We are engulfed in turmoil over predatory misuse of personal data by governmental actors and corporations. Although perhaps not inevitable, this was certainly predicted.
In the episode of the television show The West Wing titled “The Short List,” which first aired in November 1999, the character Sam Seaborn argues against nominating a judge for the Supreme Court due to the judge’s refusal to acknowledge an individual right to privacy. Sam asserts privacy will be the seminal debate of the era – “Twenties and thirties, it was the role of government. Fifties and sixties, it was civil rights. The next two decades are gonna be privacy. I’m talking about the Internet. I’m talking about cellphones.”
The past two decades have proven Sam at least partially right, with the courts hearing major cases involving wiretapping, government access to personal devices and digital records, and corporate use of personal data. Legislatively, however, Congress has not demonstrated commensurate resolve to update our privacy laws to reflect the digital era.
But Congress may yet be compelled to act, at least when it comes to defending individual privacy from corporate abuse and neglect. Against the backdrop of data breaches at Yahoo! (affecting all of its users), Equifax (affecting over 140 million Americans) and numerous other companies, the magnitude of questionable, outright unethical and possibly illegal conduct on the part of Facebook and its leadership will perhaps prove a tipping point.
If we are to seize this opportunity, however, Congress must address the fundamental imbalance in power between individuals and companies when it comes to personal data. Too often Congress, subject to lobbying from special interests, develops overly technical, convoluted solutions, opting for compliance-oriented legislation that curtails specific activities without materially impacting an industry’s power to inflict harm in the future.
While technical responses are important, and of course it is critical that legislation draw upon the knowledge and experience of experts and industry professionals, without considering the balance of power, our remedies prove fleeting. It is the nature of power, absent a countervailing force, to alter the future in its own interest.
Facebook can add features to reduce the probability of repeating the egregious activities that have come to light, but this will little matter as its power – in the form of unique access to user data – will enable it to invent new ways of abusing personal information, ways we currently cannot even contemplate. And so we need individuals (users) to have equal power to shape the future uses of personal data.
Theologian Reinhold Niebuhr explored this dynamic in Moral Man and Immoral Society: A Study in Ethic and Politics. Addressing those who suggest the root of social injustice is simply the failure to apply intelligence and reason, with no recognition of the tendency for those in power to seek to sustain their position, Niebuhr writes, “Conflict is inevitable, and in this conflict power must be challenged by power.”
Applied to our current situation, if we do not create a legal framework that transfers power from Facebook and other companies to individuals, we will continue to see our data, personal lives and identities exploited.
Identifying all the components of such a framework is a massive endeavor, but the European Union’s General Data Protection Regulation, which will go into effect in May, provides a useful reference point. The GDPR provides clear authority for individuals to access their data, assert greater force over how companies will use personal information and have such data be erased (the right to be forgotten). Such measures will meaningfully restore power to users, and while Congress must create a structure that speaks to America’s unique political and economic systems, GDPR contains many ideas worthy of consideration.
As another way to integrate an analysis of power in a policy response, consider how the balance of power would change if Congress prohibited Facebook and other platform companies from selling ads. If such companies are not media companies liable for their content, then it is reasonable to argue they should not give preferential treatment to one category of users (i.e., those who advertise) in return for payment. Prohibiting such companies from selling ads would compel them to adopt a revenue model more reliant on individuals (e.g., a subscription model), giving them enormous incentive to protect personal data lest they lose customers.
More remains for us to learn before we can know whether such a response would be viable and effective, but it illustrates how Congress should infuse its deliberations with an understanding of power dynamics. And Congress must think holistically – Facebook may be among the worst offenders, but our response must encompass more than just Facebook.
The complexity of this challenge is staggering, yet few policy debates are more urgent. Referring to individual privacy, Sam Seaborn closes his argument by saying, “In a country born on the will to be free, what could be more fundamental than this?”
(Dan Vallone is a member of the Truman National Security Project’s Defense Council. He lives in Concord. Views expressed are his own.)