Eric Null•Director of the Privacy and Data Program at the Center for Democracy and Technology
Executive Summary
The latest attempt at a US federal privacy law, the Republican-led SECURE Data Act, is analyzed as a significant step backward from previous bipartisan efforts like ADPA and APRA.
The bill is heavily criticized for its weak data minimization standards, narrow definition of sensitive data, broad exemptions that benefit AI training, and lack of protections against manipulative 'dark patterns'.
A primary concern is the bill's broad preemption clause, which threatens to nullify stronger state-level privacy and civil rights laws, effectively creating a low federal ceiling for data protection.
The discussion also highlights the tension between competition policy and privacy, citing California's BASED Act as an example where interoperability mandates could create new risks like forced message decryption.
9 quotes
Concerns Raised
The SECURE Data Act's broad preemption clause will nullify stronger state privacy and civil rights laws.
The bill contains numerous loopholes and weak standards that codify the status quo rather than protect consumers.
The lack of a private right of action removes a key enforcement mechanism for individuals.
The insatiable demand for data to train AI models is exacerbating privacy risks, and the SECURE Act effectively exempts this activity.
Opportunities Identified
Passing a strong, bipartisan federal privacy law that sets a high standard (a floor, not a ceiling).
Learning from past bipartisan compromises on difficult issues like the private right of action.
Ensuring new competition laws include robust, built-in privacy protections to avoid unintended consequences.