Since debate on privacy legislation began in earnest following the 2018 midterm elections, members of Congress have released over 20 comprehensive information privacy bills or drafts. Most of these bills do not include proposed legislative findings or statements of policy that explain the overarching foundations of the legislation. Such declarations are primarily rhetorical rather than operational, but this rhetoric can serve several important functions. In this light, as the House and Senate and a new presidential administration prepare for the 117th Congress, we are proposing a set of legislative findings for federal privacy legislation as a template for the coming debate.
A handful of bills, like Sen. Kirsten Gillibrand’s (D-N.Y.) Data Protection Act and Sen. Sherrod Brown’s (D-Ohio) Data Accountability and Transparency Act, include statements of legislative findings or policy—but the majority do not. Most notably, legislative findings are absent from the bills that are the most likely starting points for legislation in 2021: Sen. Maria Cantwell’s (D-Wash.) Consumer Online Privacy Rights Act, Sen. Roger Wicker’s (R-Miss.) SAFE DATA Act, and the House Energy and Commerce “bipartisan staff draft” (although the latter does include a bracketed placeholder).
These omissions are understandable. The core provisions of privacy legislation present plenty of challenging and contested issues that we explored in our report “Bridging the gaps: A path forward to federal privacy legislation” last June. That report analyzed the Wicker and Cantwell bills in particular and suggested ways to reconcile differences, including on the polarized issues of preemption and private right of action. To make our recommendations concrete, we also drafted complete legislative text. Complete, that is, except for legislative findings. Like the House bipartisan staff draft, our proposed legislative text put in only a placeholder. The “Bridging the gaps” report commented briefly on the significance of findings and referred to “an ongoing project” on the content of such findings. Here, we introduce legislative findings and policy statements as the end product of that effort. They seek to provide an overarching foundation for our June report, and to fill in the placeholders in the draft privacy legislation. We hope to motivate further discussion about articulating the foundational principles and aims of privacy legislation.
“Legislative findings present an argument for a bill that can help build congressional and public support.”
Legislative findings present an argument for a bill that can help build congressional and public support. More significantly, they build a record of congressional intent that can guide interpretation by courts, administrative agencies, and affected parties, as well as enunciate grounds to uphold legislation against constitutional challenges. Such a record will be significant for the inevitable challenges to privacy legislation, especially on First Amendment commercial speech protections or Article III standing questions. As Congress continues to debate privacy legislation going into 2021, legislative findings will provide an opportunity to make a statement about the significance of privacy—one that can not only inform judges, regulators, and lawyers applying a privacy law, but can also declare American values to the world.
Writing for the University of Chicago Law Review, Brigham Young University law professor Jarrod Shobe conducts a rare and thorough study of the use and legal significance of legislative findings and purposes in enacted statutes. In a review of 30 years of legislation appearing in the Statutes at Large, the chronological collection of laws passed by Congress, Shobe finds that the majority of “significant bills” included findings. Nevertheless, he points out, courts and legal academics have given them little attention. This judicial omission is wrong, he argues, because “[e]nacted findings and purposes are law just like any other law, and there is no reason why they should not be given the full weight of the law.”
Shobe points to institutional reasons for the underestimation of legislative findings: they are often published only in the Statutes at Large, stripped out when legislation is codified in the United States Code, and discouraged by the House and Senate Offices of Legislative Counsel. In short, this omission does not indicate a lack of legal import, but rather reflects a mere matter of practice by the Office of Law Revision Counsel, a nonpartisan congressional office charged by statute with “[c]lassifying newly enacted provisions of law to their proper positions in the Code.” If Congress wants its text to matter, perhaps it should change this practice of relegating enacted findings and purpose statements to either hard-to-find statutory notes or the Statutes at Large.
Cameron F. Kerry, John B. Morris, Caitlin Chin-Rothmann, Nicol Turner Lee
Technology & Information By passing Proposition 24, California voters up the ante on federal privacy law
Cameron F. Kerry, Caitlin Chin-Rothmann
November 17, 2020
Professor Shobe’s groundbreaking argument makes sense. The late Supreme Court Justice Antonin Scalia’s most accepted contribution to American law has been the significance of textualism in statutory interpretation (not to be confused with a second and more debated Scalia contribution, originalism in constitutional interpretation). From his first term on the Supreme Court, Scalia waged a battle against use of legislative history to interpret statutes, dismissing statements of sponsors and even committee reports as irrelevant to the meaning of the text and a dubious reflection of the intent of Congress as a whole. As a result, as Jonathan Siegel puts it, “[w]e are all textualists now compared with the 1960s and 1970s.” As Shobe points out, legislative findings are a different order of congressional statement. “The text is the law,” Scalia argued—and legislative findings adopted by Congress are an integral part of that text, enacted by the full Congress the same as the other parts of a bill.
Legislative findings will matter in privacy legislation. Privacy legislation addresses the use of personal information, and any legislation that regulates information may implicate the First Amendment. The Supreme Court has extended First Amendment protection to encompass commercial speech, in particular advertising and marketing, albeit under a more lenient standard than for non-commercial speech. Under this standard, any government restrictions on commercial speech must “directly advance” a “substantial” government interest, whereas restrictions on other speech must be “narrowly tailored” to interests that are “compelling.” Commercial speech cases raise questions for how privacy legislation may limit businesses that share personal information with third parties, track and profile online users for advertising and marketing, serve ads based on personal information, and collect and disseminate information that may be considered public. Inevitably, some of these issues will become judicial questions.
In particular, the Supreme Court’s 2011 decision in Sorrell v. IMS Health may increase the likelihood that limitations on advertising and marketing resulting from privacy legislation will be challenged on First Amendment grounds. The Sorrell decision resulted from a Vermont law that prohibited pharmacies from disclosing information that links doctors with drug prescriptions to “data miners,” and barred pharmaceutical manufacturers from using such information to contact doctors for marketing purposes. The Court saw the statute as discriminating against these pharmaceutical manufacturers and marketers on one hand, while others were allowed to use the same prescription information for non-marketing purposes. It therefore struck down the statute under the stricter standard that applies to discrimination in expression (but said the same result would apply under the more lenient commercial speech standard).
Darrell M. West, John R. Allen
This narrow rationale was complicated by the statute’s confusing history—leaving the impact of the Court’s decision on privacy limits open to interpretation. Notably, the Court contrasted Vermont’s narrowly-targeted law with the broader protection of the Health Insurance Portability and Accountability Act (HIPAA) and suggested that a HIPAA-like statute “would present quite a different case than the one presented here.” Even so, the potential impact of privacy legislation on commercial speech has been raised in the privacy debate, and challengers would likely cite Sorrell as support for their claims. Indeed, a Maine law establishing privacy requirements specifically for broadband providers is being challenged on the theory that it discriminates among First Amendment speakers, and facial-recognition systems provider Clearview AI is defending a suit under Illinois’s Biometric Information Protection Act on similar grounds. Legislative findings will help to meet the Supreme Court’s effective guidance in Sorrell—that Congress should explain the broad societal goals that baseline privacy legislation seeks to address.
Privacy legislation also needs to address the Supreme Court’s Spokeo v. Robins 2016 decision on standing. This class action case was brought under the first federal privacy statute—the Fair Credit Reporting Act of 1970—by a plaintiff who alleged that a “people search engine” used to assess individual credit contained inaccuracies and sought damages. The Court sent the case back to the lower courts to determine whether allegations of intangible harm were “particularized” and “concrete” enough to meet the requirement of a case or controversy to sue in federal court under Article III of the Constitution. In discussing these requirements, the Court noted that injury to rights like free speech and free exercise of religion can be concrete for these purposes even though they are abstract. Although the Court ruled that not every inaccuracy or procedural violation under FCRA amounts to concrete harm, it acknowledged that when considering “whether an intangible harm constitutes an injury in fact, both history and the judgment of Congress are instructive.” The Spokeo decision specifically recognized that “Congress is well positioned to identify intangible harms that meet minimum Article III requirements …” This directly invites Congress to identify and articulate privacy harms.
“Legislative findings in privacy legislation will amount to a congressional brief to the Supreme Court.”
In the context of issues like these, legislative findings in privacy legislation will amount to a congressional brief to the Supreme Court that can articulate “substantial” or “compelling” interests—and how the statute directly advances these interests as well as limits harms that privacy violations can cause to individuals. With the force of law, such a brief would be far more persuasive than any “appellate counsel’s post-hoc rationalizations for agency action.”
With these considerations in mind, we have drafted a set of legislative findings and policy conclusions to anticipate and address these likely challenges. Our proposal is intended to inform interpretation by courts, the Federal Trade Commission, and the many other parties that would apply privacy legislation and need to understand congressional intent. These proposed findings are more expansive and detailed than what is typical in most legislation (though far more concise than the 173 recitals and 31 pages that explain the European Union’s General Data Protection Regulation). Unlike Members of Congress, however, we do not seek to win the votes of a majority of colleagues or to declare a set of conclusions. Instead, as think tank scholars, our goal is to provide a comprehensive outline for Congress and stakeholders to consider, and arguments to back up the recommendations in our June report. We leave it to Congress to distill such ideas into punchy declarations about enacted legislation as the privacy debate builds on current bills in the next Congress.
In drafting these suggested findings, we have drawn wherever possible on existing declarations in enacted legislation. Endnotes to the suggested language indicate these and other sources of the language.
The findings below contain five segments. We begin with a brief statement of the legal, moral, and historical foundations of privacy in America, demonstrating that privacy is a value deeply embedded in American law and society and describing some of the history that the Supreme Court alluded to in Spokeo. Second, we cover recent technology developments that underlie the need for legislation, especially the explosion of data and widespread collection and sharing of personal information, as background for legislative purposes.
“Privacy is a value deeply embedded in American law and society.”
The third and fourth segments lay out these purposes. The third identifies effects of these developments that privacy legislation aims to address and the fourth explains how it aims to address them. Finally, we conclude with a set of policy declarations that express key governmental objectives (which may be somewhat broader than the findings and specific provisions of the legislation), as Congress did in both the Fair Credit Reporting Act of 1970 (FCRA) and “Section 230” of the Communications Act of 1934, as amended (47 U.S.C. § 230). FCRA was a foundational national privacy law not only in the United States but around the world, and Section 230 is aimed at some of the same sectors most affected by privacy legislation. The proposed findings address reasons for the potential compromises framed in our “Bridging the gaps” report: tailored federal preemption, individual rights aimed at recognized privacy harms, and a graduated approach to risk and obligations centered on duties of loyalty and care that balance prescription and flexibility.
“Any new privacy laws must be flexible and technology-neutral, so that the laws’ protections may apply not only to the technologies and products of today, but to those of tomorrow.”
The Brookings Institution is a nonprofit organization devoted to independent research and policy solutions. Its mission is to conduct high-quality, independent research and, based on that research, to provide innovative, practical recommendations for policymakers and the public. The conclusions and recommendations of any Brookings publication are solely those of its author(s), and do not reflect the views of the Institution, its management, or its other scholars.
Brookings recognizes that the value it provides is in its absolute commitment to quality, independence, and impact. Activities supported by its donors reflect this commitment.
