▶ 0:14:39The chairman recognizes himself for five minutes for an opening statement. Good morning. Welcome to today's legislative hearing on federal comprehensive privacy reform. After years of debate, I'm pleased to see to the critical issue and discuss the secure data act legislation, I believe, will establish a national standard that protects american consumers and provides much
▶ 0:15:10Needed certainty to businesses across the country. Whether it's your favorite restaurant, your hometown newspaper or the corner gas station. Every business, no matter the size, uses digital technology these days. These innovations bring enormous benefits to everyday americans and help ensure that our country remains dynamic and competitive in an increasingly digital world.
▶ 0:15:38But today, when americans ask if their personal data is protected, the answer depends entirely on which state they're in. Unfortunately for the millions of americans that live in states without a comprehensive privacy law, the answer is no.
▶ 0:15:56This is unacceptable, as far as I'm concerned, not only for consumers, but for the small and mainstream businesses navigating confusing patchwork of state mandates. The secure data act takes the best ideas of the state privacy laws, and incorporates many of the ideas developed over the past several years.
▶ 0:16:21It seeks to establish meaningful consumer protections while creating a uniform national standard that promotes innovation, economic growth, and regulatory certainty. I would like to thank doctor joyce for leading the committee's privacy working group and all the working group members and their staff for their efforts today. This group, I think doctor joyce did an outstanding job personally.
▶ 0:16:50This group was tasked with finding consensus on a difficult subject while balancing consumer protections with business certainty. Their work has laid an important foundation for today's discussion. I look forward to working with you, our colleagues across the aisle and the stakeholders, so that we work to advance the strong, the strongest bill possible.
▶ 0:17:16So I want to thank everyone here on the panel, and I will yield back the balance of my time. And I'll recognize the ranking member, miss schakowsky, for her five minutes for an opening statement. >> okay. Thank you. You know.
▶ 0:17:47>> until now, democrats and republicans have worked together. Um, and on privacy and these important issues. But right now, democrats have really not been included, which is very distressing to, to, to me. Um, but, uh, the. >> consumers, yeah.
▶ 0:18:20>> corporations. Cannot be over consumers right now. And, um, the. >> this, this. Rick allen. Ralph norman. >> so I want to, I'm going to yield right now to rob mullen for his comments. >> thank you. Ranking member schakowsky.
▶ 0:18:48Americans overwhelmingly feel powerless over how their information is collected, used, and shared. And the evidence suggests they have good reason to feel this way. Information on whether someone has been to an abortion clinic or searched for information about addiction treatment can be easily bought and sold. Cars are transmitting driver location data to insurers.
▶ 0:19:13Gig work platforms are using nurses personal financial data to set individualized pay, offering lower wages to those who appear most in need of work. Foreign adversaries have legally purchased location data that could be used to track active duty U.S. service members. We know how to address these problems.
▶ 0:19:34My home state of california enacted the nation's first comprehensive consumer privacy law in 2018 and has continued to strengthen those protections, giving consumers greater transparency and control over how their personal information is collected, used, and shared. And in a recent congress, this committee has also proposed strong bipartisan privacy legislation.
▶ 0:20:00Unfortunately, this secure data act is not that the legislation before us today moves in the opposite direction. It protects companies that profit from personal data, places the burden on consumers to fight for control over their own information, and undermines stronger state level protections already in place. So I urge my republican colleagues to work in a bipartisan basis on meaningful privacy protections that put consumers in control of their personal information.
▶ 0:20:29And with that, I yield back to the ranking member. >> does the ranking member yield back? >> and I yield back. >> okay. Thank you very much. Now I'll recognize the chairman of the full committee, Mr. guthrie, for his five minutes for an opening statement. >> thank you very much. I want to thank my good friend. Thank you, chairman, for having us. My good friend ashley watts, ceo of the kentucky chamber of commerce, for being here. And this can be a bipartisan bill.
▶ 0:20:58Matter of fact, the model of this bill is what happened in our commonwealth, where we have a very prominent democrat governor and a super majority republican legislature that put a bill together that's very similar to what we're doing, that does protect individuals and also ensures that we can still be competitive in the world. We're not competing with europe to regulate. We're competing with with china to innovate. We have to innovate and also protect, uh, protect individuals data. So it's a crucial time and I'm glad that we're here.
▶ 0:21:27I believe the security act secure data act does protect individuals data and allows us to flourish and to make sure we're the world leaders. Doctor joyce has really led this this effort. Doctor joyce, when we first started this congress was chair was vice chair of the full committee and took this on. He has done a fantastic job with the staff, and I would like to yield the remainder of my time to doctor joyce for talk about. And thank you for the great job that you've done.
▶ 0:21:55>> thank you, chairman guthrie, and thank you, chairman bilirakis. At the start of this congress, you gave the privacy working group a tall order. Find a path forward on federal privacy reform that protects consumers, enables beneficial use of data, gives businesses the certainty that they need, and can earn consensus among committee republicans.
▶ 0:22:15As we saw in the 118th congress, reaching agreement on comprehensive privacy legislation is not easy, even among members on the same side of the aisle. We cannot and will not take that consensus is for granted. The secure data act is a result of 15 months of the working group's efforts.
▶ 0:22:38Reaching this consensus was only possible with strong collaboration between members of the working group, who are all original co-sponsors of this legislation. Thank you for your partnership, and thank you to your dedicated staff who spent countless hours on this issue reviewing more than 250 rfi responses, taking hundreds of meetings with stakeholders, and working through difficult policy questions to reach agreement on legislative texts is no small task to the
▶ 0:23:09Stakeholders who engaged with the working group. Thank you for your thoughtful contributions. Many stakeholders have already expressed support of the secure data act, and I'm grateful for this support as we work to move this bill through regular order to the house floor, to my colleagues on both sides of the aisle. I look forward to engaging with you to advance the secure data act and produce the strongest bill that is possible.
▶ 0:23:34This legislation is built on the foundations laid by more than 20 states, red states and blue states and purple states. The states have sketched a path forward for us that protects consumers, provides certainty for businesses, and offers a strong foundation for bipartisan federal privacy legislation. All of these issues are significant components of the secure data act. I look forward to today's subcommittee discussion as we work to advance this legislation.
▶ 0:24:03And again, thank you, chairman bilirakis. And I yield back to chairman guthrie. >> thank you. Thank you, Mr. chairman. Give a job to doctor joyce and he gets it done. So I next will recognize the chairman of the full committee, actually the ranking member of the full committee, Mr. pallone, for five minutes for an opening statement. >> thank you, chairman bilirakis. When it comes to data privacy, it's clear what americans need.
▶ 0:24:32They need a national privacy law that puts the focus on companies to collect and use data responsibly. They need their sensitive data used only for limited purposes that they control. They should have the ability to easily opt out across all data brokers and websites, selling their data, or using it for invasive, targeted ads, rather than opting out one by one. And they need to know that their data will be kept safe from data breaches and misuse, and that they can pursue legal remedies.
▶ 0:25:01If it's not, they need protections to ensure their data won't be used to discriminate against them, and our nation's kids and teens need the strongest possible protections for their data. Now, the republican bill before us today does not meet that mark. The partizan secure data act is not the strong, enforceable standard its sponsors describe. Instead, this bill locks in the failed notice and consent status quo, and then compounds loophole upon loophole to water down its provisions.
▶ 0:25:30And then, to make matters worse, it adds expansive preemption that will leave many americans with fewer privacy protections than they have today. Rather than taking the strongest consumer protections from the existing state privacy laws, this bill is assembled from industry friendly state privacy laws that have been pushed by big tech.
▶ 0:25:50It's therefore no surprise that this bill allows big tech and others to continue their ongoing privacy violations, and unfortunately, these intrusions will only get worse as they push to insert artificial intelligence into every corner of our lives, supercharging both incentives to gather every bit of personal data and the potential harm that could result. A future with ai chatbots that can tailor personalized recommendations to our unconscious wants and algorithms that can set prices based on intimate details.
▶ 0:26:21Demand strong privacy guarantees for all americans, and in fact, these privacy guarantees are more important than ever. And I have fought for years for data minimization standards to shift the burden of protecting americans privacy from consumers to the companies that profit off of their data. But the secure data act is so-called data minimization provisions. Those provisions allow companies to collect and use data however they choose, as long as it's disclosed in the fine print.
▶ 0:26:48So this is just another notice and consent by different name. It continues to impose unreasonable burdens on consumers. They should not be forced to become privacy policy experts every time they visit a website or download an app. The sweeping preemption in this bill would not only eliminate hard won privacy protections that millions of americans currently enjoy, but would also invalidate any state law that relates to the bill.
▶ 0:27:12The legislation would prevent maryland, for example, from continuing to protect its residents by ensuring their sensitive information is not sold. It would prevent californians from being able to delete their data from all data brokers in one step, and it would invalidate state laws on wiretapping, on robocalls, data breach notifications, civil rights, and kids online safety. Not only are these existing laws preempted, but states will be forever apart from addressing the future privacy harms that emerge with new technologies like ai.
▶ 0:27:41So I've long supported bipartisan, national comprehensive privacy legislation, but previous bipartisan compromises like the american privacy rights act, the american data privacy and protection act, they recognize that a federal privacy law must exceed the strongest protections of any state and not set a weak ceiling.
▶ 0:27:59These compromises also put consumers in control of their personal information, prioritize data minimization, protecting kids and teens, and included algorithmic accountability measures. And all of this was paired with strong enforcement to make these protections meaningful for consumers. Such a compromise remains, in my opinion, the only path forward to truly protect american privacy. And I want to stress, Mr.
▶ 0:28:26Chairman, that, you know, although I'm being very critical of this bill, I still think that we can come to a compromise similar to what we've done in the past. But this is not it. And so I have to criticize what's here today and hope that we can work for a better bill. And with that, I yield back. Mr. chairman. >> I thank the ranking member. Thanks so very much for your comments. And we will work together.
▶ 0:28:50Uh, today our witnesses are, uh, miss kate goodloe, managing director, business software alliance, uh, miss ashley watts, president and ceo of kentucky, kentucky chamber of commerce. Miss katrina fitzgerald, deputy director of electronic privacy information center, and Mr. tyler are bright again. I hope I said that right. Uh, partner of the womble bond dickinson.
▶ 0:29:23So let's start. Let's begin with, uh, miss goodloe, you're recognized for five minutes. Thank you. >> good morning, chair bilirakis, ranking member schakowsky, chair guthrie and ranking member pallone and members of the subcommittee. My name is kate goodloe, and I'm managing director at the business software alliance, or bsa. Bsa represents the business to business technology providers that support companies in every sector of the economy.
▶ 0:29:49Privacy and security are core issues for our members, which is why we are deeply engaged on privacy legislation in the united states, including across the state capitals and worldwide companies of all sizes and in all industries, including manufacturers, automakers, hotel chains and energy companies rely on ai driven business to business tools like cloud computing, collaboration software, customer service platforms, and cyber security services.
▶ 0:30:19Bsa members provide these technologies so that other companies can focus on what they do best, making products and serving customers. The united states needs a national privacy law that is built for the modern economy, one that pairs strong consumer protections with clear rules that limit how companies can collect and use consumers data. We welcome your focus on these issues, and I thank you for the opportunity to testify.
▶ 0:30:44This committee has led congress's work to protect consumer privacy. We urge you to continue that work and to leverage progress made by the states in recent years. In july 2022, this committee approved a comprehensive consumer privacy bill. At that time, just one state had a comprehensive consumer privacy law in force.
▶ 0:31:10Two years later, in april 2024, leaders of this committee released a discussion draft of an updated federal privacy bill. At that time, five state laws had entered force. Now two more years have passed and 22 states have acted past efforts to draft comprehensive federal privacy legislation started from a blank slate, but the landscape of american privacy laws is no longer blank.
▶ 0:31:3622 states, both red and blue, have enacted comprehensive consumer privacy laws. Those laws are remarkably consistent because 21 share the same core structure with a common approach to definitions, rights, and obligations. But this core structure risks unraveling, as at least 30 different amendments have revised, expanded, and changed state laws, making it hard for companies and consumers to keep up.
▶ 0:32:04The secure data act adopts the right structure for protecting consumer privacy nationwide because it is grounded in the laws already passed by states. This is a key difference from prior federal bills. The secure data act uses the same structure of privacy legislation that underpins 21 of the 22 state laws.
▶ 0:32:24It includes a core set of rights for consumers, based on the clear consensus that consumers should have the ability to access, correct, delete and port their data and rights to opt out of activities like the sale of their data, targeted advertising and certain profiling. It also adopts the long standing widespread distinction between controllers and processors.
▶ 0:32:49This ensures its obligations fit companies across the modern supply chain, in which one company relies on many others to serve customers. I want to emphasize this last point, because every company that handles consumers personal data should be required to do so responsibly in a way that fits their role. Grounding federal privacy legislation and the structure already used by state laws is a critical step, and we urge you to continue this important work. Why is it good for businesses?
▶ 0:33:19Well, companies should not have to track 50 moving goalposts to do business in the united states. We need a single, clear set of rules that limits how companies collect and use consumers data. So consumers trust it is used responsibly. Why is it good for consumers? They need rights that do not depend on whether they live in one of the 22 states that have already acted. Consumers data should also be used responsibly and kept securely, no matter where they live.
▶ 0:33:46Of course, for any federal privacy bill to pass into law, it will need to have bipartisan support. As this bill moves through the process, we hope that the text can become a bipartisan product. Privacy has always been a bipartisan issue. In the states, ten democratic governors and 11 republican governors have signed privacy bills. With this structure into law, we look forward to working with both sides of the aisle as this bill moves forward.
▶ 0:34:15We appreciate the subcommittee's leadership on federal privacy legislation, and we urge you to move the secure data act through the legislative process to promote technology adoption across the economy and protect american consumers nationwide. Thank you, and I look forward to your questions. >> thank you. Thank you for your testimony. Now, I'll recognize miss watts. Uh, you're recognized for five minutes. >> yes. Thank you, thank you.
▶ 0:34:41And good morning, chairman guthrie, chairman, ranking member pallone, ranking member schakowsky and members of the subcommittee. Thank you for the opportunity to be here today. I'm ashley watts, and I am the president and ceo of the kentucky chamber of commerce, which is the commonwealth's largest business advocacy association. We represent employers of every size in every sector, who collectively employ hundreds of thousands of kentuckians. I also serve as chair of the U.S.
▶ 0:35:07Chamber's committee of 100, comprised of the chief executives of america's largest state and metropolitan chambers of commerce. Through that role, we have brought together more than 120 state and local chambers and unified support of the secure data act, including the kentucky chamber. In 2024, the kentucky chamber played an important role as a convener throughout the state level. Conversation on data privacy.
▶ 0:35:35We brought together stakeholders from across industry sectors, business organizations, retailers and privacy, security and technology experts to negotiate a balanced, workable solution. The result was house bill 15, kentucky's comprehensive consumer data privacy law. Now, like chairman guthrie said, kentucky is a bit of a unique state.
▶ 0:35:58We have a super majority republican legislature and a democratic governor, house bill 15, which is very similar to the secure act, passed unanimously with strong bipartisan support and was signed into law by governor andy beshear. And it is a law that the kentucky chamber is proud of leaving leading the way. The goal was straightforward protect consumers data and privacy while maintaining an environment where kentucky businesses can operate and compete.
▶ 0:36:26The secure data act asked congress to extend to all americans what kentucky and 19 other states have already put into law. We believe that federal action is urgent because when every state writes its own law, even good policy creates a patchwork. The majority of our businesses at the kentucky chamber are small businesses, and no business, large or small, can realistically navigate 50 state legal strategy to comply with privacy expectations.
▶ 0:36:55Small businesses, in particular, often lack in-house legal teams, chief privacy officers or large compliance budgets. The U.S. chamber's empowering small business report found that nearly two thirds of small businesses are worried that complying with different state laws will expose them to higher compliance and litigation costs, a number that jumped 14 percentage points in just a single year.
▶ 0:37:21A fragmented privacy landscape is estimated to cost the U.S. economy as much as $1 trillion, with 200 billion of that burden falling on small businesses. It is important to note that strong consumer privacy protections and economic growth are not competing goals.
▶ 0:37:42They reinforce each other when customers trust that their information is being handled responsibly, they are more willing to engage, to transact and participate in the digital marketplace, and clear rules help build that trust. The secure data act is built on bipartisan state laws, just like the one we passed in kentucky.
▶ 0:38:03It provides consumers with strong privacy protections, the right to access, correct, delete and import their data, opt out rights and opt in requirements for sensitive information. It has a reasonable data minimization standard, and it establishes a national standard without a private right of action. Every state that has passed this type of legislation has made that same choice because it produces consistent, meaningful outcomes for consumers.
▶ 0:38:31This framework has been signed by nine democratic governors and 11 republican governors. More than 2500 state lawmakers, both democrats and republicans, have voted for it. More than 135 million americans are already protected by it. This is not just a technology policy issue. It is a competitiveness issue.
▶ 0:38:54Kentucky's businesses and all american businesses, especially small businesses, need one clear set of rules of which they can build around. The secure data act provides just that. The model is proven and the consensus exists across party lines. What remains is for congress to act on behalf of the business community. I urge this subcommittee and the full congress to pass the secure data act, the kentucky chamber of commerce, the U.S.
▶ 0:39:22Chamber of commerce, and our more than 120 state and local chamber partners stand ready to support you in this effort. Thank you, and I look forward to your questions. >> I tell you what, those excellent testimony. I appreciate it. Uh, miss fitzgerald, you're recognized for five minutes. >> brett guthrie and bilirakis ranking members, pallone and schakowsky, members of the subcommittee, thank you for the opportunity to testify today. My name is katrina fitzgerald, and I'm deputy director of the electronic privacy information center, or epic.
▶ 0:39:51Epic is an independent nonprofit established in 1994 to secure the fundamental right to privacy in the digital age for all people, and we have been deeply involved in the debate in the states over privacy legislation. We believe privacy is a fundamental human right. There's broad bipartisan agreement that americans need stronger privacy protections. Poll after poll shows that consumers are fed up with the status quo. They don't want surveillance pricing at the grocery store.
▶ 0:40:19They don't want their cars broadcasting their driving habits to their insurance companies. And they certainly don't want U.S. troops put at risk in war zones, because online, private online advertising is a privacy nightmare. America needs a strong data privacy law, but the secure data act is not the right approach. This committee previously approved bipartisan bills that meaningfully protected privacy.
▶ 0:40:43In those negotiations, both sides worked to craft a federal bill that was stronger than the strongest state law. Those bills included meaningful data minimization, heightened protections for sensitive data, limits on data discrimination, and robust enforcement. The secure data act does the opposite. It sets a national standard that is weaker than the weakest state law. We shouldn't be making the floor the ceiling.
▶ 0:41:08You've heard today that this framework has been successful in the states, but it hasn't been successful for the people in those states. What makes it so weak? A core weakness of the secure data act is its lack of a real data minimization rule, right? A secure data act allows businesses to continue collecting and using data however they please, as long as they disclose it. In a privacy policy that we know few consumers read and no consumer has the power to change.
▶ 0:41:36Data minimization only works if it actually limits how much data companies can collect and how they can use it. Now, my eight year old is a huge soccer fan, but every team he joins requires me to download a new app to get the schedule and talk to the coach. Um, if I don't like the app's terms, there's no disagree, but download the app anyway button. There's, you know, I have to accept it or not download the app. Am I supposed to tell my son he can't play soccer because his mom doesn't want her? Data?
▶ 0:42:05Used to train ai systems. Congress shouldn't be passing a privacy law that makes this unfair system where companies get to dictate the terms into law. The secure data act also fails to adequately protect our most sensitive data. Like our location. Data sensitive data should have stronger protection than beyond simply consent, because in practice, that just leads to endless pop ups that consumers grow numb to.
▶ 0:42:30Another significant weakness of the secure data act is that despite its focus on individual consumer rights, it lacks a private right of action. If a company ignores my request to delete my data or opt out, there's no recourse. It's essentially unenforceable. The ftc and state ags don't take on individual cases. This bill has many more weaknesses than I have time to detail in my testimony today.
▶ 0:42:54But the fatal flaw is the combination of these weak rules with the most expansive preemption option available to the federal government. This bill would wipe out decades of state laws causing chaos in our legal system. My testimony includes a list of the hundreds of laws epic believes could be preempted, including those on robocalls, civil rights, kids, online safety and even longstanding privacy torts. This bill would also make it harder to hold big tech accountable in court.
▶ 0:43:19Just last week, meta snapped youtube and tiktok agreed to a $27 million settlement with a kentucky school district where platforms addictive designs harmed students mental health. Many of the claims in that case relate to rules in this bill, so there's no way of knowing whether similar cases could move forward. The weak, weak rules in this bill, paired with its extreme preemption provision, would be a disaster for americans.
▶ 0:43:44I want to emphasize that this the passage of this bill would be a worse outcome for americans than no federal data privacy law at all. The trends in the us are clear companies are abusing increasing amounts of personal data. Ai is turbocharging that abuse, and americans want more protections from big tech. Yet this committee is proposing weaker legislation than it overwhelmingly approved in previous sessions.
▶ 0:44:09Congress should not pass a privacy law that fails to address the very real data abuses and privacy harms that americans are asking them to fix, and it certainly should not strip americans of privacy rights they already have. We know what's needed strong data minimization, heightened protections for sensitive data, limits on data discrimination, and robust enforcement.
▶ 0:44:29The secure data act unfortunately, doesn't meet the moment, but the solutions do exist, and I urge the subcommittee to consider other approaches that give americans the privacy they want and deserve. Thank you for the opportunity to testify today, and I look forward to your questions. >> thank you. Uh, now I'll recognize Mr. brighton, uh, for your five minutes. Appreciate it. >> michael guest ranking member pallone janice schakowsky, members of the subcommittee. My name is tyler brighton.
▶ 0:44:55As a brief housekeeping matter, I'm here in my personal capacity today, not on behalf of any company, organization or, um, I want to, uh, one, I want to say thank you, members, for picking up this effort again. You know, I think we all are in agreement that it is a, is essential, um, priority to get a federal privacy law passed in the united states.
▶ 0:45:19I want to give you guys start with a bit of my background so you can understand the sort of lens that I'm viewing, uh, the secure data act. Um, at the end of up until the end of last year, I was serving as the director of privacy and tech enforcement for the texas attorney general's office.
▶ 0:45:37There I was headed up our efforts to implement and enforce all of the recently passed texas privacy laws that included comprehensive privacy data, broker laws, children's privacy and online safety laws. Um, as part of that, we took a very intentional approach to looking at sort of what harms exist in the united states. Many of our cases were very high profile.
▶ 0:46:04Um, they involved looking into the entire auto manufacture industry, um, several social media companies and several of our investigations ultimately led to litigation. Um, also as part of my role, I had the opportunity to get to know my counterparts in other states.
▶ 0:46:22It was a incredible experience getting to hear what so many states are doing on the privacy front, both advising their legislatures on what is working and what isn't in their privacy laws, as well as figuring out ways to appropriately enforce their law and dedicate resources. Um, at the end of last year, I returned back to private practice at the law firm womble bond dickinson. There, our firm has a very broad client base. We have our origins in the southeast.
▶ 0:46:48Um, and then we've since expanded across the united states. As part of that, we have clients of all sizes, um, in that or in every industry from your brick and mortar to defense, um, you know, to giant online retailers. Um, it is been extremely educational for myself, um, to see what all of these different companies and different sectors care about with respect to privacy.
▶ 0:47:15Um, but enough, enough about my background on the secure data act front, I want to cover, you know, sort of four key points with you guys today. Um, first, there is widespread support and I think that's been echoed by all the other witnesses that americans want a privacy law passed. Companies practices are unclear to consumers. They are learning of new ways their data is being used. It is time to protect those consumers.
▶ 0:47:43In texas, as part of our privacy law, we had to create a consumer privacy complaint database. Um, it took it went online july 1st. By july 2nd, we had our first ten consumer complaints, um, coming from corners of texas, you would not expect someone from laredo.
▶ 0:48:03Um, filed a complaint, uh, asking for a, a, um, oh my gosh, fast food chain to update their privacy policy because it didn't have a right for them to an option for them to delete. Um, not the first company I probably would have looked into. Um, you know, I think all to say there's widespread support on that front. Um, now second point, we now know much more tangible harms.
▶ 0:48:30You know, I think several of our cases focus on how data was particularly sensitive. Data types were ultimately being used to monetize or affect consumers. Um, third, we now know more, you know, when the last time congress pushed forward with this effort, most of the state laws were not in effect. And there's definitely not been enforcement that had occurred yet.
▶ 0:48:51We now have had the opportunity to see which provisions in the laws sort of protect from those key consumer harms, particularly the the tangible harms that we're seeing emerge. Um, and then fourth, um, I think that passing of federal privacy law is crucial. You know, right now over half the states don't have sensitive data protections, meaning by default, companies can collect and use that data however they please.
▶ 0:49:16Trillions of data points are being generated about americans every single day that still go unregulated. All that to say, you know, I am extremely excited for this effort to be moving forward. Um, I think you were actually pretty close on, um, a lot of provisions, which is exciting when I was reviewing this law. Um, that is it for me and I'm happy to answer any questions. >> thank the gentleman. Uh, and now I'll begin questioning and recognize myself for five minutes.
▶ 0:49:45Uh, I share the concerns of many americans that companies are collecting more personal data than is really needed. Uh, at the same time, uh, we've seen how overly restrictive privacy laws like the, like europe's general data protection regulation, uh, throttle privacy, uh, again, private industry and innovation. So, Mr.
▶ 0:50:10Goodloe, how do the secure data act's restrictions on data collection work, and how do they differ from europe's law and past proposals before the committee? Uh, Mr. brodigan, if you want to add something, uh, after Mr. goodloe would appreciate that as well. It's actually a good law, I apologize. >> thank you for the question.
▶ 0:50:41Uh, the secure data act builds on the experience of state laws to create a core, right, core set of rights for consumers and a core set of obligations on companies. Importantly, those obligations extend across the modern supply chain, and they create rules for both controllers, which are the companies that decide how and why to collect consumers data, and for processors, which are the companies that handle data on behalf of other companies pursuant to their instructions.
▶ 0:51:09That is a critical difference from prior federal laws, and it ensures that the obligations created by this act carry across the modern economy. I think it is important that congress pass a law that creates one set of rules for companies to collect and use data so that consumers know it is used responsibly. >> thank you. Mr. brighton. Would you like to add to that? >> yeah. Um, you compared to the gdpr, it's actually conceptually similar.
▶ 0:51:38There are similar restrictions in the gdpr about sensitive data and using consent in order to collect and use that data that that is present in the secure data act. There's a long history. Illinois's biometric information privacy act, washington state's most recent my health, my data act, texas's similar biometric and genetic privacy act that that principle is a is strong. It has led to several of the largest settlements in history in the united states.
▶ 0:52:04I'd also say gdpr takes a more high level approach, um, without being too prescriptive. And that's similar to things we've seen in other contexts in the united states, like the nist cyber controls, right? It's, it's explaining what types of controls you need and what sort of practices, you know, ultimately lead to stronger protections. Um, without being so prescriptive as to require companies to implement or include many specific requirements in a privacy policy, for example.
▶ 0:52:34>> thank you. Next question. There's a view in washington as well as some states that more mandates on business means more protections for americans. Right now, we have 22 comprehensive consumer privacy laws in this country, which may become 24, uh, in short order, it's governors of louisiana and vermont signed the bills on their desks.
▶ 0:52:58Uh, and I know you alluded to this earlier, but these laws sit alongside existing federal requirements for different sectors such as health care and finance and the ftc, the ftc act. So, uh, Mr. brodigan, uh, is the status quo effectively protecting consumers or more state by state laws better than a uniform federal framework?
▶ 0:53:29>> I think there has been a good movement at the state level to increase enforcement, but said at the end of the day, the 50 states having a uniform law to enforce and create precedent around as plus being able to team up with the federal trade commission will create very clear market shifts and privacy practices around the country. Most companies want to good faith comply with the law, but at the end of the day, there's a real effect for the.
▶ 0:53:56When there's a heightened risk of enforcement from several entities, I think a federal law would create that heightened risk for enforcement and ultimately, um, encourage companies to prioritize complying with the letter of the law. >> I have a little more time, Mr. goodloe and miss watts, would you like to add anything? >> I will add that the important piece of a national law is it will it will protect consumers nationwide.
▶ 0:54:21Right now, consumers are protected in 22 states with different state laws. And we need a clear set of national rules that companies can build strong compliance programs toward. I think that will make sure that consumer protections are extended nationwide and that companies know what to do and what to focus on to better protect consumers. >> miss watts? >> yeah. Thank you. >> yes, Mr. chairman, I would echo my colleague's answers on that.
▶ 0:54:47We in kentucky really did kind of question whether we should continue to advocate for a federal law or work on a state law. After several years of no action by congress, we decided that we needed to take matters a little bit into our own hands and pass a law in kentucky. But we absolutely believe that a federal law is the way to go. I'm proud to speak on the majority of my members of the chamber of commerce for small businesses. They want one clear set of standards to be able to comply with, and this is what this bill would do instead of a patchwork of all the various states. >> very good. Thank you.
▶ 0:55:16I yield back the balance of my time, and I'll recognize the ranking member of the subcommittee, miss schakowsky, for five minutes of questioning. >> Mr. chairman. >> Mr. let's see. Am I getting here? Okay, miss fitzgerald, I wanted to ask you. Where are you? There you are. Um, how, um.
▶ 0:55:47>> what is it? How does this bill. >> yeah. How does this bill benefit corporations rather than the american people? >> thank you so much for that question, ranking member schakowsky, because I think it's really important for members to understand a bit of the history of where these 22 state laws came from. Privacy and consumer rights and civil rights groups have opposed those laws in the states.
▶ 0:56:15Those bills originated from a draft that was written by tech giants in washington state. It ultimately did not pass in washington state. But, um, they took it to virginia, first, passed it in 2021, and then brought it to, you know, uh, these, these now 22 states or 21, I guess because california followed a similar, a different path.
▶ 0:56:40Um, and pushed their weak model with the hopes of getting exactly to this moment, coming to congress and saying, this is the consensus in the states, please pass this at the federal level and preempt states from doing anything for all the time on privacy. Those state laws are far too weak to adequately protect privacy, and congress should not be emulating that model. Right? Privacy law should not be written by the very entities they seek to regulate. Um.
▶ 0:57:09This bill also contains about five pages of exemptions and loopholes, uh, corporate carve outs. It makes you wonder what, uh, who the weak rules in the bill will even apply to in the end. Uh, so that's something we really want to be careful of when we're looking at bills as well and who they're protecting.
▶ 0:57:30Um, you know, I'll say as a privacy advocate in the states when it's disappointing to see how quickly the conversation turns to a focus entirely on business compliance. And consumers are almost, you know, they're hardly mentioned. In the end, you almost would forget that you're working on a consumer protection bill in the end as opposed to a business compliance bill.
▶ 0:57:57So I'd say so much work was done on previous bipartisan proposals to come up with a framework that protected americans and allowed businesses to thrive and innovate. Uh, and it's disappointing that the secure data act throws all that out and starts over. And I hope that we can come back to the table and come to a bipartisan agreement on a bill that works for both the american people and our businesses. >> are there other things that we should be doing to make sure that consumers are, um, benefited?
▶ 0:58:28>> I think the key with the privacy law is to make sure that the onus of protecting privacy is not entirely on the consumer and rather the businesses that are collecting, using, profiting off of our data have obligations on the foreign front to limit the amount of data they're collecting and using. It's there's just such a power imbalance that if companies can just write these policies and say, take it or leave it, uh, that that just doesn't, doesn't protect privacy.
▶ 0:58:56They need, you know, I realize that we're trying to put things back in the box because we didn't act on privacy. Um, early on, epic has been asking congress to pass a privacy law for 30 years. Um, but that doesn't mean that we should just allow the status quo to continue. We need consumers need adequate protections online. And I really do think that the solutions exist to do that in a way that would allow our businesses to thrive but adequately protect consumers.
▶ 0:59:25>> what are the things that we need to do to make sure that consumers are empowered? >> we need a strong data minimization rule that limits data collection and use. It says to company, you know, uh, the adpa and the limited data collection use to what was necessary for the product or service the consumer is asking for. So that means that companies have to better align their data practices with what consumers expect. I don't expect my flashlight app to collect my location data.
▶ 0:59:54I expect my weather app to collect my location data, but I don't expect them to sell it to a dozen data brokers. So we want a better, you know, have encourage companies to have this culture of privacy where they're only collecting what they need to provide the service the consumer is asking for. >> thank you. Appreciate that very much. >> gentlelady yields back. I now recognize the, uh, the chairman of the full committee, Mr.
▶ 1:00:24Guthrie, for his five minutes of questioning. >> thank you very much. And, uh, the process by writing this bill that Mr. fitzgerald described, absolutely was not the process in writing this bill. It was, uh, doctor joyce will speak for herself, but we met with hundreds of different people, different groups, and everybody on here wants people's data, data to be secure and to have their privacy and have security. As I said, we're not looking to compete with europe to regulate. We're looking against to compete against china, to innovate.
▶ 1:00:52And we don't want to be china either. We certainly don't want to be europe. Uh, and so the question is, can you find a balance? And that's what we've worked hard to find a balance. And we think that we strongly believe that we have, you know, europe and the united states had the same economy 20 years ago, the same economy 20 years ago, the european economy. And there's a lot of reasons their energy policy. You can't dismiss, uh, that europe that britain has pulled out. But our economy is twice the size of europe today in 15 years, twice the size. So now you got to look at the reverse.
▶ 1:01:22What if our economy today was half the size that is today? Talking about unemployment. You talk about affordability. Talk about all these. So these things matter and things just don't happen in a think tank. Things just happen in academia. Things happen in the real world. And so people's data is being being collected in the real world. And people are trying to innovate and grow their companies in the real world. And so how do we strike that balance? That's what we're looking at. So, miss watts, we heard a lot about big tech.
▶ 1:01:49I know in kentucky we have a lot of small businesses. And you mentioned in your remarks, could you kind of go a little further on how typical kentucky small businesses are affected by this and why they and I don't believe governor beshear was out looking for big tech and for businesses. I think he's trying to make kentucky a business state. I'm not saying he was anti. But I don't think he was. How can we give everything to big tech? I don't think he had that that at all.
▶ 1:02:15And he and it didn't just come from the general assembly because he's been known to veto a lot of bills and they get overridden. But he vetoes a lot of them. So I would have to have to think that he had a hand in doing this too. And so I don't think he's out there trying to to protect big tech at the expense of the consumer. It's been insinuated. >> absolutely. Thank you, chairman guthrie, for that question. You know, we are really proud of our small businesses in kentucky. They are the backbone of our economy, as you know, in your district.
▶ 1:02:41And I always say, you know, I've been at the kentucky chamber now for 14 years leading their advocacy. I feel like I'm pretty good at my job, but it's still really hard to pass a bill unanimously through the kentucky general assembly and have it signed into law by a democratic governor. I think that shows the power of our convening and the power of the consensus that we built around this. It was not just big tech, of course. We had tech at the table. We needed to have their voice be heard. But we also had small businesses.
▶ 1:03:06We had retail, we had restaurant, we had consumers, we had everyone kind of at this table really working together for a consensus based solution. And that's exactly what we did in kentucky. That is really mirrored here with the secure act. And so I think just speaking for it wasn't only bipartisan, it was unanimous in kentucky's general assembly and then signed into law by governor. >> because every business, no matter what size, if they have a credit card portal, is affected by this. >> exactly.
▶ 1:03:32>> if you're a lone person with a store, your family runs your store, you're the and you have a credit card portal, which everybody has to have. Now then you're >> affected by this bill? >> absolutely. And I think, you know. >> any proposal that. >> we do exactly small businesses in our in in your district and throughout the commonwealth want to be a nationwide marketplace. We do a lot of our shopping online. You want that ease and you want your small businesses in the commonwealth. >> and I was in the general assembly. So being a product of the general assembly, you do get a lot more grassroots input.
▶ 1:04:01So my guess is you had a lot of consumers and you had a lot of businesses around the table, as opposed to consumer groups that represent the interests of consumers not out there, their think tanks. And you always got to wonder who's hired the think tank. And the second thing is, and then big tech. So not in kentucky. You didn't have probably the 4 or 5 big titans of big texan at the table with a bunch of consumer groups. It was consumers and small businesses. And that's. And so if you see one of these state laws have developed the way they. They have.
▶ 1:04:27My guess is because they're listening to the people in their state, not because they're just trying to cover up for some other big. This has been insinuated here today. >> so I would absolutely agree. And I would say if small businesses were upset with a law that was passed in kentucky two years ago, I absolutely guarantee you that law would not have been passed unanimously by the kentucky general assembly and signed into law by governor andy beshear. Small businesses in kentucky supported this bill.
▶ 1:04:52Local chambers of commerce all across the commonwealth supported this bill, and that bill has then has now been mirrored a lot in the secure act. I think we're a great example to show the convening power and the consensus building that we built around data privacy in the commonwealth. >> and it's typical of state governments to have those kind of grassroots input. Thank you. And my time. I don't have time to ask another question. I'll yield back. >> you're welcome to ask another question, Mr. chairman. All right. The gentleman yields back. Now recognize the ranking member of the full committee.
▶ 1:05:22Mr. pallone, please. >> thank you, chairman bilirakis, I've long said that the core of any comprehensive privacy standard has to begin with strong data minimization, but the secure data act contains a provision that claims to offer data minimization, but actually allows companies to do anything they want with consumer data with notice and consent. So my question is, Mr. fitzgerald and I actually have four. So I'm going to ask you like to answer them in a minute or so if you could.
▶ 1:05:51So the first one is how does a standard for data minimization and the secure data act compare to the data minimization offered by prior bipartisan federal privacy proposals like the american data privacy act and. And the protect american. Well, the two bills, american data privacy and protection act and the american privacy rights act. Um, and does it provide the secure act any meaningful difference for consumer privacy compared to the status quo? In a minute. >> thank you.
▶ 1:06:20Ranking member pallone epic views data minimization as the most important substantive rule in any privacy bill, and I would hesitate to call what's in the secure data act data minimization. I know that section is titled that way, but it's really data maximization, right? Companies are incentivized to write their privacy policy as broadly as possible, list as many purposes as possible, because the only thing that counts as violation is not disclosing. So they'll just say, you know, we collect your data for marketing purposes that allows them to do anything, doesn't tell anything to consumers.
▶ 1:06:50And in fact, it's basically restating current consumer protection law. So it's not giving them any additional protections because unfair and deceptive trade practices laws already require companies to be truthful in their privacy policies. Whereas previous bipartisan proposals, like you said, limited required companies to limit their data collection and use to purposes that the consumer expected that were reasonably necessary for the product or service they asked for. >> all right. Thanks.
▶ 1:07:18So the second thing is about enforcement, because meaningful consumer protection is only as effective as its enforcement, and that includes cases involving individual consumers who have been uniquely harmed. So the question is, how will the lack of a private right of action in the secured data act impact the law's effectiveness? Will the right to cure further impact the law's effectiveness, and in what way? >> yes. Thank you. We've seen in the states that the lack of a private right of action.
▶ 1:07:49Without it, there's really little incentive for companies to comply with the law because they know the risk of government enforcement is so low. And that's only made worse by the inclusion of a right to cure in the secure data act, because companies know they'll get a jail, a get out of jail free card if government enforces do come knocking at their door, you know, they can just fix the problem and the there can't be any enforcement. Consumers lose in all these situations because they can't enforce their own rights.
▶ 1:08:15And then if a government, a government agency, a state ag, or the ftc does try to enforce, companies can just fix the problem after the fact, even though, you know the harm is already done, your data is already out there, your privacy rights have already been violated, and there's no getting that back. >> all right. And then the third thing, I recently began an inquiry into surveillance pricing to find just how widespread these practices are.
▶ 1:08:40And this includes pricing that can use consumers intimate details to predict when they're most vulnerable and most likely to pay more for the product. So the question is, would the secure data act address the problems presented by surveillance, pricing algorithms and practices? >> no secure act does nothing to address it. Surveillance pricing companies could just say in their privacy policy that they were using your personal data to offer personalized pricing.
▶ 1:09:04And what that will look like for the consumer is they sign up for a loyalty program in the hopes of saving money, and then their personal data is used to determine just how much they'll tolerate paying for eggs, which could be a different price than their neighbor. And secure data act would do nothing to stop that harmful practice. >> all right. And then the last thing is about preemption. The secure data act contains very broad preemption language. It goes beyond what we saw in apra and adpa, and clearly preempts more than state comprehensive data privacy laws.
▶ 1:09:33So the question is, under the secure data act, what is the potential scope of state preemption and how might this affect consumers in states that already have strong protections in the law? >> yeah. So secure data includes the broadest preemption option available to the federal government. Um, preempting anything that relates to the provisions in the bill. And the supreme court has described this form of preemption as deliberately expansive.
▶ 1:09:58I attached a list of the hundreds of laws that epic believes could be preempted to my testimony. That's even a representative list. There could be many more. It's hard to overstate the chaos this will cause in our legal system. Uh, you know, it goes so far beyond just preempting the comprehensive privacy laws that it attempts to mirror. Um, it would preempt longstanding privacy torts.
▶ 1:10:21It would preempt a lot of kids online safety laws like age appropriate design codes, um, laws about robocalls that we all know one wants robocalls back, um, and data breach notification law. So the preemption provision was just written, um, so expansively that everything from, you know, kids online safety to robocalls is at risk. >> thank you so much. Thank you, Mr. chairman. >> I appreciate the gentleman yields back.
▶ 1:10:48Now recognize the gentleman from the great state of california, Mr. obernolte, for his five minutes of questioning. >> thank you, Mr. chairman. Let me begin by saying how delighted I am that we are finally having this hearing. This has been a long road. Uh, it's been an honor for me to serve on the data privacy working group under the leadership of congressman joyce. And let me emphasize some of the points that have been already been made here.
▶ 1:11:15This legislation has been over a year in drafting, and we tried to correct some of the mistakes that have been made in previous efforts by broadly engaging all corners of the stakeholder community. We sat down with hundreds of different groups representing different points of view, and I want to give a shout out to all of our individual staff and the committee staff, because this has been a herculean effort to get to this point.
▶ 1:11:40Uh, one of the things that I think we need to spend more time talking about is how burdensome it is on small businesses to have this complex regulatory landscape of potentially 50 different state laws, currently 22, but potentially 50 different state laws.
▶ 1:11:57As a technology entrepreneur myself, I can tell you that a landscape like that is a barrier to entry to people trying to start new businesses and technology, because what it does is it advantages big tech, because those are the companies not to pick on them, but those are the companies that have buildings full of lawyers. And the the sophistication to deal with the regulatory landscape like that. So if you're a google, if you're a microsoft, you can do it.
▶ 1:12:24If you're two people in a garage somewhere trying to start the next google or the next microsoft, you can't. And, and this is the big challenge that we're trying to solve with one unified federal standard. So, miss goodloe, could you you have many small businesses as part of your organization. Can you talk about just how challenging it is to navigate this landscape of currently 22 different state regulations? >> thank you for the question.
▶ 1:12:48Bsa represents the business to business technology providers that power companies across every sector of the economy, and those are companies of all sizes. When you have to comply with laws on a state by state approach, companies are forced to track 50 moving goalposts. We have 22 state laws already enacted. Several more are awaiting action by governors and amendments that continue to go through the legislative process every day. It is a complicated landscape.
▶ 1:13:17No matter what size your company is. I can only speak for the business to business part of the technology industry, but we think one standard is needed so that companies of all sizes know the rules and know how to comply with the goal of protecting consumer privacy so that consumers trust that their data is used responsibly. >> right. Well, obviously, I would very much agree with you. Um, miss fitzgerald, uh, we could agree to disagree on some of these issues.
▶ 1:13:47You said a couple of things that I found to be kind of inflammatory, and I wanted to, uh, talk about them and give you the opportunity to respond. Uh, one of the things you said is that the goal of this process of creating one federal standard should be to create a standard that's strongest of, uh, stronger than any of the individual state standards. And I very much disagree with that because we tried very hard to take a consensus approach where we took the best of what everything, every state had to offer.
▶ 1:14:15And that would mean, you know, being somewhere in the middle, not the strongest, not the weakest, but, but looking at what worked. The other thing that you said that I take issue with a little bit is said that, uh, this bill is weaker than the weakest state standard and that we would be better off to have no federal standard at all than to pass this bill. And I do take exception to that, because, first of all, the weakest state standard right now is no state standard. We have 22 different state standards.
▶ 1:14:43That means the majority of states have zero for consumers. When it comes to digital data privacy, how can you say that having no bill is better than the protections in this bill? Even if we agree to disagree on how strong those protections should be? >> thank you, representative, and thank you for the opportunity to elaborate on this.
▶ 1:15:04You know, um, we believe at epic, especially where there's a broad preemption provision in this bill, that if the federal law does not exceed the protections in the strongest state law, then congress is taking away privacy rights from americans that they already depend on. >> half the states don't have. They have no privacy rights in half those states. So even if that's true, uh, you're giving privacy rights to consumers that right now have none.
▶ 1:15:34>> but privacy rights that are not necessarily meaningful. And in practice, most businesses are now offering these consumer rights of access, correction and deletion to residents of 50 states because so many states have, uh, these state privacy laws that include these consumer rights. So in practice, you know, the enactment of this bill is going to give americans, even in states without privacy laws, very few rights that they don't already have today.
▶ 1:16:00>> well, I mean, that's the whole goal here, is to create one federal standard that gives everyone the same rights that we all believe that we should have. And I'm hopeful, Mr. chairman, I see my time has expired. I'm hopeful that we can get to a place of bipartisan agreement on this. Obviously, for this to be a lawmaking exercise, we have to get there eventually. Uh, so I hope that we can still continue having this discussion as the bill moves forward. I yield back. >> good enough. I now recognize, uh, miss castor for her five minutes of questioning. >> uh, well, Mr.
▶ 1:16:29Chairman, I'm not going to mince words. I think this bill is an appalling betrayal of hard working americans. Their ability to safeguard their personal information. It's a violation, would just allow violation of their privacy to continue. It wipes away laws across the country that protect privacy. It will lead to higher costs for consumers. Uh, it will further unleash insidious ai surveillance pricing.
▶ 1:16:56It will end state laws relating to unwanted robocalls and spam text messages, and it will gut online privacy protections for kids. Uh, miss fitzgerald, you have an entire section in your testimony about how the gop anti privacy bill will make minors less safe online. Uh, we've debated this a lot in this committee. Will you expand and elaborate on that?
▶ 1:17:27>> yeah, sure. Thank you for the question. You know, states have passed dozens of laws giving kids and teens stronger privacy protections online, um, both as part of comprehensive privacy laws and in age appropriate design codes and other kids online safety rules. Um, and this bill will take those protections away without really, you know, meaningfully replacing them. So it's an example of why I did say that.
▶ 1:17:53I, I do think that passage of this bill would be a worse outcome for americans because, you know, we know how this works if this privacy bill passes, uh, you know, congress will have checked the box on dealing with privacy for decades to come. And these rules will be cemented into law. Technology is changing. We're already seeing the harms that, um, kids are suffering, especially kids are suffering online due to harmful business practices of big tech.
▶ 1:18:20And I just don't think that congress should be passing a federal privacy law that fails to address those harms. >> and it would weaken enforcement of those laws, kind of gut, gut those enforcement mechanisms. In fact, there are many lawsuits right now, uh, that parents and families have brought against the tech companies. What would the impact be? Uh, legally?
▶ 1:18:41>> yeah, the broad preemption provision in this bill would really cause chaos for those lawsuits because, you know, you're talking about school districts and parents and others going against the most powerful companies in the world. And so if those companies have an out to, to argue in court that their claims are preempted by this bill and that they disclosed in their privacy policy what they were doing, there's a question about whether those. >> that is so wrong, that is so wrong, to rip the rug out from under the families and kids.
▶ 1:19:09I mean, the evidence of harm to children online is is very apparent after many years. Um, and I know that they want to I hear the argument, they want to hang their hat on. Okay, we want to, we want one set of rules nationwide. But if you have a very weak, uh, federal standard, that's no protection at all for people's privacy, is it? >> no it's not. I agree that we need a federal data privacy law.
▶ 1:19:38And epic has been asking that for 30 years. But we need that rule to be strong. >> in fact, we had a we had a good bipartisan compromise that we had hammered out here. And it's I think that americans deserve better. They really do deserve to be able to safeguard their personal private data. Some of it is very sensitive. Their personal health data, uh, as well.
▶ 1:20:02And this would just, I think, unleash, uh, the big tech companies ability to mine that data, make us the, the product with no recourse. It's kind of on theme for what this committee has done. If folks don't know what this committee has done, this session, they passed it out of this committee, uh, a complete ban on any ai regulation at all, at all federally or for the states at all. Uh, they've also gutted our kids online safety act.
▶ 1:20:35That is very bipartisan in the senate. Also, the kids online privacy protection act is passed unanimously by unanimous consent in the senate. And here. Uh, I don't know why the tech companies have greater influence. They have gutted that, uh, weaken that. Uh, it just seems like it's another gift to the big tech companies. It's unfortunate that that's the tact of this committee, but I want folks to know what what is going on here. We I just think people deserve better.
▶ 1:21:04They deserve to, to have their privacy protected and not constantly mined and surveilled and then sold. Uh, and I'll, I'll end it there. Thank you very much. >> gentlelady yields back. Uh, we'll recognize Mr. bentz for five minutes of questioning. >> thank you, Mr. chair. Uh, Mr. bridge, again, I just to start with you, and this is just a question I've had for years.
▶ 1:21:29And you say on page four of your testimony, um, consent is generally defined as a clear affirmative act that signifies the customer's freely given, specific, informed, unambiguous agreement to process their personal data. I don't know how many times I've quickly gone through the 26 pages, 56 pages of the consent in other situations and, you know, gone to the bottom box and checked. Yes.
▶ 1:21:54I'm just curious how, how you or anybody would ever suggest that, that we're going to get this kind of under understood consent from anybody in these kind of situations. >> yeah. Thank you for the question. I would like to clarify a couple respectfully, a couple misunderstandings on, um, how consent works in these privacy laws. So texas has a very similar, um, comprehensive privacy law as the secure data act, particularly around consent and sensitive data.
▶ 1:22:22Um, texas is also the only state in the united states that has recovered over $1 billion multiple times using laws that are based on consent. There's no other state that has ever recovered more than $1 billion from a company. Um, so consent in these scenarios is not something as simple as a click through. You know, when you see a banner at the bottom of the screen and say, accept all to privacy policies, it needs to be specific and informed.
▶ 1:22:49Um, texas precedent has texas courts have done a great job on explaining that each one of these adjectives has a meaning, and a company needs to satisfy those specific meanings. So at a minimum, you're going to be able to, you're going to need to be able to demonstrate that a that the company disclosed the, the, what they were collecting the data for and how they were using that data. >> so if I may, I understand the desire to achieve that type of understanding, but what are the odds of that actually happening?
▶ 1:23:21>> if companies will. Part of that relates to the enforcement mechanisms, right? So if there's actually the risk of enforcement, companies are going to take a close look at, um, what they are disclosing and telling consumers and how they're obtaining consent. >> so let's see if I, if I may, the, the way this works, the you harvest this data from millions of people.
▶ 1:23:40And so to suggest that these companies are going to go to millions of people and ascertain that each one has reached that level of consent seems, uh, highly unlikely. So I'm just trying to say, can you explain to me how we're going to reach that level of consent in any meaningful form?
▶ 1:23:59>> so it would be on a going forward basis, obviously, but, um, you would I mean, a company would need to say if it was just a website that wanted to collect sensitive data, that's going to be our position was always that it needed to be a separate disclosure in a short disclosure, not something that is, you know, mixed into a giant privacy policy that nobody reads. It needs to be something that is very clearly informing the consumer. Um, and so, you know, that's like a, you can condense that down to two sentences, but it does need to specifically state like we're collecting your geolocation.
▶ 1:24:29>> data, if I may, I don't want to be too mean to my state of oregon, but our reading, uh, comprehensive test scores are abysmal. So I wonder how anybody is going to read these kinds of things in my state of oregon, uh, and actually understand them. But I want to set that aside because, but it's a terrifically important question because the whole system now seems to be run on llms. And that means all kinds of data.
▶ 1:24:56And what you're basically saying is there's going to have to be a opt in from an educated person who actually gets it. And I don't see that happening. >> I mean, the burden is on under the law. The burden is on the company to demonstrate that they actually obtained specific informed consent. So they're going to have to be, you know, adversely arguing that with the regulator so that it is a burden shifting.
▶ 1:25:20It's not as simple as a notice, um, provision, but that that ultimately will fall on that burden to demonstrate that will be on the company. >> um, uh, miss, what's a state by state regime rewards whoever has the biggest legal and compliance budget. And that's rarely a new entrant. And this goes back to comments already made by previous folks. Uh, so my question is, does the privacy patchwork entrench the largest incumbents at the expense of smaller competitors?
▶ 1:25:49Seems to me the answer is obviously yes, but go ahead and tell me. >> yeah, we we absolutely agree that a federal framework is really the way to go for small businesses. As we have discussed several times throughout this committee testimony, the, uh, the compliance for small businesses and the navigation is really cumbersome and burdensome. So we do believe that a national framework will help small businesses. >> thank you. And I just want to thank the panel, uh, extraordinarily interesting conversation and appreciate it very much. Yield back. >> thank you. Appreciate it. I now recognize Mr.
▶ 1:26:18Mullin for five minutes of questioning. >> thank you, Mr. chair. And thank you all for your testimony today. As I mentioned earlier, I am concerned that the legislation before us today moves us in the wrong direction on data privacy. Not only does it set a remarkably low ceiling for privacy protections, it also overrides the good work that the states have been doing in this arena.
▶ 1:26:40As I noted, california has enacted some of the strongest privacy protections in the country, giving consumers rights over how their personal data is collected, used and shared. These laws are now actively being used by californians to exercise control over their data. Uh, for example, california also recently enacted the delete act, which allows consumers to submit a single request directing registered data brokers to delete their personal information.
▶ 1:27:09Hundreds of thousands of californians have already used this service, and connecticut adopted similar legislation just last week, as I understand it. Uh, miss fitzgerald, can you discuss how the legislation before us today would affect existing privacy protections for californians? >> yes. It would completely wipe out the protections in the california consumer protection act, the privacy act. I'm sorry. Uh, the delete act, california age appropriate design code.
▶ 1:27:39You know, there may be, uh, the california privacy act does cover employees. That might be the only kind of piece that's left since this doesn't cover, um, the employment situation. But, uh, all of the provisions in those laws relate to provisions in this bill. So billions of californians would be left with fewer privacy rights than they have today, and that they have had on the books for eight years now.
▶ 1:28:03Um, and our federal system, congress's role should not be stripping privacy rights, uh, eviscerating hard fought rights that their state legislators have decided they should have. Uh, the delete act has been wildly popular. It's only been, you know, effective since january 1st. And I think something like 300,000 californians have already taken advantage of that to have that centralized deletion mechanism. Um, because we don't know who data brokers are as consumers.
▶ 1:28:32So it's great that they have a, you know, one place to go where they can say, I don't want my information sold by data brokers. And that is conveyed to those companies. Um, and this would just, it would leave californians in a worse place than they are today. >> thank you for that. I also want to walk through a real world example that our witnesses are familiar with.
▶ 1:28:52Uh, texas recently led a suit against an insurance company that used third party apps to collect trillions of miles worth of location data from over 45 million consumers nationwide, and use that information to build what has been described as the world's largest driving behavior database, according to the allegations. Insurers then use that data when setting or renewing consumers insurance premiums under the secure data act.
▶ 1:29:17Even if those allegations are true, the company would have 45 days to remedy the issue without any penalty, even though the data has already been collected, shared and sold. So, uh, Mr. bright, again, you just mentioned texas texas's biometric privacy law and the recovery of billions of dollars for consumers. Um, as I understand it, that law and others hold bad actors accountable even if they later fix any violations.
▶ 1:29:42However, the secure act would give bad actors 45 days to rectify any violations with no penalty if they do. But fixing the problem going forward doesn't undo the harm that the data has already been collected, already been sold, and consumers can't get it back. So why would we want to preempt state legislation with such a provision? >> thank you for that question.
▶ 1:30:07I think that case is actually in very fascinating example of how narrow a cure period really is. Um, texas has a 30 day cure period that was not curable conduct under texas's privacy law. There's actually very few. We've had to do a lot of thinking on what really is curable. So if you collect data about a person without their consent, how do you fix you can't really how do you cure that? Do you delete it? But I would say you already did the harm by collecting their data without their consent.
▶ 1:30:37Deleting it doesn't do it. If you go back and get their consent that arguably you still violated that initial provision of the law, there's not really a way to walk that back. A lot of these data ecosystems are also extremely complex and pursuant to very complex contractual agreements that are negotiated with sophisticated law firms and parties, those have mechanisms that can't really be completed in a 30 to 45 day window.
▶ 1:31:03You know, you say you're, you know, up your counterparty to the agreement big company. How do you and you've sold that data to them? How do you you can't suddenly void that sale of data. And if that company went on and used that data, that would also be another layer of arguably incurable conduct. I kind of I have viewed the cure period as really something that goes first for more of the facial violations.
▶ 1:31:25So not including, um, the right language in a privacy policy, not having your, um, the ability for consumers to exercise their rights working properly. There are even that one might get into incurable conduct. But ultimately, you know, the, that case was a very good illustration of sort of how limited, um, the cure period really is ultimately. >> well, thank you for that. I remain skeptical of the approach before us today. And with that, I yield back. Thank you all. >> gentleman yields back.
▶ 1:31:54I recognize miss lee from the great state of florida. My fellow florida gator, you're recognized for five minutes of questioning. >> thank you, Mr. chairman. What we are doing here today is so important. Americans should not have to surrender their privacy in order to participate in modern life. And parents should not have to wonder whether a child's personal information is being collected, shared, or sold without their knowledge.
▶ 1:32:21The reality is that technology has changed dramatically, but many of the laws governing how we address personal information have not kept pace. I have worked, along with many of my colleagues on this committee, to modernize coppa because the internet children use today looks nothing like the internet that congress attempted to regulate in 1998.
▶ 1:32:43As we consider a national privacy framework, we should reject the false choice between protecting consumers and promoting innovation. We can do both. And I appreciate all of you for sharing your insight about the pathway toward doing that here today. States like my home state of florida have already shown that strong consumer protections and economic growth can go hand in hand.
▶ 1:33:10We should build on those lessons by giving families meaningful control over their children's data, strengthening safeguards for sensitive information, and establishing clear rules that consumers and businesses alike can trust. Mr. bright, again, I want to come back to you.
▶ 1:33:26One of the major differences between the secure data act and some of the existing privacy frameworks that we've been discussing here today is its requirement that companies obtain affirmative consent before processing sensitive information, such as health information, biometric data, or precise geolocation data during your time enforcing texas privacy laws.
▶ 1:33:48What types of sensitive data abuses concerned you most, and how does an affirmative consent requirement help us prevent those abuses? >> thank you for the question, representative lee. When I when I started as, um, heading enforcement privacy enforcement for texas, I did not come in expecting to be focused so heavily on geolocation data.
▶ 1:34:08Um, around that time, the new york times had reported that several car manufacturers were collecting data from people's vehicles directly and ultimately, um, scoring them and sending it on to insurance companies for insurance companies to charge varying rates. Um, that, that I think was sort of a novel use in some ways of geolocation data.
▶ 1:34:27And it sort of to me underscores the importance of having a law that has those tried and true mechanisms like consent, um, that enforcers can apply to different situations as more data types and uses emerge over time. You know, a data ecosystem is incredibly complex, but, you know, there needs to be enough flexibility.
▶ 1:34:47Um, and sort of on those mechanisms that we've seen work in the enforcement context, children's data, I think is extremely, um, will emerge, has emerged and will continue to emerge as, um, an area that requires heightened attention. >> what is your perspective on the biggest privacy risks facing children and teens today? And how does requiring parental consent help get to ensuring that that minor's personal information can be kept safe and parents can stay in control?
▶ 1:35:19>> there is data being collected by children now that I think will stay with them for the next 70 years longer. Um, it it is unpredictable how that data will ultimately be used. Um, it throughout their lives. You know, I think there has not been enough of a focus on sort of ensuring that going from that age of minority to majority, that there's some sort of clear line about what needs to happen with that data. Um, on the age verification front, texas has been a leader in passing, um, children's online safety and privacy laws.
▶ 1:35:51Um, those all come back to age verification. I know congress is pushing forward with an additional children's privacy and online safety package, which I think is a great effort because there is continues to be sort of a blind spot, um, for parents. And then, um, and arguably sometimes intentionally blind spot by, um, companies on as to what is happening on these platforms. >> do you believe that parental consent, in addition to those age verification verifications plays an important role?
▶ 1:36:20And if so, tell us, tell us more about that. >> yes, I think it is key for parents to be in the loop on what is happening. Um, what is being used, what their children's data is being used for and what, um, ah, what features are allowed for children, you know, in the social media context, there's a lot of, there was a lot of focus from our office on sort of what, um, different users could, um, how they could interact with minors and there needs to be some sort of stop
▶ 1:36:51Gap there because they're there. There's just has not been sort of a required, um, demarcation of preventing certain interactions from adults and minors or minors to minors, um, in several of those spaces. >> thank you, Mr. chairman. I yield back. >> I thank the gentlelady. I recognize Mr. vc for his five minutes of question. Oh, miss clark is back. Okay, we'll recognize miss clark. You're recognized. >> thank you, Mr. chairman. And good morning to both of you. And ranking member schakowsky, my colleagues.
▶ 1:37:21And thank you to our panelists of witnesses for joining us today. Anyone familiar with the work and history of this subcommittee knows that for years, I've been stressing the importance of a comprehensive federal privacy framework. While I can appreciate the title of today's hearing, I must address the fact that legislation, the legislation before us today is a nonstarter for comprehensive privacy and data security.
▶ 1:37:46In front of us is a piecemeal attempt at protecting americans online. And to be clear, naming a bill, the secure data act, by no means qualifies it as a comprehensive privacy bill. A privacy bill should actually protect privacy to to level set today's hearing.
▶ 1:38:08We must acknowledge that my colleagues on the right have not only been unserious about americans online safety, they have been actively working against it. Let remind.
▶ 1:38:21Let me remind us all that the party backing this legislation is the same one who has tried to illegally fire the democratic ftc commissioners is insistently promoting sweeping preemption of state ai laws and continues to prioritize big tech over people. Sorry, but I don't trust this proposal as a good faith attempt.
▶ 1:38:45It wasn't too long ago that house democrats and republicans were able to come together and form the bipartisan ai task force that produced a comprehensive report with the intention that it would guide the 119 congress on the necessary next steps at regulating ai.
▶ 1:39:05My colleagues and I have worked to advocate for the inclusion of civil rights priorities in the bipartisan report, and while it could have gone further, I was proud to see that the task force report emphasized the different biases that ai can hold and how that may affect consequential decisions that ai occasionally is employed to make.
▶ 1:39:28I'm beyond disappointed to see that the secure data act has not only walked back on any effort to protect american civil rights online, but has gone as far as to narrow the scope of protections watered down the definition of consequential decision making and preempt state civil rights laws.
▶ 1:39:48When congress works to stymie or dumb down privacy protections and technological and technology safeguards, it is working against the public interest. This bill maintains the status quo. Big tech data brokers will carry on business as usual, collecting and using people's data, whether they know it or not.
▶ 1:40:10Now more than ever, we should be holding companies responsible for failing to keep us from harm when we go online to live up to their promises, when they say they care about our privacy and to hold them to their commitments to ensure that ai systems they create are safe, I implore my colleagues to recognize that this bill is just not. Not it.
▶ 1:40:35This bill will do nothing to prevent or mitigate harm caused. When the data collected and used by company drives discriminatory decisions and will only further harm black and brown americans who will continue to have their data used against them, I move to enter into the record this letter from the leadership conference on civil and human rights into the record. >> without objection.
▶ 1:41:04So ordered. >> well, I thank you, Mr. chairman. And with that, I yield back. >> now, I recognize Mr. falter, the vice chairman of the subcommittee, for his five minutes of questioning. >> thank you, Mr. chairman. The purpose of the secure act is to provide consumers more control over their personal data and create a uniform national framework.
▶ 1:41:27The bill does not include a private right of action, and we've seen downsides of litigation abuse in the privacy space. In other cases. Historically, currently, opportunistic law firms have filed over 4600 suits nationwide, claiming that ordinary internet activity is the use of cookies and pixels and bots and analytical tools constitute wiretapping under various state laws. It's been.
▶ 1:41:54More than 3000 of these suits have been filed just in california alone. So I'm going to just fast forward here. But, um, we've got a situation where one plaintiff has filed 30 lawsuits claiming wiretapping by roofers, plumbers, general contractors, hvac employees, and so on. Another one has filed 30 lawsuits against rocket mortgage, marriott, marriott, hp frontier, and williams-sonoma.
▶ 1:42:19There's many more examples like that, but you get the picture of the issue I'm trying to bring up here. Uh, question for miss. Miss, what's, um, in your written testimony, you mentioned that private rights of actions are used to target small businesses who are incentivized to settle cases, as opposed to engaging in the costly litigation.
▶ 1:42:40Do you think that if the secure act did not contain federal preemption, that we'll see a growth in in litigation, in privacy suits? And just more generically, what are your thoughts of the ramifications if the secure act did not have federal preemption? >> yeah, thank you for that question. I think it's important to note that 22 states have not had private right of action in their legislation. It wasn't even taken out of legislation.
▶ 1:43:09It was never it was never included in the first place. We hear stories from small businesses all the time from other states where they are being targeted by the trial bar, and instead of going through a costly legal system, they are settling for 10,000, $15,000 because it's easier to do that than to fight that that lengthy, that lengthy court system. I think it's also important to note that there is recourse in this bill. And actually in kentucky, that would be strengthened.
▶ 1:43:34Right now in kentucky, our recourse is to go to our state's attorney general, russell coleman, who absolutely has been very communicative with business and with consumers as well, on how to if there is an issue, to complain to his office. He is a former U.S. attorney. He's a former fbi agent. He very much wants to protect consumers and especially children. As it has been mentioned throughout this testimony, I also think it's really important that we make sure that this bill it's clear that it is not it is not going to protect bad actors.
▶ 1:44:03In addition to states going through their attorney generals, there is also the recourse of going to the ftc as well. For a state like kentucky that has passed a state law right now, our recourse kind of our our way of our pathway would be to go to the state's attorney general. Now, uh, consumers could go to the attorney general, but also the ftc as well. So I think it actually strengthens the protections of the states that already have these bills in place. >> thank you for that. I appreciate your comments, Mr. brannigan.
▶ 1:44:31When professional plaintiffs file lawsuits and there's no demonstrable harm, what's the impact of that? And I want to just preface my question by, uh, by just sharing that I've worked in the tech sector before this portion of my life.
▶ 1:44:49And as a matter of course, when an officer of the company would, would sell stock, whether it was in the, um, uh, window of time where that was allowed or not, there would just be a flurry of lawsuits that got filed automatically. And so there truly are professional plaintiffs out there. But when those lawsuits are filed and there's no demonstrable harm, what's the impact of that? >> yeah. Thank you for the question. Back in private practice, we've had to deal with this a lot.
▶ 1:45:19And it comes in waves, and I think underscores both the risks of a private right of action, but also the risk of not having a uniform standard. So, you know, using wiretap litigation as an example, that is, um, legal theories crafted by the plaintiff's bar to essentially, um, claim that someone's privacy rights are, are violated.
▶ 1:45:41You know, it's a, it's a unfortunate model where many of them, um, and this happens in the ada website compliance and tcpa litigation as well, where they will price this opening offer settlement so low that it is, um, more, but it's more than or I'm sorry, it is the opening settlement offer is less than what it would take for a, a company to retain a law firm to respond to the lawsuit.
▶ 1:46:05So they're getting these five, ten, $15,000 on behalf of single consumers over and over and over, um, from, you know, oftentimes several companies will have multiple filed against them in any one time. Um, I think it's very distressing for particularly small, the targets of those are, as miss watts explained, oftentimes small, medium sized businesses that do not have the resources to retain and fight those lawsuits. >> thank you for that, Mr. chairman, I yield back. >> gentleman yields back. I recognize Mr.
▶ 1:46:34Vc for his five minutes of questioning. >> thank you, Mr. chairman. >> um. >> obviously there are a lot of things about this bill that really, you know, worry me. Obviously, we need to do something about data and privacy. I think that everybody agrees on that. Um, but but again, there are just some worrisome language in this bill. And that's just specifically want to ask if. Mr. if Mr. fitzgerald could answer this question, I don't this bill explicitly bars the ftc from enforcing its own civil rights provision and can only pass complaints to other agencies.
▶ 1:47:02I was wondering that if a company is using personal data to deny someone a ride or a loan, or a job based on race or religion or political views, who exactly is going to enforce that? Because that's what I kind of don't understand. >> yes. That is, um, a very problematic, um, provision in this bill, one of many, um, and it's unclear who, uh, a consumer would go to if they are discriminated against online.
▶ 1:47:31Um, you know, there are, it points to other agencies, um, that the ftc would refer those cases to. Um, but the ftc has historically had that authority, um, to protect consumers when, when data is used in ways that discriminate against them. >> yeah, yeah, that's really interesting.
▶ 1:47:51If a company is caught misusing data to discriminate based on someone's race or religion or politics to give them a job, I know that the bill gives them a 45 day grace period to try and cure. Uh, exactly, uh, what's going on? Uh, so they can say that it's fixed no matter how serious the violation may be. And I was wondering, why is it important for a company to get a free pass just because they promised not to do it again?
▶ 1:48:22>> yes. The right to cure in this bill is mandatory. Um, many states that have included rights to cure have either sunsetted them after a couple of years after the bill comes into effect, so that companies have a chance to catch up on compliance, um, for the first couple of years.
▶ 1:48:38And then it goes, you know, it sunsets or they make the right to cure discretionary so that enforcement authorities, you know, can look at a specific case and see that it's curable, um, or decide, you know, not to move forward with that if the violation rises to that level. So I think that those are options that were not included in this bill. And that could have been.
▶ 1:49:00And something else that's missing from the secure act is the strong civil rights protections that were included in the american data privacy and protection act and american privacy rights act that prohibited personal data from being used in ways that discriminate against americans. Um, you know, in many ways, yeah. >> I was wondering from some of the other panelists, does it bother you that there is no language in there to, to, um, to help in those areas, the civil rights. And just to jump in, I would be curious.
▶ 1:49:28I mean, to me, this all seems very problematic. >> we agree this is a really important issue. And in the past, the business software alliance has called for legislation that addresses ai related issues, including this one. We have, though, deferred to congress on whether to combine that with privacy legislation or to address it through standalone legislation. We know it is difficult to pass a federal comprehensive privacy law, and we want to see progress on that.
▶ 1:49:55So it is something where we have really looked to to leaders in congress to decide how best to move these issues forward. >> okay. Well, thank you very much. Um, you know, speaking of that sort of puts the burden on individual consumers to request the deletion of their data, uh, particularly if someone had no idea that their data is being used to profile them and deny services. Um, how would someone be able to make that kind of request on their data?
▶ 1:50:28>> um, yeah. So, um, you know, companies in their privacy policy will are required to explain to consumers how to exercise their privacy rights. So if it's a company that they interact with directly, social media company or retailer's website, um, they would go to the website and either, you know, submit a form or email the company to ask to delete their data.
▶ 1:50:51The problem is that there are so many companies that most consumers have never even heard of, um, that are gathering our data on a, every minute of every day. And so they don't have, uh, they don't know that those companies exist to go to them and ask to delete their data. >> yeah, yeah. And my, my last question, is it problematic that people will sometimes just click on the box to give people consent? Because I'm worried about that.
▶ 1:51:19It's almost like when people clicked on boxes before and they didn't know they were waiving the right to go to trial. Is that a problem that people are just basically, you know, clicking this box to give consent the little pop up box so they can sort of keep moving along without knowing exactly what they're clicking on. Um, and does that, um, is that a fair and transparent way to help consumers? >> I don't think so. Because even if they know what they're agreeing to, there's no choice not to agree.
▶ 1:51:48Usually the proceed button is grayed out until you check the box saying I agree to these terms. So that is not a real choice at all. >> yeah. Thank you very much. Thank you, Mr. chairman. >> thank you. The chair recognizes Mr. goldman for five minutes, please. >> thank you, Mr. chairman. Uh, first, let me thank my deskmate today. Doctor joyce, thank you so much for your leadership on this. Um, for those of you who don't know, doctor joyce and his staff have put insane amount of hours into this. And I just want to thank you.
▶ 1:52:15It's been an honor to work with you on this, uh, as a member of the privacy working group, I'm proud to co-sponsor the secure data act, which is based on consensus privacy laws like those in my home state of texas. Mister bright, again, thank you for being here. Um, great to see a fellow texan. Uh, thank you for your work on data privacy and security at the secure data act. Becomes law with texas still be able to hold bad actors accountable? >> yes. I think to Mr.
▶ 1:52:45Fitzgerald's point, the consent mechanisms, at the end of the day, that shifts the burden to companies to demonstrate to the government if they can't do that, it's somewhat, uh, a side note, whether the consumer understood or not, what was contained in that consent provision. It is the it shift fundamentally shifts the onus on to companies to be able to demonstrate that to the government. Compare that to california, which is the only state of every state that has passed a privacy law that does not require consent. They.
▶ 1:53:12This was alluded to earlier, I think miss fitzgerald's point in california by default, as long as a company includes notice of what they're doing with their privacy law or I'm sorry, with sensitive data in their privacy policy, they are allowed to collect, use, process, sell, whatever. With that sensitive data. It is a sort of, I would say, arguably um, lowest standard for sensitive data of any privacy law in the world at this point. Um, every other state strengthened that requirement with consent.
▶ 1:53:41Some states have taken it further to go to a full on ban. But that is, um, you know, I would say that even goes further than the gdpr, um, on that front. >> super. And based on your experience leading privacy enforcement in texas, can you explain why state attorneys generals and their federal trade commission would be better equipped than private trial lawyers to enforce federal privacy laws? >> yeah, I alluded to this earlier.
▶ 1:54:06The wiretap litigation is a really good example of how there's this sort of different interpretation of privacy laws that is inconsistent with, say, take the california wiretap law compared to california's privacy law. Those provisions, if you comply with california's comprehensive privacy law, that is not does not immunize you from suit by private plaintiffs.
▶ 1:54:26Um, so there's companies that were having to divert resources to, um, limited resource dollars for privacy compliance to focusing on these class action private litigation as opposed to implementing requirements that would be required under california's privacy law. Um, these laws also give government regulators an immense amount of discretion. You know, should a, if, say, a company doesn't include specific language in a privacy policy, should they now be hauled into court and sued by individual plaintiffs?
▶ 1:54:54I would argue that's not really protecting privacy and not in taking dollars away from actually making sure compliance programs are up to snuff. Um, alternatively, because of the care period, because these are highly technical laws, those are much more sort of attuned to government interpretation. Um, in sort of the, the injunctive nature that comes along with government enforcement as opposed to a more, a larger focus on obtaining a monetary settlement. >> all right. Thank you. Miss watts. Thank you very much for coming.
▶ 1:55:23Throughout your testimony, you explained the small businesses are increasingly dependent on data technology and online commerce to compete and grow. Can you explain why the secure data act is important for the success of many small businesses, both in my district, in texas and around the nation? >> yes. Thank you for that question. As I said, most of our members of the kentucky chamber of commerce are small businesses, and they want to grow their businesses. They want to take those businesses outside of the commonwealth and get consumers and customers from all over the nation. And so having a patchwork of laws is very cumbersome and burdensome to them.
▶ 1:55:53So really, what we have been saying is the 22 states that have these comprehensive data protection laws, it really we don't need to reinvent the wheel. We can use what we've done in 22 states that have protected consumers first, but also had businesses have a clear set of guidelines to follow nationwide. I think it's really important for small businesses in particular to be able to grow their business. And as we know, we are a digital world. I know myself as a working mom of two. I do most of my shopping on my phone.
▶ 1:56:22Uh, that is really important to businesses. We had a small business member that is a member of the U.S. chamber of commerce say that if all of the data was gone and kind of this technology ceased to exist, it would be another pandemic for him. So I think we cannot, um, underestimate the power of technology and data for our small businesses to really grow and flourish like we all want them to do. >> thank you very much, I appreciate it. I do want to thank everyone for being here.
▶ 1:56:48It's always great to have a full house and the the general public here attending this hearing. I specifically want to point out we have two young americans. They've been sitting here on the front row the entire hearing without their phones, without playing games. I just want to thank you all for being. You've been paying attention the entire hearing. So thank you all very much for being here, especially. Thank you, Mr. chairman. >> thank you. We can all take a lesson from that chair. And I recognizes the representative from illinois. Miss kelly, please. >> thank you, chair and ranking member schakowsky, for holding this morning's hearings.
▶ 1:57:17And thank you to our witnesses for participating. As has been said, americans want a strong privacy act, but the secure data act does not quite meet the mark and preempts the stronger protections already in place in the states. This piece of legislation keeps the notice and consent model in place, where a company can collect and use data for almost any purpose, as long as it lists that purpose.
▶ 1:57:41Somewhere in a privacy policy, almost no one reads those policies, and the few who do cannot reasonably understand them. In many cases, this is not true consent. Miss fitzgerald, you stated that under this legislation, a company can bundle a necessary purpose, like processing a payment with an unnecessary one, like selling data into a single set of terms. When a consumer clicks accept, do they have any real way to know what they just agreed to?
▶ 1:58:12>> um, you know, I think it is difficult for consumers to know I'm a privacy advocate. I still don't read all the privacy policies. You would do nothing else with your time if you read all the privacy policies, everything you used. Um, so while consent is an important piece of consumer protection, it shouldn't be the only thing standing between consumers and the collection and use of their data. There should be obligations on companies to limit how much data they're collecting and how they're using it.
▶ 1:58:41Because if the only protection is at the end of a long privacy policy, there's a checkbox for accept, and I have to check it in order to use the website or app. That's not a meaningful protection. That leaves me with no choice. Um, in modern day society, um, there's just so many apps that we have to use. Um, and also I want to highlight that, uh, there are protections in many state laws in terms of what consent means that were not included in this bill.
▶ 1:59:10Uh, the protections that Mr. bridget mentioned about making sure that consent isn't just acceptance of broad terms and conditions or prohibitions on dark patterns. There's nothing in this bill prohibiting dark patterns. So that means that a company can just have one big, brightly colored accept button and then, you know, disagrees in small font and requires toggling a dozen buttons.
▶ 1:59:33So you want to make sure that when you are using consent, it's meaningful and that it's not the only protection for consumers. >> thank you, miss goodloe, your members right. The privacy policies, consent screens, consumers every day. And your testimony says a federal law should help people trust their data is used responsibly. That trust depends on people understanding what they agree to.
▶ 2:00:00What standard would your members support to make sure consumers actually understand what their. They are agreeing to? >> thank you for the question, and before I respond, I want to clarify. I represent the business to business part of the technology industry. I know we've talked about the technology industry more broadly.
▶ 2:00:17I represent bsa members who are a very specific part providing business to business technologies, to companies of all sizes across every industry sector, things like cloud computing software that can track inventory and keep track of customer service inquiries, these sort of back end functions that everyday businesses across the economy rely on.
▶ 2:00:35Very often it is those other companies, the consumer facing companies, who are creating this sort of privacy policy to tell consumers what they're going to collect from the consumer, how they're going to use that information. I think the bill that is before this committee today reflects both of those roles by being anchored in this long standing distinction between controllers who decide how and why to collect data and processors who handle it on their behalf.
▶ 2:01:01When we step back and look at the consent requirements that apply to those controllers, the ones who are deciding, why do I collect a consumer's data? How am I going to use it? I think that is a long standing and very important topic in the broader conversation about privacy legislation and the right set of safeguards that >> that are put on how companies collect and use consumers data.
▶ 2:01:22And I think there has been a concern that consumers are sort of bombarded by consent requests, and that ends up in a situation where they're unable to read all of them at the same time. Consent is an important guardrail, and consumers do want to know when companies are collecting very types of data and know how companies intend to use that data and be offered that choice. This bill requires consent to collect sensitive data, as some of the other witnesses have mentioned. That is stronger than the law right now in california.
▶ 2:01:51But I think the goal of privacy legislation is to make sure that that consent is meaningful, that consumers actually have a choice about the things that matter most to them. >> thank you so much, and thank you to all the witnesses I yield back. >> thank you. And the chair recognizes representative fry for five minutes, please. >> thank you, Mr. chairman. Um, you know, I found myself. >> in this working group just kind of really interested. >> in diving into the the legalese. Of what states are doing, how they operate, the lessons learned.
▶ 2:02:21Um, you know, I served in the state legislature and we often borrowed good ideas from other states and we shunned ones that were not successful in other states. And this was, I think, no different. Uh, when you're looking at this, um, miss, what's, what is, what was, what do you think is important here in, uh, what are the competing interests?
▶ 2:02:42Excuse me, what are the competing interests, uh, that exist when you're in the debating this in the kentucky legislature, it seems to me that the competing interests are privacy, right citizens, right to their data, maybe. Um, but also innovation, uh, small business entrepreneurship, that, that seems to be kind of the rub right between the two sides. Is that fair to say roughly? >> yeah. Thank you, representative fry, for that question.
▶ 2:03:06You know, we passed this bill back in 2024, and you as a former state legislator, know that sometimes it does take a couple years to get the right bill. Uh, we worked for several years with a broad coalition. And I often say, I know many of you work with your local or state chambers of commerce. If the chamber of commerce had one superpower is the ability to convene and find consensus. We bring groups of all different shapes and sizes and sectors to the table to really find a feasible path forward. And that's exactly what we did with house bill 15 back in 2024.
▶ 2:03:37>> so you guys, you worked with stakeholders, right, with different ideas on what is acceptable and what is unacceptable, and they were not always aligned. Is that correct? >> that is correct. I mean, I, I said earlier, I've been doing this job for 14 years, and very rarely have I ever passed a bill unanimously through the kentucky general assembly. But this was one of them. So you're exactly right. It was the balance of consumer protection, but also business innovation. >> isn't that the balance. >> that we have flourish? >> isn't that the balance that we have right now, miss goodloe?
▶ 2:04:07Right. I mean, to to to your point, you have multiple states that have done this. California's model seems to be modeled after the european model more than it does some other states. Would you characterize it that way? Miss goodloe. >> thank you for the question. I think california has a different approach than the other 21 state consumer privacy laws, and california took the important step of adopting the states, adopting the united states first state level comprehensive privacy law back in 2018. But we haven't seen anyone copy it since.
▶ 2:04:35The model that has been widespread throughout the states where it's had, um, you know, common agreement is this model that has a core set of rights, a core set of obligations, um, to make sure that their data is used responsibly and enforcement. And that's the model that we see in the secure data act. >> do you know what happened in europe after they passed the gdpr model? What happened to investment in europe in tech?
▶ 2:05:05You know, miss watson, would you care to? >> yeah, I would like to comment on that. Recently, the european commission has said that the overregulation has harmed their economy, their economy. And when every day we talk to our consumers, our businesses about affordability, I do think it's a great concern to be going down the path of what europe did with privacy. >> yeah. In fact, there was a national bureau of economic research found that the gdpr took that took effect in 2018. Um, has seen technology startups decline in europe.
▶ 2:05:32And so when we talk about competing interests, right, when we talk about this in a global economy that we have, uh, what europe did might have been an overreaction to a problem. And maybe what california did was an overreaction to a problem. So states like kentucky seem to be trying to find the right balance. Is that fair to say? >> I think it's absolutely fair to say.
▶ 2:05:57And like miss goodloe said, I think it's very important to note that california no other states have passed the california model. We're pretty proud that many states have passed the kentucky model. >> so they were the first. But everyone said, we don't want any. >> part of it. It doesn't work for business. It doesn't balance those rights of consumers as well as let business flourish and innovate, which is what we want them to. >> do this. Why do you think it's important that this bill, the federal bill, uh, have a strong preemption on privacy laws?
▶ 2:06:26>> I think it's important so that businesses know what rules to follow. And like we've mentioned before, large businesses have teams of attorneys and privacy officers, and they can usually navigate the complexity of various state laws. I represent mostly small businesses who do not have that. They are dealing with workforce issues with inflation and affordability, and all the things that small businesses deal with every single day. >> so if you're a big, big tech company, you've got the lawyers to be able to navigate a 50 state patchwork of laws, right? >> yeah, of course they have.
▶ 2:06:56>> if you, if you, if you, you and I decided to put 100 bucks into the, into the collection plate and start up our own tech company, would we have those same financial resources to navigate 50 state laws? >> absolutely not. >> so we stifle innovation if we don't do something about this. Correct. Thank you, Mr. chairman. I yield back. >> thank you. The chair recognizes the gentlelady from washington. Miss schreier, please. >> thank you, Mr. chairman.
▶ 2:07:21Uh, congress has talked for years about passing comprehensive privacy legislation to give consumers the ability to keep their data private and secure. And so I'm really glad we're holding this hearing today to discuss policy that, uh, we're long overdue in passing. And I appreciate all of your comments. Um, the internet basically runs on your data. Um, there's the old adage if something is free, then you are the product.
▶ 2:07:47And I think we should all keep that in mind. Just about every app, every site, every interaction online is collecting personal data that companies can use and sell to their financial benefit, and not necessarily or not at all comparably to yours.
▶ 2:08:03Um, and it is almost impossible to track, uh, exactly when your data is being collected and certainly impossible to track when it is, where it goes afterwards and for what purpose, who's getting hold of it. And that's why an enforceable right to privacy is so important. Um, but a national standard, although I understand the importance of preemption, um, it's useless if it's weak and it doesn't actually give consumers control over their own data.
▶ 2:08:32And in fact, a national standard can be actually, uh, actively harmful if it overrides or fails to adequately replace the protections that have been passed already in dozens of states. Um, that would certainly be true for washington state, which passed the my health, my data act into law in 2023. And this law protects washington residents health data beyond the limits of hipaa.
▶ 2:08:56Uh, hipaa protects, uh, patients by preventing health care providers from sharing or selling your data. But it doesn't prevent other companies from tracking, analyzing, selling your health data that they collect in other ways. Um, like hipaa doesn't cover health tracking apps or wearable devices that are collecting unprecedented amounts of your biometric data doesn't cover companies using your data to infer health conditions from your purchasing history.
▶ 2:09:24I think we all remember, uh, people getting advertisements for cribs when they started buying prenatal vitamins at a certain large retailer. Um, but the, my health, my data act does, and it's been an enormous step toward giving washington residents privacy when it comes to their health.
▶ 2:09:40It has strict data minimization standards and ensures that companies have to gain explicit authorization to collect and sell personal health data, and specifically, that authorization cannot be part of a broad terms of use agreement or through any kind of hidden or deceptive means. So, um, that means it can't be buried in just a long, legalistic notice that no one ever reads or hidden behind a complicated menu of options.
▶ 2:10:08But the secure data act would override this state law, and it's health protections are not nearly as robust as washington states. So I fear that this would be a net loss for my constituents. And this would happen in a patchwork of states across the country. Um, miss fitzgerald, thank you for all of your comments. Can you speak to the kinds of robust protections and data minimization standards that you would like to see for health data specifically? >> yes. Thank you for the question.
▶ 2:10:36You know, there was just a discussion of whether gdpr and california overreacted to the problem. I think it's important that we also don't underreact to the problem. People are being harmed by these data practices every minute of every day. And health data is a really good example of that.
▶ 2:10:53So any federal privacy law should require that the companies collecting that data limit it to what's necessary, you know, line it up with what the consumers expect, and then make sure not also that not only that the collection is limited, but also those uses, because often it's the secondary uses of our data where the harms really happen. You know, we expect our, our fitness tracker to collect our health data and provide those services. But if they're selling it to third parties, that's where the harm really, really happens.
▶ 2:11:24>> that's right. And we've seen this with, uh, ability to get life insurance, health insurance, the ability to get car insurance when our data gets sold without our authorization. Um, some of what concerns me about the secure data act is that it places so much of the burden on consumers to navigate all these different opt out options to protect their, their, uh, their data and the functionality and the ease of use is really going to make the difference here.
▶ 2:11:50I think more burden should be put on the companies that have been profiting off this data to protect this data. And I really, um, appreciate that the bill commissions a study on universal opt out mechanisms. Um, but I think we need to take more action than just a study. And the reality is that congress is playing catch up right now, uh, to the states. And I'm glad we're having this discussion.
▶ 2:12:14Um, but as miss fitzgerald, you noted, in 2022, we had a stronger bill, and I think it's time to return to that. We can do better. We should do better. And I yield back. >> thank you. Chair recognizes representative cammack for five minutes, please. >> thank you, Mr. chairman. Thank you to our witnesses and all our guests here today. It's nice to see the committee room packed full. I'm going to start with you, miss goodloe.
▶ 2:12:36In your testimony testimony, you state that the secure data act reflects the modern economy by recognizing different roles and responsibilities with respect to data, especially differences between controllers and processors. Can you discuss how the secure data act distinguishes between these roles and responsibilities, why it's important to do so, and for folks watching at home, the difference between the two. >> yes. Thank you very much for the question.
▶ 2:12:59This is a core issue for our members who are the business to business technology providers that are competing to provide privacy, protective and security protective services to other companies. The distinction between controllers and processors is long standing, widespread, found in every state privacy law, and it underpins modern privacy laws worldwide. It matters because if you conflate controllers and processors, you end up creating privacy risks for consumers.
▶ 2:13:28It's important to know that controllers are the companies that decide how and why to use a consumer's data. Processors are the companies that handle that data on behalf of another company. So one example is if you join a gym and the gym keeps your data in the cloud, because it's not going to keep it in a file cabinet, the gym is deciding how to collect your data, why it's going to use that data, and it's giving it to the cloud storage company to handle it. As the gym says, on its behalf. So the cloud storage company is a processor here.
▶ 2:13:58If we conflate these roles and the privacy law starts assigning the wrong obligations to the wrong type of company, what we've seen is it can require that cloud storage company to start looking at all that membership data, the gym stores with it, and we don't want that. The goal of a privacy law should be to minimize how companies review data, and not require them to start looking at data that they otherwise would not. And that can happen when we conflate these roles. That really goes against the goal of privacy legislation. >> excellent. Thank you for that. That's a perfect dovetail into my next question.
▶ 2:14:27So I'm going to start with I'm a very proud floridian. Go gators. Proud to represent the real gator nation. And so many people on this committee know that. I'm always talking about my gators. So I am very pleased that this legislation, the secure data act, is building on existing state privacy and data security frameworks like those that we have across the country, but in particular the sunshine state. So less than half the country has comprehensive privacy laws in place.
▶ 2:14:54And I believe that every american should benefit from the rights and protections that floridians enjoy every day. So I'm going to start with you. I'm going to mess up your last name. So I'm going to try really hard. Britigan. Uh, sorry. Can you share more about the consumer protections and rights that are laid out in the secure data act, and why it's important that we have a uniform federal framework? >> yeah. You know, I think the data minimization point is a really interesting one.
▶ 2:15:22And harkening, harkening back to the consent piece that we've been talking about because of consent, that that although it's a somewhat amorphous standard, we know what it doesn't look like if we had some great examples of it does not look like that disclosure at the end of a privacy policy that requires you to click a box. Again, it in a consent interacts with data minimization in a really interesting way, which we saw, um, sort of from, from the enforcement lens.
▶ 2:15:49It, um, data minimization is somewhat not needed in a, in for sensitive data because um, it only because you have to have consent unless it can, unless a company is actively able to get that consent, if they collected that data without that consent, they're in violation of the law. It doesn't matter whether they needed it or not. Um, so that that is a sort of a point to, um, just to keep in mind that these provisions are all interacting with each other.
▶ 2:16:20Also, data minimization is a frankly more difficult provision to enforce. Um, it is also a somewhat amorphous standard. And sometimes, you know, hearkening back to consent again, if someone violated the consent provisions, I would rely on that, um, as an enforcer to point to that. They violated the law.
▶ 2:16:38I would not necessarily need to, I could add on a violation of data minimization, which is what california recently did, or because california does not have consent protections for sensitive data in the recent settlement with a um, vehicle manufacturer. A couple of weeks ago, they had to rely on their data minimization violation. >> well, and I know you want to finish that thought. So I'm going to ask you to finish that thought in writing, because I want to do a quick, rapid fire across the whole panel when we're talking about data and data privacy.
▶ 2:17:07When it comes to a consumer, should they have the option to opt in or out when they're signing up for a service? And I'm just going to start with you and we'll go down the line, opt in or opt out. >> for for both data for sensitive and non-sensitive. >> let's just go broadly and say non-sensitive. >> non-sensitive. That would be an opt out. >> okay. >> the company should have to limit what they're collecting and using. It shouldn't all be on the consumer. >> so they should be forced to. So consumers should opt in.
▶ 2:17:35>> they should not be presented with constant pop ups that will make their internet experience unusable. Okay. >> bill in kentucky would be opt in. >> okay. >> for non-sensitive data. I think opt out has been the standard, in part to avoid having too many consent requests going to consumers. >> okay, I'm going to say, miss watson, I'm with you on this one. I think there should be a blatant opt in in order for people's data to be shared. But I have a final question. I'll submit it for the record. I appreciate y'all's prompt responses. Thank you, I yield. >> thank you. Chair.
▶ 2:18:04Now, recognize the gentleman from florida, please. Mr. soto, five minutes. >> thank you, Mr. chairman. You know, americans are desperate to take back our privacy rights. For generations, people conducted transactions without a trail of their personal data left behind. Imagine when I was a kid, going to major retail stores or to the mall or all these other places, and they didn't get your biometric data. They didn't get your religion.
▶ 2:18:30They didn't get so many different things that now, uh, we have to protect, uh, but now that we're online, every transaction leaves a long trail of breadcrumbs. And that has fundamentally changed the dynamic between consumers and businesses. Americans want to own their own personal data. We want more control over it. We want to protect it from misuse. That's why we have so many people here today sharing those same values. And we especially want to protect our kids.
▶ 2:18:57Uh, the personal data that is recognized as a sensitive is a good list. I, I do agree with it. Health and dna data, geolocation calendar, children's data, religion, immigration status, ethnicity, and others. These are things that people should be able to protect if they want to. Uh, yet the enforcement is is lacking, uh, rules without a strong enforcement is like a tiger without teeth. Uh, no.
▶ 2:19:28Cause of action means we can't have strong, uh, we can't have a strong cause of action without. We need a strong cause of action and preemption together. That's reasonable. If you do one without the other, you could actually have really unintended consequences. So if you have strong preemption, but then you block state causes of action and you have no federal relief, then you've actually just shut the door on a lot of these states.
▶ 2:19:53We've heard from both kentucky and texas today, um, on their, on their, uh, regimes that they have. And then when you look at what the ftc can do, they really can't take meaningful action in this bill. They, they can't address civil rights issues or protect personal data. They can refer it to attorney generals. And, uh, and this is where I get deeply concerned about the bill.
▶ 2:20:16Uh, if you leave this all to state attorney generals, you're going to have different enforcement by different attorney generals, by how aggressive they want to be and how much they want to deal with thousands and thousands of complaints. So you go from a patchwork of laws in the states to a patchwork of enforcement, depending on what the the the attorney general wants to do. Now, I know a lot of states, they've done these privacy laws, but have not included a private cause of action.
▶ 2:20:43My own state of florida, although there are three common law privacy claims that you can make like appropriation, intrusion, and public disclosure of private facts. Um, but I know it's kentucky and texas. No cause of action either. Right. And so we're given a lot of work to the state attorney generals.
▶ 2:21:00And I, and I worry that whether they're going to be equipped to handle this kind of volume, um, my opinion, you know, we at least have to have injunctive relief and attorney's fees available so that most people can't afford to hire an attorney just to do some personal data violation that they have. Uh, and you need to make sure you could take down the information that you want to take down.
▶ 2:21:21And so we could argue about anything beyond there about proper compensation, whether we have it or not, but injunctive relief and the ability to make sure you can hire an attorney is absolutely critical. If we're going to have stronger preemption provisions on the federal level. And I get it, this is interstate commerce. It's the internet is in flowing through different states. Uh, and so, um, first, miss fitzgerald, um, what happens when consumers face violations of the privacy, but they can't go to court to fix it? What is traditionally what are you seeing across the states right now?
▶ 2:21:51What, how quickly can they get their data offline? >> yeah. Unfortunately, without a private right of action, there's little they can do. Um, and I think, you know, it's really important when we're talking about a private right of action to recognize that it's not an all or nothing proposition.
▶ 2:22:08You know, if we can talk about small business carveouts for private right of action, the bipartisan bill that passed this committee on a vote of 53 to 2 included a compromise private right of action that focused on injunctive relief and actual damages to avoid some of the issues that were raised earlier.
▶ 2:22:25So, you know, I think if both sides come to the table and we can come up with a compromise, there are ways where individuals would have the ability to enforce their privacy rights as opposed to, you know, what's in this bill right now, which is they're left without a remedy. >> I'm glad you mentioned the small business exception. So we're not talking about someone with one little website that makes a mistake.
▶ 2:22:48They're one of your local barber shops or general stores or, or other, um, restaurants or retail establishments. So where do you think the small business exception should fit in? Because that's very important. >> yeah.
▶ 2:23:01States have been, you know, considering, um, private rights of action, you know, it has struggled to get across the finish line, but um, one option is, you know, set a revenue threshold or set a threshold of companies that only collect over x amount of personal data and only have the private right of action applied to them. Because as you mentioned, state attorney generals are under-resourced, overworked.
▶ 2:23:25Um, and if you're talking about cases against some of the biggest companies in the world, and they have 2 or 3 assistant attorney generals in a privacy division, you're talking about five years of those people's time. And that's going to be, you know, taking up their entire workload. >> time's expired. >> to enforce. >> thank you. And the chair recognizes the gentleman from ohio, Mr. balderson, for five minutes, please. >> thank you, Mr. chairman. And thank you all for. >> being here today. Um, my first question is for Mrs. watts. Good afternoon.
▶ 2:23:53Um, last congress, this committee considered data processing rules or data minimization standards that were equivalent to europe's burdensome general data protection regulation. According to economic analysis, if the us were to adopt european style data standards like some are proposing, it could cost the us up to $123 billion and cost up to 340 000 jobs.
▶ 2:24:20Can you discuss the impact that strict european style data standards would have on businesses, especially small and main street? >> absolutely. Thank you for that question. Representing small businesses in kentucky, which obviously borders your great state, uh, we are really proud to make sure to protect small businesses in our state law in kentucky. We know that the european commission has now said that the overregulation has actually harmed their economy.
▶ 2:24:46And I know much like you, which borders our state, we are dealing with affordability and the cost of small business to just keep their businesses open every day, and we really can't risk that. So we definitely do not need to go down the path of having a european style model that they have now been on record of saying the over burdensome regulations have harmed their economy. You quoted it yourself, it could cost up to 340 000 jobs. We absolutely do not need that in the united states. >> thank you very much, miss. I appreciate that answer. And we love kentucky ohioans do.
▶ 2:25:13Uh, my next question is for Mr. britigan. Uh, thank you for being here, sir. Also, um, some advocates argue that these european style data standards are necessary to protect consumers. In your opinion, as a former privacy and technology enforcement official, what effects would adopting those stricter european style rules have on consumers in their privacy?
▶ 2:25:40>> yeah, I think, you know, as I as alluded to in my opening, we have now learned a lot about sort of emerging privacy harms and which protections actually can help consumers and help regulators to go after those privacy harms in which can't, you know, including additional language in a privacy policy that's prescriptive. There's not necessarily any tangible benefit because they're the consumer, you know, and all of us don't tend to read those privacy policies.
▶ 2:26:06So there's a there's a balance that I think needs to be struck of what is prescriptive in the sense that it's actually getting to those core privacy harms. And I've harped a lot about sensitive data. You know, that is just one category. That is an area where there needs to be heightened protections. We have seen that on a bipartisan basis. Illinois, washington, texas all have heightened data standards for sensitive data types. Um, and several of them have standalone privacy laws for just those sensitive data types.
▶ 2:26:33And so I think it's important to keep in mind and really think through which requirements are actually protecting consumers from privacy harms. And I think there's a california has a long list of, uh, a long law, a lot of regulations that I would struggle to see how a violation of many of those actually resulted in a tangible privacy harm. >> okay. Thank you very much for that detailed answer. I appreciate that. Uh, my next question is for Mr. goodloe. Um, thank you for being here, ma'am.
▶ 2:27:03Small businesses that sell products online may interact with customers in all 50 states, even though they're often run out of a single storefront or a garage. How does this how does the existing patchwork of privacy requirements complicate day to day operations for those businesses? And I'll have a follow up for you. >> I think. Thank you for the question.
▶ 2:27:25Right now, companies are required to track 50 moving goalposts to do business in the united states as long as they are serving customers in more than one state, they need to keep track not only of the 22 states that have already enacted laws, but of the many states that are already revising and amending those laws. And by my count, we're up to 30 amendments. We need a clear national standard that sets one set of rules so that companies can operate nationwide and know how to protect consumers privacy. >> thank you. My follow up then, and we have about a minute left.
▶ 2:27:57In contrast, how would establishing a single national standard under the secure data act make it easier for them to serve customers across state lines? >> I think it tells them what to do. Our companies as business to business technology providers are in the business of competing to provide privacy, protective and security protective services. They want to comply with strong privacy laws because their customers demand it when they know the rules.
▶ 2:28:21When there's a single clear rule and regulatory lead enforcement, it helps them know what to do to focus on core protections for consumers. And providing one standard can do that. >> thank you very much, Mr. chairman, I yield back. >> thank you. Chair recognizes representative trahan for five minutes. >> well. >> I thought I was I thought I was ready here. Thank you, Mr. chair. Um I want to thank the panel as well. You know, a federal consumer privacy law is certainly long overdue.
▶ 2:28:51Uh, there's broad agreement on that. But I do worry that this congress is going to, again, fail to make progress, uh, on it. I appreciate representative joyce and the committee's work on the secure data act, but I'm concerned that it falls short in a few ways, and I'm going to use my time to identify one of them. And that's the unique harms that data brokers perpetuate. And advanced artificial intelligence exacerbates.
▶ 2:29:17Today, ai can be used to correlate data from a cross data sets, meaning anyone with access to an ai model can purchase your data from a broker and paint a very intimate picture of your life, from your location to your browsing data and your purchases, that actors can infer your sexual orientation, how much money you earn, and where you work, study, or worship.
▶ 2:29:42Miss fitzgerald, how can ai now draw these kinds of inferences about people who never knew that their data was collected and never consented to it? And what are the privacy risks of advanced ai systems built on data acquired from data brokers? >> yes. Thank you for that question. Ai is turbocharging the ability for companies to make inferences about consumers, and that's leading to data discrimination.
▶ 2:30:09Um, and, you know, surveillance pricing is another harm that consumers really can't stand that is being, being turbocharged by ai and strong data privacy legislation is a really critical, critical baseline protection, um, to protect americans from the harms of ai. It doesn't do everything, but it's a really important first step. >> thank you.
▶ 2:30:30Uh, that, that, as you mentioned, it's so critical that data privacy legislation provides americans a meaningful way to prevent their data from being collected, stored, or sold by data brokers. While the bill requires data brokers to allow americans to opt out, this must be repeated for every data broker, meaning that you might have to opt out of hundreds, if not thousands of times.
▶ 2:30:55I have a bill, the delete act, which would give americans control over their own data by allowing them to force data brokers to delete their data and stop collecting future data through a single opt out request. So, miss fitzgerald, would a single universal opt out be more effective for consumers than requiring them to opt out? Broker by broker yes.
▶ 2:31:18>> a centralized solution mechanism is especially important when we're talking about data brokers, because these are companies that consumers don't know, have their data, don't even know exist. For the most part, I don't think many americans could name a data broker for you. Um, and they've never interacted with these companies, so they don't know who to go to, to ask to delete their data. So the centralized deletion mechanism is really important. There's a reason it's been incredibly popular in california, and just the five months since it went into effect, 300,000 californians have taken advantage of it.
▶ 2:31:47Um, and I think that shows the desire americans have to protect their information from data brokers. >> but even a universal opt out has a loophole here. Uh, the bill bars americans from requesting deletion of what it calls de-identified data brokers can keep collecting and selling it, so long as buyers promise not to re-identify it.
▶ 2:32:12Uh, so have there been cases before where de-identified or pseudonymous data was able to be linked back to individuals? And what kind of information might bad actors be able to infer, even from de-identified data? >> yeah, thank you for that question, because it highlights something that hasn't been raised yet today. Um, there's an exemption in this bill for de-identified and anonymous data, as you mentioned.
▶ 2:32:34And it's unanimous data in particular is problematic because it includes things like our advertising id and our ip address. These are identifiers that companies are using to track us across the internet. And by exempting them from the consumer rights in this bill, from exempting them from the opt out, it you know, it almost makes the opt out meaningless because they're not, you know, often identifying it with my name. They're identifying it with my advertising id. Um. So.
▶ 2:33:05The ftc has long held a position that, um, pseudonymized identifiers or, uh, it does not render data anonymous. So that is not something that should be exempted. And then in the case of de-identified data, yes, there has been, there have been many cases where de-identified data has been able to be re-identified back to the original consumer. >> thank you. Look, I think I believe there's agreement across the aisle that congress must act to protect americans privacy, as a number of states have already done.
▶ 2:33:32The recent advancements with ai make this issue even more urgent. But this bill, as written, fails to meet the moment. So I look forward to working with my colleagues, and I yield back. Thank you. >> thank you. The chair recognizes the gentleman from colorado. Mr. evans, please, for five minutes. >> thank you, chair, of course, to the ranking member for this hearing, to the witnesses for coming today. Um, secure. Data secure. Excuse me. Strong data security is essential for protecting consumers in today's digital economy.
▶ 2:34:00The fbi's internet crime complaint center showed that consumers lost more than $20 billion in fraud. Just last year in colorado, there was a total financial loss of $355 million statewide, and that's an increase of more than 250% since 2020.
▶ 2:34:19Colorado's got one of the fastest aging, um populations in the nation, and we see scammers and fraudsters are explicitly targeting seniors with complex schemes and phishing traps. I saw it during the ten years that I spent as a cop in the denver metro area. And unfortunately, colorado has the third worst rate in the nation for senior fraud. We've got malicious cyber actors, weak data security.
▶ 2:34:46Uh, these are some of the reasons that americans are facing a fraud epidemic. And it's why I'm pleased to see the secure data act requiring companies to adopt some common sense data security measures to protect constituents like mine from these fraud impacts. And so, miss goodloe, first question to you, since you're here from the business software alliance, can you share how the secure data act's data security requirements work in practice, and how the industry can integrate them with existing policies? >> yes.
▶ 2:35:15Thank you for the question. I think this is a very important issue when we think about privacy legislation. The secure data act requires controllers to adopt reasonable security measures to make sure that data is kept secure and confidential. What that means in practice is that companies have to establish, implement and maintain data security practices. And we see this requirement already across state laws, and it needs to apply nationwide.
▶ 2:35:41The secure data act also tells companies how to do this because it creates a rebuttable presumption that they satisfy this obligation if they use leading tools like cybersecurity risk management frameworks that have set the gold standard globally. >> thank you so much. The next question will be to Mr. bright. Again.
▶ 2:36:00Uh, we know prevention is the first step in making sure that people's data stays safe from fraud and from these malicious actors, but we still need to be able to go and prosecute the bad guys when they because they sit around all day long and try to figure out how to hack and bypass these security protocols. You know, security isn't static. So when you have malicious actors that still work overtime to go out and do bad things, defraud americans, we got to have the ability to go get those guys.
▶ 2:36:28And so I'm pleased to see that the national insurance crime bureau has sent a letter supporting the secure data act. Um, because this helps us not only detect, prevent and deter, deter insurance fraud and financial crimes and related crimes. It also helps us work with law enforcement to be able to go and get the bad guys. So can you talk a little bit about how the secure data act works with law enforcement to protect americans?
▶ 2:36:54>> yeah, I think in general, the more cyber requirements that companies are required to implement, the more the greater the chance that law enforcement can do its job because the more protections you have on the front end, you're collecting more information about those threat actors. Um, and ultimately, you can coordinate with law enforcement to help go after them.
▶ 2:37:12We recently recovered on behalf of a client that was defrauded, financial institution that was defrauded of six figure amount, um, go after the fraudsters civilly because of our work with law enforcement, who is able to do go after them criminally. Um, so it's an incredibly complex scheme, but it is permeating throughout the united states, as you alluded to. >> and then my final question, and this is unfortunately just a tragically horrifying statistic.
▶ 2:37:38Colorado has got 2% of the nation's population, but we're 10% of the human trafficking in the nation. And a lot of these are kids that are being subject to this. And we know that when you have human trafficking, there's money transactions, there's a lot of digital footprint that's involved here. And so again, we want data privacy for americans, but we also have to be able to interrupt not just the financial crime space, but we have to be able to trace that back and untangle that to horrific crimes like human trafficking and human trafficking of minors.
▶ 2:38:08So can you talk in my remaining 30s, just a little bit about how this, uh, not only works to prevent, to protect americans data and to work with law enforcement, not just on the financial piece, but also on things like human trafficking. >> yeah. >> you know, again, it this bill helps create that information flow between law enforcement and the private sector.
▶ 2:38:31The fbi has done a great job over the past decade or so, holding itself out as a partner to companies that are, um, you know, either observing crime or, um, the target of fraud. And so there's been that palpable shift over the past decade to really encourage that coordination, which I think is so key to sort of getting at the core issues here. >> thank you so much. And I'm out of time. Yield back. >> thank you. The chair recognizes the ranking member for one minute, please, miss schakowsky. >> I'm I'm I am concerned that.
▶ 2:39:06This bill right now protects companies and not people. And that what we really need to do is protect our everyday people. And that's not happening right now. >> thank you. The chair recognizes the gentleman from ohio, Mr. joyce, for five minutes, uh, from. >> pennsylvania, the other joyce. But, uh, it's good to be with you. >> my apologies about this. >> thank you. Thank you for our witnesses for being here.
▶ 2:39:33Thank you for participating in this candid conversation. To start, I'd like to rebut a shallow attack on the secure data act, the. The secure data act's consensus approach is flawed because it's based on over 20 states blue, red and purple states. To that end, Mr.
▶ 2:39:53Chairman, I'd like to enter into the record on may 11th, 2022, press release from the well known consumer advocacy group consumer reports that's entitled connecticut governor signs comprehensive bill into law that explicitly states, this year we saw a giant tech companies push weak bills at the state level. So we are especially pleased to see connecticut sign a strong law that will extend real privacy protections to its citizens.
▶ 2:40:20In may 2022, a connecticut law that was modeled on virginia, modeled on colorado and modeled on utah laws, was dubbed by consumer advocates as extending real privacy protections protections to consumers and not the product of giant tech companies.
▶ 2:40:41Yet today, a federal law that is modeled and centered on those exact laws and extends privacy protections to all americans is somehow, in retrospect, all just part of a some multi year multi-dimensional scheme by big tech to ultimately create a federal standard.
▶ 2:41:00This is a clear example of how consumer groups will move the goalposts, not based on what is working for the consumers, but rather on a desire to hamper legitimate uses of data that benefit american consumers and american workers.
▶ 2:41:17For far too long, consensus on federal privacy reform has been elusive, and a lack of that consensus has pled, has plagued legislation in multiple congresses. As I shared at the beginning of this hearing hours ago, I'm committed to working with my colleagues on both sides of the aisle, as well as stakeholders to advance the strongest possible bill out of this committee and onto the house floor.
▶ 2:41:46What's why do you believe that the consensus state approach to comprehensive privacy and data security offers the best pathway forward to consensus from the federal level? >> yes. Thank you for that question, and thank you for all of your work, uh, on this bill. We are really proud in kentucky to have had a consensus based bill that passed unanimously through our general assembly and was signed into law. >> how's it working? >> it's working great so far.
▶ 2:42:13It just went into effect in january, so passed during the general assembly of 2024 is now full effect. We actually just checked with our attorney general. >> you worked hard to get that. >> we worked very hard. And I will say for a couple of years, we really wanted a federal bill. We wanted kind of you all to take that step so that there was not going to be a patchwork. >> this passed unanimously. You said earlier. >> it passed unanimously. And we are a supermajority. >> a supermajority of which side? Republicans who signed it into law, a. >> democratic governor. >> and it shows that this is a bipartisan concern completely.
▶ 2:42:43We in the us house of representatives understand that and can work in a bipartisan manner to make this effective. Um, miss, miss, uh, godot, can you please talk to us about comprehensive privacy and data legislation from a whole economy regulation, because you deal business to business and you understand the entire economy from the tech sector.
▶ 2:43:07And the secure data act will grant consumer rights and protections across all industries, from life sciences to real estate to manufacturing. Talk to me how that will affect that business to business relationship. >> so we think, um, well, I should start by saying thank you for all of your work with the working group to work on pushing forward comprehensive federal privacy legislation. We deeply appreciate that because this matters to bsa member companies.
▶ 2:43:34We have long supported federal comprehensive privacy legislation because it is important to the national economy. Companies of all sizes and in all industries rely on technology. This bsa represents the business to business technology providers that power businesses in every sector. And so what we see is the need for a single standard that sets the right level of consumer protections for companies nationwide and across sectors. >> that U.S.
▶ 2:44:02Digital economy that supports all sectors, supports over 28 million american jobs, which means that the stakes are serious for so many americans. We need to get privacy right. And we've seen in europe that embracing impractical and burdensome approaches to privacy results in stagnation and results in job losses. The secure data act is the result of a consensus framework.
▶ 2:44:30I think it was justice brandeis who said 80 or 90 years ago that the states are the laboratories of democracy. We took that very seriously. We looked at the 20 plus states that have privacy acts. This is our opportunity to consensus based legislation that protects consumers first and foremost, and gives certainty to american businesses to stop moving the goalposts.
▶ 2:44:57Once again, I look forward to working with all of my colleagues on both sides of the aisle to advance the secure data act. Again, I thank you for being here with us on this long morning. And, Mr. chairman, I yield back. >> thank you. And the chairman appreciates the gentleman from pennsylvania ask unanimous consent that the documents and the staff document list be submitted for the record, without objection. So ordered. I'd like to thank our witnesses for being here today.
▶ 2:45:24Members may have additional written questions for you. I'll remind members they have ten business days to make questions for the record, and I ask the witnesses to respond to the questions promptly. Members should submit their questions by the close of business, june 17th. Without objection. Subcommittee is adjourned.
▶ 2:52:59>> test one. Two. One two. Check, check, check. This is mic check for the house recording studio. This is a check. This is only a check. Thanks, chris. Bye.