Congress should consider passing online privacy laws, the non-partisan Government Accountability Office said Wednesday in a new report.
“Recent developments regarding Internet privacy suggest that this is an appropriate time for Congress to consider comprehensive Internet privacy legislation,” the GAO writes in a new 59-page report to the House Energy and Commerce Committee.
The watchdog adds that laws empowering an agency (like the Federal Trade Commission) to craft privacy rules and impose fines for violations “could help enhance the federal government’s ability to protect consumer privacy, provide more certainty in the marketplace as companies innovate and develop new products using consumer data, and provide better assurance to consumers that their privacy will be protected.”
The FTC currently has limited rule-making authority, and isn't usually allowed to fine companies the first time they are prosecuted for violating people's privacy. The report was based on interviews with web companies, advocacy groups, academics, former government officials and others.
The GAO says it was asked to review online privacy after it came to light that President Trump's data consultancy, Cambridge Analytica, was able to obtain data of up to 87 million Facebook users. “This disclosure followed other recent incidents involving the misuse of consumers’ personal information from the Internet, which is used by about three-quarters of Americans.”
For the report, the GAO reviewed privacy enforcement actions by the FTC from July 2008 through June 2018. In that time, the FTC brought 101 cases -- almost all of which resulted in settlements. “In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations,” the GAO writes.
The report comes as lawmakers are gearing up to tackle online privacy. Late last year, Senator Ron Wyden (D-Oregon) floated a proposal to create a national “do not track” regime that would give consumers the right to prevent information about them from being shared or sold by ad-tech companies.
Last year, California passed a state law that gives consumers the right to learn what data is collected about them, and to opt out of the sale of that information. The measure is slated for enforcement in 2020.
Some ad industry groups and tech companies have called for federal lawmakers to pass legislation that would override state laws, like the new California statute. But consumer advocacy groups argue that Congress shouldn't block states from developing privacy standards that may be tougher than federal ones.