Blog /Policy Weekly 04 12 24
Privacy push revived – but bipartisan package faces uphill climb

Privacy push revived – but bipartisan package faces uphill climb

Author: The Carta Policy Team
|
Read time:  10 minutes
Published date:  12 April 2024
|
Updated date:  12 April 2024
Federal agencies align to scrutinize competition policies
Request a demo

Topline

  • Privacy push revived – but bipartisan package faces uphill climb

  • Agencies share focus on competition policy

  • Treasury proposes rule to strengthen foreign investment oversight at CFIUS 

  • Takeaways from SEC climate hearing

  • SEC sends enforcement notice to DeFi exchange Uniswap 

Privacy push revived – but bipartisan package faces uphill climb

A new bipartisan, bicameral effort to enact a federal data privacy standard was unveiled this week: the American Privacy Rights Act (APRA) is a discussion draft negotiated by House and Senate chairs of the committees of jurisdiction. The APRA is the successor to the 2022 American Data Privacy Protection Act (ADPPA), which stalled after clashes on key issues eroded support.

  • The familiar: Like its predecessor, APRA would empower consumers to access, adjust, and delete their personal data; require some form of consent for the collection/transfers of certain data; limit the type of data companies can collect; direct the creation of a universal opt-out mechanism to keep individuals’ data from being transferred; and impose transparency and security obligations on data holders (privacy audits, etc.), among other provisions. It does not contain a data breach notification requirement, though it would carry civil rights protections for consumers and outlines an enforcement regime.

  • The new: Resolving a major issue from the last effort, this draft includes a full preemption of state laws. This change was agreed upon after key provisions from the state laws in question—including the California Consumer Protection Act—were added to the package. The APRA now captures a broader group of both “large data holders” subject to its requirements, and a larger swath of “small businesses” are exempt from the legislation. It does not have any language related to a “duty of care,” but individuals could immediately sue companies for alleged violations (there was previously a two-year delay for a private right of action under the ADPPA). 

  • The GLBA issueP Summary materials claim the package would not apply to financial services entities covered by the Gramm-Leach-Bliley Act (GLBA), but the text is nebulous; as written it could impose additional reporting requirements on GLBA-regulated actors. This is kicking off a jurisdictional fight with House Financial Services Chair Patrick McHenry, who advanced his GLBA-focused privacy bill, the Data Privacy Act of 2023, last year.

Why it matters: How a startup or growth-stage company acquires, uses, and secures customer data is increasingly subject to the growing and convoluted patchwork of state (and international) privacy laws. Companies want an appropriate federal standard that preempts the existing patchwork regime. Though aspects of this policy need to be ironed out, this bipartisan legislation establishes a federal standard, creating clarity on operational practices, regulatory requirements, and legal liability.  

What’s next: The bill has support from the chairs of both committees with jurisdiction, but like anything in Congress these days, there are roadblocks. Senate Commerce Ranking Member Ted Cruz has serious reservations with the proposal, ranging from the authority given to the Federal Trade Commission, to the more immediate private right of action. This is progress, but not a foregone conclusion: Lawmakers will need to address policy concerns that will emerge, political roadblocks in an election year, and other competing priorities when there is limited legislative time.

Agencies share focus on competition policy

The Federal Trade Commission (FTC) and the Justice Department’s (DOJ) Antitrust Division met to discuss competition policy and the disparate efforts underway at their agencies and across the federal government. 

  • Merger guidelines: In December, the FTC and DOJ finalized updated merger guidelines that clarify previous frameworks used by the agencies to evaluate—and potentially block—anticompetitive behavior. While the new guidelines are business-model agnostic, they target roll-up strategies common in private equity and clarify that agencies can consider a series of transactions, rather than an individual deal. At the summit this week, the DOJ’s antitrust head Jonathan Kanter explained that the updated guidelines focus on market realities, as U.S. markets have changed considerably over the past 20 years. These guidelines are not binding, but can be persuasive in litigation.   

Why it matters: These guidelines affirm a shift that expands anticompetitive considerations beyond an individual deal, and do so as—and in response to—more investors acquiring multiple businesses in a segment. This is a lever to deter that practice and a pillar regulators will use to bolster litigation when they see such acquisition strategies.

  • HSR filing requirements: Notably, the proposed changes to the Hart-Scott-Rodino Act (HSR) did not come up at the summit this week. In July 2023, the FTC and DOJ proposed changes to the HSR form, which is a premerger reporting requirement. The proposed HSR form rules will require businesses filing for a merger to answer a set of detailed questions informing antitrust authorities about the nature of the deal, the acquisition target, and the rationale for the move. 

Why it matters: The proposed rule would dramatically increase the volume of documents and data to be submitted by parties seeking to merge. The FTC estimates that the burden per filer will quadruple from the current 37 hours per filing to 144 hours under the changes, resulting in an additional $350 million in labor costs. 

What’s next on HSR: There is bipartisan concern from Congress, where the two leading lawmakers on the House Judiciary’s Antitrust Subcommittee convened a staff-only briefing on Monday to inform members about the new merger guidelines as well as the proposed HSR rule. As a result of the meeting, there is speculation that there will be a bipartisan letter of opposition against the HSR rule in the next month.

While there is no timetable for finalizing the HSR rule, regulators at the FTC and DOJ will likely push to get all major rules completed before a deadline (likely to be sometime in May) that would make them eligible for reversal under the Congressional Review Act (CRA) in the next Congress, when Republicans could control both chambers and the presidency.

Treasury proposes rule to strengthen foreign investment oversight at CFIUS

The Biden administration is proposing new rules to enhance scrutiny of foreign investors through the Committee on Foreign Investment in the U.S. (CFIUS), led by the Treasury Department. These changes aim to bolster the government's ability to investigate foreign buyers and penalize companies for withholding information or misleading the board. The proposed rule expands CFIUS's authority by:

  • Increasing the types of information CFIUS can request, 

  • Extending subpoena power to cover third-party companies involved in transactions, and 

  • Broadening the scope for imposing fines on firms that fail to disclose information accurately 

Additionally, the Treasury Department is considering a "reverse CFIUS" mechanism for reviewing U.S. investments in other countries, although this initiative is still in the rulemaking process. 

Comments on the proposed rule are due on May 11.

Why it matters: Notably, the proposed rule expands the amount of information that CFIUS may request in non-notified transactions, which are foreign investments in the United States that are not voluntarily submitted to CFIUS for review. Currently, CFIUS may only request information related to whether CFIUS has jurisdiction. The proposed rule would allow CFIUS to also ask questions related to whether the transaction creates national security risks. Ultimately, this change would allow CFIUS to request a wide swath of information prior to receiving a filing from the parties, which is a sizable change from current procedures and would introduce compliance burden and potential divestment risk for private funds.

Former SEC officials blast climate rule

A former SEC Commissioner and the agency’s former general counsel testified before the House Financial Services Committee on the negative impacts of the SEC’s recently adopted climate change disclosure rule. Here are a few takeaways that could impact the private market ecosystem:

  • Scope 3 disclosures: The SEC’s final rule did not include an explicit Scope 3 disclosure requirement. But companies that have climate-related goals and transition plans will have to provide information to investors on their progress, which will likely require companies to report supply-chain and end-user emissions. This could have indirect impacts on private companies in the supply chain by forcing them to account for and provide emissions reporting to inform reporting company disclosures. 

  • Implementation and compliance costs: Most businesses will need to spend considerable resources to implement the new climate change disclosure reporting mandates. Companies that are planning to go public or are expecting to be acquired by a public company will need to have reporting processes in place to comply with these rules in advance as there is no transition period for most of the requirements. Given the costs and compliance burden, the climate disclosure rules could discourage companies from going public. 

  • Litigation: The SEC’s former general counsel opined there is a strong basis for the courts to strike down the climate disclosure rules in violation of the Administrative Procedures Act, as well as the major questions doctrine. The Fifth Circuit recently struck down the SEC’s stock buyback rules for being “arbitrary and capricious,” and industry has sued to vacate a number of other rules, including the private fund adviser rules, on similar grounds. The judicial branch has traditionally been deferential to regulators but are viewing expansive regulatory actions with more scrutiny. Any further limitations from the could curtail the SEC’s rulemaking authority.

Why it matters: If the rule stands, it will indirectly affect private companies. Even though Scope 3 (the supply chain component) was not included, the practices for many companies with climate-goals will require such reporting from private company partners.  And the growth plans for many private companies—going public or acquisition—will need to contemplate direct reporting. 

SEC sends enforcement notice to DeFi exchange Uniswap 

The CEO of the leading DeFi platform, Uniswap Labs, announced the receipt of an SEC Wells notice—typically a warning sent by the agency prior to the launch of possible formal enforcement actions. 

  • According to Uniswap, the notice focused on the platform acting as an unregistered securities broker and unregistered securities exchange.

  • In response, its Chief Legal Officer publicly stated that they do not believe the Uniswap protocol, web app, and wallet meet the legal definitions of a securities exchange or broker nor do they believe the SEC has the authority or guidance to regulate Uniswap’s products.

What’s next: The impending Uniswap case comes at a time when the crypto industry is wary of the SEC’s continued pursuit of enforcement in the absence of clear guidance. DeFi has also proved to be a particular challenge for financial regulators to wrap their arms around because of the absence of legal entities acting as traditional brokers, banks, or exchanges. A lawsuit between the SEC and Uniswap will carry significant implications on this rapidly growing area of the crypto market.

News to know

  • Schumer holds on tax bill. Senate Majority Leader Chuck Schumer does not plan to put the package on the floor until it has the 60 votes necessary to invoke cloture, and most Republicans are holding strong on demands for revisions. Schumer could change course in the coming weeks and call a vote to force senators to put themselves on record as opposing or supporting the deal, but for now the measure remains in stasis.

  • New stablecoin bill to be released early next week. Sens. Kirsten Gillibrand and Cynthia Lummis are expected to introduce new stablecoin legislation next week. While negotiations are ongoing, the legislation is expected to provide two paths for stablecoin issuers. The first path would allow for both federal and state bank charter depository institutions to become stablecoin issuers after an approval process. The other path would be for nondepository institutions and would give the federal government supervisory authority over the state nonbank institutions while preserving states as the primary functional regulator.

  • OMB completes review of final DOL fiduciary rule. The White House Office of Management and Budget (OMB) has concluded its review of Labor’s final fiduciary rule and could announce the final rule as early as next week. The rule will likely revise the definition of an investment advice fiduciary under ERISA to encompass certain types of advice that are currently not covered by the law.

  • Brown teases bill granting Treasury’s crypto asks. Senate Banking Chair Sherrod Brown said Tuesday he is “hopeful” he can introduce a bill soon that would give the Treasury Department more power to crack down on the use of crypto for illicit financing.

  • Treasury announces applications for new Investing in America Small Business Opportunity Program. The Treasury Department announced the opening of the 60-day application window for the Investing in America Small Business Opportunity Program (SBOP) – a U.S. Treasury competitive grant program funded by the State Small Business Credit Initiative (SSBCI). The program seeks to strengthen small business creation by unlocking access to private capital and critical technical assistance that bolsters the small business support network.

  • Treasury releases stock buyback proposed guidance. The Treasury Department and IRS proposed regulations around how the stock buyback or “repurchase” excise tax will be imposed and administered.

  • IMF releases report on private credit. The report assesses vulnerabilities and potential risks to financial stability in private credit. The chapter identifies important vulnerabilities arising from relatively fragile borrowers, a growing share of semi-liquid investment vehicles, multiple layers of leverage, stale and potentially subjective valuations, and unclear connections between participants.

  • Morgan Stanley’s wealth arm probed by multiple federal regulators. The SEC, bank regulators, and FinCEN are reportedly investigating whether the financial adviser is sufficiently vetting its customers for money-laundering risk.

Upcoming events

Sign up below to receive Carta’s Policy Weekly Brief:

All product names, logos, and brands are property of their respective owners in the U.S. and other countries, and are used for identification purposes only. Use of these names, logos, and brands does not imply affiliation or endorsement. ©2024 eShares Inc., d/b/a Carta Inc. (“Carta”). All rights reserved. Reproduction prohibited.

The Carta Policy Team
Author: The Carta Policy Team
Carta’s Policy Team aims to connect the policymaking community and venture ecosystem to build an ownership economy and advance policies that support private companies, their employees, and their investors.