Sign in Subscribe
Federal privacy legislation

That's a wrap (for now): federal privacy legislation update, December 23

It's official: at the end of the day, nothing passed

Jon

• 5 min read
Congress, with a grey sky in the background

The 117th Congress has adjourned  after passing the $1.7 trillion, 4155-page "omnibus" appropriations bill, so it's now official.  Even though several privacy bills advanced from committee in 2022, and bill sponsors continued to express confidence during the lame duck session, at the end of the day nothing passed either the House or Senate (let alone both).  Legislators have clearly heard that voters want them to do something, but the devil is in the details.  Privacy legislation is hard.

So after a short break, it's on to 2023.  With Republicans saying they'll use their new majority in the House to be obstructionist, and the filibuster unlikely to go anywhere in the Senate, it'll require bipartisan agreement for Congress to pass privacy legislation or anything else. The good news is that most of the key federal privacy bills have bipartisan sponsorship, and Big Tech's bad behavior alienating more and more legislators in both parties ... so it's certainly not impossible. Time will tell.

So let's do a quick wrapup of the 2022 session – and start looking forward to 2023. Here's the list of Nexus of Privacy posts on federal privay legislation; read on for a bill-by-bill breakdown and some thoughts about next year.

Fourth Amendment Is Not For Sale Act

The Fourth Amendment Is Not For Sale Act feels to me like a huge missed opportunity, with strong support from everybody at its House Judiciary hearing, and well-justified mistrust of law enforcement and intelligence agencies from both parties.  Alas, even though there were no obvious downsides to anybody but the surveillance-industrial complex, outgoing House Judiciary Chair Jerry Nadler never scheduled it for a markup.  Still, Incoming Judiciary Chair Jim Jordan is a supporter as well (and so is past Judiciary Chair Bob Goodlatte) so it still has a good chance.

The American Data Privacy and Protection Act (ADPPA)

ADPPA advanced from the House Energy & Commerce committee on a 53-2 vote, but could never overcome resistance from California, Washington, Maine, and other states that objected to its preemption of stronger current and future state and local laws.   It's the first comprehensive privacy bill to advance from committee this decade, so a signficant achievement, especially the bipartisan support for privacy as a civil right.

Preemption's far from the only issue with ADPPA; still, the bill's got plenty of supporters who see its giveaways to Big Tech as a feature, and don't have any problems with how it  falls short in protecting LGBTAIQ2S+ people, pregnant people, unhoused people, immigrants, and others who bear the brunt of privacy abuses.  So it'll probably be back again in 2023, and Republicans and centrist Dems have the votes to get it through the House, quite possibly weakening it even further in the process.  

Especially if DC-based privacy and civil rights organizations continue to support it (because "perfect is the enemy of the good"), there will be a lot of pressure on Senate Commerce Committee Chair Maria Cantwell to get on board.  Then again, Big Tech's going to continue provide high-profile examples of how badly regulation is needed, so hopefully DC-based privacy and civil rights organizations will start putting more effort into pushing to strengthen ADPPA instead of trying to convince Californians to give up their rights.

Kids privacy: KOSA and COPPA 2.0

On kids privacy, Senate Commerce also advanced the unconstitutional, anti-LGBTQ KOSA (the Kids Online Safety Act), and there were reports that the White House was pressuring Senators to support it, but spirited opposition from over 90 human rights and LGBTQ rights groups kept it from being added to the omnibus. Tech industry groups are suing to block California's similarly unconstitutional Age Appropriate Design Code, but that probably won't prevent Congress from giving KOSA another try next year.

Senate Commerce advanced COPPA 2.0 along a mostly-party-line vote, but Republican Senator Tom Wicker (D-MS) and others argued that it was better to focus on ADPPA because it fails to protect adults as well as kids.  As Senator Ed Markey notes, there are some key points that are in common between hese bills: banning targeted marketing to children, extending data protection to teenagers, and creating a Youth Marketing and Privacy division in the FTC.  Like the Fourth Amendment Act Is Not For Sale, this is a place where it would be easy for Congress to do something if they wanted to ... but I'm not holding my breath.

My Body My Data and the Health and Location Data Privacy Act

Rep. Sara Jacobs' My Body My Data Act to protect reproductive health data never got a hearing, and with Republicans in control of the House next year it's not likely to move forward.  Even so, this may well wind up as the session's most impactful bill: Washington state's My Health My Data Act is only one of many health data privacy acts we're likely to see in 2023.  

Danielle Keats Citron's The End of Roe Means We Need a New Civil Right to Privacy discusses the role of My Body My Data Act and the Warren/Wyden/Murray Health and Location Data Privacy Act (which also didn't get a hearing) in a post-Roe world.  

2023 will be an interesting year!

Of course, we'll also see new federal privacy legislation in 2023.  As Lia Holland of Fight for the Future and Mariah Grant of the Sex Workers Project of the Urban Justice Center point out in Fast Company Democrats’ double standard on financial surveillance will be even more dangerous.  So there may well e a lot going on in Congress.  

And of course as David Stauss points out in The Future of State Privacy Legislation After the 2022 Election, there's a lot going on at the state level too. Here in Washington state, our legislative session starts on January 9.  The My Health My Data Act is extremely promising and the People's Privacy Act is closer than it's ever been to getting a hearing.  Not only that, the Bad Washington Privacy Act's primary sponsor has retired after once again failing to pass weak, industry-backed legislation.  

A broad coalition of civil liberties, civil rights, consumer advocacy, labor, and progressive organizations and individual privacy advocates has steadily been building power over the last several years, and it feels like the best opportunity we've had yet to pass strong protections for Washingtonians. At the same time, we'll be staying involved with the federal legislation, building on the productive discussions we had with staffers this session.

I'll have a more detailed 2023 preview early next year.  Stay tuned!