On Thursday, May 23, the House Energy and Commerce Subcommittee on Innovation, Data and Commerce marked up the updated draft of the American Privacy Rights Act of 2024. The Main Street Privacy Coalition (MSPC), of which NACS is a founding member, sent a letter to the subcommittee expressing concern and opposition to the updated discussion draft.

The coalition noted in the letter that while it appreciates and supports the improvements made to the bill on loyalty and reward programs, it remains concerned about the uneven relationship between covered entities, service providers and third parties that remains in the bill, and the potential liability of enforcement or litigation against businesses.

Almost every industry, including the convenience and fuel retailing industry, handles large volumes of consumer information. The U.S. convenience industry conducts over 160 million transactions each day and sells over 80% of the motor fuels in the country, with more than half of the sales on payment cards.

In the letter, the coalition wrote:

All MSPC member associations firmly believe that consumers across the nation should be empowered to control the data that they have shared with businesses who serve them. We continue to be strong advocates for a preemptive federal data privacy law that creates a single, uniform national standard that applies consistent protections for consumers and obligations for businesses rather than a patchwork of state privacy laws that are confusing and burdensome for consumers and businesses alike. While we appreciate the ARPA’s attempt to establish a federally preemptive framework, we are concerned that the bill as drafted includes far too many carveouts for other relevant state-level privacy laws, consumer protection laws, and laws that govern both employee and biometric data, among others.

NACS believes any federal privacy bill should apply to all industry sectors rather than shifting the requirements onto the retail sector of the economy. A federal law should not pick regulatory winners and losers among different business sectors, nor should it exempt any industry or business. Only by ensuring all businesses are responsible for their own data practices can legislation protect consumers without loopholes.