Senate Bill Would Impose Steep Fines, Potential Jail Time For Executives Who Violate Data Privacy Rules

Sen. Ron Wyden, a staunch advocate of increased cybersecurity regulations, introduced the legislation as part of an effort to track how companies collect and share customer data.

• By Haley Samsel
• Oct 21, 2019

Sen. Ron Wyden (D-Oregon), an outspoken advocate of increased data privacy and cybersecurity regulations, has introduced legislation that would empower the Federal Trade Commission to impose “steep fines” on companies for data breaches and lax cybersecurity practices. 

Under Wyden’s proposal, called “The Mind Your Own Business Act,” corporations could be fined up to 4 percent of annual revenue on their first offense. Company executives could face 10 to 20-year criminal penalties if they knowingly lied to the FTC. These measures would make the commision an “effective cop on the beat,” Wyden said in an Oct. 17 announcement. 

“Mark Zuckerberg won’t take Americans’ privacy seriously unless he feels personal consequences,” Wyden said in a statement targeting the Facebook CEO. “A slap on the wrist from the FTC won’t do the job, so under my bill he’d face jail time for lying to the government.” 

Currently, the FTC has the ability to sue businesses after a data breach if their cybersecurity standards were inadequate, but the agency cannot outline what those standards are beforehand, The Washington Post reported. The FTC also cannot issue fines unless corporations violate earlier agreements with the government to fix their cybersecurity issues. 

Wyden’s bill would allow the commission to go after companies that have not signed those agreements, meaning that “first-time offenders” could face penalties. A draft of the legislation was circulated last November, giving Wyden time to integrate feedback, he said. 

In addition to the FTC provisions, the bill would create a national “Do Not Track” system that lets consumers opt out of companies tracking their activity on the web, selling or sharing their data, and targeting ads based on that information. Consumers would have a way to review what personal information has been collected about them and which companies have accessed it. 

“I spent the past year listening to experts and strengthening the protections in my bill,” Wyden said. “It is based on three basic ideas: Consumers must be able to control their own private information, companies must provide vastly more transparency about how they use and share our data, and corporate executives need to be held personally responsible when they lie about protecting our personal information.”

A more moderate version of the bill has gained momentum in the House of Representatives, where the Democrats hold the majority. While the Information Transparency and Personal Data Control Act would give consumers the ability to opt out of data collection, storage and sharing, it does not include provisions for executive jail time or the potential for states to pass their own laws. 

The bill, sponsored by Democratic Rep. Suzan DelBene of Washington, earned the support of a group of centrist Democrats earlier this week. Under the law, the FTC would have more authority to pursue data privacy violations. 

“I’m very pleased this critical legislation has received the support of my New Democrat colleagues,” DelBene said in a statement reported by The Hill. "Our coalition is about finding solutions to tough problems, and my legislation is an important step toward ensuring that consumers have more control over their most sensitive information.”