Breaking down proposals for privacy legislation: How do they regulate?

Several of the draft bills related to privacy in the 116th Congress present concrete signs of an emerging shift in the underlying model for privacy regulation in the current discussion, from one based on consumer choice to another focused on business behavior in handling data. This paper focuses on this key element of the taxonomy—how proposals reflect this shifting paradigm and how the change affects other aspects of privacy protection.

A change in the paradigm of privacy regulation from consumer choice to business behavior means that law will have to supply these checks. Center for Democracy and Technolgy’s categories of per se, unfair data processing activities is one effort to put certain uses out of bounds, but its draft bill does not touch on collection. No matter where boundaries are drawn, some existing business models and practices are bound to fall outside. That will make for some complex drafting discussions and difficult political choices ahead.