You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

EPIC Alert 27.06

EPIC Alert logo

1. EPIC Seeks Records About Use of Cell Phone Location Data for Coronavirus Tracking

EPIC has filed Freedom of Information Act requests with the Office of Science and Technology Policy and the Department of Justice seeking information about the White House's plan to use cell phone location data for public health surveillance.

According to news reports, the White House has sought the assistance of large tech companies including Facebook, Apple, and Google, to obtain and use location data of American telephone customers. It is not clear at this time whether the U.S. program is lawful or how the data would be used.

In EPIC's request to the OSTP, EPIC is asking for "all policies, proposals, and guidance documents for the collection of cell phone location data in connection with the coronavirus" and also "any privacy assessments, including but not limited to privacy threshold assessments and privacy impact assessments, related to the collection of cell phone location data in connection with the coronavirus."

In EPIC's request to the DOJ, EPIC is seeking legal analysis concerning the collection and use of GPS and cell phone location data. "The Department of Justice plays a key role advising the President regarding the lawfulness of proposed activities, and particularly the proposed expansion of government authorities during a time of national crisis," EPIC explained. "If the Department of Justice is considering the use of cell phone data to address the public health crisis, it should first consider whether the use is lawful and that analysis should be made available to the public," EPIC added.

EPIC pursued a FOIA lawsuit during the Bush Administration, EPIC v. DOJ, for the legal memos concerning the warrantless wiretapping program that was later repealed by Congress.

2. World Health Organization Speaks Up for Data Protection

Dr. Michael Ryan, a key advisor for the World Health Organization, recently emphasized the need to safeguard privacy and data protection in the responses to the coronavirus. "We take the issues of personal data protection and intrusion very, very seriously," Dr. Ryan said.

Dr. Ryan explained that the WHO is working to ensure that "all of the initiatives we're involved with, while aiming to develop good public health information, in no way interfere with the individual rights to privacy and protections under the law. It is important when we talk about surveillance and the surveillance society that in the case of public health the gathering of information about individuals, their movements must be done with the consent of the community and in many cases of the individual themselves."

Previously, Dr. Ryan noted the "tremendous amount" innovation and enthusiasm for new products to address the novel coronavirus but cautioned that "when collecting information on citizens or tracking their movements there are always serious data protection and human rights principles involved."

UN human rights experts and European privacy officials have urged governments to safeguard privacy in the effort to contain the novel coronavirus. Yuval Noah Harari wrote recently: "We can and should enjoy both privacy and health. We can choose to protect our health and stop the coronavirus epidemic not by instituting totalitarian surveillance regimes, but rather by empowering citizens."

3. DOJ Delivers Mueller Report to Federal Judge in EPIC's FOIA Case

The Department of Justice has submitted the complete Mueller Report to federal Judge Reggie B. Walton for review. Judge Walton will now determine whether the federal agency properly withheld information EPIC sought in the open government case EPIC v. Department of Justice.

The court's review of the Mueller Report marks one of the most significant "in camera" reviews in the history of the Freedom of Information Act. Judge Walton will also examine a related memo obtained by EPIC to determine what additional material must be released to EPIC and the public.

Judge Walton previously ordered the DOJ to turn over the full Mueller Report in EPIC's case, explaining that "the need for the American public to have faith in the judicial process" requires that the court review the report without redactions. "Adherence to the FOIA's objective of keeping the American public informed of what its government is up to demands nothing less," Walton wrote. The court also rebuked Attorney General Barr and raised "grave concerns about the objectivity of the process that preceded the public release of the redacted version of the Mueller Report[.]"

The book EPIC v. DOJ: The Mueller Report, which includes EPIC's original FOIA request and related materials, is available for purchase at the EPIC Bookstore. EPIC's case—the first in the nation for the disclosure of the Mueller Report—is EPIC v. DOJ, No. 19-810.

4. EPIC Urges Georgia Court to Ensure Ballot Secrecy in Upcoming Election

In an amicus brief, EPIC has asked a Georgia federal court to protect the secret ballot. Plaintiffs presented the court with evidence that Georgia's ballot-marking devices, which rely on large display screens, make voter choices easily viewable by others in the polling place.

"The right to cast a secret ballot in a public election is a core value in the United States' system of self-governance," EPIC wrote. "Secrecy of the ballot is guaranteed in state constitutions and statutes nationwide, including in Georgia."

"The secret ballot reduces the threat of coercion, vote buying and selling, and tampering," EPIC added. "For individual voters, it provides the ability to exercise their right to vote without intimidation or retaliation."

This is the second amicus brief EPIC has submitted in the case, Curling v. Raffensperger. In the earlier amicus brief, EPIC urged the court to stop Georgia's use of Direct Recording Electronic voting machine, which EPIC explained were unreliable and easily hacked. The court ruled that Georgia must replace those voting machines before the 2020 election.

5. EPIC Obtains DOJ Report on Predictive Policing and AI - ‘Individual Liberty is at Stake’

EPIC, through a FOIA request, lawsuit, and negotiated settlement, has obtained a 2014 report from the Department of Justice to former President Obama warning about the dangers of predictive analytics and algorithms in law enforcement.

The Justice Department report, titled Predictive Analytics in Law Enforcement, highlights the risks of "making decisions about sentencing—where individual liberty is at stake in the most fundamental way—based on historical data about other people," stating that "equal justice demands that sentencing determinations be based primarily on the defendant's own conduct and criminal history." Even when algorithms "seem neutral, any model is susceptible to importing any biases reflected in the underlying data," the report explains.

Former U.S. Attorney General Eric Holder has said that "basing sentencing decisions on static factors and immutable characteristics . . . may exacerbate unwarranted and unjust disparities that are already far too common in our criminal justice system and in our society."

The case, which was before the D.C. Circuit Court of Appeals, has now settled, and EPIC will receive attorney's fees for its work on the matter. The case is EPIC v. DOJ, No. 18-5307 (D.C. Cir.).

News in Brief

EPIC Backs Experts' Statement on Data Protection and Coronavirus

EPIC President Marc Rotenberg has endorsed a statement of German privacy experts that emphasizes, "even in the corona crisis, personal rights remain—in the words of the German Federal Constitutional Court—'an elementary functional condition of a free and democratic society based on the ability of its citizens to act and participate.'" The experts state, "data protection demands data minimisation, ensuring that data is used for specific purposes only and that measures and any new legal powers are clearly limited in time." The statement also calls attention to "principles and guidelines on data protection in the Corona crisis." The statement was organized by Peter Schaar, Chairman of the European Academy for Freedom of Information and Data Protection (EAID) and the former Federal Data Protection Commissioner for Germany.

EPIC Testifies in Support of Voting System Guidelines

EPIC Policy Director Caitriona Fitzgerald testified last month before the Election Assistance Commission in support of the Voluntary Voting System Guidelines 2.0. Fitzgerald said that the Voting Guidelines are "vital to protecting our democratic institutions." The Voting Guidelines are open for public comment through June 22. EPIC, along with the Association for Computing Machinery, previously recommended principles for voter privacy, ballot secrecy, and data protection. EPIC and the ACM also urged the Commission to ban internet-connected voting machinery, citing the risks to voting integrity and democratic institutions. The EAC adopted these suggestions, banning internet-connected voting systems and retaining strong provisions on voter privacy, ballot secrecy, and data protection. Though states are not mandated to comply with the Voting System Guidelines, the Guidelines shape the election security market. EPIC has a long history of working to protect voter privacy and election integrity.

EPIC and 131 Organizations Support Government Transparency During Coronavirus Crisis

EPIC and 131 other organizations issued a public statement supporting government transparency and public access to information when the U.S. is taking measures to respond to the coronavirus pandemic. The groups caution that agencies should not take advantage of the public's inability to attend large gatherings to conceal critical policy decisions. The group "encourage[s] the custodians of information at all levels of government to take this opportunity to leverage technology to make governance more inclusive and more credible, not to suspend compliance with core accountability imperatives." The statement emphasized that "the legitimacy of government decision-making requires a renewed commitment to transparency." Previously, the White House ordered federal health officials to treat top-level coronavirus meetings as classified, "an unusual step that has restricted information and hampered the U.S. government's response to the contagion," according to a report by Reuters.

Council of Europe Issues Statement on COVID-19 and Data Protection

The Council of Europe recently published a Joint Statement on The Right to Data Protection in the Context of the COVID-19 Pandemic. The statement was published by Alessandra Pierucci, Chair of the Committee of Convention 108 and Jean-Philippe Walter, Data Protection Commissioner of the Council of Europe. The COE Statement advises that "States have to address the threat resulting from the COVID-19 pandemic in respect of democracy, rule of law and human rights, including the rights to privacy and data protection." The Council further states that even during a public health crisis, "human rights(such as the International Covenant on Civil and Political Rights and the European Convention on Human Rights) cannot be suspended but only derogated or restricted by law, to the extent strictly required by the exigencies of the situation, while respecting the essence of the fundamental rights and freedoms." The COE notes that "anonymised data is not covered by data protection requirements. The use of aggregate location information . . . would thus not be prevented by data protection requirements." EPIC has worked closely with the Council of Europe on updates to the Council of Europe Privacy Convention, recommended US ratification of the Convention, and recently advised the COE on AI policy. The text of the COE Privacy Convention is contained in the EPIC Policy Law Sourcebook.

Apple Launches New COVID Resource Backed by CDC

Apple has launched a COVID-19 Screening Tool that provides information about the coronavirus, information about social distancing and current guidance on COVID-19 testing. Apple states "Apple is not collecting your answers from the screening tool. To help improve the site, Apple collects some information about how you use it. The information collected will not personally identify you." In a press statement, the CDC said the "tool provides CDC recommendations on next steps including guidance on social distancing and self-isolating, how to closely monitor symptoms, recommendations on testing, and when to contact a medical provider." In a comment on Twitter, Apple CEO Tim Cook said "the data is yours and your privacy is protected. Stay safe and healthy." In 2015, Tim Cook received the EPIC Champion of Freedom Award.

European Commission Seeks Anonymized Location Data, Citing Coronavirus

The European Commission has reportedly asked telecom companies to turn over anonymized cell phone location data, citing a need to track the spread of the novel coronavirus. The planned transfer would give the Commission access to location information and other data from hundreds of millions of cell phone users. European Data Protection Supervisor Wojciech Wiewiórowski, responding to the proposal, warned that "effective anonymisation requires more than simply removing obvious identifiers" and called on the Commission to "clearly define the dataset it wants to obtain and ensure transparency towards the public." The European Data Protection Board explained that any use of location data in connection with the coronavirus must be "strictly limited to the duration of the emergency at hand" and "in accordance with the Charter of Fundamental Rights and the European Convention for the Protection of Human Rights and Fundamental Freedoms." EPIC recently submitted a Freedom of Information Act request to the U.S. Department of Justice seeking legal analysis concerning the collection and use of GPS and cell phone location data for public health surveillance.

DHS Postpones Real ID Enforcement Deadline

The Department of Homeland Security announced that the agency is extending the REAL ID enforcement deadline to October 1, 2021. DHS plans to publish a notice of the new deadline in the Federal Register in the coming days. The REAL ID Act requires states to gather certain personal data and issue documents that comply with federal standards. The failure to have a REAL ID-compliant document can restrict the freedom to travel. EPIC, along with a broad coalition, opposed REAL ID because it created a de facto national identity system and has exposed Americans to data breaches. Criminal hackers compromised the authenticating documents in state DMVs including Oregon, North Carolina, and California. EPIC has urged the DHS to limit the data collection and ensure transparency and accountability in implementing REAL ID.

EU NGOs Call for Fundamental Rights-Based Responses to COVID-19

European NGOs called on EU countries to ensure that fundamental rights are upheld while taking public health measures to tackle COVID-19.The members of the European Digital Rights Initiative (EDRi) urged Member States to limit the collection and use of personal data and to implement exceptional measures only for the duration of the crisis. The NGOs also highlighted the danger of internet shutdowns during a pandemic, stating that: "During this crisis and beyond, an accessible and open internet will play a significant role in keeping us safe." The groups warned that "companies should not abuse the extraordinary circumstances to monetise information at their disposal." Privacy International has created a resource to track the privacy implications of the various responses to the Coronavirus by tech companies, governments, and international agencies. The EPIC Public Voice Fund supports the work of EDRi.

European Privacy Officials Offer Guidance in Response to Pandemic

The European Data Protection Board, the committee of national European privacy officials, has published a statement advising data processors on their legal obligations in light of the pandemic. The EDPB statement addresses the lawfulness of processing during a public health emergency, the use of mobile location data, and the protections of health data of employees. The Board cautioned that: "Personal data that is necessary to attain the objectives pursued should be processed for specified and explicit purposes." The EDPB advises processors that: "The least intrusive solutions should always be preferred, taking into account the specific purpose to be achieved." EPIC and 131 other organizations issued a public statement supporting government transparency and public access to information when the U.S. is taking measures to respond to the coronavirus pandemic.

Senators Back Bill to Promote Vote-by-Mail

Senators Amy Klobuchar and Senator Ron Wyden have introduced the "Natural Disaster and Emergency Ballot Act of 2020," which would expand early in-person voting and no-excuse absentee vote-by-mail to all states. Twenty-six Senators have co-sponsored S. 3529. Senator Klobuchar said, "we should act swiftly to pass my legislation to ensure that every American has a safe way to participate in our democracy during a national emergency." According to the National Conference on State Legislatures, five states currently conduct all elections entirely by mail, and at least 21 other states have laws that permit some elections to be conducted by mail. EPIC has a long history of working to protect voter privacy and election integrity. In 2016 EPIC published The Secret Ballot at Risk: Recommendations for Protecting Democracy, a report highlighting the right to a secret ballot and how Internet voting threatens voter privacy.

Government Considers Location Data to Track Coronavirus

According to the Washington Post, the U.S. Government is in active discussions with tech companies about tracking telephone customers to monitor the spread of the coronavirus. Cellphone data is currently protected under federal privacy law. In the Carpenter case, the Supreme Court made clear that government access to location information implicates the Fourth Amendment. EPIC has long advocated for protection of location privacy. EPIC pursued a lawsuit against a mobile app company that led to greater protection of users' location data. EPIC also successfully petitioned the FCC to safeguard sensitive data collected by phone companies. The FCC recently announced fines against T-Mobile, AT&T, Verizon, and Sprint for selling customers' location information.

Ad Groups Seek Delay of California Privacy Law

In a letter to the California Attorney General, several advertising associations called for a six-month delay in implementation of the California Consumer Privacy Act. The business groups cited the coronavirus as the reason they should not comply with the law as planned. The California privacy law establishes new privacy rights for California residents, and busineses are required to bring their practices into compliance. The California Attorney General will begin enforcement actions on July 1, 2020. EPIC expressed support for the new privacy law in comments to the Attorney General on proposed regulations. EPIC's recommendations for baseline federal privacy legislation and the creation of a Data Protection Agency are detailed in Grading on a Curve: Privacy Legislation in the 116th Congress.

Privacy International Tracks Privacy Impact of Response to COVID-19

Privacy International has created a resource to track the privacy implications of the various responses to the Coronavirus by tech companies, governments, and international agencies. Some responses to the pandemic involve mass surveillance and locational tracking that impact on privacy and human rights. For example, Israel plans to use cellphone data for contact tracing and a U.S. company Athena Security has proposed mass surveillance for temperature monitoring. U.S. Senators have written to the Federal Trade Commission and the White House expressing concern over the privacy implications of the Administration's plan to allow Google to establish a virus screening website for COVID-19.

DOJ Releases 2019 FOIA Litigation and Compliance Report

The Department of Justice has released the 2019 FOIA Litigation and Compliance Report which details the DOJ's efforts to encourage agency compliance with the FOIA across federal agencies. DOJ updated the Guide to the Freedom of Information Act, with recent court decisions. The DOJ report also summarizes agency guidance, including the application of Exemption 4 after the Supreme Court expanded the definition of "confidential" information. On that issue, EPIC filed an amicus brief in Food Marketing Institute v. Argus Leader Media telling the Supreme Court that access to commercial records is critical for government oversight. EPIC celebrated Sunshine Week with the 2020 EPIC FOIA Gallery, highlighting important EPIC FOIA work from the past year, including EPIC's case for the release of the Mueller Report, EPIC v. Department of Justice.

Senators Question White House Google Website Plan

Five U.S. Senators have sent a letter to the White House expressing concern over the privacy implications of the Administration's plan to allow Google to establish a virus screening website for COVID-19. Senators Bob Menendez, Sherrod Brown, Richard Blumenthal, Kamala Harris, and Cory Booker said "If the Administration and the private company responsible for launching and maintaining the website does not establish sufficient privacy safeguards, Americans who use the site will be more susceptible to identity theft, negative credit decisions, and employment discrimination." Google is under a consent order that gives the FTC authority to oversee the company's privacy practices. The FTC consent order followed complaints by EPIC about Google Buzz. EPIC later sued the FTC, EPIC v. FTC, for the agency's failure to enforce the consent against Google.

Senators Urge FTC to Stop Google's Monetization of COVID-19 Fears

U.S. Sens. Mark R. Warner (D-VA) and Richard Blumenthal (D-CT) recently wrote to FTC Chairman Joe Simons about Google's ad targeting practices for products such as face masks and hand sanitizer. The Senators presented evidence that Google continues to run ads that capitalize on COVID-19 fears despite claiming to ban such ads. The Senators said that the ads "create widespread social harms to our nation's response to the crisis." The also said, "consumers should b able to rely on representations regarding a company's business practices...if consumer cannot rely on a company's representations, then the FTC must intervene." EPIC has long advocated privacy protections for medical information. EPIC helped establish the FTC's authority to oversee Google, but EPIC has since criticized the agency's effectiveness and called for the establishment of a U.S. Data Protection Agency.

Federal Government Weakens Privacy Protections for Telemedicine

The Department of Health & Human Services has announced that it is rolling back privacy protections for electronic medical appointments during the coronavirus outbreak. HHS stated it will not take enforcement action against health care providers that violate the federal patient privacy law (HIPAA) when consulting with patients remotely, as long as providers act in "good faith." Normally, remote communications tools used for medical purposes must comply with strict privacy rules. Health care providers are still prohibited from using "public facing" applications such as Facebook Live and TikTok to consult with patients, HHS said. EPIC has long advocated privacy protections for medical information and filed a brief in IMS v. Sorrell urging the Supreme Court to safeguard prescription data.

Senate Passes Short-Term Extension of Surveillance Authorities

The Senate voted recently to extend for 75 days certain national security authorities that were set to expire. Previously, the House passed a bill that included several reforms. EPIC and other civil liberties groups backed a bill that would establish a warrant requirement for location data and internet browsing history, increase transparency, and strengthen the Privacy and Civil Liberties Oversight Board. Members of both parties have expressed support for reform of the controversial NSA surveillance program. EPIC closely tracks the use of FISA authority. EPIC has advocated for significant FISA reforms, and recently advised Congress to limit Section 702 surveillance and to allow Section 215 to expire.

EPIC in the News

More EPIC in the News »

EPIC Bookstore

EPIC publications and books by members of the EPIC Advisory Board, distinguished experts in law, technology and public policy are available at the EPIC Bookstore. Featured now at the EPIC Bookstore:

EU Law in Populist Times: Crises and Prospects (Francesca Bignami ed., 2020).

Authored by leading academics and policymakers, EU Law in Populist Times provides a comprehensive and cutting-edge analysis of the fields of European Union law at the heart of contemporary political debates—economic policy, human migration, internal security, and constitutional fundamentals at the national level.

Recent EPIC Publications

The AI Policy Sourcebook 2020, edited by Marc Rotenberg (EPIC 2020).

The AI Policy Sourcebook includes global AI frameworks such as the OECD AI Principles and the Universal Guidelines for AI. The Sourcebook also includes AI materials from the European Union and the Council of Europe, national AI initiatives, as well as recommendations from professional societies, including the ACM and the IEEE. The Sourcebook also includes an extensive resources section on AI, including reports, articles, and books from around the world.

The Privacy Law Sourcebook 2020, edited by Marc Rotenberg (EPIC 2020).

The Privacy Law Sourcebook is the leading resource for students, attorneys, and policymakers interested in privacy law in the United States and around the world. The Sourcebook includes major U.S. privacy laws. The Sourcebook also includes key international privacy frameworks such as the EU General Data Protection Regulation and the modernized Council of Europe Convention on Privacy. The Privacy Law Sourcebook 2020 includes the new California Consumer Privacy Act, the Illinois Biometric Information Privacy Act, the Public Voice Declaration for a Moratorium on Facial Recognition, and updates on GDPR implementation. The Sourcebook also includes an extensive resources section with information on privacy agencies, organizations, and publications.

EPIC v. Department of Justice: The Mueller Report, edited by Marc Rotenberg (EPIC 2019).

EPIC v. Department of Justice: The Mueller Report chronicles the efforts to obtain a full account of Russian interference in the 2016 presidential election. EPIC filed the first lawsuit in the country for the release of the full and unredacted Mueller Report and obtained a newly redacted version in early May 2019. EPIC is now challenging the redactions made by the Department of Justice in federal court. This volume is an essential guide to the legal arguments about the redactions, the dispute between the Attorney General and the Special Counsel, and EPIC's request for the Mueller Report and other records about Russian interference in the 2016 presidential election.

Communications Law and Policy: Cases and Materials, 5th Edition, by Jerry Kang and Alan Butler (Direct Injection Press 2016).

This teachable casebook provides an introduction to the law and policy of modern communications. The book is organized by analytic concepts instead of current industry lines, which are constantly made out-of-date by technological convergence. The basic ideas—power, entry, pricing, access, classification, bad content, and intermediary liability—equip students with a durable and yet flexible intellectual structure that can help parse a complex and ever-changing field.

Privacy Law and Society, 3rd Edition, by Anita Allen, JD, PhD, and Marc Rotenberg, JD, LLM. West Academic (West Academic 2015).

The Third Edition of "Privacy Law and Society" is the most comprehensive casebook on privacy law ever produced. It traces the development of modern privacy law, from the early tort cases to present day disputes over drone surveillance and facial recognition. The text examines the philosophical roots of privacy claims and the significant court cases and statues that have emerged. The text provides detailed commentary on leading cases and insight into emerging issues. The text includes new material on developments in the European Union, decisions grounded in fundamental rights jurisprudence, and exposes readers to current debates over cloud computing, online profiling, and the role of the Federal Trade Commission. Privacy Law and Society is the leading and most current text in the privacy field.

Privacy in the Modern Age: The Search for Solutions, edited by Marc Rotenberg, Julia Horwitz and Jeramie Scott (The New Press 2015).

The threats to privacy are well known: The National Security Agency tracks our phone calls; Google records where we go online and how we set our thermostats; Facebook changes our privacy settings when it wishes; Target gets hacked and loses control of our credit card information; our medical records are available for sale to strangers; our children are fingerprinted and their every test score saved for posterity; and small robots patrol our schoolyards while drones may soon fill our skies.

The contributors to this anthology don't simply describe these problems or warn about the loss of privacy—they propose solutions.

Contributors include: Steven Aftergood, Ross Anderson, Christine L. Borgman (coauthored with Kent Wada and James F. Davis), Ryan Calo, Danielle Citron, A. Michael Froomkin, Deborah Hurley, Kristina Irion, Jeff Jonas, Harry Lewis, Anna Lysyanskaya, Gary T. Marx, Aleecia M. McDonald, Dr. Pablo G. Molina, Peter G. Neumann, Helen Nissenbaum, Frank Pasquale, Dr. Deborah Peel, MD, Stephanie E. Perrin, Marc Rotenberg, Pamela Samuelson, Bruce Schneier, and Christopher Wolf.

Upcoming Conferences and Events

"Addressing the Data Governance and Privacy Challenges in the Fight Against COVID-19." OECD. Apr. 15, 2020. Paris, France (by remote). Marc Rotenberg, EPIC President.

OECD Expert Group. Apr. 17, 2020. Paris, France (by remote). Marc Rotenberg, EPIC President.

EPIC Webinar: "The Need for a US Data Protection Agency." June 3, 2020.

EPIC Champion of Freedom Awards Event. June 3, 2020. Washington, DC.

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security