It seems like a no-brainer that consumers should know how businesses handle the personal data that is routinely forked over as a condition of doing business with them.
But they don’t―at least not in the United States, although that could change in California where Assembly Member Bonnie Lowenthal (D-Long Beach) has introduced legislation that echoes privacy and disclosure laws in the European Union.
The Right to Know Act, Assembly Bill 1291, would require any business that holds personal data to disclose it within 30 days of a customer’s inquiry. The business would have to identify third parties that have acquired the data within a 12-month period and provide contact information. Consumers could file a civil suit to force compliance, if necessary.
The legislation would update the 2005 Shine the Light Act (SB 27) that required businesses to tell inquiring parties what personal data they have sold and who they sold it to, but was mostly limited to older types of telemarketing that didn’t include the modern world’s online advertisers, data brokers and third-party applications.
The bill would also expand the information to be made available beyond the customary name, address and phone number to include data about sexual orientation, race, gender, income, health concerns, buying habits and similar areas of interest. A 2012 USC Dornsife/Los Angeles Times poll showed that 82% of people are concerned about what companies are doing with their personal information.
Personal data is scooped up virtually every time someone surfs a website, buys groceries, conducts financial business, visits a doctor, uses their smartphone, utilizes social media or otherwise engages in 21st Century communications. The data has currency and is readily swapped, sold and stored by private interests who use it for marketing and myriad other purposes. The information can be used to personalize Google search ads or scuttle a credit card application.
The Lowenthal legislation is in its early stages and its proponents are certain to be lobbied heavily by companies that profit from a lack of transparency. Companies with a dominating presence in California, like Facebook, Yahoo, Amazon and Google, have furiously fought regulations governing personal data in Europe and in the U.S.
Sponsors of the legislation include the American Civil Liberties Union, California Public Interest Research Group (CalPIRG), Consumer Federation of California, Privacy Rights Clearinghouse and California Now.
The proposed law does not prohibit or limit companies from sharing data. It simply requires them to let you know what they know, and who else knows what they know. It’s not like consumers are asking that their personal data be kept private. No one is seriously crazy enough to propose that.
–Ken Broder
To Learn More:
California Introduces “Right to Know” Data Access Bill, and Why Silicon Valley Will Hate It (by Zack Whittaker, Wired)
New California “Right to Know” Act Would Let Consumers Find out Who Has Their Personal Data—And Get a Copy of It (by Rainey Reitman, Electronic Frontier Foundation)
First SOPA, Now Your Privacy: Facebook, Google Flex Lobbying Muscle in Europe (by Dana Liebelson, Mother Jones)
Feds Want to Know What Data Brokers Who Market Data on Consumers Know (by Ken Broder, AllGov)
ACLU Fact Sheet (pdf)
Assembly Bill 1291 (California Legislative Information)