Month: December 2023

Meta is now seeking a preliminary injunction to prevent the FTC from moving forward with its update to the 2020 order. 

Privacy advocates called the lawsuit’s legal theory “far-fetched” and a “kitchen sink constitutional attack,” saying Meta is trying to run out the clock to block the proposed changes. 

“A hearing before the FTC will confirm that Meta continues to mishandle personal data and put the privacy and safety of minors at risk, despite multiple orders not to do so,” John Davisson, litigation director at the Electronic Privacy Information Center, said in a statement.

Read more here. 

EPIC submitted comments to the White House Office of Management and Budget commending their strong step toward regulating AI use by federal government agencies, and recommending several ways to strengthen it.

Last month, the agency took a major step toward ensuring the federal government uses new AI technologies responsibly: it released draft guidance outlining federal agencies’ obligations and suggested actions around the responsible development, use, and procurement of AI technologies.

The draft guidance comes on the heels of President’s Biden Executive Order 14110, entitled “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence,” and incorporates previous federal efforts to manage the risks and impacts of AI technologies like the White House’s Blueprint for an AI Bill of Rights and the National Institute for Standards and Technology’s AI Risk Management Framework.

It has three overarching purposes: (1) established new agency roles, resources, and processes for managing new and existing government AI systems, including a new Chief AI Officer (CAIO) role to lead each agency’s implementation of the OMB draft guidance; (2) requires agencies to build internal processes to foster responsible AI innovation and adoption; and (3). sets out minimum AI risk management practices that most executive agencies are expected to follow when developing, procuring, or using AI systems that impact individuals’ rights or safety. These pra ctices include ongoing AI impact assessments covering an AI system’s intended purpose, potential risks, and relevant data; real-world performance testing to ensure reliability and risk mitigation in practice; independent evaluations of AI performance; annual AI monitoring; and consultations with affected and underserved communities.

EPIC recommends that OMB (1) enforce agency compliance with its AI guidance; (2) refine responsible AI provisions like AI impact assessments and AI use case inventory reporting to increase transparency and accountability for more types of AI systems; (3) increase agency data management practices through additional data minimization provisions and reinvigorated privacy impact assessment reporting requirements; (4) encourage AI adoption only where AI can serve as a curated tool to meet predefined agency needs; and (5) monitor national security systems and mandate AI risk management practices when they are used for other purposes covered by OMB’s AI guidance.

Senator Wyden published a letter today to the Attorney General revealing that the U.S. government and other foreign governments have “secretly compelled” Google and Apple to turn over information obtained from push notifications including both communications metadata and often the contents of communications. Push notifications are alerts from apps that pop up on phones, informing the user of a new message or reminder. Because these notifications are routed through centralized Google and Apple servers, the government can mine them for otherwise difficult to obtain data, like how often a person uses an app, or even what a particular push notification says. Also today, 404 Media today published a story detailing how the U.S. government compels tech companies to turn over push notification data. 

Senator Wyden urged the DOJ to permit Apple and Google to “be transparent about the legal demands they receive, particularly from foreign governments, just as the companies regularly notify users about other types of government demands for data.” The Senator also requested that the DOJ permit companies to reveal at least aggregate statistics on how often governments are accessing push notification data. 

Senator Wyden also recently revealed new details about the Drug Enforcement Agency’s Hemisphere program, now known as Data Analytical Services (DAS), a vast and highly-secretive surveillance authority run by the White House Office of National Drug Control Policy and the DEA. 

Senator Wyden’s letter came out in the midst of a bipartisan push to reform government surveillance in the U.S. EPIC and a bipartisan coalition of privacy, civil liberties, and civil rights groups have launched a campaign to significantly reform Section 702 of the Foreign Intelligence Surveillance Act and related surveillance authorities. Members of this coalition recently urged Senate Majority Leader Chuck Schumer to refrain from including any short-term reauthorization of FISA Section 702 in the continuing resolution or any other “must-pass” legislation.

Americans are rightly concerned about what information their devices may be collecting about them and their family, and businesses would be wise to learn the lessons of tech policy past and address data privacy and security issues now to avoid fragmented, reactive regulation later. In November, the Federal Communications Commission closed the reply comment period for PS Docket No. 23-239, “Cybersecurity Labeling for Internet of Things, Notice of Proposed Rulemaking” (IoT NPRM). EPIC, represented by the Georgetown Law Communications and Technology Law Clinic, joined by coalition partners, filed a reply comment to this NPRM, proposing several key elements in the best interest of consumers and which companies should embrace.

Given the label’s primary goal of ensuring consumer confidence in the cybersecurity of their IoT devices, we urged the FCC to adopt a dual-layer labeling solution. This solution would include an easily glanceable primary label and a secondary label that displays additional cybersecurity and privacy information, empowering consumers to make an informed purchase at point of sale.   For the vast majority of products, we supported the FCC’s proposal that the product itself contain a mark–a “U.S. Cyber Trust Mark.” To qualify for the U.S. Cyber Trust Mark, our proposal would require the product itself to collect only the data necessary to provide its essential functions and services, a principle called data minimization that has been promoted since the Fair Information Practice Principles (FIPPs) of the 1970s but not adhered to in recent memory (although some regulators are looking to change this). Companies should design the product itself to include the mark. Additionally, the product box should include a primary label which displays a information most critical to the consumer’s evaluation of the product’s relative cybersecurity, including the kind of data the device collects (e.g. video, audio, physiological, geolocation, etc.) per Carnegie Mellon University CyLab’s model. The primary label on the product box should also include a URL and a QR code to connect the consumer to a website which hosts a secondary label that displays a set of more detailed information regarding the privacy and cybersecurity of the device. 

Our vision for the label also builds in cybersecurity best practices through a robust enforcement regime. Cybersecurity is a constantly evolving field, and capturing compliance at a single point in time is not enough to ensure consumer protection. We urge the FCC to conduct periodic recertification and post-certification audits to ensure that IoT device companies stay current in their cybersecurity practices. Additionally, we urge the FCC to implement a short cure period for devices discovered to be noncompliant with label obligations and representations. While robust enforcement of the label is necessary for success, immediate punishment does not fix the device vulnerability, leading to greater consumer risk. By using a short cure period, the FCC will incentivize companies to quickly patch any vulnerabilities, leading to safer devices for consumers.

Finally, and perhaps most importantly, we urged the FCC to not allow the label to be used as a…

John Davisson, the director of litigation and senior counsel at the Electronic Privacy Information Center, told The Capitol Forum that this draft regulation is a “significant potential step” for privacy law.

“The board appears to be trying to make the most of what the California Consumer Privacy Act authorizes them to do, and to really put teeth into the automated decision-making pieces of this,” Davisson said.

…

Davisson told The Capitol Forum that he hopes the CPPA will consider including a universal opt-out option for consumers, like they have done in the past, so that consumers do not have to continually opt-out for every company they interact with.

“If you are constantly being barraged with requests to manage your privacy settings at a granular level, it very quickly becomes exhausting and exasperating,” Davisson said. “And people will just click through and consent to everything. It’s important for these obligations to lie with the companies rather than with individuals or having to manage everything at a granular level.”

(Subscription newsletter)

This state-level push is not aimed at seeping across all 50 states but rather at tightening regulation in enough places to compel the industry to adopt a de facto national standard. Privacy advocates are striving to enact state-level proposals that align closely with the ADPPA, including limitations on data collection and sharing, establishing a data broker registry, and creating new rights for Americans to delete their data. 

However, this approach faces challenges from an industry-led campaign that has successfully enacted weaker laws in states like Virginia and Utah. The Electronic Privacy Information Center, a D.C.-based nonprofit, is spearheading the multi-statehouse push among privacy advocates, targeting states like Maryland and Michigan to introduce state versions of ADPPA. 

Read more here.