WASHINGTON – Consumer advocacy organizations expressed strong opposition today to H.R. 1165, the Data Privacy Act of 2023, a bill consumer groups believe would actually deprive consumers of important protections under state law, and offer little or no real new protections at the federal level.  

The bill, introduced by House Financial Services Committee Chair, Rep. Patrick McHenry (R-N.C.), is scheduled for mark-up and vote tomorrow in the committee. Consumer groups are calling on committee members to vote against this bill, which would be a major setback for consumer data privacy protections.

“This bill is being sold as a way to strengthen data privacy protection laws, but in reality, it will do much more harm than good. Members of Congress should reject this proposal,” said Ed Mierzwinski, U.S. PIRG Senior Director for Federal Consumer Programs. 

H.R. 1165 would override or “preempt” any state law regulating financial institutions in their “collection or disclosure of personal information.” This could include laws such as the California Financial Information Privacy Act, as well as data breach notification laws, which all 50 states have adopted. 

More shockingly, since the term “financial institutions” under the Gramm-Leach-Bliley Act (GLBA) covers more than just banks – it extends to credit bureaus, debt collectors, auto dealers, travel agents, and many other types of businesses. H.R.1165 could nullify state privacy law governing these companies, including laws in half the states that regulate state credit reporting. 

“The potential scope of preemption by H.R. 1165 is breathtaking,” noted Chi Chi Wu, attorney at the National Consumer Law Center.

One type of state law that could be preempted is medical debt laws, passed to protect patients against these debts showing up on their credit reports and lowering their credit scores. Maine and Texas have these laws, and bills have been introduced in Colorado and North Carolina.  

“Millions of consumers are burdened by medical debts on their credit reports,” stated Wu. “States are in the vanguard of trying to protect their citizens from the unfair impact of these bills – no one should have their credit ruined because they got sick.”

Bill proponents in Congress, backed by the fintech sector, argue that the GLBA is outdated and needs updating in response to burgeoning new uses of financial data and widespread problems with data privacy. But, while consumer advocates agree that GBLA needs strengthening, they say this bill would actually be worse than the status quo.

“This bill largely fails to offer new meaningful protections for consumers,” said Ruth Susswein, Consumer Action’s Director of Consumer Protection. “Instead it would substitute a weaker framework, roll back stronger state laws, and leave consumers worse off than they are now.”

The bill also fails to address the need for a private right of action or remedy for harmed consumers. Currently, many state laws provide some form of private remedy for consumers to seek redress when their privacy rights are violated. These laws are especially critical for consumers seeking protection, as GLBA lacks a private remedy mechanism.

“This bill’s failure to strengthen the rights to private action and its preemption of state private remedies, further strips consumers of their rights and makes it nearly impossible for them to hold companies accountable when they break the law,” said Emily Peterson-Cassin, Digital Rights Advocate with Public Citizen. ”A right without any remedy is largely meaningless to the millions of consumers whose lives are routinely impacted by widespread misuse of their private information.”

Despite these dangers, the House Financial Service Committee Chair is determined to move the bill for a vote, essentially arguing that federal updates are necessary and that state pre-emption is the necessary trade off. But, consumer groups say this is a false choice.

“Congress doesn’t need to choose between total state preemption and a federal framework for data privacy. Recently enacted bipartisan laws have struck a good balance between the two; the same can be achieved with data privacy,” said Mark Hays, Senior Policy Analyst with Americans for Financial Reform and Demand Progress. “Pushing this bill as is right now ultimately benefits primarily the finance and tech industries – much more can and should be achieved for consumers.”