How Billionaires, Corporations, and the Government are Battling for Your Private Data

Our new Tech Column was made possible by the fine folks at Mozilla Firefox.  The nonprofit Mozilla Foundation believes the Internet must always remain a global public resource that is open and accessible to all.  And that’s why we love Firefox.

Guest Post by SHAHID BUTTAR

2018 was a rough year for people who use the Internet, as distinguished from the bots that now account for a majority of online traffic, or the corporate behemoths that continue to monetize us. One bright spot, however, offers reasons for cautious optimism. Facebook, in particular, has screwed the user privacy pooch so many times that mounting global public outrage at Silicon Valley’s corporate carelessness is finally forcing policymakers to pay attention and consider potential interventions.

Unfortunately, the only thing more apparent than corporate attitudes towards users (hint: “they don’t really care about us”) is that most Members of Congress are profoundly ignorant about tech, tech policy, and our Constitution. When senior executives from Facebook and Google have appeared before their committees, congressional interlocutors have wasted their opportunities by repeating meaningless platitudes, grandstanding, dangerously inviting government censorship, and frankly asking foolish questions that any 12-year old could answer. Who lets these people in the room, anyway?

Process: A Policy Circus

Fortunately, our constitutional design encourages experimentation in policy. That’s one way to think of the 50 states within the Union. Supreme Court Justice Louis Brandeis described them as “laboratories” in which policies could be observed before expanding across the rest of the country. Few experiments today are more compelling than one currently underway in Sacramento.

California’s AB 375 is the nation’s first broadly applicable consumer data privacy law. It restores broadband privacy rules repealed by Congress under Trump, allows users greater transparency into corporate data collection practices, empowers users to compel companies to delete information collected from them, prohibits companies from selling data from users (or even collecting it in the first place) without their consent, also prohibits companies from retaliating against users who exercise these rights. The law also has several gaps that advocates have called for policymakers to address.

Remarkably, the bill was enacted unanimously by the state legislature—and signed into law by the governor—within a single week of its introduction. Such legislative alacrity is rare, to say the least.

Before thinking this speed and unanimity reflected an underlying consensus, however, note the preceding context. A state ballot initiative sponsored by billionaire real estate developer Alastair MacTaggart threatened even broader measures, modeled in some respects on the Global Data Protection Regulation that became effective in the E.U. this spring. MacTaggart agreed to withdraw the initiative only after state legislators promised to enact something—which remained unspecified at the time—instead.

The initiative terrified companies, as well as state policymakers. Companies were concerned about needing to comply with the rules, which could threaten some predatory or opaque business models by, for instance, requiring companies to obtain the informed consent of users before collecting any information about them online. Legislators, meanwhile, were concerned because ballot measures have high procedural obstacles to later amendments, which can effectively freeze in place a regulatory structure even if only half-baked.

Substance: A Policy Laboratory

Other states, like Vermont, have recently adopted less ambitious laws that aim to curtail the worst practices of online data brokers. They have illustrated some of the challenges in protecting users online, as well as the danger of Congress stepping in prematurely to impose its ignorance on states that might be inclined to do more to protect users.

In the wake of AB 375 becoming law in California, the state Attorney General’s office has begun crafting regulations that would govern how it would be applied in practice.

One of the key questions is the role of the Attorney General’s office in the first place: the original version of the ballot measure included a right of private action (which would empower users and class action lawyers to enforce the law’s provisions). The bill enacted by the legislature, however, reserved much of that authority to the state Attorney General’s office, which lacks the resources to effectively enforce the law.

Put simply, the state legislature offered wiggle room to Silicon Valley companies that the ballot measure did not. That theme repeats in several other areas, from inviting companies to seek advisory opinions on the taxpayer dime and allowing them a period to cure potential violations before facing government enforcement, to limiting security requirements to only some kinds of sensitive data (such as Social Security numbers) while leaving others (such as passwords and mailing addresses) at greater risk.

A Ball Still in the Air

Researchers at Princeton and Northwestern have empirically determined the democracy in America is broken, insofar as our public policy responds not to popular preferences, but rather the demands of corporate capital. The story of our nation’s leading consumer data privacy law may uncomfortably reinforce that conclusion, even as it advances privacy interests shared by a broad swath of Americans across the ideological spectrum.

Over the course of 2019, state policymakers will continue to wrangle with self-interested corporations, an outraged and frustrated public, advocates for privacy and user rights, an activist billionaire, and the looming possibility of Congress stepping in to pre-empt experimental state policies.

Bored of watching Netflix and Hollywood? Look no further than Sacramento for a compelling saga, and consider attending the Attorney General’s public forum in San Francisco next Tuesday to learn more. Unlike dramas scripted for the big screen, this one could dramatically impact what appears on your’s—and how much control you have over it.