House, Senate leaders nearing deal on landmark online privacy bill

The tentative deal is expected to broker a compromise between congressional Democrats and Republicans by preempting state data protection laws and creating a mechanism to let individuals sue companies that violate their privacy, the person said. Rep. Cathy McMorris Rodgers (R-Wash.) and Sen. Maria Cantwell (D-Wash.), the chairs of the House Energy and Commerce Committee and the Senate Commerce Committee, respectively, are expected to announce the deal next week.

Spokespeople for the committees did not immediately respond to requests for comment late Friday.

News of the expected deal was first reported by the politics publication Punchbowl News.

Lawmakers have tried to pass a comprehensive federal privacy law for more than two decades, but negotiations in both chambers have repeatedly broken down amid partisan disputes over the scope of the protections. Those divides have created a vacuum that states have increasingly looked to fill, with more than a dozen passing their own privacy laws.

Republicans have long argued that a federal law should harmonize state standards, while Democrats have called for letting states go beyond any federal protections. The two sides have also largely remained apart on whether consumers should be able to bring their own lawsuits over violations, with Democrats backing such provisions and Republicans opposing.

In the last Congress, the leaders of the House Energy and Commerce Committee and the top Republican on the Senate Commerce Committee reached a deal on a proposal that seemingly overcame those hurdles, with Democrats agreeing to preempt some state laws and Republicans allowing for a limited right for consumers to bring lawsuits, known as a private right of action.

But Cantwell publicly rejected that proposal, casting doubt on the legislation’s prospects for passage. House lawmakers advanced the bill out of committee, but the proposal never made it to the floor in the face of opposition from California Democrats, including then-Speaker Nancy Pelosi. That measure, the American Data Privacy and Protection Act, has not been reintroduced this Congress.

Details of the latest framework are scant, and support from McMorris Rodgers and Cantwell does not guarantee that the measure will clear both chambers of Congress. But their expected deal would mark the first time the heads of the two powerful commerce committees, which oversee a broad swath of internet policy, have come to terms on a major consumer privacy bill.

While lawmakers have long sought to pass a federal privacy law, their efforts have gained steam in recent years as scrutiny of tech companies’ data collection practices has soared in Washington.

The federal government already has laws safeguarding people’s health and financial data, in addition to protections for children’s personal data, but there’s no overarching standard to regulate the vast majority of the collection, use and sale of data that companies engage in online.

Meanwhile it’s been nearly six years since the European Union began implementing its own standards, which set limits on companies’ collection practices.