This pandemic could give Congress the push it needs to finally pass a privacy law. It’s just not the comprehensive one legislators have been promising.
Technology companies possess a trove of information about Americans’ day-to-day lives that can help public health officials conduct mass contact tracing, track symptoms to see hot spots, measure compliance with social distancing directives and more. Just as the coronavirus crisis has revealed how useful this knowledge can be, it has also revealed how sensitive this knowledge always has been — and how essential it is to ensure the outbreak doesn’t become an excuse for exploitation. Encouragingly, lawmakers in both chambers appear to recognize this risk, along with the need to boost civilians’ trust so that they’ll actually adopt essential new services.
Both parties have put forward proposals in the Senate Commerce Committee regulating data related to the covid-19 emergency, and Democrats have produced a matching bill in the House. The good news is agreement on several high-level issues: requiring express affirmative consent for collection, forbidding reuse of data for another purpose and mandating that information be deleted or delinked from individuals when the pandemic ends. The bad news is that two of the differences between the bills look awfully familiar — because they’re the same fights that have stalled Congress’s efforts to forge a federal framework for privacy for more than a year. Democrats want to enable citizens to sue directly for violations; Republicans do not. Republicans want to override existing state statutes; Democrats do not.
These debates shouldn’t be allowed to derail the need to protect from abuse today, and there’s probably room for compromise. Democrats might acknowledge that allowing citizens to sue runs the risk of deterring innovative strategies for saving lives. Republicans, in turn, might recognize wholesale preemption as less of a priority for a problem that will largely be managed on the local level.
There are other gaps between the proposals that legislators should bridge. Neither bill seeks to regulate public health authorities; both give those officials plenty of leeway to respond to the emergency and home in instead on what companies are doing on their own, in case what looks like a good-faith intervention is really a pretext for vacuuming up more information. But restrictions in Democrats’ plan would apply to other government authorities to guard against mission creep, whereas Republicans target only private actors. Democrats also explicitly prohibit using covid-19-related data for advertising or e-commerce, as well as for discriminating in traditionally protected areas such as employment, credit, education and places of public accommodation.
Congress is faced with a choice: fail as it has failed so far to safeguard the data of those it represents, or prove it can compromise in a crisis — and then, even better, channel that spirit toward producing a comprehensive law at last.
