Backed by progressive privacy advocates, a pair of California House Democrats who represent Silicon Valley introduced sweeping legislation on Tuesday that aims to strengthen online user protections and increase accountability for major technology companies—in part by creating a new federal agency.

“Our legislation ensures that every American has control over their own data, companies are held accountable, and the government provides tough but fair oversight.”
—Rep. Anna Eshoo

The Online Privacy Act of 2019, H.R. 4978 (pdf), is sponsored by Reps. Anna Eshoo and Zoe Lofgren.

“Our country urgently needs a legal framework to protect consumers from the ever-growing data-collection and data-sharing industries that make billions annually off Americans’ personal information,” said Lofgren. “The Online Privacy Act creates a robust framework that balances the actual needs of businesses with fair privacy rights and expectations for users.”

The new legislation is now ranked #1 by Electronic Privacy Information Center (EPIC) among all the privacy bills currently pending in Congress.

“The bill by Reps. Eshoo and Lofgren sets out strong rights for Internet users, promotes innovation, and establishes a Data Protection Agency,” said EPIC policy director Caitriona Fitzgerald. “This is the bill that Congress should enact.”

Specifically, as a joint statement from the congresswomen detailed, the bill “protects individuals, encourages innovation, and restores trust in technology companies” by doing the following:

• The bill grants every American the right to access, correct, or delete their data. It also creates new rights, like the right to impermanence, which lets users decide how long companies can keep their data.
• The bill minimizes the amount of data companies collect, process, disclose, and maintain, and bars companies from using data in discriminatory ways. Additionally, companies must receive consent from users in plain, simple language.
• The bill establishes an independent agency led by a director that’s appointed by the president and confirmed by the Senate for a five-year term. The DPA will enforce privacy protections and investigate abuses.
• The bill empowers state attorneys general to enforce violations of the bill and allows individuals to appoint nonprofits to represent them in private class action lawsuits.

“Every American is vulnerable to privacy violations with few tools to defend themselves,” said Eshoo. “Our legislation ensures that every American has control over their own data, companies are held accountable, and the government provides tough but fair oversight.”