The Senate this week held a hearing examining the first comprehensive privacy proposals to come from the leaders of the Senate Committee on Commerce, Science, and Transportation. The bills are likely to set the tone for much-anticipated final legislation safeguarding our privacy rights online.
Neither bill is perfect. But the Consumer Privacy Online Rights Act — introduced by Sen. Maria Cantwell, D-Wash. — offers a strong first step. The bill from Sen. Roger Wicker, R-Miss., the U.S. Consumer Data Privacy Act of 2019, has several glaring deficiencies and should not move forward without significant improvement.
Here’s how the two bills stack up on key issues:
Preserving State-Level Privacy Protections
Sen. Cantwell’s bill preserves the rights of states to pass stronger privacy laws. States have often led the work to protect consumer privacy. While Congress has yet to act, California has passed comprehensive privacy legislation, Illinois has taken steps to safeguard our face and other biometric information, and Maine has limited how internet service providers can collect and use our information. Recognizing the important role states play in protecting our privacy, Sen. Cantwell’s bill makes clear that federal privacy legislation must serve as a floor — not a ceiling — leaving states free to pass laws that provide stronger protections.
By contrast, Sen. Wicker’s draft legislation would completely gut existing state privacy laws and prevent states from passing stronger laws in the future. Companies could use the legislation — if it were to become law — in efforts to gut existing state privacy laws, like the California law, and stop states from putting in place more stringent privacy protections. This would negatively impact states’ ability to protect the privacy rights of their residents.
Strong Enforcement
Mechanisms
As recent settlements
with the Federal Trade Commission have demonstrated, federal fines for
privacy-violating companies are often simply viewed as the cost of doing
business, not a call to change harmful practices. To make privacy protections
meaningful, consumers should be able to sue those companies for damages, and
the FTC should have the authority to levy civil penalties and to set
strong privacy rules.
Sen. Cantwell’s bill offers a strong approach. In addition
to beefing up the authorities and resources of the Federal Trade Commission,
the bill allows private citizens to sue companies who violate their privacy
rights. Recognizing the
difficulty in quantifying the cost of a privacy harm, the bill specifies
the damages available to individuals per violation, and allows for the award of
punitive damages, as appropriate.
Sen. Wicker’s bill provides no such right. Instead, the bill
leaves enforcement entirely to state attorneys general and the FTC, though the
latter has increased authorities. This is simply not enough and is likely to
lead to significantly weak enforcement, stranding people who have been harmed
with no recourse.
Preventing Online
Discrimination
It’s imperative that Congress act to stop discrimination from taking on new life in the 21st century. To that end, Sen. Cantwell’s bill includes provisions that would prohibit the use of data to discriminate in housing, employment, credit, education, or public accommodations, and permits the FTC to enforce the prohibition. In addition, the bill would require data operators to conduct impact assessments to measure potential discrimination stemming from their use of an algorithm. As the bill advances, these provisions should be improved to provide other agencies, like the Consumer Financial Protection Bureau and Department of Housing and Urban Development, the ability to monitor and take enforcement action against companies that violate these provisions.
Sen. Wicker’s bill positively acknowledges that companies’ use of data to discriminate in ways that violate existing anti-discrimination laws is a problem that needs to be addressed. It requires some operators to conduct impact assessments and stipulates that the FTC may refer cases of discrimination to the appropriate state and federal agencies, an authority that the FTC already has in many contexts. This, falls far short of what is needed to prevent discrimination in the online ecosystem and is inferior to the approach in Sen. Cantwell’s bill.
Clear and Strong Data
Usage Rules
Consumers should have control over their data. To that end, both
bills prohibit companies from sharing data without an explicit opt-in for
sensitive data, or opt-out for other types of data. Both also give consumers
the right to access, correct, and request the deletion of their information. Sen.
Cantwell’s bill would even prohibit companies from denying services or charging
someone more if they choose to exercise their privacy rights.
The two bills, however, make an artificial distinction
between sensitive and non-sensitive data, with the former afforded greater
privacy protections. Personal data is personal, which means the value ascribed
to certain data varies by individual. For one person, information about their
race may be deeply sensitive. For another, this information may already be widely
available, yet information about their reading or buying habits may be more
personally revealing. Privacy legislation should afford a high level of
protection to all information without distinction.
We encourage members of Congress to continue working together
to enact legislation that protects our data, preserves state laws that provide
greater protections, and gives people the ability to enforce their privacy
rights. Consumers are counting on it to take action to protect their data.