For years, Congress has attempted to empower Americans to manage their personal data, including the ability to see, correct, and delete it. Despite these efforts, no substantial federal legislation has come to fruition, leaving citizens vulnerable to data misuse.

Data brokers operate in a largely unregulated market, collecting and selling personal data. Some states, like California, Virginia, and Texas, have enacted laws to regulate this practice. These laws mandate that data brokers register with the state, comply with deletion requests, and disclose collected data. However, enforcement is weak, and inconsistent coverage means companies that operate across state lines can easily disregard these rules.

In response, two new federal bills have emerged: the SECURE Data Act and the GUARD Financial Data Act. These aim to bring data brokers under federal regulation. Yet, opposition within Congress threatens these measures, with some preferring to keep existing state laws over a national standard. Without federal regulation, consumers face varied protections that depend solely on where they live.

Adding to the complexity, some companies avoid being classified as data brokers. Unlike traditional brokers, large data aggregators do not sell direct personal data like names and addresses. They gather data from various sources, assemble it into profiles and scores, which impact real-life decisions such as loan approvals and interest rates. These aggregators escape current regulations due to definitional gaps, as they do not fit the typical data broker model.

The SECURE Data Act and the GUARD Financial Data Act make strides to address these issues. The GUARD Financial Act defines financial data aggregators in federal law, while the SECURE Data Act introduces data minimization, opt-in requirements, and a public registry for data brokers managed by the Federal Trade Commission.

Despite these advances, gaps remain. The SECURE Data Act’s revenue threshold excludes aggregators who sell profiles rather than raw data. Meanwhile, the GUARD Financial Data Act focuses on disclosure, allowing aggregators to continue data practices with minimal accountability.

While the SECURE Data Act allows consumers to opt out of some profiling, it does not outright ban the secondary use and sale of derived data. The situation underscores the need for comprehensive legislation to protect consumer data rights effectively.

Author: Gerard Scimeca, Attorney and Co-Founder, Chairman, and General Counsel of CASE, Consumer Action for a Strong Economy.