Washington Lawyer - October 2019 - 22

"There has been sensitivity about allowing the FTC to have broad rulemaking
authority because it may adopt broad sets of rules that could impact the
economy. This is mainly an issue for Republicans. So, Congress has for some
years not given the FTC rulemaking authority," Wimmer says. "It's pretty hard to
have a privacy law without having rulemaking authority under [it]," he adds.
Wimmer says Congress should pass legislation that will last for many years
but that would allow for changes under the umbrella of that legislation. "It's
helpful to have an agency that can look at what's changing and say, here's what
we are going to do, or look at when specific issues arise. Biometric identification,
artificial intelligence, machine learning, connected devices in the internet
of things - these are all very specific, highly dynamic areas that are hard to
capture in a statute, but that could definitely be dealt with in rulemaking by
a federal agency."

In the EU, data privacy is considered a fundamental
right. People in the EU generally feel very strongly
about protecting and being able to control their
personal or sensitive information. Contrast that to
a more liberal or at least more wide-ranging belief
system regarding data privacy here in the United
States, and then add in a variety of commercial
and political elements, and you've got a more
complicated landscape.
YODI HAILEMARIAM
Drinker Biddle & Reath LLP

got 2,000 other things occupying our attention. And maybe now that there
is a federal privacy law, we don't need to pass a privacy law,'" Wimmer adds.
"One of the hurdles here is that our corporate friends are really stuck on the
preemption issue, and they are having a hard time talking about anything
else. The irony is that the only way to get to preemption is by talking about
everything else and getting the big picture together in a good bill that would
make members feel comfortable intervening in state actions," says the CDT's
Richardson.
"We would like a single federal standard, but we think it is only justified if the
federal legislation is incredibly strong and requires companies to do better on
privacy and security. It is not worth trading preemption, which is really the
leverage here and why the companies are interested, for something that is
weak," Richardson adds.
While Republicans want preemption and Democrats generally don't, the
opposite is true about giving the FTC more rulemaking authority in the area
of data privacy.

22 WASHINGTON LAWYER

OCTOBER 2019

Steering away from California's opt-in, opt-out model, the CDT is advocating
Congress to take an approach that provides clear rules about how companies
can and cannot use data, says Richardson.
"That would be a whitelist of things that are appropriate to the service that
someone signs up for," she says. "But then there also needs to be something like
a blacklist. And for us that means repurposing data, especially sensitive data like
location and health information. The way it would work is, if it's not necessary
for offering the services the consumer signed up for, you can't collect, use, and
share it."
For Freeman, a comprehensive federal privacy law will likely have the same sort
of structure as the GDPR and the CCPA in terms of consumers' rights and companies' obligations. "The devil will be in the details: in the definitions, in whether
there will be a private right of action, and regarding the nature and scope of
preemption. And that is all up for debate," Freeman says.

GLOBAL OUTLOOK
Beyond the domestic debate in the United States, other countries like Japan,
India, and Brazil have recently introduced or amended existing data privacy
frameworks following the example of Europe's GDPR, says Yodi Hailemariam,
an associate at Drinker Biddle & Reath LLP.
"It raises an interesting anthropological question globally - does where we
live, our culture, what we're exposed to, and how the people around us think
and feel affect our notions?" Hailemariam says.
"In the EU, data privacy is considered a fundamental right. People in the EU
generally feel very strongly about protecting and being able to control their
personal or sensitive information. The EU government has always responded to
that," Hailemariam adds. "Contrast that to a more liberal or at least more wideranging belief system regarding data privacy here in the United States, and then
add in a variety of commercial and political elements, and you've got a more
complicated landscape.
"Some people may be comfortable with trading personal data for access to
better goods, better deals, or for connections to long-lost friends, but others
may feel much more strongly about protecting their digital identities and electronic footprint," Hailemariam says. "We have such a diverse set of opinions here
that there isn't as much definite consensus just yet. But we could be heading in
that direction."

William Roberts is a regular contributor to Washington Lawyer.

Privacy lock image, Shutterstock; Kurt Wimmer, courtesy of Covington & Burling LLP; Reed Freeman, courtesy of
WilmerHale LLP; Yodi Hailemariam, courtesy of Drinker Biddle & Reath LLP

Washington Lawyer - October 2019

Table of Contents for the Digital Edition of Washington Lawyer - October 2019