This past weekend, the House Energy and Commerce Committee introduced the draft of a bill that would force companies to respect user privacy and limit how much private data they can sell. This includes:
- Allowing Americans to opt out of data processing if a company changes their privacy policy, opt out of targeted advertising and access, correct, delete and export the collected data.
- Requiring affirmative express consent before sensitive user data can be transferred to a third party.
- Gives individuals the right to sue bad actors who violate their privacy rights and prevent companies from enforcing mandatory arbitration in cases of substantial privacy harm.
- Prevents companies from using personal information to discriminate against them and requires annual reviews of company algorithms to ensure they don’t put individuals at risk of harm or discrimination.
- Mandates strong data security standards to limit the chances for identity theft or harm and makes company executives take responsibility for ensuring that customer data is protected.
- Authorizes the Federal Trade Commission (FTC), states and consumers to enforce against violations.
The bill will not apply to small businesses that are not selling their customers’ personal information.