Optimism on this subject may seem naive. Congress, after all, led off its last session teasing a solution that has yet to materialize. Yet there is reason for hope: President-elect Joe Biden is on the record expressing his support for protecting Americans’ personal information. The incoming White House could give the Senate Commerce Committee the push it needs to reconcile the two promising proposals from Chairman Roger Wicker (R-Miss.) and ranking minority member Maria Cantwell (D-Wash.). These two senators ought to shake hands on moving a bill in the first quarter of 2021 no matter whose party ends up with a majority. After all, their drafts find agreement in areas that years ago were bereft of any hint of consensus — and even in the areas where they diverge, there is ample opportunity for compromise.
Individual rights to control, access and delete data seem to be a given in any forthcoming law, as are some form of limits on collection and processing. Those limits are perhaps the most important part of the package. Congress must ask companies to look out for their consumers rather than continuing to ask consumers to look out for themselves, ideally by imposing duties of loyalty and care based on reasonable expectations. What’s required of a business should be proportionate to the size of the business and the scope of its data collection. These matters and more may be devilish in their details, but, broadly, lawmakers seem primed to concur.
The trouble lies where it has been from the beginning of these negotiations: in preemption of existing state privacy laws and in enforcement. Lawmakers have settled themselves on opposite sides of the spectrum on both points, but there’s plenty of room in the middle. Federal rules could override state rules only where the two conflict, for instance, and the override could sunset so that Congress could revisit the need for localities to fill in any gaps. The enforcement debate rests on the wisdom of individuals’ right to sue, but there are ways to prevent nuisance lawsuits that enrich only trial lawyers — by setting a high bar for demonstrating violations, or by limiting recovery to actual damages.
The Facebook case is only the latest example of its kind. Worried, as Sen. Amy Klobuchar (D-Minn.) said this month she is, about who accesses data from those sleek wearable health devices? Concerned that coronavirus contact-tracing tools provided by private companies will hoover up irrelevant information to sell targeted advertisements? The answer to all such concerns is, and long has been, a federal privacy framework.