Pallone on Republicans' SECURE Data Act: This Bill Is Assembled from Industry-Friendly State Privacy Laws That Have Been Pushed by Big Tech

Energy and Commerce Committee Ranking Member Frank Pallone, Jr. (D-NJ) delivered the following opening remarks at a Subcommittee on Commerce, Manufacturing, and Trade at a "Legislative Hearing on the SECURE Data Act:"

When it comes to data privacy, it is clear what Americans need. They need a national privacy law that puts the focus on companies to collect and use data responsibly. They need their sensitive data used only for limited purposes that they control. They should have the ability to easily opt out across all data brokers and websites selling their data or using it for invasive targeted ads rather than opting out one by one. They need to know that their data will be kept safe from data breaches and misuse and that they can pursue legal remedies if it is not. They need protections to ensure their data won’t be used to discriminate against them. And our nation’s kids and teens need the strongest possible protections for their data.  

The Republican bill before us today does NOT meet that mark. The partisan SECURE Data Act is not the strong, enforceable standard its sponsors describe. Instead, this bill locks in the failed notice and consent status quo, then compounds loophole upon loophole to water down its provisions. And then, to make matters worse, it adds expansive preemption that will leave many Americans with fewer privacy protections than they have today.

Rather than taking the strongest consumer protections from the existing state privacy laws, this bill is assembled from industry-friendly state privacy laws that have been pushed by Big Tech. It is, therefore, no surprise that this bill allows Big Tech and others to continue their ongoing privacy violations.  

And unfortunately, these intrusions will only get worse as the push to insert artificial intelligence into every corner of our lives, supercharges both the incentives to gather every bit of personal data and the potential harm that could result. A future with AI chatbots that can tailor personalized recommendations to our unconscious wants and algorithms that can set prices based on intimate details demands strong privacy guarantees for all Americans. In fact, these privacy guarantees are more important than ever.

I have fought for years for data minimization standards to shift the burden of protecting Americans’ privacy from consumers to the companies that profit off of their data. The SECURE Data Act’s so-called “data minimization” provisions allow companies to collect and use data however they choose, as long as it’s disclosed in the fine print. This is just “notice-and-consent” by a different name. It continues to impose unreasonable burdens on consumers. They should not be forced to become privacy policy experts every time they visit a website or download an app.   

The sweeping preemption in this bill would not only eliminate hard won privacy protections that millions of Americans currently enjoy, but would also invalidate any state law that relates to the bill. The legislation would prevent Maryland from continuing to protect its residents by ensuring their sensitive information is not sold. It would prevent Californians from being able to delete their data from all data brokers in one step. And it would invalidate state laws on wiretapping, robocalls, data breach notification, civil rights, and kids’ online safety.  

Not only are these existing laws preempted, but states will be forever barred from addressing the future privacy harms that emerge with new technologies like AI.

I have long supported bipartisan national comprehensive privacy legislation. But previous bipartisan compromises like the American Privacy Rights Act and the American Data Privacy and Protection Act recognized that a federal privacy law must exceed the strongest protections of any state, not set a weak ceiling. These compromises also put consumers in control of their personal information, prioritized data minimization, protected kids and teens, and included algorithmic accountability measures. And all of this was paired with strong enforcement, to make these protections meaningful for consumers. Such a compromise remains the only path forward to truly protecting Americans’ privacy.

And with that, I yield back the balance of my time.  

###