Washington Indivisibles: Please only advance ADPPA if it is strengthened significantly

Sent to Washington’s Congressional delegation on November 28 by Washington Indivisible Network on behalf of the signing groups

Dear Senator Murray, Senator Cantwell, Ms. DelBene, Mr. Larsen, Ms. Herrera Beutler, Mr. Newhouse, Ms. McMorris Rodgers, Mr. Kilmer, Ms. Jayapal, Dr. Schrier, Mr. Smith and Ms. Strickland,

Data privacy is an issue that affects all of us, and our families, in our daily lives. And data privacy is especially important for those who are most threatened by having their data used against them. As more and more states criminalize abortion in the wake of the Supreme Court’s decision ending Roe, pregnant people are one obvious example. LGBTQ+ people in states with “Don’t Say Gay” laws and or laws criminalize gender-affirming care are another. And Black and Indigenous people, Muslims, immigrants, and activists have long been the targets of racialized surveillance.

A strong consumer privacy bill would be a critical step towards addressing these issues. Unfortunately, in its current form, the American Data Privacy and Protection Act (ADPPA) fails to protect us — and especially fails to protect the people most at risk. While we appreciate the effort Congress has put into it, unless ADPPA can be strengthened significantly, the limited time in the lame duck session is better spent on other crucial issues.

For example, the current version of ADPPA has several loopholes allowing data brokers to buy and sell location data — including selling to governments or vigilantes doing “civil enforcement” of laws criminalizing abortion:

• ADPPA completely exempts “de-identified data” (§2(8)(B)(1))
• Location information derived from images taken by surveillance cameras or automated license plate readers is not treated as sensitive (§2(24)) so can be bought and sold without consent.

These loopholes allow tracking of visits to facilities providing reproductive health care. They also put many others at risk. De-identified data has been used to out a Catholic priest. The military uses “de-identified data” to track Muslims. DHS uses de-identified data to help identify immigrants who were later arrested.

Please ensure ADPPA is strengthened to close these location loopholes and better protect pregnant people, immigrants, Muslims, and other vulnerable people.

Several other critical improvements are also needed:

• Providing protection for LGBTAIQ2S+ people by restoring “sexual orientation” to the list of what’s considered sensitive covered data (§2(28)), and adding “gender expression and identity”, to provide comprehensive protection for all genders.
• Making the civil rights protections real by restoring the requirement for independent algorithmic impact assessments, removing the exemption for government contractors and other service providers, adding whistleblower protections, and adding a right to opt-out of automated decision making systems (similar to California’s CPRA). The attached ADPPA’s algorithmic impact assessments are too weak to protect civil rights — but it’s not too late to strengthen them goes into more detail on this.
• Removing preemption of state and local laws would give Washington state — and cities like Seattle — the ability to better protect their residents. The current version of ADPPA preempts all current and future state and local privacy laws on biometric information (apart from face recognition), genetic data, broadband privacy, and data brokers. As well as eliminating existing legislation like the Seattle Broadband Ordinance and our biometric privacy law, ADPPA would prohibit the state of Washington and cities like Seattle from passing stronger legislation in the future to better protect our residents. This is vitally important from an immigrant rights perspective, because it allows the digital equivalent of “sanctuary city” protections.
• Removing barriers to AG Ferguson’s ability to investigate and enforce the law by removing §404(b)(2)(A) (“a violation of this Act shall not be pleaded as an element of any such cause of action”) to allow AG Ferguson to investigate and enforce the law. The July 19 AG Coalition letter (attached) discusses this is well as preemption.

If these issues can be addressed, ADDPA does have some very good features. However, it will be extremely challenging to make these changes during the lame duck session.

Of course there is no such thing as perfect legislation, and it may be tempting to pass ADPPA despite its issues. That would be a huge mistake for several reasons:

• It would set a precedent that privacy laws don’t need to protect the people most at risk
• Preemption would shut off future stronger privacy legislation in states — removing pressure to strengthen federal legislation
• History shows that once privacy legislation has been passed, it doesn’t get significantly strengthened

So if ADPPA is not strengthened significantly we ask you to oppose any efforts to move it forward in the lame duck session — either as a standalone bill or attached to the omnibus. And if it does move forward without addressing these issues, we ask you to vote against it.

Sincerely,

Washington Indivisible Network groups, including:

(alphabetically)

Indivisible Bainbridge Island
Indivisible Bellingham
Indivisible Eastside
Indivisible Plus Washington
Indivisible Skagit
Indivisible Washington’s 8th District
Indivisible Whidbey Island
Lower Columbia Indivisible
North Kitsap Indivisible
Olympia Indivisible
Seattle Indivisible
Snohomish County Indivisible
Wallingford Indivisible