Democrats Seek Expansion of Corporate Liability in Privacy Bill

(Bloomberg) -- Three Democratic senators helping write a privacy bill are seeking to allow individuals to sue companies for mishandling their data, according to Republican Senator John Thune. The measure would raise the burden on businesses and could imperil Congress’s ability to pass the legislation.

A so-called private right of action, which several consumer groups have advocated, would likely spur opposition from Republicans and regulated businesses facing a litany of consumer lawsuits.

“The Democrats have a real interest in a duty of care standard and a private right of action,” said Thune, the No. 2 Senate Republican and a member of bipartisan group of six lawmakers from the chamber’s Commerce Committee who are leading efforts to write a privacy bill. “Republicans have differing views.”

Republicans and industry groups such as the U.S. Chamber of Commerce have argued that allowing individuals to sue would expose companies to a flood of nuisance lawsuits and could smother small businesses. Business proposals largely advocate for enforcement by the U.S. Federal Trade Commission, potentially supplemented by state attorneys general.

Thune said Democrats are also pushing a measure to make companies responsible for individuals’ data. That responsibility, known as a duty of care, could resemble provisions in a bill proposed last year by another member of the working group, Democratic Senator Brian Schatz of Hawaii, according to three people familiar with the talks.

‘Reasonable’ Security

That bill, which attracted more than a dozen Democratic cosponsors, focuses on requiring companies to provide “reasonable” security for data and promptly notify individuals of breaches involving sensitive information. It would also mean that consumers own their data and require companies to act in the interest of customers.

A spokesman for Schatz did not immediately respond to a request for comment. Spokesmen for Senator Maria Cantwell of Washington, the top Democrat on the Commerce panel, and Senator Richard Blumenthal of Connecticut, the third Democrat in the working group, declined to comment.

Cantwell has pushed for adding data security components in the privacy bill after years of breaches without successful efforts by the federal government to address them.

Bill Timeline

Lawmakers have said a bill is unlikely to be ready before the end of May, pushing back the timeline and lowering the chances it could pass Congress before California’s privacy law goes into effect at the beginning of 2020, making the state’s strict new statute something of a national baseline. Senator Jerry Moran, one of the Republican members of the working group, has said he hopes the lawmakers can present a text in June.

While the Democrats don’t control the Senate, Republicans need some Democratic votes to advance legislation that could require comprises. If the parties remain too far apart, talks could collapse.

Still, Thune said the group could still find its way toward crafting a bill.

“There is a path if we work together to find it,” he said.

Much of the public debate among lawmakers so far has focused on overriding state laws, with Republicans wanting unified national standards on privacy and Democrats insisting they won’t support any federal legislation that weakens the California privacy law that passed last year and other potential state statutes.

California’s legislation originally contained a broad private right of action as well, which alarmed business groups. State lawmakers eventually passed a measure that allowed lawsuits only in cases when companies suffered a data breach after failing to put in place or maintain reasonable protections.

Industry lobbyists have said they’re concerned that so-called preemption issue to override state laws already puts Republicans in a weaker negotiating position.

To contact the reporters on this story: Ben Brody in Washington at btenerellabr@bloomberg.net;Daniel Stoller in Washington at dstoller1@bloomberg.net

To contact the editors responsible for this story: Sara Forden at sforden@bloomberg.net, ;Keith Perine at kperine2@bloomberg.net, Mark Niquette

©2019 Bloomberg L.P.