Consumer Reports opposes Pennsylvania H.B. 1201, consumer privacy legislation. The bill seeks to provide to Pennsylvania consumers the right to know the information companies have collected about them, the right to access, correct, and delete that information, as well as the right to stop the disclosure of certain information to third parties. However, in its current form it would do little to protect Pennsylvania consumers’ personal information, or to rein in major tech companies like Google and Facebook. The bill needs to be substantially improved before it is enacted; otherwise, it would risk locking in industry-friendly provisions that avoid actual reform.
We offer several suggestions to strengthen the bill to provide the level of protection that Pennsylvania consumers deserve:
- Include strong data minimization rules to limit collection and use of personal data.
- Broaden opt-out rights to include all data sharing and ensure targeted advertising is adequately covered.
- Narrow the loyalty program exemption.
- Remove the right to cure from the Attorney General enforcement section and add a private right of action.
- Apply authorized agent provisions to rights to access, correct, and delete.
- Eliminate entity level carveouts.
- Include strong civil rights protections.
- Remove ambiguities around requirements that the universal opt out mechanism not “unfairly disadvantage” other controller.
- Amend prohibitions on default opt-outs.
- Clarify that approximating geolocation by IP address is sufficient residency authentication.
To read the full letter, please see the attached PDF.