During an interview last October on the sudden upsurge in interest surrounding data privacy, Republican Sen. Roger Wicker—now chairman of the Senate Commerce Committee—said, “we need to have a law on the books, a federal law on the books, by the end of 2019.”
It’s a sentiment echoed by lawmakers on the other side of the aisle. “It’s a very complex and challenging topic, but we’re seeing a lot of those moving parts come together,” said Democratic Sen. Richard Blumenthal, when asked last week about the feasibility of the 2019 timeline. “We have supporters in the industry, we have Republicans—among Democrats like myself there’s, I think, critical mass. And it will be difficult, but it’s certainly possible.”
As new data breaches pile up and regulators in California and the European Union enact their own privacy regulations, Congress is increasingly eager to weigh in with its own standard. Silicon Valley’s desperate push to preempt California’s aggressive new rules with a lighter federal framework before they go into effect next year has only added to the sense of urgency.
But away from Capitol Hill, experts are increasingly unconvinced that a landmark privacy bill can become law within the next 12 months. Given the sluggish first steps taken by the relevant committees, the staggering complexity of any wide-reaching legislation, uncertainty within the business community and between policymakers over the contours of a bill, and an unexpected government shutdown, most expect the passage of serious privacy legislation to take several years at the minimum.
“I’ve never seen a national, consequential bill—particularly when we’re talking about technology policy—happen in a very short period of time,” said Ernesto Falcon, legislative counsel at the Electronic Frontier Foundation, a group that supports aggressive privacy legislation. Falcon compared debate over privacy legislation to the 1996 Telecommunications Act, which he says took six years to pass despite broad consensus that the legislation was needed.
Experts on the other side of the privacy debate also expect the road to legislation will be long and arduous.
“I think it’s wishful thinking that, with everything else going on, both chambers will come to a consensus view on privacy and pass something this year (short of sticking it on some must-pass vehicle),” wrote Zach Graves, head of the free-market tech group Lincoln Network, in an email. “In my view, building bipartisan consensus around a compromise bill is the most we can hope for this year.”
Last year saw a steady stream of data-privacy bills introduced by members of both parties, a trend that looks likely to escalate in the new Congress—Sen. Marco Rubio, a Republican rarely mentioned as part of the broader privacy debate, introduced his own legislation Wednesday, and Sens. Amy Klobuchar and John Kennedy unveiled their own bipartisan bill on consumer privacy Thursday.
But all that activity obscures the larger point. Within the relevant committees in either chamber, a consensus has yet to form around any bill that could pass out of committee. And neither Wicker nor Rep. Frank Pallone, the Democratic chairman of the House Energy and Commerce Committee, have put privacy at the top of their priority list when it comes to holding hearings in early 2019.
Given all the professed interest, some are perplexed by what they see as a lack of Capitol Hill’s progress on the issue. “I was surprised that there wasn’t more text that we could find when we talked to [GOP Senate leadership] in late December,” said Daniel Castro, the vice president of the Information Technology and Innovation Foundation. “It didn’t seem like there was anything in place for what was coming next.”
Abigail Slater, the special assistant to the president for tech, telecom, and cyber policy, expressed a similar sentiment when describing recent meetings with Democratic congressional offices. “Honestly, they were at such early stages themselves,” she told National Journal on Wednesday, when asked whether any major policy differences have cropped up between Democrats and the White House on privacy legislation.
Slater was also unable to articulate the White House’s specific views on a privacy bill. “We just were there as much symbolically, to demonstrate interest in the issue and a desire to work with them,” she said.
But major policy differences are almost certain to arise. Republican Sen. John Thune, the former Commerce chairman now in charge of the Subcommittee on Communications, Technology, Innovation, and Internet, has repeatedly voiced his preference for a “light touch” approach on privacy. But most House Democrats say any bill that stands a chance at passage needs to be at least as aggressive as regulatory efforts elsewhere.
“Anything Congress does needs to be stronger than California, not weaker,” said Rep. Ro Khanna, a Democrat whose district includes a substantial portion of Silicon Valley.
Khanna, who last year introduced an “Internet Bill of Rights” that includes strong privacy rules, suggested he has the ear of Rep. Jan Schakowsky, the new chair of the Consumer Protection and Commerce Subcommittee and Pallone’s pick to jumpstart the privacy push in the House.
Despite an overarching desire to avoid burdensome state rules, industry may be as divided as Congress on the nuts and bolts of privacy legislation. Companies that monetize personal data on a grand scale, such as Facebook and Google, have a very different perspective on potential legislation than a hardware company like Apple, where chief executive Tim Cook continues to push for more expansive rules. And that’s just within the tech industry—the finance and retail sectors are also expected to weigh in, and their priorities are also split.
“I think there’s a lot of daylight between different stakeholders on what the proposal should look like,” said Castro. “And there hasn’t been enough time to really go through an extensive revisions process, which is what you’d want for any legislation like this that’d have such a big impact on the economy.”
There’s also the government shutdown, which shows no signs of abating and threatens to derail more than just data privacy in the new Congress. Having earlier teased the possibility that a Senate privacy bill would be introduced early in 2019, Blumenthal expressed frustration that the ongoing chaos was diverting attention and energy elsewhere. “I didn’t foresee a shutdown lasting three weeks with no end in sight right now,” he said.
But Blumenthal won’t give up on a 2019 timeline for passage, suggesting that the House—which has so far held fewer discussions on privacy legislation—could quickly catch up to the work done in the Senate. He also pushed back on the skepticism voiced by some experts. “They think 2020 will be easier?” he asked.
Actually, they don’t. “I think everyone is interested in having a good privacy law at the end of this,” said Falcon. “But you really have a short operational window this year with the campaign for president coming on the backdrop—maybe eight months?”
“I think we’re looking at a multiyear effort before we see anything on the federal level,” Falcon said. “And we may not ever see anything on the federal level.”