White House Big Data Report Changes Conversation, But Vagueness Worries Some

It’s a notable shift, said privacy advocates and academics in interviews and statements. Notice and choice “has failed as an organizing framework” for the big data discussion, said Berkeley Law professor Deirdre Mulligan, who co-directs the Berkeley Center for Law and Technology and participated in the White House review (WID April 2 p1). With this report, the White House is now “talking about a broader surveillance culture,” with discrimination and fairness at the center, she said.

The report urged Congress to pass data breach notification legislation and an update to the Electronic Communications Privacy Act (ECPA). The ECPA update has been a constant call across the spectrum, from conservative groups to industry groups to privacy groups. “Congress should amend ECPA to ensure the standard of protection for online, digital content is consistent with that afforded in the physical world -- including by removing archaic distinctions between email left unread or over a certain age,” the report said.

The language suggests any ECPA update should not include an exemption for any government agency, said observers. Earlier this week, stakeholders who participated in the review told us they expected to see certain government agencies exempted from any ECPA update suggestion (WID April 30 p1). The way it’s written, the report “seems to call for a warrant” that would span all government agencies wishing to access remotely stored electronic data, American Civil Liberties Union Legislative Counsel Chris Calabrese told us. “It’s a really positive development.” A possible government agency carve out in an ECPA update has been a sticking point between the administration and numerous stakeholders (WID April 21 p1).

But the fine print on ECPA lacks specifics, cautioned TechFreedom President Berin Szoka in an interview. “They've worded it to carefully say as little as possible on the real question,” of whether specific government agencies -- such as the Securities and Exchange Commission -- could be exempted from any warrant requirement. Pritzker said the policy recommendation doesn’t refer to any specific legislation pending in Congress and is intended to “try to set in motion an acceleration of the Hill’s consideration of a bill, which has stalled,” she said. Senate Judiciary Committee Chairman Patrick Leahy, D-Vt., lauded the move. “I am working with Senator [Mike] Lee [R-Utah] and many others in Congress to update this law for the digital age,” he said in a statement. “It is clear that momentum is on the side of reform, and now it is time for the Congress to respond."

The report also puts the Commerce Department in charge of reviving a long-stalled comprehensive privacy legislative proposal (WID Dec 1 p1), Pritzker said. While Center for Digital Democracy Executive Director Jeff Chester worried “the report further delays the release of a legislative proposal,” many welcomed the updated push with its focus shifted away from notice and choice. Interactive Advertising Bureau General Counsel Mike Zaneis said the White House’s earlier attempts at producing privacy legislation in this fashion had stalled. “So we disagree with the report’s assumption that this process would necessarily lead to that outcome,” he told us. “Establishing a legislative goal before clearly identifying the problem and scope of work could set the process up for failure."

Observers said the report set important privacy precedent in other areas. It recommended privacy protections granted to citizens -- enshrined in the 1974 Privacy Act -- be extended to non-U.S. persons. It also emphasized the administration’s key role in ensuring data collected on students is used exclusively for education purposes. Counselor to the President John Podesta -- who led the review -- said during Thursday’s conference call the administration could largely accomplish both goals without congressional help. He said expanding privacy protections to non-U.S. persons could take up to a year, given the time it will take for the government to comb through its databases. “This commitment to transparency is essential if we want to enable this sort of conversation about what privacy means going forward,” Berkeley’s Mulligan said.

Although Podesta acknowledged the work on student data could require future updates to the Family Educational Rights and Privacy Act (FERPA), he said the administration could make significant progress on its own. Sen. Ed Markey, D-Mass., who has repeatedly promoted the use of student data only for educational purposes, said the recommendation was “shining a light” on an important privacy issue. “We need to be aware of any privacy problems that are posed to students when their personal information is in the hands of private companies,” he said in a statement. “Parents, not schools, have the right to control information about their children, and I plan to introduce legislation in the coming weeks that will ensure a child’s educational record is not sold as a product to the highest bidder on the open market.”

As expected, the National Institute of Standards and Technology will play a role in ongoing research, Pritzker said. It “will help support our public-private efforts in technology standards and research in this area,” she said. Podesta also encouraged the FTC to promote its privacy work. “We'll encourage them to be more public with their analysis,” like the commission’s soon-to-be-released report on data brokers, he said.