This afternoon, the White House unveiled a discussion draft of its long-awaited privacy “bill of rights,” which aims to give consumers more control over data that is collected about them.
Consumer advocates have urged the Obama administration to propose legislation since at least 2012, when the White House issued a report endorsing the view that companies shouldn't collect more data than they need. But the bill unveiled today clearly disappointed many privacy advocates, who say it is filled with loopholes.
The “Consumer Privacy Bill of Rights Act of 2015” would require companies that collect data from consumers to notify people about the information gathered, and allow them to wield limited control over that data.
Specifically, the 23-page proposed bill requires companies to give consumers “reasonable means to control the processing of personal data about them in proportion to the privacy risk to the individual and consistent with context.”
The measure would apply to data that has long been considered personally identifiable, like names and addresses, and to information that marketers consider anonymous, like device identifiers and cookies.
The draft bill broadly directs companies to limit data collection and use to “a manner that is reasonable in light of context” -- such as fulfilling an individual's request for a service or product. But the measure also allows companies to use data even in ways that are “not reasonable in light of context” if they go through certain hoops, like conducting a “privacy risk analysis.”
The proposal empowers the Federal Trade Commission to bring enforcement actions against companies that violate the privacy rules, while also giving companies a “safe harbor” defense if they participate in a self-regulatory program approved by the FTC.
The Center for Democracy & Technology was among the critics who denounced the bill today.
“Unfortunately, the President’s bill falls short on the privacy protections needed in today’s digital world: it just has too many loopholes and doesn't provide for meaningful enforcement,” Justin Brookman, director of consumer privacy at the organization, said in a statement. He added that the group will work with Congress and the administration “to improve this initial draft.”
John M. Simpson, head of Consumer Watchdog’s privacy project, added that the bill gives too much power to the industry, which will play a big role in developing self-regulatory codes. “The bill is full of loopholes and gives consumers no meaningful control of their data,” he said in a statement.
Sen. Ed Markey (D-Mass.), who says he plans to introduce his own bill, also expressed concern that the White House measure gives too much power to the industry. “Instead of codes of conduct developed by industries that have historically been opposed to strong privacy measures, we need uniform and legally-enforceable rules that companies must abide by and consumers can rely upon,” he said in a statement.
At the same time, the ad industry also doesn't appear happy about the proposed “bill of rights.” Interactive Advertising Bureau general counsel Mike Zaneis said in a column in The Hill that there's no need for new legislation. “Existing laws do an excellent job of addressing targeted areas where misuse of data could cause identifiable harms to consumers,” he wrote. “Pursuing a privacy bill in an attempt to prevent theoretical harms is sure to put a deep chill on the creators, designers, and innovators the president called 'the pioneers of this Information Age.'”
The Privacy Bill of Rights highlights some key issues but falls short in addressing the core privacy issues undermining consumer trust and the long-term vitality of the internet. The Online Trust Alliance looks forward to a dialog with the White House, FTC and members of Congress to build on this draft.