Congress needs to address consumer data privacy in a responsible and modern manner

In today’s post-industrial economy, you are the product. Data detailing your every move is why 34-year old Mark Zuckerberg is worth $54 billion, and Google co-founder Larry Page is worth $50 billion.
Your data is incredibly valuable, and for the most part, it is not even yours. But use of your personal data is governed by antiquated laws that do not work in the modern economy.  The time has come for Congress to address consumer data privacy in a candid, responsible and modern manner.

The Facebook Cambridge Analytica scandal last year revealed a severe lack of accountability and transparency in the company’s handling of user data. While this individual incident was sufficiently troublesome, consumers have plenty of reasons to question who has access to their data when they provide it to an online entity.

{mosads}Governments domestically and abroad are starting to respond. Last May, the European Union’s General Data Protection Regulation took effect, and a number of states domestically have passed or are considering new data regulations. While these states have undergone important debates and passed laws to address the concerns of their communities, a state-by-state patchwork of laws is simply not an effective means of dealing with an issue of this magnitude. Internet data is unquestionably interstate commerce, and it is the responsibility of Congress to take appropriate action. 

The current structure of most privacy policies that users blindly accept protect tech providers instead of user privacy and data. This is unacceptable, which is why I am introducing the American Data Dissemination (ADD) Act.

My bill uses the Privacy Act of 1974, widely considered one of the seminal pieces of privacy law in effect today, as its framework. The Privacy Act came in response to Watergate because Congress was concerned with government’s increasing use of computers to store and retrieve personal data. Today, we face a similar crisis, but it involves private industry, and their use and dissemination of our data.

It is important Congress legislate the new rules of the road, but we should use the non-partisan expertise from the agency of jurisdiction to ensure lawmakers make informed decisions to properly protect consumers. My bill requires the Federal Trade Commission (FTC) to provide Congress with detailed privacy requirements within six months that would be substantially similar to the requirements under the 1974 Privacy Act. I believe that these recommendations will give Congress the direction needed to draft legislation that will effectively protect both consumers and the innovative capabilities of our internet economy. These recommendations would incorporate many of the same principles from the Privacy Act and provide overdue transparency to the use of our data. 

However, my bill also takes important precautions to ensure it does not entrench large, incumbent corporations. Facebook, Apple, Amazon, Netflix, Google (FAANG) and others would welcome cumbersome regulations that prevent start-ups and smaller competitors from challenging the FAANG’s current dominance. We should be cautious in balancing the legitimate privacy needs of individuals with the important contributions the Internet has made to increase our societal knowledge sharing capabilities. While we may have disagreements on the best path forward, no one believes a privacy law that only bolsters the largest companies with the resources to comply and stifles our start-up marketplace is the right approach.

Any national privacy law must provide clear, consistent protections that both consumers and companies can understand, and the FTC can enforce. That is why my bill leans heavily on the Privacy Act framework. However, we also cannot tolerate inaction. If Congress does not act on the FTC’s recommendations within two years, my bill gives the FTC authority to issue a final rulemaking based on the Privacy Act framework. I am confident that my colleagues will be able to act within this timeframe, but if we are not I am comforted that the FTC would have a narrow, congressionally mandated course of action.

Our country is ready for reforms to our national privacy law designed for the privacy challenges of today and tomorrow. Changes that provide consumers with basic rights and increased transparency, but also ensures small businesses can continue to thrive. Tech industry leaders should encourage responsible legislation that provides clear rules for companies to operate under and prevents future scandals. While we may not have a consensus in Congress, we must begin to offer solutions. Because this is the only way we can regain the public’s trust. 

Rubio is the senior senator from Florida.