Articles
June 23, 2022
Federal data privacy bill introduced in Congress
Enforcement, preemption, accountability provisions are of concern to restaurants
Aside from some sector-specific and state data privacy laws already on the books, the data that’s created when consumers interact with businesses is largely unregulated. A new bill in Congress could change that.
In general, the American Data Privacy and Protection Act (ADPPA) would create standards dictating that businesses protect consumer information they collect, store, and use.
Drafted by House Energy & Commerce Committee Chair Frank Pallone (D-NJ) and Ranking Member Cathy McMorris Rodgers (R-WA) and Senate Commerce Committee Ranking Member Roger Wicker (R-MS), the ADPPA marks a significant development in decades of attempts and failures by Congress to bring federal data privacy legislation to fruition.
What’s different this time is that Democrats and Republicans have reached a bipartisan agreement on two pivotal provisions: preemption of state laws and a private right of action (PRA).
While having one comprehensive federal data privacy law is generally easier for businesses to comply with than a patchwork of different state laws, the ADPPA’s preemption language (as it’s currently written), is troubling for restaurants.
As detailed in a letter to House Energy and Commerce Subcommittee on Consumer Protection and Commerce Chair Jan Schakowsky (D-IL) and Ranking Member Gus Bilirakis (R-FL), the Association noted that language in the bill would actually nullify its preemption provision and instead require businesses to continue complying with the multitude of federal and state laws that already exist.
The Association further explains that the PRA, which would allow for consumers to file lawsuits against companies for violations, would enable trial lawyers to act as privacy “trolls” to create class action lawsuits for alleged violations that may not have occurred. Irrelevant and unnecessary litigation bogs down the legal system and is costly for businesses.
Additional alarming measures in the bill would hold restaurants responsible for potential data privacy violations committed by business partners and inhibit the ability of consumers and businesses to voluntarily establish mutually beneficial business-customer relationships (loyalty programs, for example).
Currently going through the subcommittee mark-up process, the ADPPA is in the early stages of policymaking.
The Association will continue to monitor the legislation and expand strategic advocacy efforts to educate members of Congress on the bill’s negative ramifications for the restaurant industry.
In general, the American Data Privacy and Protection Act (ADPPA) would create standards dictating that businesses protect consumer information they collect, store, and use.
Drafted by House Energy & Commerce Committee Chair Frank Pallone (D-NJ) and Ranking Member Cathy McMorris Rodgers (R-WA) and Senate Commerce Committee Ranking Member Roger Wicker (R-MS), the ADPPA marks a significant development in decades of attempts and failures by Congress to bring federal data privacy legislation to fruition.
What’s different this time is that Democrats and Republicans have reached a bipartisan agreement on two pivotal provisions: preemption of state laws and a private right of action (PRA).
While having one comprehensive federal data privacy law is generally easier for businesses to comply with than a patchwork of different state laws, the ADPPA’s preemption language (as it’s currently written), is troubling for restaurants.
As detailed in a letter to House Energy and Commerce Subcommittee on Consumer Protection and Commerce Chair Jan Schakowsky (D-IL) and Ranking Member Gus Bilirakis (R-FL), the Association noted that language in the bill would actually nullify its preemption provision and instead require businesses to continue complying with the multitude of federal and state laws that already exist.
The Association further explains that the PRA, which would allow for consumers to file lawsuits against companies for violations, would enable trial lawyers to act as privacy “trolls” to create class action lawsuits for alleged violations that may not have occurred. Irrelevant and unnecessary litigation bogs down the legal system and is costly for businesses.
Additional alarming measures in the bill would hold restaurants responsible for potential data privacy violations committed by business partners and inhibit the ability of consumers and businesses to voluntarily establish mutually beneficial business-customer relationships (loyalty programs, for example).
Currently going through the subcommittee mark-up process, the ADPPA is in the early stages of policymaking.
The Association will continue to monitor the legislation and expand strategic advocacy efforts to educate members of Congress on the bill’s negative ramifications for the restaurant industry.