Photo: Den Rise/Shutterstock.com

Intel's global privacy chief said Wednesday the company took in three lessons from the European Union's General Data Protection Regulation when writing the latest draft of its Innovative and Ethical Data Use Act of 2019.

David Hoffman, Intel's associate general counsel and global privacy officer, said it is clear that flexibility in different jurisdictions does not work and makes the case for strong preemption of state laws.

“Any approach that tries to provide flexibility in different jurisdictions is a mistake in the way that data is managed now and is unworkable,” Hoffman said. “We need to have strong preemption and we do not need to states to have different requirements.”

The third draft included giving the Federal Trade Commission enforcement power over the federal law. Hoffman said the FTC is apolitical and it has done a “remarkable job” in pursuing its agenda despite its lack of resources.

If a bill similar to this were passed, the FTC would have the authority to levy fines of up to $1 billion and bad actors could face up to 10 years in prison. The harsh punishment, Hoffman said, gets entities to take data privacy seriously, as shown in the GDPR.

“When you have a legal framework that makes strong enforcement possible, people start deploying resources to protect privacy,” Hoffman said.

The bill also grants the FTC authority to “promulgate regulations as authorized by the specific provisions of this Act.”

One of the key aspects that changed from the second draft of the bill to the third is how explicit consent is described. Hoffman explained that the draft bill does not require consent in most situations. It is only required in “risky uses of data” such as health care or trying to determine someone's race.

“We want to encourage entities to get consent and figure out new technological means to get that consent,” Hoffman said.

Where the GDPR fails, Hoffman said, is the law tried to give detail on how to “accomplish privacy principles.”

“That is fraught with the risk of not scaling well to meet changes in new technology,” Hoffman said.

Despite partisan politics and a growing number of states passing their own forms of data privacy bills, Hoffman said he believes there will be a federal data privacy law in the future. He said he believes people are beginning to recognize the prospect of having 50 different laws governing privacy legislation is “unworkable.”

The draft legislation is not being proposed as is to Congress. However, Hoffman said his team has spoken to the several congressional offices about what should go into a federal data privacy bill.