A new senate bill would create a US data protection agency
Europe's data protection laws are some of the strictest in the world, and have long been a thorn in the side of the data-guzzling Silicon Valley tech giants since they colonized vast swathes of the internet.
Two decades later, one Democratic senator wants to bring many of those concepts to the United States.
Sen. Kirsten Gillibrand (D-NY) has published a bill which, if passed, would create a U.S. federal data protection agency designed to protect the privacy of Americans and with the authority to enforce data practices across the country. The bill, which Gillibrand calls the Data Protection Act, will address a "growing data privacy crisis" in the U.S., the senator said.
The U.S. is one of only a few countries without a data protection law (along with Venezuela, Libya, Sudan and Syria). Gillibrand said the U.S. is "vastly behind" other countries on data protection.
Gillibrand said a new data protection agency would "create and meaningfully enforce" data protection and privacy rights federally.
"The data privacy space remains a complete and total Wild West, and that is a huge problem," the senator said.
The bill comes at a time when tech companies are facing increased attention by state and federal regulators over data and privacy practices. Last year, Facebook settled a $5 billion privacy case with the Federal Trade Commission, which critics decried for failing to bring civil charges or levy any meaningful consequences. Months later, Google settled a child privacy case that cost it $170 million - about a day's worth of the search giant's revenue.
Gillibrand pointedly called out Google and Facebook for "making a whole lot of money" from its empires of data, she wrote in a Medium post. Americans "deserve to be in control of your own data," she wrote.
At its heart, the bill would - if signed into law - allow the newly created agency to hear and adjudicate complaints from consumers and declare certain privacy invading tactics as unfair and deceptive. As the government's "referee," the agency would let it take point on federal data protection and privacy matters, such as launching investigations against companies accused of wrongdoing. Gillibrand's bill specifically takes issue with "take-it-or-leave-it" provisions, notably websites that compel a user to "agree" to allowing cookies with no way to opt-out. (TechCrunch's parent company Verizon Media enforces a "consent required" policy for European users under GDPR, though most Americans never see the prompt.)
Through its enforcement arm, the would-be federal agency would also have the power to bring civil action against companies and fine companies of egregious breaches of the law up to $1 million a day, subject to a court's approval. The bill would transfer some authorities from the Federal Trade Commission to the new data protection agency.
Gillibrand's bill lands just a month after California's consumer privacy law took effect, more than a year after it was signed into law. The law extended much of Europe's revised privacy laws, known as GDPR, to the state. But Gillibrand's bill would not affect state laws like California's, her office confirmed in an email.
Privacy groups and experts have already offered positive reviews.
Caitriona Fitzgerald, policy director at the Electronic Privacy Information Center, said the bill is a "bold, ambitious proposal." Other groups, including Color of Change and Consumer Action, praised the effort to establish a federal data protection watchdog.
Michelle Richardson, director of the Privacy and Data Project at the Center for Democracy and Technology, reviewed a summary of the bill.
"The summary seems to leave a lot of discretion to executive branch regulators," said Richardson. "Many of these policy decisions should be made by Congress and written clearly into statute." She warned it could take years to know if the new regime has any meaningful impact on corporate behaviors.
Gillibrand is the only sponsor on the bill. But given the appetite of some lawmakers on both sides of the aisles to crash the Silicon Valley data party, it's likely to pick up bipartisan support in no time.
Whether it makes it to the president's desk without a fight from the tech giants remains to be seen.