ALEXANDRIA, Va.—Technology is advancing faster than we can keep up, and there have been numerous media reports about privacy abuses and the proliferation of state legislation on consumer data privacy. In response, the House Committee on Energy & Commerce held a hearing today on strengthening data privacy and security, and NACS’ General Counsel Doug Kantor testified on behalf of Main Street Privacy Coalition, of which NACS is a founding member.
“Having data privacy and security laws that create clear protections for Americans while allowing our members’ businesses to serve their customers in the ways they have come to rely upon is a key goal. Achieving that goal, however, has been elusive,” said Kantor in his testimony before the committee.
Kantor said that one of the challenges that has been central to this effort is the overwhelming focus on the data practices of technology companies. Privacy law needs to work for Main Street, said Kantor. The “Main Street” Kantor refers to includes the businesses that line America’s business thoroughfares, including convenience stores, gas stations, grocery stores, hotels, home builders, among many others.
“Simply to ensure that business occurs as intended on a daily basis requires large volumes of data to be used and exchanged by a multiplicity of different actors. The ways in which this happens are incredibly diverse across the economy and therefore quite complex. That diversity and complexity is one of the reasons that writing legislation to cover privacy is so challenging,” said Kantor.
Kantor said that these seven principles can help achieve the best public policy results for data privacy:
- Establish uniform nationwide rules and enforcement for data privacy
- Ensure industry neutrality and equal protection for consumers across business sectors
- Impose direct statutory obligations (rather than contractual requirements alone) for all entities that handle consumer data
- Preserve customer rewards and benefits
- Achieve transparency and customer choice
- Ensure accountability for business’s own actions
- Include reasonable data security requirements
Kantor pointed out that the American Data Privacy and Protection Act represents an important milestone on the road to achieving a national data privacy standard that meets these seven principles; however, Kantor said that there are a number of areas in which additional work will be important to ensure that the act fulfills the policy goals intended by its authors.
“Among the most impactful areas in which we see the benefits of additional work on the bill include the need to cover all industry sectors and participants that interact with data covered by the act,” said Kantor.
Currently, the act creates a rule that allows financial services firms that are subject to a law that does not have credible privacy requirements to be in compliance with the act. Kantor said there needs to be a plan to rectify that issue and cover financial services companies in the act.
Additional work must be done to ensure that the vast category of “service providers” that do the bulk of the work of collecting, processing, transmitting, storing and transferring data are fully responsible for their role and required to comply with every aspect of the act, according to Kantor.
“The Act has language in some areas to advance this goal but also has language that creates uncertainty which can and should be addressed,” said Kantor. “More importantly, each of the privacy laws enacted in four states the past two years require service providers to be responsible for protecting consumers’ data to a greater extent than this Act, and we urge the Committee to match or exceed those protections.”
Kantor also said that how any data privacy law handles the questions of whether and on what basis individuals may be able to bring lawsuits against businesses under the law, as well as whether and how a federal law preempts state laws, will be controversial at every stage of the legislative process, but these two issues merit additional attention.
“We believe changes are in order to ensure that the act creates a scheme that works for consumers and businesses,” he said.
Kantor also said there are portions of the language in the act that should be changed to make sure consumers continue to get the benefits that they have come to expect. These include access to loyalty discounts and rewards, as well as competition on prices and product and service offerings that is enhanced by many forms of advertising broadly accepted by consumers.
Here is Kantor’s full testimony.