Legislator Takes Aim At Data Privacy

By Whitney Downard

Americans have no federally protected data and privacy protections, leaving individuals and companies scrambling to control a huge flow of information that could damage billions of lives.

A small number of states have started introducing their own laws to enshrine these protections and Indiana could be next.

“Right now, there is no legislation at the federal level that protects consumers and only five states so far have this,” Sen. Liz Brown said about her proposed legislation, Senate Bill 5. “We will be at the forefront of protecting consumer data privacy.”

Brown, a Republican from Fort Wayne, presented her data privacy bill as part of the Senate Republican agenda earlier this week, re-introducing a bill she filed last year.

The bill would come as a win for everyone from technology companies to everyday consumers, Brown said, except for the bad actors profiting from the sale and misuse of sensitive information about Hoosiers.

“(Technology companies) want assurance that they know how to act in this space but they also want their customers to be assured they’re taking good care of (consumers’) data,” Brown said.

What companies might know about their users

With technological advances come additional layers of surveillance, some used to enhance how a consumer interacts with an organization’s website or business model. For example, a local grocery store offering customers points toward future purchases with each item they buy.

But the program also allows the store to track what a customer orders and when, even anticipating future purchases. That information can be packaged and sold to a third party, who can use that information to tailor advertising or other marketing materials for that customer.

“They know when, for example, my grandchildren visit because I probably went down and bought diapers and baby food,” Brown said. “They probably know more about us than the Amazons of the world.”

Brown’s bill would allow consumers to ask these entities who hold their personal data, called controllers, to stop selling their data to a third party, correct inaccuracies, obtain their own copy of that information or delete it altogether.

“If you really don’t want anyone to have it or if you want to check it, then you’ll have the ability to do that,” Brown said.

Businesses must also improve the ways they safeguard that data, preventing some of the data breaches Hoosiers have experienced – whether with local healthcare entities or multinational consumer credit reporting agencies.

The “bill of rights” codified in the bill closely resembles Virginia’s legislation, which went into effect this year. Brown’s bill gives companies three years to comply and doesn’t apply to most small businesses.

“We want to give (companies) time to implement those security measures that they’re going to need and understand how to control the data,” Brown said.

In contrast to European data protection laws, one of the first efforts to institute protections worldwide, Brown’s bill doesn’t address censorship or content issues. But it does penalize companies who don’t follow the law – $7,500 per violation.

According to the Attorney General’s Office, which oversees data privacy cases now and would have expanded authority under this bill, these types of cases have grown in number and complexity.

“Particularly, we want to protect consumers’ ability to opt-out of targeted ads, which could include sensitive personal information that should remain PERSONAL,” an office spokesperson said in a statement. “Along with the modernization of our laws, more resources will be necessary to fund additional professionals and investigative tools. We will work with legislators to make sure Hoosiers know how their data is being processed.”

Tracking someone else without their knowledge

Another bill under consideration in the General Assembly would be Brown’s bill creating a law against non-consensual tracking, a practice that was previously legal.

In 2021, Apple released its AirTag, a $29, disc-shaped device that can be used to remotely track objects such as keys or luggage. Other, similar devices exploded in popularity, enabling stalkers and abusers nationwide to track their victims without their knowledge. Anyone can also order vehicle tracking devices on Amazon.

In response to a flurry of articles early last year criticizing the company for its lack of protections, Apple released an update that automatically alerts its users to AirTags following them. Android users must download and proactively use Apple’s Tracker Detect app to get the same services.

Those actions didn’t prevent two women from filing a class action lawsuit against Apple in December, who alleged former partners used the devices to stalk them.

Indiana Capital Chronicle is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501c(3) public charity. Indiana Capital Chronicle maintains editorial independence. Follow Indiana Capital Chronicle on facebook.com/IndianaCapitalChronicle and twitter.com/INCapChronicle