Protecting Personal Privacy

Protecting personal privacy has become a more significant issue in recent years with the advent of new technologies and artificial intelligence (AI), and the proliferation of personal information. The federal government collects and uses personal information on individuals in increasingly sophisticated ways for things like law enforcement, border control, and enhanced online interactions with citizens. In the private sector, commercial entities collect, share, and sell vast amounts of personal information for marketing and other purposes. Some companies also used technology to monitor the spread of COVID-19—such as to identify individuals that came in contact with people displaying symptoms. 

Policymakers face some key challenges to protecting personal privacy in this environment. 

For instance: 

• Federal privacy law. The collection or use of personal information by the federal government is governed primarily by two laws: the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. But there is no overarching federal privacy law that governs the collection and sale of personal information among private-sector companies. There is also no federal statute that gives consumers the right to learn what information is held about them for marketing purposes and who holds it. Congress could consider strengthening the consumer privacy framework. 

• Technological advances and AI. Emerging technologies—like facial recognition or AI—have rapidly increased the amount of personally identifiable information (PII) federal agencies collect, share, and use. Federal agencies face challenges in addressing the related privacy risks, including at the Departments of Defense, Homeland Security, and Housing and Urban Development. Many federal IT systems also need stronger privacy practices and safeguards to protect the PII they hold. 

• Numeric scores. Companies increasingly use numeric scores to predict how consumers will behave. These scores are based on hundreds of pieces of information about a person's purchases and personal characteristics. Scores are used, for example, to target ads or provide individualized pricing. Unlike traditional credit scores, these scores may not be subject to consumer protection laws that seek to ensure fair and transparent treatment. Congress could play an important role in establishing appropriate consumer protections related to numeric scores, which includes considering the rights of consumers to view and correct the data used to create the scores. 

• Privacy notices. The privacy notices that banks and credit unions provide to consumers do not give a complete picture of the information institutions collect on consumers and potentially share with retailers, marketers, government agencies, and others. The Consumer Financial Protection Bureau could update this privacy notice form to ensure that consumers are better informed about all the ways banks and credit unions collect and share personal consumer information.  

• Taxpayer data. Tax returns are filled with sensitive personal and financial data—which the Internal Revenue Service (IRS) is expected to protect. However, recent disclosures of sensitive taxpayer data have made headlines and raised concerns about IRS's ability to safeguard taxpayer information.