On September 26, the Senate Commerce Committee conducted the first of two scheduled hearings on data privacy policy. Entitled, "Examining Safeguards for Consumer Data Privacy" the hearing featured testimony regarding the privacy policies of AT&T, Amazon, Google, Twitter, Apple, and Charter. Senators reviewed the current state of consumer data privacy and discussed ways to safeguard privacy more effectively, specifically the positive and negative aspects of the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Lobbyit attended this hearing, and provides this detailed coverage to our partners at NCISS.
Note in particular the panel's emphasis on crafting a federal regulatory framework.
Witnesses/Panelists:
- Len Cali, Senior Vice President Global Public Policy, AT&T Inc.
- Andrew DeVore, Vice President and Associate General Counsel, Amazon.com, Inc.
- Keith Enright, Chief Privacy Officer, Google LLC
- Damien Kieran, Global Data Protection Officer, and Associate Legal Director, Twitter, Inc.
- Guy (Bud) Tribble, Vice President for Software Technology, Apple Inc.
- Rachel Welch, Senior Vice President, Policy & External Affairs, Charter Communications, Inc.
Opening Statements:
Chairman John Thune (R-S.D.)
- The Chairman stated that because of the developments of strict regulations and penalties by the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) the issue is not whether we need a federal law, but what the federal law should look like.
- The Chairman believes there to be bipartisan support and by both industry and public interest groups, to work to reach a consensus on a national consumer data privacy law that will help consumers, promote innovation, reward organizations with little to hide, and force shady practitioners to clean up their act.
Ranking Member Bill Nelson (D-FL)
- Ranking Member Nelson noted the many hearings on data privacy over the years because consumers have been hit by the misuse of their personal information and by data breaches.
- Hopes the committee will gain insight into how companies are safeguarding customer's private information.
Len Cali
- Mr. Cali stated there is a risk in over-regulating privacy by importing the GDPR.
- Noted AT&T's commitment to consumer privacy and support of federal privacy legislation.
- Mr. Cali believes that policymakers should design a national privacy law that builds upon the FTC's privacy framework and includes:
o
Consistent nationwide privacy protections for consumers
o
Avoids duplication and inconsistent requirements
o
Respects customer privacy choices, requiring companies to be transparent about their privacy practices
o
Allows innovative, consumer-friendly uses of data that enhance their lives, subject to appropriate protections
o
Requires companies to take reasonable steps to protect consumer data
o
Supports collaborative public-private partnerships
- Believes there to be imminent risk of states passing legislation and companies facing a patchwork of inconsistent state privacy laws that will lead to confusion and uneven protections.
Andrew DeVore
- Mr. DeVore stated that customer trust is their highest priority and that they are not in the business of selling customers' personal data.
- Policy perspectives for Committee to consider in a federal approach to privacy legislation:
o
Data privacy must take into account all stakeholders.
o
Congress must ensure that any additional overhead and administrative demands future legislation requires, actually produces commensurate consumer privacy benefits.
o
Must address unintended consequences. The CCPA's definition of personal information results in a law that is confusing, difficult to comply with, and may undermine privacy-protective practices encouraging companies to handle data in a way that is not directly linked to consumer's identity.
o
Focusing on customers will create smart privacy policies and practices.
Keith Enright
- Mr. Enright noted that in order to achieve Google's mission-to organize the world's information and make it universally accessible and useful-and provide products for free they must utilize advertisements.
- Google supports Congress in their efforts to legislate privacy and wants to constructively engage with them in their developments.
- Stated 4 key issues that are central to Google's framework for responsible data protection regulation:
o
Transparency: Stated that Google works to make privacy policies clear and concise recently updating them to include informative videos explaining practices and settings.
o
Control: Acknowledged that users can download a copy of their personal information Google has collected, see or delete activity, and disable personalized ads.
o
Data portability: Believe this is key to driving innovation, facilitate competition, and best serve users.
o
Security: Stated that Google shares their security technology and collaborates with partners to help people stay safe when online. Noted that small and midsize businesses are leveraging Google's cloud technology to protect the security and confidentiality of their business data.
Damien Kieran
- Mr. Kieran stated Congress must balance consumer rights and the ability to innovate.
- Believes companies must be held accountable for the protection of privacy.
- Mr. Kieran noted that Twitter recently updated their Privacy Policy to explain what data we collect, how it is used, and what is and is not shared by utilizing and including callouts, graphics, and animations.
- Noted that to share the public content on Twitter as widely as possible, they provide companies, developers, and other customers with programmatic access to public Twitter data through Application Programming Interfaces. Stated private information disclosures are only upon individual persons' consent or if the settings of an individual allow for personal data to be disclosed.
Bud Tribble
- Mr. Tribble acknowledged that at Apple, privacy is about putting the user in control of what is shared and used.
- Believes privacy is a fundamental right and should be supported by both social norms and the law.
- Mr. Tribble stated that Apple minimizes the amount of information they collect.
- Noted how Apple is specific and transparent about the data they collect and use with their customers.
Rachel Welch
- Ms. Welch stated that online privacy is a complex issue and must be addressed with stakeholder support and there are increasing amounts of data being collected, shared, and sold without protections.
- Charter believes a national online privacy framework should focus on 5 core principles:
o
Control:
Consumers should be empowered to have a meaningful choice for each use of their data and reasonably limited to what the consumer understood at the time consent was provided.
o
Transparency: Consumers should be given the information needed to truly provide informed consent.
o
Parity:
Consumers are best served by a uniform framework that is applied consistently across the entire Internet ecosystem not based on who is collecting it, or whether a service is free or paid.
o
Uniformity: Believes there needs to be a national standard that protects consumers' online privacy regardless of where they live, work, or travel.
o
Security:
Security practices should include administrative, technical, and physical safeguards to protect against unauthorized access to personal data, and ensure that these safeguards keep pace with technological development.
Q&A
Chairman John Thune (R-S.D.)
- If we pursue fed legislation, can you identify provisions from the California law, CCPA, or Europe's GDPR, that we should emulate?
o
Kelly: Both laws apply to all companies uniformly. California sets the default to opt out.
- Are there conflicts between the 2 that we should address?
o
Cali: GDPR is overly descriptive and burdensome. California has a nondiscrimination obligation that is ambiguous, and the notice and consent process.
- Do you plan to seek revisions to the California law before it goes into effect?
o
Cali: Yes, we do. Nondiscrimination obligation and the notice of consent.
- Can anyone else talk about compliance costs under GDPR today and whether they create barriers to entry for start-ups?
o
Enright: The compliance costs have been a challenge at Google. An organization like Google can absorb those costs better than an entry business.
o
Welch: We do not fall under GDPR but are watching its impact closely as we realize it is a framework that people are looking at.
o
Tribble: Many of the companies who create Apps for the App store are small and medium-sized businesses and will have a hard time with compliance costs.
Ranking Member Bill Nelson (D-FL)
- Will your companies support the FTC with more resources to protect consumer privacy?
o
Panel: Yes.
- Do you support providing the FTC with more legal authority and better tools to protect consumer privacy?
o
Cali: We do not support unfettered discretion to any agency. We believe it is Congress' job to develop and set policy. If Congress were to do that we would work with them.
o
DeVore: Yes, but the issue is complex.
o
Enright: Would suggest that we first look at their existing authority is enabling them to exercise their mission effectively, and if that answer is no, then I think we move on to address expanding that authority.
o
Kieran: Support engaging in dialogue to work with the committee.
o
Tribble: FTC has a good track record. Important to look at whether their existing authority is sufficient.
o
Welch: If the committee finds that the FTC needs additional tools then they should have them.
Senator Deb Fischer (R-NE)
- Do you think federal legislation is needed to protect consumers?
o
Tribble: Federal comprehensive legislation is needed. The amount of personal information available is only going to increase.
- What is the best approach to federal legislation to not burden smaller businesses?
o
Tribble: Anything that makes things clear and one set of rules to follow.
- What is an unreasonable way to use data?
o
Tribble: Identity theft. Information that is used out of context.
- Should companies focus on using data in ways that don't directly link to individual identity?
o
Tribble: Even information that is disassociated can be later associated with an individual. Leaving personal information on the device and not having it sent back to company servers.
Senator Amy Klobuchar (D-MN)
- Do you believe that we need federal legislation for privacy standards for consumers?
o
Panel: Yes.
- Do you favor the idea of having a 72-hour notification window when there is a breach?
o
No one on the panel was in favor of the idea.
- Do you think online platforms being forced to make plain language disclosures regarding how personal data will be collected and used?
o
Enright: We are constantly working to make our disclosures simple for consumers.
o
Keirnan: Earlier this year we revised ours completely to make it understandable for our consumers.
- Do you think it would be helpful for consumers to be able to withdraw consent just as easily as they are able to give consent?
o
Kieran: We believe it is an important component.
Senator Brian Schatz (D-HI)
- Do you think companies ought to take reasonable steps to prevent unwanted disclosures of data and that companies should not use data to the detriment of their customers?
o
Panel: Yes.
- Do you support rule-making authority in this new federal privacy statute?
o
Panel: A qualified yes. Depends on what is involved in the statute.
- Do you think the FTC should have the authority to fine in the first instance?
o
Cali: Qualified no.
o
DeVore: It is not something that should be ruled out.
o
Enright: Many FTC agreements already have penalties in settlements in the first instance.
o
Kieran: Qualified yes.
o
Tribble: We would be open to considering it and happy to be involved in the discussions.
o
Welch: Qualified yes.
Senator Jon Tester (D-MT)
- Are you doing everything you can to ensure that private information is protected and if you're not, why aren't you? Why are we looking at Congress to pass laws and companies not doing it on their own?
o
Cali: We are doing all that we can as a company. The clarity of a federal law, leveling the playing field for participants makes sense.
- Do any of you sell information that you get?
o
Cali: We do not sell information without affirmative customer consent.
o
DeVore: We are not in the business of selling personal information. We run a number of services that are information dependent.
- What do you classify as personal information?
o
Enright: Information that would be identifiable to an individual user. Name, email account, or anything else tied specifically to a person or their device.
Senator Catherine Cortez Masto (D-NV)
- Do we need to identify and define what personal information is?
o
Panel: Yes, it would be helpful with a uniform definition of personal information.
- Would you support a default opt-in?
o
Cali: No because it would restrict non-sensitive data.
o
DeVore: Concerns that overlaying a regulation like default opt-in you risk breaking innovation on some services and the benefits from data.
o
Enright: No.
o
Welch: Yes, we feel a default opt-in is the right approach and the best way to empower consumers.
o
Tribble: May be appropriate in some cases but not all.
Senator Mike Lee (R-UT)
- How much did Google spend in order to comply with GDPR?
o
Enright: I do not have specific figures available, but there were significant capital expenditures put forth to get into compliance before it went into effect.
- How many human hours did it take to get into compliance with GDPR?
o
Enright: I would estimate hundreds of years of human time.
- Is Congress' authority exclusive in data privacy similar to air traffic being federally regulated?
o
Cali: I believe it is exclusive. Data does not respect state boundaries, it is an intra-state service and therefore should be federally managed.
Senator Gary Peters (D-MI)
- What percentage of users utilize Google's dashboard which provides features to control the collection of data?
o
Enright: I do not have those numbers with me, but I can get them.
- Does Google's dashboard provide information to users how you track them across the internet?
o
Enright: Provides as much information as we are able. Users can see reporting about the advertisements they have seen.
- Would you support a federal privacy law that mandates disclosure of tracking?
o
Panel: Yes.
- What do you believe should be the contours of personally identifiable information, how should it be defined in legislation and how can we ensure it will be adaptable to new technology?
o
Enright: Our definition is data that directly identifies an individual user, i.e. an email address.
Senator Roger Wicker (R-MS)
- Should federal legislation include preemption of state data privacy laws?
o
Panel: Yes.
o
DeVore: Qualified yes. The details matter a lot.
o
Tribble: Yes, assuming that it meets the bar protecting consumers meaningfully.
- Do we all agree the FTC is the place for primary enforcement?
o
Panel: Yes.
- Members of Internet Association, does that mean that your companies believe that EDGE providers and ISP's and all other online entities should be subject to the same privacy requirements?
o
DeVore: Yes. Core principles should apply to everyone.
o
Enright: Yes. Uniform application across industries enforced by the FTC is the way to go.
o
Kieran: We echo both those sentiments.
- Do you think the national privacy law should take an online entities business model into account or should they be subject to the same data requirements?
o
Cali: Irrelevant to a company's business model. Information is either sensitive or not.
Senator Richard Blumenthal (D-CT)
- Do all you agree that we need mandatory practices when it comes to privacy?
o
Panel: Yes.
Senator Ed Markey (D-MA)
- Would companies support a federal privacy bill that requires companies to tell consumers in clear concise ways what information is being collected about them and how that information is being used, shared, retained, or sold?
o
Kieran: Twitter already has these practices in place and we would support that type of legislation.
o
Panel: Yes.
- Should federal privacy policy establish consumers right to control their personal information and give consumers the right to say no to their data being sold or shared with others?
o
Panel: Yes.
- Should Americans be able to access their personal data online? Would Charter support a federal policy bill that would put that right into law?
o
Welch: Yes.
o
Cali: Qualified yes.
o
Panel: Yes.
Senator Tammy Baldwin (D-WI)
- How should we take into account the incentives of user data that may or may not exist depending on the business model?
o
Tribble: Apple's business does not depend on collecting user's information. Any comprehensive legislation should apply equally to companies.
o
Enright: We should be able to find a shared understanding and direction for uniform legislation to protect consumers.
