With House and Senate hearings on data privacy recently concluding, Senator Catherine Cortez Mastro (D-NV) has introduced the Digital Accountability and Transparency to Advance (DATA) Privacy Act. If enacted, the DATA Privacy Act would require companies that collect data on 3,000 or more consumers annually to concisely disclose their data collection and privacy practices, provide “conspicuous” access to a data collection opt-out mechanism, and obtain affirmative opt-in consent before collecting “sensitive” personal information from consumers. The Act would also restrict companies to only collecting consumer data and information if there is a “legitimate business reason for doing so” that conforms to the companies’ “operational purpose” and that does not subject the consumer to unreasonable privacy risk. Companies’ violations of these requirements would be prosecuted by the FTC under the Federal Trade Commission Act’s prohibition on unfair/deceptive business practices and by state attorneys general, who would be permitted to seek civil penalties against first-time offenders (and subsequent offenders).
The DATA Privacy Act has been referred to the Senate Committee on Commerce, Science, and Transportation.
