Federal Data Privacy and Security Legislative Updates

Bookmark this page (Ctrl+D): Return for Ongoing Updates

In the course of doing business, rental housing owners and operators, and their third-party service providers, collect, use and maintain a significant amount of highly sensitive personal data about applicants, residents and employees. This information is used in a wide variety of essential business operations but also makes apartment firms a target of malicious actors. Given the ever-expanding cyber-threat landscape, rental housing owners and operators have made defense against these vulnerabilities a top priority.

NMHC believes that Congress should enact legislation that creates a single national data security, consumer privacy and breach notification standard that is reasonable, flexible and scalable.

Read on for the latest legislative actions related to this topic.

Feb. 28, 2023

🗨️

NMHC Submits Comments on Two House Data Privacy Efforts

NMHC submitted comments on February 28 in advance of a House Energy and Commerce Committee hearing on data privacy and the American Data Privacy and Protection Act (ADPPA) and a House Financial Services Committee markup that included Chairman Patrick McHenry’s data privacy bill that has been in the works for quite a while (see previous updates for historic context).

Why We Weighed in: ADPPA would establish a national data privacy standard, which NMHC strongly supports. The bill provides a private right of action and reflects a compromise on preemption, which have long sticking points that have prevented federal movement on creating a national standard.

Financial Services Committee Chairman McHenry’s bill does not apply to apartment firms, but pieces of the bill could ultimately be folded into broader bipartisan privacy legislation, specifically in light of momentum in both chambers. Chairman McHenry’s bill amends the Gramm-Leach-Bliley Act (GLBA) to better reflect the evolving technological landscape for firms directly involved in providing financial services to consumers.

Diving Deeper: ADPPA has strong bipartisan and bicameral support, so it currently serves as the starting point for future data privacy negotiations.

Cosponsors during last Congress include House Energy and Commerce Chair Cathy McMorris Rodgers and Ranking Member Frank Pallone, along with subcommittee leadership Reps. Gus Bilirakis and Jan Schakowsky. Former Committee on Commerce, Science and Transportation Ranking Member Sen. Roger Wicker also supported the legislation.
Senate Commerce Chair Maria Cantwell opposed the bill based on issues of enforcement and preemption of state privacy laws, particularly California’s Consumer Privacy Act. The California delegation and Governor Gavin Newsom also voiced opposition along the same lines.
Because of Chair Cantwell’s continued concerns, there will need to be further compromises to bring her on board.

What’s Next: Momentum for a data privacy standard continues as Congress pushes to create consumer data privacy protections in light of concerns about big tech and foreign actors. NMHC will continue to make the case for a national standard that preempts existing state data privacy laws so that apartment firms do not have to comply with an onerous patchwork of state laws.

Learn more about our viewpoint on this issue by reading our recently submitted comment letter.

July 22, 2022

📄

Legislation that Creates Federal Data Privacy Standard Advances to Senate

The House Committee on Energy and Commerce advanced a measure that would create a national data privacy standard during a June 20 markup.

Why This Matters: This is a significant step forward in creating a national standard, which has taken years of negotiation between Democrats and Republicans. As previously reported when the bill was introduced in June, NMHC is highly engaged on this issue given its impact on the industry. Multifamily firms are faced with a growing patchwork of state data privacy standards. That’s why it’s critical we implement a national standard that preempts state data privacy laws and allows for flexibility and scalability.

What We’re Doing: We’re pleased this bill has bicameral and bipartisan support and will continue to work with lawmakers to ensure it progresses. In advance of the markup, we weighed in with the Committee to applaud their efforts and share the apartment industry’s perspective on numerous aspects of the proposal. Among the many items raised, we encouraged lawmakers to clarify consumer notification protocols, legal responsibility and liability provisions and the FTC’s role in rule making and enforcement.

What’s Next: While this bill was overwhelmingly approved by the House Committee, it faces an uphill battle in the Senate where the lead democrat with jurisdiction over this issue, Senate Commerce Chair Maria Cantwell (D-Wash.) has voiced opposition.

Without her support, there will be no movement forward, but efforts toward compromise continue. House Energy Commerce Chair Frank Pallone (D-N.J.) and Ranking Member Cathy McMorris Rodgers (R-Wash.) addressed some of Chair Cantwell’s concerns by including limits to the forced arbitration provision and delaying for two years the private right of action instead of the original four. Chair Cantwell has also expressed concerns about enforcement, particularly if a national standard would preempt existing state data privacy laws. This concern is echoed by some in the California House delegation, as well as California Governor Gavin Newsom and will continue to be a focal point of negotiations.

June 10, 2022

📄

Bipartisan Lawmakers Release Federal Data Privacy Bill That Would Have Impact on Multifamily Data Practices

For the past several years, Congress has continued to debate a federal consumer data privacy standard, but disagreements on federal preemption and private right of action have prevented meaningful progress. But in a significant step forward in the debate, House Commerce Committee Chair Frank Pallone (D-N.J.), Ranking Member Cathy McMorris Rodgers (R-Wash.) and Senate Commerce Ranking Member Roger Wicker (R-Miss.) released a discussion draft in early June that establishes a federal data privacy standard that preempts most state laws, with some exceptions.

Why This Is Critical for Our Industry: This bill has been years in the making and includes several key provisions that will have direct impact on industry operations, including a:

requirement that groups minimize the data they collect from consumers;
prohibition of the transfer of sensitive data to third parties; and
limited private right of action allowing individuals to sue for privacy violations.

What’s Next: The bill reenergizes the debate and provides a framework for ongoing negotiations. But forward progress is unlikely until it gains the support of Senate Commerce Chair Maria Cantwell (D-WA), who is notably not a sponsor. Senator Cantwell (D-WA) wants to see stronger consumer protections and will be unlikely to move the bill without changes. The congressional calendar also poses a challenge, as it’s an election year and there is not much time left in the Congressional calendar before August break.

Kevin Donnelly kdonnelly@nmhc.org

Julianne Goodfellow jgoodfellow@nmhc.org

Daria Dudzinski ddudzinski@nmhc.org