On February 27, 2015, the White House proposed legislation to protect consumers' personal data and information that is collected and used by private companies and nonprofits. Federal and state governments and their agencies are not covered by the proposed law.
The proposal, The Consumer Privacy Bill of Rights Act, would require covered entities to provide individuals with notice of their privacy and security practices and allow individuals a reasonable opportunity to review their data, correct it, have it deleted and withdraw consent for its continued use. Private companies, nonprofits or industry trade groups can avoid penalties by obtaining approval from the Federal Trade Commission (FTC) of their procedures and criteria for collecting, maintaining, sharing and using personal data (termed a "code of conduct" in the proposal). The proposal envisions that these codes of conduct can be developed and submitted to the FTC by private industry or trade groups, or initiated by the Department of Commerce with private industry. The proposal envisions that any FTC-approved code of conduct will carry with it a presumption of reasonableness and adherence to such a code will provide a "safe harbor" from penalties. The privacy proposal expressly excludes a private right of action and vests enforcement exclusively with the FTC and the state attorneys general.
It has been widely reported that the driving force behind the proposed law is an effort to address gaps in existing laws, such as the Fair Credit Reporting Act (FCRA) and the Health Information Patient Protection Act (HIPPA) and to push private industry to develop privacy codes of conduct.
The White House proposal, considered a discussion draft, requires Congressional sponsors to be introduced as legislation. It seems unlikely that the proposal in its current form will attract Congressional sponsors given the Republican dominated Congress and the strong criticism from all sides. Some argue that the proposal wrongly relies on self-interested private industry groups to develop the guidelines. Others argue that the proposal does not go far enough because, as Senator Edward Markey said, "it did not provide uniform legally enforceable rules that companies must abide by and consumers can rely upon." Others claim that the proposal added an unnecessary layer of government intervention or actually would reduce privacy protections because the proposal would pre-empt state laws that provide greater protections.
The proposal was announced amid heightened concern about privacy of consumer data and personal information, particularly as used by "consumer profiling companies," also called "data mining" companies. These companies aggregate data about consumers from various sources and assist marketers in targeting consumers by household income, zip codes, social networks or interests, such as music, types of clothing purchases, tobacco use, etc. Targeting consumers by personal interests seems harmless, if annoying. However, the FTC concluded in 2014 that the data also could be used to harm consumers by identifying individuals as a poor insurance or employment risk or an unsuitable candidate for admission to a college or university. Reportedly, Senator Markey also is investigating consumer profiling companies.
The Administration's proposal for The Consumer Privacy Bill of Rights Act should remind companies to continue to monitor both state and federal developments regarding the privacy of individuals' personal data and information. In addition to the White House proposal, numerous states have enacted privacy legislation recently, some of which require a consumer's explicit consent before collecting certain information.
We will continue to follow and report on privacy developments.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
