Politically Direct Summer 2009: Behavioral Advertising Legislation

July 28, 2009 — Following a markup and approval of a manager’s amendment on June 2, the House Committee on Energy and Commerce Subcommittee on Commerce, Trade, and Consumer Protection approved HR 2221, the Data Accountability and Trust Act.

The legislation, introduced by Subcommittee Chairman Bobby Rush (D-IL) and Subcommittee Ranking Member Cliff Stearns (R-FL), would require companies to implement data security programs and notify those affected by a data breach. The bill would preempt various state data breach notification laws, creating for the first time a uniform national standard for notification. HR 2221 would also give the Federal Trade Commission (FTC) rulemaking authority and enforcement power relating to data breach.

The amendment addresses concerns relating to overlapping requirements some companies may encounter due to other laws, including the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. As amended, the bill considers a company in compliance if it has satisfied the information security requirements under any other federal law. Additionally, the amendment authorizes the FTC to expand the definition of “personal information,” requiring the FTC to create an expanded definition that does not “unreasonably impede interstate commerce.”

Chairman Rush has indicated that, although changes have been incorporated so far, this remains a “work in progress.” Rush stated that he will work with all stakeholders as well as Congressional members for effective data protection. DMA looks forward to participating in this process as appropriate.

Cooperation between the sponsor and other members could be helpful for the passage of the bill, as attempts to pass similar legislation in previous sessions of Congress have been impeded by jurisdictional battles between various Committees.

While joint hearings are unusual for Congressional Subcommittees, such a meeting took place on June 16 between the House Energy and Commerce Subcommittee on Commerce, Trade, and Consumer Protection and the Subcommittee on Communications, Technology, and the Internet. The joint-hearing explored behavioral advertising practices. and considered whether federal legislation is necessary to address concerns associated with these practices.

Led by the Subcommittee on Commerce, Trade, and Consumer Protection Chairman Bobby Rush (D-IL) and Subcommittee on Communications, Technology, and the Internet Chairman Rick Boucher (D-VA), the hearing was a continuation of previous hearings in each Subcommittee looking at various aspects of privacy.

While members commented on the benefits of targeted advertisements, concerns were raised over whether privacy issues should be addressed by Congress. The Subcommittee members’ questions garnered more information regarding what information is collected, how opt-outs currently work and how opt-in and opt-out methods can protect consumer privacy, and the appropriate roll and effectiveness of self-regulation.

At the same hearing, a letter from the Federal Trade Commission (FTC) to the Chairs and Ranking Members of both Subcommittees was introduced into the record. In the letter, the Commission addressed its own role in the development of self-regulatory guidelines, and encouraged the recent efforts of industry members to self-regulate. The FTC letter further expressed the Commission’s intention to continue to monitor the marketplace so that such self-regulatory efforts would continue to evolve.

Since the joint hearing, Congressman Rush has continued to push legislation on data security and breach notification in HR 2221, the Data Accountability and Trust Act. Additionally, Congressman Boucher has indicated his intentions to introduce a general privacy bill including regulations for online behavioral advertising.

# # #