Federal privacy legislation progresses, but concerns about data brokers loom

The latest version of the legislation still leaves loopholes for abuses of data including reproductive health data.

The House Energy and Commerce Committee voted Wednesday to advance sweeping privacy legislation with strong bipartisan support.

The American Data Privacy Protection Act (ADPPA) could see a full floor vote as early as next week, moving forward what would become the nation’s first comprehensive privacy law.

But some lawmakers and privacy experts are now alarmed the legislation may not address some of the most pressing issues related to consumer privacy — reining the massive growth in data brokers that buy and sell the public’s information and curbing potential abuse of commercial data such as reproductive health information.

“The bill before us has a major loophole that could allow law enforcement to access private data to go after women,” said Rep. Anna Eshoo, D-Calif., who voted against the bill. “For example, under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps. That loophole must be addressed.”

One of those loopholes Eshoo referred to is a carveout for data collection needed to comply with state laws, which could include laws criminalizing abortion. Data needed to comply with state laws criminalizing abortion could potentially include a wide range of information such as location and message history.

Critics have also drawn attention to the bill’s exemption for de-identified data, which the American Civil Liberties Union called “ripe for abusive interpretations,” in a letter to the committee Monday. While many firms argue such data is anonymous, experts and even the Federal Trade Commission have pointed out that such claims are often dubious and that using information such as advertising identifiers can reveal sensitive behavioral information.

Sen. Ron Wyden, D-Ore., who has previously expressed he would not vote for the House version of the bill, has similar concerns about the exemption of de-identified data.

“[T]his loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals,” a Wyden aide wrote in an email to CyberScoop. “He strongly believes this must be fixed before any legislation becomes law.”

Commercial data privacy is increasingly impossible to untangle from broader civil liberties concerns about government surveillance, experts have warned. Numerous federal agencies including the Internal Revenue Service and Department of Homeland Security have purchased commercial data services to use in investigations, avoiding warrants and other oversight mechanisms in the process.

“The overall bill is still weak on controlling all parts of the data brokerage ecosystem,” said Justin Sherman, senior fellow in charge of the data brokerage project at Duke’s Sanford School. “For example, companies selling data collected on their own customers and companies which sell data on the side for additional revenue would not be covered as ‘third-party collecting entities.'”

That exception leaves out, for example, Internet Service Providers with questionable advertising businesses.

“We need to do much more to rein in the harms already occurring to civil rights, consumer privacy, and national security from data brokerage,” said Sherman.

The American Data Privacy Protection Act isn’t the only potential mechanism for Congress to crack down on data brokers or the abuse of their services. For instance, Wyden’s bipartisan and bicameral The Fourth Amendment Is Not For Sale Act would prohibit law enforcement from purchasing data that would otherwise require a warrant. House Judiciary leaders called for a markup of the bill at a hearing on Tuesday.

Several House Energy and Commerce Committee members made clear Wednesday that they would like to see additional discussion before giving the bill their support for a full floor vote. And even if it gets to the Senate, the bill faces strong resistance from Senate Commerce Chair Maria Cantwell, D. Wash., who has previously said she would not bring the bill for markup.

House Republicans roll out national privacy bill

Experts say the federal legislation takes inspiration from states laws in Virginia and Kentucky, but a lack of bipartisan support could spell trouble. 

Apple and Google challenged by parents’ rights coalition on youth privacy protections

Cyber threat information law hurtles toward expiration, with poor prospects for renewal

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure