Senator Moran of Kansas has submitted a bill to protect your data. Unfortunately, that won’t protect it from the most dangerous actors of all: Governments.
Most Americans value their privacy. So when Mr. Moran (R-KS) submitted S.3456, the Consumer Data Privacy and Security Act of 2020, I’m sure many people cheered. For my part, I find two very important and serious issues with this bill.
Authorization
As with any bill submitted, we should check to see that the Constitution authorizes Congress to do what the proposed legislation calls for. S.3456 claims it is “To protect the privacy of consumers.” Now I like privacy as much, if not more, than the next guy. Just ask my friends and business associates. I refuse to store confidential data in the cloud because of privacy concerns. There are several online services that would make my life easier, but I will not use because of privacy concerns. The question, as related to S.3456, is does the Constitution give Congress the authority to regulate the relationship between private businesses and their consumers? The only thing I could find was the Commerce Clause, but if we look at that clause, we should find something interesting.
To regulate Commerce with foreign Nations, and among the several States, and with the Indian Tribes;
U.S. Constitution, Article I, Section 8, Clause 3
Congress is only authorized to regulate commerce with foreign nations, between the states, and with the Indian Tribes. A search of the bill showed nothing about regulating commerce with foreign nations, only coordinating with similar agencies they may have. There was also no mention of interstate commerce or Indian Tribes. So the answer is no, Congress has no delegated authority to interfere with the lawful relationship between a business and their customer.
So who is going to protect our privacy? We should. Every company puts out a privacy policy which is available to all of their current and prospective customers. It is then up to the consumer to determine if the value derived from doing business with them is greater than any loss of privacy they would incur. Does that mean you might have to decide between using Google’s search engine and your privacy? Yes. Would you have to decide if the convenience of buying stuff on Amazon was worth letting them share your data? Absolutely. Might you have to give up the convenience of asking Alexa or Siri to turn on your lights to keep them from listening to every word you speak? Well, to be blunt, making such decisions is part of being an adult. If enough people decide that their privacy is worth more than the services these companies are providing, then they will change their policies.
What if a company violates its privacy policy? That is what courts are for. And while these companies employ lots of attorneys, I’m sure a few industrious legal firms could make a good living winning cases against them.
From here, I should ask why the federal government can determine how much damage was done to you by a breach of contract?
Except as provided in clause (ii), the amount of a civil penalty described in subparagraph (A) shall be the number of individuals affected by a violation described in that subparagraph multiplied by an amount not to exceed $42,530.
S.3456, Section 9, Paragraph (a)(3)(b)(i)
What if the shared data cost you a $100,000 a year job? What if the data that was compromised led directly to someone stealing your entire life savings? What if you cannot get insurance because of this compromised data? What is the value of spending the rest of your life having to explain some incorrect or out of context data that now lives forever on the Internet? Unfortunately, it gets even worse. Part of the consideration for the size of the civil penalty is the size of the of the entity that exposed your data.
(III) the size, complexity, and resources of the covered entity or service provider, including if it is a small business;
S.3456, Section 9, Paragraph (a)(3)(b)(ii)(iii)
Is the damage to you any less because the entity that leaked it is a small business? Or should you receive greater compensation just because the company that did wrong is large? This language has nothing to do with attempting to get justice for the victim. It is a limited liability clause for businesses that violate their privacy contracts with their customers. Or, in other words, it is not for protecting the privacy of consumers.
Protecting Us From the Wrong People
To be blunt, I’m not nearly as worried about private companies respecting my privacy as I am about governments. Let’s face it, until Congress got its greedy fingers into this, I had a legitimate method to redress any grievance with a private company or individual. However history has shown that when governments are involved, the courts are weighted in their favor. All you have to do is see how many arguments about privacy and the Fourth Amendment revolve around “a government’s compelling interest”. The courts have even established euphemistic tests for whether they think the government’s need is sufficient to overturn the Constitution and infringe on your rights. More often than not, the courts side with government. After all, the courts are part of one of those governments.
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
U.S. Constitution, Amendment IV
There is nothing in the Fourth Amendment about the right of the people to be secure except if there’s a compelling governmental interest. I argue that the Declaration of Independence describes the only true governmental interest, that of protecting your rights.
That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed,…
Declaration of Independence
The Fourth Amendment does not make allowance for what those in government desire. The only standards are reasonableness and probably cause.
RE’ASONABLE, adjective
Conformable or agreeable to reason; just; rational.
Webster’s 1828 Dictionary
Reasonable is what a reasonable person would find reasonable, just, and rational. Not what a court can find reasonable, not what a government agent finds reasonable, but what a reasonable person like you and me would find reasonable. For any search to be legal, the reasonable people of the United States must find it reasonable. Which is one of the reasons why the right to trial by jury is protected as well.
PROB’ABLE, adjective [Latin probabilis, from probo, to prove. See Prove.]
Likely; having more evidence than the contrary, or evidence which inclines the mind to belief, but leaves some room for doubt.
Webster’s 1828 Dictionary
For a court to issue a warrant there must be more evidence for than against the government’s cause being true; there must be evidence which inclines someone to believe it. Yet today, governments of all sizes in America are searching and seizing data without reasonable or probable cause. They do so simply because they may want it in the future.
Conclusion
Which scares you more: Google, Amazon, or Apple sharing your data with private entities or with state, local, and federal governments doing so? Are you more worried about some marketer or analyst company getting their hands on your data or the FBI, IRS, EPA, or some other Three-Letter Agency? When Google, Amazon, or Apple violate their privacy policies, you can go to the courts, but when it’s your state or federal government, where can you go for that impartial redress? If you go to the courts, they most likely work for the very same government with which you have a grievance.
If we want companies to keep our data private, then we should be able to sue them without the federal government getting in the way. At first it may not make much of a difference, but if enough people sue, or just abandon those companies who deal falsely with your data, they have every reason to change. However, what incentive is there for governments to change their ways? Rather than taking a bad situation and making it worse, maybe Mr. Moran should focus on cleaning up his own house. A good place to start would be to amend the Fourth Amendment to account for modern versions of papers and effects.
The right of the people to be secure in their persons, houses, documents, papers, and effects, including data and records created by them or about them, against unreasonable searches and seizures, shall not be violated,…
Proposed Amendment to the Fourth Amendment of the U.S. Constitution
