I'm one of your constituents, and I'm writing to ask you to oppose the SECURE Data Act (H.R. 8413). I want a real federal privacy law — this bill isn't one.
The problem starts with what the bill would take away. Its broad preemption language would wipe out state privacy laws, including Illinois's biometric privacy statute — the law that forced Clearview AI to stop selling its face surveillance system to private companies — and replace those protections with a weaker national standard. Tens of millions of Americans would have less privacy protection than they do today.
What the bill offers instead is enforcement that exists mostly on paper. There's no private right of action, so an individual whose data is misused couldn't sue. The FTC and state attorneys general are left as the only enforcers, and even they face a 45-day notice-and-cure period before acting — a guaranteed window for violating companies to fix things quietly, with no penalty after they're caught. EPIC points out that in states where attorneys general have sole enforcement authority, actual enforcement is rare. Decades of federal privacy laws, from the Fair Credit Reporting Act to the Video Privacy Protection Act, included private rights of action for a reason.
There's also no data minimization standard, so the basic problem — companies collecting everything about everyone — stays untouched. Behavior is rewarded, not changed: a notice-and-consent framework that obligates nothing, topped off with a safe harbor for companies that follow Commerce Department-approved codes of conduct.
Meanwhile, states like California built real tools people depend on — like the Delete Act's DROP platform for wiping your data from brokers — and this bill would take that away too.
If Congress wants to legislate privacy, follow the model of other federal privacy laws: set a floor, not a ceiling. Allow states to go further. Include a private right of action. Require data minimization. Until then, I'm asking you to vote no on the SECURE Data Act.
Sign Petition
