Congress’ push for a privacy law is alive and well — in statehouses

So she started looking at the state version of ADPPA that EPIC has been recommending. While Yoder isn’t introducing it as a bill, she is using elements of it, like its data minimization requirements, and private right of action. It’s still too early to tell how successful this effort will be, but the federal bill’s track record in Congress gives Yoder confidence.

“I thought the protections were good, I think what was so exciting and encouraging was that it did have bipartisan support,” Yoder said.

In Massachusetts, lawmakers introduced the Massachusetts Data Privacy Protection Act in the House and Senate after several failed attempts to pass privacy regulations in past years. Each time, tech lobbyists argued that strong privacy protections could cost jobs in the tech industry. For Massachusetts, the state with the highest concentration of tech employees in its workforce, those concerns mean a lot to lawmakers.

The state bill’s introduction comes with modifications from the American Civil Liberties Union of Massachusetts, which advised on the legislation. Some changes include adding workplace surveillance protections, and removing data security requirements because Massachusetts already has laws that require them.

“We hope that legislation that has been so carefully hashed out by so many of the actors involved, and frankly endorsed by many of the most prominent tech companies in D.C., will have a better chance of success in Massachusetts,” the ACLU of Massachusetts’ Crockford said.

But these small changes will attract criticisms from both tech industry groups as well as the lawmakers behind ADPPA on Capitol Hill.

Rodgers, the chair of the House Energy and Commerce Committee, said that Congress needs to take action, and wants to avoid states moving ahead with their own proposals.

“We appreciate these states recognize that ADPPA is the strongest data privacy and security bill out there,” Rodgers spokesperson Sean Kelly said, “but the best way to accomplish this is with comprehensive privacy protections and one national standard — not by doing it piece by piece or state by state — to ensure people’s protections remain the same regardless of where you are.”