Loss of Control of Personal Data

The Constitution places limits on the ways the government can collect and use information about you.

“What damage is done to our individual sense of privacy and autonomy in a society in which information about some of the most sensitive aspects of our lives is available for analysts to examine without our knowledge or consent, and for anyone to buy if they are willing to pay the price?”

-Commissioner Julie Brill, Federal Trade Commission, “Reclaim Your Name,” 23rd Computers Freedom and Privacy Conference

DESCRIPTION

The Constitution limits government collection and use of information about individuals. However, the isolated bits of personal information we give to private companies can be combined, repackaged, and given to the government without our knowledge or permission.

We live in a sprawling data market. Our internet service providers, web browsers, social media, and mobile devices all collect information about our locations, interests, habits, relationships, finances, and health. A given piece of the information we give to private companies may not reveal very much on its own. But in recent years, data aggregation companies have built a multi-billion-dollar industry around accumulating and recombining this information to build detailed “digital dossiers.” The average consumer has little knowledge this is happening and no meaningful ability to object. In a December 2013 report, the Senate Commerce Committee lamented that these companies operate under a “veil of secrecy.” Consumers,” the committee noted, “have minimal means of learning – or providing input – about how data brokers collect, analyze, and sell their information.”

The questionable uses of this information by private companies are troubling enough. For example, companies use this data to engage in differential pricing where they offer some customers lower prices than others for the same products. But national security and law enforcement agencies also tap these vast databanks, acquiring detailed information they often could not legally get on their own.

For decades, U.S. courts have recognized a “third party” exception to the privacy protections in our law. According to this principle, most information you share with a third party (like Google, Facebook, Apple, or Amazon) loses its Fourth Amendment protection. Under this doctrine, law enforcement and intelligence agencies at the federal, state, and local levels have all subpoenaed or purchased user information from private companies that they themselves could not collect lawfully. In 2012, for instance, Verizon and AT&T received a combined 412,000 subpoenas from government agencies. Experian, one of the largest data aggregators, lists government agencies among its most important customers.

Examples of Use

Location::
U.S.A
Database tracks location of drivers across the US
In February 2014, Immigration and Customs Enforcement solicited bids to build a national database of automatic license plate reader data. The press and several members of Congress denounced the project as an unjustified threat to the privacy of American drivers. In response to the outcry, Homeland Security Secretary Jeh Johnson ordered a halt to the program. Although many breathed a sigh a relief at the quick closure of a misguided program, several prominent privacy activists pointed out that the feared national location-tracking database already existed – in private hands. Vigilant Solutions, a California-based company, collects ALPR data from police cars, tow trucks, and other vehicles. It operates a database of at least two billion plate reads, and this number grows by 100 million each month. According to documents associated with the bid, ICE and other agencies in the Department of Homeland Security have accessed this database for years. Kade Crockford, Director of the ACLU of Massachusetts Technology for Liberty Project, theorizes that the February solicitation was an attempt to retroactively legitimize that system by contriving a competitive bid process. As numerous privacy advocates have noted, the solicitation asked for a system that seems to fit Vigilant’s ALPR database almost perfectly.

Recommendations

When government agencies consider acquiring and using surveillance systems, communities and their elected officials must both weigh the benefits against the costs to civil liberties and carefully craft policies and procedures that help to limit the negative effects that surveillance will have on fundamental rights. For a useful list of considerations, please visit the recommendations page.