• by Wendy Davis , September 25, 2018

Federal lawmakers should avoid passing a national privacy law that would trump powerful existing laws in states like California, Illinois and Vermont, the digital rights group Electronic Frontier Foundation says.

"If Congress enacts data privacy legislation that is weaker than the existing state data privacy laws, and simultaneously preempts the stronger state data privacy laws, the result will be a massive step backwards for user privacy," the EFF says in a letter to leaders of the Senate Commerce Committee.

That committee is slated to question representatives from Google, Twitter, Amazon and other tech companies at a Wednesday hearing about online privacy. At least some of those companies are expected to urge Congress to pass a federal privacy law that effectively eliminates individual state laws.

Earlier this week, the ad group Interactive Advertising Bureau also said it now supports a national privacy law, arguing that different regulations in different locales "will result in a patchwork of varying state laws and consumer confusion, and would negatively impact the online user experience."

But the EFF says that "weak federal legislation that preempts stronger state legislation would be far worse than doing nothing."

The group notes that three states -- California, Illinois and Vermont -- have already passed privacy laws.

California's new Consumer Privacy Act, slated to take effect in 2020, allows consumers to learn what personal information about them is held by businesses, and to opt out of the sale of that information. In May, Vermont passed a number of requirements on data brokers, including a requirement to disclose whether they allow consumers to opt out of having their information collected, stored or sold. And in Illinois, a biometric privacy law requires companies to obtain consumers' written consent before storing data like faceprints and retinal scans.

"The people of these and other states would suffer if Congress enacts a weak consumer privacy law that preempts these stronger consumer privacy laws," the EFF writes.