Data privacy is a big public concern. Will Congress answer with a law?
-
Dwight A. Weingarten Staff writer
| Washington
Your 鈥渇riends鈥� online? Check. Your shopping habits? Check. Your credit card or other online payment information? Check. Some of America鈥檚 biggest, richest companies are custodians of that data.
American consumers display plenty of ambivalence about this 鈥� showing little reluctance to sign up for no-fee apps and web tools that earn money by using their data for targeting ads.听聽
At the same time, the public is worried 鈥� enough so to heavily support legislation to safeguard online privacy. And a tide of data hacks adds to the urgency. T-Mobile and retailer Neiman Marcus are two of the most recent data-breach targets聽involving millions of customers.听
Why We Wrote This
Ohio resident Amy Krebs knows firsthand about the damage that invasions of privacy can bring. Concerns from people like her are one reason there鈥檚 momentum in Congress for a possible federal law.
Amy Krebs is an Ohio resident who has seen up close how personal data can be compromised. Eight years ago, soon after the Obama administration passed a privacy 鈥渂ill of rights,鈥� a set of voluntary guidelines for companies to follow in order to protect consumers鈥� privacy, she received a phone call from her credit card company. Her name and financial information had been stolen.听
鈥淚 couldn鈥檛 believe that this could happen,鈥� she says. The culprit used Ms. Krebs鈥� information at banks, for credit card purchases 鈥� even for a subscription to the local newspaper.
Now, despite the difficulty of legislating in a highly polarized Congress, the push for a nationwide consumer data privacy law has gained momentum. Privacy experts say a federal law could establish broad new protections for the American people and reconfigure the power dynamic between consumers and companies, which historically have used people鈥檚 information as if it belonged to them. Three states 鈥� California, Virginia, and Colorado 鈥� have now passed data privacy laws that, in effect, say otherwise.听
The International Association of Privacy Professionals
鈥淲e鈥檝e always operated in the U.S. as if the data did not belong to the individual,鈥� says James E. Lee, chief operating officer at the Identity Theft Resource Center. 鈥淪o this is a huge shift that鈥檚 underway.鈥�
Multiple data privacy bills have been proposed in Congress over the past couple of years to clean up the mess, and at least have considered their own legislation.听
Support is bipartisan. 鈥淎mericans deserve to have their data protected,鈥� said Mississippi Republican Sen. Roger Wicker, at a hearing on data privacy聽.听
鈥淚 do think the moment is here,鈥� Democratic Sen. Maria Cantwell of Washington said on Oct. 6.
Rising pressure on Big Tech聽
The push for a law comes as technology companies face criticism on multiple fronts 鈥� the latest example being a whistleblower who appeared on Capitol Hill on Oct. 5, testifying that Facebook has ignored鈥� internal evidence that its content-sharing business models are having harmful effects on users.
A privacy law would address just one of the concerns about Big Tech 鈥� but an important one. Mr. Wicker, the top Republican on the Senate Committee on Commerce, Science, and Transportation, introduced earlier this year. Ms. Cantwell, who now chairs the committee, introduced of her own in 2019.听聽
鈥淭he conversation has become much more sophisticated over the last couple of years, which is helpful,鈥� says Stacey Gray, senior counsel at the Future of Privacy Forum. 鈥淭here鈥檚 room for compromise.鈥�
One point of contention is whether a . Many Democrats prefer letting states pass tougher laws if they want. Another sticking point is whether the bill should include a private right of action for individuals to sue companies that violate the law. Mr. Wicker is wary of this unless the scope is limited.听
But the bills, including those at the state level, 鈥渃ome down to the same basic principles,鈥� says Mr. Lee, of the Identity Theft Resource Center.听
鈥淵ou have the right to know who is collecting information about you, what information is collected, and then depending upon the purpose of that information, you can then request that it be deleted or you can request that it be corrected if it was wrong,鈥� he says.听
Those steps could be a big help for people like Ms. Krebs, who works for a nonprofit community foundation and now runs a to help others who face identity theft.听
She emphasizes, also, the importance of corporations maintaining records that are correct.听
鈥淏efore we can go and talk about privacy laws, either at the federal or the state level,鈥� she says, 鈥渨e need to talk about accuracy.鈥澛�
In her case, fictitious identity-verification data from the criminal denied her access to her own credit reports. She estimates that the criminal used her information at about 80 places.听
When Ms. Krebs got the call about her information being stolen, she didn鈥檛 know what to do. After researching online, she found that very few people had spoken out publicly about identity theft.听
鈥淥ne of the natural responses you have is to be even more hidden because you feel a swell of different emotions,鈥� Ms. Krebs says. She decided to call local police in North Canton, Ohio, and file a report.听
Accessing her credit reports was a next step, but the thief had already changed the reports鈥� confirmation questions with incorrect information.听
鈥淭here needs to be ability for the consumer to challenge information if they find it to be inaccurate,鈥� she says.听
The number of identity theft reports went from about 650,000 in 2019 to over 1.3 million a year later, to data from the Federal Trade Commission, the nation鈥檚 privacy enforcer.听
That may help explain widespread popular support for a federal privacy law, spanning party lines.听
More than 8 in 10 voters said Congress should prioritize privacy legislation, according to an April . That included 86% of Democrats and 81% of Republicans who said Congress should make privacy a 鈥渢op鈥� or 鈥渋mportant but lower鈥� priority in 2021.
Some companies , which had over 500 million users鈥� information posted in a hacking forum, are calling for a federal law instead of a patchwork of state statutes.听
The president, apart from a couple of lines in a July , has been largely silent on the data privacy issue since taking office, but he did a privacy advocate to a seat on the FTC last month.听 聽
鈥淲ithin shouting distance of each other鈥�
Cameron Kerry, who served as acting secretary of the Commerce Department during the Obama administration, says the United States is an outlier as a major economy without a data privacy law.听
鈥淭he key Democratic and Republican bills are within shouting distance of each other,鈥� says Mr. Kerry, now a visiting fellow at The Brookings Institution. 鈥淐ongress should act.鈥�
On Sept. 29, Senator Wicker called for the president to appoint a specific senior staff person in the administration to work with Congress to pass a law this year. And last month, nine Senate Democrats FTC Chair Lina Khan to begin a rule-making process to protect consumer privacy 鈥渋n parallel to congressional efforts to create federal privacy laws.鈥�
Ms. Gray, of the Future of Privacy Forum, says federal legislation could have both visible and invisible benefits. Consumers could see what data of theirs a company holds. And the 鈥渋nvisible鈥� help: The law would call on companies to better secure customer data.听
Data minimization and limitation requirements, similarly, would reduce the amount of data being saved on corporate servers or sold for uses beyond the original reason for collection.听
鈥淭he success of [a new] law, no matter how it comes about, is also going to require individuals to actually utilize the rights that they鈥檙e getting,鈥� says Mr. Lee, 鈥渂ecause if they don鈥檛, then it鈥檚 as if we have no law at all.鈥�
Even eight years later, Ms. Krebs is still dealing with the effects of the theft, despite the culprit being tracked down and charged with a felony through the work of local detectives.
鈥淚t鈥檚 insane the amount of hours that go into this,鈥� she says.
