State should act to protect data privacy

The issue of online privacy only grows in seriousness. It involves more than just cellphones and computers. Everything from fitness trackers to home thermostats are connected to the internet.

This technology is great for convenience. But the same information these machines are gathering on consumers’ behalf is available to be bought and sold to others. Think of it as the hidden price we pay for “free” apps and other services available online.

People have been raising the alarm about this issue for years, particularly whenever there’s a leak of data that compromises individuals’ information. It’s happened far too often.

But government has been slow to react. Federal law on data privacy is based on a mishmash of regulations involving specific types of information. We hope to see Washington offer a coherent approach to this situation but have our doubts about how likely that is to happen given the state of national politics.

That leaves it to states to try to fill in the gaps. A handful have passed data privacy laws, and some lawmakers here are hoping Pennsylvania will join the list. Several bills are in the works. One such measure comes from Democratic state Sens. Lisa Boscola of Northampton County and Maria Collett of Montgomery County. Their goal is to ensure consumers know who is collecting their personal data, what is being collected, and who is buying it. They want to give consumers the ability to stop those sales cold.

What’s at issue, according to Collett, are sales of things such as a person’s financial and medical data, birth date, address, cell number and family members’ names.

There’s reason to be hopeful about this, as even though Pennsylvania is hardly immune from today’s divided politics, there have been at least some bipartisan successes in Harrisburg.

In this case, some Republicans are on board with the general concept but have not signed on to Democrats’ legislation.

Republican York County Sen. Kristin Phillips-Hill says lawmakers should start by fixing the problems state government has in protecting consumer data. She pointed to a consumer data exposure allowed by a contractor hired for COVID-19 contact tracing. It makes sense, she said, to fix government dataprotection weaknesses first and then create remedies for the private sector, especially since unlike businesses, the government can force people to give out information.

Legislative Democrats are proposing the following:

• Let consumers find out what information is being collected from them; learn whether it is being sold and to whom; decline or opt out of those sales; and access the information itself.

• Prevent businesses from discriminating against people who stopped the sale of their own information.

• Apply the new rules only to businesses that have annual revenue of more than $10 million or make half or more of their revenue from selling consumers’ information.

• Impose a blanket ban on the sale of all private data of people under age 16.

Rep. Rob Mercuri, an Allegheny County Republican, filed a bill in 2021 that would require larger companies and personal information aggregators to share more information with consumers about data that is gathered, tracked and sold. He likened the current situation to the Wild West and said it demands immediate attention.

We urge the two parties to get together and see if they can find a path forward on addressing this serious problem.

Collett said that if the Republican-controlled Legislature makes the effort a priority, a data privacy bill could pass in the closing few months of the two-year legislative session.

It’s less than ideal to have regulations on this subject vary from state to state, but in the absence of federal action, it’s the best we can do. And many companies are likely to adjust their policies to reflect the strictest regulations that states have on the books rather than try to operate based on as many as 50 different sets of rules.