Washington Retail Insight

Privacy Legislation Sees Renewed Interest in Congress

By J. Craig Shearman
Washington Retail Insight
August 6, 2010

Congressional interest in privacy legislation appears to have picked up in recent weeks with the introduction of a major new bill, a series of hearings and talk of additional action this fall and next year.

H.R. 5777, the BEST PRACTICES Act, was introduced on July 19 by Representative Bobby Rush, D-Ill., chairman of the House Energy and Commerce Committee’s Subcommittee on Commerce, Trade and Consumer Protection. The bill was based on draft legislation circulated but never formally introduced by Communications, Technology and Internet Subcommittee Chairman Rick Boucher, D-Va., in May.

Boucher’s subcommittee followed up with a hearing on the Rush bill on July 22, and on July 27 the Senate Commerce Committee held an initial “overview” hearing on privacy. Senate Commerce Chairman John D. Rockefeller IV, D-W.Va., and Senator Mark Pryor, D-Ark., who chairs the panel’s Consumer Protection Subcommittee, are reportedly close to introducing a data breach bill that would preempt conflicting state data breach laws but could limit access to some information and bring costly burdens for businesses.

The Federal Trade Commission testified at both hearings, with Chairman Jon Leibowitz telling the Senate panel his agency plans to recommend the passage of new, comprehensive privacy legislation during the 2011-2012 session of Congress if industry has not improved its privacy practices by then. The FTC is expected to issue a report on privacy that could recommend guidelines that could become a blueprint for even broader privacy legislation than what has been seen so far.

Energy and Commerce Committee staff are expected to work during Congress’ August recess to come up with a combined version of the Rush and Boucher measures before lawmakers return in September. Rush announced during the hearing on his bill that he hopes to hold committee votes this fall after allowing an “ample opportunity” for industry to comment on the measure. With Congress scheduled to be in session only a few weeks before breaking for this fall’s election campaigns and other high-priority items already on the agenda, it would be difficult for a privacy bill to reach the floor of either the House or Senate this year.

NRF expressed concern earlier this summer that the Boucher proposal is overly broad, and has similar concerns about the Rush bill.

“While the two House proposals are good starting points for discussion, NRF remains concerned that the unintended consequences of the bills if they were to be enacted could stifle innovation and growth for retailers at this critical time in our economic recovery,” NRF Senior Vice President and General Counsel Mallory Duncan said in a memo to member companies.

Both the Rush bill and the Boucher draft would address disclosure of privacy practices, collection and use of information, disclosure of information to third parties and enforcement by the Federal Trade Commission. Any company that collects personally identifiable information about individuals would be required to conspicuously display a clearly written, understandable privacy policy explaining how information is collected, used and disclosed. Companies would generally be allowed to collect information unless an individual affirmatively opted out of collection. But companies would need an individual’s express opt-in consent to use broadly defined “sensitive” information about an individual or to share personally identifiable information with unaffiliated parties for anything other than an operational or transactional purpose. While targeted at online shopping, the measures would also require notice and consent for collection of information in-person at retail stores.

The Rush bill would go further in two areas. Individuals would be given the right to access and dispute information collection about them, and would also be allowed to file private lawsuits for violations. The Boucher proposal would allow only the FTC, state attorneys general or other state officials to bring civil actions.

The Rush bill would also provide a safe harbor exemption from its opt-in requirements, customers access rights and private lawsuits for companies that participate in a “self regulatory choice program approved by the FTC. But the legislation requires that the self-regulation provide “equivalent or greater protections” compared with those in the measure, effectively making exemption from the bill contingent on compliance with the bill.

© 2010 National Retail Federation