Public Interest Privacy Legislation Principles

Unregulated data collection and use in the United States has eroded public trust in 

companies to safeguard and use data responsibly. Surveys show that, while individuals

often try to remove or mask their digital footprints,1 people think they lack control over their 

data,2 want government to do more to protect them,

3 and distrust social media platforms.4

The current U.S. data privacy regime, premised largely upon voluntary industry selfregulation, is a failure. Irresponsible data practices lead to a broad range of harms, including 

discrimination in employment, health care, and advertising, data breaches, and loss of 

individuals’ control over personal information. Existing enforcement mechanisms fail to hold 

data processors accountable and provide little-to-no relief for privacy violations.

The public needs and deserves strong and comprehensive federal legislation to protect their 

privacy and afford meaningful redress. Privacy legislation is essential to ensure basic 

fairness, prevent discrimination, advance equal opportunity, protect free expression, and 

facilitate trust between the public and companies that collect their personal data. Legislation 

should reflect at least the following ideas and principles: 

1. Privacy protections must be strong, meaningful, and comprehensive 

Privacy concerns cannot be fully addressed by protecting only certain classes of personal 

data held by some companies. Legislation should mandate fairness in all personal data 

processing, respect individuals’ expectations for how data should be treated, provide for 

data portability, and include safeguards against misuse of data, including de-identified and 

aggregate data. Legislation should advance fundamental privacy rights and require all 

entities that collect, store, use, generate, share, or sell (collectively, “process”) data both 

online and offline to comply with Fair Information Practices5 (collection limitation, data

 

1 The State of Privacy in Post-Snowden America, Pew (Sept. 21, 2016), http://www.pewresearch.org/facttank/2016/09/21/the-state-of-privacy-in-america.

2 Bree Fowler, Americans Want More Say in the Privacy of Personal Data, Consumer Reports (May 18, 

2017), https://www.consumerreports.org/privacy/americans-want-more-say-in-privacy-of-personaldata.

3 Lee Rainie, Americans’ Complicated Feelings About Social Media in an Era of Privacy Concerns, Pew (Mar. 

27, 2018), http://www.pewresearch.org/fact-tank/2018/03/27/americans-complicated-feelingsabout-social-media-in-an-era-of-privacy-concerns.

4

Id.

5 Fair Information Practices are similar to those adopted by the OECD. See OECD Privacy Framework, 

http://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf.
quality, purpose specification, use limitation, security safeguards, openness, access and 

correction rights, and accountability) across the complete life cycle of the data. Legislation 

should require all data processing to be clearly and accurately explained, justified, and 

authorized by the individual. People should have the right to know when their data has been 

compromised or otherwise breached. Additionally, legislation should require entities 

processing data to adopt technical and organizational measures to meet these obligations, 

including risk assessments of high-risk data processing.

2. Data practices must protect civil rights, prevent unlawful discrimination, and advance 

equal opportunity

Legislation should ensure fundamental fairness of and transparency regarding automated 

decision-making. Automated decision-making, including in areas such as housing,

employment, health, education, and lending, must be judged by its possible and actual 

impact on real people, must operate fairly for all communities, and must protect the interests 

of the disadvantaged and classes protected under anti-discrimination laws. Legislation must 

ensure that regulators are empowered to prevent or stop harmful action, require appropriate 

algorithmic accountability, and create avenues for individuals to access information 

necessary to prove claims of discrimination. Legislation must further prevent processing of 

data to discriminate unfairly against marginalized populations (including women, people of 

color, the formerly incarcerated, immigrants, religious minorities, the LGBTQIA/+

communities, the elderly, people with disabilities, low-income individuals, and young 

people) or to target marginalized populations for such activities as manipulative or 

predatory marketing practices. Anti-discrimination provisions, however, must allow actors 

to further equal opportunity in housing, education, and employment by targeting 

underrepresented populations where consistent with civil rights laws. Moreover, decades of 

civil rights law have promoted equal opportunity in brick-and-mortar commerce; legislation 

must protect equal opportunity in online commerce as well.

3. Governments at all levels should play a role in protecting and enforcing privacy rights

The public consistently call for government to do more, not less, to protect them from misuse 

of their data. Legislation should reflect that expectation by providing for robust agency 

oversight, including enhanced rulemaking authority, commensurate staff and resources, and 

improved enforcement tools. Moreover, no single agency should be expected to police all 

data processors; therefore, legislation should empower state attorneys general and private 

citizens to pursue legal remedies, should prohibit forced arbitration, and importantly, should 

not preempt states or localities from passing laws that establish stronger protections that do 

not disadvantage marginalized communities.
4. Legislation should provide redress for privacy violations

Individuals are harmed when their private data is used or shared in unknown, unexpected, 

and impermissible ways. Privacy violations can lead to clear and provable financial injury, 

but even when they do not, they may, for example, cause emotional or reputational harm; 

limit awareness of and access to opportunities; increase the risk of suffering future harms; 

exacerbate informational disparities and lead to unfair price discrimination; or contribute to 

the erosion of trust and freedom of expression in society. In recognition of the many ways in 

which privacy violations are and can be harmful, legislation should avoid requiring a 

showing of a monetary loss or other tangible harm and should make clear that the invasion 

of privacy itself is a concrete and individualized injury. Further, it should require companies 

to notify users in a timely fashion of data breaches and should make whole people whose 

data is compromised or breached. 

Signed,

Access Humboldt

Access Now

Berkeley Media Studies Group

Campaign for a Commercial-Free 

Childhood

Center for Democracy & Technology

Center for Digital Democracy

Center for Media Justice

Center on Privacy & Technology 

at Georgetown Law

Color of Change

Common Cause

Common Sense Kids Action

Consumer Action

Consumer Federation of America

Consumers Union

Customer Commons

Demand Progress

Free Press Action Fund

Human Rights Watch

Lawyers’ Committee for Civil Rights 

Under Law

Media Alliance

Media Mobilizing Project

National Association of Consumer 

Advocates

National Consumer Law Center

National Consumers League

National Digital Inclusion Alliance

National Hispanic Media Coalition

New America’s Open 

Technology Institute

Oakland Privacy

Open MIC (Open Media and Information 

Companies Initiative)

Privacy Rights Clearinghouse

Public Citizen

Public Knowledge

U.S. PIRG

United Church of Christ, OC Inc.