Privacy bill would give FTC actual authority, land lying executives in jail

Sen. Ron Wyden (D-Ore.) would like tech and data companies to mind their own business and get their noses out of yours. To that end, he has introduced a bill that would penalize them, potentially with jail time for executives, for not doing so.

The proposed bill (PDF), actually called the “Mind Your Own Business Act of 2019,” is in many ways an updated version of a discussion draft Wyden published last November.

The draft does not name any company specifically, instead focusing on the general concepts of personal data and company responsibility. That said, Wyden did name names in a statement, and Facebook is clearly front and center on his radar.

“Mark Zuckerberg won’t take Americans’ privacy seriously unless he feels personal consequences,” Wyden said. “A slap on the wrist from the FTC won’t do the job, so under my bill he’d face jail time for lying to the government.”

Not only do companies need to be more transparent and to give consumers more control, Wyden added, but also “corporate executives need to be held personally responsible when they lie about protecting our personal information.”

The proposal zeroes in on a few big challenges. First, consumers are tracked and monetized but do not have an effective way to control that tracking or to even know what’s done with the data collected from them. Second: businesses that siphon up and trade in consumer data have a terrible track record when it comes to securing that data and preventing unauthorized access. And third: the Federal Trade Commission, which is the closest thing we have to a privacy regulatory body, is woefully underpowered and under-resourced for addressing the challenge.

Sen. Wyden’s bill, then, would address those concerns by 1) imposing minimum privacy and security standards for user data, 2) increasing transparency for consumers to access their own data and learn what has been done with it, 3) creating steep penalties for companies that blow it, and 4) expanding the FTC’s authority and resources so that it would be able to enforce those penalties. The bill would allow companies to charge for higher-privacy versions of services, but it would exempt from those fees anyone using a Lifeline subsidy⁠ (a small credit that low-income individuals and families can use to pay for phone or broadband services)⁠. This would be a gesture against reserving privacy as a luxury good.

Putting someone on the beat

The FTC recently established a small division dedicated to technology enforcement issues, but Wyden’s proposal would beef it up substantially.

FTC chairman Joseph Simons has said several times this year that he feels his agency is hamstrung by its inability to impose stiff penalties for first-time violations of the FTC Act or of the Safeguards Rule, which requires financial institutions to take special care with consumer data.

“The CFPB and the states were able to obtain civil penalties for this massive breach by a major financial institution. The FTC could not,” Simons said in a July press conference explaining the agency’s settlement with Equifax. “Fortunately, other agencies were able to fill in the gap this time. That will not always be the case, which sends the wrong signal regarding deterrence.”

A few days later, when discussing the $5 billion settlement between the FTC and Facebook, Simons again called on Congress for a new bill. “We are a law enforcement agency without the authority to promulgate general privacy regulations,” Simons said at the time. “Our authority in this case comes from a 100-year-old statute that was never intended to deal with privacy issues like the ones that we address today.”

If Sen. Wyden’s bill were to become law, the FTC would gain 175 additional staff members to help enforce data and privacy standards⁠—and the penalties could be steep. A first offense, which currently carries no fine, would cost a company up to 4% of its annual revenue. In the case of the Equifax data breach, for example, that would have been an additional $136 million to the FTC, on top of the existing $500 million agreement.

Corporate officers would also be held personally accountable for their company’s behavior. If a business, such as Facebook or Google, were found to be filing incorrect reports about privacy, executives would be subject to penalties equaling 5% “of the largest amount of annual compensation received during the previous 3-year period,” or $1 million, whichever is greater, and up to 10 years in prison.

That’s just for an “oops.” If those officers were found to have lied intentionally on those reports, the penalties jump up to 25% of compensation or $5 million, whichever is greater, and up to 20 years in prison.

The challenge

Nearly everyone with a stake in the matter, including politicians from both major parties, agree that we in the United States are badly overdue for some kind of update to privacy law and regulation. The questions of what such a law should cover, what it should allow, and who should benefit, however, are contentious at best.

More than 50 of the nation’s largest companies—including Amazon, AT&T, and Comcast, among dozens of others—in September signed onto a letter (PDF) to Congress asking for federal privacy legislation.