“A State of the Union for Privacy: Fall, 2002”

Professor Peter P. Swire

Ohio State University

Consultant, Morrison & Foerster LLP

International Privacy Officers Association

October 18, 2002

Overview

Privacy and Government– The “Lawless State” and the 1970s Reaction– Since September 11

Privacy in the Private Sector– Medical, financial, Internet, international

What to Do Next

I. “The Lawless State”

By the mid-1970s, there was clearly substantiated evidence of widespread lawlessness and surveillance by the FBI, CIA, and other federal agencies

“The Lawless State” by Jerry Berman & others

Church Committee hearings

“The Lawless State”

Surveillance and smears of MLK, Jr. FBI infiltration of political groups

– FBI agents in KKK to Black Panthers, including participating in bombings, etc.

– “Fringe groups”? Large fraction of delegates to 1972 Democratic National Convention under surveillance

– Blackmail files on political officials

“The Lawless State”

IRS files routinely scanned for political advantage

CIA prohibited from acting in U.S.– But, active in ports– Then active in hundreds of other domestic

operations– Allende assassination plans, secret funding in

foreign elections, and other “black ops” overseas

“The Lawless State”

National security powers– President and A.G. claimed unlimited ability to

wiretap within the U.S. for “national security” purposes

State wiretaps– No federal law limiting wiretaps by state

officials until 1968

Reactions to the Lawless State

Title III (1968) -- wiretaps only under strict, federal standards

Privacy Act, 1974 Government in the Sunshine

– FOIA Amendments, 1974– Open meeting & whistleblower laws

Foreign Intelligence Surveillance Act, 1978 Electronic Comm. Privacy Act, 1984

Summary on the Lawless State

Demonstrated history of abuse of power and lack of accountability

New laws going beyond constitutional minimum, to limit surveillance and protect privacy

New laws to create openness in government, to promote accountability

II. Privacy -- the Next Generation

Clinton years– “Chief Counselor for Privacy”– HIPAA, GLB, COPPA, and more– 2000 proposal to update wiretap laws

Initial Bush Administration– Pro-privacy statements by the President– Decision not to cancel medical privacy rule– Likely would have had a Federal CPO by now

9/11 and USA-PATRIOT

Legal changes: significant rollback but not repeal of surveillance law

Updating with the surveillance powers from 2000 Clinton proposal

“Double” that, especially for FISA and computer trespasser

None of the proposed privacy updating– No suppression for illegal email/web snooping– That evidence can be used in court

USA PATRIOT Act & After

Implementation changes: use authorities to the limit, and perhaps beyond

Political changes: “protecting privacy” means “weak on terrorism”

Not all proposals enacted:– Some proposals taken out of bill– E.g., proposal for CIA to get IRS records– Sunset for some surveillance in fall, 2005

The Effects of 9/11

Less known -- the theory change Viet Dinh in DOJ, seek powers to the limit

permitted by the Constitution Sounds good, but means repeal of much of the

1970s laws– Often no “reasonable expectation of privacy”– Often records held by 3d parties, who can “consent”

to release– Surge in secrecy -- FOIA not in Constitution

Homeland Security Department

Beginning of a return to previous privacy politics

House hearing and bill– CPO for the Department– Privacy Impact Assessments– No authorization for national ID– TIPS (Armey)

Senate? Commission on Privacy & H.S.?

Cyber-Security Report

Released September, 2002 Section of report on privacy

– First Bush Administration written statements (that I have found) on the importance of building privacy into government practices

– Excellent on this: should build in privacy when upgrade systems for security

– Report widely criticized for good intentions, but few actual action items

Summary on Government Access to Records

Some Congressional return now to previous pro-privacy politics

September 11 and USA-PATRIOT effects continue

Administration statements: privacy should be based on what is required by the Constitution

That is less than I believe most Americans will want

III. Privacy & the Private Sector

Medical Financial On-line and more generally International

Medical Privacy & HIPAA

I commend the Bush Administration for going forward with HIPAA– Have historic one-time shift from paper to

electronic medical records– Is of course a difficult transition for a huge

industry to new IT systems– Overwhelming majority of Americans expect

security and privacy to be built into the new medical record systems

HIPAA

What about the changes to the rule?– I estimate HHS kept 90-95% of the 2000 rule– Many changes sensible & fix problems– Biggest mismatch of rule and consumers on

marketing Now permits a covered entity to do unlimited marketing

for health-related products and services Covered entity can be paid for this, no disclosure No disclosure of source of communication Likely biggest impetus for Congressional action

HIPAA

HHS staff: professional, thoughtful, & hardworking

Administration leadership:– Has done the “minimum necessary” for achieving

HIPAA goals– NCVHS (HHS Committee): call for far more

guidance, education, and outreach from HHS– Abject failure to promulgate Security Rule, with

needless cost to industry

Financial Privacy

Implementing Gramm-Leach-Bliley– Pretty routine for many companies– Should have “layered notices” such as HHS

encourages for HIPAA

Changes in Financial Privacy?

Fair Credit Reporting Act reauthorization due in 2003

FCRA preemption of state law expires State law changes possible for GLB

– California, North Dakota Sarbanes hearing last month, and he has

supported Clinton 2000 bill Unclear what will happen

Online and Other Privacy

Progress thus far without legislation– 15% privacy policies in 1998 (commercial)– 88% privacy policies in 2000

FTC/Muris commitment to enforcement Question is the “quality” of policies

– Cautious lawyers and promise as little as possible

– Many policies weaker today than 2 years ago

What next for Online?

Stearns and Hollings bills No action unless there is

– Remember Sarbanes bill for Enron reforms– Dead in the water– Now, have Sarbanes-Oxley Act

Big issue: online only?– FTC approach that can’t promise online and treat

offline data differently– Likely the best approach

International Data Flows

E.U. Privacy Directive– Beginning of some enforcement with

significant fines E.U.-compatible privacy regimes

– E.U. neighbors– New Zealand & Australia– Canada– More coming: Malaysia? Everyone else?

International Issues

Safe harbor for financial services– No agreement yet, truly difficult issues

The reality for global companies– Compliance with privacy regimes outside the

U.S.– What to do inside the U.S.?

Conclusion: ongoing international pressure for more privacy laws in the U.S.

IV. Conclusion: Private Sector

Privacy is not dead HIPAA is the biggest privacy compliance in

U.S. history More federal financial privacy legislation if

the states get active Internet legislation is one scandal away Global companies face continuing pressure

from almost all our trading partners

Conclusion: Government Access

The Bush Administration is at risk if privacy politics continue to shift back

It has taken stands as a friend of government surveillance and secrecy

It has not designated officials to address privacy and ensure that privacy values are incorporated in new initiatives

Conclusion: Privacy & Security

First, does the intrusive measure in fact improve security?

Second, is the measure designed to improve security while also respecting privacy where possible?

Third, have we built the new checks and balances appropriate to the new surveillance?

Finally ...

Don’t let the anti-terrorism measures of today turn into the anti-communist excesses of decades past.

We’ve seen what abuses in the name of liberty look like -- lack of accountability and institutionalized lawlessness.

We must assure that does not happen again. You as privacy professionals can help assure it

does not.

Contact Information

Professor Peter P. Swire web: www.peterswire.net phone: (240) 994-4142 email: pswire@mofo.com