Technology Moves Faster Than the Privacy Laws
Evolving information-sharing technologies used by the govt. are leaving some privacy concerns legally uncovered, experts said. “There are a lot of issues not covered by the Privacy Act,” said Maureen Cooney, former DHS chief privacy officer now at Hunton & Williams: “Government employees would like steps to follow.” Cooney spoke a meeting Fri. of NIST’s Information Security & Privacy Advisory Board, which is starting a year-long project to study gaps in the privacy law.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
It’s important to think of technology as “neutral,” said Paula Bruening, staff counsel for the Center for Democracy & Technology. “Technology is not good or bad, it’s how you use it. It’s the policies you build around it” and they must remain flexible as technology rapidly evolves. The Internet doesn’t just reveal information -- it can also be used to conceal and protect, Cooney said. Algorithms can “anonymize” data, such as AIDS statistics, to avoid violating privacy, she said.
But the public tends to see the problems when technology and privacy intersect, Bruening said: “New technologies are going to have new places where breaches can happen.” The Internet makes data sharing between agencies easy and fast and people feel “out of control” of data about them, she said. Privacy laws require agencies to post notices in the Federal Register but Bruening and Cooney questioned whether the process is “robust” enough. Giving proper notice when the govt. gains access to personal data is the only protection, because people have no way to stop govt. use of their information, Bruening said: “Notice is going to become more important, not less. Making the public aware is very important, it raises the accountability level. It allows the public to decide where they want [laws and regulations] to go.”
When agencies pass information down the line or receive data from other sources like states and private companies, figuring out who’s responsible for providing notice gets complicated, Cooney said. Privacy laws on who’s supposed to notify the public are often written in the passive voice, Cooney said, as in “the public is to be notified.” Now that agencies can share information instantly, it becomes more difficult to know whom to notify, she said. The Internet also makes the process invisible: “The thing that really seems to bother people is that you can’t see it,” Breuening said: “Ubiquitous computing is the place where public concerns rub up against information collection -- and the public is passive in that collection.”