A bill introduced by Senator Kirsten Gillibrand last week proposes the creation of the Data Protection Agency, an independent federal agency tasked with defining, arbitrating, and enforcing data privacy laws.
The Data Protection Agency will seek to protect individuals' privacy and limit the collection, disclosure, processing, and misuse of individuals' personal data by covered entities. To this end, the Data Protection Agency will be empowered to collect consumer complaints, conduct investigations, and use a broad range of tools, including civil penalties and injunctive relief, to enforce laws and regulations related to privacy and data protection. The Data Protection Agency will also develop model privacy, data protection, and fair information guidelines for use in the private sector and prohibit "pay-for-privacy" and "take-it-or-leave-it" terms of service.
Certain "high-risk" data practices may be subject to enhanced scrutiny by the Data Protection Agency. These actions include large-scale automatic processing of individual data, processing of biometric or genetic data, and the combination, comparison, or matching of personal data obtained from multiple sources. In particular, the Data Protection Agency will seek to regulate the automated processing of personal data when applied in ways that might limit an individual's access to particular opportunities or benefits or when using the personal data of children and other vulnerable individuals.
The Data Protection Agency will also be responsible for providing active leadership and coordination to the efforts of other federal departments to enforce laws and regulations involving privacy or data protection. Currently, consumer complaints related to data privacy may be filed with the Federal Trade Commission, but the proposed Data Protection Agency would be specifically tasked with collecting and investigating such claims.
Senator Gillibrand's bill is part of a wave of legislation introduced over the past year with the goal of regulating consumer data privacy. Representatives Anna Eshoo and Zoe Lofgren introduced a similar bill to create a federal Digital Privacy Agency in November of last year. The Consumer Online Privacy Rights Act, introduced by Senator Maria Cantwell and Senator Amy Klobuchar also proposed specific data privacy rights for consumers.