Employment-related data excluded: While the bill would cover a wide variety of what it identifies as "sensitive personal information," including geolocation information, biometric data, health information, and other categories, the bill states: "The term 'sensitive personal information' does not include... information related to employment." [Emphasis added.]
The bill introduced by Rep. Suzan DelBene’s (D-WA), would direct the FTC to promulgate regulations requiring:
- Opt-in consent to any function that involves the collection, storage, processing, sale, sharing, or other use of sensitive personal information, including sharing with third parties;
- Opt-out consent, at any time, for any collection, storage, processing, selling, sharing, or other use of non-sensitive personal information;
- Audits by third parties; and
- A privacy and data use policy that uses clear and plain language.
Limited private right of action: State attorney generals may bring an action on behalf of the residents of their state in U.S. district court.
Why it matters: The strong support for the bill is noteworthy on two points. First, by excluding data that is "related to employment," it recognizes the problems that would be created by failing to distinguish consumer data from HR data in legislation—a significant positive for employers. HR Policy has been engaged on this issue by leading a coalition of member companies and business groups to aid lawmakers in recognizing this important distinction. In addition, by supporting the bill, the 104 members of the moderate New Democrat Coalition have signaled that perhaps there is some room for debate within Democratic ranks when it comes to establishing a preemptive national law regulating data privacy. Significantly, eighteen of its members hail from California. The conventional view had been that the 46 Democrats within California's delegation was strongly united in its opposition to preempting the state’s California Consumer Privacy Act.
