EPIC Alert 27.02

1. A Big Victory for Privacy Groups

Facebook has agreed to pay $550 million to settle a lawsuit about the use of facial recognition technology. The New York Times called the settlement "A Big Victory for Privacy Groups."

In 2010, EPIC objected to Facebook's collection of biometric data and urged the FTC to modify a proposed settlement to limit Facebook's use of facial recognition. EPIC filed similar complaints about facial recognition with the FTC in 2016 and 2018. EPIC also filed several amicus briefs stating that the violation of a federal privacy law is sufficient to confer "standing," the right of consumers to bring lawsuits.

In response to Facebook's challenge to the Illinois Biometric Privacy Act, EPIC wrote, "Judicial second-guessing of statutory protections for biometric data established by the state legislature, following a careful weighing of the public safety concerns, will come at an enormous cost to the privacy of Illinois residents." EPIC's views were adopted by a federal court in the facial recognition case, which led to the recent settlement with Facebook.

The text of the Illinois privacy law is available in the 2020 EPIC Privacy Law Sourcebook at the EPIC Bookstore. And EPIC's objections to the current FTC settlement with Facebook are now pending in federal court.

2. EPIC, Coalition Urge Oversight Board to Suspend Face Surveillance

EPIC and over 40 organizations have urged the Privacy and Civil Liberties Oversight Board to recommend the suspension of face surveillance systems across the federal government. The Board advises the government on new threats to privacy.

The groups said that "the rapid and unregulated deployment of facial recognition poses a direct threat to 'the precious liberties that are vital to our way of life.'" The groups also noted that "there is a growing movement across the United States to ban the use of facial recognition. Many local governments are taking steps to protect their residents against the use of facial recognition for mass surveillance."

Last year, the Public Voice coalition called for a global moratorium on face surveillance, warning that "the technology has evolved from a collection of niche systems to a powerful integrated network capable of mass surveillance and political control." The Declaration was endorsed by over 100 organizations and several hundred experts in over 40 countries.

EPIC previously called for DHS to suspend the use of facial recognition technology. EU leaders are now considering a ban on the use of facial recognition in public spaces, "for up to five years until safeguards to mitigate the technology's risk are in place.

3. EPIC Seeks Regulation of AI, Petitions Federal Trade Commission

EPIC has filed a petition with the Federal Trade Commission for a rulemaking "concerning the use of artificial intelligence in commerce." The petition follows two recent EPIC complaints to the FTC about the use of AI for employment screening and the secret scoring of young athletes.

"Though AI has the potential to advance science, medicine, commerce, and education, the unregulated use of AI techniques has already caused serious harm to consumers, who are increasingly subject to opaque and unprovable decision-making in employment, credit, healthcare, housing, and criminal justice," EPIC warned. "Moreover, the absence of effective regulation has accelerated the spread of unaccountable and untrustworthy AI tools with immediate impacts on American consumers."

"Given the scale of commercial AI use, the rapid pace of AI development, and the very real consequences of AI-enabled decision-making for consumers, the Commission should immediately initiate a rulemaking to define and prevent consumer harms resulting from AI," EPIC added.

EPIC noted that several FTC Commissioners have called for updated regulations to address the challenges of Artificial Intelligence. Last month, Commissioner Rebecca Kelly Slaughter said that "[i]n the area of algorithmic justice, [an FTC] rule might be able to affirmatively impose requirements of transparency, accountability, and remedy."

EPIC pointed to the recent OMB Guidance for Regulation of Artificial Intelligence in support of the FTC rulemaking. EPIC also publishes the AI Policy Sourcebook, the first reference book on AI policy.

4. EPIC Gives International Privacy Award to Isabelle Falque-Pierrotin, Carole Cadwalladr

EPIC presented the 2020 International Privacy Champion Awards to Isabelle Falque-Pierrotin, former President of the French Data Protection Agency (the "CNIL") and British journalist Carole Cadwalladr.

EPIC President Marc Rotenberg drew attention to Falque-Pierrotin's "dedication and determination" which have "given force to the right to privacy." Rotenberg cited Cadwalladr's reporting on the Cambridge Analytica data breach, which has made clear "the deep connection between data protection and the protection of democratic institutions."

The ceremony took place at the annual conference on Computers, Privacy, and Data Protection in Brussels, Belgium.

The 2020 EPIC Champion of Freedom Awards will be held at the National Press Club in Washington, DC on June 3, 2020.

5. EPIC Argues in Court Fifth Amendment Protects Cell Phone Passcodes

EPIC's Megan Iorio presented argument recently in State v. Andrews, a New Jersey Supreme Court case about the compelled disclosure of a cell phone passcode.

In its amicus brief, EPIC argued that the Fifth Amendment limits the ability of the government to obtain cellphone passcodes. Citing Riley v. California and Carpenter v. United States, EPIC said the U.S. Supreme Court has held that the vast troves of personal data stored in cell phones "justifies strong constitutional protections."

EPIC also explained that limited exceptions to Fifth Amendment safeguards were "formulated in the age before cell phones, when an individuals' documents of interest were not all consolidated in one place. Today, most of an individual's sensitive records are accessible through their cell phone, full access to which is guarded by a single passcode. Pre-digital antecedents, such as a safe or a lockbox, could not possibly hold as many documents or as much information about a person as their cell phone now does."

At argument, EPIC's Iorio told the court that "[c]ellphones do not fit neatly under existing precedent. They really are an extension of the contents of a user's mind, both by the information that they gather and their relation to the user."

EPIC routinely files amicus briefs arguing that constitutional protections should keep pace with advances in technology. EPIC filed amicus briefs in Carpenter and Riley, which both involved the searches of cellphones. The Supreme Court cited EPIC's amicus brief in the Riley opinion.

News in Brief

EPIC Settles ICE Lawsuit about Palantir and Profiling

EPIC has settled a Freedom of Information Act lawsuit against Immigration and Customs Enforcement. EPIC sought records about the agency's use of Palantir's technology for mass surveillance. The documents obtained by EPIC revealed the vast capabilities of agency program to link phone numbers, GPS data, and social network data. The FALCON database, developed by Palantir, also includes sensitive data such as social security numbers, financial records, call records, ISP records. In previous comments, EPIC urged the agency to limit the data gathered, narrow the exemptions to the Privacy Act, and remove the routine use disclosures. As a consequence of the successful litigation, EPIC will receive attorneys fees.

EPIC Advises FCC to Protect Privacy of Lifeline Subscribers

In comments on an FCC proposed rule, EPIC said that the agency should not track the Internet use of Lifeline subscribers. Lifeline is a federal program that provides broadband service to economically disadvantaged Americans. The FCC is proposing that Lifeline subscribers install apps to track their data usage and that companies retain detailed records about Internet use by Lifeline subscribers. EPIC said: "Americans should not be required to sacrifice their privacy to access the Internet." EPIC led a campaign and petition opposing the FCC's requirement that telephone carriers retain detailed records of American telephone customers.

FCC Announces Enforcement Action on Location Privacy

FCC Chairman Pai has announced upcoming enforcement actions against wireless carriers that disclosed subscribers' location data. Last year Members of Congress called an emergency briefing with the FCC and urged the agency to investigate companies that were selling subscribers' location data. EPIC has long advocated for protection of location data. EPIC pursued a lawsuit against a mobile app company that led to greater protection of users' location data. EPIC also successfully petitioned the FCC to safeguard sensitive data collected by phone companies. And EPIC filed a amicus brief in Carpenter v. US. The Supreme Court held in that case that the Fourth Amendment protects cell site location information. EPIC maintains detailed webpages on location privacy.

Senator Bennet Slams White House AI Strategy

Sen. Michael Bennet (D-CO) has criticized the White House Guidance on Artificial Intelligence as "insufficient" and "little more than gauzy generalities." In a letter to US Chief Technology Officer Michael Kratsios, Bennet said the "principles male only passing referrence to privacy protections" and "just a cursory discussion of Americans' civil rights." Bennet said also that the White House "has failed to set spending targets, establish metrics, or allocate additional funding." EPIC published the AI Policy Sourcebook, the first reference book on AI policy. The AI Sourcebook includes the Universal Guidelines for AI, an influential human rights framework for AI policy.

On International Privacy Day, EPIC Urges Congress to Act on Privacy

On January 28, EPIC celebrated International Privacy Day, which commemorates Council of Europe Convention 108, the first international privacy convention. EPIC urged Congress to take three steps to safeguard the personal data of Americans: (1) enact comprehensive baseline legislation, (2) establish a data protection agency, and (3) ratify the International Privacy Convention. EPIC and consumer organizations have long urged the United States to endorse the Privacy Convention, which establishes a global framework for the free flow of personal data. The complete text of the Privacy Convention is in the EPIC Privacy Law Sourcebook, available at the EPIC Bookstore. Follow #DataProtectionDay.

Interior Department Will Ground Chinese-Made Drones

The Interior Department announced recently that it will ban Chinese-made drones for non-emergency use. The Secretary's Order responds to growing concerns that information collected by aerial drones could be "valuable to foreign entities, organizations and governments." In 2012, EPIC and more than 100 experts petitioned the FAA to establish a privacy rule for drones, but the agency failed to act. Last year EPIC's Marc Rotenberg and Len Kennedy cited the FAA's failure, and also warned that China's surveillance model requires "comprehensive privacy legislation to safeguard the personal data of Americans." Senator Chris Murphy [D-CT] and Senator Rick Scott [R-FL] have introduced S. 2502, the American Security Drone Act of 2019 that would prevent federal agencies from purchasing drones manufactured in China.

Banisar Publishes 2020 Global Privacy Survey

The Banisar index has found that as of 2019, 130 countries have adopted comprehensive data protection laws to protect personal data held by private companies and government entities. In almost all of the countries, an independent data protection agency or information commission oversees and enforces the laws. EPIC's recent report on U.S. federal privacy legislation Grading on a Curve: Privacy Legislation in the 116th Congress evaluates federal privacy bills. EPIC has called for comprehensive baseline legislation and the creation of a data protection agency. EPIC also makes available The 2020 Privacy Law Sourcebook at the EPIC Bookstore.

Pew Survey: Americans Support 'Right to Be Forgotten'

A new Pew Research survey found that 74% of U.S. adults say it is more important to keep things about themselves from being searchable online than it is to discover potentially useful information about others. And 85% say that all Americans should have the right to have potentially embarrassing photos and videos removed from online search results. EPIC advocates for the "right to be forgotten" and maintains a webpage on U.S. state laws that allow individuals to remove records containing disparaging information. EPIC publication "The Right to be Forgotten on the Internet: Google v. Spain," an account of the original case written by former Spanish Privacy Commissioner Artemi Rallo, is available in the EPIC bookstore.

European Parliament Committee Adopts Resolution on AI Oversight

A new European Parliament Resolution advises the European Commission to establish strong oversight of artificial intelligence. The Resolution emphasizes safe and compliant products, human responsibility, safety, transparency, explainability, and data quality. The Resolution also supports the free flow of non-personal data to promote innovation. Several of these principles are put forward in the Universal Guidelines for AI, which EPIC recommends as the baseline for AI Policy. On February 19, the European Commission is expected to announce how it will proceed with AI regulation. EPIC has promoted Algorithmic Transparency and published the AI Policy Sourcebook, the first reference book on AI policy.

Schrems Launches New Resource on GDPR

None of Your Business, the privacy NGO established by Max Schrems, has launched a new resource for those following European privacy law. GDPRhub provides summaries of decisions by national Data Protection Agencies and courts concerning the GDPR. This database offers insight into key debates on the interpretation of contentious GDPR issues. A second database, "GDPR Knowledge," offers commentaries on GDPR and DPA profiles across the EU. NOYB is also publishing GDPRtoday, which provides a "quick overview of all national decisions of the past days from all across Europe." EPIC provides the text of the GDPR in the 2020 Privacy Law Sourcebook available at the EPIC Bookstore.

Poll: Americans Split on Fitness Tracker Data Use in Research

A new Pew Research poll finds that 41% of Americans say it is acceptable for makers of fitness trackers to disclose users' data to medical researchers, while 35% believe this is an unacceptable practice and 22% are unsure. The study also found that white adults (39%) are more likely than those who are black (31%) or Hispanic (26%) to see disclosure of this data as unacceptable. EPIC told Congress that the Federal Trade Commission must block Google's plan to acquire Fitbit and that merger review must consider data protection. EPIC maintains an extensive page on Privacy and Public Opinion which shows consistent support among Americans for stronger privacy laws. EPIC advocates for comprehensive privacy legislation and the establishment of a U.S. data protection agency.

Supreme Court Declines to Review Facebook Face Scan Case

The U.S. Supreme Court will leave in place a decision that allows lawsuits against Facebook for the unlawful collection of facial images. In Patel v. Facebook, the Ninth Circuit held that that an Illinois biometrics law protects "concrete privacy interests" and that violations of the law "pose a material risk of harm to those privacy interests." EPIC filed an amicus brief in the case, arguing that users can sue companies that violate rights protected by privacy laws. EPIC has long advocated for limits on the use of biometric data and has opposed Facebook's use of facial recognition software. EPIC and others recently called for a global moratorium on facial recognition. EPIC recently launched a campaign and resource page to ban face surveillance.

EPIC in the News

• Morning Tech: A call for AI regulation, POLITICO, Feb. 3, 2020
• FTC Should Regulate Artificial Intelligence, EPIC Petition Says, Bloomberg Law, Feb. 3, 2020
• Facebook payout puts spotlight on 'biometric privacy', LiveMint, Feb. 2, 2020
• 'Biometric privacy' under the spotlight after Facebook's $550 million settlement, GeoTV, Feb. 2, 2020
• Facebook's settlement puts spotlight on 'biometric privacy', France24, Feb. 2, 2020
• Record Facebook Deal May Boost US Privacy Law Push, Law360, Feb. 1, 2020
• Facebook's settlement puts spotlight on 'biometric privacy', Yahoo, Feb. 1, 2020
• Dating apps leak personal data, Norwegian group says, WPIX.com, Feb. 1, 2020
• Privacy Groups Hail Facebook Facial Recognition Settlement, Multichannel News, Jan. 31, 2020
• Consumer group claims dating apps leak personal data, CBS , Jan. 31, 2020
• Facebook to Pay Millions for Allegedly Mishandling User Data (Again), Vanity Fair, Jan. 30, 2020
• Facebook agrees to pay $550 million to settle privacy lawsuit, days after Supreme Court declined to hear case, Washington Post Technology 202, Jan. 30, 2020
• Facebook Settles Facial Recognition Lawsuit for $550 Million, Data Breach Today , Jan. 30, 2020
• Facebook to pay $550 million to settle lawsuit over its use of facial recognition technology, Indian Express, Jan. 30, 2020
• California's New Privacy Law Faces Its First Big Challenge, Law 360, Jan. 30, 2020
• Facebook to pay $550 million to settle facial recognition suit, Silicon Valley Business Journal, Jan. 30, 2020
• FACEBOOK TO PAY MILLIONS FOR ALLEGEDLY MISHANDLING USER DATA (AGAIN), Vanity Fair, Jan. 30, 2020
• The Technology 202: Several presidential candidates have yet to promise not to spread disinformation, Washington Post, Jan. 30, 2020
• FACIAL RECOGNITION INDUSTRY SET TO MAKE BILLIONS DESPITE BANS AROUND THE COUNTRY, Inverse, Jan. 30, 2020
• Many of the Major Dating Apps Are Leaking Personal Data to Advertisers, CPO Magazine, Jan. 30, 2020
• Facebook reveals 'Off-Facebook Activity' tracker to users, Rocket City Now, Jan. 29, 2020
• Facebook to Pay $550 Million to settle Facial Recognition Suit, New York Times, Jan. 29, 2020
• Privacy, Civil Rights Advocates Urge U.S. Suspend Facial-Recognition Surveillance, Karma, Jan. 29, 2020
• FTC, Facebook Say $5B Privacy Deal Benefits Consumers, Law360, Jan. 28, 2020
• Illinois Law Increases Transparency on AI Hiring Practices, Governing.com, Jan. 28, 2020
• Privacy groups want a federal facial-recognition ban, but it's a long shot, Fast Company, Jan. 28, 2020
• Facial Recognition Startup Clearview AI Is Struggling To Address Complaints As Its Legal Issues Mount, Buzzfeed Newa, Jan. 28, 2020
• U.S. Board Should Seek Facial Recognition Halt, Groups Say (1), Bloomberg News, Jan. 28, 2020
• https://federalnewsnetwork.com/federal-newscast/2020/01/senators-worry-new-polices-may-hinder-non-citizen-servicemembers-naturalization-process/, Federal News Network, Jan. 28, 2020
• Groups Push Federal Agency to Put Facial Recognition Systems on Hold, News Max, Jan. 28, 2020
• Employers use algorithms to rate job interviewees. A new Illinois law gives candidates rights, Philadelphia Inquirer, Jan. 28, 2020
• Whether you're hired may depend on how an algorithm rates your video job interview. A new state law on AI screening gives you rights., Chicago Tribune, Jan. 27, 2020
• States and feds to meet up on tech antitrust probes, POLITICO, Jan. 27, 2020
• Backlash grows against Clearview as lawsuit looms, The Daily Dot, Jan. 27, 2020
• Privacy Groups Urge Suspension of Federal Facial Recognition use, MeriTalk, Jan. 27, 2020
• 40 groups call for US moratorium on facial recognition technology, MIT Technology Review, Jan. 27, 2020
• Government privacy watchdog under pressure to recommend facial recognition ban, The Hill, Jan. 27, 2020
• FTC, Facebook Say $5B Privacy Deal Benefits Consumers, Law360, Jan. 27, 2020
• Facebook And FTC Urge Judge To Approve $5 Billion Privacy Settlement, MediaPost, Jan. 26, 2020
• New surveillance AI can tell schools where students are and where they've been, Vox, Jan. 25, 2020
• FTC, Facebook play defense on $5B settlement, POLITICO, Jan. 24, 2020
• Facebook, government urge court to approve $5-billion FTC settlement, USAToday, Jan. 24, 2020
• Bill Would Limit Spy Agencies' Domestic Surveillance, Law360, Jan. 24, 2020
• FTC settlement requires 'sea change' for Facebook privacy, DOJ says, POLITICO Pro, Jan. 24, 2020
• There's a new obstacle to landing a job after college: Getting approved by AI, CBS News Atlanta, Jan. 23, 2020
• Consumer privacy law off to uneven start in California, Arkansas Democrat Gazette, Jan. 22, 2020
• NJ High Court Challenges Legality Of Forced IPhone Access, Law360, Jan. 22, 2020
• 'Private Enclave'? Supreme Court Deciding Whether Cellphone Passcodes Are Protected, New Jersey Law Journal, Jan. 22, 2020

More EPIC in the News »

EPIC Bookstore

EPIC publications and books by members of the EPIC Advisory Board, distinguished experts in law, technology and public policy are available at the EPIC Bookstore. Featured now at the EPIC Bookstore:

The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power, by Shoshana Zuboff (Public Affairs 2019)

The challenges to humanity posed by the digital future, the first detailed examination of the unprecedented form of power called "surveillance capitalism," and the quest by powerful corporations to predict and control our behavior.

• New York Times Notable Book of the Year
• One of The Guardian's Best 100 Books of the 21st Century

Recent EPIC Publications

The AI Policy Sourcebook 2020, edited by Marc Rotenberg (EPIC 2020).

The AI Policy Sourcebook includes global AI frameworks such as the OECD AI Principles and the Universal Guidelines for AI. The Sourcebook also includes AI materials from the European Union and the Council of Europe, national AI initiatives, as well as recommendations from professional societies, including the ACM and the IEEE. The Sourcebook also includes an extensive resources section on AI, including reports, articles, and books from around the world.

The Privacy Law Sourcebook 2020, edited by Marc Rotenberg (EPIC 2020).

The Privacy Law Sourcebook is the leading resource for students, attorneys, and policymakers interested in privacy law in the United States and around the world. The Sourcebook includes major U.S. privacy laws. The Sourcebook also includes key international privacy frameworks such as the EU General Data Protection Regulation and the modernized Council of Europe Convention on Privacy. The Privacy Law Sourcebook 2020 includes the new California Consumer Privacy Act, the Illinois Biometric Information Privacy Act, the Public Voice Declaration for a Moratorium on Facial Recognition, and updates on GDPR implementation. The Sourcebook also includes an extensive resources section with information on privacy agencies, organizations, and publications.

EPIC v. Department of Justice: The Mueller Report, edited by Marc Rotenberg (EPIC 2019).

EPIC v. Department of Justice: The Mueller Report chronicles the efforts to obtain a full account of Russian interference in the 2016 presidential election. EPIC filed the first lawsuit in the country for the release of the full and unredacted Mueller Report and obtained a newly redacted version in early May 2019. EPIC is now challenging the redactions made by the Department of Justice in federal court. This volume is an essential guide to the legal arguments about the redactions, the dispute between the Attorney General and the Special Counsel, and EPIC's request for the Mueller Report and other records about Russian interference in the 2016 presidential election.

Communications Law and Policy: Cases and Materials, 5th Edition, by Jerry Kang and Alan Butler (Direct Injection Press 2016).

This teachable casebook provides an introduction to the law and policy of modern communications. The book is organized by analytic concepts instead of current industry lines, which are constantly made out-of-date by technological convergence. The basic ideas—power, entry, pricing, access, classification, bad content, and intermediary liability—equip students with a durable and yet flexible intellectual structure that can help parse a complex and ever-changing field.

Privacy Law and Society, 3rd Edition, by Anita Allen, JD, PhD, and Marc Rotenberg, JD, LLM. West Academic (West Academic 2015).

The Third Edition of "Privacy Law and Society" is the most comprehensive casebook on privacy law ever produced. It traces the development of modern privacy law, from the early tort cases to present day disputes over drone surveillance and facial recognition. The text examines the philosophical roots of privacy claims and the significant court cases and statues that have emerged. The text provides detailed commentary on leading cases and insight into emerging issues. The text includes new material on developments in the European Union, decisions grounded in fundamental rights jurisprudence, and exposes readers to current debates over cloud computing, online profiling, and the role of the Federal Trade Commission. Privacy Law and Society is the leading and most current text in the privacy field.

Privacy in the Modern Age: The Search for Solutions, edited by Marc Rotenberg, Julia Horwitz and Jeramie Scott (The New Press 2015).

The threats to privacy are well known: The National Security Agency tracks our phone calls; Google records where we go online and how we set our thermostats; Facebook changes our privacy settings when it wishes; Target gets hacked and loses control of our credit card information; our medical records are available for sale to strangers; our children are fingerprinted and their every test score saved for posterity; and small robots patrol our schoolyards while drones may soon fill our skies.

The contributors to this anthology don't simply describe these problems or warn about the loss of privacy—they propose solutions.

Contributors include: Steven Aftergood, Ross Anderson, Christine L. Borgman (coauthored with Kent Wada and James F. Davis), Ryan Calo, Danielle Citron, A. Michael Froomkin, Deborah Hurley, Kristina Irion, Jeff Jonas, Harry Lewis, Anna Lysyanskaya, Gary T. Marx, Aleecia M. McDonald, Dr. Pablo G. Molina, Peter G. Neumann, Helen Nissenbaum, Frank Pasquale, Dr. Deborah Peel, MD, Stephanie E. Perrin, Marc Rotenberg, Pamela Samuelson, Bruce Schneier, and Christopher Wolf.

Upcoming Conferences and Events

"The Future of .ORG." Feb. 11, 2020. George Washington University, Washington College of Law, Washington, DC. Marc Rotenberg, EPIC President.

"AI and Facial Recognition," European Data Protection Supervisor. Feb. 13, 2020. Brussels, Belgium. Marc Rotenberg, EPIC President.

"Social Media: Challenges and Ways to Promote Freedoms and Protect Activists," UN High Commissioner for Human Rights. Feb. 16–17, 2020. Doha, Qatar. Marc Rotenberg, EPIC President.

"The Future of Artificial intelligence and Fundamental Rights." Feb. 18, 2020. University of Florence, Florence, Italy. Marc Rotenberg, EPIC President.

Invited Lectures. Feb. 19–21, 2020. Bocconi University, Milan, Italy. Marc Rotenberg, EPIC President.

OECD AI Expert Group. Feb. 26–27, 2020. Paris, France. Marc Rotenberg, EPIC President.

Launch of OECD AI Policy Observatory. Feb. 27, 2020. Paris, France. Marc Rotenberg, EPIC President.

OECD AI Expert Group. Apr. 22–24, 2020. Paris, France. Marc Rotenberg, EPIC President.

AI World Society, Harvard University. Apr. 28, 2020. Harvard University, Cambridge, MA. Marc Rotenberg, EPIC President.

EPIC Champion of Freedom Awards Dinner. June 3, 2020. Washington, DC.