US lawmakers strike deal on data privacy legislation

WASHINGTON — Two key US lawmakers said on April 7 they struck a deal on draft bipartisan data privacy legislation that would restrict consumer data that technology companies can collect and give Americans the power to prevent selling of personal information or compel its deletion.

The agreement between Democratic Senator Maria Cantwell, who chairs the Commerce Committee, and Representative Cathy McMorris Rodgers, Republican chair of the House Energy and Commerce Committee, would give individuals control over use of their personal information and require disclosure if data has been transferred to foreign adversaries.

Congress has been debating online privacy protections since at least 2019 amid concerns about use of data by social media companies including Meta Platforms' Facebook, Alphabet's Google and ByteDance-owned TikTok, but have been unable to reach agreement.

Aides told reporters on April 7 they hoped to advance legislation soon. Meta, TikTok and Google could not immediately be reached for comment.

In a joint statement, the lawmakers said the plan gives the Federal Trade Commission (FTC) and state attorneys general broad authority to oversee consumer privacy issues and establish "robust enforcement mechanisms to hold violators accountable, including a private right of action for individuals."

The bill does not ban targeted advertising but gives consumers the ability to opt out of it. The FTC would create a new bureau focused on privacy and could issue fines for privacy violations which would also cover telecommunications companies.

In 2019, Facebook agreed to pay a record-breaking US$5 billion (S$6.7 billion) fine to resolve an FTC probe into its privacy practises, triggered by allegations Facebook violated a 2012 consent decree. The FTC now wants to tighten that existing privacy settlement to ban profiting from minors' data and expand curbs on facial-recognition technology.

In 2021, ByteDance agreed to a US$92 million class-action settlement regarding data privacy claims from some US TikTok users. Reuters reported in March that the FTC could soon resolve its investigation into TikTok over allegedly faulty privacy and data security practises.

Google and its YouTube unit in 2019 paid US$170 million in a settlement with the FTC and New York to resolve allegations it broke federal law by collecting personal information about children.

US lawmakers Cantwell and Rodgers added: "This bipartisan, bicameral draft legislation is the best opportunity we've had in decades to establish a national data privacy and security standard that gives people the right to control their personal information."

The measure would allow people to opt out of data processing if a company changes its privacy policy. It requires "affirmative express consent before sensitive data can be transferred to a third party".

Consumers could sue "bad actors who violate their privacy rights — and recover money for damages when they've been harmed" and would stop "companies from using people's personal information to discriminate against them," the statement said.

The bill would require "annual reviews of algorithms to ensure they do not put individuals, including our youth, at risk of harm, including discrimination".

ALSO READ: Google to destroy browsing data to settle consumer privacy lawsuit