Guest Editorial: There’s hope for federal online privacy legislation

This editorial is from the Washington Post:

A few months ago, every day seemed to bring with it a new technology scandal. Now, each day seems to bring a new policy proposal to fix the problem. Even the companies support action from Congress. The gaps between the proposed solutions so far offer some insight into areas of agreement - and more important, disagreement - that will define the fight to come.

A handful of lawmakers, including Sens. Brian Schatz, D-Hawaii, and Ron Wyden, D-Oregon, introduced bills last session. Sen. Marco Rubio, R-Florida sent his own shot across the bow last week, and Sens. Amy Klobuchar, D-Minnesota, and John Neely Kennedy, R-Louisiana put their 2018 proposal back on the floor soon after. Think tanks and industry groups have produced reports and model legislation. Ambitious bipartisan bills are expected in both the Senate and the House this term, but they may not arrive for some time. The battle now is partly to help shape those bills.

Republicans so far seem determined that any federal framework will pre-empt a California law that companies consider too complicated and burdensome. Democrats might sign on to that - with the caveat that the replacement regulations provide at least as much protection as states already offer. There's room for compromise in figuring out how to provide that protection but also room for controversy.

Democrats and Republicans alike appear encouragingly ready to enshrine affirmative rights for consumers, including the right to access the data a company has on them, the right to correct it, the right to delete it and the right to move it from one firm to another. Hammering out what those rights mean in practice could pose hurdles. But actors on both sides of the debate recognize that they exist, and that is heartening.

The wider rift will arise in determining what companies must do beyond respecting the rights consumers are granted. As we have said before, simply requiring more detailed terms of service and more active agreement to those terms from consumers (which is essentially what the Klobuchar-Kennedy bill does) is not enough. The existing system of increasingly complex consent forms that most of us approve without reading just doesn't work.

Lawmakers could legislate general principles along the lines of those Schatz has outlined prohibiting self-dealing and then allow the Federal Trade Commission or, as privacy groups have suggested, another agency substantial latitude on the particulars.

Alternatively, Congress could get more specific by outlawing outright some types of processing - for example, barring companies from using location information for any purpose except what is necessary for a service to perform its core function. Lawmakers could also mandate even more stringent rules on how companies can share data with third parties.

How much rulemaking authority to give any regulatory agency is likely to spark acrimony; Rubio's proposal, for instance, lets the FTC craft a code only if Congress fails to.

There's always a danger that Congress will replace existing rules with something worse. But many of the proposals that are emerging point to the possibility of a cyberspace with more respect for its inhabitants.

You can send a letter to the editor at letters@pressdemocrat.com