The post Contingent Support of Delaware Personal Data Privacy Act appeared first on Consumer Federation of America.

The post Consumer Organizations Write in Support for The Children and Teens’ Online Privacy Protection Act appeared first on Consumer Federation of America.

The post CFA Joins Comments on CA Privacy Regulations appeared first on Consumer Federation of America.

The bill, introduced by House Financial Services Committee Chair, Rep. Patrick McHenry (R-N.C.), is scheduled for mark-up and vote tomorrow in the committee. Consumer groups are calling on committee members to vote against this bill, which would be a major setback for consumer data privacy protections.

“This bill is being sold as a way to strengthen data privacy protection laws, but in reality, it will do much more harm than good. Members of Congress should reject this proposal,” said Ed Mierzwinski, U.S. PIRG Senior Director for Federal Consumer Programs. 

H.R. 1165 would override or “preempt” any state law regulating financial institutions in their “collection or disclosure of personal information.” This could include laws such as the California Financial Information Privacy Act, as well as data breach notification laws, which all 50 states have adopted. 

More shockingly, since the term “financial institutions” under the Gramm-Leach-Bliley Act (GLBA) covers more than just banks – it extends to credit bureaus, debt collectors, auto dealers, travel agents, and many other types of businesses. H.R.1165 could nullify state privacy law governing these companies, including laws in half the states that regulate state credit reporting. 

“The potential scope of preemption by H.R. 1165 is breathtaking,” noted Chi Chi Wu, attorney at the National Consumer Law Center.

One type of state law that could be preempted is medical debt laws, passed to protect patients against these debts showing up on their credit reports and lowering their credit scores. Maine and Texas have these laws, and bills have been introduced in Colorado and North Carolina.  

“Millions of consumers are burdened by medical debts on their credit reports,” stated Wu. “States are in the vanguard of trying to protect their citizens from the unfair impact of these bills – no one should have their credit ruined because they got sick.”

Bill proponents in Congress, backed by the fintech sector, argue that the GLBA is outdated and needs updating in response to burgeoning new uses of financial data and widespread problems with data privacy. But, while consumer advocates agree that GBLA needs strengthening, they say this bill would actually be worse than the status quo.

“This bill largely fails to offer new meaningful protections for consumers,” said Ruth Susswein, Consumer Action’s Director of Consumer Protection. “Instead it would substitute a weaker framework, roll back stronger state laws, and leave consumers worse off than they are now.”

The bill also fails to address the need for a private right of action or remedy for harmed consumers. Currently, many state laws provide some form of private remedy for consumers to seek redress when their privacy rights are violated. These laws are especially critical for consumers seeking protection, as GLBA lacks a private remedy mechanism.

“This bill’s failure to strengthen the rights to private action and its preemption of state private remedies, further strips consumers of their rights and makes it nearly impossible for them to hold companies accountable when they break the law,” said Emily Peterson-Cassin, Digital Rights Advocate with Public Citizen. ”A right without any remedy is largely meaningless to the millions of consumers whose lives are routinely impacted by widespread misuse of their private information.”

Despite these dangers, the House Financial Service Committee Chair is determined to move the bill for a vote, essentially arguing that federal updates are necessary and that state pre-emption is the necessary trade off. But, consumer groups say this is a false choice.

“Congress doesn’t need to choose between total state preemption and a federal framework for data privacy. Recently enacted bipartisan laws have struck a good balance between the two; the same can be achieved with data privacy,” said Mark Hays, Senior Policy Analyst with Americans for Financial Reform and Demand Progress. “Pushing this bill as is right now ultimately benefits primarily the finance and tech industries – much more can and should be achieved for consumers.”

The post Consumer Advocates Blast So-Called Data Privacy Bill for Wiping Out State Consumer Protection Laws appeared first on Consumer Federation of America.

The post CFA and CR Support KY Privacy Bill appeared first on Consumer Federation of America.

The post For California Consumers: Your Rights Under the California Consumer Privacy Act appeared first on Consumer Federation of America.

Introduced by Senate Banking Committee Chairman Sherrod Brown (D-OH), Sen. Bob Casey (D-PA) and Sen. Chris Van Hollen (D-MD), this bill would prohibit shadow banks and nonbank commercial entities from taking advantage of legal loopholes.

The post Coalition Supports Close the Shadow Banking Loophole Act appeared first on Consumer Federation of America.

The coalition, which includes Americans for Financial Reform, Bank Policy Institute, Center for Responsible Lending, Consumer Federation of America, Credit Union National Association, Independent Community Bankers of America, Mid-Size Bank Coalition of America, National Association of Federally-Insured Credit Unions, National Community Reinvestment Coalition, National Consumer Law Center (on behalf of its low-income clients) and U.S. PIRG, stated the following in a letter:

The time is now for Congress to close the ILC loophole before it is further exploited by firms seeking to gain all of the advantages of an FDIC-insured bank charter without the concomitant supervision and regulation that Congress has established for the corporate owners of full-service insured banks. As financial services trades and consumer advocates, we come together to fully support this legislation and look forward to working with the committee to advance this legislation in the future.

Why this matters:

Congress sought to preserve a competitive economy by establishing a strict separation between banking and commerce. The ILC loophole allows commercial entities to undermine the intent of Congress and ignore the protections designed to maintain that separation. This loophole:

• Creates a riskier financial system and less competitive economy;
• Gives major commercial firms – including Big Tech companies – access to sensitive balance and transaction data, adding to their trove of personal and behavioral data; and
• Exempts these nonbanks from many consumer data and privacy protections.

The Senate legislation would eliminate the loophole and strengthen protections for consumers, taxpayers and the financial system.

A short history of industrial loan companies:

Industrial loan companies offer special exemptions for any type of organization to control a full-service FDIC-insured depository institution without being subject to the same consolidated oversight and prudential standards or limitations applied to traditional financial institutions. These charters were established in the early 1900s and have historically been held by small, locally owned institutions.

The Competitive Equality Banking Act excluded ILCs from the definition of a “bank” in the Bank Holding Company Act in 1987. As a result, the size and number of these companies ballooned until, in 2013, the Dodd-Frank Act imposed a temporary moratorium on new ILCs. That moratorium has been lifted.

Additional background:

The coalition, which represents a broad cross-section of regulated banks, credit unions and consumer protection organizations, also supported H.R. 5912, the “Close the ILC Loophole Act” introduced in the House by Congressman Jesús “Chuy” García (D-IL), Stephen Lynch (D-MA), Lance Gooden (R-TX) and Pete Sessions (R-TX). The House bill passed through committee earlier this year.

The post Financial Services and Consumer Groups Support Senate Bill to Close Industrial Loan Company Loophole appeared first on Consumer Federation of America.

The post CFA and Other Groups Urge Pelosi to Move Privacy Bill appeared first on Consumer Federation of America.

Read first set of comments here.

Read second set of comments here.

The post CFA and Other Groups Comment on Proposed CA Privacy Regulations appeared first on Consumer Federation of America.

The post CFA and Other Groups Tell CA Senators to Vote No on Digital License Plate Bill appeared first on Consumer Federation of America.

The post CFA Provides Comments to New CA Privacy Regulator on Consumers’ Experiences with CCPA appeared first on Consumer Federation of America.

The post CFA Supports Petition to Ban Surveillance Advertising appeared first on Consumer Federation of America.

The post Groups Provide Input to OSTP on Uses of Biometric Technologies appeared first on Consumer Federation of America.

The survey is part of a project, The California Privacy Initiative, that Consumer Action and CFA launched with support from the Rose Foundation to educate Californians about the law and encourage them to exercise their CCPA rights. “People are increasingly being tracked, online and offline, as they go about their daily lives, and the information collected about them can determine what offers they receive—not only for products and services, but for employment, credit, housing and other economic opportunities—and the prices or rates they pay,” said Ken McEldowney, executive director of Consumer Action. “The rights to see, delete and stop their data from being sold helps Californians protect themselves from unwanted, unfair and harmful uses of their personal information.”

The online survey, conducted in English and Spanish by Engine Insights from Oct. 7 to Oct. 12, 2021, collected responses from 1,507 California residents who are 18 or older. In addition to asking about their awareness of and experience with their CCPA rights, the survey asked whether businesses should be required to obtain people’s consent before collecting, using, selling or sharing their personal information for purposes other than to provide the goods or services they requested.

Nine out of 10 survey respondents said that businesses should be required to get their permission if they want to collect, use or share their personal information for any purpose other than to provide the product or service they requested. “Californians clearly want more limits on the information businesses can collect about them and its use beyond what is necessary to fulfill their requests,” observed McEldowney. “The notice and opt-out model places too much of a burden on individuals to understand businesses’ data practices and take action.”

“It’s clear that the prominent ‘Do Not Sell My Personal Information’ option that businesses covered by the CCPA must display on their website homepages is being seen,” said Susan Grant, a senior fellow at CFA. Sixty-three percent of the survey respondents said they made this request at least once to businesses whose websites they visited, compared to 47 percent who asked businesses to delete their data and 46 percent who asked to see the information that had been collected about them. “Still, 42 percent of those who didn’t ask businesses not to sell their personal information said they didn’t know they could, and even more gave the same reason for not asking to see or delete their data,” noted Grant. “It needs to be more obvious and easier for Californians to exercise their rights so they can get the full measure of privacy protection to which they’re entitled under the CCPA.”

Compared against the responses of older and White people, younger, Black and Hispanic Californians more frequently said they did not know they could make these requests. More survey respondents at the lower end of the income and educational scales also gave that reason for not making these requests.

Survey participants who did make these requests were not entirely satisfied with the businesses’ responses. Of those who asked to see or delete their data, 73 percent were very or somewhat satisfied with the responses; 71 percent of those who asked for their data not to be sold were very or somewhat satisfied with the responses. More than a quarter were not too satisfied or not satisfied at all. “The new California Privacy Protection Agency should explore the reasons for consumer dissatisfaction with how these types of requests are handled,” said Linda Sherry, director of national priorities at Consumer Action.

An executive summary of the survey findings is here. The full survey, with more details, is here.

Consumer Action and CFA have created a consumer guide for Californians about their CCPA rights and how to exercise them, which will be available on both organizations’ websites. A webinar for consumer educators for community-based organizations, consumer and privacy groups, and consumer agencies that operate in California will also be offered. If you would like more information about these materials, contact Linda Sherry or Susan Grant (see Contacts at top of release).

Contact:
Susan Grant, Consumer Federation of America, sgrant@consumerfed.org
Linda Sherry, Consumer Action, 202-544-3088

The post Survey Shows Californians Are Still Unaware of Privacy Rights appeared first on Consumer Federation of America.

Executive Summary

Full Report

Major Findings Illustrated

The post Survey Shows Too Many Californians Are Still Unaware of Privacy Rights appeared first on Consumer Federation of America.

The post CFA and Other Groups Support Update to COPPA appeared first on Consumer Federation of America.

The post Groups Ask FTC to Launch Rulemaking on Civil Rights and Privacy appeared first on Consumer Federation of America.

As Consumer Federation of America noted in the report we released last year, Marketing Direct-to-Consumer Genetic Testing: Are Consumers Getting What They Think They Are?, DTC genetic testing companies aren’t covered by privacy requirements that apply to healthcare providers, and federal law only limits access and use of individuals’ genetic information by employers and health insurers. So DTC genetic testing companies are generally free to use and share consumers’ personal information, including their genetic data, for marketing and other purposes. They may also allow law enforcement agencies to obtain consumers’ data from them without a warrant. Some DTC genetic testing companies say they won’t use or share particularly sensitive information about individuals, such as their genetic data, without their explicit consent and that they will only provide information to law enforcement in certain circumstances (see the charts in our report). But companies’ practices vary widely, and in some cases their privacy policies are so difficult to read and understand that it’s impossible to know exactly what they do with people’s data. While a few states have privacy laws, California will be the first in the nation to enact specific privacy and security requirements for DTC genetic testing companies.

The Genetic Information Privacy Act will require these companies to provide clear and complete information regarding their policies and procedures for collecting, using, maintaining and disclosing consumers’ genetic data. This includes making a summary of their privacy practices available in plain language, as well as providing the details in a prominent and easy-to-access privacy notice. If they share “deidentifed” genetic data with others for certain research purposes, which is allowed without consumers’ consent, they must say so.

DTC genetic testing companies will be required to ask consumers for separate, express consent to:

• Use the genetic data collected through their testing products or services for the purposes they specified.
• Store the biological sample after the initial testing consumers requested has been done.
• Use the genetic data or the biological sample for something other than the primary purpose of the genetic testing or service.
• Transfer or disclose the genetic data or biological sample to someone else (other than to a service provider, such as an outside lab that conducts the tests), who must be identified.
• Market or help market products and services to customers based on their genetic data.
• Enable other companies to market to customers based on their having ordered, purchased, received, or used the companies’ genetic testing product or service.

Our study showed that some DTC genetic testing companies engage heavily in upselling – advertising additional products and services to existing customers. The law will allows the companies to use their websites and apps for that that type of marketing without the customers’ express consent as long as it’s not based on information about them beyond the fact that they purchased or used certain products or services and doesn’t have a discriminatory effect.

In another first, the law would bar the use of “dark patterns” – user interfaces that are designed to subvert or impair consumers’ ability to make choices in their own best interests, to obtain express consent.

DTC genetic testing companies will have to clearly label the advertisements they provide on behalf of other companies as advertisements, identify those companies, and state that they haven’t checked on the validity or endorsed the claims made for those products and services, if that is the case. They will be required to keep consumers’ genetic data reasonably secure and provide simple ways for consumers to access their genetic data, request that their accounts and genetic data be deleted, and have their biological samples destroyed.

Consumers can’t be denied services, charged more or otherwise be discriminated against for exercising their rights under the law. Finally, consumers’ genetic data can’t be accessed or used for making decisions related to health insurance, life insurance, long-term care insurance, disability insurance, or employment.

While consumers won’t be able to bring their own lawsuits to enforce their rights, the state Attorney General, district attorneys, and city attorneys will have the power to seek penalties (which will go to the affected consumers) for violations as well as reimbursement for their court costs.

Last year Governor Newsom vetoed a similar bill, citing public health authorities’ concerns that the law could interfere with their ability to request samples from individuals to track diseases. That has been addressed this time by specifically excluding tests conducted exclusively to diagnose whether an individual has a specific disease, as long as those involved in conducting the tests maintain, use, and disclose genetic information in the same manner as medical information or protected health information under federal law.

Consumer Federation of America and other groups are urging Governor Newsom to sign the bill as soon as possible to protect Californians’ genetic privacy and provide a model for other states to follow.

The post California Poised to Protect Genetic Privacy appeared first on Consumer Federation of America.

The post Groups Urge CA Governor to Sign Genetic Testing Privacy Bill appeared first on Consumer Federation of America.

The post Groups Call for FTC to Address Surveillance and Data Abuses appeared first on Consumer Federation of America.

The post FTC Must Protect Civil Rights and Privacy in Data-Driven Commerce appeared first on Consumer Federation of America.

One of the most common arguments in favor of using facial recognition in stores is that it can help identify known shoplifters, bad-check writers and other criminals. But it’s well-known that this technology is prone to error and biased, frequently misidentifying people of color. Furthermore, people may have been falsely accused of crimes. And where do you draw the line for objectionable behavior? Should someone who is recognized as having been involved in a protest be barred from a store? What about an undocumented individual? How do you know that someone who appears to be drunk doesn’t have a disability that affects their facial expression?

On the other end of the scale, facial recognition can be used to identify people for preferential treatment. For example, someone who spends a lot of money at a store may be offered a special deal, or moved to a shorter line. As the Government Accounting Office noted in studying facial recognition, it can also be used to track what people look at in a store in order to target them for marketing. See my earlier blog on surveillance advertising – it’s the same type of profiling for profit, based on what we do in the physical world rather than online, though of course online and offline the data can be combined to paint an even richer picture of our activities and interests.

Even if facial recognition was 100 percent accurate and only used for things we personally benefit from, do we want to live in a society where we can no longer simply browse in a store in private? Where some people are treated better than others based on how they look and other assumptions about them? Where we can’t control the use and sharing of intimate personal information such as our faces?

In my view, this type of commercial surveillance is un-American and unwarranted. We applaud the companies that have committed not to use facial recognition – the list is on the campaign website – and we urge other companies to make that pledge. Individuals can join the campaign to make their voices heard and help persuade retailers to do the right thing.

The post Campaign Launched to Ban Facial Recognition in Stores appeared first on Consumer Federation of America.

The post CFA and Other Groups Oppose CA Digital License Plate and Registration Programs Unless Data Privacy is Protected appeared first on Consumer Federation of America.

The post CFA Joins Others to Oppose California Bill to Allow Facial Recognition Use to Obtain Vital Records appeared first on Consumer Federation of America.