USA: Congresswomen propose creation of Digital Privacy Agency with power to enforce privacy rights for users & ensure companies follow the law
On 5 November, 2019, Congresswomen Anna G. Eshoo and Zoe Lofgren introduced the Online Privacy Act of 2019. If passed, this bill would set up a Digital Privacy Agency (DPA), require that companies disclose why they need to collect and process data, not use private communications to target ads or “other invasive purposes,” and obtain consent to disclose or sell personal information, among other provisions. The bill would also enable users to sue companies for data protection violations, edit their data, correct or delete data about themselves, and limit the amount of time companies hold their information.
All components of this story
Author: Jennifer Brody and Estelle Masse, Access Now
"Finally! A U.S. data protection bill we can get behind", 12 November 2019
In terms of protecting data privacy, the Online Privacy Act of 2019 goes far beyond [California's]... Consumer Privacy Act... [and is] more robust than any of the pending federal data privacy bills... Responding to the U.S. Federal Trade Commission's failure to protect our right to privacy, the Eshoo-Lofgren legislation creates a sorely needed U.S. Digital Privacy Agency (DPA), similar in mandate to European Data Protection Agencies... The bill would also provide for the private right of action... enabl[ing] users... to sue companies for data protection violations. This private right of action is an essential component of any strong data privacy bill, as it provides victims recourse when the government fails to act... the Online Privacy Act would empower people to opt in to certain kinds of data collection, correct or delete data about themselves, and limit the amount of time companies hold their information... [T]he bill could have gone further, to limit what public authorities can obtain. Governments that are given free rein can weaponize data just as easily as private companies... [This] legislation... helps reframe the debate in the U.S. by placing our human rights, not companies' bottom line, at the center of the discussion on data privacy.
Author: Lauren Feiner, CNBC
[Democratic Reps. Anna Eshoo and Zoe Lofgren] new bill proposes the creation of the Digital Privacy Agency (DPA) that would have the power to enforce privacy rights for users... "I believe that the FTC lacks the staff, the expertise and the culture to take [this on]." Eshoo said. "This is a monumental task of protecting privacy."... The bill... grants users the right to "access, correct, delete and transfer data about them," and choose for how long a company can keep the data... Users can request "human review of impactful automated decisions." [The bill] requires opt-in consent for users' data to be used for machine learning or artificial intelligence algorithms. It allows individuals to sue for declaratory or injunctive relief, and when not acting collectively, for damages... the bill requires [companies to] disclose why they need to collect and process data, minimize employee and contractor access to user data, not use private communications like email to target ads or "other invasive purposes," obtain consent to disclose or sell personal information, [and] abstain from [misleading] users into providing consent... The bill explicitly provides protections for journalists to "use or disclose personal information for investigative journalism no differently than they do today."... Facebook CEO Mark Zuckerberg has been among the tech leaders urging congressional leaders to move forward on federal regulation.