The persistent surveillance under which most Americans reside appears likely to continue unabated after federal lawmakers pulled from consideration on Thursday a privacy bill that legal experts contend has little hope of protecting anyone’s privacy.
United States lawmakers who’ve flirted for years with the idea of offering Americans a semblance of control over their own data yanked at the last moment the latest iteration of a “comprehensive” privacy package that’s been subject to continual editing and debate for the better part of a decade. The bill, known as the American Privacy Rights Act (APRA), was scheduled for markup Thursday morning by the House Energy & Commerce Committee (E&C), which holds jurisdiction over matters of commercial surveillance.
The decision to cancel the hearing came amid news that House GOP leaders had vowed behind closed doors to scuttle the bill whether it was approved by the committee or not. But while the power of the pen ultimately rests in Republican hands, eighty-sixing Thursday’s session has also saved many Democrats from having to make the difficult decision to support a bill that was recently stripped of crucial civil rights protections.
The APRA, which promised to establish a “federal consumer privacy framework,” was constructed upon the bones of various other bills introduced in Congress over the past decade—a litany of doomed efforts to shield Americans from the invasive monitoring and data-hogging practices of a largely unregulated commercial surveillance industry.
The bill aimed to impose a slate of new duties on corporations actively gobbling up Americans’ private data by requiring them to provide, amend, and even delete said data upon request, as well as minimize their collection by installing various opt-out and consent-based mechanisms; it would also put in place new transparency rules and data security standards. With each successive failure to pass such a law, however, a greater portion of the US economy becomes dependent on corporations closely monitoring the daily goings-on of its users, practices that today impact some of the most consequential facets of their lives—the attainment of choice housing, health care, and employment, to name only a few.
The morass of delays only serves to further entrench the power of US corporations to monitor the most minute details of people’s lives, while helping to paint profitable surveillant activities as both an “inevitability” and net positive for mankind.
While Republicans who staunchly oppose the most rigorous of protections—favoring, as they say, a more “pro-business” approach—held the real power to decimate the bill, House Democrats have been under intense pressure as well to see it dead. As one reporter familiar with the bill’s trajectory through the House described the text on Wednesday: “Everyone hates it.”
APRA had by Tuesday lost the support of dozens of major privacy and civil liberties groups across the country. Organizations such as the American Civil Liberties Union and the Center for Democracy & Technology stated they could no longer support APRA after E&C lawmakers this week cut several key provisions aimed at protecting vulnerable members of society from discrimination and harmful byproducts of AI-driven technologies.
Dozens of civil rights organizations had been urging Democrats (some of whom had puzzlingly signed off on those changes) to sink the bill, arguing that the changes were both “immensely significant and unacceptable.”
The new text, engineered to appease conservative lobbyists representing the interests of big business, omitted, for instance, a key section referencing “civil rights.” The deleted section aimed to prevent businesses from trafficking in people’s data “in a manner that discriminates in or otherwise makes unavailable the equal enjoyment of goods or services on the basis of race, color, religion, national origin, sex, or disability.” For reasons that at this stage are above obvious, GOP lawmakers are firmly opposed to such language.
Deleting sections of a bill holding companies accountable for making data-driven decisions that could lead to discrimination in housing, employment, health care, and the like spurred a strong response from civil society organizations including the NAACP, the Japanese American Citizens League, the Autistic Self Advocacy Network, and Asian Americans Advancing Justice, among dozens of others.
In a letter this week to E&C Democrats, obtained by WIRED, the groups wrote: “Privacy rights and civil rights are no longer separate concepts—they are inextricably bound together and must be protected. Abuse of our data is no longer limited to targeted advertising or data breaches. Instead, our data are used in decisions about who gets a mortgage, who gets into which schools, and who gets hired—and who does not.”
But the cuts did not end there. The most recent version of the ARPA noticeably excluded language designed to grant users the power to opt-out before companies could use algorithms to “facilitate a consequential decision” using an individual’s personal data. At the same time, language that would have imposed a duty on companies to examine, or audit, the impacts of their own algorithms on users was likewise erased.
Both of these provisions contained generous “pro-business” caveats. For instance, users would be able to opt out of algorithmic decisionmaking only if doing so wasn’t “prohibitively costly” or “demonstrably impracticable due to technological limitations.” Similarly, companies could have limited the public’s knowledge about the results of any audits by simply hiring an independent assessor to complete the task rather than doing so internally.
“Prior versions of APRA required companies that developed or used AI for making automated decisions about people in certain important areas like employment, housing, and credit to be transparent about those systems and to allow people to opt out of that automated decisionmaking,” says Eric Null, codirector of the privacy and data project at the Center for Democracy & Technology, a digital rights nonprofit. “Without those provisions, people can and will be subject to AI that makes or contributes to important, life-changing decisions about them, and they will have little to no way to protect themselves.”
Digital rights groups such as Access Now, Demand Progress, and Free Press Action joined in to pressure Democrats not to accept these changes in stride, arguing that “a privacy bill that does not include civil rights protections will not meaningfully protect us from the most serious abuses of our data,” and that the changes were imposed “without prior stakeholder consultation and without studying the impact to the bill’s ability to address data-driven discrimination.”
WIRED had reached out on Wednesday to 23 Democrats currently serving on the E&C to get a response to the demands of these groups. A single lawmaker responded:
“I already had concerns with the American Privacy Rights Act,” US representative Nanette Barragán said, pointing to language in the bill that could arguably undermine stronger data privacy protections already implemented by her home state of California. “The latest draft only deepens my concerns about the bill because critical civil rights provisions have been removed from the proposal.”
In a statement after Thursday’s cancellation, the E&C’s ranking Democrat, Frank Pallone, Jr., blasted GOP leaders for interfering with the committee’s process while at the same time extending his gratitude to the committtee’s Republican chair, Cathy McMorris Rodgers, lauding her dedication to “giving Americans back control of their data.”
“We’re not giving up,” adds Pallone, declaring he and his colleagues are the only ones in Congress with the guts to “take on Big Tech on behalf of the American people.”
