My second day in Washington involved more meetings and discussion of hot-button issues in the tech and privacy sectors.

California is the fifth largest economy in the world, home to Silicon Valley and many of the tech giants including Google, Facebook and others. Last year, California’s state legislature passed a Privacy Act which is due to come into effect on 1 January 2020. It is a product of a unique Californian legislative mechanism that allows citizens to propose specific initiatives which with sufficient popular support, can become law.

The Act will give consumers greater control over their data, allowing them to tell business not to share or sell their personal information. Businesses will also be held responsible for safeguarding personal data. Some of the federal legislators I spoke to in Washington said that if Washington did not expedite the drafting of federal privacy laws, California’s law risked becoming the default.  I learned a lot about the US Constitutional concept of “pre-emption”. Pre-emption is when a federal law “pre-empts” or overrides a state law that might be in conflict. But to avoid the citizen-initiated consumer preferring law to become the new standard, legislators will have to do more than unite in their concern about that prospect. They will have to agree on a viable alternative.

Tuesday 30 April

Meeting with Democratic Congresswoman for Washington’s 1^st District, Suzan DelBene

In early 2017, the US Supreme Court was asked to consider whether US law enforcement agencies could access individuals’ cloud-based information, regardless of the jurisdiction it was stored in (Microsoft v the United States of America). My office filed a brief in the Supreme Court. The court never got to decide on that case, because Congress passed a law which set out the rules under which warrants in the US would have extra-territorial effect. Congresswoman DelBene was the architect of that law, the Clarifying Lawful Use of Overseas Data Act (CLOUD) Act. The Act, which passed in 2018, clarified that US and foreign law enforcement agencies could access information about US persons stored in US owned databases, whether those databases are stored in the US or overseas. It also provides for other countries to enter into executive agreements with the US Government, which can provide better protection for data about their citizens. It was a pleasure to discuss law-making for the digital age with a Congresswoman with a deep technical and business knowledge of the target industry.

Embassy luncheon roundtable on internet privacy and regulation, free speech and revenge porn

This roundtable was attended by experts and thought leaders on US constitutional law and internet privacy. One attendee, Mary Anne Franks, Professor of Law at Miami and Vice President of Cyber Civil Right Initiative, was one of the key advocates in passing state legislation outlawing online revenge porn in 2013 (44 American states have since enacted similar laws).  Also in attendance was Chief Privacy Officer for Newscorp, James Marcovitz, David Golumbia from Victoria Commonwealth University, who researches the internet and its role in funding white supremacist groups, and Katharina Kopp, Deputy Director of the Center for Digital Democracy and Director for Policy.

The group discussed the first amendment, section 230 of the Communications Decency Act (CDA) and their impacts on privacy regulation. Discussions centred around the degree to which the first amendment is deeply embedded in American identity. NGO’s like the American Civil Liberties Union (ACLU) apply a philosophy that ‘the worse the person or cause whose right to free speech we defend, the better we feel we are as a society.’

Even “speech” as indefensible as revenge porn has allies, apologists and advocates in the US, with even the ACLU challenging laws prohibiting the repugnant practice of posting intimate photos in breach of trust.

There were concerns from some in the room that s.230 of the CDA was legitimate in its inception and gave the fledgling internet industry the room to grow and innovate, but it was no longer needed. Social media networks should now be treated as broadcasters and publishers and therefore accountable to the same libel laws and ethics.

Blog continues in Part 3

Part 1 of the blog can be found here 

International Association of Privacy Professionals (IAPP), International