New Privacy Bill: Senate Democrats Introduce Data Care Act

Senator Brian Schatz (D-HI) and 14 other Senate Democrats have introduced a new privacy bill, called the Data Care Act, into Congress for consideration. In general, the proposed privacy legislation would require websites, apps and online providers to safeguard personal information and stop the misuse of personal data by imposing a fiduciary duty on them similar to the special care required of doctors, lawyers and bankers.

It would accomplish this by creating a duty of care, loyalty and confidentiality around user data. The law would give enforcement power to the Federal Trade Commission and allow states to bring civil enforcement actions (if the FTC did not intervene). The FTC would also be given rulemaking authority to implement the federal privacy law.

The Duty of Care would require covered businesses to reasonably secure individual identifying data and promptly inform users of data breaches that involve sensitive information.

The Duty of Loyalty would prohibit use of individual identifying data in ways that harm users.

The Duty of Confidentiality would extend the duties of care and loyalty to third parties when disclosing, selling, or sharing individual identifying data.

The Data Care Act is co-sponsored by U.S. Senators Brian Schatz (D-HI), Maggie Hassan (D-N.H.), Michael Bennet (D-Colo.), Tammy Duckworth (D-Ill.), Amy Klobuchar (D-Minn.), Patty Murray (D-Wash.), Cory Booker (D-N.J.), Catherine Cortez Masto (D-Nev.), Martin Heinrich (D-N.M.), Ed Markey (D-Mass.), Sherrod Brown (D-Ohio), Tammy Baldwin (D-Wis.), Doug Jones (D-Ala.), Joe Manchin (D-W.Va.), and Dick Durbin (D-Ill.).

A copy of the bill (PDF) is available on Senator Schatz’s website.

We will be exploring the details of the proposed privacy law in the next few weeeks. Senator Schatz has previously said that any new federal privacy law would need to be as strong as the California Consumer Privacy Act (CCPA) to warrant federal preemption. The initial draft does not appear to preempt the California law.

The Center for Democracy & Technology has also released a draft federal privacy bill this week. Here are some of the key provisions from the discussion draft:

It allows individuals to exercise the four major Data Subject Access Rights – the right to access, correct, delete and export data.

It bans the collection of biometric information unless required for the service to be provided.

It requires companies to implement data security and consumer complaint protocols.

It excludes information of employees from the definition of personal information.

The Federal Trade Commission would enforce the proposed law.

It preempts state laws placing requirements on the processing of personal information, such as the California Consumer Privacy Act (CCPA). It exempts a number of laws from the preemption, including HIPAA, GLBA, generally applicable consumer protection laws, and employee privacy rights laws, among others.

It specifies a two year period of implementation before enforcement. This is the same time period that companies were given before enforcement of the European Union’s General Data Protection Regulation (GDPR).

UPDATE:

EFF Letter to Congress Opposes Federal Preemption

The Electronic Frontier Foundation and 15 other organizations sent a joint letter to Congress today opposing federal preemption, which is part of the CDT draft discussion bill and several other proposals. The letter said that preemption “will likely result in [consumers] being worse off than they would be in the absence of federal legislation.”

The letter points to existing privacy protections among the states including the CCPA, the Illinois Biometric Information Privacy Act, the Vermont Data Broker Act, dozens of state laws to protect the privacy of school kids and the data breach legislation of all 50 states.

The organizations favor “federal privacy legislation that ensures a basic level of protection for all individuals,” but will oppose federal legislation preempting state laws.”

Survey Finds Public Favors Federal Privacy Law

A new online survey of 600 US adults conducted in November through Google Consumer Survey found that 72% favor a national data privacy law. The survey also found that 52.1% will not give up their data for any reason – skipping discounts, product samples, priority service or access to company news.

Other Blog Posts on Privacy Bills in the US Senate:

American Data Dissemination Act – Senator Marco Rubio.
Consumer Data Protection Act – Draft by Senator Wyden
Senator Thune Privacy Bill
8 Proposals on Privacy from Draft Senate Policy Paper
Social Media Privacy and Consumer Rights Act introduced into Senate
Senate to Consider CONSENT Act for Enhanced Privacy Protections Online
Do Not Track Kids Act Back in Congress

Contact Clarip Today for Help with CCPA and GPDR

The Clarip team and data privacy software are prepared to help your organization improve its privacy practices. Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo or speak to a member of the Clarip team.

If your challenge right now is CCPA compliance for your California operations, allow us to show you our CCPA software. From consent management software to offer the option to opt-out of the sale of personal data, to a powerful DSAR Portal to facilitate the right to access and delete, Clarip offers enterprise privacy management at an affordable price.

If you are preparing your European operations for GDPR compliance, we can help through our modular GDPR software. Whether you are looking to start the process with GDPR data mapping software, increase automation in your privacy program with DPIA software, or handle ePrivacy with a cookie consent manager, Clarip has the privacy platform that you need to bolster your program.

Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo and speak to a member of the Clarip team.