Privacy Law News: Senate Banking & Commerce Committees, GAO, California Data Dividend

There has been a lot of news on data privacy regulation over the past few days. The Senate Banking Committee came out and said data privacy would be a ‘major focus’ going forward. The Government Accountability Office issued a report recommending that Congress consider a comprehensive federal privacy law. Also, the Senate Commerce Committee will hold a hearing at the end of the month on policy principles for a federal data privacy framework. And the California Governor came out in favor of paying consumers for use of their personal information – a data dividend. We will discuss each one of these in turn:

Senate Banking Committee Solicits Public Feedback on Financial Data Privacy

The heads of the Senate Banking Committee invited public feedback on the collection, use and protection of sensitive information by financial regulators and private companies. In the statement, the Chairman and Ranking Member said: “The collection and use of personally identifiable information will be a major focus of the Banking Committee moving forward.”

There are already a few federal laws regulating the privacy of personal information in the financial industry. For example, the Fair Credit Reporting Act was one of the early privacy laws, applying to the operations of credit reporting agencies. Almost three decades later, Congress passed the Gramm-Leach-Bliley Act (GLBA) to, among other things, regulate the privacy of personal information held by banks.

However, it is evident from the announced major focus that the committee does not consider the laws, developed twenty or more years ago, entirely sufficient. The Equifax data breach in 2017 was one area cited in the announcement. Another area we are aware of is the Treasury Department issued a report last year encouraging the regulation of data sharing to permit innovation between financial institutions and FinTech. At least one study over the past few months has also identified the desire of a large segment of Americans to have better control over their financial data.

Here are the questions that the Senate Banking Committee is looking for feedback on:

1) What could be done through legislation, regulation, or by implementing best practices that would give consumers more control over and enhance the protection of consumer financial data, and ensure that consumers are notified of breaches in a timely and consistent manner?

2) What could be done through legislation, regulation, or by implementing best practices to ensure that financial regulators and private financial companies (including third-parties that share information with financial regulators and private financial companies) provide adequate disclosure to citizens and consumers about the information that is being collected about them and for what purposes?

3) What could be done through legislation, regulation, or by implementing best practices to give citizens and consumers control over how financial regulators and private financial companies (including third-parties that share information with financial regulators and private financial companies) use consumer data?

4) What could be done through legislation, regulation, or by implementing best practices by credit bureaus to protect consumer data and to make sure that information contained in a credit file is accurate?

5) What could be done through legislation, regulation, or by implementing best practices so a consumer can easily identify and exercise control of data that is being (a) collected and shared by data brokers and other firms and (b) used as a factor in establishing a consumer’s eligibility for credit, insurance, employment, or other purposes.

GAO Study Recommends Congress Consider Privacy Law

A recent Government Accountability Office study recommends Congress consider comprehensive legislation on internet privacy to protect consumers. The report was delivered to the Chairman of the House Committee on Energy and Commerce. It is titled, “Internet Privacy: Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility”. As part of the report, the GAO interviewed a broad range of academics, consumer advocacy groups, federal government agencies, former government officials, industry groups, internet content providers and internet service providers. The report also quickly summarizes the past GAO reports on privacy, including reports on the internet of things, vehicle data privacy, information resellers and mobile device location data. Although we will be examining the report in more depth later, here is the link to the PDF report.

After receiving the report, the chair of the House Committee on Energy & Commerce announced that the Consumer Protection and Commerce Subcommittee would hold its first privacy hearing on Tuesday, February 26th. Given the connection to receipt of the report, it seems likely that the hearing will dive into some of the GAO recommendations:

– Federal privacy law with general requirements governing Internet privacy across all sectors.
– Notice and comment rulemaking authority for the overseeing agency or agencies.
– Authority to impose civil penalties for first-time violations.

Senate Commerce Committee Sets Privacy Hearing

Senator Roger Wicker (R-MS), the chair of the Senate Commerce Committee, announced a panel hearing on Wednesday, February 27th, which he said in a statement would be the first step towards bipartisan legislation. The hearing is titled, “Policy Principles for a Federal Data Privacy Framework in the United States.” It will be the first hearing of the Senate Commerce Committee on privacy this term of Congress. The witnesses at the hearing have not yet been announced.

California Governor Floats Data Dividend

California Governor Gavin Newsom pushed for a new data dividend to pay consumers for access to their data in his State of the State address this week. In the speech given at the State Capitol in Sacramento, the Governor said that companies make billions collecting, curating and monetizing personal data. “California’s consumers should also be able to share in the wealth that is created from their data,” he said. Governor Newsom has reportedly directed his staff to develop a proposal around the concept.

The California Governor also applauded the passage of the California Consumer Privacy Act, which was signed into law by his predecessor in office. There is an informational hearing coming up next week in the California State Assembly at the Committee on Privacy and Consumer Protection titled, “Understanding the Rights, Protections and Obligations Established by the California Consumer Privacy Act of 2018: Where should California go from here?” Also, the last of the original six public forums held by the California Attorney General as part of the rulemaking process was concluded yesterday. The seventh and final hearing (added to the schedule in January) will be conducted at Stanford Law School on March 5th.

Other Relevant Posts:

Proposed Senate Privacy Bill of Rights Act Includes Private Right of Action
New Senate Privacy Bill: Own Your Own Data Act Summarized
Summary of Latest Senate Bill to Amend COPPA
New Federal Privacy Bill: Commercial Facial Recognition Privacy Act
New Senate Privacy Bill: Digital Accountability and Transparency to Advance (DATA) Privacy Act

More Resources:

Check out the guide Clarip has written on the California Consumer Privacy Act and contact us to see a demo of the Clarip privacy management platform used by Fortune 500 clients.