A House Energy and Commerce subcommittee has passed a draft of landmark privacy legislation, with a retooled section on civil rights and algorithms and a pledge from committee leaders to work on further changes leading up to a full committee markup.
The draft American Privacy Rights Act by Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) was approved May 23 by voice vote in the subcommittee on data and innovation, as lawmakers discussed changes they still want to see but agreed to withhold amendments amid the promise of ongoing discussions.
The draft bill was circulated late on May 21 and the markup was announced the following day. It is based on a compromise draft by Rodgers and Senate Commerce Chair Maria Cantwell (D-WA). A full Energy and Commerce Committee markup has yet to be scheduled and the legislation still awaits consideration by the Senate committee.
Rep. Cathy McMorris Rodgers (R-MI)
Rodgers and subcommittee Chair Gus Bilirakis (R-FL) pledged to continue working with colleagues on the text, with Bilirakis saying, “This is not the last opportunity to refine this bill but time is of the essence.”
Rodgers and Cantwell announced their APRA agreement on April 7 and the subcommittee held an April 17 hearing where Energy and Commerce ranking member Frank Pallone (D-NJ) urged changes to better address artificial intelligence-related issues.
Pallone at the markup called the updated draft “another significant step toward our goal” while cautioning that more changes are needed.
Rodgers said the draft bill advanced by the subcommittee reflects input from “hundreds of constructive stakeholders” and that it was “intentionally kept … as a discussion draft” to allow for improvements before moving to a full committee markup.
Rep. Yvette Clarke (D-NY), who has introduced her own bill on algorithm accountability, said more time is needed to study the Rodgers draft and noted “important changes on civil rights” were added in the latest version. Clarke promised to offer new legislative language in areas including algorithms and the draft’s definition of “consequential decision,” which would trigger the requirement for impact assessments.
An analysis of changes in the latest Rodgers draft from the April version, by Brandon Pugh and Steven Ward of the R Street Institute, says, “Some of the largest changes are related to impact assessments of covered algorithms.”
Pugh and Ward say, “The new focus is on the use of ‘certified independent auditors’ to conduct an impact assessment that results in a report to the entity, with an alternative being the entity submitting its own assessments to the National Telecommunications and Information Administration. Originally, reports went to the Federal Trade Commission. Notably, the five delineated harms in the original draft for conducting assessments (including two that considered ‘disparate impact’) are removed and replaced with a new ‘consequential decision’ definition. Similar changes are seen with algorithm design evaluations.”
On other AI-related issues in the draft privacy bill, subcommittee ranking member Jan Schakowsky (D-IL) praised the inclusion of a one-click option for consumers to opt out of their data being used by data brokers, but said more work is needed on protection of biometric data.
Rodgers promised to continue working on the issue while noting that the language in APRA is stronger than in the American Data Privacy and Protection Act that overwhelmingly cleared the committee in 2022. That bill failed to advance to the House floor amid long-running disputes over issues such as state pre-emption and individuals’ rights to action.
The subcommittee also advanced the Kids Online Safety Act by Bilirakis and Rep. Kathy Castor (D-FL).