epic.org

EPIC, Coalition Urge FTC to Issue Rules Protecting Consumers Against Data Abuse and Discrimination

2021-10-27T18:10:56Z

Today, EPIC and a coalition of 44 consumer advocacy, civil rights, and media democracy groups urged the Federal Trade Commission to initiate a rulemaking to promote civil rights and protect against abusive data practices. “Companies use personal data to enable and even perpetuate discriminatory practices against people of color, women, members of the LGBTQIA+ community, religious minorities, persons with disabilities, persons living on low income, immigrants and other marginalized groups,” the letter explains. The letter calls for a rulemaking that would address the collection, use, management, retention, and deletion of personal data. "This country faces a deepening crisis of data abuse and discrimination,” John Davisson, Senior Counsel at EPIC. “But the FTC has the power to set industry-wide rules that will rein in exploitative data practices and protect privacy and civil rights. We join the president and members of Congress in urging the FTC to use that power as soon as possible.” EPIC has frequently challenged the FTC over its failure to address consumer privacy harms, has filed a rulemaking petition with the FTC on commercial AI use, and has long advocated for the creation of a U.S. Data Protection Agency. EPIC also published a report on the FTC’s unused statutory authorities, What the FTC Could Be Doing (But Isn’t) to Protect Privacy, in June.

Senate Dials Back Plan to Force SSN Collection by Payment Services, As EPIC Urged

2021-10-20T21:40:22Z

The Senate Finance Committee has significantly scaled back a proposal in the pending budget reconciliation bill to expand the mandatory reporting regime for private financial information in the United States, a move that EPIC and peer organizations called for last month. The original proposal would have required peer-to-peer apps and services to provide the IRS with Tax Identification Numbers and other data for accounts with inflows and outflows of more than $600 per year. Because most individuals do not hold a separate TIN from their Social Security Number, this plan would have forced private entities to collect the SSNs of millions of Americans. The revised proposal raises the threshold from $600 to $10,000, a significant step toward recommendations by EPIC and other privacy and consumer rights groups. “At minimum, the expanded reporting requirement should be scaled back to apply only to business accounts or individual accounts with a high de minimis threshold, adjusted for inflation over time,” the coalition wrote in its letter to the Senate Finance Committee. U.S Treasury Secretary Janet Yellen also praised the change.

EPIC Urges Canadian Privacy Commissioner to Ban Facial Recognition

2021-10-16T04:52:34Z

In comments on the Office of the Privacy Commissioner of Canada, EPIC urged the Commissioner to ban police use of facial recognition. EPIC's comments respond to the Commissioner's recently published Draft Guidance on Facial Recognition for Police Agencies. The Draft Guidance is a set of non-binding recommendations that would govern how police agencies in Canada use facial recognition technology. EPIC's comments argue that police cannot be trusted with facial recognition, that the Draft Guidance would not prevent abuses of the technology, and that the only privacy-protective approach to facial recognition is a complete ban. EPIC has joined a number of coalitions urging a ban on facial recognition including: an international letter opposing the technology, a statement of concerns on police use of FR, and EPIC's Ban Face Surveillance campaign.

EPIC and NCLC Encourage FCC to Impose Specific Requirements on VoIP Providers to Reduce Illegal Robocalls

2021-10-15T16:30:23Z

Last night, EPIC and the National Consumer Law Center (NCLC) urged the FCC to demand more robust and explicit commitments from voice over internet protocol (VoIP) service providers to protect American consumers from unwanted robocalls. Callers launching robocall campaigns often rely upon VoIP networks to do so. The advocacy groups’ comment to the FCC outlines a series of specific actions the Commission should require VoIP providers to take, including detecting and responding to indicators of suspicious activity on their networks, and increasing transparency to consumers of potential robocall threats. EPIC routinely participates in regulatory and legislative processes concerning robocalls and files amicus briefs in robocall cases.

EPIC Applauds FTC SpyFone Ban, Urges Similar Remedies in Future Privacy Cases

2021-10-09T00:04:13Z

EPIC has filed comments with the Federal Trade Commission asking the agency to finalize a proposed Consent Order that would permanently ban SpyFone from the surveillance business and require the stalkerware company to delete the personal data that it stole. According to an FTC complaint, SpyFone sold surveillance tools that would allow purchasers to install software on another person’s device and surveil their victim surreptitiously. SpyFone also lied about its data security practices and its response to a 2018 data breach. Under a settlement announced by the FTC, SpyFone would be required to notify all affected users, delete any illegally collected personal information, and permanently refrain from selling, licensing, or marketing monitoring products in the future. In its comments, EPIC urged the FTC to finalize the proposed order and to impose similar requirements and bans in the future to protect consumer privacy. EPIC has frequently challenged the FTC over its failure to address consumer privacy harms and has long advocated for the creation of a U.S. Data Protection Agency. EPIC also published a report on the FTC’s unused statutory authorities, What the FTC Could Be Doing (But Isn't) to Protect Privacy, in June.

California Enacts Genetic Information Privacy Act

2021-10-08T16:36:14Z

This week, Governor Gavin Newsom signed the California Genetic Information Privacy Act, which had been passed unanimously by the California Senate and Assembly in September. The Act requires direct-to-consumer genetic testing companies to provide consumers with certain information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure of genetic data, and to obtain a consumer’s express consent for collection, use, or disclosure of the consumer’s genetic data. The law imposes civil penalties for a violations, enforced by the Attorney General, a district attorney, county counsel, city attorney, or city prosecutor. EPIC tracks state genetic privacy laws through its State Policy Project.

European Parliament Calls for Ban on Facial Recognition, Social Scoring

2021-10-06T15:26:16Z

The European Parliament adopted a non-binding resolution calling for 1) a ban on law enforcement use of facial recognition and other biometric mass surveillance, 2) a ban on private facial recognition databases like Clearview AI, and 3) a ban on predictive policing and social scoring systems. The resolution approved of the Parliament’s 2020 report on AI in criminal law and is a step towards a ban in proposed legislation. EPIC has joined a number of coalitions urging a ban on facial recognition including: an international letter opposing the technology, a statement of concerns on police use of FR, and EPIC's Ban Face Surveillance campaign.

EPIC Joins Coalition Urging FCC Not to Permit Unfettered Ringless Voicemails

2021-10-05T22:47:45Z

EPIC has joined a coalition of consumer groups led by the National Consumer Law Center to urge the FCC to reject a proposal that would make it legal for callers to drop voicemails directly into people's phones without their consent. The groups explained that allowing such “ringless voicemail” would clog consumers’ voicemail boxes with spam, scams, and debt collection notices. More than 90,000 consumers signed a petition urging the FCC to reject the proposal, and thousands of others, including small businesses and medical professionals, have filed comments with the FCC registering their concern with the harms presented by ringless voicemail. EPIC routinely participates in regulatory and legislative processes concerning robocalls and files amicus briefs in robocall cases.

Senate Committee Hears Testimony of Facebook Whistleblower

2021-10-05T16:08:27Z

The Senate’s Subcommittee on Consumer Protection, Product Safety, and Data Security convened this morning to hear the testimony of a Facebook whistleblower about Facebook’s harm and the need for regulation. Frances Haugen, a former Facebook project manager, has come forward to reveal that Facebook knew that its platforms were harmful, especially to young users. Haugen filed complaints with the Securities and Exchange Commission and leaked documents to the Wall Street Journal which published a detailed investigation of Facebook. Today, Haugen testified that “Facebook has repeatedly misled the public about what its own research reveals about the safety of children, the efficacy of its artificial intelligence systems, and its role in spreading divisive and extreme messages.” She urged Congress to regulate Facebook, stating “there needs to be a dedicated oversight body” and “Facebook can change but it’s clearly not going to do so on its own.” EPIC advocates for the creation of a dedicated Data Protection Agency. EPIC has fought for transparency and accountability for Facebook's privacy abuses for over a decade, from filing the original FTC Complaint in 2009 that led to the FTC's 2012 Consent Order with the company, to moving to intervene in and filing an amicus brief challenging the FTC's 2019 settlement with Facebook.

EPIC Urges National AI Research Resource to Empower Developers to Design Fair and Accountable AI

2021-10-01T21:52:40Z

In comments to the newly established National Artificial Intelligence Research Resource Task Force, EPIC called on the Task Force to prioritize privacy, civil rights, and civil liberties by creating resources for companies to develop purposeful, accountable, transparent, and fair AI. EPIC also urged the Task Force to provide regulators with the resources required to enforce civil rights and consumer protection laws against companies that deploy AI systems. EPIC recently submitted comments to the Office of Management and Budget and the National Security Commission on Artificial Intelligence advising both agencies to follow the Universal Guidelines for AI and to push for actionable legal rights to protect against algorithmic harms.

Facebook Pauses Development of “Instagram Kids”

2021-09-27T15:48:03Z

Facebook announced today that it is pausing its work on a kids’ version of Instagram after facing widespread criticism. In March 2021, reports leaked that Facebook was planning to build a version of Instagram for kids under the age of 13. Regarding today’s announcement, Fairplay’s Executive Director stated, “Today is a watershed moment for the growing tech accountability movement and a great day for anyone who believes that children’s wellbeing should come before Big Tech’s profits.” The earlier reports faced swift backlash as consumer protection advocacy groups and politicians asked Facebook to halt its plan. This announcement came after senators announced an investigation into Facebook’s negative effects on teenagers and a series of investigations by the Wall Street Journal which revealed that Facebook is aware of its harmful effects on users. EPIC signed onto a letter by Campaign for a Commercial-Free Childhood, now known as Fairplay, urging Facebook to cancel its plan for Instagram Kids. EPIC has fought for transparency and accountability for Facebook's privacy abuses for over a decade, from filing the original FTC Complaint in 2009 that led to the FTC's 2012 Consent Order with the company, to moving to intervene in and filing an amicus brief challenging the FTC's 2019 settlement with Facebook.

Ninth Circuit Says Warrantless Search of Google Files Automatically Reported to Police Violated Fourth Amendment

2021-09-21T20:33:32Z

The Ninth Circuit announced today police violated a defendant’s Fourth Amendment rights when they warrantlessly searched files that Google automatically reported using a proprietary algorithm designed to detect child sexual abuse material (“CSAM”). Prosecutors in the case, United States v. Wilson, had argued that the police officer’s search of the defendant’s files did not violate the Fourth Amendment because Google, a private party, had conducted the initial search. The district court agreed, finding that there was a “virtual certainty” that the files Google sent to police were identical to files previously identified by a Google employee as CSAM. But no Google employee reviewed the defendant's files before sending them to police—instead, Google automatically forwarded the files to law enforcement after a proprietary algorithm matched the files to previously-identified CSAM images. EPIC filed an amicus brief in the Ninth Circuit appeal to explain that prosecutors had failed to show that the proprietary Google algorithm reliably matched images. EPIC also urged the court to narrowly apply the private search exception. The Ninth Circuit found that the police search “allowed the government to learn new, critical information” and “expanded the scope of the antecedent private search because the government agent viewed Wilson’s email attachments even though no Google employee—or other person—had done so.” The Ninth Circuit also echoed EPIC’s amicus brief: “on the limited evidentiary record, the government has not established that what a Google employee previously viewed were exact duplicates of Wilson’s images.” The decision in this case diverges from previous federal appeals and state court decisions on the issue and may lead the Supreme Court to review the important privacy implications of mass automatic file scanning programs.

Senators Call on FTC to Conduct Privacy Rulemaking

2021-09-20T18:41:08Z

Nine Democratic Senators led by Senator Richard Blumenthal have called on the Federal Trade Commission to conduct a rulemaking process to "protect consumer privacy, promote civil rights, and set clear safeguards on the collection and use of personal data in the digital economy." "Americans’ identities have become the currency in an unregulated, hidden economy of data brokers that buy and sell sensitive information about their families, religious beliefs, healthcare needs, and every movement to shadowy interests, often without their awareness and consent," the Senators said. Senators Schatz, Wyden, Warren, Coons, Luján, Klobuchar, Booker, and Markey joined Senator Blumenthal on the letter. EPIC has long urged the FTC to impose clear privacy obligations on companies that collect and use personal data, including by exercising the Commission's underused rulemaking power. In 2020, EPIC filed a petition with the FTC calling on the Commission to conduct a rulemaking on the use of artificial intelligence in commercial settings. "By defining unfair and deceptive practices ex ante, and with specificity, a trade regulation rule would make it easier for the FTC to take action against parties that harm consumers," EPIC explained.

NJ Court Denies Dog Owners’ Privacy Rights (But Appears to Recognize Privacy Rights of Dogs)

2021-09-20T17:19:26Z

The New Jersey Supreme Court today decided that dog owners in the state do not have a colorable claim to privacy in their names and addresses—but there may be a privacy interest in the names and breeds of their dogs. The case, Bozzi v. City of Jersey City, asked whether the privacy exemption to the state’s freedom of information law required government agencies to withhold the names and addresses of dog license holders when the only justification for disclosure was commercial interest in selling dog paraphernalia. EPIC filed an amicus brief and presented oral argument in the case, arguing that the privacy interests in names and addresses in government documents is well established under federal law and the state should follow the federal example. The court’s majority found no colorable claim to privacy for dog owners because “owning a dog is, inherently, a public endeavor”—owners take their dogs on “daily walks, grooming sessions, veterinarian visits,” “celebrate their animals on social media or bumper stickers” and “enter their dogs into public shows.” But, as the two dissenting justices retorted, “dog owners appearing in public with their dogs do not do so while simultaneously advertising their full names and addresses.” Further undermining the majority’s reasoning was the court’s recognition that other information in the dog license record—such as the name and breed of the dog, which is exposed to the public to the same degree as dog ownership, and moreso than the names and addresses of owners—may need to be redacted because of the privacy interests at stake. EPIC routinely participates as amicus in cases involving involuntary disclosure of personal information to third parties.

EPIC, Coalition Urge DHS to End Broad, Unwarranted Surveillance Programs

2021-09-16T18:37:08Z

In a letter to the Secretary of Homeland Security, EPIC and a Coalition of privacy, civil rights, and civil liberties organizations demanded the Department of Homeland Security (DHS) end some of the agency’s more pervasive surveillance programs. The coalition called for DHS to end its practice of purchasing sensitive data (e.g. cellphone location and utility information) from third-party vendors and cease the collection of social media identifiers. The coalition also urged DHS to implement a moratorium on the use of face recognition for immigration enforcement. In previous comments to DHS, EPIC opposed DHS collecting social media identifiers and called for DHS to suspend the use of facial recognition.