The Sunday Show: Prospects for the American Data Privacy and Protection Act

Audio of this conversation is available via your favorite podcast service.

On Wednesday, July 20, the United States House of Representatives Energy & Commerce Committee held a markup that included H.R. 8152, the "American Data Privacy and Protection Act,” which is touted as the first comprehensive national privacy legislation with bipartisan support.

To discuss the bill and its prospects in detail, I spoke with two experts on tech policy and civil rights issues:

• Nora Benavidez, Senior Counsel and Director of Digital Justice and Civil Rights at Free Press,and
• Justin Brookman, Director of Technology Policy for Consumer Reports.

Below is a lightly edited transcript of the discussion:

Justin Hendrix:

So I thank you both for joining me. We're going to talk today about this privacy bill that is coursing it's way, potentially to passage, in Congress. Washington Post the other day called it a watershed and a grand bargain. It is apparently the first time a federal consumer privacy bill has achieved escape velocity made it out of committee. Two questions in one, why is it taking us this long to get here? And what made this possible in this Congress? Maybe Nora, I'll put that to you start.

Nora Benavidez:

What made this possible? Well first, as I was sitting, watching the bill get a vote a few days ago, I had goosebumps all over. I almost started crying. I was so excited and moved. I think a number of factors have propelled us here. Not the least of which is the urgency that many Democrats feel that the window is narrowing, to move meaningful legislation on civil rights issues. But it's taken almost two decades to get us here. And that is for so many reasons, the partisanship we've seen in Congress, the flipping of our House and Senate. And in many ways, just the lack of broader awareness and urgency on the issue of privacy and what our data really means. What it means to control how our data is used. Too often, that conversation is seen as something niche, something that my colleague Justin, might be a wonderful expert on, but that lay people really don't understand, and then is not prioritized by members.

Justin Hendrix:

Justin, do you have a similar take?

Justin Brookman:

Yeah, I mean, I think the hesitancy to regulate... I mean, I think for a while, everyone thought, hey, the Internet's awesome, right? In the '90s, Clinton famously said, 'don't touch the internet, because it's awesome, let's let it take off.' People got comfortable, like online banking and social networking. And that was cool. And then I think starting in the 2010s people are starting to like, wait a second, there are some bad things about the internet. And I think you've seen consumer sentiment surveys, they've kind of gotten increasingly skeptical about it. And then you had the 2016 election. And so then over time, I think first, the Democrats got more comfortable saying, yeah we shouldn't have laws around privacy and lots of other things too. And the traditionally more regulatory.

And then I think really in the last few years, I think you've seen Republicans then kind of be like, you know what? Yeah, we want to regulate these companies too. They see the Silicon Valley companies as liberal. They're worried about bias. You're seeing laws pass at the state level, and at Florida and Texas around social networking and including private rights of action, right. Famously, historically, Republicans, like no, no privacy rights of action. And now we're like, yeah we let people sue Google, that's a bad company. So I think you have seen a more... Everyone's agreeing that, what's going on online is way too much. There is bipartisan consensus that something needs to happen. I think Nora is right. That I think a lot of the Democrats are like, this is our kind of last chance. There's widespread perception that they're wanted to lose at least one House of Congress.

I will say. I mean, I think the staff, actually, really plays a key role here as individuals. The staff have been putting in the work in ways I have never seen before. I got invited to a 6:30 AM conference call without any degree of self awareness, because I think they were working 20 hours a day. And I think they really deserve a lot of credit for getting past issues or there's like a hundred things you to fix. And they actually marched through and did a ton of them. And so I think they deserve a lot of personal credit for what's happened here.

Justin Hendrix:

Let's talk just a little bit about what this bill does. Maybe Justin, I'll start with you. What does this bill do? What are the most key elements of it?

Justin Brookman:

Yeah. I mean, I feel like 70% of privacy bills all kind of look the same, right? They have access rights, and deletion rights, and maybe correction rights. And this has correction rights. They have data security obligations. The trickiest thing is what the law does around secondary use, right? Primary use, we kind of get. I go to Amazon, I buy stuff and they process it and they charge my credit card and they give my information to FedEx, bring it to me. And that's all directly in service of what I ask for. And that's fine. It's all of the other stuff, like the sharing data with data brokers, or for targeted advertising that like the law really needs to get to. And there's usually three basic ways you can deal with that. You can ban it.

You can say, this is super illegal. You can require opt-in consent for it. You have to... Someone has to click okay for them to do the extra stuff, or you can have opt-out rights. And like, you can go out of your way to say no, don't do that. And they all have their flaws, I think. And it's tricky. It was really hard. This is a really hard issue to get to. And this bill has had three different versions, and each one does it in really, actually very different ways. The way they ended up, I think is actually probably the strongest that I've seen. They actually do prohibit, straight prohibit, most secondary use. And they have some carve outs for things that are allowed, and some targeted advertising. But most targeted advertising I think, is actually straight prohibited.

And they have some opt-out rights for the extra stuff. But that... And then that's, again, that's stronger than we've seen in Europe. That's stronger, certainly, than we've seen at the state level. The one extra piece, and then I'll let Nora speak, that we see in this bill that we've not seen, in other bills, are Civil Rights Protections. So section 207 has new language, that we haven't seen in other bills, that prohibit discriminatory treatment, with personal information. Which again, is a huge win that we haven't seen. I certainly haven't seen Bipartisan support, and haven't seen in privacy bills otherwise.

Justin Hendrix:

Nora, that's probably a good place to bring in your interests.

Nora Benavidez:

Sure. You know, I often love taking a step back. I think Justin, you know this probably about me, I sort of look at this from what the layperson might consider. And when the bill was first introduced, it was a discussion draft, and it was about 50 or so pages. Which seems great, right? It's like, let's really dig into this. The first round of amendments, put it at 120 pages. And as Justin said, it was significantly different. And then the newest set of amendments have also significantly altered what the bill does. So just before we even get into any of the substance, we are dealing with a fast tracked process, in which a really broad set of experts have come in to weigh in, and urge members and staff on certain issues. And it has been tremendous from a procedural perspective to watch, that the bill has really gotten refined.

And the reason I mentioned that, before getting into substance, is that this is, I believe the way the legislative process should be. It should be staffers, experts, civil society, coming together to come up with something. That if we have this lump of clay, and there is an issue that broadly has support that privacy and civil rights should be protected, that our data is somehow being used. And many people do not understand what the bounds of that look like, that an issue for Congress to take up. And it's just been really exciting to watch the kind of refining and refining and refining. So I say that before getting into substance, so that for the listeners that are less in the weeds, this has been really kind of a long time coming. And then the process over the last month and a half or so, has really been fast tracked with the intent to make this as strong, and as comprehensive as possible.

First and foremost, I begin because of my background as a civil rights lawyer, thinking about the civil rights protections. Because they are so powerful, the bill would prohibit data collection use, selling, and sharing in any way that violates people's civil rights. That includes preventing companies from collecting, processing, and then particularly transferring our data in ways that might discriminate based on race, ethnicity, religion, national origin, sexual orientation, gender, disability. This is huge for the digital era, and for our digital civil rights. It would also then stop collection use of certain data. What is typically now referred to as sensitive data. And that's been a big piece of the conversation is, what is included in sensitive data. Like our social security numbers, our genetic information, our biometric information, our precise geolocation. And so that has been one of the major pieces of discussion around what's sensitive data, what isn't sensitive data. And the bill attempts to take on that kind of interruption to prevent collection and use of certain sensitive data.

The other piece I'll mention, is around the FTC's authority, and that as we look out now, at the landscape of what can be done to reign in discriminatory data practices, the FTC has a role to play. My organization, Free Press, is excited about the potential for the FTC to take on a rule making, to really dig into what kinds of bounds there should be for consumer protection in the digital, and certainly in the data protection landscape. And so this bill would strengthen FTC enforcement, and provide them more authority to take on those types of issues. One final piece that I think sometimes gets overlooked, but I always try to mention it, is the issue of language. Perhaps mundane, perhaps too granular. But one of the more interesting aspects that I'm excited about, is that the bill would require companies to make privacy policies, and notices available in each language in which they provide a product or service.

The reason I mention that is because, so often when we talk about civil rights... we're talking in English. We know that our social media companies devote most of their resourcing to English issues. English content. We so rarely talk about some of the asymmetries when it comes to language online, even this podcast being in English. And so the idea that users in other languages, however difficult it might be for them, but would have access to the privacy policies that inform all of their experiences on a platform or service, are incredibly important steps towards better protections. Not just for race, ethnicity, but also on the basis of language.

Justin Hendrix:

So I want to talk a little bit about just maybe the high level kind of theory in this bill, about how to deal with data. Sara Collins at Public Knowledge, Senior Policy Council there, pointed out that one of the reasons she was excited about it, is that it takes a "data minimization first approach". Would you characterize it that way? Anything else on the kind of broad approach to the bill as it's been pieced together?

Justin Brookman:

Yeah, I think it does. And I think that's what... We've asked for that for years. That it should take a... That again, data processing should just be limited to what is in service of what I've asked for. Yeah, I think for a bunch of years, advocacy groups tend to ask for opt-in, like get my permission first. Then I think will be seen in response to GDPR, the ePrivacy Directive. That's kind of annoying, having to click okay for every single thing. That's not good. And then companies tend to want opt-out, but those are really hard to use. It's kind of, scroll to the bottom of each page and find the opt-out. That's really difficult to use. But the data minimization framework, and that's section 101, the first thing in this bill says, you can only do stuff that's in direct service of what the consumer asks for.

And then there's a carve-out. And I think 101 B that says, here's the exceptions. And there probably need to be some exceptions. You need to be able to do analytics, some basic product improvement, count accounting, right. And so that's where the meat is. Okay, what extra stuff is allowed. And they do exclude targeted advertising, and they say certain targeted advertising is allowed, okay. And we're going to subject that to opt-outs. But again, other parts of the bill actually prohibit the use of cross site data for targeted advertising, so it's actually just a pretty limited scope of things. But overall, that framework is great. I think the conversation has evolved beyond what we call notice and choice. Like people having to make informed decisions all time. No one wants to make privacy decisions all the time. They just want it to work, and to trust that it works. And I think that this bill was written with that in mind.

Justin Hendrix:

There were certainly concessions, even in the discussion on amendments the other day. What did Republicans want? What did they get? What did they concede, and same for Democrats?

Nora Benavidez:

Well, one of the big things that I think took up quite a bit of the debate earlier this week during the markup process, was the question of preemption. And that was an amendment that a representative issue introduced. And in its current version, I can back up and describe some of the context for what happened during that, but as it ended up, the amendment was voted down. And so in its current version, the ADPPA would preempt most comprehensive state privacy loss, and preserve many others. So states could retain their ability to pass future laws that would do any number of things. Limit the collection and use of certain data, regulate other activities, or sectors. That could include things like facial recognition data, the kinds of activities such as wire tapping. But generally what was discussed this week, was the question of how will California's law fair, and can it... Is it stronger than the federal law that's currently up for debate?

And that took up a significant portion of the conversation on Wednesday. And ultimately, I think many of the California representatives just voiced incredible concern for what would happen to the CPRA. And so ultimately, there's been quite a bit of debate now, in the days that have followed, which has only been a couple. But I think that the federal bill is stronger and allows for greater protections, when it comes to the California bill. And so the issue of preemption is one that despite having been taking up a lot of oxygen, is one that was necessary to go through.

Justin Brookman:

Yeah, it wasn't a very partisan hearing or markup. I mean again, the bill eventually passed 53 to 2. But there are eight amendments, and I think six of them were bipartisan and were relatively minor fixes. I think Nora's right, the preemption is probably the biggest remaining ask for Democrats, and for some simple society groups. This law... Congress doesn't act very often. This law gets passed in the preemptive states, then the law will be frozen for the foreseeable of the future. The states have been more nimble and able to pass laws to react to stuff. And so I think it's a fair concern. And so, the Representative Eshoo had her amendment that did not pass.

And then on the Republican side, I think there's still concerns around private enforcement. I think the one amendment that was, I think withdrawn, was around the FTC enforce, and not have other states enforcing, or new California agency. And there, I think there's still some hesitancy around the role of private suit's, and whether they'll be weaponized or abused to just take money from companies and not actually make things better for consumers. But again, that was all not a lot of the hearing. Most of the hearing was talking about privacy is important, and this is the good bill. There was really remarkably little talk... This market had been five, 10 years ago, there would've been concern about 'targeted advertising, is the life blood of the internet, and we need our targeted ads.'

But no one's saying that anymore. There does seem to be the bipartisan agreement that people don't don't want their data collected and shared and sold all the time. And that privacy rules really should reign that in. And we shouldn't buy these arguments that you're not going to get free content anymore, unless you're allowed... We allow hundreds of companies to watch everything we do. That bargain is no longer on the table. So I was really surprised by how little disagreement there was, on the actual substance of the bill.

Justin Hendrix:

So while lawmakers might not be saying anything about the merit's of targeted advertising, the Association of National Advertisers did release a statement opposing this bill, since it would "prohibit companies from collecting and using basic demographic and online activity data, for typical and responsible advertising purposes." I have to say I've been somewhat surprised not to see more industry statements, as of yet. Do we think they're sort of keeping their powder dry, or what do you expect to see with regard to opposition?

Nora Benavidez:

Oh, I am not in the business of reading tea leaves, nor would I want to speculate. I mean, I think you're right, that we have not heard a whole lot from industry folks. The bill is... Having been voted and I love that Justin reminded us that the majority vote here, that 53 to two is just huge, and really significant. But as it moves from committee to the full House, there is a question of what will happen next. And then there's always the question of what the Senate companion will look like and what that process is. Again, I don't want to speculate, but there's still quite a bit of runway time for voices to come forward. And what I hope more than anything is that, given the broad bipartisan support we saw from the committee this week, that will then continue. And we've already seen bipartisan support from others on the bill. So I hope what that means is it can be fast tracked through debate and further discussion.

Justin Brookman:

I mean, I would agree with you, Justin, that I'm surprised I haven't seen more industry outcry on this. Because again, this is more stringent than we've seen at the state level, where we've seen a lot of hues and cry. I think it's... I would argue that a lot of it is stronger than we've seen in Europe, or anywhere else. And so, again, this bill was changed radically, and it wasn't until Tuesday the texts came out, and it was voted on Wednesday. And so maybe the companies couldn't get it together. But I have been surprised we haven't seen crying out that this is going to end the internet, or outcry in general. I will say, the most cynical part of me would say, now there are some companies who like this process as a distraction from the competition bills. That have been out there for a couple of years that are fairly vetted, that are waiting for a vote in the Senate.

And so I... You have seen some public statements from Tim Cook, from the CEO of Alphabet, and from others saying like, wow we support the bipartisan privacy process, this is great. Similarly, the chamber of progress, right. Which is an industry group that is wildly opposing spending all their resources, opposing these bills. We're saying nice things about the privacy process. Again, this is before it got much stronger saying, wow people really care about privacy. And so there, I think there is some cynical... Let's invest in this Hail Mary privacy process that again, the headwinds are against it, right. It's going to be really hard to pass it because it's being drafted so quickly, and there's only so much legislative calendar left. Whereas the competition bills are pretty vetted and ready to go.

That said, this process has been more successful than a lot of people expected, including myself. And the fact that we did get a very strong vote on a very strong bill, in the House. And that maybe that'll make some folks recalculate, or maybe it's just some folks just see the writing on the wall, right? I mean, we're seeing Apple take steps to get rid of cookies, Google's getting rid of cookies... Taking all these steps to get rid of tracking. I think a lot of people are aware that the data free for all is going away. That people care about this, and one way or another it's going to go away. And then maybe just having one national standard, instead of having to worry about what California's going to do, maybe pre-emption is worth it for them, and so they're not going to raise a hue and cry. Again, because the bill got much stronger, actually I expect the hue and cry to come, but we surprisingly haven't heard a lot of it yet.

Justin Hendrix:

There was one morning consult poll that suggested more than 80% of voters support the provisions in this proposed bill. So perhaps general public support for the ideas that are represented in this text, is one of the reasons why there's been less outcry. But let's think a little bit... I mean, Nora, you were mentioning earlier, kind of the perspective of real people, quote unquote. What will change for them, when or if this legislation becomes law. What would happen on the internet? What would be different about the experience we have of engaging with corporations and other entities?

Nora Benavidez:

Well, I thought WIRED did a good piece just yesterday, on some of the ad targeting issues. Which might be one of the first, most obvious ways people experience a change. And they had a good example because of how just practical it was, which was if you shop for shoes on Target and how that type of search will change. Because frankly, as Justin mentioned, the ad targeting piece is significant, here in the bill. And if it does become law in its current iteration, I want to be clear, a few things would happen. From now on, it would be that if you shop for shoes let's say, or bath mats, Target, that private company, could still use that information to show you similar content, ads for the types of things, when you're on another site. So that's one piece that would remain.

What wouldn't be able to happen though, is for that to then be matching your shopping history with everything else you do online, and on your phone. The kind of thing where you often feel... I've had this experience where I see ads for things that I've talked about with people, because potentially they in the similar vicinity as me, were searching for something online. And so what now would not happen, is the kind of randomized... What feel random, and just like psychic ways that you see ads on different websites based on your activity from your phone. Things that maybe you've never even told your phone, or search engines that you've wanted.

That is a major significant shift for everyday people. The other thing that would be significant, is what companies like Meta, Facebook, Google could do. They would essentially not be able to place trackers on you for every site or app that you are using, to build a profile of you, for their advertising purposes. That until now has been such a common practice and frankly, a form of discrimination that we have been tracking at Free Press and with other partners, that I think just day in day out, will really shift the kinds of ad and other content experiences people have.

There are so many other things that will happen that will shift for people. As I mentioned, the issue of language that when they look into privacy policies, they can see that in the language in which they're using a product or service. And then there is something that we actually have not spoken about today, which is the private right of action. And I'd also love to hear Justin's thoughts on that, because the bill is so big, I suddenly laughed to myself that we haven't even gotten to this other section of the bill. Which has gone through a lot of discussion. Setting up a private right of action for people to go to court, for violations where they feel they have been discriminated against, or otherwise their data privacy has been violated.

Justin Brookman:

Yeah, I think that's all right. I mean, I think the overall goal... I think what most people would hopefully notice, is that the web or surfing online or using apps would become more private and less annoying, right? That again, the companies can't share data amongst about what you're doing, the shoes you're looking at Target can't follow you around the internet. And you're also not subjected to constant choices, right? You're not forced to agree to cookies, every single page you go to. You don't have to consent to anything, because consent's taken out of the picture. The data minimization framework says, just use data in the service of what the person asks for, and hopefully that's the way it does work in practice. I mean, GDPR was designed to do some of this, but the way it was written, led to consent fatigue and an annoying experience. This is written in reaction to that, this is the intent. But obviously, a lot of these companies are who rely upon tracking, aren't are going to just go kicking and screaming.

They're going to do everything they can to try to find ways to track, to try to find loopholes. We saw this with the CCPA, the California law that allowed people to opt-out of selling their data. And the company's adopted these tenacious interpretations to say, well, we're not selling your data. We're selling ad based and we're giving the data away and therefore the law doesn't apply to us. And so they're going to look for any possible loophole they can, to try to keep doing what they've been doing for the last 20 years. But certainly the goal, and I think this is written more tightly than some of the other laws, would be again to make things more private, less annoying.

And there are other rights you have... You can access, if you want. You can access your data. You can delete certain data. You can... There'll be more accessible privacy policies. But I think for most people, they're not going to want to have to deal with that. And I don't want people to read privacy policies. That's a depressing end result. I don't like reading privacy policies and that is my job. People shouldn't have to try to make privacy choices. So I think for most people it should just hopefully, just work better. Nora mentioned that there is private enforcement in here, and there's a lot of debate about whether the private enforcement is strong enough, and there are definitely a lot of hoops you need to jump through, and it's delayed for a couple of years.

And again, this is the thing we're going to find out. Does it work actually as intended. But it should introduce more accountability. Again, I don't think most people should have to try to go sue Meta when something happens, but I think it'll be available as an alternative to FTC enforcement. And then that's actually... Will FTC enforcement be enough? The FTC today has 50 lawyers working on all of privacy issues, and this bill gives them a ton more responsibilities. They have to enforce a lot more laws. They have to consider Safe harbor programs. They have to set up an office of business mentoring.

They have to do rule making. The bill says... I think section 406 says Congress is authorized to give them more money, but it doesn't actually give them more money. That's a separate conversation. They're going to need a ton more money. Even setting aside private enforcement, they're going to need a ton more money to actually implement this bill. But even then, I think FTC can't do everything. So I think private enforcement will I think, actually help put the fear of God into companies to make sure that they aren't trying to exploit loopholes that maybe really aren't there.

Justin Hendrix:

So I do want to spend maybe just a second longer on enforcement. I mean, one of the critiques of GDPR of course, is that enforcement's been lacking despite the law being in place for some time. You've mentioned that the FTC is under resourced... I mean, are the pieces really in place to enforce this law if it passes? I mean, being cynical, perhaps another reason companies may be more less concerned perhaps about this, is that they know there won't be many more cops on the beat than there are now.

Justin Brookman:

Yeah. I mean, with GDPR, the text is quite strong on enforcement. You can get up to 5% of global revenues for violations. There just hasn't been the will from enforcers. And I think that it is a cultural thing to somewhat... My brother-in-law is French, and he says there's no French word for enforce. They pass laws, but they do not have a great tradition of actually enforcing them... In holding companies accountable. Where I think the United States is different. I think the FTC has had weaker law for the last... Since going back to the nineties. But I think they've been more aggressive in enforcing it. And so I think they will enforce it. I think they'll be more likely to enforce it than European regulators.

But again, they currently only have ~50 attorneys today. I think they'll probably get more, and I think there is will to give them more. There's not been a lot of active discussions that I'm aware of that must... They probably have been... I've not seen a lot of public discussions about how much more do we give them. Do we give them a hundred attorneys, a thousand attorneys? I mean I think... And I can imagine the conversation, there are orders of magnitude that they go, and I don't know what is likely to net out. And again, like we're seeing with Chair Khan, who I think has then a desire to be more aggressive, and I think has brought some more aggressive privacy cases. If she did have five times as many attorneys... And again, a much stronger law, an ability to get penalties, I think the FTC could be a lot more effective.

There has been historically a lot of criticism that the FTC has not been as aggressive as they could be, including from Chair Khan. But they've also been deliberately hamstrung by Congress by not giving them the authority to do anything. And sometimes when they've tried to be aggressive on cases, they've either lost, in some of like the competition cases, or they've been called out before Congress for going after small businesses. I mean, I remember a few years ago, there's a hearing on, LabMD, which the company that had demonstrably bad security practices, but they got... They yelled at the FTC for, why are you going after this poor little small business? And so they've not been set up to succeed. So I think they will be given tools that I think will help, and will really matter. But I do think private enforcement going to have to play a role as well.

Nora Benavidez:

Can I come in because as we were talking about the preemption issue and that there's the potential for... Or at one time, some concern that ADPPA wasn't strong enough, that potentially California or other states might provide stronger protections. The byproduct, the result would be essentially kind of Swiss cheese of protections. I think we could potentially, in a cynical world, see a similar Swiss cheese effect when it comes to enforcement. If we have state attorney generals that are in certain places, more robustly enforcing this, than in other places. And we've seen this as just a phenomenon in the U.S., in every policy issue. This sort of picking and choosing where some states might have more robust protections, might narrow basic rights. But in my cynical view, which is not my typical state of being, I think that is one other path that we might see. Which is, if in its current form, were to become law, that we could be seeing certain states that are providing more robust enforcement actions. Both through the private enforcement, and then state attorney generals.

Justin Hendrix:

Nora, I want to just take a quick detour also to think about other policy dominoes that might fall. And there was another hearing this week in Congress in the House Judiciary Committee around one of the major categories of customers for Americans' personal data, which is government agencies at all levels. And it was kind of a terrifying hearing. There was a lot of talk about the extent to which various government agencies, whether it's the DOD, or the CIA, or the IRS, or DHS, and it's various bit's and pieces acquire so much information on the open market that they wouldn't be able to get themselves, without that recourse. I don't know. What do you see as the kind of relationship between perhaps this bill and something like The Fourth Amendment Is Not For Sale Act?

Nora Benavidez:

I am just so happy you asked about it, because I think it's such a chorus relationship between the two bills, and the broader issues. At Wednesdays hearing for the ADPPA, a number of members mentioned the problem of data purchases, and that anyone, whether it's the highest bid or someone else can buy Americans' data. Of course, that includes as members said on Wednesday, the government itself, government agencies, we know that this is a common practice. And it is a way for government agencies to circumvent court oversight and the fourth amendment. So hearing them say that on Wednesday was, I thought really meaningful. And it of course, then speaks to the hearing that happened the day before Tuesday, as you mentioned. That hearing was on, what's called Digital Dragnets, and the ways that our data have really been kind of swept up by private companies, data brokers, and then can be sold to any number of entities.

The bill in question, the Fourth Amendment Is Not For Sale Act, would close loopholes that allow our intelligence community, law enforcement, to buy and acquire data, in a number of ways. It would also prevent the government from buying data from Clearview AI, which we know has a strong relationship to many local police departments. It would extend privacy laws to infrastructure firms that own data cables and cell towers. And then it would do a number of other things, that are really meaningful steps towards protecting against the purchasing by government, of our data, in ways that are unconstitutional. So what was meaningful in the hearing on Tuesday, was that the witnesses themselves spoke to the relationship between data broker power, and the problematic unconstitutional ways that government is buying our data. And that there is then this sort of flip side need for comprehensive privacy reform.

It then quickly followed with the hearing on Wednesday. And so I hope these can be seen in many ways as sort of a one, two. Not a one, two punch, but a one, two kind of protection for preventing the collection, retention, and then purchase, of our data. And I feel one must happen with the other. And whichever can happen first, the conversation that members have and frankly that we have then with everyday people, has to be to educate and help them understand that these are inextricably linked. The phenomena that allow government to buy something about you, when you have never given them consent to do so, when a court has no oversight over that action. And then that data has been just rampantly collected by people who are selling it to anyone to make money. Those are so linked to the problems that we've been talking about the rest of our time today.

Justin Brookman:

Yeah. I mean, I'll say consumer reports doesn't work on law enforcement government access issues. But like Nora says, they are inextricably linked because of where government often gets data, or from the big companies, from ISPs, from Google. I'll say historically, I feel like government law enforcement access has been maybe a little bit less partisan issue. Obama defended NSA, and there is like an anti-government, or more 'concerned about' government stance from some Republicans. It's like, this very conservative Supreme Court, has actually been fairly good on government privacy. About cell phone tracking, about the third party doctrine. So again, I think historically it's been less partisan. I feel like the valence has switched a little bit now, because there is more bipartisan agreement on commercial privacy issues. In the light of the Dobbs decision though, I do think that there's going to be more Republicans interested in tracking... In government access to these stores.

And so I think it is going to be harder to get bipartisan agreement on that. I've actually been a little bit surprised that the abortion access issue hasn't derailed more of the commercial privacy discussion. It could be that things have suddenly become more partisan, things have become more heated, and there is more... If nothing else is more angst, right. And that would make bipartisan staffers... Make it harder to come to agreement on these issues. Surprisingly we haven't seen it. Again, I think because of the incredible work that the staff has done, keeping the focus limited on the commercial issues. In practice, I mean I think it would have a real effect. I mean because of the data minimization framing, in theory, selling to these data brokers should be prohibited.

The bill has a weird structure that there is like, in section 206, this big data broker registry and opt-out process. And makes me wonder like, isn't that... Why did that data broker still exist? And again, I think it's somewhat because the bill is moving so quickly and the provisions are changing, I'm not sure why we need that. But again, if section 101, the data minimization really works, then I think there won't be these data stores. In many cases, there'll certainly be a lot less of them, for government to go to. And again, that may end up being something that comes creeps in the debate, or that people in bad faith seek to leverage to derail the process, as it does move along. But again, so far, almost surprisingly, still varied Bipartisan agreement on the commercial stuff.

Justin Hendrix:

What happens now in the process? You mentioned, Nora, that there's not a Senate companion yet. Clearly there'll have to be one for this to advance. What's the process from here? Someone said that this may come up for a vote very quickly, right?

Justin Brookman:

So the House has, I think, three working days left this summer. So they have to schedule it for I think, Tuesday, Wednesday, or Thursday, of next week. Obviously, I think the folks who have wanted to run this process, and who have moved along very quickly, are going to try to hit that. I think because there was... I think a lot of push back from the California Democrats on preemption saying, hey, I'm voting for this now, I'm not sure I'd vote for in the future. They may need to get their ducks in a row. And again, I'm sure they're hearing the substance changed a lot, they've been hoping to have the markup they had this week, last week, but they had to delay it because they had to get agreement on stuff.

So a lot of moving pieces is also very limited floor time, right? You're seeing, Pelosi is having votes on gay marriage, on abortion access. There's only so many days, hours... And all these processes take a while so I think it would be hard to get it done in those three days. But I think again, because it was such a successful markup, because there is such momentum behind it, I think it's a possibility. The alternative though, they don't hit those three days, right. Then they have to wait until after Labor Day. Historically getting things done after Labor Day in an election year, is difficult. And as Congress has become more partisan, and more sclerotic, even this was very hard. But again, there is support, it's possible. And so they could still potentially, move it in September or October.

You mentioned the Senate, Senator [Maria] Cantwell is the Chair of the Commerce Committee and the Senate, all rows go through her. She has been famously, very critical this process. Originally, they called it a four corners discussion, the House Democrats and Republicans... Senate Democrats, and Republicans. At one point, Senator Cantwell bugged out and said, I'm not... I don't like this process. So now we call it the three cornered draft. And I think if it passes the House on a strong bipartisan basis, there is broad support for it from social society. And maybe the companies aren't screaming as they aren't as much right now, maybe there is pressure on her to do it. And obviously I think Senator Schumer would like to show some victories going into the fall, going into the midterms. And so I think she's gettable, but she has to date, been very skeptical about the text. But again, the text has changed a lot. And so again, I think on a merit, I think there's a much stronger case for moving it than there was a week ago.

Justin Hendrix:

Nora, you have anything to add? Don't want to read the tea leaves?

Nora Benavidez:

Well secretly I love reading tea leaves. But I don't know. I worry that we just don't have a whole lot of time left. And I had a thought that, if I could have been a creator of memes, I would've said 'members, they're just like the rest of us.' Because when we have a fire lit, and we feel the sense of we've procrastinated long enough, we got to get something done. I've done that with legal brief writing, I've done it in every aspect of my own life. I'm feeling now the real, just taking away of days. And I think Justin explained that really well.

One thing... I don't know, maybe we're kind of going backwards, and it's too detailed or smaller point. But I was thinking a little bit about the relationship between all of the various bills here. And we haven't spoken about the social media aspect, the kind of like what platforms are doing themselves. And I don't think you can really look at the issue largely of what's happening online and its impact on our civil rights and the offline world, without that. I'm not sure that's really a quotable podcasting comment. So... But there is that bundle of bills that attempt to increase transparency, that would attempt to provide and mandate disclosures from companies themselves.

And the algorithms that gather data about us, are themselves linked to what we're talking about today. So part of that is that, we're seeing this pretty significant movement, even if not everything goes through, let's say a full House or Senate hearing process, we are seeing a groundswell of members trying to move this work. And so I hope that in whatever happens come November, whatever the Congress ends up looking like, there is enough bipartisan support now in addressing these maligned forces that, that momentum cannot and should not end.

Justin Brookman:

Yeah. I mean, I think it was right to see this as privacy is just one piece of us reckoning with the immense power these companies have for us. There are the two bipartisan competition bills that are being considered in the Senate. There is the Algorithmic Accountability Act. We've seen the various bills on algorithms. We did a hill briefing on the Algorithmic Accountability Act this week. There are a lot of pieces of that actually included in section 207 of the bill, and the civil rights Protections. There's a lot of discussion about platform accountability... A lot of issue about what platforms do to kids. There's the age appropriate design code that is sailing through the California legislature, that versions that have passed in the United Kingdom. So I think there's all sorts of bills that are being... Again, often with broad bipartisan support, because there is the zeitgeist is a recognition, that we've let these companies have too much control over our lives, over our experiences.

And so again, I think privacy is in some ways, not the easiest. Because again, I think it's very visceral, the fact that all of our data, all of our web, whatever we do online and offline, is shared and sold and okay yeah, we need to control that. We need to lock that up. But there's all sorts of things, addiction and what this does to teenagers, and Amazon now, selling dangerous products, right? That become more of a third party marketplace with less control over it. There's less quality control. App stores taking 20% cut of everything we do through them. So all sorts of things that are being... That we're finally seeing momentum, and will to regulate in ways that we had not seen for the first 20, 30 years of the internet.

Justin Hendrix:

Nora and Justin, thank you so much.

Nora Benavidez:

Thanks so much.

Justin Brookman:

Thank you. This was fun.