HR 8152 American Data Privacy and Protection Act

July 19, 2022

The Honorable Frank Pallone
Chairman
Energy and Commerce Committee
U.S. House of Representatives
Washington, D.C. 20515

The Honorable Cathy McMorris-Rodgers
Ranking Member
Energy and Commerce Committee
U.S. House of Representatives
Washington, D.C. 20515

Re: Committee Markup of the Amendment in the Nature of a Substitute to theAmerican Data Privacy and Protection Act (H.R. 8152)

Dear Chairman Pallone and Ranking Member McMorris Rodgers:

Our members are strong proponents of protecting consumer data and privacy andhave done so for a very long time because protecting consumer financial data is acornerstone of their business. Our members have been subject to extensive federalprivacy and data protection laws and regulations for several decades. While wesupport privacy and security protections for consumer data for all companies,especially technology and other firms that are increasingly moving into financialservices, we continue to have serious concerns about several provisions included inthe American Data Privacy Protection Act (ADPPA) (H.R. 8152).

GLBA and Data Privacy

The primary privacy and data security consumer protection law for consumerfinancial data is Title V of the Gramm-Leach Bliley Act (GLBA). With the GLBA,Congress carefully constructed a privacy and data security regime to provide aneffective and successful balance between strong consumer protections and ensuringthat consumer financial transactions take place in a safe and secure environment. Inparticular, the current regime has been carefully structured to ensure compliance withexisting laws and regulations, adherence to judicial process, and protection fromfraud, illicit finance, money laundering and terrorist financing. Further, GLBA grantsfederal financial regulators with broad authority to adopt necessary regulations toenact these standards, thus allowing the regulatory regime to adapt over time asprivacy concerns evolve.

Enforcement

One of the most important elements that must be included in any federal privacy legislation is assurance that the legislation will be consistent from state-to-state. A uniform national standard is the foundation for adopting federal privacy legislation. By allowing enforcement by private rights of action, however, it will only be a short matter of time before different judicial interpretations of the law mean that different states have different interpretations of the law, and a consumer in Nebraska will have different privacy protections than someone in Alabama. Another disadvantage is that these state-by-state variations inhibit national training and consumer understanding of privacy rights.

Further, a private right of action in this context will only serve to encourage frivolous litigation from plaintiffs’ attorneys and will further encourage class actions even for minor compliance infractions. As in many class action suits, companies are forced to settle to avoid outrageous litigation costs even if the firm is not at fault. This type of legislation leaves open many opportunities for such actions and should be amended to remove such provisions. 

As such, our members do not support provisions in the ADPPA that would authorize private rights of action. Instead, federal privacy law must include preserving GLBA’s existing regulatory enforcement structure for financial institutions.

Preemption of State Law

The increasing patchwork of state privacy and data breach laws must be replaced by a federal standard. In our view, it is critical that any new federal privacy law preempt existing state laws to avoid inconsistent and duplicative requirements that could potentially disrupt financial transactions and the financial system. A federal standard will also help increase the transparency needed for consumers to understand their rights and responsibilities. More importantly, having a federal standard would ensure that consumers receive the same privacy rights and data protections regardless of where they may live.

Although the ADPPA would preempt many state laws, it also provides numerous exceptions that undermine the preemption, including several highly litigated state privacy laws. That is, the ADPPA would in fact codify a patchwork of federal and state privacy laws.

The ADPPA should be amended to create a clear and direct preemption of all state privacy and data protection provisions to prevent the continued patchwork of requirements imposed on companies. 

Conclusion

Our organizations support legislation to protect consumer privacy that would put in place a national privacy standard that recognizes that strong privacy and data security standards are already in place for financial institutions under the GLBA and other financial privacy laws and avoids provisions that duplicate or are inconsistent with those laws. It must also provide robust, exclusive enforcement of this national standard by the appropriate federal or state financial regulators, including preserving GLBA’s existing administrative enforcement structure for financial institutions, including banks. Finally, the national privacy standard must eliminate the current inconsistent patchwork of state laws on privacy and data security. A national standard containing these elements would provide consistent protections for consumers regardless of where they may live. 

As we have explained, the ADPPA contains several provisions that concern our members, and we strongly urge the Committee not to move forward without addressing these concerns.

Sincerely,

American Bankers Association
Consumer Bankers Association
Financial Services Institute
National Association of Federally-Insured Credit Unions
Securities Industry and Financial Markets Association

cc: Members of the House Energy & Commerce Committee