{"id":16360,"date":"2019-09-19T09:10:04","date_gmt":"2019-09-19T17:10:04","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/09\/19\/news-10101\/"},"modified":"2019-09-19T09:10:04","modified_gmt":"2019-09-19T17:10:04","slug":"news-10101","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/09\/19\/news-10101\/","title":{"rendered":"CEOs offer their own view of a US data privacy law"},"content":{"rendered":"

Credit to Author: David Ruiz| Date: Thu, 19 Sep 2019 15:54:43 +0000<\/strong><\/p>\n

Last week, the chief executives of more than 50 mid- and large-sized companies urged Congress to pass a national data privacy law to regulate how companies collect, use, and share Americans\u2019 data. <\/p>\n

Buried deep within the chief executives\u2019 recommendations for such a law, presented as a policy framework<\/a> for guidance, was a convenient proposal: Private individuals should not be allowed to sue companies if those companies violate the data privacy law itself. <\/p>\n

That idea is just one of a few from the CEOs\u2019 framework that, if included in a federal data privacy law in the United States, would disenfranchise members of the public from asserting their data privacy rights. Other ideas offered by the CEOs include potential pay-for-privacy<\/a> schemes and overriding the large number of state data privacy protections already signed into law in states including Vermont, Nevada, Maine<\/a>, and California<\/a>. <\/p>\n

A representative for the CEO group did not respond to questions sent by Malwarebytes Labs.  <\/p>\n

The involved CEOs are all members of the corporate public policy group \u201cBusiness Roundtable.\u201d They include Amazon\u2019s Jeff Bezos, Comcast\u2019s Brian Roberts, AT&T\u2019s Randall Stephenson, IBM\u2019s Ginni Rometty, Accenture\u2019s Julie Sweet, and Qualcomm\u2019s Steve Mollenkopf, along with the chief executives for Target, Visa, FedEx, Bank of America, and Dell. <\/p>\n

In a letter addressed to the Majority and Minority Leaders of both the US Senate and the House of Representatives<\/a>, the Business Roundtable CEOs urged Congress to pass, \u201cas soon as possible, a comprehensive consumer data privacy law that strengthens protections for consumers and establishes a national privacy framework to enable continued innovation and growth in the digital economy.\u201d<\/p>\n

As the country continues to grapple with how to appropriately codify data privacy into the law, here\u2019s a look at what the Business Roundtable\u2019s framework would allow in terms of data collection, use, and sharing. <\/p>\n

No \u201cprivate right of action\u201d<\/strong><\/h3>\n

The last item on the Business Roundtable\u2019s framework is potentially the most important. The Roundtable does not want any federal data privacy law to include a \u201cprivate right of action.\u201d <\/p>\n

That means that, should this proposal get worked into a national data privacy law, if a company violates that law, you, your neighbor, and your family would not have the right to sue the company. <\/p>\n

This proposal goes directly against what Todd Weaver, founder and CEO of the company Purism, told Malwarebytes earlier this summer, when he described what should be included in a federal data privacy law<\/a>. Without a private right of action, Weaver said, members of the public have no meaningful tools to defend their rights. <\/p>\n

\u201cIf you can\u2019t sue or do anything to go after these companies that are committing these atrocities, where does that leave us?\u201d Weaver said. <\/p>\n

The digital rights organization Electronic Frontier Foundation also supports a private right of action for any national consumer privacy law, as such a right would further enable members of the public to fight back against companies that violate the law. <\/p>\n

\u201cIt is not enough for government to pass laws that protect consumers from corporations that harvest and monetize their personal data. It is also necessary for these laws to have bite, to ensure companies do not ignore them,\u201d wrote EFF Associate Director of Reseach Gennie Gebhart<\/a> and Senior Staff Attorney Adam Schwartz<\/a>. \u201cThe best way to do so is to empower ordinary consumers to bring their own lawsuits against the companies that violate their privacy rights.\u201d<\/p>\n

In lieu of a private right of action, the Business Roundtable proposed that only state Attorneys General should be allowed to file lawsuits against companies on behalf of their state\u2019s residents\u2014a similar scheme visible in the lacking data privacy protections offered to consumers today<\/a>. <\/p>\n

The Business Roundtable also proposed that the US Federal Trade Commission serve as an enforcer, doling out fines to companies that violate the potential privacy law. <\/p>\n

But, following the FTC\u2019s recent slap-on-the-wrist fine issued against Facebook earlier this year<\/a>\u2014a fine that actually caused Facebook shares to increase <\/em>in value\u2014it is difficult to see how and why these enforcement measures would effectively curb would-be privacy violations. For instance, it didn’t stop YouTube from violating COPPA regulations<\/a>. <\/p>\n

Pre-emption of state laws<\/strong><\/h3>\n

The Business Roundtable framework recommends that a national consumer privacy law \u201cshould pre-empt any provision of a statute, regulation, rule, agreement, or equivalent of a state or local government for organizations with respect to the collection, use, or sharing of personal data.\u201d<\/p>\n

Here, the Business Roundtable is asking that Congress pass a national consumer privacy law that tosses aside and in fact overrides the current data privacy laws cropping up across the nation. <\/p>\n

That means recent state efforts to improve residents\u2019 data privacy would be nullified, including California\u2019s landmark privacy law\u2014the California Consumer Privacy Act (CCPA)\u2014Maine\u2019s ISP privacy bill<\/a>, Nevada\u2019s new K-12 student data protection law, and Montana\u2019s recent law to allow residents to opt-out of the sale of their data to third parties. <\/p>\n

Further, legislative efforts in Hawaii, Massachusetts, New York, Pennsylvania, Rhode Island, and Texas, which have all introduced statewide data privacy bills modeled after the CCPA, and similar privacy efforts in Illinois, Minnesota, Connecticut, New Jersey, South Carolina, Louisiana, Oregon, and Washington, could likely be washed away. <\/p>\n

Johnny Ryan, chief policy officer at the privacy-forward browser Brave, told Malwarebytes this summer that he did not support a weak federal data privacy bill that pre-empted state laws. <\/p>\n

\u201cThe federal law should be of equal or higher standard to state laws, and should not undermine state laws,\u201d Ryan said. <\/p>\n

EFF also opposes any national data privacy law that would pre-empt state privacy laws. <\/p>\n

\u201cAvoiding such preemption of state laws is our top priority when reviewing federal privacy bills,\u201d the organization said. It continued: <\/p>\n

\u201cState legislatures have long been known as \u2018laboratories of democracy<\/a>\u2019 and they are serving that role now for data privacy protections. In addition to passing strong laws, state legislation also allows for a more dynamic dialogue as technology and social norms continue to change.\u201d<\/p>\n

Privacy opt-in consequences<\/strong><\/h3>\n

The Business Roundtable\u2019s national consumer privacy law framework includes recommendations for what rights should be afforded to the public. The individual rights include \u201ctransparency,\u201d \u201cconsumer control,\u201d \u201caccess and correction,\u201d and \u201cdeletion.\u201d <\/p>\n

At first blush, these rights mirror many of the rights championed by some of the small, privacy-focused companies we interviewed in July. Upon closer inspection, though, the Business Roundtable\u2019s proposed rights leave much to be desired.  <\/p>\n

Under the umbrella term of \u201cconsumer control,\u201d the Business Roundtable framework explains that consumers \u201cshould have opportunities to exert reasonable control with regard to the collection, use, and sharing of personal data.\u201d <\/p>\n

That\u2019s good!<\/p>\n

The framework then goes on to say that \u201cconsumers should understand under what circumstances their decision to opt-out (or not opt-in) may result in the organization no longer providing them certain goods and services (for example, free content).\u201d<\/p>\n

That\u2019s bad. <\/p>\n

This individual consumer right focuses on the wrong issue. It recommends that consumers simply be made aware of unfair treatment and does nothing to address the actual unfair treatment. <\/p>\n

Malwarebytes Labs previously reported on a similar issue in the federal data privacy law introduced by US Senator Ron Wyden of Oregon<\/a>. The Senator\u2019s proposal, for all its positive data protections, also includes a \u201cpay-for-privacy\u201d stipulation, in which companies could literally charge consumers a fee for opting out of data collection and sharing. <\/p>\n

Though it does not include any mention of a fee, the Business Roundtable framework does present a hypothetical in which consumers can face \u201ccircumstances\u201d for opting out of a company\u2019s data collection, and those circumstances can include \u201cno longer providing them certain goods and services.\u201d <\/p>\n

That\u2019s not just bad. It\u2019s wrong. <\/p>\n

Malwarebytes pushed back against pay-for-privacy schemes earlier this year, and we continue our stance against any legislative scheme that would allow companies to punish consumers for choosing to protect their privacy. <\/p>\n

Areas of agreement<\/strong><\/h3>\n

Despite the few areas we covered above, the Business Roundtable framework includes several recommendations that echo others made by smaller companies we interviewed this year when asking them about what should be included in a federal data privacy law. <\/p>\n

For one, the framework asks that any new national data privacy law achieve \u201cglobal interoperability,\u201d which the framework describes as \u201c[supporting] consumer privacy while also respecting and bridging differences between US and foreign privacy regimes.\u201d<\/p>\n

When Malwarebytes spoke with Ryan from Brave, he emphasized the importance of the world\u2019s most famous data privacy law today\u2014the European Union\u2019s General Data Protection Regulation (GDPR)<\/a>. A national US data privacy law, Ryan added, could benefit from being modeled after GDPR. <\/p>\n

\u201cThe standard of protection in a federal privacy law, and the definition of key concepts and tools in it, should therefore be compatible and interoperable with the emerging GDPR de facto standard that is being adopted globally,\u201d Ryan said.  <\/p>\n

The Business Roundtable framework also includes individual rights for consumers to access and correct data collected and stored on them, along with the right for consumers to require organizations to delete personal data collected on them. <\/p>\n

Weaver, the CEO at Purism, spoke of similar concepts when describing a \u201cdigital bill of rights” that he would like to see codified into US law. <\/p>\n

Purism\u2019s implementation and interpretation of these concepts, however, goes much further, with recommendations that any federal data privacy law include a consumer right to change providers, a right to protect personal data\u2014including the right to \u201cown and control\u201d the master keys to encrypt their data\u2014and the right to not be tracked. <\/p>\n

What\u2019s next? <\/strong><\/h3>\n

The Business Roundtable\u2019s consumer privacy law framework is just the latest proposal for what data privacy should look like in the future US legal landscape. It is surrounded by other proposals, like the draft bill written by Center for Democracy and Technology<\/a>, the current data privacy laws being considered in several states, and the no-less-than six data privacy bills introduced by US Senators<\/a> this year.<\/p>\n

Further, while the Business Roundtable may count some of the largest, most revenue-driving, marquee corporations in America as members, when it comes to data privacy legislation, big money does not always mean big success. <\/p>\n

Earlier this year, the technology industry lobbying group TechNet, which includes some of the exact same companies as Business Roundtable members (Amazon, AT&T, Comcast, Dell, General Motors, Visa, and Accenture), failed to convince California lawmakers to pass two bills<\/a> that would have weakened the CCPA before it goes into effect on January 1, 2020. <\/p>\n

On September 13, TechNet released a statement<\/a> by Executive Director Courtney Jensen about the fate of California\u2019s data privacy law. In the statement, Jensen sounded like she was asking for pre-emption: <\/p>\n

\u201cWhile we hope the rulemaking process will allow for additional improvements [to CCPA], the importance of federal action to avoid a patchwork of privacy laws has never been clearer, and we urge Congress to act,\u201d Jensen said. <\/p>\n

A quick look at the US Senate\u2019s upcoming calendar shows a different reality: No scheduled votes on data privacy. No scheduled hearings on any of the six current, submitted bills. <\/p>\n

Instead, individual US states continue to press forward. <\/p>\n

The post CEOs offer their own view of a US data privacy law<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: David Ruiz| Date: Thu, 19 Sep 2019 15:54:43 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Should this proposed privacy law come into effect, if a company violates that law, you, your neighbor, and your family do not have the right to sue them. <\/p>\n

Categories: <\/p>\n