Draft of Proposed Federal Privacy Legislation Released

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

A discussion draft of legislation to protect the privacy of information about individuals both on the Internet and offline was released by Representatives Rick Boucher (D, Virginia) and Cliff Stearns (R, Florida) on May 4.

Privacy Policy

The measure would require companies that collect personally identifiable information about individuals to conspicuously display a clear, understandable privacy policy that explains how such information is collected, used, and disclosed to third parties.

General Rule for Collecting Information

According to Boucher and Stearns, the proposed legislation would set forth a general rule that companies are permitted to collect information about individuals unless an individual affirmatively opted out of that collection. No consent would be required to collect and use operational or transactional data—such as session cookies—or to use data that was rendered anonymous.

Opt-In Consent Requirement

The legislation would require companies to obtain express opt-in consent before collecting sensitive information about an individual, including medical data, financial account information, Social Security numbers, sexual orientation, government-issued identifications information, and precise geographic location data.

Affirmative opt-in permission would have to be obtained before a company could share an individual’s personally identifiable information with unaffiliated third parties, other than for an operational or transactional purpose.

The draft bill would create an exception to this opt-in consent requirement by applying opt-out consent to the sharing of information with a third-party ad network, as long as there is a clear, easy-to-find link to a webpage for the ad network that allows a person to edit his or her profile and to opt out of having a profile.

FTC Implementation, Enforcement

The Federal Trade Commission would be directed to adopt rules to implement and enforce the measure. States could also enforce the FTC’s rules through state attorneys general or state consumer protection agencies. The legislation would not create a private right of action.

The law would preempt any state law that included requirements regarding the collection, use, or disclosure of information covered by the federal statute.

A news release and full text of the discussion draft appears on Representative Boucher’s website.