Data privacy has been a big concern lately given the highly publicized and unauthorized ways that online companies such as Facebook and Amazon have been found to be using personal data. Foreign and U.S. laws, such as the GDPR and the California Consumer Privacy Act, among others, have been passed to protect consumers’ privacy, but many have called for federal legislation on the matter as it is becoming difficult for companies to comply with varying data privacy requirements of multiple jurisdictions. Senator Hawley said “Big tech companies collect incredible amounts of deeply personal, private data from people without giving them the option to meaningfully consent. They have gotten incredibly rich by employing creepy surveillance tactics on their users, but too often the extent of this data extraction is only known after a tech company irresponsibly handles the data and leaks it all over the internet.”
If passed, Senator Hawley’s law would aim to protect the privacy of internet users and would be enforced by the Federal Trade Commission and by State Attorneys Generals. Users would be able to enroll in several ways, including a one-time click in the settings on their browsers or by downloading an app.
Some of the highlights of the Do Not Track Act are that it would give every person the ability to block online companies from collecting any data beyond what is indispensable to their online services, it would make disclosure of individuals’ rights under the Do Not Track Act mandatory by online companies, and it would make it unlawful (i) for data collected to be used to create or contribute to a user’s profile; (ii) to block or impede the ability to send or receive the Do Not Track signal; (iii) for companies to discriminate against individuals who activate the Do Not Track signal; and (iv) for companies to transfer data to other companies when a user activates the Do Not Track signal, unless the first company is an intended intermediary. Moreover, the Do Not Track Act would impose severe penalties for violating its provisions, including a penalty for willful or reckless violations that shall not be less than $100,000 and shall not exceed $1,000 for every user affected by such violations for every day during which the person is in violation of the Act when the Federal Trade Commission brings the action.
TAKEAWAY: The protection of consumers’ personally identifiable information is extremely popular right now. A number of states have started to propose state laws regarding data protection. It remains to be seen if the Do Not Track Act will pass, and if so, if it would affect any state privacy laws. It is also questionable whether the Do Not Track Act would even work given the Do Not Call List’s failure to block unwanted calls. In the meantime, we recommend that companies take a close look at their data collection and storage procedures, their privacy policies and their agreements with consumers to ensure that they are on their way to becoming compliant with any privacy regulations that could affect them.