Washington Lawyer - October 2019 - 20

Indeed, Congress would have to solve a number of tricky legal and political
challenges to pass the kind of landmark legislation that lawyers, activists, and
companies say is needed in the United States. Congress has been late to the
game. The European Union's GDPR came into force on May 25, 2018, setting
a global standard that U.S. multinational companies must follow. California,
home of some of the biggest tech companies in the world, charged ahead
of Congress by passing its own data privacy law that is set to go into effect
in early 2020.

The business risks to U.S. companies of the emerging checkerboard regulatory
environment are high, so there is keen interest in a comprehensive federal data
privacy bill that would minimize some of the threats.

The stakes are huge. Worldwide market spending for information security
products and services is projected to be $124 billion in 2019, according to a
forecast by research and advisory company Gartner, Inc. The market for legal
and regulatory work is exploding, with spending up 22 percent since 2017.

STICKING POINTS FOR CONGRESS

Earlier this year the Federal Trade Commission (FTC) fined Facebook $5 billion
in a settlement over data handling with Cambridge Analytica. Equifax, the
consumer credit scorer, was fined at least $575 million for failing to protect
customers' personal information. Yahoo offered to pay $117.5 million to people
whose email and home addresses were stolen in the largest data breach in
U.S. history. And Capital One announced in July that a hacker stole the Social
Security and bank account numbers of more than 100 million individuals.

"There is a lot of attention [being paid] to this. And there is actually considerable
bipartisan support in favor of legislation, but getting from there to a bill in
Congress that would have much of a consensus at all is a tough road," says Alan
Raul, head of the privacy and cybersecurity practice at Sidley Austin LLP.

So far leadership on Capitol Hill has been coming from the Senate Commerce
Committee chaired by Sen. Roger Wicker, a Mississippi Republican. Wicker has
signaled interest in moving a bill, and the committee held a number of hearings
earlier this year. The Senate Judiciary Committee also has jurisdiction over some
of the issues in play.
The picture in the U.S. House of Representatives, where big tech is facing harsh
new criticism, is more complicated. The House Judiciary Committee's antitrust
subcommittee summoned executives from Google, Amazon, Facebook, and
Apple to a hearing in July to defend their business practices.
"The purpose of today's hearing and of our investigation is to understand how
intermediaries are affecting the shape of our economy and our democracy,"
said Rep. Jerrold Nadler, a New York Democrat and chair of the House Judiciary
Committee. "How can and do these platforms use their market power? What
are the effects of this conduct? And how should policymakers respond?" are
questions the House is pursuing, Nadler said.
In February, business and consumer advocates clashed at a House
Subcommittee on Consumer Protection and Commerce hearing over what
should be in a federal data privacy law. Members in both the House and Senate
have introduced various pieces of legislation. Leadership backing for legislative
text was expected to emerge in both houses in September, which would help
give the debate focus and direction.
"There was a window of opportunity in early 2019 when, if the process had
been managed, you could have seen Congress coming out with a set of bills
that could have moved forward," says Kurt Wimmer, chair of the data privacy
and cybersecurity practice group at Covington & Burling LLP.

Privacy is a complicated area, and there are a lot of
nuances to consider because you are dealing not only
with consumer rights and how best to protect them,
but also on the other side, with the need to continue
to foster innovation in this really vibrant sector of
our economy. It is really a matter of calibrating what
the right approach is, which takes a lot of work.
KURT WIMMER
Covington & Burling LLP
20 WASHINGTON LAWYER

OCTOBER 2019

"Privacy is a complicated area, and there are a lot of nuances to consider
because you are dealing not only with consumer rights and how best to protect
them, but also on the other side, with the need to continue to foster innovation
in this really vibrant sector of our economy. It is really a matter of calibrating
what the right approach is, which takes a lot of work," Wimmer says.
Among the major roadblocks facing Congress is a sharp divide over whether
federal law should preempt emerging state laws in the area of data privacy. Big
companies that handle large volumes of sensitive consumer data would like a
somewhat watered-down national law that preempts state laws so that compliance standards are clear and not onerous, lawyers say. Consumer advocates
want clear rules about what companies can and cannot do with customer data,
but if federal law is going to preempt state laws, they want it to be tougher not
weaker than what the states are doing.
Another key sticking point is how much authority to give the FTC to create rules
for the industry and levy civil penalties for enforcement. Republicans generally
oppose giving the FTC more regulatory power, but the cyberworld is advancing
so rapidly that legislative language is unlikely to cover emerging issues in areas
such as artificial intelligence, facial recognition, and self-driving cars.
"It is not impossible to find time for data privacy legislation. It really is about
making some decisions and moving forward. Because everything is happening

Washington Lawyer - October 2019

Table of Contents for the Digital Edition of Washington Lawyer - October 2019