Month: April 2024

On April 17, EPIC submitted comments to the UK ICO on its call for views relating to “Consent or Pay” business models. In its comments, EPIC urged the ICO to prohibit the use of the facially illegal business model due to the clear violation of the UK GDPR’s definition of consent. Under the UK GDPR, consent must be “freely given, specific, informed, and unambiguous.” Forcing users to pay a fee or lose access to a website if they don’t want their data to be processed for targeted advertising is anathema to the rigorous standard of consent needed under the UK GDPR and does not pass the muster under the UK ICO’s own guidance on consent. There is no fee that would ever be appropriate to sell a UK citizen’s fundamental right to privacy and data protection, so the UK ICO should prohibit the practice.

This call for views comes on the heels of a November 2023 decision by the European Data Protection Board (EDPB) stating that Meta was in violation of the EU GDPR for processing personal data for targeted advertising without an appropriate lawful basis to process such data. Following the decision, Meta rolled out its “consent or pay” business model, where it offered a “free” version of its social media platforms where Meta would continue to process personal data for targeted advertising as well as a paid version of the platform that would not process personal data for the purpose of targeted advertising. The Norway, Dutch, and Hamburg Data Protection Authorities requested an opinion from the EDPB regarding the legitimacy of this business model. Twenty-eight organizations, including EPIC, sent a complaint to the EDPB in February 2024 requesting that the EDPB prohibit “consent or pay” business models based on the irrevocable harm to the fundamental rights to privacy and data protection. On April 17, the EDPB released its decision, holding that “in most cases, it will not be possible for [platforms using a “consent or pay” business model] to comply with the requirements for valid consent[.]”

EPIC has long advocated for robust safeguards to protect consumers from exploitative data collection, use, distribution, and retention practices both in the United States and abroad. EPIC has filed amicus briefs, regulatory comments, and supported legislation with comprehensive data minimization provisions to protect consumers from commercial surveillance regimes.

The Department of Health and Human Services published a final rule this week strengthening privacy protections for reproductive health information. The rule extends the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by prohibiting regulated entities from using or disclosing personal health information for the “mere act of seeking, obtaining, providing, or facilitating reproductive health care.” This is an important reproductive privacy safeguard for millions of Americans, particularly in the wake of the U.S. Supreme Court’s decision invalidating the constitutional right to abortion in Dobbs v. Jackson Women’s Health Organization. As EPIC wrote in its comments to HHS, the collection and misuse of reproductive health information post-Dobbs can expose people to undue criminalization under newly-enacted state laws and deter others from seeking reproductive health services even where they are legal.

Although HHS has concluded the current rulemaking, EPIC continues to support two further amendments to the HIPAA Privacy Rule set out in its comments. First, the Rule should protect reproductive health care provided in every state, including states that have banned or severely limited access to abortion and other reproductive health services. As adopted, the new rule only covers PHI concerning reproductive health care that was lawful in the jurisdiction in which it was obtained. Second, HHS should adopt a warrant requirement for law enforcement access to PHI. While the changes finalized this week require a signed attestation from law enforcement that they are not seeking PHI related to reproductive health care for any prohibited purpose, HHS should strengthen these protections and bring the Privacy Rule in line with the Fourth Amendment by establishing a warrant requirement supported by probable cause.

EPIC regularly files comments on proposed rules to protect the privacy of personal information and advocates for reproductive privacy and other health privacy protections. EPIC released a statement in 2022 opposing the Supreme Court’s rollback of the constitutional right to abortion and published an analysis of reproductive privacy after the overturning of Roe v. Wade.

President Biden has signed H.R. 815, which includes the Protecting Americans’ Data from Foreign Adversaries Act of 2024. Under the law, data brokers are prohibited from selling, transferring, or providing access to Americans’ sensitive data to certain foreign adversaries or entities controlled by foreign adversaries. 

Under the law, sensitive data includes identifiers such as social security numbers, geolocation data, data about minors, biometric information, and private communications. “Information identifying an individual’s online activities over time and across websites or online services” is also considered sensitive data.

A report by the Irish Council for Civil Liberties last year found that sensitive information about U.S. political figures, members of our military, and other high profile targets can be obtained by China and other foreign advertising through the ‘real time bidding’ system used by data brokers to target online ads.

“There is an urgent need to rein in data brokers, who are profiting off the sale of our most sensitive data and putting Americans at risk,” said EPIC Executive Director Alan Butler. “This law is an important step in the right direction in providing specific protections for sensitive data. But EPIC believes it is long past time for Congress to enact comprehensive privacy protections that include a strong data minimization standard, protect civil rights online, and provide for robust enforcement to stop harmful commercial surveillance practices.”

EPIC has long supported heightened protections for sensitive personal data, including in congressional testimony supporting the proposed American Data Privacy and Protection Act, in EPIC’s proposed State Data Privacy and Protection Act, and in comments on the Federal Trade Commission’s commercial surveillance rulemaking. EPIC has also backed strict prohibitions on the sale of personal information by data brokers, including in comments on the Consumer Financial Protection Bureau’s Fair Credit Reporting Act rulemaking.

Moreover, experts question why the onus for privacy protection should land on individuals. “Web browsers and web pages should operate with those protections baked in,” said Sara Geoghegan, Counsel to the Electronic Privacy Information Center (EPIC), a nonprofit that advocates for stronger privacy regulations.

Read more here. 

Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center (EPIC), told Marketing Brew the Maryland Online Data Privacy Act would be the strongest comprehensive privacy law among the states with such legislation; if it becomes law, Maryland would be the 16th state to protect consumer privacy. The bill contains strong data minimization rules, Fitzgerald said, and existing privacy laws in several other states have fewer restrictions. 

“Companies can only collect what’s reasonably necessary for the product or service I’m asking for,” Fitzgerald said. “If I download a weather app, they can use my location to give me the weather; that’s necessary for the product or service I’m asking for. But they can’t sell my data, my location data, to a dozen data brokers. That’s not necessary for the service.” 

Maryland’s bill is a “gamechanger,” she said, in part because other states may follow suit with legislation that has more stringent consumer protections. 

“Big Tech tries to get state legislators to feel like no one will be able to access the internet if they pass this strong law,” Fitzgerald said. “It certainly helps to have a strong law pass in a state like Maryland and show states the sky didn’t fall.” 

Read more here.

EPIC and a coalition of privacy, civil liberties, and civil rights groups wrote a letter to Senate Majority Leader Chuck Schumer, Senate Minority Leader Mitch McConnell, Senate Judiciary Chair Richard Durbin, and Senate Intel Chair Mark Warner, expressing our strong opposition to the Reforming Intelligence and Securing America Act (RISAA), H.R.7888, which would dramatically expand the government’s warrantless surveillance powers. The 75+ organizations called on leadership to oppose the consideration of RISAA or any version of Section 702 reauthorization that includes an alarming provision expanding the types and number of businesses who can be compelled to assist in surveillance.

EPIC has published a blog series focused on explaining Section 702 and the need to reform it. EPIC and a bipartisan coalition of civil society groups have called for broad reform to Section 702 and related surveillance authorities.

America is quietly being populated with Automatic License Plate Reader (ALPR) systems in towns, cities, and on highways. Most Americans drive by these devices daily unaware that they are being watched and recorded into a state database and probably a national database. The ALPR units are often very small and not easily detectable when mounted on electric poles and highway sign poles.

I work in a small city along the I-75 corridor which runs through six states from Florida and Michigan. I work in technology for a local company and know a few higher-ups in the local police department. One day I was inquiring about these new license plate readers and the officer was excited to tell me how they worked and where each of them was placed in town.

He explained that every vehicle that drives by these cameras takes a digital snapshot of the license plate number and the information about the vehicle such as if it’s a four-door, red, truck, sedan, Ford, Toyota, etc. Each snapshot reads the plate and state using character reading software and loads this data into a database. That data is then compared to a list of vehicles that are on a watch list for about any reason to be watched for. He went on to explain how fast this system responds as he tested it by entering his vehicle into the watch list. He then drove by a known camera to see if he would get a “hit” on his phone notification. It was explained the system is so fast that his phone pinged a hit within 10 seconds of driving past the camera.

I was told that any kind of parameters can be entered into the database search such as: “Be on the lookout for a red GM 2 door with a black roof, even without a plate number.” Whenever a car fitting the description of the search drives by, the camera the officer in charge of the database will get a hit that such a vehicle just drove by going in X direction on X street. He then dispatches an officer in the area to investigate the find to see if its a match.

I went looking for these cameras and found them to be quite small. They are mounted mostly on wood electrical poles. One camera on one side of the pole looking at oncoming traffic and one camera on the other side of the same pole looking at the traffic from the other direction. I found 12 of these cameras in our little town but I’m sure I missed a few more. They are usually mounted high on a pole looking down. They sometimes have a small solar panel to power them. A small box wired to each camera provides a cellular phone network connection,  sending images to a cloud server somewhere.

My source went on to explain that each city might have a database and that they can make that data…