Here’s How Congress Should Respond to Facebook/Cambridge Analytica

In the twenty-first century, it is impossible to meaningfully participate in society without sharing our personal information with third parties. Those third parties should have commensurate obligations to protect that personal information. Unfortunately, it has become increasingly clear that too many third parties are failing to live up to this responsibility. It is therefore incumbent on Congress to step in to protect consumers.

1. Notice and Consent: consumers should have a right to know a) what information is being collected and retained about them; b) how long that information is being retained; c) for what purposes that information is being retained; d) whether the retained information is identifiable or anonymized; e) whether and how that information is being used; f) with whom that information is being shared; g) for what purposes that information is being shared; and h) under what rubric that information is being shared (for free, in exchange for compensation, subject to a probable cause warrant, etc.). 
2. Security Standards:  Third parties that are stewards of our personal information should be expected to adhere to the latest, state-of-the art security standards.
3. Meaningful Recourse: When there is unauthorized access to personal information, individuals must be made whole to the greatest extent possible.