28 Association of Research Libraries Research Library Issues 297 — 2019 place the burden on companies to ensure meaningful consent and protections. Virtually all discussions assume FTC enforcement and oversight. Senator Ron Wyden (D-OR), who has long been an advocate for privacy, released a discussion draft of the Consumer Data Protection Act, which would “create radical transparency into how corporations use and share their data…”.20 Wyden’s bill would give consumers the power to control the sharing of their data and allow companies to charge consumers who want to use their services but opt-out of data collection and processing. Wyden’s bill envisions harsh penalties, including steep fines and potential prison terms for violations of the act. However, the bill’s scope is limited to larger companies or ones engaged in particularly high volumes of data collection. Senator Brian Schatz (D-HI) released his own draft bill, the Data Care Act,21 also in fall 2018, which garnered co-sponsorship of 14 other Democratic Senators.22 The key elements of the Data Care Act would impose duties of care, loyalty, and confidentiality on companies for example, the bill would prohibit companies from using data that would result in reasonably foreseeable physical or financial harm to the individual. More recently, on April 12, 2019, Senator Edward Markey (D-MA), a member of the Senate Commerce, Science, and Transportation Committee, introduced a comprehensive privacy bill. In addition to providing the rights to notice and control, the Privacy Bill of Rights Act would: explicitly prohibit companies from using personal information in discriminatory ways (such as targeted advertisements related to housing), limit the information that companies can collect to only what is needed to provide the requested services, and allow for suits by state attorneys general and a private right of action by individuals. The bill also prohibits both “take-it-or-leave-it” policies and financial incentives (such as a discount for services) in exchange for opt-in approval of the use and sharing of personal information.