Earlier this year, U.S. Senator Sherrod Brown of Ohio released a draft discussion bill that if implemented would drastically alter corporations’ ability to collect and use personal information from consumers.

According to Sen. Brown, “We need legislation now more than ever that empowers Americans to control their personal information. No person should have to worry about being spied on, just as no one should worry about their information being bought and sold or stolen.” Brown believes that his bill would “change the fundamental framework of privacy in this country” by shifting the burden of privacy protection from consumers to corporations. Brown’s new bill is critical of the current consent-based framework that requires customers to agree to privacy policies in order to use specific online service.

Under Brown’s Data Accountability and Transparency Act of 2020 or DATA 2020, corporations collecting data from consumers would be the exception and not the rule. Companies would be banned from collecting, using or sharing personal data unless specifically allowed by law. Permissible reasons for collections include providing goods or services specifically requested by a consumer, journalism, employment and exigent circumstances by first responders.

If a corporation collected data pursuant to one of these exceptions, the corporations would then be required to disclose specific information to the consumer including; (1) the reason for collection, (2) a description of the data collected, and (3) how long the organization would retain the information. The law also requires the companies to maintain reasonable security procedures to protect any data that it collects.

Other notable provisions of the law include a ban of the use of facial recognition technology and a requirement CEOs annually certify compliance with the Act. CEOs and Board of Directors that fail to comply with the law would also face potential criminal and civil penalties.

DATA 2020 would also create a new independent federal agency to implement the Act’s requirement. The agency would have rulemaking, supervisory and enforcement authority, as well as the ability to issue civil money violations for violations of the law. The agency would also have a dedicated Office of Civil Rights to address potential discrimination. DATA 2020 would also allow individuals to bring private right of actions.

Although Brown’s bill is unlikely to pass in its current form, it marks a notable trend in recent efforts to increase accountability and transparency regarding individual privacy. In the last year, California implemented the California Consumer Privacy Act of 2018 (CCPA) and Nevada similar enacted its own data privacy law.