Online Privacy

Privacy regulation should maximize opportunities for innovation while minimizing specific harms from particular uses. In the United States, there are existing laws regarding use of particularly sensitive data such as financial and certain health information. By responding to how awful actors could specifically abuse our information, this approach helps prevent financial, health, and personal harm.

Policymakers should go after awful actors that are abusing data, not criminalizing otherwise benign tools. Existing uses of our data improve our lives by fighting disease, improving traffic flow, and providing users free and groundbreaking technology. While in the wrong hands, data can harm, discriminate, and exploit, in the right hands, these tools improve our lives. Enforcers can use existing tools to focus on many concerning and already illegal actions. That way improved cybersecurity and consumer education around privacy choices and risks ensure Americans feel safe online.

This application and harm-based approach is why the United States has paved the way for the rest of the world, choosing to go after specific harms in specific industries rather than regulate privacy once across all industries. Based on the success of this approach, innovators have been able to engage in many beneficial uses of data, while regulation responds to those particularly problematic or significantly more likely to result in harm.

Many mainstream websites and digital services let us download our information. Some platforms even help users take that information to a competitor. Microsoft Word can convert to a Google Doc and Google Docs can convert to Microsoft Word.

While data portability empowers users, too much interoperability might sometimes harm them.

Interoperability requires secure services to give third-parties access to your data. Applied poorly, this could allow awful actors to get personal information about you without your consent or knowledge.

“Your information” is not always straightforward and can often overlap with how you interact with others online—like friends’ birthdays, tagged photos posted by others, and algorithmic inferences. In order to best help us protect ourselves online, policy needs clarification for both the companies providing the data and the liability for data that a user has requested to send to another company.

With regards to protecting our kids online, there’s one law to rule them all—the Children’s Online Privacy Protection Act, or COPPA,which applies to children under 13.

COPPA was designed to prevent awful actors from communicating with and grooming our children. The law recognizes the special sensitivity and consent issues associated with children who do not have the full understanding of how their data may be used.

While protecting children’s information is important and may be an appropriate role for regulation, COPPA also has tradeoffs. In some cases, COPPA has likely limited the offering of apps designed to help kids learn, get connected to support, or ask difficult questions to adults and their peers. 

By making development for children fraught with financial and legal pitfalls, COPPA may discourage well-intentioned people from making child-appropriate content or choose to institute a higher age-barrier rather than reach all for whom the app would be beneficial.

Changes to COPPA should consider not only the need to protect children, but also the potential tradeoffs particularly for teenagers.

Data breach notifications ensure we get timely updates on whether our personal information is being kept safe.

When a breach happens, businesses have only a handful of hours to identify how much data was taken, and who has been affected.

But each state has its own rules on what counts as a breach of our personal information or how quickly they need to be notified.

That inconsistency in rules across the country makes it hard for online services to abide by data breach rules so they can best protect users. We need a national standard to ensure all Americans enjoy the same levels of protections.

Private businesses have been working with one another to hold themselves accountable under the eyes of the US government.

Safe harbors and other self-regulatory programs are ways that companies can work together to self-regulate, protect their consumers, and adhere to predetermined codes of conduct. If a company fails to abide by the rules and hurts their users, that company is subject to government enforcement and disciplinary action by the Federal Trade Commission.

There are a variety of different self-regulatory solutions, including the Advertising Self-Regulatory Council, the Digital Advertising Association, and the Student Privacy Pledge.

There is a fundamental difference between “private right of action” and “private right of action with statutory damages.” 

The purpose of our civil law system is to make people whole, not to profit off of someone’s mistakes. Statutory damages would dictate that even if the player wanted to cover all your damages, they could perhaps pay even more because a bureaucrat wants them to.

Usually when a law is passed with statutory damages along and a private right of action, predatory attorneys come out seeking to weaponize victims with little or no harm into a huge attorney pay-day. This results in a series of “gotcha” cases, can financially collapse small startups, and chills innovation simply because monetary damages is not injunctive relief.