The Obama administration apparently wants its legacy to be that of regulating the Internet, notwithstanding the Internet's remarkable success in the United States under what has been a generally light-handed regulatory regime.

Step 1 occurred last week when the Federal Communications Commission (FCC), in the name of net neutrality, adopted a far-reaching public utility regulatory regime for the broadband sector. Step 2, if the administration has its way, is to extensively regulate online data — the lifeblood of the information economy—– through rules prescribed in the just-released "Administration Discussion Draft: Consumer Privacy Bill of Rights Act of 2015."


To improve on what has become a cliche about the net neutrality rules, the administration's privacy proposal is a solution to an imaginary problem. Since 2009, not one of about a half-dozen reports by both the administration and the Federal Trade Commission (FTC) has found any actual (as distinct from speculative) harms from legitimate uses of personal data.

The "Discussion Draft" reflects the long-standing focus of privacy advocates on limiting data collection, retention and use. Individuals would be required to be notified of "the purposes for which a covered entity collects, uses, and retains ... personal data" and a "covered entity may only collect, retain, and use personal data in a manner that is reasonable in light of context." Thus, a federal agency — the FTC — would be second-guessing a company's data collection policies on which its entire business model may depend.

Recent reports from the White House and, especially, the President's Council of Advisors on Science and Technology (PCAST), point to the costs of limiting data collection and retention, and of limiting data use to pre-specified purposes. By its very nature, innovation is often serendipitous. A big data world will yield a cornucopia of innovative uses of data that could not have been envisioned when the data were collected. The PCAST report recommends that policies should focus on specific practices that cause harm to individuals or groups of individuals, as opposed to preemptive restrictions on data collection and use.

Numerous provisions in the "Discussion Draft" will raise costs of innovation, make it more difficult for firms to enter markets, and raise costs to consumers.

For example, the "Discussion Draft" requires that individuals be able to control and make decisions about the "processing" of their personal data. Since processing is generally done by algorithm, does this mean that companies are required to make their algorithms public?

The "Discussion Draft" requires that individuals be able to "withdraw consent for data retention" and that within a reasonable period of time, "a covered entity shall delete the personal data associated with the withdrawal of consent." Notwithstanding the bow to the First Amendment, is the administration proposing a European-style "right to be forgotten"?

The "Discussion Draft" also includes a plethora of regulatory requirements for data uses considered to be "not reasonable in light of context." This could be a very broad class of uses. Entities would be required to conduct resource-intensive privacy risk assessments. In some instances, privacy review boards approved by the FTC would supervise the use and analysis of data and would be required to determine that the likely benefits of the data use outweigh the likely privacy risks. This is one of several instances in which a cost-benefit analysis is mentioned, which is ironic since the administration refuses to perform a cost-benefit analysis of its privacy bill of rights.

The "Discussion Draft" provides a safe harbor through adherence to industry-developed codes of conduct that must be approved and are enforceable by the FTC. Thus, the information collection and use practices of entire sectors may now become subject to inflexible regulatory codes of conduct. These codes may well become a vehicle for raising the costs of entry for start-ups and favoring larger incumbents.

The U.S. has a unique, global leadership position in the Internet economy. Adopting as law language similar to the "Discussion Draft" would put that position at risk, harm innovation, make entry more difficult and ultimately make consumers worse off. Hopefully, the conventional wisdom that the bill has little chance of becoming law is correct.

Lenard is president and senior fellow at the Technology Policy Institute.