Is This the Year Congress Finally Tackles Privacy Legislation?

Predictions that Congress will finally pass comprehensive privacy legislation have aged about as well as past forecasts that self-driving cars are almost ready to roll. But a major tech-policy think tank tried again Wednesday, telling reporters that 2023 could finally be The Year. 

“The seeds are there for this to happen,” said Samir Jain, VP of policy at the Center for Democracy and Technology, at the start of that Washington non-profit’s Zoom briefing about its 2023 policy priorities.

He placed his hope in one bill in particular, the American Data Privacy and Protection Act(Opens in a new window) introduced last June by a bipartisan group of legislators. One of those sponsors, Rep. Cathy McMorris Rodgers (R-Wash.), now chairs the House Energy and Commerce Committee, which easily passed that bill last year before the House failed to take further action.

The ADPA would impose data-minimization practices on companies instead of letting them claim vast amounts of information in privacy policies that people routinely ignore, grant customers opt-out and data-ownership rights that include the ability to decline targeted advertising and veto the sale or transfer of their data, and constrain the conduct of data brokers.   

“We think that last year’s effort on APDA represented a significant milestone,” says Eric Null, co-director of CDT’s privacy and data project, in the briefing.

CDT staffers sounded more confident in predicting Congressional action to reform a separate statute, the Foreign Intelligence Surveillance Act(Opens in a new window)—because a key section of this law allowing intelligence gathering(Opens in a new window) on foreign targets from US communications services expires Dec. 31. 

“Reauthorization is almost a certainty,” says Greg Nojeim, director of CDT’s security and surveillance project. “What reforms will ride the reauthorization legislation?”

FISA-enabled surveillance has been controversial since Edward Snowden’s disclosures about its extent a decade ago. But while many Democrats objected back then, many Republicans also now resent FISA after seeing it applied to investigate possible ties between the 2016 Trump campaign and Russian actors. The Department of Justice’s Inspector General later found (PDF(Opens in a new window)) this work exhibited “many basic and fundamental errors.”

Plus, Nojeim continued, the risk of Europeans’ data being caught in these national-security investigations has led to multiple lawsuits threatening transatlantic data flows between divisions of US tech firms.  

CDT’s forecast looked haziest for another perennial topic of tech-policy punditry: possible reform to Section 230 of the Communications Decency Act, the law that encourages online forums to police content as they say fit by holding them not responsible for items that their users post even if they do actively moderate it.

“Chances are that we won’t see any legislative movement,” said Jain. He added that while some Republicans want limits on how social sites can moderate content, some Democrats would rather require sites be stricter in moderating content deemed harmful: “They have opposite goals.”

But two upcoming cases before the Supreme Court, Gonzalez v. Google LLC(Opens in a new window) and Twitter Inc. v. Taamneh(Opens in a new window), could upend this debate.  

Emma Llansó, director of CDT’s free expression project, said the Google case–involving claims that Google provided assistance to the Isis terrorist cult by algorithmically recommending its videos on YouTube–will be “the first time that the Supreme Court will have addressed any questions relating to Section 230.”

Llansó said that the Supreme Court rewriting “CDA 230” from the bench in the Google or Twitter case, which also involves allegations of social-media support for terrorist organizations, could push Congress to act. 

Or Congress might find itself once again unable to decide what to do next–as many other tech-policy types have noted, once you get into the weeds of content moderation, things get complicated.