Senator Kirsten Gillibrand is back with a revised bill that would create a federal data protection agency in the US to oversee consumer privacy. This time, it includes powers to review big tech company mergers.
The Democratic senator from New York introduced the Data Protection Act of 2021 today, a revised and expanded version of an original bill introduced in February 2020.
At its core lies something the US has lacked to date: a federal regulator dedicated to overseeing data privacy. The bill proposes developing an agency that would make its own data privacy rules or enforce those made by Congress across the government and private companies. It would be an executive agency with a director appointed by the president for a five-year term.
Alongside enforcing data protection rules, the agency would also develop model privacy frameworks for businesses, watch for discrimination in the use of automated algorithms, and advise the government on emerging threats like deep fakes.
The proposed law goes beyond its predecessor with several additions. The most notable is the supervision of mergers that involve data aggregators or any merger that involves transferring over 50,000 peoples' data.
The new bill would also include a civil rights office within the data protection agency, which would protect people from discrimination and clearly define terms such as privacy harm and high-risk data practices.
Under the new law, the data protection agency would have more enforcement powers, including the power to issue penalties and fines for violators.
Gillibrand targeted big tech companies in her remarks. They represent a direct threat to privacy and civil rights, she said, describing them as bad actors at the center of a "data privacy crisis."
Today, there are two main routes to hold companies accountable for privacy infractions in the US. The first is via states with strong consumer protection laws, such as California. The second is via the Federal Trade Commission, which Gillibrand called out for failing to act in dozens of cases and enforce its own orders.
-
UK businesses patchy at complying with data privacy rulesNews Companies need clear and well-defined data privacy strategies
-
Data privacy professionals are severely underfunded – and it’s only going to get worseNews European data privacy professionals say they're short of cash, short of skilled staff, and stressed
-
UK cyber experts on red alert after Salt Typhoon attacks on US telcosAnalysis The UK could be next in a spate of state-sponsored attacks on telecoms infrastructure
-
Four years on, how's UK GDPR holding up?News While some SMBs are struggling, most have stepped up to the mark in terms of data governance policies
-
Healthcare data breaches are out of control – here's how the US plans to beef up security standardsNews Changes to HIPAA security rules will require organizations to implement MFA, network segmentation, and more
-
The US could be set to ban TP-Link routersNews US authorities could be lining up the largest equipment proscription since the 2019 ban on Huawei networking infrastructure
-
Multicloud data protection and recoverywhitepaper Data is the lifeblood of every modern business, but what happens when your data is gone?
-
Intelligent data security and managementwhitepaper What will you do when ransomware hits you?
