A monthly roundup of federal data privacy and security policy and regulatory new

Welcome back to Holland & Knight's monthly data privacy and security news update that includes the latest in policy, regulatory updates and other significant developments. If you see anything in this report that you would like additional information on, please reach out to authors or members of Holland & Knight's Data Strategy, Security & Privacy Team.

LEGISLATIVE UPDATES

Fall 2023 Outlook

Current Status: Congress departed Washington, D.C., on July 28, 2023, for August recess. Before adjourning, the Senate Committee on Appropriations favorably reported all 12 appropriations bills, but the full Senate has yet to pass any of the bills. The House Committee on Appropriations favorably reported only 10 appropriations bills, and the full House has approved only the Military ConstructionVeterans Affairs spending bill by a 219-211 vote. House Republicans planned a vote on the Agriculture spending bill before recess but pulled the vote at the last minute over internal disagreements between Republicans. The U.S. Senate is set to return on Sept. 5, 2023, and the U.S. House of Representatives will return on Sept. 12, 2023. When Congress returns, it will have to pass a continuing resolution (CR) to avoid a shutdown before the current fiscal year ends on Sept. 30, 2023, or face a government shutdown.

Risks: Adding to the complexity of the appropriations process, on June 3, 2023, President Joe Biden signed into law the Fiscal Responsibility Act of 2023 (H.R. 3746), which suspended the nation's debt limit through Jan. 1, 2025, and set spending caps for Fiscal Years (FY) 2024 and 2025. The deal keeps non-defense spending roughly flat with current (FY 2023) levels in FY 2024 ($704 billion). The deal also caps defense spending at $886.3 billion for FY 2024, a 3.3 percent increase over FY 2023. The bill also created a penalty to incentivize the enactment of the FY 2024 and FY 2025 appropriations bills - if all 12 appropriations bills are not enacted by Jan. 1, 2024, non-defense and defense spending limits are reduced to 1 percent below FY 2023. This penalty was intended to create an incentive strong enough to support the enactment of a final FY 2024; however, conservative Republicans believe these cuts do not go far enough, and the two parties have not agreed on a pathway forward.

Barriers to Passing a CR: The president has also requested $40 billion in supplemental funding for Ukraine, border funding, disaster relief and fentanyl-abatement efforts, which runs counter to House Republicans' goal of cutting spending. Senate Appropriations Committee Chair Patty Murray (D-Wash.) and Vice Chair Susan Collins (R-Maine) agreed on a bipartisan basis to add $13.7 billion in additional emergency appropriations, including $8 billion for defense and $5.7 billion for non-defense spread across four subcommittees.

On July 10, 2023, 21 House Republicans - members of the conservative Freedom Caucus - signed a letter to House Speaker Kevin McCarthy (R-Calif.) making a number of demands before they would support the FY 2024 appropriations bills. The primary demand is to reduce federal spending to FY 2022 levels instead of FY 2023 levels. Based on the current make-up of the House, Republicans can only lose four votes and still pass the appropriations bills with Republican votes only, so if the 21 signatories insist on the demands in the letter, they have enough votes to force their consideration or require Speaker McCarthy to rely on Democratic votes to pass the CR. One of the Freedom Caucus members, Rep. Bob Good (R-Va.), stated that if the government shut down, "most Americans won't even miss" it. If Freedom Caucus members are not concerned about shutting down the government to get what they want, it will create a challenging environment for Speaker McCarthy.

Expectations: Republicans and Democrats will spend the month of August negotiating and counting votes to advance a CR before Sept. 30 to buy more time to enact the final FY 2024 appropriations bills. Speaker McCarthy vowed to his caucus on Aug. 14, 2023, that any CR would last no later than early December to avoid running into the winter holidays. In turn, Senate Majority Leader Chuck Schumer (DN.Y.) said a CR through early December "makes a good deal of sense." Conservative Republicans in the House will likely seek to extract a reduction in government spending in exchange for a CR that keeps the federal government open. Democrats are unlikely to support anything short of a clean CR and a final FY 2024 appropriations bill consistent with the spending caps agreed to in the debt deal. Reaching a deal to pass a CR will be challenging and may result in a government shutdown to create the urgency to reach a deal.

Senate Commerce Marks Up Children's Privacy Bills

On July 27, 2023, the Senate Committee on Commerce, Science, and Transportation held a markup on bipartisan measures that aim to enhance kids' online safety and privacy. The committee favorably reported the two bills, the Children and Teens' Online Privacy Protection Act (S. 1418) (COPPA 2.0) and the Kids Online Safety Act (S. 1409) (KOSA). Senate Majority Leader Chuck Schumer (D-N.Y.) intends to bring kids' privacy bills to the Senate floor for a vote in the coming months. United for Privacy, a coalition of advocacy groups, sent a letter to members of Congress urging the passage of a comprehensive federal data privacy bill that creates a uniform national standard, preempts state law and ends the patchwork of state privacy laws. Nevertheless, passage in the House will likely be more difficult. House Committee on Energy and Commerce Chair Cathy McMorris Rodgers (R-Wash.) has indicated that she prefers a comprehensive national standard on data privacy over narrow child protections.

The kids' privacy bills passed by Senate Commerce Committee include:

  • COPPA 2.0: Sens. Ed Markey (D-Mass.) and Bill Cassidy (R-La.) would reform the existing Children's Online Privacy Protection Act (COPPA) law to prohibit online companies from collecting personal information from users who are under 17 years old without their consent and ban targeted advertising to children and teens. This is similar to previous renditions of the bill.
  • KOSA: Sens. Richard Blumenthal (D-Conn.) and Marsha Blackburn (R-Tenn.) reintroduced this bill that would impose a duty of care for digital services to prevent harm to younger users.

For other kids' privacy bills introduced or reintroduced in the Senate, view the May 2023 Holland & Knight Data Privacy and Security Report.

House Judiciary Committee Holds Hearing on FTC Oversight

The House Committee on the Judiciary held a hearing on July 13, 2023, "Oversight of the Federal Trade Commission," in which the committee examined management of the FTC, its record of enforcement actions and rulemakings under Chair Lina Khan. In her testimony, Khan highlighted the FTC's activities and initiatives, as well as challenges facing the agency as it works to fulfill its dual mission of promoting competition and protecting American consumers from unfair or deceptive practices in the marketplace.

On the competition side, Khan argued the FTC continues to target illegal mergers and conduct, and challenge transactions in critical sectors of the economy, including semiconductors, defense, energy, healthcare, mortgage technology, digital markets and pharmaceuticals. Khan highlighted a bipartisan coalition of 10 state attorneys general to charge pesticide manufacturers and the FTC's rule that would ban employers from imposing noncompete restrictions. (For further insight, see Holland & Knight's previous alert, "FTC Proposes an End to Employee Non-Compete Agreements," Jan. 6, 2023.) On the consumer protection side, Khan focused on combatting fraud and protecting consumer privacy. She highlighted the FTC's enforcement actions under the Opioid Addiction Recovery Fraud Prevention Act, Health Breach Notification Rule, Military Lending Act (MLA) and Made in USA Labeling Rule.

Khan also mentioned multiple actions using authority under existing rules such as COPPA. For example, in December 2022, the FTC announced a law enforcement action against Epic Games Inc. over charges the company violated COPPA and imposed unfair default privacy settings on children and teens. She also highlighted the FTC's launch of a new Office of Technology to strengthen the agency's ability to keep pace with technological challenges in the digital marketplace. House Judiciary Committee Chair Jim Jordan (R-Ohio) criticized Khan and accused her of "mismanagement of the FTC and its disregard for ethics...and politicized rulemakings." In his opening statement, Jordan criticized Khan for putting burden and costly demands on parties and for failing to comply with congressional oversight or requests from the committee.

Click here to continue reading . . .

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.