Silicon Valley finally pushes for data privacy laws at Senate hearing

(Via www.theguardian.com) By Dan Tinan It seems Silicon Valley and Congress can finally agree on something after all – the need for data privacy regulation.

On Wednesday, representatives from Amazon, Apple, AT&T, Charter, Google and Twitter appeared before the Senate commerce committee to endorse the notion of new federal data protection laws.

But whether such legislation will come to pass, exactly what it will look like and who it may end up favoring is a long way from being determined.

That Congress is now considering passing privacy legislation after more than a decade of debate and delay is a positive development, says Amie Stepanovich, the US policy manager for digital rights organization Access Now. But with a panel consisting entirely of major internet companies, consumer voices were sorely lacking.

“It’s really good that we’re seriously considering data protection in the United States with an eye toward a federal law,” she says. “That said, the exclusion of any non-corporate interests from the hearing … prevents members of Congress from receiving an in-depth picture of what the situation really is.”

Committee chair John Thunes, a Republican of South Dakota, opened the session by acknowledging that a second hearing that will include consumer advocates would take place in about a month. But Stepanovich expressed skepticism that Congress would give equal weight and attention to the testimony of groups that wield less influence in Washington than their corporate counterparts.

By and large, Silicon Valley companies usually favor self regulation over legislation. But in May the European Union’s General Data Protection Regulation (GDPR) went into effect, offering Europe’s citizens far greater control over how their personal data is collected and used. The following month, California passed its own version of GDPR, which has been dubbed the strongest privacy bill in the nation but has also been criticized by the state’s own attorney general for being “unworkable”.

All of the witnesses before the committee objected to some elements of GDPR and the California law, and all favored a federal law that pre-empts existing and pending state regulations.

“If you look at the California and GDPR laws, companies were overwhelmingly geared toward killing those proposals, and thinking they could make them go away altogether,” Stepanovich adds. “But it seems like companies are seeing that they can’t continue to claim people don’t want data protection laws. The movement is clearly forward, and companies don’t want to be left out of those conversations.”

When Democratic senator Richard Blumenthal of Connecticut asked the Silicon Valley giants whether any of them believed US citizens deserve less privacy protection than Europeans, none agreed. He also pointed out that none of the companies had stopped doing business in Europe or California as a result of those laws.

Congress has been wrestling with the data privacy issues since the early 2000s, notes Berin Szoka, president of TechFreedom, a tech policy thinktank.

In 2012, the Obama administration formulated “the consumer privacy bill of rights”, backed by Google, Microsoft and other tech heavyweights. But it was never enacted into law by Congress. (The page containing that document was removed from the White House website within hours of the Trump administration taking office.)

Szoka was one of the policy experts consulted during the creation of that document, which he describes as “a sensible, coherent approach”.

“Congress has been stuck on this issue for 18 years,” he says. “I don’t see the Democrats or Republicans doing a better job on this than California did. [Congress] is still struggling to figure out how online advertising works.”

Even if Congress, Silicon Valley and consumer advocates manage to agree on basic privacy rules, Szoka says, the nitty gritty details of how that legislation will work in the real world is the tricky part.

“The real question becomes, how do you operationalize that?” he asked. “What does the institutional framework look like? What are the enforcement mechanisms? They’re hard questions that lawmakers don’t really seem to care about.”