![\"Polly](\"https:\/\/nclnet.org\/wp-content\/uploads\/2020\/08\/PollyW_squared.jpg\" "\\"Polly")
<\/em><\/span><\/span><\/p>\nBy NCL Google Public Policy Fellow Pollyanna Turner-Ward<\/em><\/strong><\/p>\n O<\/span><\/span>n September 11, 2019, policymakers, industry stakeholders, and consumer advocates gathered at The Brookings Institution to discuss the pressing question o<\/span>f<\/span>\u00a0how to protect in<\/span>f<\/span>ormation privacy through\u00a0<\/span>f<\/span>ederal legislation.\u00a0<\/span><\/span>Representing the National Consumers League was Executive Director, Sally Greenberg.<\/span><\/span><\/p>\n <\/p>\n How did we get here?<\/strong><\/p>\n To set the scene, panelists\u00a0first discussed why there is consensus on the need\u00a0for\u00a0federal legislation\u00a0to address privacy and data security. The Snowden revelations showed consumers how\u00a0much of\u00a0their data is out there, and they\u00a0began to question whether companies could be trusted to keep their data safe\u00a0from the government.\u00a0More recently,\u00a0in light of\u00a0the Cambridge\u00a0Analytica\u00a0scandal and increasing instances of\u00a0identity theft and\u00a0fraud resulting\u00a0from data breaches, consumers have begun to question whether companies themselves can be trusted with their data.<\/p>\n Businesses are worried\u00a0about\u00a0lack of\u00a0consumer\u00a0trust\u00a0interfering with their adoption of\u00a0digital products and services.\u00a0For instance, parental refusal to provide consent to the collection and use of\u00a0data regarding their kid\u2019s academic performance prevents the personalization of\u00a0their children\u2019s learning experience. By providing individuals with greater privacy\u00a0protections, businesses hope that individual participation in the digital economy will increase.<\/p>\n In response to consumer privacy concerns, a patchwork of\u00a0state bills on privacy and data security are\u00a0also\u00a0popping up. Business claims to be\u00a0overwhelmed by the idea of\u00a0complying with\u00a0these\u00a0differing\u00a0regulatory schemes, especially\u00a0in light of\u00a0the EU\u2019s\u00a0General Data Protection Regulation<\/a>\u00a0(GDPR), which has already\u00a0moved\u00a0many organizations to comply with privacy and data security rules.\u00a0To support\u00a0businesses and\u00a0to\u00a0regain U.S. privacy leadership, greater\u00a0international operability is necessary.<\/p>\n What shoul<\/strong>d\u00a0federal legislation look like?<\/strong><\/p>\n Each panelist\u00a0set\u00a0forth their idea\u00a0of\u00a0what\u00a0federal legislation should aim to achieve.\u00a0Intel drafted a privacy bill<\/a>\u00a0which includes various\u00a0protections\u00a0but which lacks a private right of\u00a0action\u00a0\u2013 that is, the ability to take wrongdoers to court if\u00a0they violate privacy laws. If\u00a0companies promise not to use your information in certain ways and then do it anyway, in violation of\u00a0law, you should have the right to take them to court.\u00a0NCL\u2019s Sally Greenberg directed audience members towards the\u00a0Public Interest Privacy Principles<\/a>\u00a0signed by thirty-four consumer advocacy and civil rights organizations. Advocating in\u00a0favor of\u00a0strong protections, strong enforcement, and preemption,\u00a0and highlighting the importance of\u00a0\u201cbaking data privacy into products and services\u201d,\u00a0she\u00a0offered\u00a0NCL\u2019s\u00a0vision of\u00a0a strong, agile and adaptive national standard.<\/p>\n Panelists\u00a0drew comparisons between this approach and that of\u00a0the\u00a0EU\u2019s GDPR, but criticized the\u00a0time-consuming and resource intensive nature of\u00a0that legislation.\u00a0They agreed that\u00a0U.S. legislation\u00a0should avoid being too prescriptive in the details.\u00a0Rather than requiring documentation of\u00a0policies,\u00a0practices, and data\u00a0flow maps,\u00a0legislation should\u00a0focus on high-level issues.<\/p>\n Breaking down these\u00a0issues according to consensus and complexity,\u00a0Cameron\u00a0F. Kelly listed covered information, de-identification,\u00a0data\u00a0security,\u00a0state enforcement, accountability,\u00a0and\u00a0FTC authority\u00a0as solvable issues. Implementation issues, he said,\u00a0include\u00a0notice and transparency and\u00a0individual rights\u00a0(access, portability, right to object to processing, deletion, nondiscrimination). However, Mr. Kelly\u00a0noted that\u00a0disagreement clouds\u00a0a number of\u00a0complex issues. These relate to\u00a0algorithmic transparency, algorithmic\u00a0fairness, and data processing limitations (use restrictions). Until consensus is reached in these\u00a0areas, disagreements about\u00a0preemption and private right\u00a0of\u00a0action are unlikely to be\u00a0resolvable.<\/p>\n Notice and Transparency\u00a0<\/strong><\/p>\n While notice and transparency are important aspects of\u00a0a comprehensive approach towards privacy and data security, it is difficult\u00a0for consumers to process the volume of\u00a0information contained in privacy policies. Consumers also often have little choice but to \u201cagree\u201d to services that are essential to everyday life. As such, legislators may wish to explore the extent to which a company may\u00a0force an individual to waive their privacy rights as a condition of\u00a0service. Consent should only have a limited role in relation to sensitive data uses, and companies should\u00a0focus on designing user interfaces to enable meaningful\u00a0consumer consent.\u00a0Panelists criticized the\u00a0California Consumer Protection Act<\/a>\u00a0(CCPA)\u00a0for its lack of\u00a0detail and\u00a0for putting the burden on individuals to protect themselves. It was agreed that\u00a0federal standards should move beyond notice-and-consent and put the burden back on businesses.<\/p>\n De-identification\u00a0<\/strong><\/p>\n One panelist called de-identification the \u201csecret sauce\u201d to privacy. Preserving the utility of\u00a0data while removing identification puts the\u00a0focus on data processing harms. It is important to get de-identification right\u00a0for valuable research purposes. However, de-identification is often not done\u00a0well\u00a0and confusion lurks around\u00a0pseudonymization.\u00a0This technique involves replacing personally identifiable information\u00a0fields within a data record with artificial identifiers.\u00a0As data remains identifiable using that technique, data security\u00a0and privacy\u00a0risks remain. Companies must be incentivized to effectively de-identify data, to not re-identify, and to contractually restrict downstream users\u00a0from doing the same. To avoid conflating data security levels with\u00a0pseudonymization\u00a0levels, a universal and adaptable de-identification standard must be developed.<\/p>\n Data security\u00a0<\/strong><\/p>\n Because data security is critical to privacy, panelists agreed that it is the\u00a0foundation upon which privacy legislation should be built. Panelists warned against an\u00a0overly prescriptive approach towards data\u00a0security but\u00a0suggested that the\u00a0Federal Trade Commission (FTC) should offer more guidance. \u201cReasonable\u201d data security depends upon the nature and scope of\u00a0data collection and use.\u00a0This affords organizations\u00a0flexibility when adopting measures that make sense in terms of\u00a0information sensitivity, context, and risk of\u00a0harm.<\/p>\n However, determining data security standards according to the\u00a0risk of\u00a0privacy harm\u00a0is difficult because \u201crisk of\u00a0privacy harm\u201d\u00a0is an\u00a0unsettled and controversial concept. It was also debated whether \u201cinformation sensitivity\u201d\u00a0should be used\u00a0to determine\u00a0the\u00a0reasonableness of\u00a0data security standards. Public Knowledge argued that all data should be protected in the same way because the distinction between sensitive and non-sensitive data is increasingly questionable. When data is aggregated and sophisticated technologies such as machine learning are applied,\u00a0each and every\u00a0data point can lead\u00a0back to an identifiable person.<\/p>\n While use of\u00a0off-the-shelf\u00a0software should generally be considered reasonable, higher standards should apply to companies that are more aggressive in their data collection and use. Extending to third party processors and service providers, organizations must continually develop physical, technical, and legal safeguards. To ensure robust infrastructure to secure their data, they should run tests, impact assessments, and put resources towards data mapping.<\/p>\n Data processing limitations<\/strong><\/p>\n In sectors ranging\u00a0from education to healthcare, the use of\u00a0data undoubtedly\u00a0has\u00a0the potential to help us solve many\u00a0societal problems.\u00a0However,\u00a0data use is pervasive,\u00a0and\u00a0new\u00a0and\u00a0unpredictably\u00a0bad outcomes are\u00a0also\u00a0possible.\u00a0Consumers want data to be used in ways that benefit them,\u00a0for data\u00a0not to be used in ways that harm them, and\u00a0for their data to be protected.\u00a0However, information\u00a0collection\u00a0and sharing\u00a0is\u00a0largely unbounded.\u00a0If\u00a0Congress wishes to move beyond a notice-and-consent model and put\u00a0the burden back on organizations\u00a0that handle data, then the\u00a0boundaries of\u00a0how data should be collected, retained, used, and shared\u00a0must be confronted.\u00a0Without limitations, the high value of\u00a0data will continue to incentivize organizations to collect and retain data\u00a0for the sake of\u00a0it. These practices\u00a0increase cybersecurity\u00a0and privacy risks on unforeseen levels.<\/p>\n Calling out data brokers, Intel\u2019s David Hoffman stated\u00a0that databases containing lists of rape victims are simply \u201cunacceptable.\u201d\u00a0However, transfer restrictions are likely to be one of the hardest areas to reach consensus on.\u00a0Use restrictions, which relate to what organizations can and cannot do with data at a granular level, may be approached by creating presumptively allowed and presumptively prohibited lists.\u00a0Use and sharing could be presumptively allowed for responsible\u00a0advertising, legal process and compliance, data security and safety, authentication, product recalls, research purposes, and the\u00a0fulfillment of product and service requests. Meanwhile,\u00a0use of data for\u00a0eligibility determinations, committing fraud or stalking, or\u00a0for\u00a0unreasonable practices could be presumptively prohibited.<\/p>\n