Editorial: Adopt federal rules on data privacy and rights

By The Herald Editorial Board

Last month’s vote by the U.S. House that sought to force the sale of TikTok over data privacy concerns was praised as a rare act of bipartisanship in an often divided Congress. But — even if taken up and passed by the Senate — the legislation itself addressed only a sliver of the broader concerns for data privacy among the full constellation of tech companies.

As large and influential as TikTok is — with about 170 million American users of the video-sharing network — the legislation limited its concerns to how secure the data of its users was with owners based in China. TikTok’s owners insisted it had not and would not turn over data to Chinese officials, yet House members — citing national security concerns — insisted that TikTok either sell or shut down.

Supporters of the bill seemed content to trust the same data vulnerability to other corporate owners, as long as they weren’t Chinese. Even if China does pose such a threat, others — among them many European countries and several U.S. states have seen the wider threat posed to data security — regardless of who owns a tech firm — and have passed laws seeking a tighter rein on data and better protections and options for users.

Congress may have now caught up to those setting earlier standards with a bipartisan proposal from two Washington state lawmakers: Democratic Sen. Maria Cantwell and Republican Rep. Cathy McMorris Rodgers, both chairs of their respective commerce committees.

The pair released legislation Sunday that for the first time seeks to provide consumers with greater control over what data is collected and kept by tech companies — including Meta (Facebook and Instagram), TikTok, X, Google and others — and how those companies use and share that data.

“A federal data privacy law must do two things: It must make privacy a consumer right, and it must give consumers the ability to enforce that right,” Cantwell said in a statement introducing the act.

“This landmark legislation gives Americans the right to control where their information goes and who can sell it,” McMorris Rodgers added. “It reins in Big Tech by prohibiting them from tracking, predicting, and manipulating people’s behaviors for profit without their knowledge and consent.”

The act would give users of such apps and services the right to opt out of specific data collection and use, including advertising that targets specific users based on that data. As well, companies could only collect data necessary to operate the app as intended. Users could review their data, delete what they wish and transport data among other such services.

The legislation, the American Privacy Rights Act, was released in “discussion draft” form, meaning both committee chairs are likely to seek further input from other lawmakers, as well as from representatives from industry and consumer rights groups before formal introduction.

Both lawmakers had proposed legislation earlier seeking tighter controls on data. Cantwell last summer proposed giving the White House greater rule-making authority to identify and address potential data privacy risks, while also allowing Congress oversight over the actions of the executive branch. McMorris Rodgers, two years ago — then as the committee’s ranking member — proposed privacy protections in a bipartisan plan.

Negotiations between the two Washington state lawmakers found middle ground on provisions that had frustrated earlier efforts. Republicans won a provision that will preempt some of the legislation passed by a dozen states, including Oregon and California, in favor of a federal standard, a provision favored by the tech industry. Democrats won assurance that app and service users will be able to file lawsuits for compensation if companies violate requests to delete data or don’t obtain users’ consent.

The agreement between the two clears past objections from each party, yet time remaining for passage is tight as the election and the end of the 118th Congress approaches. Adding to the time crunch, McMorris Rodgers announced earlier this spring she was not seeking re-election to Congress, meaning her support of the legislation and her leadership on her committee will end this year.

While certainly more comprehensive than the bill seeking TikTok’s sale, the privacy act will still need to be joined by other legislation under consideration, including existing bills in the Senate regarding online safety and privacy for children and youths.

Again, we note the warning last year by U.S. Surgeon General Dr. Vivek Murthy, in a 19-page advisory, regarding the effects of social media on children’s and teens’ mental and emotional health, physical well-being and social development.

Even if passage of the privacy act is secured, users of social network platforms and other internet services still will have to put to work the tools that these laws can provide.

To protect their interests and that of their children, they will have to take the initiative to learn how to review the data that has been collected and make informed decisions about what they are willing to share and what they want deleted.

Legislation can assure that companies make that review accessible and understandable, but no one but users can check the “delete” box.