00:00Thank you, Warren. Thank you for... I understand that you did, and I'm grateful for that and for all your leadership on this issue.
00:12Nearly a decade ago, California became the first state in the nation to adopt a comprehensive consumer privacy law, the California Consumer Privacy Act.
00:20This was shortly followed by the establishment of the California Privacy Protection Agency, which has served Californians for the last five years by implementing and enforcing the state's privacy laws.
00:32Other states have looked at California in our example and followed our lead, especially as new technologies have emerged, AI, facial recognition, algorithmic targeting, each posing more sophisticated threats to Americans' privacy.
00:45At the end of the day, California has proven you can be the fourth largest economy in the world and be home to the most innovative technology companies on the planet, and you can still protect consumers' fundamental right to privacy.
00:59To this end, I'd like to enter into the record a letter from the California Privacy Protection Agency on the importance of a federal privacy law that creates robust baseline protections
01:09while allowing states like California to continue to continue to adopt stronger protections and respond to the rapidly changing technologies being built in our own backyard.
01:24May that letter be entered in the record?
01:26Of course it will, yes.
01:28Just a procedural.
01:30Yes, thank you.
01:33The horrific political assassinations last month targeting Minnesota lawmakers that I know Rankin Member Klobuchar has already referenced were aided in part by a data broker and website the shooter used to look up politicians' addresses.
01:50A recent investigation also revealed that a data broker owned and operated by at least nine major U.S. airlines secretly sold Americans' information collected through flight records
01:59to U.S. Customs and Border Protection and U.S. Immigration and Customs Enforcement.
02:05Starting on January 1, 2026, 40 million Californians will be able to go to a single web page hosted by the California Privacy Protection Agency
02:14and request that their data be deleted from over 500 data brokers if they choose.
02:20Federal legislation that preempts California's Delete Act without meaningful consideration of state-level protections
02:26could mean that Californians will lose this touch-of-a-button ability to know how their data is being used and have a voice in it.
02:34Mr. Butler, Mr. Levine, how can a federal privacy law include better regulation of data brokers,
02:41including their registration in a central clearinghouse,
02:44and allow Americans to prevent their personal information from being sold to outside entities,
02:49like we have done in California with the soon-to-be-implemented Delete Act?
02:54Thank you, Senator Schiff, for the question.
02:57I think that California really has taken the lead here on tackling the problems of data brokers in this specific context,
03:05and I think both the requirements of registering,
03:09given that the average consumer has no way really to know what data brokers exist
03:14and who might have access to their information,
03:17and also providing a centralized mechanism to allow for deletion of data held by these entities
03:23are really important protections,
03:25especially because this is a massive problem that requires scaled solutions, right?
03:31This isn't a situation where an individual consumer can be expected to go
03:34to every single one of hundreds or thousands of data brokers
03:38and submit individualized requests.
03:40So I think both of those are really important protections that have been developed in California.
03:45Mr. Levine, am I pronouncing your name correctly?
03:48You are. Thank you, Senator.
03:49I fully agree with Mr. Butler on the need for a floor rather than a ceiling,
03:55consistent with other federal privacy laws.
03:57You know, I'll make a quick point.
03:58I started my career at a state attorney general.
04:01In the run-up to the financial crisis,
04:03it was state AGs desperately trying to stop subprime mortgages,
04:08the innovative products of the day,
04:10and it was federal banking regulators cheered on by big banks
04:13that were actively trying to stop them.
04:15So as I hear today big tech companies go around Washington
04:18saying we need to hit delete at all of these important state laws
04:21like the one you referenced, Senator,
04:23I recall that similar conversations two decades ago,
04:26and I recall well what happened in our country as a result.
04:29Two quick points specifically on data brokers.
04:32You know, the first is that we brought a series of enforcement actions
04:34under Chair Kahn at the FTC,
04:36and what we required data brokers to do,
04:38we banned them from sharing sensitive location data,
04:40and we prohibited them from building profiles of consumers
04:43based on sensitive geolocation data.
04:45I think that's a really important precedent.
04:47I think Congress also acted, I think in the last Congress,
04:50I'm going to get this wrong,
04:51Protecting American Data from Foreign Adversaries Act,
04:54PADFA, given the FTC enforcement authority,
04:58I think it's regrettable that six months into this administration
05:01we've not seen a single enforcement action.
05:03I hope that changes.
05:04Madam Chair, do I have time for one more?
05:07Oh, yes.
05:07Okay, thank you.
05:09Over the past few months,
05:11I've led a number of letters along with my colleagues
05:14to the Trump administration in response to alarming reports
05:17that various agency officials have ordered states
05:20to hand over the personal data of millions of Medicaid enrollees,
05:24as well as SNAP recipients and applicants
05:26to the Department of Homeland Security.
05:28These actions are a remarkable departure
05:30from established federal privacy protections
05:32and should alarm everyone.
05:35I've demanded the administration reverse these actions,
05:38which likely violate several federal and state privacy laws,
05:41including the Privacy Act of 1974,
05:44HIPAA, and the Social Security Act.
05:46Mr. Levine, what precedent does it set
05:48when federal agencies under the administration
05:50simply bypass established privacy laws
05:53that have protected Americans for decades
05:55and demand that states hand over
05:58their residents' most sensitive information
06:00with little or no explanation?
06:02And how does this compare to privacy protections
06:05in other democratic nations?
06:07Are we seeing the U.S. now fall behind
06:09international standards for protecting citizens' data?
06:13Thank you, Senator.
06:14I think we have the right standards here,
06:16at least with respect to government.
06:17It's not clear whether government officials
06:19are following them.
06:20And that makes me very worried.
06:21One of my consistent messages as an enforcer
06:24to big tech companies and to everyone
06:26is you need to follow privacy laws,
06:28and if you don't, there are going to be consequences.
06:30And when you have reports,
06:32and I've not verified them myself,
06:33but when you have reports of federal officials
06:35and federal agencies brazenly violating
06:38hard-won privacy protections around federal data
06:41resulting in potential loss of health care,
06:45loss of jobs, loss of housing for Americans,
06:48I think that's deeply disturbing,
06:50and it raises a real question
06:51of how Congress is going to pass a privacy law
06:54to bind the private sector
06:55when the federal government
06:56isn't following its own rules.
06:58So I completely share your concern,
06:59and I hope to see changes in that
07:02from this administration.
07:04And finally, if I could very quickly,
07:06Mr. Butler, you mentioned that there were a list
07:08of other privacy laws
07:10where Congress had set a floor, not a ceiling.
07:14Can you share a few of those with us?
07:16Absolutely, and I'm happy to supplement
07:18the record with that as well, but just to note
07:20that basically every major federal privacy law
07:24sets either a floor or a conflict preemption standard,
07:27and that includes the Electronic Communications Privacy Act,
07:30the Right to Financial Privacy Act,
07:31the Cable Communications Privacy Act,
07:34the Video Privacy Protection Act,
07:35the Employee Polygraph Protection Act,
07:37the Telephone Consumer Protection Act,
07:39the Driver's Privacy Protection Act,
07:41the Gramm-Leach Bylay Act,
07:42and the Fair Credit Reporting Act.
07:44These are not ceiling preemptions.
07:45They don't limit states' abilities to adapt and evolve
07:48and protect their citizens more.
07:51Thank you, Regan Member.
07:52I appreciate it.
07:53Okay, very good.
07:54Well, thank you,
07:56and this is a lot of great testimony.
07:58And this is a lot of great testimony,
07:58and this is a lot of great testimony,
07:58and this is a lot of great testimony,
07:58and this is a lot of great testimony.
07:58Thank you, Regan Member.
07:59Thank you, Regan Member.
07:59Thank you, Regan Member.
07:59Thank you, Regan Member.
08:00Thank you, Regan Member.
08:00Thank you, Regan Member.
08:00Thank you, Regan Member.
08:01Thank you, Regan Member.
08:01Thank you, Regan Member.
08:01Thank you, Regan Member.
08:02Thank you, Regan Member.
08:03Thank you, Regan Member.
08:04Thank you, Regan Member.
08:05Thank you, Regan Member.
08:06Thank you, Regan Member.
08:07Thank you, Regan Member.
08:08Thank you, Regan Member.
08:09Thank you, Regan Member.
08:10Thank you, Regan Member.
Comments