EPIC Alert 27.16

1. EPIC Analysis: Supreme Court Nominee Amy Coney Barrett's Record on Privacy

Supreme Court nominee Amy Coney Barrett has a mixed record on Fourth Amendment and Article III standing issues but an alarming view of the federal statute that protects consumers from robocalls, according to an EPIC analysis of Judge Barrett's past writings.

Barrett—a judge on the Seventh Circuit U.S. Court of Appeals—has twice ruled that evidence should be excluded from a criminal case because police had violated the Fourth Amendment: once because officers stopped a car on an unreliable tip and once because officers did not obtain valid consent to search an apartment. But Judge Barrett also stated that the exclusionary rule is "strictly limited," refusing to suppress evidence collected through a warrantless border search of traveler's cell phone and obtained on the basis of an overbroad warrant.

In Gadelhak v. AT&T Services—a case in which EPIC filed an amicus brief—Judge Barrett interpreted the federal robocall statute narrowly, allowing companies to use many types of autodialing equipment without penalty. If Judge Barrett is confirmed to the Court before the end of November, she will hear Facebook v. Duguid, a similar case that concerns the federal robocall ban.

Judge Barrett's record on Article III standing—a doctrine that affects the right of consumers to bring suit for privacy violations—is somewhat better. Although Judge Barrett has twice ruled that consumers lacked standing, she has also underscored that standing is separate from the merits of a plaintiff's claims and ruled in Gadelhak that invasive robocalls provide a valid basis for suit.

EPIC regularly reviews the privacy records of Supreme Court nominees, including Justice Kavanaugh, Justice Gorsuch, Justice Kagan, Justice Sotomayor, Justice Alito, and Chief Justice Roberts.

2. EPIC Publishes Analysis of California's Proposition 24

EPIC has published an analysis of Proposition 24 in California, the California Privacy Rights Act. EPIC is not taking a position for or against Proposition 24, but provides this resource to help voters understand the initiative.

In 2018, the State of California enacted the California Consumer Privacy Act of 2018, the first comprehensive consumer privacy law in the United States. This year, Californians will once again play a role in determining the direction of privacy law in the United States. A new November ballot initiative, California Proposition 24: The California Private Rights Act of 2020, would significantly change the CCPA.

As EPIC explains, Proposition 24 would create an independent California Privacy Protection Agency, which would be a major step forward in protecting the privacy of California residents. The initiative would also add some protections for sensitive data, take steps towards ensuring algorithmic transparency and fairness, and establish some data minimization requirements.

However, Proposition 24 also weakens protections for biometric data, allows "pay for privacy" schemes in which companies offer discounts for permission to collect and use personal data, and fails to expand the limited private right of action currently available under the CCPA.

EPIC has also published a separate resource to help California residents exercise their rights under the CCPA.

3. EPIC v. DOJ: Court Demands Trump's Position on Release of Unredacted Mueller Report

A federal court ordered the Department of Justice today to determine President Trump's position on releasing the complete, unredacted Mueller Report. The President recently tweeted that he has "fully authorized the total Declassification of any & all documents" pertaining to the Russia investigation with "[n]o redactions!"

During a hearing this morning in EPIC's and BuzzFeed's joint cases for disclosure of the complete Mueller Report, Judge Reggie B. Walton rejected the DOJ's claim that the White House did not actually intend to declassify any information via the President's tweets. "It's not the White House that declassifies information, it's the President," Walton said.

Judge Walton ordered the DOJ to provide a sworn statement by Tuesday from someone "who has conferred directly with the President" as to whether the entire Mueller Report should be released. Walton has already ordered the DOJ to provide EPIC with extensive new material from the Report by November 2, in addition to the material previously disclosed as a result of EPIC's case.

EPIC's Freedom of Information Act suit—the first in the nation for the disclosure of the Mueller Report—is EPIC v. DOJ, No. 19-810.

4. EPIC Opposes DHS's Plans to Broadly Expand Biometric Collection

In comments to the Department of Homeland Security and U.S. Citizenship and Immigration Services, EPIC urged the agency to rescind a proposed rule to broadly permit DHS to collect biometric from immigrants, their families, and their associates.

DHS's rule would enable the collection of palm prints, iris images, voiceprints, DNA, and images for facial recognition. EPIC argued that DHS's broad authorization of biometric collection was incompatible with the department's Fair Information Practice Principles.

"DHS's proposed rule to expand the collection and use of biometric modalities and information is ill-advised," EPIC wrote. "DHS should immediately rescind the proposed rule and commit to narrowing the use of biometrics to the bare minimal needed to affect its mission."

EPIC specifically called on the agency to suspend the use of facial recognition technology. "Ubiquitous identification via facial recognition by the government eliminates the individual's ability to control the disclosure of their identities, creates new opportunities for tracking and monitoring, and increases the security risks from data breaches," EPIC explained. "An individual's ability to control disclosure of his or her identity is an essential aspect of personal freedom and autonomy. The use of facial recognition erodes these freedoms."

EPIC consistently opposes biometric data collection at DHS. In April, EPIC urged DHS to narrow both the use and Privacy Act exemptions for its Insider Threat Database linking biometrics to personal information. Earlier this year, EPIC and 40 other organizations called on the Privacy and Civil Liberties Oversight Board to recommend the suspension of face surveillance systems across the federal government.

5. EPIC Advises Consumer Watchdog to Regulate Lender Use of Machine Learning

Oracle, responding to a recent demand letter from EPIC, insisted that there is "no discernable basis" to believe that its pending partnership with TikTok threatens the privacy of TikTok users—despite extensive evidence to the contrary.

Calling the privacy risks that EPIC identified "very theoretical," Oracle General Counsel Dorian Daley charged that EPIC has "confused [Oracle] with large consumer-facing tech platforms that make their billions on advertising by exploiting the personal data of their users."

However, the reliance of Oracle's business model on the exploitation of personal data is well documented, including in an exhaustive 2018 complaint from Privacy International that lays out the privacy harms caused by Oracle Data Cloud. As Oracle has itself acknowledged, "Oracle Data Cloud aggregates, analyzes, and activates consumer data, enabling marketers to connect to customers and prospects . . . target the right consumers, [and] personalize their experience."

EPIC's letters to Oracle and TikTok warned that unless they "adequately protect the privacy of TikTok users," EPIC intends to bring a lawsuit against both companies under the D.C. Consumer Protection Procedures Act. EPIC previously used the same law to force AccuWeather to stop deceptively gathering users' location data.

In a separate response to EPIC, TikTok said that user privacy "will remain a priority for TikTok" if and when a deal with Oracle is finalized—but stopped short of agreeing to EPIC's full demands.

News in Brief

EPIC Advises CFPB to Regulate Lender Use of Machine Learning

In comments to the Consumer Financial Protection Bureau, EPIC urged the agency to issue regulations that ensure borrowers are protected under the Equal Credit Opportunity Act when lenders use AI/Machine Learning systems to make lending decisions. EPIC specifically recommended that the agency rely on the Universal Guidelines for Artificial Intelligence, the OECD AI Principles, and scientific expertise in establishing regulatory guidance that requires explainability, transparency, and mitigation of bias in these systems. EPIC recommends agencies Government-wide enact similar regulations and has urged Congress to enact federal baseline requirements about government use of AI and consumer privacy.

EPIC Urges DHS to Extend Comment Period on Massive Expansion of Biometric Data Collection

In a letter to the Department of Homeland Security, EPIC urged DHS to provide the standard 60-day comment period for a notice of proposed rulemaking authorizing DHS to expand its biometric data collection practices. DHS would be able to collect finger/palm prints, images for facial recognition, DNA, iris images, and voiceprints from a broad swath of the population, including millions of citizens. The proposed rule would subject immigrants to "continuous vetting" surveillance up-to and even past the time they obtain citizenship. In 2018 EPIC urged CBP to suspend its biometric entry/exit program. EPIC currently leads a campaign to Ban Face Surveillance.

Georgia Court Denies Motion to Require Hand-Marked Paper Ballots

A federal court in Georgia has ruled against plaintiffs who had brought suit in an effort to force Georgia election officials to use hand-marked paper ballots instead of its new electronic voting machines in the November election. However, Judge Amy Totenberg said the State must tackle the cybersecurity issues presented by electronic voting machines. In an amicus brief in the case, EPIC had asked the court to protect the secret ballot. EPIC wrote that "the right to cast a secret ballot in a public election is a core value in the United States." It was the second amicus brief EPIC has submitted in the case, Curling v. Raffensperger. In the earlier amicus brief, EPIC urged the court to stop Georgia's use of Direct Recording Electronic voting machine, which EPIC explained were unreliable and easily hacked. The court ruled that Georgia must replace those voting machines before the 2020 election.

House Judiciary Committee Reports on Competition in Digital Markets

The House Judiciary Committee has released its report following a years-long investigation of competition in digital markets. "[O]nline platforms' dominance carries significant costs. It has diminished consumer choice, eroded innovation and entrepreneurship in the U.S. economy, weakened the vibrancy of the free and diverse press, and undermined Americans' privacy," the report states. The Committee also found that the Federal Trade Commission had neglected to use the antitrust authorities granted to the agency by Congress. "In its first hundred years, the FTC promulgated only one rule defining an "unfair method of competition," the report notes. EPIC had previously told the Committee that merger review must consider data protection. "The United States stands virtually alone in its unwillingness to address privacy as an increasingly important dimension of competition in the digital marketplace," EPIC said. The committee report makes numerous recommendations, including "structural separations and prohibitions of certain dominant platforms from operating in adjacent lines of business."

EPIC in the News

• Judge Orders That Trump Be Asked About Declassification Tweets in Mueller Info Fight, National Law Journal, Oct. 16, 2020
• Judge suggests White House counsel is overriding Trump's position on Russia docs, CNN, Oct. 16, 2020
• Pay No Attention To Trump's 'Declassify' Tweets, DOJ Says, Law360, Oct. 14, 2020
• Pay No Attention To Trump's 'Declassify' Tweets, DOJ Says, Law360, Oct. 14, 2020
• CBP Spent $2 Million On Google Maps For A Massive Surveillance Tool, Forbes, Oct. 13, 2020
• As Democrats Raise Alarm Over Barrett Materials, Litigation for Kavanaugh's Papers Drags On, Law.com, Oct. 12, 2020
• DOJ Asked to Explain Whether Trump Declassification Tweet Means Full Mueller Report Will Be Released, Epoch Times, Oct. 9, 2020
• No more magic in driver's licenses, Elkin Tribune, Oct. 7, 2020
• FOIA Roundup: FOIA finds regulatory weaknesses, the debts owed to D.C., and more Mueller soon, MuckRock, Oct. 6, 2020
• EPIC comments to CFPB urge application of universal AI guidelines and OECD AI principles, DataGuidance, Oct. 6, 2020
• Federal judge orders Bill Barr to release redacted portions of the Mueller report, Salon, Oct. 2, 2020

More EPIC in the News »

EPIC Bookstore

EPIC publications and books by members of the EPIC Advisory Board, distinguished experts in law, technology and public policy are available at the EPIC Bookstore.

Recent EPIC Publications

Communications Law and Policy: Cases and Materials, 7th Edition, by Jerry Kang and Alan Butler (Direct Injection Press 2020)

This teachable casebook provides an introduction to the law and policy of modern communications. The book is organized by analytic concepts instead of current industry lines, which are constantly made out-of-date by technological convergence. The basic ideas—power, entry, pricing, access, classification, (indecent) content, privacy, and intermediary liability—equip students with a durable and yet flexible intellectual structure that can help parse a complex and ever-changing field. This book includes concise technological and legal summaries and carefully edited opinions and FCC reports. It also includes "just-in-time" delivery of the text of statutes and regulations so that students get accustomed to parsing statutory material as they analyze legal questions.

The AI Policy Sourcebook 2020, edited by Marc Rotenberg (EPIC 2020).

The AI Policy Sourcebook includes global AI frameworks such as the OECD AI Principles and the Universal Guidelines for AI. The Sourcebook also includes AI materials from the European Union and the Council of Europe, national AI initiatives, as well as recommendations from professional societies, including the ACM and the IEEE. The Sourcebook also includes an extensive resources section on AI, including reports, articles, and books from around the world.

The Privacy Law Sourcebook 2020, edited by Marc Rotenberg (EPIC 2020).

The Privacy Law Sourcebook is the leading resource for students, attorneys, and policymakers interested in privacy law in the United States and around the world. The Sourcebook includes major U.S. privacy laws. The Sourcebook also includes key international privacy frameworks such as the EU General Data Protection Regulation and the modernized Council of Europe Convention on Privacy. The Privacy Law Sourcebook 2020 includes the new California Consumer Privacy Act, the Illinois Biometric Information Privacy Act, the Public Voice Declaration for a Moratorium on Facial Recognition, and updates on GDPR implementation. The Sourcebook also includes an extensive resources section with information on privacy agencies, organizations, and publications.

EPIC v. Department of Justice: The Mueller Report, edited by Marc Rotenberg (EPIC 2019).

EPIC v. Department of Justice: The Mueller Report chronicles the efforts to obtain a full account of Russian interference in the 2016 presidential election. EPIC filed the first lawsuit in the country for the release of the full and unredacted Mueller Report and obtained a newly redacted version in early May 2019. EPIC is now challenging the redactions made by the Department of Justice in federal court. This volume is an essential guide to the legal arguments about the redactions, the dispute between the Attorney General and the Special Counsel, and EPIC's request for the Mueller Report and other records about Russian interference in the 2016 presidential election.