March 13, 2020
Senator Jerry Moran (R-KS) sidelined a bipartisan effort to draft a comprehensive federal data privacy bill and introduced his own measure, as a data privacy bill in Washington state failed for the second year in a row.
Employment data exemption: The Moran bill—the Consumer Data Privacy and Security Act—does not apply to “information about employees or employment status collected or used by an employer pursuant to an employer-employee relationship, including information related to prospective employees and relevant application materials.” Thus far, most comprehensive data privacy proposals introduced in Congress have included a carve out for employment data.
The bill would additionally preempt state and local privacy laws, beef up the Federal Trade Commission’s enforcement capabilities, impose various security and privacy requirements on companies, and grant consumers several data privacy rights. It does not include a private right of action.
Breakdown of bipartisan effort: Last year, the Senate effort to craft a bipartisan privacy bill was led by six members of the Commerce Committee, including Sen. Moran. That group splintered six months into deliberations, and Sen. Moran paired up with another member of the group, Sen. Richard Blumenthal (D-CT), to come up with a bipartisan solution. Sen. Moran’s solo bill signals a fracture between them as well.
Groundhog Day in the Evergreen State: In 2019 the Washington State Legislature failed to pass a sweeping data privacy measure due to disagreements over enforcement. This week, a nearly identical bill failed again in the legislature for nearly identical reasons.
Now what? Odds of a comprehensive federal data privacy bill being passed this year have taken a hit. Looking ahead, it is hard to determine where data privacy fits in the legislative schedule, even this early. At the state level, the Washington bill appeared, just like last year, to have the best chance of joining California’s Consumer Privacy Act in enactment. Eight states are still considering comprehensive data privacy measures, including Maryland, New York, Minnesota, Wisconsin, New Hampshire, South Carolina, New Jersey, and Nebraska. With strong public support for new consumer data privacy protections, it remains likely that new laws will eventually be enacted, but not in the near term.