Pass the popcorn! We're only a few minutes away from the webinar #PrivacyTwitter has been waiting for with bated breath! And talk about an all-star cast ...
Some quick background: the American Data Privacy and Protection Act (ADPPA) is the first federal consumer privacy bill to make it through committee this century. It's a huge milestone! But its prospects going forward are unclear.…
@AlanInDC's recent article (with @CaitrionaFitz) in @techpolicypress makes the the case for ADPPA.…
earlier today, @omertene shared some reasons why he thinks ADPPA should pass.

But not everybody agrees. At @CalPrivacy's special board meeting, Alistair Mactaggart of @caprivacyorg described ADPPA as a major threat to Californians' privacy. @CalPrivacy's board voted unanimously to oppose ADPPA in its current form.…
Moderator @DanielSolove gives ADPPA a B+ -- but graded on a curve.… Grading on a Curve: Why Even a State of the Art Law Today Is
Solove's post on ADPPA's preemption as a "Faustian Bargain" is also excellent reading.

ADPPA overrides state and local laws like California's and Seattle's Broadband Privacy Ordinance, and prevents stronger future state and local consumer privacy laws…
The webinar will start in just a couple minutes -- so register now before it's too late!…
And just in time for the webinar, @caprivacyorg has , announced their opposition to ADPPA and released their detailed analysis of how it compares with California's law…
It's a great complement to our post from last night (which will clearly need updating!) looking at the two bills.…
Solove starts off by asking whether the bill is strong enough to do good. "On the whole, I give it a fairly high grade on a curve - especially for something coming out of Congress. Objectively, I would give it a C or C-. Even the GDPR has a long way to go."
Solove: "Will this improve privacy? Yes. Will it solve the problem? No."
@jodywestby: "On a curve, I give it a B. They made a complete mess of the private right of action, which they didn't need to do. They did a good job of getting rid of the sale/share of CPRA.

Objectively, I give it a D. The US isn't in the driver's seat."
@AlanInDC: "In terms of where we are in Congress, I'd give it an A-. It has strong prohibitions on harmful business practices, data minimization, anti-discirminatino.

Objectively, a C or B. Not addressing law enforcement, no statutory damages, no privacy authority."
Alistair Mactaggart of @caprivacyorg: "I think it's a real mistake. Preemption is the real central issue. Tech industry's attempt to neutralize CA. Why are we trying to do it this way, as opposed to make it a floor?"
"It's tech industry's attempt to replace CA's regulations. It does some things well -- prohibiting targeting advertising to kids, data broker regulations -- but there are plenty of things it does worse."
Mactaggart mentions the elephant and talks about ADPPA's failure to protect against post-Roe threats!

"If it were a floor, I'd be jumping up and down. But take out preemption and it won't pass."
@omertene suggests that none of this would have happened without Mactaggart and California's law (I agree!). He gives it an A on a curve -- "not even close". Not on a curve, he doesn't know how to compare to pie-in-the-sky that won't materialize.
Tene: has a good balance between principles (like data minimization, privacy by design, anti-discrimination) and operational issues like notices, global opt-out. Also points to strong enforcement -- a PRA, a "turbocharged" FTC, keeps state AG's in the mix.
I'm not going to fact-check everything real-time, but as @jason_kint points out the global-opt out Tene's talking about is very ineffective, and the state AGs have complained that their enforcement power is severely curtailed.
@slhintze: "I give any law that passes Congress an A+ -- something is better than nothing. Compariing to other laws in US, an A- -- an overall improvement. Compared to other laws around the world, B+.

Objectively, I'm a hard grader: C+. Quite a few gaps and holes to improve"
@slhintze notes that we need privacy protections for LGBTQ+ people. "We need to set aside our differences and not let perfect be the enemy of the good."
Solove: it remains to be seen whether the PRA is viable, or really weak and meaningless. Privacy Impact Assessments, maybe it's okay, but no requirement to submit to regulator -- could just be a papwerwork requirement.
FTC enforcement, looks good, but will Congress give the FTC what it needs to enforce? Not clear. Lots of "maybes." The optimist in me says if everything works great - FTC gets what they needs, PRA is viable, it gets updated over time -- it looks good.
"I'm a cynic." We see that Congress *doesn't* update privacy laws. So I'm very ambiguous.
The things I like, I have to put an asterisk near them -- if it develops in a different way I could easily dislike them.
Alan Butler: "The thing I like most in the law is 102(2), the specific prohibition on sensitive data processing. This bill would require that sensitive data can't be processed except for specific enumerated purposes. Other bills don't limit this."
Enforcement is at three levels:
- State AGs and privacy agencies
- PRA. Even acknowledging limits, this is stronger than state bills.

Need FTC funding, some small things that need tightening, need to clarify preemption -- e.g., limiting automated decision making.
Susan Hintze: "Biggest thing I like is that it covers people outside California." Programmatic protections are in line with GDPR. Loves Privacy By Design (FYI @LourdesTurrecha), privacy impact reports, requirement for privacy officers is huge.
Love the concept of FTC Bureau of Privacy, requirement for FTC to educate entities and give guidelines. Agree that the FTC will need funding, although that's something that can be addressed over time.
Hintze: "There's so many things to hate that it's hard to pick just a couple. So many holes it's like swiss cheese!" Exemption for public data is so broad, really undermines protections against discrimination when you have loopholes you can drive a truck through.
Last draft struck the definition of sexual orientation from sensitive data. "Some people are fine with having that information out there, others are at risk."

There are a lot of weird preemptions, a lot of sausage making. "Let's play some favorites here among the states"
Absurdity of some clauses, it applies to girl scout troops but not banks. I'm willing to get over all those though!
Mactaggart: like exempting kids from targeted advertising, national scope.

Dislike: no prohibition against weakening. Lost opt-out from profiling and automated decision making. No separate privacy authority, could be important for EU adequacy.
Concerned that service providers to government agencies are exempt, points to ICE buying data.

Sensitive data excludes data from surveillance cameras and photos -- including location data.
Covered data under ADPPA "may" include identiiers, under CPRA it does.

Pay for privacy: CRPA has strong language, it's gone in ADPPA -- "all retailers will force you into loyalty programs, and there goes your ability to have some kind of privacy."
"It makes me sad that we're here. Preemption is the problem." EPIC's opposed preemption for ever, rolling over for short-term gain is a mistake. A strong state privacy law makes a difference -- MS and Apple extended CCPA protections to the whole country.
Tene: "I couldn't disagree more with Alistair." Going through section by section on ADPPA, we could do the same thing with CCPA/CPRA -- they're far from perfect privacy laws. This law has data minimization, opt-in for sensitive data, civil rights.
"This is the foundation -- sensitive data opt-in, it knocks California out." I do think this law provides stronger protections to 40 million CA residents, but aside from that it applies to 300 million people outside CA.
Tene objects to "California exceptionalism", notes that women in other states are also concerned about post-Roe threats. "This law would give them some protection." Again, I'm not going to fact-check in real time, but many people disagree.…
Tene: "It's not unreasonable to have a national standard. This law does have carve-outs -- biometrics, student privacy laws. It's not realistic to talk about a federal privacy law without preemption."
Tene: Solove's point about ossifying and becoming detached from reality is true about any law." Draws analogy to climate change law (which isn't preemptive, so I'm not sure it makes this point). "We rely on agencies and courts to keep these laws alive."
Tene: "What I like most about this law is that it exists. It's a bipartisan compromise." Compliments legislators, "a tremendous achievement they've been able to stitch it together". Applies in 50 states, data minimization,
Some incoherence (reflecting compromise) - when is advertising opt-out, some confusion. Line was originally fuzzy between service providers and covered entities, fixed in the latest draft.

@BenBrodyDC has discussion service providers…
Westby: we need a federal law! I like the data security provisions -- quite good, better than California law, that's a big plus. Business community has had 20 years to get their act together, and they haven't. I really like 208.
Westby: Likes 403 with FTC and State AGs sharing authority. AGs have a good record of protecting people in their states, US government doesn't.

Very happy that reference to share and sell are gone, that third-party doesn't include affiliates.
Westby: doesn't have employee data, that's good.

Don't like: doesn't include FTC budget. It has a lot of guidance and compliance requirements for FTC, look at how much EU spends -- we need to spend more.

Not sure about eliminating other federal regulators (FCC)
Really don't like the private right of action. "It's a mess," with all the requirements you have to do before.

FTC setting guidelines on public data (outside of human subject research) is concerning, this could get very muddied up.
Westby: the preemption problem is unnecessary. Why not just saying it's preempting any state law that conflicts? Exempting these other laws is confusing, makes industry nervous -- went way out of bounds.
But it is a start. The US can't innovate on laws like the EU can -- we can't do privacy, we just don't do it well. Yes, laws get behind, but still we need a federal law to be on the global stage, to be a player.
Solove: I'm torn. I'd lke to see a federal law, but we do have the FTC act, and if we had passed a federal law in 2000 it would be far weaker than today. Even if we did it two or three years ago, the progress in privacy laws is phenomenal. Do we really want to fix it now?
Maybe optimistically this is a starting point, and Congress will ratchet up protections. I ... don't ... know. We're kicking away the ladder, the threat of state legislation - California has driven things. FTC is already doing a lot under Section 5, will this strip resources?
Solove: we might be better off not having a federal law. "It's not so bad in the interim." A lot of companies are following California and GDPR.

Tene: I *would* take the bread out of the oven, because it might burn later.
Tene: it's surprising that a cynic like Solove says that things might get better in two years. It might get worse. It's a unique moment and opportunity, sometimes you need to seize the opportunity! Not convinced by the argument about timing.
With respect to the Section 5 comparison, so far-fetched to compare this law with all its rights to the prohibition on unfair and deceptive business practices. It's so much stronger!
Solove: depends on your view. Rights are good, but they don't do as much as people want them too.
Butler: This bill sets strong protections and a recognition of "finding some form of middle ground." For a long time EPIC and others said "federal floor or nothing", companies said "federal feeling or nothing". This is a middle ground, between the two extremes.
Mactaggart: somehow a lot of people have bought into the notion of "privacy's different, unless we get federal protection it's not going to pass." What about GLBA and HIPAA? They have privacy floors. What's so different?
This is just a mantra that tech keeps repeating. The only reason we're talking right now is that tech's trying to get back to where we were -- give all the regulation to FTC with no resources, that's perfect!
Tene: would you prefer no ECPA?

Mactaggart: data breach is a better example. CA went first, now each state has them. Companies can survive -- they do it in all other areas of laws. CPRA isn't perfect, CA legislature can update it.
Mactaggart thinks that CA can drive privacy. Hopes that Soltani gets adequacy from EU, then people will get on board.
Westby: the EU has showed us why preemption is needed. The Data Protection Directive was a mess, that's what drove GDPR. Companies can't do this any more. What states are doing is out of time. Agree that CA is more aligned with GDPR, we have to get a federal standard.
Westby: have to stop taking this US-centric view, and look globally.
Butler: Congress can at any time pass a preempting federal law. The trend we've seen in the states is new comprehensive laws that are bad, new proposals even worse. Industry will push for weaker and weaker state laws across the country, then push for weak preemptive federal law
So there's a real risk of not doing it now. The ballot initiative is a great thing in California, but it'll be weaponized by companies. So there's a real benefit to setting a strong privacy standard through a bipartisan process.
Hintze: agrees. The political issues and treatment of fundamental rights isn't the same as protecting people from harm due to data breaches. When we're seeing states not protect fundamental rights, I don't see how we'll get 50 states to pass laws like CA's
And that's why I think this is the right time. Without our ability to have privacy protections in place, we won't be able to express ourself. I don't know we'll have a federal government in a couple years that can even consider privacy legislation. Now is the time.
A lot of the state laws aren't even really protecting people's rights, just giving us busy work to do. So we can't rely on state laws.
Solove: a lot to think about. I'm really so ambivalent and torn. A lot depends on how it plays out -- public information, FTC funding (could easily be taken away in the future, or it could get stronger). It really is trying to make a hard balance and prediction.
Solove: "I teeter in the middle." Great arguments on both sides: costs and benefits. Also, the bill now isn't necessarily what it looks like when it passes. Could well be more loopholes and exemptions that underline the law -- it's a moving target.
Solove: I read different things about its likelihood of practice. This has been our best chance to see things at the federal level in a long time.

Fascinating conversation, I've learned a lot. Thanks everybody!
@threadreaderapp please unroll

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with The Nexus of Privacy

The Nexus of Privacy Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @NexusOfPrivacy

Aug 11
Big privacy news today! The @FTC is seeking comment on whether to issue rules aimed at commercial surveillance & lax data security practices.…
Read 39 tweets
Aug 10
One out of six ain't good: Five ways the American Data Privacy and Protection Act falls short. #ADPPA…
As @omertene points out, @ACLU_NorCal opposed California's current privacy bill when it was on the ballot in 2020.

So did @ColorOfChange, @DoloresHuerta, and quite a few immigrant rights groups.

How many of the California bill's weaknesses they talked about does ADPPA address?

I looked at the ballot argument against Prop 24, the rebuttal argument, and @ACLU_Norcal's "Californians Should Vote No on 24"…
Read 9 tweets
Aug 9
Today's Privacy News: the #StopShotSpotter week of action, Amazon buys Roomba (what could possibly go wrong?), Facebook DMs lead to a teen being prosecuted for having an abortion ... and much much more.…
The @stopshotspotter coalition and groups including @ACREcampaigns @mediajustice @FreedomtoThrive @MPower_Change and @lucyparsonslabs have a week of action.

One way to get involved: sign the petition and tell ShotSpotter to stop selling surveillance.…
Find out more! Thursday, at 4:30 pm Pacific (7:30 pm Eastern), is The People’s Earnings Call, with organizers from campaigns across the country, to talk about how ShotSpotter business financially impacts our communities.…
Read 12 tweets
Aug 8
The Opportunity and the Elephant: Federal Privacy Legislation Update, August 8

As Congress leaves DC for a four-week recess, it's a good time to look at what's up with federal privacy legislation.…
The newsletter includes an update on five privacy bills
- the Fourth Amendment Is Not For Sale Act
- ADPPA, the consumer privacy bill
- the Children and Teens Online Privacy Act (CTOPPA)
- Health and Location Data Privacy Act
- My Body My Data…
The Fourth Amendment Is Not For Sale Act probably has the best chance to pass this session. @justinhendrix has a good summary of the strong bipartisan support at its House Judiciary hearing.…
Read 14 tweets
Jul 28
We'll be live-tweeting the California Privacy Protection Agency (CPPA, aka @CalPrivacy) Board's special meeting today discussing proposed federal privacy legislation, including the ADPPA, starts at 9:00 am Pacific time.

Let's start with some background.

Here's our update on ADPPA from earlier in the week.…
ADPPA's current version overrides California's privacy law, CRPA - and current and future privacy laws in all 50 states.

CPPA, CA's AG and Governor, @EFF, @ACLU_NorCal, @AsmBuffyWicks all oppose this.

Here in Washington, so does our AG and Indivisible groups across the state
Read 78 tweets
Jul 27
Good morning! Starting at 7 am (Pacific time), it's the @SenateCommerce_ markup on bipartisan children's privacy legislation! You can watch the livestream at…
There are two bills on the agenda today.

S. 1628, Children and Teens’ Online Privacy Protection Act (CTOPPA, sometimes called COPPA 2.0 because it updates the Childs Online Privacy Protection Act, COPPA), is sponsored by @SenMarkey and @SenBillCassidy…
And S. 3663, Kids Online Safety Act (KOSA) is sponsored by @SenBlumenthal and Senator Blackburn (@VoteMartha)…
Read 33 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!