A right to be erased? Moran’s bill would establish new data privacy for consumers
Sen. Jerry Moran introduced a sweeping plan Thursday to strengthen data privacy and security for consumers, part of a larger push for tighter regulation of the tech industry at the state and federal level.
The Kansas Republican’s bill would establish a “right to access,” enabling consumers to know whether companies have collected their personal data. It would also provide a “right to accuracy and correction” if data is wrong or incomplete.
Even more importantly, the measure calls for the “right to erasure,” requiring companies to “delete or de-identify the personal data of the individual upon request without undue delay,” according to documents Moran’s office shared with The Star.
“The ability for someone to say that this is not something that can be included in my record… I think that’s a common sense, that’s a typical American, a typical Kansan I want to control what companies have about me,” Moran said in a phone call Thursday afternoon.
The legislation would apply to any businesses or non-profits that collect consumer data and are not already covered by regulations that protect the privacy of health care and banking information. The bill would exempt small businesses from the access and accuracy provisions but still require them to follow the right to erasure.
“This bill differentiates in a number of respects between startup businesses and small businesses and those that are major players in the tech industry,” Moran said.
Ryan Weber, president of the KC Tech Council, said the concept is similar to the right to be forgotten, which exists in the European Union.
“It’s a very important aspect for consumers,” Weber said. “You have the right to say what the future of your data consists.”
The legislation would also require affirmative consent from consumers for collection of personal information and require that companies develop comprehensive data security programs.
Moran’s legislation follows California’s passage of its own data privacy law in 2018. Other states are considering similar measures. His bill is intended to create a federal standard that would supersede the state-level regulations.
Weber, whose group represents tech companies in the Kansas City area and advised Moran’s office on the legislation, said that without a federal standard many start-ups would struggle to comply with a patchwork of state laws, with the costs passed onto consumers.
“It is imperative that there is a federal law. If that does not happen and more states continue to pass their own versions it will force companies out of compliance. Small companies and startup companies in particular,” he said. “No one wants regulation, but the tech industry’s begging for it.”
Moran’s bill comes amid widespread interest from both parties on Capitol Hill to crack down on the tech industry.
Sen. Elizabeth Warren, D-Massachusetts, has called for breaking up the largest tech firms and Sen. Josh Hawley, R-Missouri, has pushed for an array of new regulations.
Moran, who chairs the Senate Commerce subcommittee in charge of consumer protection, has long promised comprehensive data privacy legislation.
His bill is the result of a two-year bipartisan collaboration with Sen. Richard Blumenthal, D-Connecticut. But after the senators’ working group could not reach consensus on some of the language, the measure was introduced only under Moran’s name.
Blumenthal said in the statement that the legislation reflects Moran’s priorities, but he indicated that the two will continue collaborating on the issue as Congress looks to take action this year.
“We always knew these issues would be tough to solve. I appreciate Senator Moran’s collaboration and look forward to continuing the conversation with him and our colleagues,” Blumenthal said.
Moran said that the bill includes many provisions the two senators agree on, but he said they could not find consensus on whether or not individuals should have the right to take private legal action against companies.
Under the version Moran unveiled Thursday, the Federal Trade Commission would take enforcement actions against violators and state attorneys general could bring civil actions on behalf of their state’s citizens in lieu of personal lawsuits rather than allowing personal lawsuits.
Legislation that includes a private right to legal action would be a non-starter for the tech industry, said Carl Szabo, vice president and general counsel of NetChoice, a group which represents Google, Facebook and other tech companies.
“The last thing we need to do is create a cottage industry of privacy trolls looking for gotcha cases against American businesses,” Szabo said.
Szabo called Moran’s bill a good starting point, but he warned that it would give the FTC too much power to define what constitutes personal information. He said the bill “could be massaged into a viable piece of legislation” with more input from the industry.
Moran said he’s worked hard to balance concerns of all stakeholders in crafting the legislation.
“The language that is here has been worked between a Republican and a Democrat and all of it has been vetted by consumer groups, the FTC and the industry,” Moran said.
This story was originally published March 12, 2020 at 5:00 AM.
