In recent months, members of Congress have introduced several bills designed to protect consumer privacy, but one senator said he believes most current legislation doesn’t go far enough. This month, Sen. Sherrod Brown has released draft legislation that would prohibit companies from collecting personal data in many cases, allowing them only to collect it when “strictly necessary.” Brown’s Data Accountability and Transparency Act would end the current privacy practices of many online companies in which they get consumers to consent to data collection described in lengthy and rarely read privacy policies.
The proposal has little chance of passing in an election year, especially when several less expansive privacy bills seem to be going nowhere. But the proposal advances the debate when it’s time for a new privacy model, Brown argued.
“Sen. Brown believes this is the first step in moving the privacy debate away from the common notice-and-consent framework and in shifting the responsibility for protecting our data from consumers to corporations,” said a spokeswoman for the Senate Banking Committee, where Brown serves as the senior Democrat. “Consumers should not have to agree to invasive data collection in order to use basic online services.”
Some privacy groups, including the Electronic Privacy Information Center and the Public Interest Research Group, praised Brown’s proposal, saying a major change in privacy regulations is needed. Critics, however, said Brown’s proposal would destroy many online business models.
The proposal would “bankrupt companies and shift priorities to compliance vs. entrepreneurship,” said Ivan Assenov, founder of Michigan software and web development firm Scale Campaign. “This will increase the price tag and slow down the information flow to almost zero.”
The proposal also gives “huge power” to state attorneys general to prosecute companies accused of violating regulations. “And it will eventually be used to outmaneuver competitors,” added Assenov, a long-time developer of compliance software.
Brown’s spokeswoman argued that online business models don’t need massive personal data collection to survive. “Advertising and marketing firms have been profitable for years without invasively collecting data — tech companies can use those models or innovate new ones that protect our privacy,” she said.
Brown’s proposal, in addition to allowing personal data collection only when “strictly necessary,” would also ban the use of facial recognition technology and would create a new data privacy enforcement. It would allow both individuals and state attorneys general to go to court to force companies to comply with the privacy regulations, and it would not preempt stronger state privacy laws. Many Republicans in Congress have opposed a private right to file lawsuits and have demanded preemption of state privacy laws in other privacy regulation efforts.
The proposal’s impact on current business models may be a feature, not a bug, said Yoav Aviram, founder of YourDigitalRights.org, a free service that helps people request organizations to delete their personal data. “If adopted, this regulation would mark the end for many business models, not just for internet companies,” he said. “I think it’s a mistake to see this as a side effect of the new proposal. On the contrary — it’s the main intended consequence.”
There’s now a wide understanding that the current level of personal data collection is “untenable,” Aviram added.
“When tech companies started to collect data, it was done innocently,” he said. “No one could have predicted how lucrative this trade would become, and it took the world a little while to catch up with this realization. When the world did catch up, everyone wanted to be in on it.”
But Brown’s proposal, with its private right of action and lack of state preemption, will be too big of a step for many people in Congress, countered Kevin Coy, privacy group co-chairman at the Arnall Golden Gregory law firm in Washington.
The blanket ban on facial recognition technology is also problematic, Coy said. There’s no “effort to distinguish between beneficial uses of the technology and other use cases that raise mass surveillance and other civil liberties concerns,” he said.
The proposal also appears to prohibit any kind of online advertising that’s targeted to users based on their web searches and other preferences, he said. The proposal will be a “magnet” for class-action lawsuits and huge administrative penalties, he said.
“There is a strong case to be made for national privacy legislation that provides enhanced privacy protections for individuals and clearer, more uniform rules of the road for businesses,” Coy added. “The devil is in the details, of course, and Sen. Brown’s draft bill appears to go too far in a number of respects.”
