Consumer Online Privacy Rights Act Could Safeguard Data, but Tough Fight Lies Ahead
The bill, known as COPRA, would limit data collection and toughen enforcement
Sen. Maria Cantwell, D-Wash., has introduced a piece of comprehensive federal privacy legislation, called the Consumer Online Privacy Rights Act, or COPRA, that could expand individual rights when it comes to how all sorts of personal data is collected, shared, and used.
Among its many provisions, the bill would require companies to collect as little information as possible about consumers, require explicit consent when sharing consumer data with third parties, and make companies responsible for correcting or deleting inaccurate information.
“I think consumers want strong privacy protections,” Cantwell said in an interview with Consumer Reports. “They’re very concerned about private and personal information being leaked and sold and trafficked.”
A number of digital privacy bills have been introduced in Congress this year, but COPRA is notable for its comprehensive approach as well as its attention to detail, according to privacy advocates including Justin Brookman, director of privacy and technology policy at Consumer Reports.
A Reaction to California
Cantwell’s bill is being introduced shortly before the California Consumer Privacy Act goes into effect Jan. 1, 2020. That legislation will be the most sweeping privacy law in the nation, and experts say it may have a national effect as companies adopt the provisions of the law nationwide, much as carmakers have been building cars that comply with California’s auto emissions laws, which are stricter than federal guidelines.
California is just one of several states that have introduced or passed consumer privacy legislation. All this action on the state level has helped drive interest in creating a uniform, federal law. A national law could preempt state measures, however, potentially leading to weaker protections overall, according to legal experts.
Cantwell’s bill is more expansive than the California law in several important ways. It requires companies to get consumers to opt in to data sharing, rather than simply providing them with a way to opt out. It also enables individuals to sue companies that violate their privacy under the law, without having to prove that they were harmed financially or in some other way.
“Give consumers their due,” Cantwell told CR. “People rushed to get that California law in place and now [others] have tried to rush the federal law because they wanted to preempt California and any other state.”
COPRA currently lacks a Republican co-sponsor, which limits its prospects of becoming law in the near future. Hearings on the bill will be held in early December, but experts suggest that without bipartisan support—and the likely addition of language to preempt state privacy laws—it’s unlikely to pass this year. “Without bipartisan support, the calendar moves to 2021,” says Gaurav Laroia, senior policy counsel at Free Press, an internet advocacy group based in Washington, D.C.
“There are going to be some hard conversations,” about enforcement and other issues, Cantwell acknowledges. “But we’ve had very good discussions on where this needs to go, and [introducing the bill] will be very helpful in that process.”
“COPRA establishes a beachhead,” CR’s Brookman says. “While recognizing that there’s a longer fight ahead.”