These are strange times in Washington. Congress, which has spent decades conspicuously showing only the most passing interest in privacy, suddenly is awash in proposed privacy legislation and the calendars in both chambers are crowded with committee hearings on the topic. The unending string of breaches and data-misuse and abuse scandals, coupled with increasing consumer outrage, has apparently combined to accomplish that most difficult of tasks: convincing Congress to act.
But there’s a significant difference between knowing that something must be done and knowing what do. Right now, Congress seems to be stranded somewhere between those two mileposts, and a pair of hearings this week on Capitol Hill did not produce much evidence that is going to change soon.
The good news is that there seems to be a general sentiment in Washington that it’s time to pass a federal privacy law. The various state laws that exist now have laid the groundwork, holding companies accountable for lapses in privacy protection and loss of consumer data, and providing some expectation on the part of consumers that there will be consequences--however fleeting they may be--when these incidents occur. People have become much more conscious of and educated about the ways in which companies collect and use their data in the last few years, and expect that there will be legal and regulatory measures in place to keep those companies from going off the rails. While there is no federal privacy law at the moment, there are several bills at different stages of the legislative process right now, some of which would impose severe fines on companies for violations.
Both the House of Representatives and the Senate held hearings this week to discuss the need for a federal privacy measure, what that could look like, and what it might mean for data collectors as well as consumers. On Wednesday, the Senate Committee on Commerce, Science, and Transportation met to talk about the parameters of a federal policy framework, and members expressed an eagerness to improve the protections for consumers across the board.
“Congress need to develop a uniquely American data privacy framework. It is clear that we need a strong national data privacy law,” said committee Chairman Roger Wicker (R-Miss.).
“I believe that notice and consent are no longer enough,” said Sen. Maria Cantwell (D-Wash.).
"Privacy is a broad concept that involves lots of different elements and shouldn’t be distilled down to just control.”
“The problem with notice and choice models is that they create incentives for companies to both hide the risks in their data practices though manipulative design, vague abstractions, and excessive and complex words while at the same time shifting risk by engineering a system meant to expedite the transfer of rights and relinquishment of protections,” he said.
There was plenty of discussion about what kinds of policies, controls, and incentives don’t work in protecting consumer data privacy, but not much in the way of concrete suggestions for what does work. That’s probably because both the House and Senate hearings were populated mainly by witnesses from advertising and technology industry associations and policy think tanks and neither included an actual privacy officer or practitioner. The committees would benefit from hearing from people who do this on a daily basis and have a clear sense of what actually works rather than falling back on concepts that are known to be insufficient, such as consumer control. As Hartzog pointed out, the idea of control is meaningless without other informative and protective elements to help people make proper decisions.
“The problem with thinking about privacy in terms of control is that it’s treated as though the mere gift of it is privacy in and of itself. In fact, it’s illusory,” he said. “Control ostensibly serves to give people autonomy. Privacy is a broad concept that involves lots of different elements and shouldn’t be distilled down to just control.”
Congress’s interest in meaningful federal data privacy legislation looks to be sincere, but any resulting laws will be diminished and less useful without meaningful input from privacy practitioners and advocates.