As 2021 comes to a close, we will be sharing the key legislative and regulatory updates for artificial intelligence (“AI”), the Internet of Things (“IoT”), connected and automated vehicles (“CAVs”), and privacy this month.  Lawmakers introduced a range of proposals to regulate AI, IoT, CAVs, and privacy as well as appropriate funds to study developments in these emerging spaces.  In addition, from developing a consumer labeling program for IoT devices to requiring the manufacturers and operators of CAVs to report crashes, federal agencies have promulgated new rules and issued guidance to promote consumer awareness and safety.  We are providing this year-end round up in four parts.  In this post, we detail data privacy updates in Congress and federal agencies.

Part II:  Data Privacy

Congress continued to introduce a broad range of data privacy bills this year, though Congress appears to be stalled by whether the legislation should include a private right of action.  Additionally, in lieu of a comprehensive federal privacy law, the FTC has explored using its general rulemaking authority to advance data privacy regulation.

Although a number of data privacy bills have been introduced this year, lawmakers continue to disagree on whether legislation should include a private right of action for consumers.  The Consumer Online Privacy Rights Act (S. 3195), introduced by Senator Maria Cantwell (D-WA), Chair of the Senate Committee on Commerce, Science, and Transportation, would prohibit deceptive or harmful data practices; require that users be able to view, access, transfer, correct, and delete their data; and would require new measures to safeguard the collection and storage of sensitive personal data.  It grants enforcement authority to the FTC and state attorneys general and would provide consumers with a private right of action.  Also, Senator Roger Wicker (R-MS), the Ranking Member of the Senate Committee on Commerce, Science, and Transportation, introduced the Setting an American Framework to Ensure Data Access, Transparency, and Accountability (SAFE DATA) Act (S. 2499), which would impose data minimization rules, require consent for processing and transferring sensitive data, and would provide for enforcement by the FTC.  With Chairwoman Cantwell and Senator Wicker putting forth competing legislation, it is unclear what the two sides will need to find an accord, but that is a challenge that will continue into the new year.

In response to the increasing number of ransomware incidents, several bills create new breach notification obligations.  The Cyber Incident Notification Act (S. 2407), introduced by Senator Mark Warner (D-VA), would require federal agencies and contractors as well as operators of critical infrastructure to report cybersecurity breach notification reports to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 24 hours of learning of an incident.  Another notification proposal, the Cyber Incident Review and Reporting Act (S.2875), introduced by Senator Gary Peters (D-MI), the Chairman of the Senate Homeland Security and Governmental Affairs Committee, and the Committee’s Ranking Member, Senator Rob Portman (R-OH), would require owners and operators of critical infrastructure to report cybersecurity incidents within 72 hours.

With respect to FTC developments, an amendment to the Build Back Better Act (H.R.5376) includes a proposal that would allocate $1 billion over ten years to create a Privacy Bureau within the FTC, responsible for enforcing the FTC’s mandate with regards to privacy and data security.  The FTC issued a report to Congress in September, noting that the agency’s most recent efforts have focused on addressing privacy concerns heightened by the pandemic, such as health apps, accuracy of data used for housing, employment, and credit decisions, and video conferencing, as well as the accuracy and fairness of algorithmic decision-making.  At the same time, several Commissioners have expressed interest in using the FTC’s Section 18 rulemaking authority to develop a privacy rule, and several senators also wrote to FTC Chair Lina Khan, encouraging the FTC to begin a privacy rulemaking process.

We will continue to update you on meaningful developments in these updates and across our blogs.  To learn more about our team and our work, please visit Covington’s Data Privacy and Cybersecurity website.  For more information on developments related to AI and IoT, please visit our AI Toolkit and our Internet of Things website.

Print:
EmailTweetLikeLinkedIn
Photo of Jennifer Johnson Jennifer Johnson

Jennifer Johnson is a partner specializing in communications, media and technology matters who serves as co-chair of Covington’s global and multi-disciplinary Internet of Things (IoT) group. She represents and advises content distributors, broadcast companies, trade associations, and other media and technology entities on…

Jennifer Johnson is a partner specializing in communications, media and technology matters who serves as co-chair of Covington’s global and multi-disciplinary Internet of Things (IoT) group. She represents and advises content distributors, broadcast companies, trade associations, and other media and technology entities on a wide range of issues. Jennifer has more than two decades of experience advising clients in the communications, media and technology sectors, and has served as a co-chair for these practices for more than 15 years. On IoT issues, she collaborates with Covington’s global, multi-disciplinary team to assist companies navigating the complex statutory and regulatory constructs surrounding this evolving area, including legal issues with respect to connected and autonomous vehicles, internet connected devices, smart ecosystems, and other IoT products and services.

Jennifer assists clients in developing and pursuing strategic business and policy objectives before the Federal Communications Commission (FCC) and Congress and through transactions and other business arrangements. She regularly advises clients on FCC regulatory matters and advocates frequently before the FCC. Jennifer has extensive experience negotiating content acquisition and distribution agreements for media and technology companies, including program distribution agreements with cable, satellite, and telco companies, network affiliation and other program rights agreements for television companies, and agreements providing for the aggregation and distribution of content on over-the-top app-based platforms. She also assists investment clients in structuring, evaluating, and pursuing potential investments in media and technology companies.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.

Photo of Lindsay Brewer Lindsay Brewer

Lindsay Brewer is an associate in the firm’s Washington office. She advises clients on environmental, product safety, occupational safety, and public policy issues. She has experience with a wide range of environmental and safety programs, with a focus on the Clean Air Act…

Lindsay Brewer is an associate in the firm’s Washington office. She advises clients on environmental, product safety, occupational safety, and public policy issues. She has experience with a wide range of environmental and safety programs, with a focus on the Clean Air Act (CAA), the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA/Superfund), the Federal Trade Commission Act (FTC Act), the Consumer Product Safety Act (CPSA), the Federal Motor Vehicle Safety Standards (FMVSS), and the Occupational Safety and Health Act (OSH Act).

Photo of James Yoon James Yoon

James Yoon is an associate in the firm’s Data Privacy and Cybersecurity Practice Group. Prior to joining the firm, he served as a law clerk to Judge J. Clifford Wallace on the U.S. Court of Appeals for the Ninth Circuit and Judge Barbara…

James Yoon is an associate in the firm’s Data Privacy and Cybersecurity Practice Group. Prior to joining the firm, he served as a law clerk to Judge J. Clifford Wallace on the U.S. Court of Appeals for the Ninth Circuit and Judge Barbara M.G. Lynn on the U.S. District Court for the Northern District of Texas.

James is a member of the Bar of California. District of Columbia bar application pending; supervised by principals of the firm.

Photo of Nira Pandya Nira Pandya

Nira Pandya advises private and public companies on venture capital financings, mergers and acquisitions, joint ventures, strategic investments, and other corporate transactions. She also represents emerging companies in general corporate matters, including entity formation, corporate governance, and securities law compliance.

Andrew Longhi

Andrew Longhi is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and Communications and Media Practice Groups. Andrew advises clients on a broad range of privacy and cybersecurity issues, including compliance obligations, commercial transactions…

Andrew Longhi is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and Communications and Media Practice Groups. Andrew advises clients on a broad range of privacy and cybersecurity issues, including compliance obligations, commercial transactions involving personal information and cybersecurity risk, and responses to regulatory inquiries. Andrew is Admitted to the Bar under DC App. R. 46-A (Emergency Examination Waiver); Practice Supervised by DC Bar members.