Talking about the elephant: Federal Privacy Legislation Update, July 8

"The Supreme Court’s reversal of Roe v. Wade on June 24 has directed a spotlight on the question of digital surveillance, as Google searches, location information, period-tracking apps and other personal digital data could be collected and used as evidence of a crime if one seeks to terminate a pregnancy—or helps someone do so—in states where it’s illegal....

While some lawmakers have been fighting for this issue for years, legislation that would enshrine safeguards against the collection of personal data by governments and companies for criminal surveillance and corporate profit has stalled. But the urgency has intensified in recent weeks."

–  Lawmakers are scrambling to pass privacy legislation, Nik Popli and Vera Bergengruen, Time

Yeah, really. And when Congress is back in session on Monday, there are at least four privacy bills that could have a real impact:

• The My Body, My Data Act protects reproductive health data. It's supported by reproductive rights groups including Planned Parenthood, NARAL, Unite for Reproductive & Gender Equity (URGE), and Feminist Majority,
• The Fourth Amendment Is Not For Sale Act prohibits data brokers from selling data to law enforcement and intelligence agencies without a court order. Nearly 50 consumer-advocacy, media-justice and privacy-rights groups, including the ACLU, the Brennan Center for Justice, Demand Progress and Free Press Action, support it.
• The Health and Location Data Protection Act (HLDPA) also focuses on data brokers, prohibiting them from selling health or location data – to government or anybody else.   With the House Oversight probing data brokers' handling of reproductive health data, this is an topic that's goign to get a lot of attention.
• The American Data Privacy and Protection Act (ADPPA) is a broad consumer privacy bill, with civil rights protections and some data broker regulation.  It's got a lot of momentum and the sense of urgency could be enough to push it over the top, although privacy groups like Electronic Frontier Foundation say ADPPA still needs significant improvements.  UPDATE, July 12: the House Energy & Commerce committee is planning a markup on ADPPA next week.

[There are also several child privacy bills, but this post is already going to be long enough that I'm going to skip over them for the time being.]

GET INVOLVED: Tell Congress to pass the My Body, My Data Act and support the Fourth Amendment Is Not For Sale Act using EFF's handy web forms.

With the Senate split 50-50, the only way for a bill to pass this session is with bipartisan support.  The Fourth Amendment Is Not For Sale Act was introduced by Senators Ron Wyden (D-OR) and Rand Paul (R-KY), and Republican Senators Lee and Daines are also co-sponsors, so it has a chance.  By contrast, even though My Body, My Data Act sponsor Rep. Sara Jacobs (D-CA) has said there's a good chance that the House will vote on it soon, it may well have a hard time clearing the Senate.  [Biden has said he’d support eliminating the filibuster to codify Roe and right to privacy, which could provide another path, but there don't currently appear to be the votes for that route either.]

The big wild card is the ADPPA, which also has bipartisan sponsorship.  Everybody agrees that it's an encouraging start, and breaks some important new ground – for example, a section on civil rights protections that prohibits collecting, processing, and transferring covered data in was that discriminates on the basis of race, color, religion, national origin, sex, or disability.  But even though the Consumer Protection and Commerce subcommittee advanced it unanimously, it faces pushback from multiple sides:

• Groups like EPIC Privacy, Common Sense, Lawyers Committee on Civil Rights, and EFF have pointed out areas for improvement, and several Democratic legislators are pushing to strengthen it.  
• Industry trade associations are very concerned that its requirements are too onerous, and several Republicans legislators are pushing to weaken it.

Talking about the elephant

At ADPPA's hearing and markup in June, reproductive health data was the elephant in the room that nobody talked about.  But now, as Cristiano Lima's Abortion ruling could scramble data privacy talks (in the Washington Post) reports, a memo from Democratic staffers raises concerns that the bill "does not adequately protect” privacy in a post-Roe world:

According to the memo, the American Data Privacy and Protection Act “makes it harder for women to seek redress when their sensitive health data has been used against them” and would force women to “jump through arbitrary, drawn-out hoops” to sue over privacy violations.

Democratic aides called out provisions overriding state laws and delaying when consumers can bring lawsuits against companies by four years. “During that time, all strong state privacy laws are preempted, leaving fewer enforcement mechanisms for women,” they wrote.

Democratic legislators are concerned as well.  The article quotes Wyden with concerns about the loophole exempting “de-identified” data (which is typically very easy to re-identify); Jacobs as saying “it’s clear that there is a lot more to do than is currently included in this bill;” and Senate Commerce Chair Maria Cantwell (D-WA), focusing on how enforcement needs to be strengthened.

None of these issues are new. Disagreements on preemption and the private right of action (whether people can sue companies who break the law) have been major roadblocks to agreement on federal privacy legislation for the last several years, and ADPPA attempts to thread the needle with "compromises" in both of those areas was already the source of heated discussion.  Articles like Lano's Cantwell’s elusive endorsement hinders privacy talks give a glimpse into some of the behind-the-scenes tensions.

That said, the SCOTUS decision changes the dynamics.  Democrats who might have been willing to "compromise" and support a weak bill will look really bad if they pass privacy legislation that doesn't protect reproductive health data.  Then again, that also gives industry and their an opportunity to claim that a weak bill protects reproductive health data (even if it doesn't) and press Democrats to pass it.  In How comprehensive privacy legislation can guard reproductive privacy, Brookings' Cameron Kerry says "The ADPPA would accomplish the essence of the Warren-Wyden and Jacobs bills."  But would it really?

Now what?

Still,  it was clear at the ADPPA hearing that legislators from both parties really understand the need to pass privacy legislation and want to do something this session.  So they've certainly got an incentive to work through these problems. And the ADPPA's not the only bill in town.  As the Boston Globe notes in With Roe overturned, Congress must act on data privacy, even though bills like HLDPA and My Body My Data are unlikely to get past a Senate filibuster, there's still plenty of room for amendments to the ADPPA that bring in at least some of these protections.  And the Fourth Amendment Is Not For Sale Act would also be a big win for our privacy.

One of the lessons from our experiences in the multi-year battle over privacy legislation in Washington states is that grassroots organizing can make a big difference in situations like this. Industry has so many well-paid lobbyists that privacy and civil rights groups are badly outnumbered – but polls consistently show that the vast majority of voters in both parties support strong privacy protections.  And it's not just legislators and people concerned about reproductive health information who are feeling the urgency to do something about privacy ASAP.  As WA People's Privacy Network says in Losing Roe means we have to fight harder than ever for everyone’s privacy

Geo-fence warrants, unwarranted data collection and surveillance via brokers and third parties, automated decision systems, biased algorithms, and biometric data collection have all threatened Immigrants; Black, Indigenous and people of color; LGBTQIA+ people; Muslims; community organizers; activists, anti-war, peace and environmental advocates; movement lawyers and journalists for years. These communities have all felt the brunt of data privacy and surveillance threats and harms, and have spoken up about it.

So it'll be interesting to see what happens once Congress is back in session.  To get involved with the activism, make sure to follow groups like EFF and WA People's Privacy Network.  And I'll continue to cover the federal privacy legislation battle, along with other topics, here on The Nexus Of Privacy.  So if you want to stay in the loop, please subscribe!

________________________________________

Image credit: JessicaRodriguezRivas, via Wikipedia Commons.  licensed under the Creative CommonsAttribution-Share Alike 4.0 International license.