epic.org

A federal court has rejected an effort by Alabama to scrap the Census Bureau's system for protecting personal data collected in the 2020 Census. Earlier this year, Alabama filed a lawsuit challenging the Bureau's deployment of differential privacy, in which controlled amounts of statistical noise are added to published census data to prevent individuals from being identified and linked with their census responses. The Bureau recently demonstrated that sophisticated "attacks" can identify tens of millions of people from published census data unless robust privacy safeguards are implemented. Alabama sought a preliminary injunction blocking the Bureau's use of differential privacy, but the court denied that motion this week and dismissed many of the claims in the case. Alabama said that it does not plan to appeal this week's ruling, but the case may develop further after the Bureau publishes redistricting data in August. EPIC filed an amicus brief in the case arguing that differential privacy is "the only credible technique" to guard against reidentification attacks. EPIC also argued that differential privacy "is not the enemy of statistical accuracy," but rather "vital to securing robust public participation in Census Bureau surveys[.]" EPIC has long advocated for the confidentiality of personal data collected by the Census Bureau. In 2004, Bureau revised its "sensitive data" policy after an EPIC FOIA request revealed that the Department of Homeland Security had improperly acquired census data on Arab Americans from following 9/11. In 2018, EPIC filed suit to block the citizenship question from the 2020 Census, alleging that the Bureau failed to complete several privacy impact assessments required under the E-Government Act.

EPIC has reached a settlement agreement in EPIC v. AI Commission, bringing to a close EPIC's successful litigation to open up the proceedings of the National Security Commission on Artificial Intelligence. The Commission was charged by Congress with developing recommendations on the use of AI in national security and defense contexts. But after the Commission conducted much of its work in secret and without public input, EPIC filed an open government lawsuit against the Commission in 2019. EPIC twice prevailed in the case, securing court rulings that the Commission was subject the Freedom of Information Act and the Federal Advisory Committee Act. As a result, the Commission was forced to hold public meetings and disclose thousands of pages of records about its work to EPIC. The Commission issued its final report this spring, urging Congress and the President to implement key safeguards on federal AI deployment. However, the report failed to propose any substantive limits on AI use for Congressional enactment, as EPIC urged the Commission to do last year. EPIC's settlement with the Commission resolves EPIC's claim to attorney's fees for its work on the case. The case is EPIC v. AI Commission, No. 19-2906 (D.D.C.).

President Biden today signed a wide-ranging executive order with the aim of promoting competition. EPIC has long argued that market consolidation in online platform threatens privacy. The Executive Order aims to address the ways in which dominant tech firms are undermining competition and reducing innovation in three ways: 1) greater scrutiny of mergers, especially by dominant internet platforms, with particular attention to the acquisition of nascent competitors, serial mergers, the accumulation of data, competition by “free” products, and the effect on user privacy; 2) encouraging the FTC to establish rules on "unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy"; and 3) encouraging the FTC to establish rules barring unfair methods of competition on internet marketplaces. More than a decade ago, EPIC urged the FTC to block Google’s proposed acquisition of DoubleClick. EPIC said that the acquisition would enable Google to collect the personal information of billions of users and track their browsing activities across the web. EPIC correctly warned that this acquisition would accelerate Google’s dominance of the online advertising industry and diminish competition. The FTC ultimately allowed the merger to go forward. EPIC has since repeatedly warned FTC that other mergers posed similar risks to consumer privacy and competition, including Facebook's acquisition of WhatsApp.

The Executive Order signed today by President Biden addressing competition in the American economy requires the Department of Transportation to address drone privacy. "[G]iven the emergence of new aerospace-based transportation technologies, such as low-altitude unmanned aircraft system deliveries, advanced air mobility, and high-altitude long endurance operations," the Executive Order reads, the Secretary of Transportation shall ensure that the Department of Transportation take action to "facilitate innovation that fosters United States market leadership and market entry to promote competition and economic opportunity and to resist monopolization, while also ensuring safety, providing security and privacy, protecting the environment, and promoting equity." EPIC has long highlighted the privacy and civil liberties implications of aerial surveillance technology and has called on Congress to "establish drone privacy safeguards that limit the risk of public surveillance."

In comments to the Homeland Security Department (DHS), EPIC highlighted systemic problems with several DHS systems that use facial recognition or artificial intelligence and urged the agency to end these programs. EPIC also urged DHS to put in place rigorous algorithmic impact assessments before the agency undertakes any other AI or facial recognition projects. Recently, EPIC joined over 40 other organizations to detail the issues with cops using facial recognition and call for a law enforcement ban on the technology's use. EPIC has proposed the Universal Guidelines for Artificial Intelligence as the basis for federal legislation. The Universal Guidelines have been endorsed by more than 250 experts and 60 organizations in 40 countries.

EPIC and a coalition of privacy and civil liberties groups are calling for stores to stop using facial recognition technology. The new campaign tracks which major retailers use or are considering using facial recognition and aims to pressure these entities to stop. Corporate use of facial recognition is especially concerning because, according to Sen. Ron Wyden, government agencies are already buying surveillance information from corporations to evade warrant requirements. EPIC has joined a number of coalitions urging a ban on facial recognition including: an international letter opposing the technology, a statement of concerns on police use of FR, and EPIC's Ban Face Surveillance campaign. EPIC recently endorsed legislation that would ban federal law enforcement use of facial recognition and pressure state law enforcement to do the same.

EPIC has filed an amicus brief with the ACLU and EFF in United States v. Morton urging the full Fifth Circuit to prohibit invasive forensic searches of cell phones when law enforcement only has probable cause to search some of the data on the phone. In Morton, police obtained a warrant to search the defendant's cell phone for evidence of an alleged drug crime, but instead conducted a forensic search of the phone's full contents and uncovered evidence of an entirely unrelated crime. A Fifth Circuit panel ultimately found that the search violated the Fourth Amendment because it reached a type of data on the phone that was not likely to contain evidence of the specific crime being investigated. EPIC, ACLU, and EFF applauded the panel's recognition that "the scope of cell phone searches must closely adhere to the probable cause showing, lest authority to search a device for evidence of one crime mutate into authority to search the entirety of the device for evidence of any crime—a prohibited general search." The groups argued that, in an age when "Americans’ dependency on smartphones has, intentionally and inadvertently, resulted in our phones containing vast troves of our personal information, strict limits on searches and seizures are necessary to preserve privacy" and that technological and administrative convenience "is no justification for discarding the Fourth Amendment’s probable cause and particularity requirements." EPIC regularly files amicus briefs challenging unconstitutionally broad cell phone searches, including forensic searches of entire cell phones.

In comments to the Comptroller of the Currency, Federal Reserve, Federal Deposit Insurance Corporation, Consumer Financial Protection Bureau, and the National Credit Union Administration (Financial Agencies), EPIC highlighted concerns with accuracy and bias of AI systems used by financial actors. EPIC urged the agencies to promulgate rules limiting data collection, sharing, and use, as well as require rigorous impact assessments in order to increase transparency and accountability. EPIC argued that “The adoption of AI by financial actors should not be treated as inevitable, and the agencies are uniquely posed to protect consumers through data collection and use limits, reporting and accountability requirements, and bans on certain discriminatory or untested uses of AI.” EPIC has urged both the White House and Congress to prioritize human rights over AI adoption and has recommended the OECD Principles and the Universal Guidelines for Artificial Intelligence as baseline frameworks for regulating AI and mitigating algorithmic harms.

Senator and veteran privacy advocate Ron Wyden recently sent a letter to the Acting Intelligence Community Chief Information Officer urging him to protect intelligence community computers and personnel from threats posed by the sale and misuse of online advertising data. The letter emphasized that advertising companies operate in an unregulated market where they can "collect vast amounts of sensitive information about users, their movements, web browsing, and other online activities" and then offer that information "for sale to anyone with a credit card." Senator Wyden previously led an investigation that uncovered the ways advertising companies were selling so-called "bidstream" data to firms in China, Russia, and other high-risk foreign countries. The sale of bidstream data poses both privacy and national security risks because that data includes precise location information of Americans as well as their device identifiers and browsing histories. In the letter, Sen. Wyden sought information on how, if at all, the intelligence community protects data from online advertisers, including through the use of ad blocking technologies. EPIC has repeatedly raised concerns over the collection of vast amounts of data online and has joined a growing coalition of groups in their call to Ban Surveillance Advertising.

The House of Representatives passed the Consumer Protection and Recovery Act (H.R. 2668) Tuesday on a 221-205 vote. The bill explicitly authorizes the Federal Trade Commission to seek monetary relief for injured consumers in federal court and to require bad actors to return money obtained through illegal actions. The amendment to the FTC Act restores a key piece of the FTC's Section 13(b) power, which the FTC previously used to obtain restitution and disgorgement for wronged consumers until the Supreme Court recently limited this authority in AMG Capital Management v. FTC. On Monday, the House Rules committee voted to advance the bill to a floor vote, with bill sponsors stressing that “the urgency is not hypothetical.” The White House has also expressed support for the bill. EPIC has long called for greater protection of consumer privacy through FTC enforcement and the imposition of financial penalties against companies who engage in unfair data practices. Recently, EPIC published a report that highlighted a number of key authorities that the FTC should use to address emerging privacy threats.

EPIC is pleased to announce the newest members of the EPIC Advisory Board. EPIC's new members are leading experts in privacy, technology, and civil liberties law and policy. These experts will help inform EPIC’s important work on emerging privacy and human rights issues. Since its inception, the EPIC Advisory Board has been comprised of innovative and solution-oriented scholars, experts, and advocates. EPIC’s newest Members are: Colleen Brown, Simone Browne, Mishi Choudhary, Michele Bratcher Goodwin, Adrian Gropper, Marcia Hofmann, Jumana Musa, Scott Skinner-Thompson, Ashkan Soltani, Amie Stepanovich, and Katherine Strandburg.

Today, U.S. Rep. Kathy Castor (FL14) introduced an updated “Protecting the Information of our Vulnerable Children and Youth Act” or the “Kids PRIVCY Act” to strengthen the Children’s Online Privacy Protection Act (COPPA). "Representative Castor’s bill makes critical updates to our children's privacy laws to address the dangers of today’s technologies," said Caitriona Fitzgerald, Deputy Director, Electronic Privacy Information Center (EPIC). "Everyone deserves strong privacy protections online, but children and teens especially need to be protected from corporate surveillance and manipulative targeted advertising. The Kids PRIVCY Act prohibits behavioral ad targeting to children and teens and includes strong enforcement mechanisms to ensure that companies comply with the law. EPIC is proud to support this bill and encourages Congress to move this legislation forward in order to protect children and teens online."

A new poll from Data for Progress found that 7 in 10 Americans think the government should be doing more to keep their personal data safe and nearly 8 in 10 Americans across the political spectrum support Senator Gillibrand's Data Protection Act, which creates a U.S. Data Protection Agency. "Our government must continue to evolve alongside our society, and adapt to meet new challenges the American people face," Senator Gillibrand said in a blog post. "I believe the best way to do that is by creating a new federal agency designed with your data privacy in mind: the Data Protection Agency." EPIC has long advocated for the creation of a U.S. Data Protection Agency.

In comments responding to a Homeland Security Department (DHS) Request for Information, EPIC urged the agency to slow its investigation into mobile driver's license technology and implement only systems with the most rigorous cryptographic and privacy-preserving design standards. EPIC recently urged the National Institute of Standards and Technology to adopt anonymous credentialing for identity verification cards for federal employees.