Nobody reads privacy policies. This senator wants lawmakers to stop pretending we do.

So I was intrigued when Sen. Sherrod Brown (D-Ohio) called me recently to say he wants lawmakers to stop pretending like we do. “Nobody reads the small print,” he said. “You end up giving up far too much data.”

Read more on Washington Post.

This was one of the recurring themes at the recent Privacy Law Scholars Conference that I was privileged to attend — privacy law scholars uniformly agreed that notice and consent was a failed approach and that we needed to move on to other approaches– including regulation. One scholar noted that embracing regulation would require some of us to get over “neoliberal paranoia about regulation.” I found that a surprising statement, as it’s usually not the liberals who object to privacy protective legislation (at least not if it doesn’t pre-empt stronger protections). To the contrary, I tend to see more neoconservative objections to regulating businesses.  And businesses certainly lobby the conservatives and Republicans in Congress a lot.

So let’s agree that we all need to come together to find some solution. And just as we argued for years that we needed to keep the internet free from a lot of regulation so it could innovate and thrive, now we need to say, “Okay, but we need to protect privacy much better than we have done, so let’s sit down and come up with some enforceable regulations to protect ourselves.”

You can read Senator Brown’s discussion draft form of the Data Accountability and Transparency Act to help start the conversation. EPIC.org commented on the introduction of the bill this way:

Ohio Senator Sherrod Brown announced today that he will introduce the Data Accountability and Transparency Act of 2020, a comprehensive privacy and data protection bill. The bill would (1) prohibit both private companies and government agencies from collecting personal data unless it is “strictly necessary” to carry out one of a few specified purposes; (2) ban the use of facial surveillance technology; (3) prohibit discrimination on the basis of personal data; (4) require accountability and transparency for algorithmic decisionmaking; (5) establish a federal data protection agency with the power to issue rules and enforce dozens of federal privacy laws; (6) enable individuals and state attorneys general to enforce the law in court; and (7) allow states to enact more restrictive privacy laws if they choose to. “The Data Accountability and Transparency Act of 2020 sets a strong standard for data protection,” said Caitriona Fitzgerald, EPIC Interim Associate Director. “Senator Brown’s bill creates enforceable privacy rights and limits the amount of data companies can collect and keep about us.” EPIC has long advocated for the enactment of comprehensive privacy legislation and the creation of data protection agency. EPIC’s report Grading on a Curve: Privacy Legislation in the 116th Congress sets out the key elements of a modern privacy law.