Kerry and McCain throw their weight behind privacy bill of rights

Sens. John Kerry (D-Mass.) and John McCain (R-Ariz.) on Tuesday introduced long-awaited legislation that would establish a privacy bill of rights. 

The bipartisan push signals there is increasing momentum in Congress for passing bills that spell out how firms should handle consumers’ personal data.

The unveiling of the Commercial Privacy Bill of Rights Act of 2011 came after months of negotiations between lawmakers, the tech industry and consumer advocacy groups.

The bill tries to strike a balance between protecting consumers from unauthorized tracking and allowing firms the flexibility to offer new services and technologies. Kerry said plenty of companies collect and use consumer data with high ethical standards but “the data deluge is worrying at the same time.”

“Companies can keep your information for as long as they like or sell it without even letting you know. You shouldn’t have to be a computer genius to opt-out of sharing,” Kerry said, adding there are currently no rules to protect consumers’ personal information.

“In short, companies can do whatever they want with our personal information. We have no legal right to tell them to stop.”

The bill includes a number of measures aimed at protecting consumers, such as requiring firms to implement security measures to protect the data they collect. Under the bill, companies must clearly communicate how they gather and use personal information while giving consumers the ability to opt out of any information collection unauthorized by the law. 

The legislation would also require firms to obtain consent before collecting sensitive information such as financial or health records. 

The bill includes a voluntary Safe Harbor provision that Kerry described as a privacy certification run by the Federal Trade Commission. Certified firms would have more flexibility in how they implement the bill’s provisions while others would need to follow the letter of the law. The FTC would be granted enforcement authority to ensure firms comply with the bill’s requirements.

McCain emphasized the importance of Congress passing privacy rules of its own rather than leaving it to the FTC to regulate the area under existing regulations. He warned the FTC might enforce those rules in a way that cripples innovation. 

“This bill would put in place rules to guide the Federal Trade Commission in its ability to ensure the security of personal information while providing businesses more clarity in the Commission’s jurisdiction,” McCain said.

Some consumer advocates had pushed for the creation of a Do Not Track list similar to the Do Not Call list used for telemarketers, but Kerry said the provision would be unnecessary after the implementation of a strong opt-out mechanism for data collection. He signaled he would be open to discussing a Do Not Track amendment to the bill but said including the measure at the outset might have upset the balance of support between industry and consumer advocates.

“We have long advocated for comprehensive federal privacy legislation, which we believe will support business growth, promote innovation and ensure consumer trust in the use of technology,” Microsoft, HP, Intel, and eBay said in a joint statement.

“We appreciate that this legislation is technology neutral and allows for flexibility to adapt to changes in technology. The bill also strikes the appropriate balance by providing businesses with the opportunity to enter into a robust self-regulatory program.”

An official with Consumers Union, the nonprofit publisher of Consumer Reports magazine told The Hill on Tuesday the group will support the bill because they view it as a step forward, though they will likely push for the addition of Do Not Track as the debate begins. 

Verizon also called the bill a good start to privacy discussions.

The ACLU also called the bill a positive first step but said it wants to see Do Not Track added.