TheCorporateCounsel.net

Privacy compliance is getting more complex – and costly – as state-by-state laws proliferate. This Morrison Foerster memo flags possible federal legislation that will be important to watch. Here’s the intro:

In the wake of numerous privacy bills introduced in Congress over recent years, on June 3, 2022, three key House and Senate committee leaders released the first bipartisan and bicameral discussion draft for a comprehensive federal privacy bill. If enacted, the proposed American Data Privacy and Protection Act (the “Act”), to be enforced primarily by the Federal Trade Commission (FTC), would largely preempt state privacy legislation recently implemented in California, Virginia, Colorado, Utah, and Connecticut, as well as possible future privacy legislation in other states. It would also afford to individuals across the nation extensive rights to correct, delete, access, and port their covered data, and require covered entities to comply with general data governance principles such as data minimization and restrictions on data retention. Unlike the majority of its state counterparts, the Act offers U.S. residents a conditional private right of action against covered entities for violations. The Act would go into effect 180 days after enactment—a short timeframe as compared to the state privacy laws that were enacted in recent years.

Because Congress will be in recess for much of the month of August, followed by the 2022 midterm elections, there is only very limited time in the current legislative session for Congress to come to an agreement on the Act, including controversial provisions like those relating to the private right of action of individuals and the preemption of state laws. If it does not pass this legislative session, a version of this bill could be reintroduced in the next legislative session, although which party controls each chamber of Congress and the resulting committee assignments in the next legislative session will impact the bill’s likelihood of passage. Although the prospects of enactment remain uncertain, this bill represents the most concrete effort to date to pass a national privacy law in the United States, and, as a result, organizations that have been focused on compliance with state privacy laws should monitor the development of this bill as they continue to review and refine their privacy compliance program.

This write-up from The Hill says that the bill is facing opposition and is unlikely to pass… but it’s a start.

– Liz Dunshee