Onetime presidential hopeful Sen. Marco Rubio, R-Florida, introduced a data privacy bill for what would be called the American Data Dissemination (ADD) Act seeking pre-emption of existing state laws, which experts say will make it difficult to pass.

If the bill is passed, the Federal Trade Commission will be required to submit a series of recommendations for Congress to enact. Congress will then have two years to enact those recommendations into law. The bill will also provide for consumers to have a greater ability to access their information and have it corrected or, if necessary, deleted. If passed, it would pre-empt all state laws relating to data privacy and cybersecurity. The bill does not list potential punishments for violators of the ADD Act.

Colin Bastable, CEO of cybersecurity company Lucy Security, said the bill is unlikely to go anywhere because of the two years Congress has to pass it once the FTC submits its proposed regulations. Even once it is passed, state attorneys general in states such as California and Illinois, where state laws on data privacy are more stringent, will likely challenge the law in the courts.

“California's current legislation and plans are more onerous than what the federal government is coming up with,” Bastable said.

James Shreve, a partner at Thompson Coburn, said Thursday that one issue he sees with the bill is the issue of pre-emption over state laws, something that tech companies would like to see in a federal data privacy law.

“I think it will be difficult to get a pre-emption bill through the house,” Shreve explained. “The cost of doing so might be a more stringent federal requirement.”

The National Association of Attorneys General declined to comment on Rubio's bill. In 2018, 47 state attorneys general signed a letter to Congress asking that any federal bill on data privacy not pre-empt state laws.

The ADD Act is not the first bill introduced on data privacy in recent history. Right now, it competes with bills introduced by Rep. Hank Johnson, D-Georgia: the Application Privacy, Protection and Security Act of 2018 (H.R. 6547) and the Data Broker Accountability and Transparency Act of 2018 (H.R. 6548). Those bills are companion bills to one introduced by Sen. Edward Markey, D-Massachusetts, S.1815. In November, Sen. Ron Wyden, D-Oregon, introduced draft legislation that would amend the Federal Trade Commission Act. If passed as is, company executives found to have knowingly violated the bill in the wake of a major data breach could face up to 20 years in federal prison.