Business Roundtable Letter on the American Privacy Rights Act

The Honorable Cathy McMorris Rodgers
Chair, Committee on Energy and Commerce
United States House of Representatives
Washington, DC 20515

The Honorable Maria Cantwell
Chair, Committee on Commerce, Science, and Transportation
United States Senate
Washington, DC 20510

Dear Chair Rodgers and Chair Cantwell,

On behalf of the members of Business Roundtable, thank you for the opportunity to share feedback on the American Privacy Rights Act (APRA). We appreciate your leadership and your focus on moving towards a bipartisan consensus on comprehensive privacy legislation. Since 2018, Business Roundtable has consistently called for a federal consumer data privacy law that will protect and empower consumers and provide clear obligations for how companies handle personal data.¹ Because of the critical importance of data to the U.S. economy and to companies' ability to compete globally, well-crafted privacy legislation will spur American innovation and global competitiveness. However, Business Roundtable has serious concerns about certain provisions of APRA, in particular the bill's section on federal preemption of state laws and regulations.

We are concerned that the preemption language in the legislation would fall short of creating the uniform national privacy standard intended. In particular, we are concerned APRA uses a weaker "covered by" standard rather than "related to" and that it includes expansive carve outs to preemption. All Americans deserve privacy protections, and a strong privacy law should provide the same protections to consumers across every state in the country. However, the preemption language in APRA would maintain a fractured regulatory environment creating uneven protections for consumers and challenges for companies trying to comply with privacy laws across state and federal jurisdictions. Moreover, the numerous carve-outs from preemption would increase fragmentation in those areas, as states (including existing state privacy agencies) would seek to exercise rulemaking authorities in those areas left within their purview.

Not only is it confusing for companies to figure out obligations in different places where they serve consumers, but it is also expensive. A report from the Information Technology and Innovation Foundation found that the cost of the patchwork of state privacy laws could exceed $1 trillion over 10 years, with at least $200 billion of that cost falling on small businesses.² Stronger preemption of state laws in APRA would ensure consumers across the country receive the same protection while reducing business compliance costs and confusion.

In addition, Business Roundtable members recommend additional revisions be made to APRA to ensure that the legislation provides effective consumer protection without harming U.S. competitiveness in artificial intelligence innovation, product development, service delivery and personalization, and the ability to communicate with consumers. While we appreciate the focus on actual harm rather than compensatory damages, Business Roundtable has serious concerns about the inclusion of a private right of action. A private right of action encourages excessive and frivolous litigation and provides little actual relief for victims.

Thank you for your leadership on our shared longstanding priority that is important for consumers and businesses. We are committed to engaging constructively with you to ensure that the bill provides a uniform national privacy standard with clear, consistent requirements to strengthen consumer trust and enable new services and technologies to flourish within a well­ understood legal and regulatory structure. We appreciate your and your staff's willingness to engage with stakeholders during this process and look forward to working with you to ensure that the bill provides a strong federal privacy law that enhances consumer privacy protections while preserving the ability for American businesses to compete.