New Privacy and Personal Data Acts Introduced in the House and Senate

Key Points

• The Online Privacy Act was introduced in the House of Representatives. If passed, it would establish individual privacy rights related to personal information.
• The Filter Bubble Transparency Act was introduced in the Senate. If passed, greater transparency will be required for platforms that collect data from more than one million users and earn more than $50 million in revenue.

  ---

On Tuesday, November 5, Rep. Anna Eshoo (D-CA), a senior member of the House Energy and Commerce Committee, and Rep. Zoe Lofgren (D-CA), a senior member of the House Judiciary Committee, introduced the Online Privacy Act (see section-by-section summary here). The bill, previously unveiled as a draft in June (see prior alert here), would establish individual rights related to the privacy of personal information, as well as privacy and security requirements, and establish a separate agency to enforce these rights.

In addition, Sens. John Thune (R-SD), Richard Blumenthal (D-CT), Jerry Moran (R-KS), Marsha Blackburn (R-TN) and Mark Warner (D-VA) introduced the Filter Bubble Transparency Act on Friday, November 1. The bill would establish greater transparency requirements for platforms that collect data from more than one million users and earn more than $50 million in revenue each year.

Online Privacy Act

The proposal would notably not preempt state privacy laws and includes the rights of access to user data, correction and deletion. The right of portability, however, is limited to covered entities that lack competition and have more than 10 million users, increased from five million users in the initial draft. To the extent feasible, the user has the right to opt out and the covered entities must provide non-personalized version of services.

The bill would also create a new U.S. Digital Privacy Agency (the “Agency”) modeled after the Consumer Financial Protection Bureau. While the initial proposal authorized the Agency for $200 million, the revised proposal authorizes the Agency for $550 million. The Agency would be staffed with approximately 1,600 staff members.

In terms of enforcement, the measure would allow lawsuits to be brought by the new Agency and state attorneys general. Non-profit organizations active in protecting individual rights with regard to personal data may take the place of an aggrieved individual, and may also seek monetary damages. The bill would also allow individuals to seek injunctive relief.

While the June draft carved out businesses with fewer than 500,000 users, the revised bill carves out only businesses with fewer than 250,000 users. In addition, the preliminary draft established the rights for consumers to opt out of data collection used for personalized content. The revised draft requires covered entities to obtain affirmative opt-in consent when collecting personal information for the purpose of behavioral personalization.

Regarding security requirements, the revised bill does not contain the draft’s provision requiring entities who experienced a breach to notify consumers of the event within 72 hours if the breach is likely to be followed by additional privacy harms. The provision now requires entities to notify individual consumers of a breach within 14 days if it creates or increases foreseeable privacy harms.

Filter Bubble Transparency Act

The legislation would require large platforms to clearly inform users of the use of computer-generated filters, or “secret algorithms,” to determine how information is delivered. In addition, the measure would provide users with the option of navigating between a filter bubble-generated view of their information and a non-filter bubble version.

Without providing users with the aforementioned options, large platforms would be unable to utilize computer-generated filters to determine how users receive information. Regarding enforcement, the bill would authorize the Federal Trade Commission to seek civil penalties for violations.

Contact Information

If you have any questions concerning this alert, please contact: