New consumer rights guaranteed by strong federal compliance and consumer right to sue 

WASHINGTON Today, U.S. Senator Amy Klobuchar (D-MN) joined Commerce, Science, and Transportation Committee Ranking Member Maria Cantwell (D-WA) and fellow senior members Senators Brian Schatz (D-HI) and Ed Markey (D-MA) in unveiling comprehensive federal online privacy legislation to establish privacy rights, outlaw harmful and deceptive practices, and improve data security safeguards for the record number of American consumers who now shop or conduct business online. With new numbers showing that nearly sixty percent of all holiday spending will be done online—making this the largest online holiday shopping season ever—families everywhere want strong action taken to protect their online privacy and data security.

The Consumer Online Privacy Rights Act (COPRA) gives Americans control over their personal data; prohibits companies from using consumers’ data to harm or deceive them; establishes strict standards for the collection, use, sharing, and protection of consumer data; protects civil rights; and penalizes companies that fail to meet data protection standards. The legislation also codifies the rights of individuals to pursue claims against entities that violate their data privacy rights.

“Companies continue to profit off of the personal data they collect from Americans, but they leave consumers completely in the dark about how their personal information is being used. Consumers have a right to know if their personal data is being sold and to easily see what data has already been distributed,” Klobuchar said. “Our legislation establishes digital rules of the road for companies, ensures that consumers have the right to access and control how their personal data is being used, and gives the Federal Trade Commission and state attorneys general the tools they need to hold big tech companies accountable. It’s time for Congress to pass comprehensive privacy legislation.”

“In the growing online world, consumers deserve two things: privacy rights and a strong law to enforce them,” Cantwell said. “They should be like your Miranda rightsclear as a bell as to what they are and what constitutes a violation.

“When consumers let companies use their personal information they should be able to trust that it will be protected and won’t be used to harm them,” Schatz said.  “Our bill lays out a set of strong data privacy rights for consumers, establishes robust obligations for companies, and gives prosecutors and consumers the tools they need to hold big tech companies accountable.”

“The demand for consumers’ personal information today is at an all-time high,” Markey said. “But while the appetite for our data has skyrocketed in recent years, Americans have not yet been given a set of strong, enforceable rights that protect us from privacy invasions. This bill gives consumers strong privacy protections, including prohibitions on harmful discriminatory uses of our data and strict data security requirements. I look forward to working with my colleagues on the Senate Commerce Committee to enact a comprehensive federal privacy bill, which must include heightened protections for vulnerable populations, like children and teens.”

The full text of the Consumer Online Privacy Rights Act (COPRA) can be found HERE. A one-pager on the legislation can be found HERE. The just-released Commerce Committee report titled The State of Online Privacy and Data Security can be found HERE.

The Consumer Online Privacy Rights Act (COPRA) is supported by consumer and civil rights advocates and privacy experts:

“This is strong legislation that directly goes after companies that build secret profiles about what we do online and off. We appreciate the bill sponsors’ leadership on data privacy, and we look forward to working with Congress to finally pass legislation to protect our personal information. This bill is an important step toward treating privacy as a fundamental right for all Americans,” said Former FTC Commissioner Justin Brookman, Director of Privacy and Technology Policy at Consumer Reports.

“This bill marks an important step forward for Congress. The bill gives consumers the right to regain control of their personal information —whether it is collected, and how it may be used.  The bill not only codifies privacy as a right —a measure long overdue —but it also recognizes that ‘rights’ that are unenforceable are empty gestures. For that reason, the bill not only restores control of personal information to consumers, but equally important, the bill gives consumers and the Federal Trade Commission real tools to hold companies accountable when they collect information without permission, when they fail to reasonably safeguard consumers' information, or when they misuse that information. And the bill is careful to recognize that federal law can coexist with state privacy laws.  Kudos to the bill's sponsors for their willingness to take on the internet giants, put the brakes on the indiscriminate and ubiquitous data collection and restore the ability of consumers to control their personal data,” said Former FTC Director of the Bureau of Consumer Protection David Vladeck, Georgetown University Law Center Professor.

“African Americans and people of color are over indexed as consumers of traditional and social media. As such, our data are uniquely vulnerable to exploitation, including civil liberties abuse, targeted disinformation campaigns designed to suppress the vote, and exclusion from employment, health, educational, and housing opportunities. I commend the bill sponsors for their leadership on the Consumer Online Privacy Rights Act. This legislation is an important first step to ensure accountability from those who hold consumer data and the protection of civil rights in the 21st century. We look forward to working with House and Senate leadership on this bill as it becomes part of comprehensive privacy rights legislation,” said Marc Morial, President and CEO of the National Urban League.

“In today’s online economy, we have seen how the misuse of personal data can exacerbate discrimination in housing, employment, credit, and education. The Consumer Online Privacy Rights Act prioritizes civil rights by ensuring that individuals’ personal data cannot be used for discriminatory purposes and that big data algorithms are assessed for bias,” said the Lawyers' Committee for Civil Rights Under Law.

“The Consumer Online Privacy Rights Act (COPRA) is outstanding. The Consumer Data Rights Act gives consumers meaningful rights, holds companies accountable, and protects stronger state safeguards. EPIC reviewed the bills pending in Congress and has now given the Consumer Data Rights Act an A-. With the addition of a data protection agency, the bill would earn an A and establish a comprehensive approach for privacy protection for the U.S.,” said Electronic Privacy Information Center (EPIC) Policy Director Caitriona Fitzgerald.

Klobuchar has been leading the fight to protect consumers’ online privacy. In January, Klobuchar and Senator John Kennedy (R-LA) introduced the Social Media Privacy and Consumer Rights Act, bipartisan legislation that would protect the privacy of consumers’ online data by improving transparency, strengthening consumers’ recourse options when a breach of data occurs, and ensuring companies are compliant with privacy policies that protect consumers.

Klobuchar and Senator Lisa Murkowski (R-AK) are the authors of the Protecting Personal Health Data Act, bipartisan legislation to protect consumers’ private health data not covered under existing privacy law. While recent reports have highlighted how home DNA testing kits and health data tracking apps have given companies access to unprecedented levels of consumer health data, current law does not adequately address the emerging privacy concerns presented by these new technologies. The Protecting Personal Health Data Act addresses these health privacy concerns by requiring the Secretary of HHS to promulgate regulations for new health technologies such as health apps, wearable devices like Fitbits, and direct-to-consumer genetic testing kits that are not regulated by existing laws. Last week, the senators urged the Department of Health and Human Services to examine a collaboration between Google and Ascension health system that enables Google to collect the personal health information of roughly 50 million Americans—including personally identifiable information, lab results, hospital records, and physician diagnoses—without their knowledge or consent.