On the heels of the formation of the House Privacy Working Group, Congressman Brett Guthrie (KY-02), Chairman of the House Committee on Energy and Commerce, and Congressman John Joyce, M.D. (PA-13), Vice Chairman of the House Committee on Energy and Commerce, issued a Request for Information (RFI) regarding a Federal Privacy Law.

“The challenge of providing clear digital protections for Americans is compounded by the fast pace of technological advancement and the complex web of state and federal data privacy and security laws, which in some cases create conflicting legal requirements,” reads the request.

Guthrie and Joyce are accepting input until April 7, 2025. They are specifically asking questions regarding:

• Roles of players in the data protection space (controllers, processor).
• Should there be different treatment for companies of varying sizes.
• Scope of the privacy laws – including the definition of “personal information.”
• Scope/content of privacy disclosures.
• Privacy rights of individuals.
• Special treatment for sensitive information.
• Any insights learned from existing comprehensive data privacy and security laws that may be relevant to the working group’s efforts.
• The degree to which U.S. privacy protections are fragmented at the state-level and the costs associated with fragmentation.
• What is the appropriate degree of preemption that a federal comprehensive data privacy and security law should adopt?
• Addressing information security.
• Addressing State level AI frameworks and automated decision making.
• Who should enforce the law?
• If the FTC enforces, what resources and authorities should be made available to it.