EPIC Statement for the Record on American Privacy Rights Act

April 17, 2024

Dear Chair McMorris Rogers and Ranking Member Pallone: 

The Electronic Privacy Information Center (EPIC) commends you and Senator Cantwell for returning to the table to work on bipartisan comprehensive privacy legislation. The American Privacy Rights Act (APRA) represents significant progress toward the goal of enacting meaningful privacy protections for all Americans. EPIC looks forward to working with you to strengthen the bill. 

We face a data privacy crisis in the United States. Americans are constantly tracked: Every website we visit, app we open, article we read, ad we linger over, even what our friends are reading and where they are going is collected and connected to other data about us all to target us with more ads. These commercial surveillance systems are fundamentally inconsistent with the expectations of consumers. This mass data collection heightens security risks, enables data misuse, threatens autonomy, and perpetuates manipulation and discrimination.

We commend the sponsors of the APRA for recognizing that in order to meaningfully protect Americans’ privacy, these harmful business practices are going to have to change. The APRA’s core protections are based on a concept that has long been a pillar of privacy protection: data minimization. The APRA sets a baseline requirement that entities only collect, use, and transfer data that is “necessary, proportionate, and limited” to provide or maintain a product or service requested by the individual (or pursuant to certain enumerated purposes). This limitation will better align company’s data collection practices with what consumers expect. We commend you for including strong data minimization rules in the APRA. 

But if the APRA is to preempt existing and future state privacy laws, it must be stronger than current state laws and resilient to future shifts in technology and business practices. EPIC has long argued that federal privacy laws should set a floor, allowing states to enact stronger protections. We still believe this is the best approach and would prefer that the APRA set that standard, but we recognize that compromise is necessary to enact a federal law that would protect the privacy and civil rights of all Americans. 

However, the privacy landscape in the United States has shifted considerably since the American Data Privacy and Protection Act was introduced in 2022. Over a dozen states have passed comprehensive privacy laws of varying strength. Just this month, Maryland passed a privacy law that includes data minimization standards and civil rights protections modeled after provisions in the American Data Privacy and Protection Act. Maine, Massachusetts, and Vermont are all considering similar bills. Companies have already started investing in compliance with the California Consumer Privacy Act and the extensive regulations issued by the California Privacy Protection Agency. Other states will likely also rely on California’s regulations to provide guidance to businesses regarding compliance with their own privacy laws. Washington state enacted the My Health, My Data Act to establish strong protections for health data. 

We believe that the current status of state privacy laws will make the preemption compromise in APRA very difficult both for businesses to follow and courts to decipher – but there are possible solutions. The current privacy landscape is similar to the situation that preceded the Clean Air Act, and we believe the preemption provisions in that law offer a solution that could be adopted in the privacy context — states would be permitted to seek a waiver of the preemption provision if they can show that their law provides a greater degree of privacy protection. EPIC is happy to follow up with the Committee with additional details and draft language if interested. Rulemaking authority for specific provisions in the bill such as algorithm impact assessments and design evaluations would also help the law keep pace with technology.

Privacy is a fundamental right, and it is time for Congress to act to protect the privacy rights of all Americans. The American Privacy Rights Act presents Congress with the best opportunity it has had in decades to stop the very real data abuses and privacy harms that are happening every minute of every day, but it must meet the moment we are in in 2024. We commend you for your work on this critical issue and look forward to continuing to work with you to finally enact meaningful privacy protections for all Americans. 

Sincerely,

Electronic Privacy Information Center (EPIC)