Month: December 2023

On December 5, the Federal Communications Commission published its final rule for the Safe Connections Act, a law designed to support survivors of domestic violence (DV) and other forms of interpersonal violence by making it easier for survivors to separate their phone line from a group phone plan, to obtain discounted phone service through the Lifeline program, and to contact hotlines confidentially by removing records of calls from customer-facing logs like monthly bills.

In response to comments from EPIC and its advocacy partners, the Commission’s rule requires law enforcement to obtain a court order to access information about a line separation request. It also requires covered providers to provide line separation requests in the same languages that the provider advertises its services and requires providers to process all requests for line separation within two days. In a related Fact Sheet, the FCC also cited to EPIC et al.’s comments for issues related to the sensitivity of current address information and to a survivor benefiting from the program more than once.

EPIC and its coalition partners have been advocating on behalf of survivors going back to the FCC’s initial Notice of Inquiry in 2022; the Commission seemed to take these comments into account as it developed its Notice of Proposed Rulemaking earlier this year. In March 2023, EPIC published a blog post with the Safety Net Project of the National Network to End Domestic Violence that further emphasized these points. EPIC filed comments addressing ease of use by survivors, data minimization, and misuse of data by law enforcement in DV contexts, as well as reply comments addressing dual-use applications and services that act as stalkerware.

EPIC advocates for laws, regulations, and policies that safeguard user privacy and protect users from technology-facilitated abuse and harassment, including actions against stalkerware developers. EPIC also filed an amicus brief urging that dating platform companies be held liable when they ignore harassment and abuse.

EPIC joined the Brennan Center for Justice an the Center for Democracy and Technology (CDT) in issuing a one-pager on the FISA Reform and Reauthorization Act of 2023, the newly-introduced bill to reauthorize FISA Section 702 by the House Permanent Select Committee on Intelligence.

The one-pager details how the FISA Reform and Reauthorization Act is an “anti-reform bill in disguise” that would in fact expand surveillance conducted pursuant to Section 702, including by:

• dramatically expanding surveillance of immigrants by allowing entirely suspicionless searches of Section 702 data for the communications of all people seeking to travel to the United States, whether on student or work visas or as tourists and business travelers; and
• vastly expanding the number and types of U.S. businesses who must assist the government in conducting Section 702 surveillance by expanding the definition of “electronic communication service provider” to include entities that do not even have access to communications.

The one-pager also notes that the HPSCI bill’s “reforms” to Section 702—in particular the persistent abuse of warrantless backdoor searches for Americans’ communications—are carefully designed to have no practical effect. The bill’s prohibition on “evidence-of-a-crime only” queries would do nothing to prevent the vast majority of abuses of Section 702, including searches for communications of Black Lives Matter protesters and tens of thousands of others involved in “civil unrest,” over 19,000 donors to a congressional campaign, members of Congress, and a local political party were all labeled “foreign intelligence” queries.

EPIC and a bipartisan coalition of privacy, civil liberties, and civil rights groups have launched a campaign to significantly reform Section 702 of the Foreign Intelligence Surveillance Act and related surveillance authorities. Members of this coalition recently urged Senate Majority Leader Chuck Schumer to refrain from including any short-term reauthorization of FISA Section 702 in the continuing resolution or any other “must-pass” legislation.

Late Friday night, EU policymakers reached a political agreement on the final terms of the Artificial Intelligence Act. The bill was proposed in 2021 as a part of the EU’s broad digital legislation strategy, tackling algorithmic based harms with a risk based approach. The European Parliament and the European Council, the two legislative bodies in the EU, along with the European Commission, the EU’s executive branch, have spent the last 6 months negotiating the final terms based on each body’s draft of the bill.

The past month of negotiations stalled on two major issues:

• Law enforcement and national security exceptions, particularly in regard to the real time biometric surveillance prohibition
• How to regulate foundational models like ChatGPT

While there is no final text published, the Parliament, Council, and Commission have come to a compromise on the terms. According to the reporting, the final terms include a striking reduction of transparency requirements for law enforcement, the official relegation of real time biometric surveillance to the high risk category, a ban on predictive policing software based on personality, obligations for general purpose AI developers, and penalties up to 7% of a company’s annual global turnover.

The final step for the AI Act before it is officially adopted into law is for each body to formally approve the final terms in the third reading of the bill.

EPIC has long advocated for comprehensive privacy protections, rigorous testing protocols, expanded resources for evaluation of AI systems, and a government-whole effort to fighting algorithmic discrimination. Most recently, EPIC submitted comments to the Office of Management and Budget on the United States government’s procurement and use of AI. EPIC has also petitioned the FTC to commence a rulemaking on commercial use of artificial intelligence, and keeps track of state AI laws.

Most major U.S. pharmacy chains regularly disclose customers’ medical information to law enforcement agencies without a warrant, according to a Congressional investigation announced Tuesday and reported in the Washington Post.

In a letter to the Department of Health and Human Services (HHS), Sen. Ron Wyden and Reps. Pramila Jayapal and Sara Jacobs detailed the results of their inquiry into the issue. As part of the investigation, “officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.” Pharmacies have unique flexibility under the Under the Health Insurance and Accountability Act (HIPAA) to interpret the legal standard required before disclosing customer medical records to law enforcement. Subpoenas require a less stringent showing than warrants and can be issued by a government agency without the oversight or approval of a judge.

“Although pharmacies are legally permitted to tell their customers about government demands for their data, most don’t,” the letter explains. “As a result, many Americans’ prescription records have few meaningful privacy protections, and those protections vary widely depending on which pharmacy they use.”

In recent comments to HHS, EPIC argued that the HIPAA Privacy Rule should establish a warrant requirement for law enforcement to access protected health information. In this context, law enforcement would have to get a warrant supported by probable cause before seeking a customer’s medical records from a pharmacy.

The ease with which law enforcement can currently obtain pharmacy data is especially concerning as many states continue to criminalize abortion and medication related to reproductive health. According to the Washington Post, nearly 1 in 3 women in the U.S. between the ages of 15 and 44 live in states where abortion is fully or mostly banned. Customers have an expectation of that their reproductive health information at their local pharmacy will remain private. As EPIC detailed in its comments to HHS, amending the HIPAA Privacy Rule to include a warrant requirement “would help normalize privacy protections nationwide and provide clarity to covered entities’ legal departments.”

EPIC regularly advocates for stronger privacy protections for personal health information, including reproductive health information, both under HIPAA and in contexts that fall outside of HIPAA. Recently, EPIC submitted comments to the U.S. Senate Committee on Health, Education, Labor, and Pensions urging the Committee to address the “unique and serious privacy and security risks” posed by the commercial processing of personal health data.