If the US fails to protect citizens’ data, it will lag behind

[Commentary] While opinions may differ on the soundness of the European approach, it is difficult to dispute that the European Union is currently leading the charge on protecting consumers’ personal information online. Its General Data Protection Regulation (GDPR), which went into effect in May, is setting the standard for data protection. The US only has a small window to get back in the game and influence the shape of global digital privacy norms. To that end, I have drafted legislation to create new transparency and user control requirements for anyone that makes money off consumer data online. My proposal would require any company involved in collecting, storing, processing or otherwise using personal data to provide clear notice of their privacy policies in plain English and ask users to “opt in” before the company uses sensitive private information in ways the customers wouldn’t expect.

Parts of my proposal would bring the US into harmony with GDPR, but it avoids the parts of that regulation that are too government-centred and heavy handed to work in the US. Instead, we focus on the need to share responsibility among companies, consumers and government regulators. The bill also gives the Federal Trade Commission extra powers to protect consumers and set clear rules of the road for companies. Today, people who feel companies have taken advantage of or mishandled sensitive personal information can only complain about it. My bill would make it easier for consumers to take a more active role in protecting their private data from exposure. If companies fail to adjust, the FTC will have a stronger hand to bring them into line. I’m encouraged by the positive feedback my draft has received from technology companies and consumer groups. We will continue to ask for advice to ensure we are getting this right. There will be tough conversations ahead, but I’m confident we’re on the right track.