White House Big Data Report to Suggest ECPA Update, Set Yearlong Research Agenda

No serious legislative proposals on consumer privacy or a comprehensive suggested update to the Electronic Communications Privacy Act (ECPA) are expected, said privacy and industry advocates who met with the White House during the process. Stakeholders told us they expect any ECPA revisions offered in the report to include a carveout for some federal agencies like the Securities and Exchange Commission, which both industry and privacy groups have argued against (WID April 28 p6). They were also not expecting the report to reiterate the long-dormant promise of a White House consumer privacy legislative proposal, which was originally supposed to emanate from a 2012 White House privacy report (WID Dec 1 p1). Nor are stakeholders holding their breath for a federal data breach and notification proposal. “Unfortunately, I don’t think they're going to do that,” said Interactive Advertising Bureau (IAB) General Counsel Mike Zaneis. “We didn’t talk about those issues” in meetings with the White House, he said.

The report is, however, rumored to advise updating the “outdated” Fair Information Practice Principles (FIPPs), said Daniel Castro, director of the Center for Data Innovation, which is part of the Information Technology and Innovation Foundation (ITIF). Privacy advocates have called the FIPPs -- FTC guidelines for handling electronic information -- a possible basis for consumer privacy legislation, while others have called them a barrier to economic innovation (WID April 1 p3).

The report will conclude the three-month series of White House meetings and workshops with tech sector industry groups, CEOs, academics and privacy advocates. President Barack Obama, during his major speech on government surveillance in January (WID Jan 24 p8), deputized Counselor to the President John Podesta to lead the big data review. White House Chief Privacy Officer Nicole Wong has also been integral to the review, speaking at the public workshops (WID April 2 p1, March 19 p2, March 4 p3) and sitting in on meetings with both privacy and industry groups, said Zaneis and Center for Digital Democracy (CDD) Executive Director Jeff Chester.

Podesta confirmed the ECPA update proposal in a weekend interview with The Associated Press (http://apne.ws/1jWwZfz). He had previously suggested the report might challenge Supreme Court decisions that the Fourth Amendment does not apply to third parties holding records, which can include personal emails and Google Docs (WID March 4 p3). Under current law, ECPA requires federal agencies to obtain a warrant only to access electronic information locally stored on a personal computer or smartphone. In his AP interview, Podesta said the report would offer an ECPA update proposal but didn’t elaborate.

Observers said the update will likely exempt some federal agencies from needing a warrant to access this third party-held electronic information. “I'm hearing the White House will announce support for ECPA reform but only with some kind of exception for civil agencies,” TechFreedom President Berin Szoka told us. That expectation has both privacy and industry groups worried. American Civil Liberties Union Legislative Director Chris Calabrese told us “one thing we're very concerned about is what the support for ECPA [revamp] might look like.” A civil agency exception “would be problematic,” said Direct Marketing Association (DMA) Vice President-Government Affairs Rachel Thomas. “The most important thing for us is that there be a strong warrant for content provision that applies across the government.”

Pending Senate and House bills would implement a government-wide warrant requirement to access third party-stored electronic content -- HR-1852 and S-609. It seems unlikely the report will come out in support of either if it remains in favor of the civil agency carveout, said stakeholders. The government has been “talking about a civil warrant of some sort,” said Calabrese. “That would be pretty unprecedented.” And poorly received, Szoka said: “Needless to say, this will outrage the broad left-right coalition that has demanded ECPA reform and would be a disaster for privacy."

Podesta also confirmed in his interview the report’s focus on possible harms of big data. Because the FTC and lawmakers have already addressed these issues through hearings, studies and bills, it “makes sense to have the White House engaged in that conversation as well,” said DMA’s Thomas. ITIF’s Castro said he thinks the harms the White House presents will “focus more on limiting harmful uses than on collecting data, since most of the concerns expressed in the workshops were around things like discrimination based on analytics and prediction.” The three White House workshops covered the technology supporting big data, such as data analytics, the social and ethical concerns big data creates and possible policy solutions. If the report centers on big data discrimination, it should also address broader questions such as “will there be redress for data-based decisions?” said Indiana University School of Law professor Fred Cate, who runs the school’s applied cybersecurity research center and presented at the final White House workshop. Discrimination is “one of many critical issues presented by big data,” he told us.

Both the marketing and the privacy groups said there was value to the discrimination discussion. CDD’s Chester called it “a major step forward” if it’s presented in the report. IAB’s Zaneis agreed “we should have that discussion” about where the actual data use harms are. But Chester thinks “the majority of the report is going to be a glowing love letter to the big data industry,” given the White House’s relationship with Google and Facebook, he said. The White House’s Wong was formerly deputy general counsel at Google. DMA and IAB told us they met with the White House staff to discuss the value of data-driven marketing and each group’s self-regulatory ethical code of conduct forbidding data use for non-marketing purposes. DMA’s Thomas and Zaneis told us they think those aspects will be included in the report. “DMA has been very much involved in the review,” Thomas said.

The report will map out future big data research and possibly funding proposals, said those we interviewed. Wong met with CDD and the Electronic Privacy Information Center and told the groups “this is just the beginning,” said CDD’s Chester. The National Science Foundation will join with organizations like New York University’s (NYU) recently launched Data & Society Research Institute (http://bit.ly/1nD58HK) and academics like NYU professor Danah Boyd, who specializes in digital teen privacy, Chester said. The report may also tap the National Institute of Science and Technology “to see if there’s more research to be done,” said the ACLU’s Calabrese. That could include suggestions for the grant-making arms of the government to direct funds toward specific privacy-enhancing technologies, he said. Or the report might create sub-working groups or multistakeholder groups to focus on more specific issues meriting more attention, said Zaneis.

But despite numerous wide-ranging expectations and predictions, “I think everybody is kind of scratching their head, wondering where they're going with this,” said Zaneis.