Internet companies have been enthusiastically gathering user data for years, eager to sell it to third-party brokers, utilize it for targeted advertisements, or even use it to enhance AI models. This extensive data collection has persisted for a long time, often without any stringent legal measures in place to hold companies accountable. Recently, however, House Republicans unveiled a proposed federal privacy bill aimed at significantly changing how major tech firms manage personal and sensitive data.
What is the SECURE Data Act?
Short for “Securing and Establishing Uniform Consumer Rights and Enforcement,” the SECURE Data Act gives individuals more power over how their personal information is accessed and used by companies online. The bill lays out two primary frameworks: one detailing consumer rights and the other placing restrictions on business activities.
Users would have full autonomy over data collection and its monetization.
Consumer Rights Under the SECURE Data Act
Access: Users have the right to know when a company accesses or processes their personal data, as long as it doesn’t conflict with the company’s trade secrets.
- Pros: Users can clearly understand how their data is employed by various services, allowing them to make informed choices about which companies they want to engage with based on their data practices.
- Cons: Companies are likely to incur significant costs and effort in documenting how they handle user data, leading to potential delays in reporting.
Correction: Users may request corrections of any inaccuracies in their personal data, which may pertain to usernames, emails, home addresses, among other identifiers.
- Pros: Ensures that the data held by companies is both accurate and up-to-date, reducing the chance of errors.
- Cons: Companies could leverage this updated info to create more refined user profiles for enhanced tracking online.
Deletion: Users who prefer that companies cease access to their data can ask for the complete removal of their information from company servers.
- Pros: Users regain control over the collection and use of their data, which they can revoke if companies misuse it. It can also serve as a method to protest against companies whose practices contradict users’ beliefs.
- Cons: Businesses might lose essential data that aids them in developing better products and services, possibly leading to stagnation in innovation.
Transferability: User information should be stored in a way that allows for easy export and transfer to other platforms, especially when switching between services or applications.
- Pros: This flexibility enables users to move their data without being tied to a specific platform, which can be particularly handy when switching between devices like iPhones and Androids.
- Cons: Without consistent data protection standards, transferring data could weaken encryption and raise security concerns.
Control: Users retain the right to decline having their personal data sold to third parties or being subjected to targeted ads.
- Pros: This prevents companies and data brokers from building intrusive profiles centered on users’ habits and interests.
- Cons: A decrease in user data might adversely affect the marketing and digital ad sectors economically.
Company Restrictions Under the SECURE Data Act
To ensure consumer rights are respected, businesses must adhere to several key obligations:
Minimize: Companies are limited in their data collection practices and should only gather information deemed appropriate for their operations.
- Pros: This regulation would curb the invasive tracking of user behavior, significantly enhancing user privacy.
- Cons: The vague language of the limits could leave room for interpretation, allowing certain companies, like Google, to justify massive data collection under various pretenses, while others might face stricter restrictions.
Limitations: Data gathered can only be utilized for the specific reason it was collected, and businesses cannot store or repurpose it without consent.
- Pros: This gives users assurance that their data won’t be funneled into undisclosed projects or profit-driven schemes.
- Cons: This could hinder companies from utilizing user data for research and development, potentially slowing innovation.
Discrimination: Data collection based on race, ethnicity, or other identifiable traits is prohibited, along with using such factors to deny goods or services, apply dynamic pricing, or alter service quality.
- Pros: Essentially, companies would no longer penalize users based on their alignment with ideas of diversity and inclusion.
- Cons: The bill doesn’t specifically shield users’ religious beliefs or political views, which might create opportunities for companies to act against those whose values differ.
Education: Companies must inform users about how their data is processed, stored, sold, and used in business operations, giving them options for adjustments based on their rights.
- Pros: This transparency ensures users aren’t left in the dark about how their personal data contributes to company profits.
- Cons: Much like GDPR-compliant cookie notices, users could become overwhelmed by data prompts and might simply accept without reading the specifics.
Sale: Companies must alert users when their data is about to be sold and allow for opting out beforehand.
- Pros: Consumers can ultimately stop companies from profiting off their personal information through sales.
- Cons: If users don’t act before their data is sold, tracking its future use might prove challenging.
Sensitive Data under the SECURE Data Act
The bill also establishes further safeguards for “sensitive data,” particularly regarding minors, requiring parental permission before collecting information about them. Notably, unlike many recent age verification laws, the SECURE Data Act does not mandate users to verify their age. Rather, it places the responsibility on parents to manage their minors’ data.
A win for consumers
For years, internet companies have engaged in extensive data collection with minimal legal oversight. Government action tends to lag behind, but the SECURE Data Act arrives at a critical juncture. With AI firms like OpenAI, Anthropic, and Google aggressively expanding their data-gathering methods, this legislation may provide much-needed protections for users as it seeks to secure their digital identities more robustly.
