Federal privacy legislation reading list

Last updated September 13, 2022

Washington Indivisible privacy principles

These were originally developed at the beginning of our state legislative session in January. The bills we support generally align with these principles. The improvements we’re asking for in ADPPA would bring it much more in alignment.

• Start with a focus on protecting people, not corporations
• Protect every Washingtonian’s privacy, not just people who have good technology access and skills and the time and energy to object to their data being used
• Combine well-resourced state enforcement with a strong private right of action.
• Require affirmative consent (opt-in) for sharing, selling, or using data — including using it for targeted advertising or marketing
• Allow cities and counties to pass stronger laws.
• Close loopholes that limit or eliminate the protections the laws claim to provide
• Protect all aspects of our privacy — as workers, students, health care recipients, and Washingtonians interacting with our government, as well as consumers.

ACLU of Washington’s Data Privacy Guiding Principles were developed at around the same time, working with Tech Equity Coalition, and have some important additional principles including

• No Economic Coercion: Entities must be prohibited from charging preferential prices, or providing better service, to individuals that permit their personal information to be collected and used, or from
  refusing services to, or discriminating against those who exercise their privacy rights. Pay-for-privacy provisions worsen the digital divide, which is also a privacy divide and raise racial equity issues. Strong regulations ensure that privacy rights are available to all and not just to those who can afford to pay to keep our privacy.
• Civil Rights Protections: Entities must be prohibited from using personal information in a manner that discriminates against people on the basis of race, religion, gender, sexual orientation, gender identity, immigration status and other protected characteristics, ensuring our civil rights are protected online and everywhere

Lobbying and Big Tech’s strategy

• Privacy bill triggers lobbying surge by data brokers (Alfred Ng on Politico)
• What Microsoft, IBM and others won as the privacy bill evolved (Ben Brody on Protocol)
• “Tweaking” the “grand bargain” and Lobbyists gonna lobby (The Nexus of Privacy)
• How Big Tech is quietly pushing for watered-down state privacy laws (Benjamin Powers on Grid)
• Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time (Todd Feathers and Alfred Ng on The Markup)
• The Amazon lobbyists who kill U.S. consumer privacy protections (Jeffrey Dastin, Chris Kirkham, Aditya Kalra on Reuters)
• Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious (Todd Feathers on The Markup)

Fourth Amendment is Not For Sale Act

• January 26 Coalition letter, including Indivisible Washington’s 8th District, Wallingford Indivisible, Indivisible Plus Washington as well as ACLU, Brennan Center for Justice, Demand Progress, FreedomWorks, Just Futures Law, MediaJustice, National Association of Criminal Defense Lawyers, S.T.O.P. — Surveillance Technology Oversight Project, United We Dream
• Bipartisan Support for Fourth Amendment is Not For Sale Act at House Judiciary Hearing, Tech Policy Press
• New Records Detail DHS Purchase and Use of Vast Quantities of Cell Phone Location Data, ACLU
• Fog Data Science Puts our Fourth Amendment Rights up for Sale, EFF

My Body My Data and Health and Location Data Privacy Act

• Congresswoman Jacobs Announces My Body, My Data Act to Protect Reproductive Health Data has quotes from Planned Parenthood Federation of America, NARAL Pro-choice America, URGE: Unite for Reproductive & Gender Equity, EFF, and National Partnership for Women & Families
• Warren, Wyden, Murray, Whitehouse, Sanders Introduce Legislation to Ban Data Brokers from Selling Americans’ Location and Health Data has quotes from privacy scholars highlighting its features.
• San Diego City Council Shows Support for Rep. Jacobs’ “My Body, My Data Act” has quotes from Councilmembers and Planned Parenthood of the Pacific Southwest
• Danielle Keats Citron’s The End of Roe Means We Need a New Civil Right to Privacy on Slate provides the broad context for these bills

ADPPA

• Washington Indivisibles’ June 13 letter to Rep. McMorris Rodgers and Sen. Cantwell
• AG Ferguson’s June 24 letter discussing weaknesses in ADPPA’s private right of action, the need for whistleblower enforcement, and the “internal research” loophole.
• AG coalition July 19 letter, discussing preemption and barrier to state AG enforcement. From AGs of California, Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, and Washington
• How well does ADPPA protect against post-Roe threats? on The Nexus of Privacy focuses on issues related to pregnant people and reproductive health care data
• Stress-testing privacy legislation with a queer lens The Nexus of Privacy focuses on issues related to LGBTAIQ2S+ people
• EFF’s Americans Deserve More Than The Current American Data Privacy Protection Act and earlier June 13 letter on the discussion draft discusses preemption, private right of action, loopholes, pay for privacy, FTC enforcement, etc
• New US Privacy Law May Give Telecoms Free Pass on $200 Million Fines, Vice
• Privacy bill strips FCC oversight of telecom data abuse, worrying consumer advocates, Cyberscoop
• ADPPA’s algorithmic impact assessments are too weak to protect civil rights — but it’s not too late to strengthen them and Automated Systems and Discrimination on The Nexus of Privacy look at adding accountability to make the civil rights protections real
• ADPPA’s data minimization and duty of loyalty: a deep dive, The Nexus of Privacy, looks at “permissible purposes” and other exceptions
• Who could have predicted? A potential “new compromise” for ADPPA! on The Nexus of Privacy has an overview of many of the areas for improvement, with links out for more details

Comparing ADPPA and California’s law

• Letter to Speaker Nancy Pelosi Opposing The American Data Privacy and Protection Act, Californians for Consumer Privacy
• Detailed Analysis Shows CPRA is Significantly Stronger than ADPPA, Californians for Consumer Privacy
• One out of six ain’t good: Five ways the American Data Privacy and Protection Act falls short, The Nexus of Privacy
• Comparison of ADPPA against California’s Privacy Laws, EPIC Privacy, Lawyers’ Committee, and CDT