100 Days of Trump: Time for Privacy Professionals to Speak Up

Just over 100 days into the second presidency of Donald Trump, the administration's actions reflect little understanding that respect for privacy is both a value Americans share across the political spectrum and a requirement US businesses must meet to serve consumers at home and abroad. 

For example:

• The Elon Musk-led Department of Government Efficiency (DOGE) has obtained access to the systems of at least 15 federal agencies containing Americans' personal information with little transparency about what data has been accessed, who has that access, how it will be used or transferred, or what safeguards are in place for its use.
• The administration fired the Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB) and the Federal Trade Commission (FTC), undermining their important oversight roles under the EU-US Data Privacy Framework and potentially jeopardizing nearly 3,000 US businesses' ability to transfer personal data of EU customers.
• The National Institutes of Health (NIH) announced an initiative to compile medical information related to autism, including personal data from the Department of Veterans Affairs and Indian Health Service, prescriptions, testing labs, genomics, private insurance claims, and data from smartwatches and fitness trackers, into a resource for use by selected researchers. This resource was initially described as an autism registry and then rebranded as a data platform. While NIH now states it will "analyze large-scale, de-identified data," privacy professionals know that just because data is de-identified does not mean it is irreversibly anonymized, and that unless proper precautions are in place, the risk of re-identifying individuals is real and often underestimated.

The administration’s pattern of acting in a manner that raises legitimate privacy questions and concerns without answering or resolving them may well continue. To whatever extent the Trump administration overlooks or condones inattention to privacy concerns, treats them as an afterthought, or issues superficial reassurances about safeguards to prevent privacy harms, it sends a signal that some will hear as permission or encouragement to do the same.

That is why it is time for privacy professionals — people who dedicate their working lives to considering how privacy principles should be reflected appropriately in every area of human activity — to speak up and lead. Even when we disagree about what treatment of personal information is appropriate in individual cases, privacy professionals believe in the importance of the principles themselves and in their consideration in determining how to do business and in making and executing public policy.

It is our responsibility to ask, with respect to specific administration actions, what personal information must be collected, processed and transferred to accomplish that action, and whether adequate safeguards for the security of that personal information are in place.

Privacy professionals deal with these considerations every day. The rest of humanity? Not so much. It’s important for privacy professionals to speak up, not for or against any specific administration action, but for the importance of addressing and resolving the related privacy issues fully, accurately, in context, and in compliance with law, whenever they arise.

This has nothing to do with whether an individual privacy professional supports the administration's actions. Depending on your political stripe, you may attribute the administration's lack of engagement with privacy considerations to a lack of awareness, recklessness, intentional disregard, or a careful determination that individual actions raise no significant privacy concerns. In any case, the Trump administration's actions to date — whatever the underlying cause — are what deprioritizing privacy looks like. That’s where the damage lies.

All Americans, regardless of their politics, expect and deserve meaningful consideration of their privacy rights and interests by the government and its non-governmental partners. Acting as if that is not the case hurts everyone. After all, we are all someone's data subject.

There will, of course, be press coverage when courts, legislators, and privacy regulators respond to the privacy impacts of the administration’s actions, and those reports may well include reactions from national privacy experts. But everyday press reporting isn’t enough.

Media reports may give the public some sense that Americans' personal information may be at risk as the result of some administration action. However, specific privacy impacts may not be reported clearly or at all. Huge fines and thoughtful quotes from prominent privacy leaders may temporarily remind people who pay attention to such things that privacy matters. However, those are the people who least need reminding — and in any event, the reminder often fades quickly as the news cycle moves on.

Neither political expediency nor the need for efficiency justifies disregard of privacy principles. A world in which privacy protections apply selectively creates concerns and undermines public trust. No one voted for that. It's up to privacy professionals to speak up for a process that applies privacy principles consistently to the administration's actions in context and in compliance with law.