New legislation on Capitol Hill brings us closer than ever to having comprehensive data privacy protection and a civil right to intimate privacy. The American Data Privacy and Protection Act enjoys bipartisan support: It passed out of the House Energy and Commerce Committee with a vote of 53-2. And while it’s unclear how the bill will fare in the Senate, its bipartisan support gives reason for optimism.
There’s just one obstacle to the House passing the ADPPA: California and its most powerful federal lawmaker, Rep. Nancy Pelosi.
Because the federal privacy act would preempt state laws—including California’s robust protections and its ability to continue to innovate with stronger laws—Pelosi has yet to hold a vote on the bill in its current form. Pelosi noted that, as the California governor and top state leaders have underscored, the ADPPA “does not guarantee the same essential consumer protections as California’s existing privacy laws.” To be clear, that’s not exactly true: The ADPPA arguably provides as strong or stronger protections than current California privacy law. Nevertheless, there’s a way to overcome those objections and garner her and the state’s support by drawing on lessons from California’s historic role in creating environmental standards.
Though the proposed law is far from perfect, everyone in the United States would benefit from its mandates to minimize the collection and trafficking of personal data, especially intimate information, and hold data collectors accountable discrimination. Renowned privacy and civil rights groups support the bill. Unsurprisingly, data brokers and industry groups do not.
The bill would do several important things, starting with imposing a baseline duty to refrain from collecting personal data unless companies reasonably need it to provide products or services to existing customers. (Right now, our online browsing, searches, purchases, and cellphone and app activities are there for the taking, so long as companies provide some notice about their data handling activities and don’t lie to us.) The act would also make it much harder to collect and exploit our most intimate, sensitive personal information, including health, genetics, biometrics, geolocation, sexual behavior, intimate images, online activities over time, private communications, and minors’ data.
The safeguards in the law promise to reduce the amount of personal data flowing into corporate digital reservoirs and the hands of law enforcement, which as of now can and do freely buy it. Importantly, the ADPPA would ban any data-handling practice that discriminates based on race, color, religion, national origin, sex or disability. The anti-discrimination mandate would cover practices that have a disparate impact on vulnerable communities, such as excluding marginalized people from employment opportunities or raising their insurance rates, with no showing of invidious intent required.
But, as Pelosi has rightly noted, the bill would preclude states, including California, from continuing to innovate with stronger privacy laws, as it has done since its passage of the California Online Privacy Policy Protection Act of 2003. The bill also would limit the mandate of California’s new Privacy Protection Agency Board, whose members are among the smartest and most innovative privacy advocates in the country. Unsurprisingly and understandably, the board issued a memo opposing the ADPPA.
In response to the stalemate, the president and executive director of the Electronic Privacy Information Center, Alan Butler, remarked that the impasse might be surmountable with modifications that would allow states to continue to experiment in the future as technology evolves.
Drawing on lessons from the environmental field, there may indeed be a way forward just as Butler suggests, with California as our guide.
As in the case of privacy protection, California has long been a leader in crafting environmental statutes that protect the public health, clean air and clean water. In fact, in 1947—long before the creation of the U.S. Environmental Protection Agency or the passage of the major federal environmental statutes—California formed the first air pollution control board in Los Angeles. Researchers with that board helped craft and implement the nation’s first air pollution regulations.
Later, the state passed the nation’s first tailpipe emissions standards for motor vehicles; and under the leadership of Gov. Ronald Reagan, California created the California Air Resources Board, the first statewide air pollution control agency in the country.
When the federal government finally began regulating air pollution, it did so in a way that maintained California’s leadership in the field of air pollution regulation. In the federal Clean Air Act of 1967, in recognition of California’s “unique” environmental challenges and the state’s “pioneering efforts” in tackling those problems, California was granted a waiver that authorized the state to set its own vehicle emissions standards. This waiver authority expanded over time, as Congress strengthened California’s ability to set its own vehicle emissions program and authorized other states to adopt California’s emission standards.
That waiver provision has proven invaluable to California and the country. With its waiver, California has used its expertise to target harmful air pollutants (like nitrogen oxides) before they were even on the federal government’s radar. It has set aggressive goals that have pushed our vehicle fleets to be cleaner and more efficient. It has encouraged the creation of new technologies like electric vehicles, which are crucial in our efforts to tackle climate change. And, in the process, California has built up an expert team of scientists and lawyers that represent the gold star of air pollution regulators.
Congress should follow a similar path now. The federal bill can provide California with a waiver, which would recognize its unique position as the home of a critical mass of tech companies and a leader in regulating them. (The Department of Commerce or the Federal Trade Commission could be tasked with determining whether California’s innovations offer greater data privacy protections than the ADPPA to warrant the waiver.) The state could continue to create privacy protections that meet evolving problems, and the nation can avoid the confusion that would result if all 50 states made their own privacy laws. As speaker of the House, Pelosi could then introduce the ADPPA knowing that California can continue to forge innovative solutions that benefit her state and the country.
Future Tense is a partnership of Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society.
