{"id":4074,"date":"2022-09-12T17:00:00","date_gmt":"2022-09-12T17:00:00","guid":{"rendered":"https:\/\/2024.thenexus.today\/index.php\/2022\/09\/12\/adppa-new-compromise\/"},"modified":"2022-09-12T17:00:00","modified_gmt":"2022-09-12T17:00:00","slug":"adppa-new-compromise","status":"publish","type":"post","link":"https:\/\/2024.thenexus.today\/index.php\/2022\/09\/12\/adppa-new-compromise\/","title":{"rendered":"Who could have predicted? A potential &#8220;new compromise&#8221; for ADPPA!"},"content":{"rendered":"<p><em>Last updated September 15<\/em><\/p>\n<blockquote><p>It could well be that [lobbyist Jon] Leibowitz et. al. are just posturing, and the industry plan is to demand concessions on other fronts in return for a &#8220;compromise&#8221; on preemption: add California&#8217;s privacy law to the already-long list of preemption exceptions, give the California Privacy Protection Agency the authority they need, and hangs Maine, Washington, and all the other states that also don&#8217;t want to be preempted out to dry.<\/p>\n<p>\u2013 me, in <a href=\"__GHOST_URL__\/a-fresh-wrench-and-two-hearings\/#what-next-on-preemption\">A &#8220;fresh wrench&#8221;, two hearings, and a busy week<\/a>, July 17<\/p><\/blockquote>\n<p>In July, the House Energy &amp; Commerce committee voted 53-2 to advance the American Data Privacy and Protection Act (ADPPA), a broad consumer privacy bill. \u00a0It&#8217;s the first time this century a consumer privacy bill has advanced from committee, and privacy and civil rights groups have justifiably lauded ADPPA&#8217;s inclusion of civil rights protections as a huge milestone. \u00a0<\/p>\n<p>The next step for ADPPA is a vote on the House floor. \u00a0But right before the Labor Day weekend, House Speaker Nancy Pelosi issued a firm statement saying that wouldn\u2019t happen unless there were changes in ADPPA.<\/p>\n<blockquote><p>California\u2019s landmark privacy laws&#8230; \u00a0must continue to protect Californians \u2014 and states must be allowed to address rapid changes in technology.<\/p><\/blockquote>\n<p>Oh no!<\/p>\n<p>Republicans have said they&#8217;re only willing to support a privacy bill if it preempts California!!<\/p>\n<p>And now California&#8217;s not willing to be preempted!!!<\/p>\n<p><em><strong>Does this mean that ADPPA is &#8220;<\/strong><\/em><a href=\"https:\/\/www.adweek.com\/programmatic\/ad-tech-granted-some-relief-with-federal-privacy-bill-dead-in-this-congress\/amp\/\"><em><strong>dead<\/strong><\/em><\/a><em><strong>&#8220;?<\/strong><\/em><\/p>\n<h2 id=\"don%E2%80%99t-be-silly\"><strong>Don\u2019t be silly<\/strong><\/h2>\n<blockquote><p>The level to which Pelosi&#8217;s stance affects the ADPPA&#8217;s chances will depend on what kind of agreement can be reached, if any, to soften preemption.<\/p>\n<p>\u2013 Joe Duball, <a href=\"https:\/\/iapp.org\/news\/a\/pelosi-rejects-proposed-american-data-privacy-and-protection-act-seeks-new-compromise\/\">Pelosi opposes proposed American Data Privacy and Protection Act, seeks new preemption compromise<\/a><\/p><\/blockquote>\n<p>Of course this doesn&#8217;t mean ADPPA is dead. \u00a0It&#8217;s not even news: Pelosi and California Democrats have had this position <a href=\"https:\/\/www.politico.com\/story\/2019\/02\/21\/congress-data-privacy-california-1185943\">since 2019<\/a>. Legislators, staffers, lobbyists, and privacy advocates have all put a huge amount of effort into ADPPA and its predecessors over the last few years. They&#8217;re not going to give up just because the preemption issue hasn&#8217;t been resolved yet.<\/p>\n<p>Pelosi&#8217;s statement made it clear that discussions are continuing. \u00a0Along with statements from House Energy &amp; Commerce Chair Frank Pallone and Ranking Member Cathy McMorris Rodgers (two of ADPPA&#8217;s sponsors), it&#8217;s just part of the negotiating process. \u00a0<\/p>\n<p>In fact, there&#8217;s already been a &#8220;new compromise&#8221; proposed on preemption. But before we get to that &#8230;<\/p>\n<h2 id=\"can-we-talk-about-something-besides-preempting-california-for-a-second\"><strong>Can we talk about something besides preempting California for a second?<\/strong><\/h2>\n<p>There\u2019s been so much focus on preemption and California that a lot of other important questions about ADPPA haven\u2019t gotten a lot of airtime, starting with one that&#8217;s top of mind for a lot of people right now. \u00a0<\/p>\n<p><strong>Does ADPPA protect against post-Roe threats to privacy?<\/strong> Probably not.<\/p>\n<ul>\n<li>Rep. Anna Eshoo says that &#8220;under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps.&#8221;<\/li>\n<li>Sen. Ron Wyden (who&#8217;s usually right about stuff like this) says the de-identified data loophole &#8220;could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals.\u201d <\/li>\n<li>Senate Commerce Committee staffers warn that the bill would force pregnant people to \u201cjump through arbitrary, drawn-out hoops\u201d to sue over privacy violations.<\/li>\n<li>Kim Clark of progressive feminist non-profit Legal Voice says \u201cThis bill, at least from the perspective of pregnant people, it really doesn\u2019t do much\u201d<\/li>\n<\/ul>\n<p><a href=\"https:\/\/nexusofprivacy.net\/adppa-post-roe-threats\/\">How well does ADPPA protect against post-Roe threats?<\/a> goes into more detail, including <\/p>\n<h2 id=\"a-few-more-topics-that-could-use-a-lot-more-discussion\">A few more topics that could use a lot more discussion<\/h2>\n<ul>\n<li><strong>Do the changes in the latest version of the bill give free rein to government contractors? <\/strong>Quite possibly. In <a href=\"https:\/\/www.eff.org\/deeplinks\/2022\/07\/americans-deserve-more-current-american-data-privacy-protection-act\">Americans Deserve More Than The Current American Data Privacy Protection Act<\/a>, EFF says they\u2019re concerned about this, and I haven&#8217;t yet seen any good responses convincing me otherwise.<\/li>\n<li><strong>Does ADPPA protect LGBTAIQ2S+ people?<\/strong> No. As WA People\u2019s Privacy pointed out on Twitter, <a href=\"https:\/\/twitter.com\/wapeopleprivacy\/status\/1559999090917720064\">sexual orientation has now been removed from the definition of &#8220;sensitive data,&#8221; and sex and gender were never included<\/a>. \u00a0And that&#8217;s only one of the problems; <a href=\"https:\/\/thenexusofprivacy.net\/adppa-with-a-queer-lens\/\">Stress-testing ADPPA with a queer lens<\/a> also discusses how ADPPA stacks up against threats to queer people Antoine Prince Albert III wrote about in <a href=\"https:\/\/publicknowledge.org\/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws\">Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws<\/a>,<\/li>\n<li><strong>Does ADPPA let state Attorneys General enforce the law?<\/strong> Not so much. AGs from states including Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, and Washington warn in a July 19 letter that the current version of the bill appears to <a href=\"https:\/\/oag.ca.gov\/system\/files\/attachments\/press-docs\/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf\">\u201csubstantially preempt many states\u2019 ability to investigate\u201d and \u201cunnecessarily interferes with robust enforcement capabilities.\u201d<\/a>\u200b\u200b<\/li>\n<li><strong>Does ADPPA let people sue companies who break the law?<\/strong> In many cases, no. \u00a0As Rep. Donald McEachin of Virginia, Sen. Maria Cantwell of Washington, and EFF have all highlighted, ADPPA allows companies to force people into arbitration. \u00a0Senate Commerce committee staffers said in a memo that ADPPA makes it harder for people to &#8220;seek redress when their sensitive health data has been used against them.\u201d There&#8217;s often a &#8220;right to cure&#8221;, giving companies a get-out-of-jail free card; the Bad Washington Privacy Act also had a right to cure, and Washington&#8217;s AG called it &#8220;anti-consumer&#8221;. EFF goes into more detail on how the bill needs stronger individual rights to fight back, including \u00a0statutory damages, in <a href=\"https:\/\/www.eff.org\/deeplinks\/2022\/07\/americans-deserve-more-current-american-data-privacy-protection-act\">Americans Deserve More Than The Current American Data Privacy Protection Act<\/a>.<\/li>\n<li><strong>Does ADPPA provide sufficient resources and authority for FTC enforcement?<\/strong> Nope. The current version doesn&#8217;t provide any additional funding for the FTC, but adds substantial new responsibilities (including approval of &#8220;compliance guidelines&#8221; submitted by companies and trade associations, who can then presumably sue if the FTC doesn&#8217;t respond within the one-year timeframe).<\/li>\n<li><strong>Are ADPPA&#8217;s algorithmic auditing requirements strong enough to make the civil rights protections against anti-discrimination real?<\/strong> I don\u2019t think so, especially after they were significantly weakened in the last version. \u00a0<a href=\"https:\/\/thenexusofprivacy.net\/adppa-impact-assessments-and-civil-rights\/\">ADPPA\u2019s algorithmic impact assessments are too weak to protect civil rights &#8212; but it\u2019s not too late to strengthen them<\/a> and <a href=\"https:\/\/thenexusofprivacy.net\/comments-for-ftc-public-forum-for-commercial-surveillance\/\">Automated Systems and Discrimination<\/a> go into more detail on the changes that are needed.<\/li>\n<li><strong>Does ADPPA provide whisteblower protections? <\/strong>No. In a <a href=\"https:\/\/www.documentcloud.org\/documents\/22111995-ferguson-privacy-letter-to-4-corners_6-24-2022\">June 24 letter<\/a>, Washington&#8217;s Attorney General Bob Ferguson said &#8220;Frances Haugen demonstrates how important whistleblowers are to daylighting abusive practices that violate Americans\u2019 privacy and I encourage you to add whistleblower protections to the ADPPA.&#8221;<\/li>\n<\/ul>\n<p>I could go on \u2026 what about the \u201cbossware\u201d loopholes? \u00a0What about the &#8220;pay for privacy&#8221; regime, where it&#8217;s okay to charge customers more or provide lower levels of service if you they don&#8217;t agree to be part of a &#8220;voluntary&#8221; loyalty program (which can require consenting to data sharing or sale)? \u00a0A potential loophole allowing ISPs to escape hundreds of millions in fines? \u00a0What are the implications of lowered protections for location data from photos, surveillance cameras, and license plate readers? \u00a0But hopefully there\u2019s enough here to make my point.<\/p>\n<p>So yes, It\u2019s a problem that ADPPA preempts California\u2019s law. And as Californians for Consumer Privacy highlight in their <a href=\"https:\/\/www.caprivacy.org\/letter-to-speaker-nancy-pelosi-opposing-adppa\/\">Letter to Speaker Nancy Pelosi Opposing The American Data Privacy and Protection Act<\/a>, the many ways that ADPPA falls short of California&#8217;s law are also problems. \u00a0<\/p>\n<p>But those aren&#8217;t the only problems we should be be talking about! \u00a0<\/p>\n<h2 id=\"people-in-other-states-and-cities-have-opinions-on-preemption-too\"><strong>People in other states and cities have opinions on preemption too!<\/strong><\/h2>\n<blockquote><p>&#8220;In 2019, the Maine Legislature enacted L.D. 946, An Act to Protect the Privacy of Online Customer Information. The law is at the forefront of consumer privacy protection, and it reflects hard-fought progress in Maine to foriify consumer data against unauthorized connection and use by Internet Service Providers.<\/p>\n<p>Current efforts to adopt federal privacy legislation could imperil this progress, and similar progress made in other states across the country.&#8221;<\/p>\n<p>Aaron Frey, Attorney General, State of Maine, in a <a href=\"https:\/\/www.eff.org\/document\/2022-07-13-letter-maine-ag-congress-re-adppa\">July 13 letter<\/a><\/p><\/blockquote>\n<p>And it&#8217;s not like Californians are the only ones who oppose preemption. \u00a0So does AG Frey \u2013 and AGs from Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, and Washington, who made similar points in their <a href=\"https:\/\/oag.ca.gov\/system\/files\/attachments\/press-docs\/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf\">coalition letter<\/a>. \u00a0But all the focus on <em>California<\/em>&#8216;s opinion about preemption of their state law frames it as California just being selfish, and obscures both the breadth of the opposition and ADPPA&#8217;s preemption of local laws.<\/p>\n<p>Seattle&#8217;s Broadband Privacy Ordinance would similarly be preempted \u2013 and so would Seattle&#8217;s ability to pass future privacy laws. \u00a0<a href=\"https:\/\/iexaminer.org\/interims-corner-the-washington-privacy-act-insufficient-for-the-immigrant-refugee-communities-we-serve\/\">Here&#8217;s what Derek Lum of Seattle&#8217;s InterIm CDA had to say<\/a> about the preemption clause in the Bad Washington Privacy Act in 2021:<\/p>\n<blockquote><p>&#8220;This cuts off one of the few avenues that organizations like mine can use to seek better protections for those we serve. Most of our community members live in Seattle, and they have reason to hope that the city will protect its vulnerable populations\u2019 privacy. To deny them this avenue of protection is not right and would be severely limiting our ability to protect our communities.&#8221;<\/p><\/blockquote>\n<p>Dozens of Tech Equity Coalition organizations and allies made a similar point in a letter to our state legislature: \u201c<a href=\"https:\/\/signon-acluofwashington.nationbuilder.com\/support_kloba_amendment_to_sb_5062\">a preemption provision prevents local jurisdictions from making important privacy decisions for their residents<\/a>.\u201d <\/p>\n<p>Here&#8217;s some other opinions about ADPPA&#8217;s preemption from Washington state. \u00a0<\/p>\n<ul>\n<li>Maya Morales of WA People\u2019s Privacy said at the California Privacy Protection Agency\u2019s July 28 special board meeting that \u201c<a href=\"https:\/\/wapeoplesprivacy.org\/our-public-comment-in-historic-ccpa-meeting\/\">It\u2019s important to be crystal clear about who preemption serves, and who it harms: preemption privileges the needs of corporations over the needs of people<\/a>.\u201d<\/li>\n<li>A dozen Indivisible groups said in a June 13 letter that \u201c<a href=\"https:\/\/indipluswa.medium.com\/indivisible-letter-to-sen-cantwell-and-rep-mcmorris-rodgers-on-federal-privacy-legislation-8071ba1d350e\">it is extremely important to us that federal legislation does not preempt Washington state\u2019s own future privacy legislation.<\/a>\u201d<\/li>\n<li>In <a href=\"https:\/\/thenexusofprivacy.net\/adppa-with-a-queer-lens\/\">Stress-testing ADPPA with a queer lens<\/a>, I wrote &#8220;From an LGBTAIQ2S+ perspective, this means that if a city like Seattle or a state like Washington wants to better protect its LGBTAIQ2S+ residents by addressing some these problems &#8230; we can&#8217;t.&#8221;<\/li>\n<\/ul>\n<p>And now, back to California &#8230;<\/p>\n<h2 id=\"what-new-compromise-could-they-possibly-have-in-mind\">What &#8220;new compromise&#8221; could they possibly have in mind?<\/h2>\n<blockquote><p>&#8220;Drawing on lessons from the environmental field, there may indeed be a way forward just as [EPIC Privacy President and Executive Director Alan] Butler suggests, with California as our guide&#8230;.<\/p>\n<p>The federal bill can provide California with a waiver, which would recognize its unique position as the home of a critical mass of tech companies and a leader in regulating them. (The Department of Commerce or the Federal Trade Commission could be tasked with determining whether California\u2019s innovations offer greater data privacy protections than the ADPPA to warrant the waiver.) The state could continue to create privacy protections that meet evolving problems, and the nation can avoid the confusion that would result if all 50 states made their own privacy laws.&#8221;<\/p>\n<p>&#8212; <a href=\"https:\/\/slate.com\/technology\/2022\/09\/nancy-pelosi-data-priavcy-law-adppa.html\">Nancy Pelosi Is Blocking Landmark Data Privacy Legislation\u2014for a Good Reason<\/a>, Danielle Keats Citron and Alison Glocke, <em>Slate<\/em><\/p><\/blockquote>\n<p>Hey! We&#8217;ve got a critical mass of tech companies in Washington too! What are we, chopped liver?<\/p>\n<p><strong>UPDATE<\/strong>, September 13: <\/p>\n<blockquote><p>&#8220;Another approach lawmakers should consider is a framework similar to <u><a href=\"https:\/\/www.epa.gov\/state-and-local-transportation\/vehicle-emissions-california-waivers-and-authorizations\">the federal Clean Air Act<\/a><\/u>, which allows California to set a tougher standard than the national one and lets states choose which they want to follow.&#8221;<\/p>\n<p>\u2013 LA Times editorial, <a href=\"https:\/\/www.latimes.com\/opinion\/story\/2022-09-12\/editorial-congress-fix-data-privacy-bill-preempt-california\">Congress must fix data privacy bill so it doesn\u2019t hurt Californians<\/a><\/p><\/blockquote>\n<p>I&#8217;m noticing a pattern here &#8230;*<\/p>\n<h2 id=\"tweaking-the-grand-bargain\">&#8220;Tweaking&#8221; the &#8220;grand bargain&#8221;<\/h2>\n<p>ADPPA&#8217;s supporters have argued that they only way to get federal privacy legislation is a \u201c<a href=\"https:\/\/twitter.com\/privacypen\/status\/1549237595418365952\">grand bargain<\/a>\u201d: <\/p>\n<ul>\n<li>Republicans will support providing some protections to cis straight non-pregnant people all over the country; something called a &#8220;private right of action&#8221; that people have to jump thrugh hoops to use and doesn&#8217;t have statutory damages; and exemptions for government contractors<\/li>\n<li>In return, Democrats will agree states can&#8217;t provide stronger protections to their residents; AGs and privacy agencies will have a hard time enforcing the law; forced arbitration and a right to cure that can prevent people from suing; and California will give up legislation that had been passed by a referendum in 2020. <\/li>\n<\/ul>\n<p>As stated, this was never going to fly. California has made it clear \u00a0<a href=\"https:\/\/www.politico.com\/story\/2019\/02\/21\/congress-data-privacy-california-1185943\">since 2019<\/a> and at every stage of discussions htis session that they were not on board. Senate Commerce Chair Maria Cantwell has firmly said she&#8217;s not on board either. And I suspect that most progressive Democratic legislators would have some serious qualms with the &#8220;grand bargain&#8221; as I&#8217;ve described it here.<\/p>\n<p>And yet, here we are.<\/p>\n<p>EPIC Privacy Executive Director Alan Butler <a href=\"https:\/\/iapp.org\/news\/a\/pelosi-rejects-proposed-american-data-privacy-and-protection-act-seeks-new-compromise\/\">suggests<\/a> that the path forward is to combine &#8220;substantive tweaks to address issues of differences raised by the CPPA and others in California&#8221; with possible modifications to the preemption provisions. He&#8217;s got a lot more visibility into the negotiations than I do, so who knows &#8230; maybe they really can &#8220;tweak&#8221; the &#8220;grand bargain&#8221; and piece together a &#8220;new compromise&#8221; with the votes to at least get ADPPA through the House while still ignoring input from the other 49 states. \u00a0We shall see.<\/p>\n<p>Keep in mind that Big Tech is playing a long game here. \u00a0If Congress passes a weak preemptive ADPPA this year, they win.** If not, they&#8217;ll go back to <a href=\"https:\/\/themarkup.org\/privacy\/2021\/04\/15\/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious\">pushing states to pass weak privacy laws<\/a> and<a href=\"https:\/\/themarkup.org\/privacy\/2022\/05\/26\/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time\"> watering down attempts at privacy regulation, one state at a time<\/a>. \u00a0<\/p>\n<p>EPIC&#8217;s and Lawyers&#8217; Committee&#8217;s strong support for ADPPA is likely to make Big Tech&#8217;s path through the states a lot easier. One straightforward strategy: use a weakened ADPPA as a starting point, and further weaken it in states where their lobbying is strongest.*** \u00a0It&#8217;s similar to the strategy they took after we rejected the Bad Washington Privacy Act and an Amazon lobbyist introduced it in Virginia, only better (from a Big Tech perspetive); with ADPPA they&#8217;ll be able to tell legislators things like &#8220;privacy groups like EPIC and civil rights groups like Lawyers&#8217; Committee support the bill and the only reason Congress didn&#8217;t pass it was those selfish Californians care more about their ego than protecting people who live in other states.&#8221; Then once it&#8217;s passed in a few states, they can take another crack at getting a mostly-preemptive bill through Congress.<\/p>\n<p>To be fair, EPIC and Lawyers&#8217; Comittee are in a tough position here. They&#8217;ve heard repeatedly that the &#8220;grand bargain&#8221; is the only path through Congress this session. Depending on how the midterms go, the Congressional landscape might be even tougher next session. Their support for the bill so far resulted in a 53-2 bipartisan vote for the principle that privacy is a civil right, which is a major accomplishment. They probably couldn&#8217;t have gotten that without advocating so strongly for a bill they know has major weaknesses.<\/p>\n<p>But there&#8217;s a big cost to that as well. I&#8217;m sure they&#8217;re continuing to push for improvements behind the scenes, but since they&#8217;ve already announced their support for the bill I wonder how much leverage they have. And even though <a href=\"https:\/\/www.protocol.com\/newsletters\/policy\/cloud-enterprise-privacy\">lobbying from Microsoft, IBM and others has significantly weakened the bill<\/a> and <a href=\"https:\/\/www.politico.com\/news\/2022\/08\/28\/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958\">data brokers are lobbying up a storm<\/a>, EPIC&#8217;s and Lawyers&#8217; Committee&#8217;s public statements continue to focus on ADPPA&#8217;s strengths and the ways they see it as better than California&#8217;s law. <\/p>\n<h2 id=\"democrats-have-other-options\">Democrats have other options<\/h2>\n<blockquote><p>\u201cWe see an opportunity for asking Democrats to recognize the threats that have become far more acute in a post-Roe worldand to consider using the leverage they have \u2013 which is not insignificant \u2013 to consider these improvements in that light.\u201d<\/p>\n<p>\u2013 Shaunna Thomas of Ultraviolet,<a href=\"https:\/\/www.spokesman.com\/stories\/2022\/jul\/25\/historic-data-privacy-law-could-be-within-reach-if\/\"> quoted in the Spokane Spokesman-Review<\/a><\/p><\/blockquote>\n<p>Even putting the other 49 states aside, ADPPA&#8217;s gonna need a heckuva lot of &#8220;substantive tweaking&#8221; to address Californians&#8217; issues. \u00a0Californians for Consumer Privacy&#8217;s latest comparison highlights quite a few differences, some of which need substantial tweeking to address. EFF is also California based, and they&#8217;ve got a stack of issues as well. Meanwhile industry will be demanding concessions elsewhere to make up for a preemption waiver for California. \u00a0How much strengthening will Republicans go along with? \u00a0<\/p>\n<p>If the answer is &#8220;not enough&#8221;, supporting a bill that leaves pregnant people at risk is very fraught for Democrats who are counting on their strong stance on reproductive rights after the Dobbs decision to motivate voters \u2013 and a bill that doesn&#8217;t protect LGBTAIQ2S+ people puts the 175 members of the LGBTQ Equality Caucus in <a href=\"https:\/\/thenexusofprivacy.net\/adppa-with-a-queer-lens\/\">a very awkward position<\/a>.<\/p>\n<p>So hopefully Democrats are looking at other options. They have the votes to get something through the House that actually <em>does <\/em>protect pregnant people if they want to. Perhaps it&#8217;s time to stop focusing on ADPPA, and instead push the My Body My Data and the Health and Location Data Privacy Act, which have narrower but much stronger protections for reproductive health data and pregnant people. \u00a0Or, they could remove preemption and significantly <em>strengthen <\/em>ADPPA by closing loopholes, removing the forced arbitration protection, and adding whistleblower protections.<\/p>\n<p>Conventional wisdom is that if the Dems move forward on My Body My Data, Health and Location Data Privacy Act, or a significantly strengthened ADPPA, whatever the House passes won&#8217;t have any chance in the Senate. I&#8217;m not completely convinced by this,**** but suppose it&#8217;s true. \u00a0<\/p>\n<p>So what? \u00a0<\/p>\n<p>After all, if nothing\u2019s going to pass, it\u2019s far better for Democrats to position themselves as having fought for strong privacy protections \u2013 and position Republicans as so virulently anti-abortion that they\u2019ll sacrifice everybody\u2019s\u2019 privacy just to be able to let vigilantes and sinister prosecutors get at pregnant people\u2019s health data.<\/p>\n<p>And privacy advocates can play a long game too. \u00a0The House passing some <em>strong <\/em>legislation sets up for next year&#8217;s legislative battles in the states \u2013 even if it doesn&#8217;t pass the Senate. And depending on the November results, it could be a different story in Congress next session. If the Democrats pick up a couple of seats in the Senate and hold the House, they might well remove the filibuster for abortion-related legislation.<\/p>\n<p>Everybody agrees that the Supreme Court&#8217;s Dobbs decision ending Roe has changed the political landscape when it comes to privacy. \u00a0Let&#8217;s hope Democrats seize the opportunity.<\/p>\n<h2 id=\"it-aint-over-til-its-over\"><strong>It ain&#8217;t over til it&#8217;s over<\/strong><\/h2>\n<p>It&#8217;ll be interesting to see how things play out over the next few weeks. \u00a0The House is in session again from September 13 to September 30. \u00a0<a href=\"https:\/\/cdt.org\/wp-content\/uploads\/2022\/08\/2022-08-25-ADPPA-Disability-Rights-Groups-Letter-to-Pelosi.pdf\">25+ disability rights groups<\/a> have called for ADPPA to be brought to a vote, highlighting the many provisions that will help protect disabled people. \u00a0So have<a href=\"https:\/\/epic.org\/epic-joins-48-public-interest-groups-urging-house-to-vote-on-american-data-privacy-and-protection-act\/\"> dozens of public interest groups<\/a>, highlighting its civil rights protections.<\/p>\n<p>Meanwhile, the FTC&#8217;s public forum on commercial surveillance last Thursday <a href=\"https:\/\/threadreaderapp.com\/thread\/1567937896786857985.htm\">spotlighted the need for strong regulations<\/a>. \u00a0ADPPA supporters will probably try to use it to support their arguments for why it&#8217;s important to pass <em>something<\/em>, while avoiding discussions of whether it actually addresses the issues people brought up like protecting pregnant people from post-Roe threats and protecting trans and queer people at a time when they&#8217;re under attack all over the country. \u00a0<\/p>\n<p>One of Big Tech&#8217;s favorite tactics in their incessant attempts to pass weak privacy here in Washington state has been to try to push a &#8220;compromise&#8221; bill through at the very end of the session. \u00a0In 2021, <a href=\"https:\/\/www.thestranger.com\/slog\/2021\/04\/29\/56978551\/washington-legislature-closes-session-with-massive-watered-down-winshttps:\/\/www.thestranger.com\/slog\/2021\/04\/29\/56978551\/washington-legislature-closes-session-with-massive-watered-down-wins\">the Bad Washington Privacy Act&#8217;s sponsor tried to hold funding for eviction protection hostage<\/a> in an unsuccessful attempt to &#8220;encourage&#8221; his colleagues to support the bill in the last days of the session. 2022&#8217;s farcical last-minute push included<a href=\"https:\/\/wa-privacy.net\/it-aint-over-till-its-over\/\"> a secret amendment that wasn&#8217;t even published before the vote<\/a>. \u00a0Good times.<\/p>\n<p>So it wouldn&#8217;t surprise me if there are still some shenanigans in store for ADPPA. \u00a0One thing we&#8217;ve learned time and again in Washington state&#8217;s legislative battles over privacy: it ain&#8217;t over till it&#8217;s over.<\/p>\n<p>Stay tuned!<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<hr id=\"updates\" \/><!--kg-card-end: html--><\/p>\n<h2 id=\"updates\">Updates<\/h2>\n<p><em>September 15: Include LA Times artcile<\/em><\/p>\n<p><!--kg-card-begin: html--><\/p>\n<hr id=\"footnotes\" \/><!--kg-card-end: html--><\/p>\n<p>* Several patterns, actually. \u00a0As well as the predicted &#8220;waiver for California&#8221;, this is the second major opinion piece the <em>LA Times<\/em> has published on ADPPA, after <a href=\"https:\/\/www.latimes.com\/opinion\/story\/2022-07-28\/data-privacy-act-civil-rights-california\">David Brody&#8217;s July 19 op-ed<\/a>. \u00a0Most of what these opinion pieces discuss are the very real problems ADPPA is trying to present and the reasons ADPPA is good. \u00a0<\/p>\n<p>But it&#8217;s a very different balance than that conveyed by Jennifer Haberkorn&#8217;s excellent September 6 <em>LA Times <\/em>news story <a href=\"https:\/\/www.latimes.com\/politics\/story\/2022-09-06\/congress-mulls-data-privacy-bill-that-would-void-california-tougher-protections\">Congress mulls data privacy bill that would void California\u2019s tougher protections<\/a>. \u00a0Haberkorn reports that ADPPA is &#8220;e legislation is widely supported by the tech industry.&#8221; \u00a0 She includes critical perspectives from Ashkan Soltani of California Privacy Protection Agency (CPPA) who flat-out says ADPPA \u201cis weaker than the California law.\u201d She quotes Soltani on ADPPA&#8217;s absence of California&#8217;s right to opt out of AI profiling. \u00a0<\/p>\n<p>And Haberkorn even mentions <a href=\"https:\/\/nexusofprivacy.net\/adppa-post-roe-threats\/\">the elephant!<\/a><\/p>\n<blockquote><p>Critics of the Energy and Commerce bill say it has too broad of a loophole for law enforcement to demand data related to a state crime, something that could open the door to the disclosure of location-tracking information, period-tracking information or messages related to abortion access in states where the procedure is illegal. Another concern is whether third parties can access the information. \u00a0<\/p><\/blockquote>\n<p>I get it, there&#8217;s a difference between news and opinion. \u00a0Still, <em>LA Times<\/em> readers are seeing a lot more positive information about ADPPA than discussions of the questions including the elephant. \u00a0And all the coverage of preemption (including Haberkorn&#8217;s) is filtered through a California lens, with nary I mention that I could see of Maine or Washington.<\/p>\n<p>** Of course Big Tech isn&#8217;t going to admit that. From a negotiating perspective, they&#8217;ve got a lot more leverage if they&#8217;re perceived as soooo against the bill that they&#8217;re ready to walk away unless they get more concessions. But if you look at the bill in its current form, there&#8217;s virtually nothing here that they don&#8217;t have to do for existing legislation in the EU, California, or Colorado. And while the private right of action gets painted as something that industry will never ever in a million years agree to, the reality is that Microsoft actually <em>did <\/em>agree to a private right of action in behind-the-scenes negotiations on a bill in Washington a couple of years ago. For big companies, a private right of action without statutory damages is a small price to pay for a bill that gives them so much.<\/p>\n<p>*** Another possible strategy for Big Tech: sprinkle a few improvements into the Bad Washington Privacy Act and continue to use that as their template. \u00a0It would be easy enough to add algorithmic impact assessments that are just a teensy bit stronger ADPPA&#8217;s (although still to weak to hold Big Tech accountable) along with a duty of loyalty and data minimization section. \u00a0Since the Bad WPA already has civil rights protections, these tweaks would make it &#8220;even stronger than ADPPA, which has the support of privacy groups like EPIC and and civil rights groups like Lawyers&#8217; Committee!&#8221; Big Tech and their allies have the resources to pursue both of these paths as well as continuing to push even weaker bills like Utah&#8217;s, which makes the Bad Washington Privacy Act and ADPPA look good by comparison.<\/p>\n<p>**** The Health and Location Data Privacy acts regulates data brokers, so is a natural complement the Fourth Amendment Is Not For Sale Act &#8212; which prohibits government agencies from buying data from data brokers without a warrant. \u00a0The Fourth Amendment Is Not For Sale Act has strong bipartisan support, and in its hearing legislators from both parties stressed that it was only a first step. \u00a0My Body My Data or a significantly strengthened ADPPA would be a tougher sell, but many Republicans in tough election races are already trying to<a href=\"https:\/\/www.washingtonpost.com\/opinions\/2022\/08\/29\/republican-abortion-backtrack\/\"> backtrack<\/a> on their previous anti-abortion statements, so it\u2019s possible that an effective pressure campaign could change some positions.<\/p>\n<\/p>\n<p><em>Image credit: <\/em>JessicaRodriguezRivas, via <a href=\"https:\/\/commons.wikimedia.org\/wiki\/File:Home_of_the_US_Congress.jpg\">Wikipedia Commons<\/a>. \u00a0licensed under the <a href=\"https:\/\/en.wikipedia.org\/wiki\/en:Creative_Commons\">Creative Commons<\/a><a href=\"https:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/deed.en\" rel=\"nofollow\">Attribution-Share Alike 4.0 International<\/a> license.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last updated September 15 It could well be that [lobbyist Jon] Leibowitz et. al. are just posturing, and the industry plan is to demand concessions on other fronts in return for a &#8220;compromise&#8221; on preemption: add California&#8217;s privacy law to the already-long list of preemption exceptions, give the California Privacy Protection Agency the authority they [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[458,459],"class_list":["post-4074","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-adppa","tag-federal-privacy-legislation"],"_links":{"self":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts\/4074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/comments?post=4074"}],"version-history":[{"count":0,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts\/4074\/revisions"}],"wp:attachment":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/media?parent=4074"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/categories?post=4074"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/tags?post=4074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}