There are Avenues for Change

The lack of consumer privacy protections in the United States has given way to myriad harms to marginalized communities. Envisioning privacy as a civil right can help curtail the extensive discriminatory harms discussed above. Yet as the fight for civil rights grapples with the harms posed by data and technology, these new developments are also making it increasingly challenging to enforce civil rights laws.¹ To ensure justice and equity, it is crucial that voices from these communities are well represented as we debate policy solutions at government agencies and in federal and state legislation.

Government agencies should protect privacy and civil rights whenever possible. Agencies like the Department of Justice and the Department of Housing and Urban Development (HUD) are empowered to enforce existing civil rights statutes. In March 2019, HUD charged Facebook with housing discrimination, alleging that its targeted advertising platform violated the Fair Housing Act by “encouraging, enabling, and causing” unlawful discrimination by restricting who can view housing ads.² This action came after Facebook settled a series of civil rights lawsuits alleging housing and employment discrimination by the National Fair Housing Alliance and others.³

Even agencies that do not have explicit civil rights mandates can help. For instance, the Federal Communications Commission (FCC) has rules protecting the privacy of cell phone users, and the rigorous enforcement of those rules can help protect civil rights. As referenced above, Motherboard found that the major wireless carriers were selling customer location data to third parties without requiring proof of lawful orders or customer consent. The FCC could enforce its privacy laws as argued in a recent complaint filed by New America’s Open Technology Institute, Georgetown Law Center on Privacy & Technology, and Free Press, which would provide more privacy protections against potentially discriminatory and dangerous uses of highly sensitive location information of cell phone users.⁴

Nonetheless, further guidance and broader policy changes are needed given the ambiguities around how to apply civil rights laws to these novel means of discrimination. For instance, while the Voting Rights Act prohibits voter suppression by violence or intimidation, it does not prohibit voter suppression by deception, which is typically how voters are disenfranchised online.⁵ We saw this in the 2016 election, where Russian interference efforts deliberately targeted Black Americans using personal information that was weaponized to deceive and disenfranchise voters.⁶

To ensure that privacy enforcement captures these civil rights violations, one possibility is empowering the Federal Trade Commission (FTC) to protect privacy and civil rights with rulemaking authority. The FTC is the primary government agency responsible for protecting privacy, but its current privacy enforcement powers are limited to its authority to protect against deceptive and unfair practices, which does not sufficiently allow the agency to protect privacy.⁷ Instead, the FTC should be empowered with rulemaking capacity that would sufficiently allow it to provide more guidance and regulatory certainty on what privacy laws require from companies as technology and business practices continue to evolve in the digital economy. However, relying exclusively on the FTC to enforce civil rights protections is insufficient, given that the agency is resource-constrained and cannot take every case.⁸ Thus, individuals require additional avenues for recourse through other agencies, states, and courts, too.

Congress must ensure that privacy laws include strong civil rights protections. Free Press and the Lawyers’ Committee for Civil Rights Under Law recently published model legislation outlining how Congress can ensure that personal data is not used to discriminate against protected classes in areas like employment, housing, and education.⁹ They also propose classifying online businesses as public accommodations. As it stands, “The bar downstairs has more obligations regarding civil rights in general to the public than any online platform does,” Laroia said on the panel.¹⁰ “That varies by state, but there’s no federal consensus on that. … By classifying online businesses as public accommodations, we [would] make it unlawful to process personal information in a manner that segregates, discriminates, or otherwise makes unavailable those goods and services.”¹¹

This model legislation would require companies to audit algorithms for privacy risk and robust transparency.¹² It also gives the FTC the ability to enforce the law.¹³ Lastly, it would give people a private right of action to protect their civil rights. A private right to action is critical because, as Laroia explained, the public cannot rely exclusively on government agencies to protect civil rights, “so it’s important that ordinary people and advocates can protect their rights when government agencies are falling down on the job.”¹⁴

States play a vital role in protecting civil rights, and any legislation should preserve that role. For instance, in July 2018, the Washington State attorney general investigated Facebook for unfair and deceptive practices and ultimately agreed to a settlement that required Facebook to alter its advertising platform by removing the option for advertisers to exclude ethnic and religious minorities, immigrants, LGBTQ+ individuals, and other protected groups from seeing their ads.¹⁵ State civil rights laws in some cases, including the Washington case, are more protective than federal civil rights laws, making it inappropriate for any federal civil rights law to preempt state civil rights laws or for federal privacy laws to preempt state laws.

Ultimately, to ensure that the debate on privacy centers perspectives from marginalized communities, the tech policy community needs to reflect the country’s diversity. Valentin has written about #TechPolicySoWhite to underscore the importance of diversifying the tech policy space.¹⁶ Impacted communities—especially Black communities—must be included in discussions about privacy, she said on the panel, particularly because stakeholders define “privacy” differently, depending on the community and cultural background. As Valentin wrote:

If someone is not a person of color, they are likely to lack the experience to find policy solutions that positively impact communities of color. Therefore, I believe it is important to get in the practice of passing the microphone to individuals who can accurately identify the issues and subsequent solutions that will benefit these communities. The same applies to people who attempt to speak on behalf of women, low-income communities, disabled communities, or the LGBTQ community…pass the mic. It is important to recognize that there are gaps in the knowledge of every well-intentioned, non-marginalized ally. Thus, it is important to identify those gaps in one’s knowledge, speak with the affected parties to gain more understanding, and subsequently uplift their voices during these important debates.¹⁷

Laroia echoed that including more voices in the policy debate also leads to better policy solutions:

By genuinely thinking about the most affected communities in the work we do, we’re actually able to solve the problems. We think the privacy conversation has moved not just because the downside risks have become more apparent, but because the circle of people who care about these issues is becoming wider, giving the privacy debate a different kind of moral center than it had before.¹⁸

For privacy legislation to fully protect against the wide array of civil rights harms that come about from commercial data practices, we must center the communities most directly affected by those practices.