Democrats' new online privacy bill heralded as chance to build 'alternative road to a digital future'

"This legislation is a game-changer," says Harvard professor Shoshana Zuboff, whose latest book warns of "surveillance capitalism."

Backed by progressive privacy advocates, a pair of California House Democrats who represent Silicon Valley introduced sweeping legislation on Tuesday that aims to strengthen online user protections and increase accountability for major technology companies—in part by creating a new federal agency.

"Our legislation ensures that every American has control over their own data, companies are held accountable, and the government provides tough but fair oversight."

—Rep. Anna Eshoo

The Online Privacy Act of 2019, H.R. 4978 (pdf), is sponsored by Reps. Anna Eshoo and Zoe Lofgren.

"Our country urgently needs a legal framework to protect consumers from the ever-growing data-collection and data-sharing industries that make billions annually off Americans' personal information," said Lofgren. "The Online Privacy Act creates a robust framework that balances the actual needs of businesses with fair privacy rights and expectations for users."

The new legislation is now ranked #1 by Electronic Privacy Information Center (EPIC) among all the privacy bills currently pending in Congress.

"The bill by Reps. Eshoo and Lofgren sets out strong rights for Internet users, promotes innovation, and establishes a Data Protection Agency," said EPIC policy director Caitriona Fitzgerald. "This is the bill that Congress should enact."

Specifically, as a joint statement from the congresswomen detailed, the bill "protects individuals, encourages innovation, and restores trust in technology companies" by doing the following:

• Creating User Rights – The bill grants every American the right to access, correct, or delete their data. It also creates new rights, like the right to impermanence, which lets users decide how long companies can keep their data.
• Placing Clear Obligations on Companies – The bill minimizes the amount of data companies collect, process, disclose, and maintain, and bars companies from using data in discriminatory ways. Additionally, companies must receive consent from users in plain, simple language.
• Establishing a Digital Privacy Agency (DPA) – The bill establishes an independent agency led by a director that's appointed by the president and confirmed by the Senate for a five-year term. The DPA will enforce privacy protections and investigate abuses.
• Strengthening Enforcement – The bill empowers state attorneys general to enforce violations of the bill and allows individuals to appoint nonprofits to represent them in private class action lawsuits.

"Every American is vulnerable to privacy violations with few tools to defend themselves," said Eshoo. "Our legislation ensures that every American has control over their own data, companies are held accountable, and the government provides tough but fair oversight."

According to a fact sheet (pdf) from the sponsors, the bill also includes protections for journalists and creates an Open Source Machine Learning Training Data Grant Program.

"This legislation helps to define a new era in our nation and around the world as citizens seek an alternative road to a digital future, one that is compatible with the rights of individuals and the aspirations of a democratic society."

—Shoshana Zuboff, professor and author

Shoshana Zuboff, professor emerita at Harvard Business School and author of The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power, welcomed Eshoo and Lofgren's proposal, calling it "a significant milestone as lawmakers around the world take critical aim at the surveillance-based economics that now dominate the Internet."

"This legislation is a game-changer in several key ways," Zuboff said in the lawmakers' statement. "First, it reframes the privacy debate from the notoriously flawed regime of 'notice and consent' to the human rights of users."

"Also, the act establishes a long overdue Digital Privacy Agency with important new investigatory, legal, and law enforcement powers," she explained. "This legislation helps to define a new era in our nation and around the world as citizens seek an alternative road to a digital future, one that is compatible with the rights of individuals and the aspirations of a democratic society."

Free Press Action senior policy counsel Gaurav Laroia declared Tuesday that the bill "marks a major moment in the ongoing legislative debate around consumer privacy."

"Misuses of private information chill free expression, cause reputational harms, inflict harmful price discrimination, and create other adverse impacts to people's civil rights," Laroia added in a statement. "Many of these data practices have disproportionate impacts on people of color, women, the LGBTQ+ community, immigrants, religious minorities, and other marginalized groups."

"It's far past time," Laroia concluded, "for the United States to adopt privacy regulations that protect people's rights and give individuals—not corporations—control over how personal data is used."