• by Wendy Davis  @wendyndavis, December 8, 2017

The recent data breach at Equifax demonstrates that existing laws don't enable consumers to protect their private information, advocacy group Public Knowledge says.

The organization is calling for Congress to pass new laws based on a set of general privacy principles, including the idea that people should be able to control personal information about themselves.

"Consumers should not need to choose between living in 21st century society and keeping private the basic facts about their personal lives and habits," Public Knowledge writes in a paper released Friday. The group adds that current digital privacy law was developed 20 years ago, when policymakers assumed that people who wanted to protect their privacy could avoid the web and live in an "analog world."

"Even then, that premise was highly questionable," Public Knowledge writes. "Now, it is intolerable. We cannot on the one hand say that broadband is an essential service for all Americans, that our children must use electronic textbooks, that our President and public officials will communicate with the public through social media, and still pretend that participation in the digital world is 'voluntary' and therefore we must give up our privacy to participate in our digital society."

Public Knowledge says in the report that it has become "almost impossible" for people to stop data about themselves from being collected online. For example, Public Knowledge says, large web companies can collect data about people even if they take steps to prevent that.

The group discusses a scenario of a consumer who wants to avoid tracking by Google, and therefore doesn't use the Chrome browser, Google search engine, YouTube or Android phones, and also purges her browser of cookies or other tracking software. "Even after devoting her every free minute to avoiding Google, her efforts are likely in vain," Public Knowledge writes. "Some friend -- or even stranger -- may have uploaded her picture to a Google Group. She may send email to someone who has a Gmail account. The advertisements served to her on other websites may report back information of any digital impression. And, if all else fails, Google can supplement any information it wants by going to a data broker."

The group notes that lawmakers have proposed at least 10 separate privacy bills since September 7, when Equifax disclosed that hackers stole data of around 145 million Americans. Public Knowledge isn't backing any specific proposal.

The advocacy group also criticizes a privacy bill that was introduced in May by Rep. Marsha Blackburn (R-Tennessee). That measure would require broadband providers as well as businesses like social networking services and search engines to obtain consumers' opt-in consent before using their online browsing data for ad targeting. The measure, which tasks the Federal Trade Commission with enforcement, would also block state broadband privacy laws.

"Proposals to preempt state jurisdiction ... cannot seriously be considered a benefit to consumers," Public Knowledge writes. "Congress has long recognized the vital role played by the states in consumer protection, both in terms of providing an additional 'cop on the beat' and as leaders in consumer protection."