a broad coalition of civil rights, consumer, and privacy organizations totaling 57 signers, is a big deal. It signals that federal privacy legislation “during this session” of Congress is priority for civil rights organizations, and, with support from a spectrum of advocacy organizations, it frames elements that are included in existing bills and can garner bipartisan support.
I have written previously that, based on Brookings convenings of various cross-sections of stakeholders and numerous conversations with individual ones, it was clear privately that a broad swathe of stakeholders both understood the bargains needed to pass privacy legislation and were ready to make them. Now, the May 25th coalition letter makes this posture public on behalf of most of the organizations on the civil society side of the privacy debate.
The letter focuses on civil rights online and was spearheaded by the Leadership Conference and the Lawyers Committee, which have been the point organizations for civil rights language, but it also includes bullet points covering additional major elements of privacy legislation, several of which are addressed in proposals from both Democrats and Republicans. The letter effectively acknowledges as much, stating: “[t]here are many avenues to enacting comprehensive data protections.”
Broadly, the civil rights coalition is calling on Congress to enact privacy legislation “[p]rohibit[ing] [the use of] personal data to discriminate on the basis of protected characteristics.” This simple framing resembles not only an abbreviated version of the civil right provision in a 2019 bill from Senate Commerce, Science & Transportation Committee chair Maria Cantwell (D-WA) but also language in a draft bill from Republican staff of the House Energy & Commerce Committee in November of 2021. The latter was surprisingly well-received among civil rights groups, and since then had provided a basis for bipartisan discussion. If Republicans and civil rights groups can converge on this issue, that is a huge step toward privacy legislation.
The list also includes “[p]reserv[ing] state civil rights laws and other types of state laws that are important for the protection of consumers and marginalized communities.” This implies federal preemption of other state legislation — a notable step away from what has been the position of numerous organizations involved, and of bills like the 2019 Cantwell legislation that federal law should allow states laws that go further in protecting privacy. The coalition letter opens the door for preemption of inconsistent state laws with certain carve-outs, along the lines of the approach recommended in the June 2020 Brookings report on bridging the gaps in the federal privacy debate.
Another substantive issue in the coalition’s letter is a right to bring private lawsuits. That is a sticking point for some in industry but, at a Senate hearing in September of 2021, both industry witnesses and Republican senators opened the door to a private right of action “with guardrails.” The May 25th coalition letter is not specific about the scope of a private right of action, but there are reports of progress toward bipartisan agreement on some form of private action.
Now, it’s up to Congress. Can legislators show the same kind of pragmatism as these advocacy groups?
At this point, several bills from both sides of the aisle propose better, stronger privacy protections than proposed legislation of the past — including the 2012 Obama Consumer Privacy Bill of Rights that I helped frame. And all signs, from whatever signals emitted from what has been a tight-lipped negotiation among committee leaders in both houses, indicate that negotiators have bipartisan agreement on most of the points covered in the coalition letter. The reported sticking points are on other issues that have been peripheral to the privacy debate.
Congress has never been this close to a comprehensive privacy bill capable of passage, but the call to action from civil rights nudges it even closer. It would be a shame to miss this opportunity to put in place long overdue protections of individual privacy, including protection against discrimination in the use of personal information. Another one may not come for a long time.