{"id":4148,"date":"2022-12-12T15:53:07","date_gmt":"2022-12-12T15:53:07","guid":{"rendered":"https:\/\/2024.thenexus.today\/index.php\/2022\/12\/12\/a-coordinated-effort-not-to-mention-the-elephant\/"},"modified":"2022-12-12T15:53:07","modified_gmt":"2022-12-12T15:53:07","slug":"a-coordinated-effort-not-to-mention-the-elephant","status":"publish","type":"post","link":"https:\/\/2024.thenexus.today\/index.php\/2022\/12\/12\/a-coordinated-effort-not-to-mention-the-elephant\/","title":{"rendered":"ADPPA and a &#8220;coordinated effort&#8221; not to mention the elephant: Federal privacy legislation update, December 12"},"content":{"rendered":"<p><em>Updated December 15.<\/em><\/p>\n<blockquote><p>&#8220;Even as enthusiasm among ADPPA&#8217;s most optimistic supporters <a href=\"https:\/\/www.brookings.edu\/blog\/techtank\/2022\/08\/12\/federal-privacy-negotiators-should-accept-victory-gracefully\/\" rel=\"noopener noreferrer\">remains high<\/a>, its prospects are limited this late in the term. Barring miraculous inclusion in a must-pass spending measure, the highest possible outcome for the bill this year is symbolic passage in the House.<\/p>\n<p>There appears to have been a coordinated effort underway this week to accomplish that limited goal, which the bill&#8217;s supporters believe will put them on stronger footing for 2023.&#8221;<\/p>\n<p>\u2013 IAPP Managing Director Cobun Zweifel-Keegan, <a href=\"https:\/\/iapp.org\/news\/a\/a-view-from-dc-privacy-compromise-as-seen-on-tv\/\">Privacy compromise: As seen on TV<\/a><\/p><\/blockquote>\n<p>Even though Congress about to leave town and time is ticking down for any action on privacy legislation this session, there&#8217;s been a sudden flurry of activity on the American Data Privacy and Protection Act (ADPPA). \u00a0A glowing <a href=\"https:\/\/www.washingtonpost.com\/opinions\/2022\/12\/08\/tech-privacy-bill-bipartisan-congress\/\">editorial<\/a> supporting ADPPA in the Washington Post, a long <a href=\"https:\/\/www.youtube.com\/watch?v=Yfabe8hyPU4\">interview<\/a> with the sponsors on ABC Live that left Cobun &#8220;starry-eyed,&#8221; a <a href=\"https:\/\/www.techdirt.com\/2022\/12\/09\/the-us-finally-has-a-chance-for-a-federal-privacy-law-it-should-take-it\/\">spin-filled <em>TechDirt<\/em> article<\/a> by David Morar of New America&#8217;s Open Technology Institute (OTI) &#8230; yeah, it sure seems like a &#8220;coordinated effort.&#8221; And what a surprise, none of them mention the elephant in the room.<\/p>\n<p>On Twitter, Zweifel-Keegan clarified<\/p>\n<blockquote><p>when I say &#8220;coordinated effort&#8221; I mean the appearance of a coordinated effort among civil society groups and the bill&#8217;s sponsors. This last-minute effort, like most of the ADPPA saga so far, does not carry many fingerprints of Industry\u2122\ufe0f<\/p><\/blockquote>\n<p>Joe Jerome of Facebook liked his tweet so it must be true! \u00a0Although &#8230; the Washington Post is owned by Jeff Bezos. ABC is owned by Disney. New America&#8217;s <a href=\"https:\/\/www.newamerica.org\/our-funding\/\">funding<\/a> includes $9.4 million from the Bill and Melinda Gates Foundation, $4,000,000 from ex-Google CEO Eric Schmidt and his wife Wendy Schmidt, $1,885,000 from Google, $550,000 from Amazon, $300,000 from Microsoft, $7,300,000 from Melinda French Gates&#8217; Pivotal Ventures, and $2,000,000 from Reid Hoffman. \u00a0So call me cynical, but if you look hard enough there might just be some industry influence here.<\/p>\n<p>After all, as New America&#8217;s Morar points out in the TechDirt article, there are &#8220;myriad reasons why companies might support regulation.&#8221; \u00a0So before we get to the elephant, let&#8217;s look at some of the reasons Big Tech might be supporting this particular regulation. \u00a0The current version of ADPPA:<\/p>\n<ul>\n<li>lets companies buy and sell location data as long as it&#8217;s &#8220;deidentified&#8221; (which as Sen. Ron Wyden points out could allow data brokers to sell location data to the government about visits to reproductive health facilities) or comes from an image taken by a surveillance camera<\/li>\n<li>&#8220;enforces&#8221; civil rights protections by <a href=\"__GHOST_URL__\/adppa-impact-assessments-and-civil-rights\/\">letting companies like Facebook and Twitter do their own algorithmic impact assessments <\/a>\u2013 and completely exempts government contractors like Palantir and ShotSpotter from doing algorithmic impact assessments as long as they&#8217;re acting as service providers<\/li>\n<li><a href=\"https:\/\/oag.ca.gov\/system\/files\/attachments\/press-docs\/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf\">puts up barriers to state Attorneys General enforcing the law<\/a><\/li>\n<li>adds a lot of responsibilities to the FTC without guaranteeing them any more funding<\/li>\n<li>lets companies require mandatory arbitration<\/li>\n<li>completely exempts employee data \u2013 and provides very little protection for data on employee-issued machines<\/li>\n<li>guts FCC oversight of telecom companies, and appears to give them <a href=\"https:\/\/www.vice.com\/en\/article\/m7gb9y\/new-us-privacy-law-may-give-telecoms-free-pass-on-dollar200-million-fines\">a free pass on $200,000,000 in fines<\/a> the FCC handed out in 2020.<\/li>\n<li>gets rid of existing state and local consumer privacy laws, like <a href=\"https:\/\/www.eff.org\/document\/2022-07-13-letter-maine-ag-congress-re-adppa\">Maine&#8217;s ISP privacy law<\/a>, the Seattle Broadband Ordinance, and California&#8217;s CCPA\/CPRA<\/li>\n<li>prevents states, counties, and cities from protecting their residents by passing future consumer privacy laws.<\/li>\n<\/ul>\n<p>So yeah I can certainly see why ADPPA is widely supported by the tech industry (as Jennifer Haberkorn <a href=\"https:\/\/www.latimes.com\/politics\/story\/2022-09-06\/congress-mulls-data-privacy-bill-that-would-void-california-tougher-protections\">reported<\/a> in September), as well as industry trade organization ITIF and Big Tech&#8217;s favorite Congresswoman Suzan DelBene (D-Microsoft). \u00a0Of course they&#8217;d like it to be weakerned further, but even in its current form it&#8217;s a good deal from their perspective.<\/p>\n<p>And then there&#8217;s the elephant, a huge issue that ADPPA supporters never discuss in detail. \u00a0As Kim Clark of Seattle-based Legal Voices said <a href=\"https:\/\/www.spokesman.com\/stories\/2022\/jul\/25\/historic-data-privacy-law-could-be-within-reach-if\/\">in July<\/a><\/p>\n<blockquote><p>\u201cThis bill, at least from the perspective of pregnant people, it really doesn\u2019t do much.\u201d<\/p><\/blockquote>\n<p>And ADPPA&#8217;s loopholes that fail to protect pregnant people from post-Roe threats also leave immigrants, Muslims, LGBTQ+ people, and other vulnerable people exposed. \u00a0It&#8217;s disappointing that organizations like OTI (who works &#8220;to ensure that every community has equitable access to digital technology and its benefits&#8221;) don&#8217;t think this even matters enough to mention. Politically, though, I can certainly see why Big Tech would want to get the current Democratic-controlled House to sign off on this in the lame duck unstead of waiting until the Republicans take over in the new year. \u00a0<\/p>\n<p>Of course, as <a href=\"https:\/\/publicknowledge.org\/policy\/coalition-letter-to-speaker-pelosi-calling-for-adppa-vote\/\">EPIC Privacy, OTI, Public Knowledge, CDT, and the other public interest, labor, consumer advocacy, and civil rights groups calling for a vote on ADPPA<\/a> point out, ADPPA could still be strengthened before it comes to the House floor. Realistically, though, with the very compressed timeframe of the lame duck session it&#8217;s hard to imagine any significant strengthening. In fact, the changes the House Energy &amp; Commerce made to the bill in July <em>weakened <\/em>ADPPA significantly. I&#8217;m sure <a href=\"https:\/\/www.politico.com\/news\/2022\/08\/28\/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958\">data brokers<\/a> and <a href=\"https:\/\/www.protocol.com\/newsletters\/policy\/cloud-enterprise-privacy\">big tech companies who have been lobbying so successfully<\/a> on the bill will try to weaken it further before it moves forward. <\/p>\n<p>Will Big Tech get what they want? Currently, Speaker Pelosi and the rest of the California delegation are blocking the bill because it preempts California&#8217;s privacy laws. \u00a0 Maybe the last-minute campaign will get California to back down; or, maybe there&#8217;s a &#8220;compromise&#8221; in the works. \u00a0We shall see.<\/p>\n<p>If ADPPA <em>does<\/em> go to a vote on the House floor (or gets &#8220;miraculously&#8221; attached to a must-pass bill) without being strengthened, groups like EPIC Privacy and all the other privacy, civil rights, and public interest groups who have been pushing for a vote on ADPPA are likely to be in a very tough situation.<\/p>\n<p>Then again, Congress has a lot of other stuff on its plate, and it&#8217;s quite possible that nothing will happen in the next two weeks. \u00a0As Cobun says<\/p>\n<blockquote><p>&#8220;[T]he more achievable target of all this activity is momentum for further progress in the 118th Congress. The unity on display among the two E&amp;C leaders as they prepare to swap roles in 2023 seems carefully crafted to send a single message: the change of party control will not upset the compromise that was reached in crafting ADPPA.&#8221;<\/p><\/blockquote>\n<p>I&#8217;ll discuss the implications for 2023, and the potential tough spot for EPIC et al, later on in the article.<\/p>\n<p>But first, let&#8217;s talk a little more about the elephant.<\/p>\n<h2 id=\"why-would-congressional-democrats-support-a-privacy-bill-that-doesnt-protect-pregnant-people\">Why would Congressional Democrats support a privacy bill that doesn&#8217;t protect pregnant people?<\/h2>\n<p>I wrote about the elephant at much greater length in <a href=\"__GHOST_URL__\/adppa-post-roe-threats\/\">How well does ADPPA protect against post-Roe threats?<\/a>, where I evaluated the bill against several key post-Roe privacy threats &#8230; but it&#8217;s such an important point that it really bears repeating! \u00a0Here&#8217;s the summary:<\/p>\n<p><strong>\u2705 <\/strong><em><strong>yes<\/strong>!<strong> <\/strong>ADPPA passes the test<\/em><br \/><strong>\u2753 <\/strong><em>I\u2019m not sure or it&#8217;s complex<\/em><br \/><strong>\u274c <\/strong><em><strong>no.<\/strong> \u00a0ADPPA does not currently pass the test<\/em><\/p>\n<ul>\n<li>\u274c Does ADPPA prevent prosecutors and law enforcement in states that have criminalized abortion from buying location data and targeting people who visit reproductive health care centers?<\/li>\n<li>\u274c When people travel out of state to get abortions, does ADPPA protect their data?<\/li>\n<li>\u274c Does ADPPA allow pregnant people to force companies to delete data that might put them at risk?<\/li>\n<li>\u274c Does ADPPA protect pregnant people and abortion providers from risks of automated license plate readers (ALPRs)?<\/li>\n<li>\u2753Does ADPPA prevent anti-abortion \u201ccrisis pregnancy centers\u201d from sharing data with vigilantes and law enforcement?<\/li>\n<li>\u2753Will ADPPA hold \u201ccrisis pregnancy centers\u201d who break the law and violate people\u2019s privacy accountable?<\/li>\n<li>\u274c Will ADPPA prevent law enforcement from accessing people&#8217;s private messages to investigate whether they got an abortion?<\/li>\n<\/ul>\n<p>Like I said above, I can certainly see why Big Tech would want to get the current Democratic-controlled House to sign off on this. And I can certainly see why Republicans would go for it! But what&#8217;s in it for Democrats \u2013 especially after they did much better than expected in the midterms because so many voters are passionate about protecting reproductive freedom?<\/p>\n<p>One possibility is that most Congressional Democrats don&#8217;t even realize how significant an issue this is with ADPPA. \u00a0As far as I know, none of the public interest, privacy, and civil rights groups who have been pushing for a vote on ADPPA have done any detailed analysis of this. \u00a0The <a href=\"https:\/\/publicknowledge.org\/public-knowledge-joins-more-than-20-public-interest-groups-urging-house-to-vote-on-adppa-to-protect-consumers\/\">most recent letter<\/a> is typical: it mentions in the first paragraph that passing comprehensive privacy legislation &#8220;is even more vital in a post-Dobbs world&#8221; but doesn&#8217;t have any discussion at all whether or not the legislation would actually address post-Dobbs threats. \u00a0But at least it acknowledges the existence of the elephant! \u00a0<a href=\"https:\/\/techpolicy.press\/evaluating-the-american-data-privacy-and-protection-act\/\">Evaluating the American Data Privacy and Protection Act<\/a>, by Alan Butler and Caitriona Fitzgerald of EPIC Privacy, doesn&#8217;t even mention Dobbs, Roe, reproductive health, or abortion.<\/p>\n<p>So it could well be that a lot of Congressional Democrats are assuming that if groups like EPIC (which under their previous Executive Director Marc Rotenberg had a well-deserved reputation for being uncompromising on privacy issues) aren&#8217;t bringing the issue up, everything is copacetic. \u00a0<\/p>\n<p>Then again, maybe they actually <em>do <\/em>know the reality. \u00a0Here in Washington state, supporters of the Bad Washington Privacy Act used the talking point of &#8220;perfect is the enemy of the good,&#8221; and I&#8217;m hearing the same thing from ADPPA supporters. It&#8217;s certainly true that there&#8217;s no such thing as perfect legislation, so Democrats may be tempted to advance ADPPA even if doesn&#8217;t protect pregnant people and hope that voters have forgotten about it by the time the next election rolls around.<\/p>\n<h2 id=\"be-careful-what-you-wish-for\">Be careful what you wish for<\/h2>\n<p>The same ADPPA loopholes that fail to protect pregnant people also put many others at risk. Most obviously, similar threats apply to trans people and their families in states that have criminalized gender-affirming health care; ADPPA doesn&#8217;t protect them either. \u00a0Or take the de-identified data loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, <a href=\"https:\/\/www.vox.com\/recode\/22587248\/grindr-app-location-data-outed-priest-jeffrey-burrill-pillar-data-harvesting\" rel=\"noopener ugc nofollow\">De-identified data has been used to out a gay Catholic priest<\/a>. <a href=\"https:\/\/www.vice.com\/en\/article\/jgqm5x\/us-military-location-data-xmode-locate-x\" rel=\"noopener ugc nofollow\">The military uses \u201cde-identified data\u201d to track Muslims<\/a>. <a href=\"https:\/\/www.wsj.com\/articles\/federal-agencies-use-cellphone-location-data-for-immigration-enforcement-11581078600\" rel=\"noopener ugc nofollow\">DHS uses de-identified data to help identify immigrants who were later arrested<\/a>. \u00a0Hey wait a second, I&#8217;m noticing a pattern here.<\/p>\n<p>Maybe ADPPA will get strengthened to address these problems. \u00a0Quite frankly, though, from everything I&#8217;ve heard from staffers and negotiators &#8230; that seems very unlikely. \u00a0If not, and ADPPA goes forward in its current weak form \u2013 or gets further weakened \u2013 it leaves EPIC Privacy and all the other privacy, civil rights, and public interest groups who have been pushing for a vote on ADPPA in a real tough situation. \u00a0<\/p>\n<p>On the one hand, &#8220;perfect is the enemy of the good.&#8221; \u00a0 <\/p>\n<p>On the other hand, the current version of ADPPA doesn&#8217;t protect the people most at risk from having their data abused \u2013 and history shows that once privacy legislation has been passed, it doesn\u2019t get significantly strengthened. \u00a0<\/p>\n<p>So what message would it send if EPIC Privacy and all these other groups support a bill that protects cis, straight, Christian people born in the US who can&#8217;t get pregnant \u2013 and lets Facebook, Twitter, Palantir, ShotSpotter, data brokers, and other badly-behaving tech companies continue to exploit people&#8217;s data?<\/p>\n<h2 id=\"laying-the-groundwork-for-2023\">Laying the groundwork for 2023?<\/h2>\n<blockquote><p>Keep in mind that Big Tech is playing a long game here. \u00a0If Congress passes a weak preemptive ADPPA this year, they win. If not, they&#8217;ll go back to <a href=\"https:\/\/themarkup.org\/privacy\/2021\/04\/15\/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious\">pushing states to pass weak privacy laws<\/a> and<a href=\"https:\/\/themarkup.org\/privacy\/2022\/05\/26\/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time\"> watering down attempts at privacy regulation, one state at a time<\/a>.<\/p>\n<p>\u2013 <a href=\"__GHOST_URL__\/adppa-new-compromise\/#tweaking-the-grand-bargain\">&#8220;Tweaking&#8221; the &#8220;grand bargain&#8221;<\/a> , September 12<\/p><\/blockquote>\n<p>As Zweifel-Keegan mentioned, it&#8217;s still possible that ADPPA will &#8220;miraculously&#8221; get attached to a must-pass bill. \u00a0Otherwise, whether or not the House advances ADPPA in the lame duck, the battle will resume next year \u2013 in Congress and the states.** <\/p>\n<p>As Keir Lamont says in <a href=\"https:\/\/fpf.org\/blog\/five-big-questions-and-zero-predictions-for-the-u-s-state-privacy-landscape-in-2023\/\">Five Big Questions (and Zero Predictions) for the U.S. State Privacy Landscape in 2023<\/a>, it&#8217;s possible that ADPPA will substantially drive the content of state privacy bills. If EPIC and all these other public interest, privacy, and civil rights groups are able to use their influence to get the House to advance a significantly strengthened version of the ADPPA that protects the people most at risk from data abuse, that&#8217;ll be good news.<\/p>\n<p>If you look at ADPPA supporters&#8217; talking points, they&#8217;re clearly trying to convince people that the only reason ADPPA hasn&#8217;t advanced is because selfish Californians who don&#8217;t want it to preempt their state laws are letting their ego get in the way. This is nonsense, of course; not only are there lots of other important issues (including the elephant), but \u00a0<a href=\"__GHOST_URL__\/adppa-new-compromise\/#people-in-other-states-and-cities-have-opinions-on-preemption-too\">people in other states and cities have opinions on preemption too<\/a>. Still, it&#8217;s a useful narrative from Big Tech&#8217;s perspective. And if ADPPA hits the House floor <em>without<\/em> getting strengthened (or worse, in a further-weakened form), and groups who are pushing for a vote decide to support it, it reinforces the scenario I warned about in <a href=\"__GHOST_URL__\/adppa-new-compromise\/#tweaking-the-grand-bargain\">&#8220;Tweaking&#8221; the &#8220;grand bargain&#8221;<\/a> <\/p>\n<blockquote><p>&#8220;EPIC&#8217;s and Lawyers&#8217; Committee&#8217;s strong support for ADPPA is likely to make Big Tech&#8217;s path through the states a lot easier.&#8221; <\/p><\/blockquote>\n<p>We can probably overcome this in Washington state, where we&#8217;ve got a strong base of local privacy advocates \u2013 and other DC-based privacy organizations have undercut their credibility by supporting the Bad Washington Privacy Act. \u00a0It&#8217;s hard to know about other states. \u00a0Time will tell.<\/p>\n<p>Shifting focus back to Congress &#8230; even if the House advances ADPPA, next year&#8217;s a new session and everything restarts. Still, if Republicans decide to prioritize a giveaway to Big Tech, Democrats advancing ADPPA now certainly makes their lives a lot easier \u2013 pressure will mount on Sen. Maria Cantwell to surrender and get on board. \u00a0<\/p>\n<p>Then again, Republicans will have a very thin majority in the House. \u00a0If new House Minority Leader Hakeem Jeffries and the rest of Democratic leadership decide to fight to protect pregnant people, immigrants, Muslims and LGBTQ+ people, they certainly have a chance to block it. \u00a0And Democrats will still control the Senate, meaning Sen. Cantwell will continue to chair the Senate Commerce Committee \u2013 and she may well try to take another try at privacy legsilation herself \u00a0So no matter what happens over the next few weeks, ADPPA&#8217;s not a slam dunk next year.<\/p>\n<p>Still, Big Tech&#8217;s prospects for 2023 are certainly a lot brighter if they can cajole Speaker Pelosi, the California delegation, and the rest of the House into advancing it without strengthening it. \u00a0And privacy advocates&#8217; prospects are a lot brighter if EPIC et al are able to strengthen the bill \u2013 or say no if the bill isn&#8217;t strengthened. <\/p>\n<p>And who knows, there may still be some &#8220;miraculous&#8221; last-minute shenanigans. \u00a0As we say in Washington state, it ain&#8217;t over &#8217;til its over.<\/p>\n<p>Stay tuned!<\/p>\n<hr>\n<h2 id=\"notes\">Notes<\/h2>\n<p>* Todd Feathers&#8217; <a href=\"https:\/\/themarkup.org\/privacy\/2021\/04\/15\/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious\">Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious<\/a>, Feathers&#8217; and Alfred Ng&#8217;s 2022 <a href=\"https:\/\/themarkup.org\/privacy\/2022\/05\/26\/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time\">Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time<\/a>, and Ben Brody&#8217;s <a href=\"https:\/\/www.protocol.com\/policy\/state-privacy-utah-spsc\">Quiet industry lobbyists are watering down state privacy laws<\/a> have more on Big Tech&#8217;s strategy for pushing weak legislation at the state level. ] <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Updated December 15. &#8220;Even as enthusiasm among ADPPA&#8217;s most optimistic supporters remains high, its prospects are limited this late in the term. Barring miraculous inclusion in a must-pass spending measure, the highest possible outcome for the bill this year is symbolic passage in the House. There appears to have been a coordinated effort underway this [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[458],"class_list":["post-4148","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-adppa"],"_links":{"self":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts\/4148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/comments?post=4148"}],"version-history":[{"count":0,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts\/4148\/revisions"}],"wp:attachment":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/media?parent=4148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/categories?post=4148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/tags?post=4148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}