Connect with us

Privacy

Republican and Democratic Senators Agree that Big Tech is Hoarding the Value of Consumers’ Digital Data

Published

on

Photo of Senate Banking Committee hearing by Masha Abarinova

WASHINGTON, October 25, 2019 – A growing bipartisan consensus emerged from a Thursday Senate Banking Committee hearing that technology companies are improperly extracting the bulk of the value of consumers’ online digital data.

Private companies are collecting and analyzing individual data for all kinds of purposes, said Committee Chairman Mike Crapo, R-Idaho., in his opening remarks. More personal information is available to companies than ever before and people have questions about how this data is used.

It’s crucial to identify the concept of data ownership, Crapo continued. Moreover, individuals are concerned with the worth of their data in the marketplace and how they can make use of it themselves.

Americans, not Silicon Valley CEOS, should have control over their private information, said Ranking Member Sherrod Brown, D-Ohio. Privacy isn’t partisan but a basic right. Big tech companies don’t make money off protecting privacy, he said, hence why they aren’t acting in that area.

Individuals should know what information is being collected at the granular level, said Sen. Mark Warner, D-Va. They should know their data’s worth and the contact it has with third parties.

There’s nothing “free” about what companies like Facebook and Google are offering, Warner said. Established companies don’t want more transparency about how data is monetized and whether it differentiates among individuals.

Whether or not data is considered property, said Sen. John Kennedy, R-La., companies are making money off its value. Out of the 95 billion dollars Facebook made last year, he said, most of the revenue came from targeted advertisements.

In response to the committee members’ concerns, the witnesses emphasized the need to address and reform privacy legislation.

Matching privacy law to the European Union’s GDPR is not enough, said Jeffrey Ritter, founding chair at the American Bar Association Committee on Cyberspace Law. The US needs to address and define ownership rights of personal information, so that the rights of data subjects are more readily enforced and commercial innovation built around personal information can thrive.

Domestic laws governing electronic transferable records, Ritter said, can help craft the legal concept of data ownership. Recognizing data ownership should not diminish a data subject’s rights or existing federal laws governing financial systems.

Privacy legislation needs an affirmative consent-based model allowing users to opt in or out of sharing their data, said Chad Marlow, senior advocacy and policy counsel at American Civil Liberties Union. California and Maine, for example, are states that have taken some steps to advance individual’s control over their personal information.

Treating data as property, Marlow added, would distract policymakers from pursuing meaningful privacy legislation. The private sector entrepreneurs advocating for this model, he said, want to use the government’s power to mandate that the data-selling marketplace is advertised to individuals at the time their information is being collected.

Additionally, he said, financially secure Americans will find it easier to opt out of the data as property model, whereas lower-income individuals may have significantly fewer choices in the matter.

Although data property rights are risky, said Will Rinehart, director of Technology and Innovation Policy at American Action Forum, there will be serious costs involved with any new privacy law, especially with compliance. Regulations will force firms to retool data processes and change the investment dynamics of the affected industries.

Not only is a property right not needed to establish consumer rights, said Rinehart, but it would be economically inefficient to do so.

The American economy has largely forgotten the data user, said Michelle Dennedy, CEO at DrumWave Inc. The greater the data set, she said, the less value individual data has for a company.

Rather than trying to analyze all of a user’s transactions, Dennedy said, the goal should be to identify errant or inaccurate transactions. Perhaps analyzing different aspects of an individual’s online worth, such as copyright, participation or branding can form a new type of privacy right.

Privacy

Colorado and Virginia Lead In Consumer Privacy Legislation, Still Need Federal Law, Conference Hears

Both states join California as the only ones with comprehensive privacy laws, but experts say a federal bill should fill the regulatory void.

Published

on

Stacey Gray, senior counsel at the Future of Privacy Forum.

WASHINGTON, November 30, 2021 – Amid the lack of comprehensive privacy law at the federal level, states across the nation join California to take privacy matters into their own hands.

California was the first state to adopt privacy legislation with its California Consumer Privacy Act (CCPA) in 2018, followed by the California Privacy Rights Act of 2020 (CPRA). In 2021, Virginia and Colorado enacted their own privacy laws, which will go into effect in 2023.

At the Federal Communications Bar Association’s annual privacy symposium on November 16, privacy experts celebrated Colorado’s and Virginia’s progress amid an industry-wide push for a comprehensive federal privacy law.

Virginia’s and Colorado’s privacy laws align with California’s CPRA by applying many of CPRA’s concepts: the scope of data covered by the law is the same, and all states impose data use restrictions that limit a company’s ability to analyze and share consumers’ personal information.

Further, all states impose affirmative duties on data processing entities. Colorado’s privacy law, however, sets itself apart by using a heightened standard for businesses to obtain a customer’s agreement to process their personal data. Colorado’s attorney general also has broad policy-making authority in the bill, making Colorado’s attorney general an effective state enforcement regime.

Drawbacks to piecemeal legislation

Despite the relative uniformity between the three states’ legislation, privacy experts agree that widely differing privacy frameworks sets the industry up for a messy regulatory compliance landscape.

Stacey Gray, senior counsel at the Future of Privacy Forum, said a lack of interoperability makes compliance across multiple states more difficult. “This is a huge issue with three states with different frameworks,” she said. “Lawmakers are getting a big push not to regulate differently or creating direct conflict with different states. That’s why [the] other proposals have similar basic language and features.”

Gray also pointed to differing frameworks for service opt-in and opt-out models as another point of tension. “We should explore what Colorado and California have done, which is include a global opt-out for browsers or internet plug-ins that communicates [opting out] to every company in the ecosystem of a person’s data,” she added.

Although Gray said she believes that a federal privacy bill is the best way to develop a national standard, she sees growing state interest as an inevitable product of growing data harms affecting consumers.

“It really started in the past few years and is snowballing,” she said. “Between the passage of the European Union’s General Data Protection Regulation, the Cambridge Analytica scandal, California’s law in 2018, some federal momentum, and the role of the media…there’s been an increasing state interest in these issues. There’s a motivation to protection residents in their own states.”

Federal privacy law is still best

Consumer privacy bills were considered in 26 states this year, and only Colorado and Virginia made it past the finish line. As lawmakers are getting ready for sessions in early 2022, stakeholders are preparing to push for greater privacy legislation across the nation regardless of any federal action. ‘’

Gray argues that a federal law would be the best authority for a nationwide privacy standard. “The federal standard would be ideal,” Gray said. If there is no action on the federal level and we’re left with the states, then states should continue enacting privacy laws, she said. “But we should tackle this at the federal level to get a standard that applies nationwide. We already have hundreds of privacy laws in various sectors that supplement HIPAA, students and privacy, and even long-standing narrow laws like paparazzi and school records,” so more state laws could be hard for businesses and entities to navigate and comply.

Still, there may be benefits to testing privacy laws on the state level before enforcing the legislation nationwide. “States are the laboratory for democracy,” said Ryan Kriger, assistant attorney general in Vermont’s attorney general public protection division.

“We have three laws in the books now to look at,” Kriger added. “It’s a huge benefit for states to test things out and see how things work, as well as finding ways to make an existing law better by applying it to the states.”

Continue Reading

Privacy

Federal Trade Commission Should Make Privacy Rules Against ISP Data Collection, Experts Say

To protect consumers in the digital revolution, experts say serious federal action on privacy can lead the way.

Published

on

Photo of Alan Butler, executive director of the Electronic Privacy Information Center

WASHINGTON, November 30, 2021 – Privacy experts are calling on the Federal Trade Commission to start the process of empowering itself to penalize internet service providers that collect unnecessary data from their customers to push targeted advertisements.

While discussions on privacy matters have overwhelmingly been focused on big technology companies and how they use customer data, experts at a Federal Communications Bar Association privacy symposium on November 16 said ISPs should be in the crosshairs of federal regulators.

Specifically, according to Alan Butler, president of the Electronic Privacy Information Center, unnecessary ISP data collection “demands action” from the FTC.

“The current status is that internet service providers are within the jurisdiction of the FTC and the FTC should act” and not wait for other federal actors to initiate ISP consumer privacy rules, said Butler. In 2017, Congress voted to disallow the Federal Communications Commission, which regulates the telecom space, from making regulations on protecting ISP consumer privacy, leaving the door open for the FTC to regulate providers’ privacy practices.

But there’s a wrinkle. While the agency can investigate and penalize business practices that are “unfair” and “deceptive,” according to the Federal Trade Commission Act, the FTC cannot issue its own federal privacy rules under its current consumer protection authority. To do that, the FTC would need to initiate a policy-making process by which the agency develops and issues regulations, which can then become federal policy.

Some experts think the FTC would be the best entity for developing such rules and should start the process, while others think the FTC’s regulatory process wasn’t made to give the agency its own privacy authority.

A separate federal agency for privacy regulation

As the FTC could receive funding to establish a privacy bureau under the House of Representatives’ reconciliation bill, Butler left open the question of whether the FTC should proceed by issuing broad privacy regulations or whether it should be should be “parsed out” into specific issues.

“The FTC has to adopt rules that establish fair data practices and seek to protect secondary data uses and sensitive data,” such as customers’ biometric and demographic data, he said. Butler said FTC privacy regulations would be a “temporary solution,” but there must be a separate federal agency that regulates privacy in the United States. “Funding for an FTC privacy bureau in the reconciliation bill is an important step forward,” he said.

The law at play for an FTC privacy authority

The FTC’s ability to regulate privacy would be governed by the Magnuson-Moss Warranty-Federal Trade Commission Improvement Act. The Magnuson-Moss Act is notorious for adding several steps beyond the normal federal policy-making process, including a requirement that the FTC must find the problematic conduct to be “prevalent” in the marketplace.

“Magnuson-Moss was designed to choke off the FTC’s ability to engage in rulemaking,” said Georgetown law professor David Vladeck. Issuing privacy rules from the FTC would hard, he says, because the FTC must clear substantial hurdles before it can enforce any privacy rules.  “There’s a clear implication that the FTC is not able to promulgate a rule unless it can prove to a court after the rulemaking is done that the intrusive conduct is ‘prevalent.’ Well, Congress doesn’t define ‘prevalent,’” he added.

Butler argued that finding prevalence of data abuse won’t be hard. “The FTC wouldn’t struggle to find issues that are endemic to the industry,” he said. “The [agency] is capable of finding that its widespread use of location data unrelated to the use of the service as prevalent in the marketplace, and online behavioral tracking.” Thus, Butler argues, the FTC would be able to prove that data abuse substantially harms consumers and correctly uses its [proposed] authority to enforce privacy rules against technology companies.

Earlier this year, FTC chair Lina Kahn approved revisions to its Magnuson-Moss procedures, making it easier for the FTC to conduct its process for developing and issuing privacy rules. The rules grant the chair the authority to serve as the Chief Presiding Officer of the rulemaking hearing process, grants the commission the authority to control the conduct of the informal hearings, and eliminates a rule requiring the commission staff to publish a report analyzing the final rule before it is established as official agency policy.

Kahn said the changes to the rulemaking process will remove “extraneous and onerous procedures” that only delay the issuance of FTC rules.

FTC process could “surface” issues

Despite the difficulty of issuing privacy regulations, Vladeck said there may be value in initiating the process anyway, including “to surface the issues” of privacy and data collection by ISPs.

Vladeck highlighted “illegal dark patterns” as an example of a narrow issue the FTC can go after. The FTC characterizes “dark patterns” as methods companies use to keep consumers trapped in subscription services.

“The FTC is the only policeman on this beat,” Vladeck said, adding it could act as an effective enforcement regime against data abuses that affect consumers.

Continue Reading

Cybersecurity

House Oversight Reveals Details of Investigation into Colonial Pipeline, Other Company Hacks

The committee released a memo stating that “small lapses” led to many prominent cyberattacks this year.

Published

on

Oversight and Reform Committee Chairwoman Carolyn Maloney, D-New York

WASHINGTON, November 17, 2021 – A House Oversight and Reform Committee investigation concluded in a staff memo that “small lapses” in cyber security led to hacks of Colonial Pipeline, meat producer JBS USA, and insurance group CNA Financial Corporation that occurred earlier this year.

Additionally, in Tuesday’s memo, the committee stated that the companies’ lack of “clear points of contact with the federal government” hampered response efforts to the attacks and that the companies faced a “huge” amount of pressure to pay hackers. Cyber security officials on Tuesday asked Congress to push legislation that would force companies to notify the government about cyber breaches.

The CNA hack occurred after an employee accepted a fake browser update and hackers gained access to JBS through an old account with a weak password that had not been deactivated. Colonial Pipeline was hacked as a result of just one stolen password linked to a profile, leading to gas shortages in several states.

Employees at JBS and Colonial Pipeline may have been operating on Internet of Things devices, which often only make use of mass-produced factory password settings due to limited processing power. This makes such devices extremely vulnerable to cyberattacks.

“Even large organizations with seemingly robust security systems fell victim to simple initial attacks, highlighting the need to increase security education and take other security measures prior to an attack,” reads Oversight’s memo.

Security issues for schools and libraries

Experts say that similar issues with IoT and password security are increasingly threatening cybersecurity in schools and libraries as well. During a School, Health and Libraries Broadband Coalition event Wednesday, leaders in education emphasized data that shows attacks on the educational sector to continue increasing in frequency from a rate that already ranks second among all professional sectors.

Amy McLaughlin, executive director of technical and solutions architecture for Oregon State University, suggested during the event that schools and libraries expand their security beyond basic firewall that is paid for by E-rate funding and change default passwords when possible, avoiding using an administrator login, patch systems, as well as use anti-malware software on all devices.

Similarly, Bob Turner, field chief information security officer for higher education at Fortinet, stated that his organization recommends schools use multi-factor authentication.

The recently signed Infrastructure Investment and Jobs Act specifically allocates funding to be used for the implementation of improved cybersecurity practices in institutions including libraries, cyber security officials said Tuesday.

National security concerns

In June, Oversight and Reform Committee Chairwoman Carolyn Maloney, D-New York, told CNA, JBS USA and Colonial Pipeline via letters that she was “extremely concerned that the decision to pay international criminal actors sets a dangerous precedent that will put an even bigger target on the back of critical infrastructure going forward.”

During an Oversight and Reform panel Tuesday, committee members questioned witnesses on the efforts by President Joe Biden’s administration to push back on recent ransomware attacks by Russian-based cybercriminals.

Continue Reading

Recent

Signup for Broadband Breakfast

Get twice-weekly Breakfast Media news alerts.
* = required field

Trending