Privacy proposals come with tradeoffs, report says

As lawmakers mull privacy legislation, they should examine whether restrictions on companies might limit consumer choice. That’s the guidance in a report by the Congressional Research Service, a division of the Library of Congress.

The report notes if Congress accedes to the wishes of some privacy advocates and bans the collection of consumer data, it would “provide the highest level of consumer data protection but could also prevent some operators from providing their services or degrade the quality of their services.”

Restricting targeted advertising might protect consumers but might result in a revenue loss for companies, and they might react by charging users for app access, CRS wrote.

If lawmakers set up a “privacy by default” regime, that would provide less protection to consumers than a proposal of the Biden administration mandating that companies allow consumers to “opt out.” And if some consumers take that option, it might incentivize companies to improve their services and data protection practices, the report predicts.

The report doesn’t take a position on the merits of any one bill.

The legislation with the most momentum, the American Data Privacy and Protection Act, borrows principles from the EU’s General Data Protection Regulation regarding users’ rights over their data, such as access, correction, deletion and data portability.

Only residents of a few states, including California, Virginia, Colorado, Connecticut and Utah, already have those rights. ADPPA mandates privacy officers for companies considered “large data holders” and establishes an oversight bureau in the Federal Trade Commission that would rival some leading data protection authorities in Ireland, France and the UK in terms of resources and responsibilities.

The bill has passed the House Energy and Commerce Committee with bipartisan support, but it faces long odds because House Speaker Nancy Pelosi says it would supersede stronger state laws, such as the one in her home state of California. Even if the House passes the measure, it will face rough going in the Senate where Commerce Committee Chair Maria Cantwell contends it’s not strong enough.

The Washington Democrat has been circulating a bill that has some similarities to the House bill but provides whistleblower protections. It doesn’t include a safe harbor provision that would permit companies to work with approved third parties to have their privacy practices deemed as compliant. But the bill allows the FTC to seek civil penalties on its own and not just in partnership with the Department of Justice.

The FTC isn’t waiting for Congress to act. In August, the agency issued a notice of proposed rulemaking seeking input on topics such as lax data security and online harms to children. “Dark patterns” found on apps and websites that coerce consumers into making bad choices about privacy are also on the short list.