New York Senator Proposes a Federal 'Data Protection Agency'

New York Sen. Kirsten Gillibrand wants the United States government more involved in protecting digital privacy, and she wants to create a new federal agency to do it. Gillibrand (D-NY) proposed legislation Thursday to create a Data Protection Agency at the federal level. In an outline of her proposal, published on the official Senate Medium account, Gillibrand said the independent federal agency "would serve as a 'referee' to define, arbitrate, and enforce rules" related to protecting personal data. "As our country and economy continue to evolve with the digital age, we face a national crisis as our personal data gets targeted—and not just for marketing by brands, but also to establish if we can access certain jobs, loans, or prices on products," Gillibrand wrote. "Americans should be able to go to an institution that will look out for, and actively work to protect, their privacy and freedom." Gillibrand's proposed Data Protection Agency, CNBC reported, would work as an independent agency headed up by a director who, after being appointed by the president and confirmed by the Senate, would serve a five-year term. The agency would have number of powers, including the ability to enforce data protection rules through methods like injunctive relief or civil penalties up to $1 million per day. The bill would promote data protection and privacy innovation within the digital marketplace by providing resources for companies, including Privacy Enhancing Technologies, and the agency would advise Congress on emerging technology challenges, such as deepfake technology. The agency would have the authority to launch data privacy investigations on any company it receives complaints about, including tech giants Google and Facebook, and can then share its findings to the public. The agency would also protect against "pay-for-privacy" or "take-it-or-leave-it" provisions that are often woven into the contracts tech companies require customers to sign before using their services. With the proposal, Gillibrand becomes the latest legislator at the federal level to introduce legislation aimed at addressing consumer privacy. Lawmakers from both Democratic and Republican parties have introduced draft bills aimed at detailing consumers' rights over their own data and outline how major companies can and cannot collect and use personal data. For example, Sen. Marco Rubio (R-FL) introduced legislation in 2019 to give the FTC the authority to update 50-year-old privacy laws, whereas Sen. Elizabeth Warren (D-MA) put together a robust plan to legislate Big Tech as part of her presidential bid. Gillibrand's proposal, though, stands out in that it would delegate enforcement to the new agency instead of delegating enforcement to the Federal Trade Commission. (Democratic reps. Anna Eshoo and Zoe Lofgren introduced a similar bill in November that would create a Digital Privacy Agency that would serve a similar purpose.) Most other lawmakers have routed compliance and enforcement through the Federal Trade Commission; some lawmakers have considered giving the FTC rule-making authority to directly address privacy. It's unlikely a bill of this scope will pass this year. While there seems to be a bipartisan appetite to tackle the issue, Republicans and Democrats have long squabbled over the details, including whether or not federal laws will preempt the increasingly large patchwork of state laws regulating and privacy and data collection, and whether individual consumers should be given a private right of action to sue major companies. An already contentious election year makes the passage of bills of this scope particularly unlikely.