Lawyers' Committee Opposes New Draft of American Privacy Rights Act
lawyerscommittee.org
lawyerscommittee.org
> Passing comprehensive privacy legislation would be a major public good–but APRA no longer can be called comprehensive. Civil rights guardrails are essential for consumer trust in a system that allows companies to collect and use personal data without consent. The new draft strips out anti-discrimination protections, AI impact assessment requirements, and the ability to opt-out of AI decision-making for major economic opportunities like housing and credit. We cannot abide a regime that would perpetuate, in the words of Dr. Ruha Benjamin, a form of ‘Jim Code’: ‘the employment of new technologies that reflect and reproduce existing inequities.’
> The new draft of APRA also creates a massive loophole for personal data collected and used on an individual’s device. Tech companies would be able to do almost anything they want with data that stays on a personal device–no data minimization rules, no protections for kids, no advertising limits, no transparency requirements, no civil rights safeguards, and no right to sue for injured consumers. As AI and computing become more powerful, allowing more processing to occur on a device, this loophole will grow. As a result, this draft of APRA is weaker than state laws it is preempting.
That hardly amounts to an uncontroversial and obvious good—I would say regardless of your feelings on the anti discrimination provisions that it should be the uncontroversial to reject this legislation.
Individual actions and usernames are recorded. Let’s call that personal data. That has to stay on the device.
But what if I also ran a “collect usage metrics” process that ran once a week and summarized your actions, removed your username and replaced it with a random GUID, and otherwise painted a profile of how you used my software over the last seven days?
Is that summary level data still considered protected? Can I send that back to my servers without telling you, or if I add a settings toggle for “share usage data to help improve our products”, is that ok?
At what point does data become generic enough to not be personal?
If the systems recreate existing inequalities, then we haven't solved these issues in real life. How can we solve these issues comprehensively?
Seems a better approach is pass privacy protections, then pass laws addressing specific things as we have solutions for them. The AI impact assessment would be better in an AI specific bill that tackles other AI issues too (like law enforcement or government use, what types of systems should require human in the loop, etc).
Privacy is an incredibly basic and fundamental right. If there is any provision for data collection without consent ("AI" or otherwise), then that right is violated. No amount of "guardrails" can recover that violation.
"the core purpose of privacy: to ensure that who we are cannot be used against us unfairly."
No. Privacy is an end in itself. It is a human right. Falling back to economic justifications weakens the foundation of fighting for privacy.
I think it is in fact quite apt to say that the right to a speedy trial is to indefinite detainment as the right to privacy is to your information being used against you. Both are material consequences of lacking those rights.
The basis for the right which was, in part, ABSOLUTELY rooted in the idea that the because people and governments have a tendency to discriminate against you based on what you believe, then as long as you do not disclose your interests publicly, there should be no basis for discrimination. And why is this discrimination so important when NOT dealing with the government (which are nothing but glorified property protection rackets)?
Economics. Specifically, trade. That thing that mankind has been doing since before we've actually had recorded history? Whether it's bartering or seashells or labor or whatever, it's an essential part of being human, because it's how you get things you need to survive.
Again, we do not assign rights for which we cannot find a real purpose. You cannot be a functioning human being in a society without economic activity, whether you perform it or someone performs it on behalf of you.
You're flat out wrong.
For example, I like how the Declaration of Independence says "We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness." There's no attempt to justify them, just a plain statement that "GFY, obviously we have these rights".
As to privacy in particular, I don't think it's a stretch to interpret (4th am) the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" as articulating support for our modern concept of privacy.
Sure, today's corrupt politicized SCOTUS could decide to interpret it otherwise. But it seems naive to think that justification based on fear of discrimination is going to prevent that disreputable politicized SCOTUS from interpreting it to some ends (i.e. outcomes favored by the parties lavishing upon them tangible gifts), no matter how well you argue it.
So, sure, go ahead, argue for our rights on any basis you can find. I hope you succeed.
Yes.
> by the argument that indefinite detention would unfairly limit our ability to obtain an auto loan?
No. It is justified by arguments like without it the state could delay your trial indefinitely keeping you in legal limbo (and possibly incarcerated) for as long as they want which would effectively negate your right to trial. They exact justifications used vary by country.
Statement: I support the right to wear pants.
Response: The core purpose of pants are economic, safety and consent. You can use this necklace to wear your wallet, phone and keys around your neck. We promise to keep the thermostat at 72F, and that we will not do anything without your consent. No pants for you.
This sounds like you want the right to prevent people from talking about you at all.
I don't see even the vaguest mention of economics in this quote. Copy-paste fail?
> no person “shall be compelled in any criminal case to be a witness against himself.”
I'd be interested to see what kind of non-discrimination provision was removed. A rule against discriminating against people for exercising their privacy rights, like we see in the California Consumer Privacy Act, GDPR, &c.? Or a more general, civil rights-style prohibition, perhaps incorporating a list of protected classes?
They mention the new draft could be weaker than state laws it would preempt. I take it that's most likely a reference to California law. But it comes after discussion of a loophole they see for on-device data, not the part of about non-discrimination.
It makes sense for a civil rights organization to want strong nondiscrimination language in a federal privacy bill. But I'm not sure we've seen those bundled in one law and passed before. We have with AI-specific legislation. If the APRA is turning into more of an Omnibus Big Tech Bad Behavior bill, AI regs included, that might make political sense.
I htink there were three key sections that got cut out:
1) "A covered entity or service provider may not collect, process, retain, or transfer covered data in a manner that discriminates in or otherwise makes unavailable the equal enjoyment of goods or services on the basis of race, color, religion, national origin, sex, or disability." This was hugely important, it was sa major victory to get a bipartisan committee majority supporting similar language in APRA's predecessor ADPPA.
2) Requirements for algorithmic impact assessments by large companies (I forget the exact threshold).
3) A requirement to let people opt-out of consequencial automated decisions (with some exceptions), somewhat similar to California's CCPA.
I don't know anything about the legislation, but the linked article's main complaint seems to be that anti discrimination language was removed from the bill. Ok. I don't understand all the issues involved with that, or what that language was.
Regardless, is it still good without that? Does it increase our privacy rights? Why not move the needle in the right direction and then lobby for additional things?
> Why not move the needle in the right direction and then lobby for additional things?
Two reasons. Preemption not only weakens some existing laws, it keeps states from passing future stronger laws -- so it caps protections. And, politicially, no privacy law in the US has ever been strengthened by Congress (or state legislatures) ... so, it's very unlikely that the lobbying for additional things will have an affect.