Jeff Cassman

Data is sometimes referred to as today’s most valuable commodity. Given the technologically focused world around us, data is generated with almost everything we do or consume, whether you use Apple Pay to purchase goods from a retail outfit or use a credit card for your Uber Eats order. It is, in other words, largely unavoidable to create a digital footprint. This continuously produced data is often monitored, retained, repackaged, and resold to third parties—including the federal government—by shadowy organizations referred to as data brokers.

A data broker is a business that aggregates information from several sources or enriches, cleanses, or analyzes this information, according to Gartner. As third parties, data brokers do not have the same financial incentives to protect consumer data because consumer data is the product and those consumers are not directly involved in the transaction. These firms have thrived, in part, because the United States does not have comprehensive data privacy rules. The products offered by data brokers and intermediaries have led to a phenomenon called “surveillance capitalism.” This industry has become so robust that several federal government agencies purchase the data brokers’ products and services.

In January 2022, the Senior Advisory Group Panel on Commercially Available Information delivered a report to the Office of the Director of National Intelligence. This report was only released to the public in June 2023. Key language from the report notes:

PAI [publicly available information] is no longer a good proxy for non-sensitive information. Today, in a way that far fewer Americans seem to understand, and even fewer of them can avoid, CAI [commercially available information] includes information on nearly everyone that is of a type and level of sensitivity that historically could have been obtained, if at all, only through targeted (and predicated) collection, and that could be used to cause harm to an individual’s reputation, emotional well-being, or physical safety.

The Senior Advisory Group Panel also acknowledges in the report that commercially available information is “generally less strictly regulated than other forms of information” acquired by the intelligence community because it is publicly available.

In June 2018, the United States Supreme Court delivered its opinion on the federal government’s acquisition of Timothy Carpenter’s cell-site records in Carpenter v. United States. A majority found that the Federal Bureau of Investigation’s acquisition of cell-site records was a Fourth Amendment search. The government argued that, under the third-party doctrine, cell-site records are “business records” for the wireless telephone carriers. Under the third-party doctrine, individuals have “a reduced expectation of privacy in information knowingly shared with one another.” The majority opinion points out that the mobile phone location information collected by wireless carriers is appreciably more precise than it has been historically.

The Supreme Court’s narrow holding in Carpenter v. United States has prompted an ongoing debate about the government’s burden for collecting sensitive information on Americans. Elected officials and journalists have fought specific instances where government agencies seemingly avoid search warrants because the…

The lack of implementation has many privacy experts concerned that the federal government is ill-prepared to handle a growing body of data, even as it seeks to accelerate a digital transformation and embrace data-reliant technologies like artificial intelligence.  

“One of the reasons that you see such checkered compliance is that there really aren’t consequences for an agency failing to produce a risk management framework or privacy impact assessment or other privacy documentation that it’s obligated to produce,” said John Davisson, senior counsel and director of litigation at the Electronic Privacy Information Center. 

Read more here.

In an amicus brief, nonprofit research center Electronic Privacy Information Center (EPIC) expressed concerns about the potential privacy implications of reverse keyword warrants. EPIC emphasized that such warrants could expose vast amounts of sensitive personal data to law enforcement without a valid basis. 

Specifically, EPIC pointed out that after the U.S. Supreme Court’s Dobbs decision last year, several states moved to criminalize abortion. If reverse keyword warrants are deemed constitutional, individuals seeking information about abortions or other reproductive health issues could be at risk of investigation and prosecution. 

Read more here.

Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center, which helped draft O’Neil’s bill, portrayed Keim’s proposal as being written by big technology companies. The Electronic Privacy Information Center played a central role in crafting federal legislation that received bipartisan support in Congress but was never enacted. 

Fitzgerald said Amazon wrote a version of the privacy law that was implemented in Connecticut and other states. 

 “This is big tech’s playbook,” she said. “They just want weaker bills at the state level so they can lower the bar for an eventual federal law.” 

Read more here.

In comments filed yesterday, EPIC, the ACLU, the Center for Democracy and Technology (CDT), and the Electronic Frontier Foundation (EFF) urged the TSA not to proceed with a temporary waiver process that would allow people in certain states to use their mobile driver’s licenses (mDLs) at TSA checkpoints before the agency goes through a full rulemaking process, and before significant technical standards for mDLs have been published. The comments argued that TSA’s process would exacerbate the very concerns TSA claims to be addressing, a lack of uniform technology and risks of early vendor lock-in, while there is no public demand for mDLs. TSA’s proposal would expose individuals to privacy harms, risks of identity theft, and would do little to develop a sustainable mDL system.

The agency’s proposal is an interim rulemaking is a new exception to the REAL ID Act of 2005 that would allow a case-by-case determination for whether TSA will accept a state’s app and design choices used to issue a version of a driver’s license onto a phone. Instead of developing lasting standards, the interim rulemaking incorporates a variety of existing standards, some from the federal government that are not designed specifically for mDLs and others from private industry groups that have not allowed public participation and are often costly to view. EPIC and the organizations argued that this interim process does not meet the agency’s mandate. 

EPIC works consistently to prevent harmful developments in digital identity and promote strong, privacy-protective options for digital identity systems where appropriate.  EPIC, along with a broad coalition, opposed REAL ID because it created a de facto national identity system and has exposed Americans to data breaches. Criminal hackers compromised the authenticating documents in state DMVs including Oregon, North Carolina, and California. EPIC has urged the DHS to limit the data collection and ensure transparency and accountability in implementing REAL ID.

Grindr isn’t doing a very good job protecting its users’ private information, including their NSFW photos, according to the Electronic Privacy Information Center (EPIC), which wants the FTC to investigate potentially unlawful practices by the LGBTQ+ dating app. 

On Wednesday, EPIC filed a complaint with the US government watchdog over Grindr’s “apparent failure to safeguard users’ sensitive personal data.” This includes both present and past users who have since deleted their accounts, according to the complaint. Despite promising in its privacy policy to delete personal info if customers remove their account, Grindr allegedly retained and disclosed some of this data to third parties.  

Considering that people trust the dating app with a ton of very sensitive information — this includes their sexual preferences, self-reported HIV status, chat history, photos including nudes, and location information — “learning that Grindr breaks the promises it makes to users would likely affect a consumer’s decision regarding whether to use Grindr,” the complaint states. 

Read more here.

r