Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

ACLU of Mass. director: Accountability required for data privacy law reform

Drawing the line between protecting consumers’ right to data privacy and giving the government access to that data to keep the public safe isn’t as simple as looking at legal cases that have dealt with this issue, various data privacy experts explained at this month’s Forum on Data Privacy hosted by the Massachusetts Attorney General’s Office at MIT.

One major obstacle to drawing this line is a lack of transparency. While there is much publicity regarding the ongoing debate between Apple and the FBI and whether the tech company should build a backdoor into the smartphone of one of the San Bernardino shooters, this is not an isolated case. There have been dozens of cases prior to San Bernardino in which the government has sought to compel private companies to turn consumer data over for public safety reasons, but these incidents have happened behind closed doors and outside the public spotlight, said panelist Carol Rose, executive director of the American Civil Liberties Union of Massachusetts.

This secrecy and lack of a public debate is a huge problem when it comes to strengthening existing laws and policies that address consumer data privacy, said Rose. She added that an open, democratic public debate is the only way to settle where the line should be drawn.

Rose warned that a lack of transparency, combined with the legal precedent set by the government by secretly recruiting private companies to create backdoors to access consumer data, is the recipe for losing consumer trust. This will start a dangerous domino effect for companies.

“When people don’t know, then they really lose trust, and they don’t become early adopters because they don’t think that the tech companies are on their side,” she said. This could result in consumers losing out on the benefits of these technologies, becoming more vulnerable to hackers.

The stance technology companies, lawmakers and other parties should be thinking about when discussing data privacy law reform is not the idea of “technology versus liberty” but rather “technology in the service of liberty,” said Rose, who launched the Technology for Liberty Project in 2013 to promote this point of view.

These are the three major areas privacy law reform needs to address, according to Rose:

  • Access and control. This is the notion of giving users the right to access their information and correct it if it’s wrong. “We get those kinds of reports all the time, where the data is wrong and put it in incorrectly, and [users] have no way to access it,” said Rose.
  • The “third-party doctrine.” This is the idea of questioning whether users or the third-party providers that hold their data are the rightful owners of that information, whether that third party is a bank, a doctor, healthcare provider or Internet service provider.
  • Notice. Related to the third-party doctrine, Rose said that lawmakers also need to address, with special rules, consumers’ right to get notified if another party is going to use their data, particularly if that party is the government. This is where U.S. policy varies from other countries. In Europe, for example, data protection laws dictate that consumers technically own their data. “If [an EU] government needs your data, they have to tell you at least, and in some cases get your permission. In the U.S., that does not have to happen,” Rose said.

Most importantly, these policies should distinguish between the government and private sector, said Rose, warning about the dangers of the U.S. government going further down the road of recruiting private companies to do its data collection bidding in secret.

“Invariably, abuse will happen; invariably people will find out about it; [there will be] loss of consumer trust and damage to the high-tech community, and the potential promise of all these innovations could really be lost if we go down that road,” she said.