Thread by @EPICprivacy

Good morning! EPIC Deputy Director Caitriona Fitzgerald will testify before Congress this morning on the need for a strong U.S. #privacy law and the proposed American Data Privacy and Protection Act. Follow this thread for updates, and watch here:

https://twitter.com/CaitrionaFitz/status/1536683780441792513

.@CaitrionaFitz is ready for today's hearing!

And we're under way! Chair Schakowsky calls the meeting to order. #privacy #ADPPA

Chair Schakowsky: "Today is really a big, significant day, and a long-awaited day." We agree! #privacy #ADPPA

Rep. Eshoo (D-CA) says it's important that federal legislation not undermine California's "groundbreaking" privacy protections. #privacy #ADPPA

Ranking member Bilirakis (R-FL) calls this an "historic" hearing—the first time that a bipartisan, bicameral comprehensive privacy bill has been considered in Congress. #privacy #ADPPA

Ranking member Bilirakis (R-FL) emphasizes the provisions of the bill limiting requirements for small businesses. #privacy #ADPPA

House Commerce Chair Frank Pallone (D-NJ) notes the "near universal agreement" that federal comprehensive privacy legislation is needed.

Chair Pallone (D-NJ):"Data privacy rights are *civil* rights." 👏 #privacy #ADPPA

Commerce Committee ranking member McMorris Rodgers (R-WA): "This is about protecting big people from big tech, especially kids."#privacy #ADPPA

Rep. McMorris Rodgers (R-WA): "This is a critical milestone that was years in the making. This is the best opportunity we've had to pass comprehensive privacy legislation in decades." #privacy #ADPPA

Chair Schakowsky introduces the witnesses. First up: @BMLeeJR from @futureofprivacy. #privacy #ADPPA

.@BMLeeJR notes that states are moving to enact #privacy laws whether Congress acts or not (including ongoing rulemakings in Colorado & California), but says that the #ADPPA is more comprehensive than these laws.

.@BMLeeJR makes 4 recs. to improve the #ADPPA: increase funding for the @FTC; add space for iterative processes to keep the law up to date with technological change; take a closer look at the intersection of ADPPA & federal laws; and add more definitional clarity. #privacy

The Information Technology Industry Council's John Miller raises concerns about several of the definitions in the #ADPPA, including "covered data" and "targeted advertising." #privacy

EPIC's @CaitrionaFitz is up! "For over 20 years, EPIC has been calling on Congress to pass a strong, comprehensive federal privacy law. Unfortunately, for the past two decades, powerful technology companies have been allowed to set the terms of our online interactions."

EPIC's @CaitrionaFitz: "The system is broken. Technology companies have too much power, and individuals too little. But it does not have to be this way – we can have a strong technology sector in the United States while protecting personal privacy." #privacy #ADPPA

EPIC's @CaitrionaFitz: "But with the #ADPPA, Congress has the opportunity right now to reclaim privacy as a meaningful right and reestablish America as a global leader on privacy. … Please do not let this moment pass. The time to act is now." #privacy

Doug Kantor, General Counsel of the National Association of Convenience Stores, says it's important to make sure financial services companies are covered by the privacy protections in #ADPPA. #privacy

Written testimony from the speakers so far:

Caitriona Fitzgerald (EPIC): energycommerce.house.gov/sites/democrat…

Bertram Lee (FPF): energycommerce.house.gov/sites/democrat…

Doug Kantor (NACS): energycommerce.house.gov/sites/democrat…

John Miller (ITIC): energycommerce.house.gov/sites/democrat…

#privacy #ADPPA

@CommonSense's Jolina Cuaresma: "Tech firms should be constrained in their Wild West data collection practices" #ADPPA #privacy

Ms. Cuaresma's written testimony: energycommerce.house.gov/sites/democrat…

Former @FTC Commissioner @M_Ohlhausen, now with the 21st Century Privacy Coalition, raises concerns about the interaction of the ADPPA with existing federal & state laws. Ohlhausen's written testimony: energycommerce.house.gov/sites/democrat…

@LawyersComm's David Brody: "If a business posts a sign that says 'whites only,' it should not matter if it's written in ink or pixels. The discrimination is the same. The harm is the same. And the legal consequences should be the same." 👏👏

@LawyersComm's Brody talks about the importance of a robust private right of action to civil rights laws and argues the #ADPPA's must be broadened. "If we're to have the rule of law, we must allow the law to rule." #privacy

Mr. Brody's written testimony: energycommerce.house.gov/sites/democrat…

We're onto the questions phase. Chair Schakowsky asks @BMLeeJR about the civil rights & algorithmic assessment provisions of the #ADPPA. Lee underscores their importance, noting "a lot of large data holders really don't understand the impact their algorithms have." #privacy

Chair Schakowsky asks @LawyersComm's Brody about enforcement. Brody describe's #ADPPA's "three-legged stool": (1) broad FTC authority; (2) authority for state AGs, who can "fill gaps"; & (3) private right of action—key for individuals to "have their day in court." #privacy

Commerce Chair Pallone to EPIC's @CaitrionaFitz: why is data minimization important in a privacy bill? Fitzgerald: it "makes privacy meaningful" & "takes the onus off of individuals." #privacy #ADPPA

Pallone: how are the data minimization provisions of #ADPPA? @CaitrionaFitz: ADPPA's focus on data minimization sets it apart from many privacy laws, helps avoid consent fatigue. #privacy

Pallone to @LawyersComm's Brody: how are #ADPPA's civil rights provisions? Brody: Strong anti-discrimination provisions, robust algorithmic assessment requirements mandating tests *before* algorithms are rolled out. #privacy

Commerce Committee Ranking Member McMorris Rodgers asks about impact of #ADPPA on small businesses. App Association's Dufault: this bill is more sensitive to small businesses than GDPR (though doesn't except them).

Rep. Rush (D-IL) praises #ADPPA, noting bill would "return[] control of consumers' information" back to consumers. Analogizes consumer controls of data processing in the bill to Do-Not-Call list. #privacy

EPIC's @CaitrionaFitz: Data brokers are some of the worst offenders when it comes to personal data. EPIC "strongly supports" substantive limits in the bill that we think will curtail data broker activity. Data broker registry is also an important piece of the puzzle.

@LawyersComm's Brody: Algorithmic discrimination is nothing new. Redlining was a form of algorithmic discrimination, and we're still grappling with that today. If algorithms are encoded with bias, results of algorithm will be discriminatory too. #ADPPA #privacy

Rep. Latta (R-OH): what's the diff between FTC rulemaking & guidance? Ohlhausen: rules activate civil penalties. Guidance is interp. of FTC statutory authorities, but violating guidance itself not subject to fine; must be prosecuted as violation of underlying statute. #ADPPA

Rep. Castor (D-FL): Very excited that children's privacy provisions are included in #ADPPA. @CommonSense's Cuaresma: on day 1 we'll be able to ban companies from processing, collecting, & sharing data about minors under 17 w/o affirmative express consent. #privacy

Rep. Guthrie (R-KY) asks about how private right of action (current version or a broader revision) would impact small businesses. Dufault argues for a "calibrated" right of action. Kantor objects that consumers can recover compensatory damages for their injuries under #ADPPA. 🤔

Rep. Trahan (D-MA): #ADPPA will ensure that consumers "can trust that their data is being used in ways they expect." Notes widespread abuse of student data by edtech providers.

EPIC's @CaitrionaFitz: problem of edtech privacy abuses underscores limitations of current sector-by-sector privacy law framework in U.S. #ADPPA #privacy

EPIC's @CaitrionaFitz: forcing companies to conduct & submit algorithmic impact assessments to @FTC is key for effective oversight, though substantive requirements of impact assessments could be improved. #ADPPA #privacy

@CommonSense's Cuaresma: Without providing additional resources for new @FTC youth division under #ADPPA, it won't be able to get the job done. #privacy

.@BMLeeJR: #ADPPA ensures broad coverage of an algorithm's life cycle and a better understanding of how algorithms are affecting our lives. #privacy

Rep. Lesko (R-AZ): Do you think political viewpoints should be added to anti-discrimination provisions of #ADPPA? @BMLeeJR: that may present First Amendment issues. @M_Ohlhausen: I think political viewpoint discrimination is outside FTC's expertise. #privacy

Rep. Greg Pence (R-IN): is it feasible to compensate individual users for the use of their data by platforms? EPIC's @CaitrionaFitz: we don't want to set up a system where only the rich can afford #privacy. #ADPPA

What Rep. Pence is describing is a form of pay-for-privacy, which EPIC's @Iwillleavenow wrote about in the context of the Uniform Law Commission's subpar model privacy bill: epic.org/the-uniform-la…

Rep. Rice (D-NY) asks about role of state AGs. @LawyersComm's Brody: State AGs have key role in data protection, but what can hold them back is a lack of transparency w/r/t companies' use of personal data. #ADPPA transparency & assessment provisions would help fix that. #privacy

Rep. Bushon (R-IN): Are privacy-by-design measures in GDPR well received by consumers? ITIC's Miller: yes, though having a privacy-by-design requirement doesn't necessarily explain how operationalize it; it's important to develop standards as bill as implemented. #ADPPA #privacy

*Rep. Bucshon (R-IN)

Rep. Kelly (D-IL): No one reads the long-form #privacy policies of today, and neither do I. How would #ADPPA short-form notices help? @BMLeeJR: short-form notices give agency back to consumers and let them understand how their data is being used and in what context.

@LawyersComm's Brody notes how important it is for individuals to be able to access information about how their personal data is used in the languages they speak (not just English). #privacy #ADPPA

Rep. Kelly asks EPIC's @CaitrionaFitz about dark patterns. Fitzgerald notes that prohibiting dark patterns (e.g., deceptive UIs that steer individuals into consenting to bad data practices) is key to making the rights under #ADPPA real. #privacy

Rep. Armstrong (R-ND) says he's worried about clarity of preemption provisions. How would #ADPPA interact with Illinois's Biometric Information #Privacy Act (which is specifically *not* preempted by ADPPA) if BIPA is later amended, he asks.

Rep. Fletcher (D-TX) asks about protection of health data under #ADPPA. EPIC's @CaitrionaFitz: people tend to assume health data is covered by HIPAA, but HIPAA only covers a narrow subset of entities. ADPPA would broaden #privacy protection.

Rep. Fletcher asks about sensitivity of geolocation data (which gets heightened protection under #ADPPA). EPIC's @CaitrionaFitz: it goes back to consumer expectations—you don't expect location data collected by your weather app to be sold to data brokers.

EPIC's @CaitrionaFitz: Location data can be purchased in bulk from brokers, and the claim that these datasets are anonymized or deidentified is a lie. Geolocation data can be readily linked to individuals, which is why there's a market for it. #ADPPA #privacy

Rep. Walberg (R-MI): How would prohibition on targeted advertising for minors <17 affect mental health of children? EPIC's @CaitrionaFitz: it's so important to protect children during their development. #ADPPA #privacy

Rep. Cárdenas (D-CA) asks about overcollection of data by apps. @LawyersComm's Brody: apps collect that much data because they can, and because they can monetize the data through advertising or selling to other companies. #ADPPA #privacy

@LawyersComm's Brody: #ADPPA has really strong data minimization provisions that would limit an app's collection, use, & transfer of personal data to what is reasonably necessary & consistent with the individual's expectations. #privacy

.@CommonSense's Cuaresma: We know human brain isn't finished developing until 20s. Minors are susceptible to images & online content that can influence her sense of self. #ADPPA prohibits targeted ads to those <17, but important to close loophole allowing some third-party ads.

And with that, Chair Schakowsky adjourns the hearing. Thanks for following along, and props to the Subcommittee, EPIC's @CaitrionaFitz, and her fellow witnesses for a compelling and historic hearing! #ADPPA #privacy

You can find the full testimony of EPIC's @CaitrionaFitz here: energycommerce.house.gov/sites/democrat…