Last year, the U.S. Senate held a hearing about consumer privacy without a single voice for actual consumers. At the time, we were promised more hearings with more diverse voices. And while a hearing a month later with consumer advocates did seem to be a step forward, this week's two hearings—only mostly full of witnesses from tech companies—make us worried about a step back.

EFF actively supports new consumer data privacy laws to empower technology users and others. Today, 90 percent of Americans feel they no longer have control over their data when they go online. Laws that impose legal duties on large technology companies that monetize consumer data, coupled with strong enforcement such as a private right of action, will give users back control.

In order to create an enforceable law that actually protects consumers, Congress needs to consider many different aspects of the issue. This week, both the House and the Senate are holding hearings on this topic, but unfortunately, instead of hearing a variety of voices and perspectives on this topic, once again, Congress decided to hear mostly from tech companies.

As Members of Congress and Senators prepare for their hearings, we hope they consider EFF’s past materials on consumer privacy legislation, which make clear our concerns and recommendations that should be considered for any privacy law:

• People should have a right to sue companies that violate their privacy rights. Laws must have strong enforcement in order to be effective. We see a persistent lack of federal enforcement regarding consumers’ private data. For years the FCC has looked the other way while wireless carriers have allowed bounty hunters (or anyone) to purchase consumers’ geolocation data. The FTC ignores Facebook and Google continuing to flaunt their consent decree, even after a litany of privacy scandals in the last year alone. It is long past time to allow individuals to protect their own privacy rights.
• Wide-reaching preemption would be harmful to user privacy. Preemption by Congress in any federal consumer privacy law poses a serious risk to user privacy rights that are already granted by the states. These include California's CCPA and Illinois' Biometric Information Privacy Act (which has been invoked in lawsuits against Facebook and Google for scanning faces without consent).
• EFF supports the creation of "Information Fiduciaries" for large Internet companies that collect user data. The law of fiduciaries is meant to address the power imbalance between ordinary people and skilled professionals (doctors, lawyers, and accountants for example). We support the creation of an "information fiduciary" rule that would impose a duty of care and loyalty on large Internet companies. Essential to a duty-of-loyalty rule is the ability for the individual to bring their own lawsuit against the business that violates this duty to them.
• Any proposed legislation should empower users by giving back control over their data. This includes requiring opt-in consent to online data gathering, giving users a right to “data portability,” giving users a “right to know” about data gathering and sharing, and imposing requirements on companies for when customer data is breached.

We’ll be watching both of these hearings. Join us at @EFFLive as we share our thoughts in real time.