Sen. Moran to Introduce Privacy Bill That Beefs Up FTC, Expands Consumer Rights

Sen. Jerry Moran (R-Kan.) is planning to introduce a bill Thursday that will require the Federal Trade Commission to appoint at least 440 additional workers to oversee privacy and security, pre-empt most state and local privacy laws and mandate that companies solicit affirmative consent from users before collecting and sharing personal information about them.

As part of the 14-part bill, any company, nonprofit or carrier that collects and processes personal data will be required to adjust their current privacy practices so that they provide a clear privacy policy and allow consumers to access, port, correct and erase the private data that both companies and service providers collect about them. 

“While our economy has benefited from the use of data, these advancements should not be traded for an individual’s right to have control over their personal information,” Moran said in a statement to Morning Consult. “We have witnessed unauthorized activities and security breaches from bad actors attempting to access and process consumers’ personal data and sensitive information in unfair and deceptive ways.”

The legislation comes after a months-long effort with Sen. Richard Blumenthal (D-Conn.) to draft a comprehensive privacy bill, which started when a six-member working group within the Senate Commerce Committee to tackle such legislation fractured. 

However, Blumenthal’s office does not appear to be a part of the new bill. In a brief interview on Capitol Hill on Wednesday, Blumenthal said discussions for a bill are “continuing” but declined to provide further details.

A Moran spokesperson said that the senators couldn’t reach an agreement on enforcement items, despite being aligned around “most of the substantive consumer protections” in the bill.

The outlook for Moran’s bill is unclear. Despite bipartisan interest in establishing a federal standard, Senate Commerce Committee Chairman Roger Wicker (R-Miss.) told reporters last week that questions about whether to pre-empt state laws -- such as the California Consumer Privacy Act, which went into effect in January -- or give consumers the ability to sue companies remain “non-starters” with Democratic lawmakers. And Sen. John Thune (R-S.D.), who was a part of the original working group, said on the same day that there “isn’t any path forward at the moment.” 

Moran’s bill appears to be an attempt to bridge the gap between the strong, federal rule that Republican lawmakers have been calling for and the tougher consumer rights that Democrats want. The bill calls for giving the FTC the ability to fine after the first violation and also pre-empts state and local laws that overlap with the bill. While it doesn’t give consumers private right of action, the bill allows state attorneys general to bring civil suits on their behalf for privacy violations, and the FTC will have the ability to intervene in those lawsuits. 

Consumers would be given specific control over the flow of their personal information, including the right to access and see what data certain companies have collected about them, the right to correct that personal information and the right to request that the data be deleted or erased. And they’ll also be able to withdraw their consent for companies to process and collect information about them.

Entities that collect and process data on more than 20 million individuals or sensitive information from more than 1 million individuals will have to appoint a privacy officer and conduct privacy impact assessments whenever they plan to make changes to their data collection programs.

“Without action from Congress, consumers will continue to be vulnerable to future threats against their personal data, and innovators and job creators will be plagued with regulatory uncertainty resulting from a growing patchwork of state laws,” Moran said. “It is clear that Congress needs to act to provide consumers and companies with a clear federal standard that lays out robust protections for consumers’ personal data.