On June 24, 2019, U.S. Sen. Mark Warner, D-Va., and Sen. Josh Hawley, R-Mo., introduced the Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data, or Dashboard, Act, which mandates transparency by major platforms such as Facebook Inc., Google LLC, Amazon.com Inc. and Twitter Inc. regarding the monetization of user data.
A bipartisan effort, the bill would require broad disclosures to consumers and the U.S. Securities and Exchange Commission of exactly what data is collected, how it’s used and shared and its worth in dollars and cents. To encourage a uniform approach, the act also authorizes the SEC to develop methods for calculating the value of data across platforms. This novel approach, among the first of its kind, has important implications for the digital economy and the status of “data” as a discrete asset governed by a new and rapidly evolving body of law.
Specifics of the Act
The act requires commercial data operators (entities that generate a material amount of revenue from user data with more than 100,000,000 unique users or visitors) to provide each user with detailed information on a quarterly basis. Specifically, each user will receive a description of the types of data collected, any use of his or her data unrelated to the online services he or she patronizes and the economic value placed on the data by the commercial data operator. With limited exceptions, commercial data operators must also provide users with the ability to delete their data through a single setting or another “clear and conspicuous mechanism.”
In contrast to the personal nature of disclosures to users, public companies that qualify as commercial data operators under the act are required to make broad disclosures to the SEC. At least annually, commercial data operators must submit a written report to the SEC setting forth the “aggregate value” of user data they hold, contracts with third parties that collect such data on their behalf, and any other items that the SEC deems “necessary or useful.”
The act empowers the SEC to develop data valuation methodologies to encourage standardization across different users, sectors and business purposes. Within a year after passage, the act requires additional disclosures to the SEC including, among others, data security, aggregate revenue derived from user data, and a description of each revenue generating activity dependent on user data.
Enforcement of the act falls squarely within the jurisdiction of the Federal Trade Commission under Section 5 of the FTC Act. Any violation of the Dashboard Act is deemed an “unfair or deceptive act,” invoking the full range of the FTC’s investigatory and enforcement powers. Perhaps more significant, the FTC would be responsible for issuing regulations under the act. Commercial data operators will be confronting enhanced scrutiny and regulation from the SEC and the FTC, two formidable federal agencies.
Why This Bill Matters
By recognizing “data” as a valuable asset in its own right, the act would disrupt the existing dynamic between consumers, the technology industry and federal regulators. If “knowledge is power,” then consumers would have an unprecedented ability to control their data. As an example, consumers may begin demanding financial compensation for data formerly provided just for the privilege of using online services.
Adoption and implementation of the act would have an immediate impact on the technology industry at an already challenging time in its evolution. Additional scrutiny by the FTC and a newly empowered SEC could have significant financial repercussions and accelerate calls to break up these “monopolies.”
Other state and federal regulators are likely to become involved, particularly with activist attorneys general and state legislatures already promoting (and passing) new data protection legislation such as the California Consumer Privacy Act. No one can predict all the consequences, but we can be certain that if the sensitive information sought by the act becomes public, there’s simply no going back.
Whether or not the act becomes law, its underlying premise that “data” is an asset in its own right has other important implications. Viewed from this perspective, data assets may be licensed, purchased, processed and shared for any number of commercial and other activities. However, data is governed by its own unique and rapidly growing body of laws and regulations that did not exist a few years — or even a few months — ago. Current models for monetizing other intangible assets, such as intellectual property, may fail to take these new developments into account.
In the midst of legal uncertainty, commercial and business activities involving data continue apace across our economy. The private sector allocates the risks associated with commercializing data every day from scope of use issues to data breach liability and everything in between. In fact, there’s a distinct possibility that the development of commercial norms surrounding data and risk allocation may outstrip the pace of legislation or significantly influence its future course. There’s no doubt that when it comes to data assets, different rules apply and they’re changing every day.
What You Should Do Now
Be Alert
The ultimate fate of the act is not clear, but the concept of data as a discrete asset with economic value is not disappearing from the public or legislative landscape. In particular, states are promulgating laws governing data privacy and security at an unprecedented pace (dozens in the last 24 months), covering far more entities than the act.
The CCPA, for example, sets the bar for coverage at $25 million in revenue or meeting threshold amounts of data under management, and the pending New York Privacy Act covers any legal entity that conducts business in New York state or produces products or services that “intentionally target” New York State residents with no financial or data standard.
Coverage under Europe’s General Data Protection Regulation, which strongly influenced the CCPA, the NYPA and other legislation in the U.S., is independent of the size of the company or the amount of data it holds. In other words, the act’s focus on tech behemoths does not preclude others from replicating the key concepts and applying them to a broad range of companies.
Stay Ahead of the Curve With Your Users
It’s a truism in some circles that data is the centerpiece of the digital economy, but the users that deliver that commodity may benefit from some attention now. Stay ahead of the trend by offering your users enhanced transparency regarding their data, and ensure that your public facing terms and policies are user friendly and easy to access. Taking reasonable steps now to encourage loyalty may mitigate the impact of future laws on user retention and your business.
Acknowledge Data as a Valuable Asset in Your Business Portfolio
- Know, understand and implement the new laws and regulations that impact your licensing, purchasing, sharing and monetizing of data in all areas of your business.
- Ensure that key personnel are appropriately trained with the legal, technical and business resources necessary to obtain, protect and capitalize data assets.
- Respect and preserve data assets with the same care and attention as any other material asset of your business.
