Testimony of Denise E Zheng Vice President Technology and Innovation Business Roundtable Before the House Energy and Commerce Subcommittee on Consumer Protection and Commerce On “Protecting Consumer Privacy in the Era of Big Data” February 26 2019 Chairwoman Schakowsky Ranking Member McMorris Rogers Members of the Subcommittee thank you for the opportunity to testify My name is Denise Zheng and I serve as the vice president for technology and innovation at Business Roundtable which represents more than 200 Chief Executive Officers CEOs of the largest American companies from all sectors of the economy including technology telecommunications retail banking health manufacturing energy hospitality insurance transportation automotive and other industries Business Roundtable companies operate in virtually every corner of the U S economy and touch virtually every American consumer Our companies process more than $16 trillion in global consumer payments each year service roughly 40 million utilities customers across the country and fly more than 250 million passengers to their destinations each year Business Roundtable companies provide wireless communications and internet services to more than 160 million consumers sponsor nearly 70 million medical insurance memberships and deliver more than 42 million packages every single day Data privacy is a major priority for our member companies especially as every company relies on data and digital platforms to deliver products and services to consumers and conduct dayto-day business operations That is why Business Roundtable CEOs from across industry sectors have come together to call for a federal law that provides a consistent set of consumer privacy protections promotes accountability and fosters innovation and competitiveness Business Roundtable member companies strongly support giving consumers control over how their personally identifiable information is collected used and shared At the same time it is important to remember the value of data in our economy as well as the enormous benefits that data-driven services provide to consumers Data enable companies to deliver more relevant and valuable user experiences to consumers They enable companies to detect and prevent fraud on user accounts and combat cyberattacks They enable greater productivity and cost-savings from manufacturing to transportation and logistics They enable breakthroughs in health and medical research Talk to any economist and he or she will tell you that innovation thrives in stable policy environments where new ideas can be explored and flourish within a well-understood legal and regulatory framework It is in fact because of our stable policy environment that the United States is the top global destination for developing and bringing to market innovative 1 technologies But fragmentation of privacy regulation threatens to undermine that stable environment and is therefore a threat to innovation Federal privacy legislation should build on the strong foundation of U S privacy law and enforcement Congress has enacted privacy laws focused on children and the health care and financial services industries and the Federal Trade Commission has engaged in hundreds of privacy and data security enforcement actions as part of its consumer protection authority However there is no comprehensive federal consumer privacy law In the absence of such a U S federal law foreign governments — from Brussels to Brasilia to Beijing — and select U S states are creating inconsistent approaches to privacy both domestically and abroad The result is a complex and difficult-to-navigate set of privacy regulations that creates inconsistent protections for consumers and undermines innovation in new technologies The issue of privacy is reaching a tipping point Perhaps for the first time in the United States there is widespread agreement among companies across all sectors of the economy government and consumer groups of the need for a comprehensive federal consumer privacy law In December Business Roundtable released a proposal for privacy legislation The Business Roundtable proposal is the product of extensive deliberation with the Chief Privacy Officers of companies and has approval from CEOs across industry sectors Business Roundtable believes that federal privacy legislation must focus on the following important objectives as priorities • Champion Consumer Privacy and Promote Accountability Legislation should include strong protections for personal data that enhance consumer trust and demonstrate U S leadership as a champion for privacy by including clear and comprehensive obligations regarding the collection use and sharing of personal data as well as accountability measures to ensure that those obligations are met • Foster Innovation and Competitiveness Legislation should be technology neutral and take a principles-based approach so organizations can adopt privacy protections that are appropriate to specific risks such as the sensitivity of the data as well as provide for continued innovation and economic competitiveness in a dynamic and constantly evolving technology landscape • Harmonize Privacy Protections Legislation should eliminate fragmentation of privacy protections in the United States by harmonizing approaches to consumer privacy across federal and state jurisdictions through a comprehensive national law that ensures consistent privacy protections and avoids a state-by-state approach that leads to consumer confusion and makes compliance nationwide very challenging 2 • Achieve Global Interoperability Legislation also should facilitate international transfers of personal data and e-commerce It should further promote consumer privacy regimes that are interoperable on a global basis meaning the legislation should support consumer privacy while also respecting and bridging differences between U S and foreign privacy regimes At the heart of the Business Roundtable proposal is a set of core individual rights that we believe consumers should have over their data • The right to transparency regarding a company’s data practices including the types of personal data that a company collects the purposes for which these data are used and whether and for what purposes personal data are disclosed to third parties • The right to exert control over their data based upon the sensitivity of the information including the ability to control whether their data are sold to third parties • The right to access and correct inaccuracies in personal data about them and • The right to delete personal data A federal privacy law should be comprehensive and apply a consistent uniform framework to the collection use and sharing of data across industry sectors Such a law should also recognize that some situations justify exceptions such as to address public health and safety concerns prevent fraud and provide cybersecurity deliver a product or service that the consumer requested or ensure First Amendment rights and protect the rights of other individuals Establishing and protecting these rights also requires consistent and coordinated enforcement to provide accountability and protect consumer privacy rights Absent action by Congress U S companies will be subject not only to a growing confusing set of state government requirements being made across the United States but also to different data protection laws from governments in Europe countries such as Brazil and elsewhere Make no mistake A patchwork of confusing data privacy requirements does not benefit consumers who deserve meaningful understandable and consistent data privacy rights regardless of where they live or where their data may be located The United States must act now to establish a consistent national standard that eliminates fragmentation within our country’s own borders sets clear direction for companies achieves some measure of global interoperability and gives consumers more control over their data Business Roundtable stands ready to work with Members of Congress as well as consumer protection advocates to support the development of federal privacy legislation that enhances privacy and accountability fosters innovation and harmonizes regulations within the United States 3