The measure being drafted by Commerce, Trade and Consumer Protection Subcommittee Chairman Cliff Stearns, R-Fla., and House Energy and Committee Chairman W. J. "Billy" Tauzin, R-La., would preempt states from passing laws that attempt to govern information privacy practices.
"In the climate today were more concerned about security than personal privacy," Stearns told reporters at a news conference today. "But as we move along and states like California pass an Internet privacy bill, the federal government is going to have to come up with a standard to be prepared when 50 states come up with different policies."
As outlined today, the proposal would require both online and offline companies to disclose the scope of personal information they collect from consumers if the data is collected and used for purposes unrelated to the consumer transaction. The nascent bill also would give consumers a chance to limit the sale or disclosure of that information to "non-affiliated third parties."
Rep. Rick Boucher, D-Va., co-chairman of the Congressional Internet Caucus, said while consumers will be given the chance to opt out of data collection activities at Web sites they visit, the legislation would likely allow companies to deny services to consumers who choose to opt out.
"As a practical matter, that might mean [the visitor] needs to leave the Web site without using the services of the site, and whether or not that would be the reality would be the choice a Web site could make," said Boucher, who is helping to craft the bill along with committee leaders and fellow Internet Caucus co-chairman Rep. Robert Goodlatte, R-Va.
In addition, committee leaders said they intend to include language that would prohibit consumers from suing companies that violate their own privacy promises. Rather, the measure would leave that role to the Federal Trade Commission, which already has authority to prosecute companies for such violations under laws prohibiting unfair and deceptive trade practices.
The bill being drafted would grant companies "safe harbor" from civil lawsuits for privacy violations, provided they join an FTC-approved self-regulatory agency, such as TrustE or BBBOnline, that meets the federal baseline privacy principles.
That portion of the proposal closely tracks FTC Chairman Timothy Muris recent announcement that the agency intends to pursue stronger enforcement of existing privacy laws, rather than advocate new ones.
Tauzin said House leaders recognize the final bill may contain different requirements for companies that transmit and store more sensitive data, such as genetic information.
However, Tauzin also said the bill will probably steer clear of areas already covered by federal privacy laws, including the Gramm-Leach-Bliley financial services bill and statutes that prohibit companies from soliciting information from young children online.
"We dont want to reinvent the wheel when it comes to policy," Tauzin said. "The thrust here is to look at specific concerns in areas that have not yet been addressed."
Yet, many privacy and consumer groups have urged Congress to include in any privacy measure language providing stronger protection for financial and medical records, particularly if the legislation being considered would preempt state medical records laws.
"There appears to be broad agreement from both sides of the aisle in Congress that this information is more sensitive and deserves greater protections," said Ari Schwartz, a policy analyst with the Washington, D.C.-based Center for Democracy and Technology.
Schwartz said any federal privacy legislation that preempts state law also should give consumers the right to review information that companies hold about them. In addition, committee leaders also need to consider requiring companies to streamline the opt-out process, Schwartz said. Such safeguards would prevent companies from forcing consumers to opt-out via mail-in forms and 1-800 numbers, for example, when the process could just as easily be handled online.
"Without access, youre disadvantaging consumers from being able to make real decisions," he said. "Weve seen in current practices that there are very good ways to have individuals control their information and others that put a heavy burden on individuals to opt out in a manner that had nothing to do with how the information was collected."
The principles outlined today resemble legislation introduced last year by then-Senate Commerce Committee Chairman John McCain, R-Ariz., with the exception that McCains bill would have allowed state attorneys general to sue companies on behalf of consumers. That could turn out to be a critical difference between the two bills, given that the National Association of Attorneys General has unanimously approved a resolution opposing efforts to preempt state enforcement of privacy laws.
"We have concerns about whether Congress is prepared to step up and address the issues were seeing every day out here," Washington Attorney General Christine Gregoire said in an interview with Newsbytes.
Gregoire said she hoped the legislation being drafted by the Commerce Committee would not remove state attorneys general from their traditional role of assisting the FTC in consumer privacy enforcement actions.
"Our position going into any legislation is that you cant preempt the states from passing additional legislation and our position forever will be you surely can never preempt the states with regard to enforcement," she said.
Current Senate Commerce Committee Chairman Ernest "Fritz" Hollings, D-S.C., last year introduced a bill requiring all of the fair information practices sought by consumer and privacy groups, including opt-in, and consumer access. Neither senator, however, has yet introduced his privacy bill in the 107th Congress.
Tauzin said the committee plans to circulate the legislative outline to consumer and business groups for comment, and that lawmakers would debate the measure at length at their annual GOP retreat in Landsdowne, Va., this weekend. Tauzin added he hoped to have a draft bill ready by early next year, but added the committee would be prepared to introduce the bill sooner if states or other federal lawmakers move to enact more restrictive measures in the meantime.
Brian Krebs, Newsbytes
