Privacy Legislation Working Its Way Through Congress

In May, a bill was introduced in Congress to assist US Citizens that want to protect their privacy. It may also help prevent ID theft. The Personal Data Offshoring Protection Act of 2004 (also known as the Markey bill and as H.R. 4366) is setup to limit companies that send personal private data to offshore locations without consumer consent.

The bill gives the Federal Trade Commission policing authority for offshoring of data. Among other things, it requires the FTC to declare which countries have adequate data protection standards written into their laws. It goes on to define “adequate” as meaning that countries must, at a minimum, have laws that are equivalent to US Federal law. Furthermore, to be certified as “adequate” a country must show that it has a propensity to enforce its privacy laws.

By definition, the bill states that the FTC will certify all European Union (EU) countries that are subject to the European Union Data Protection Directive as “adequate” unless the FTC determines that a particular EU country is not enforcing the directive within its borders. It should be noted the EU privacy standards are significantly stronger than those in use in the United States.

The Markey Bill states that companies will be allowed to offshore data to subsidiaries and private contractors in countries that the FTC has declared to provide adequate protection. Consumers must be notified ahead of any such offshoring and must be given the opportunity to object (opt-out).

The bill prevents companies from offshoring personally identifiable data to countries without adequate protections unless consumers have given the company specific written permission to allow such offshoring (opt-in).

The bill does not prevent companies from writing offshoring consent into their terms of service, such as credit card agreements and privacy policies. It does however specifically forbid companies from canceling or denying services to consumers simply for exercising their rights under the bill.

If the bill is enacted it will be more important than ever for consumers to thoroughly read the terms of service agreements and privacy policies of the companies that they do business with. These are the two most likely places for companies to bury information that they don’t want consumers to know about. They are also the most likely places for companies to give consumers information about how to exercise their rights.

by Jim Malmberg