Why We Need a Federal Privacy Law

Harvard fellow and researcher Mutale Nkonde examines technology through the lens of whether it improves people’s lives. She is an expert on how technological systems impact communities of color and she's helped craft bills on deep fakes, biometric surveillance and algorithmic bias that have been introduced to Congress.

As part of our ongoing Election 2020 series, we spoke with her about surveillance capitalism, the California Consumer Privacy Act (CCPA) and whether anyone in the Democratic field stands out to her on privacy issues. The CCPA, signed into law in 2018, empowers California consumers to know when private companies collect, share or sell their data and to stop that sale if necessary. It applies to companies with annual gross revenue of more than $25 million or that possess information on 50,000 or more consumers. 

Powers: Do you think the U.S. does need to create a law to protect citizens privacy, particularly online or in digital environments?

Nkonde: I really like the California law because it's so ambitious. Even if it's eventually attacked by that legislature, you're starting from a really strong place. You never want to make something weak initially and then try to make it stronger because that's just not the way corporate lobbyists work. And so I personally really like that law but I definitely would be somebody that advocated for online protections, not just for adults but children too. Children are incredibly vulnerable online and, as the popularity of sites like TikTok explode, you run into situations where they have a pedophile problem, right?

You want to be able to protect those vulnerable populations. I think it has to be in the form of a federal privacy law because tech knows no boundaries. So it's great that we have the law in California but what happens if I live in Arizona? What happens if my router comes from New Jersey and I live in Pennsylvania and New Jersey has a privacy law and Pennsylvania doesn’t? I can see situations like that happening in the future so it needs to be something that is federal and it needs to be something that is crafted by privacy experts and consumer protection experts – not dictated by industry. For example, Google has talked about a moratorium on their facial recognition research and development. Which is huge because that's such a big part of what they see as their growth, but they're not acting in the public interest and nor should they. They are a company and their job is to maximize shareholder value. So I feel like there has to be a different group of actors that look at these questions. 

Do you think there's a situation in which companies maneuver to not comply with CCPA? Do you think the law should take a wider approach, because it leaves sectors of the economy untouched (like presidential campaigns)? 

Nkonde: It doesn't leave wide sectors of that economy untouched, mainly because we have no antitrust enforcement. The small players have been bought up by the larger players, and that has been the history of tech. Because we don't have mom and pop entities, it's a nonfactor. But  if we successfully pursue ani-trust enforcement, and you then start to see these players that ordinarily sell to Facebook or Amazon, no longer interested in selling, then it becomes dangerous. Now they may not be at the scale covered by CCPA and outside of the regulatory enforcement the law lays out. If antitrust is enacted it might stop small companies selling to the big three because they can be competitive. But then that creates this other problem where they might not have to be compliant. 

Do you think that antitrust is the best path forward for addressing the data dominance of Facebook and Google, or is it something else?

Nkonde: I think antitrust is everything. I think it's multipronged. I think we need to enact anti-legislation, because having complete market capture puts this into a situation where Google is giving us our health data as well as telling us how long it'll take to get over a common cold as well as helping us charge our credit cards from our phones in public. That’s problematic, and it's particularly egregious with Amazon where they're able to give their businesses preferential listings on their website. And then if they see a company that's selling particularly well, they can just create a direct competitor and then promote their own company over a competitor. So that definitely has to happen. 

But it's not the only way forward. I think that it needs to be in concert with privacy protections, in concert with consumer protections, and a whole framework that redistributes power from Silicon Valley and spreads it across the country. 

Is there a candidate in the Democratic primary or outside of that who is  addressing these issues in a pointed way? Or is the conversation still a little bit disparate, because there are so many issues that we're trying to tackle in this election? 

Nkonde: You have people like Congressman Ro Khanna in San Francisco, but he's working directly with the industry. You have Andrew Yang but, again, he is very industry-friendly, and thinks a universal basic income will clear this up. That way you can keep innovating and people will still have jobs. So I would say there is still a lack of a real person, outside of maybe New York Congresswoman Yvette Clarke. She's not a national level candidate but she’s critical of tech in the interest of regular people.

You argue that digital literacy, or  the idea of us being the agents of our own data, it leaves people out of this conversation entirely. Can you explain how? 

Nkonde: It leaves out poor people, people who are often people of color. It leaves women largely out of the conversation, rich and poor, just because we're so underrepresented in decision-making in technology. It leaves out people with disabilities, who often don't even have the tools that they require to access online information the way you and I access it. 

And so when you think about all the groups that it leaves out, they're actually larger than the people that it includes. That's why I am so supportive of not just a policy response, but there has to be a way that we also have judges that are going to interpret the laws that we do have in a way that's favorable to the public interest. 

So we're completely relying on the public sector. And in the case of something like California you see it being done beautifully where, ironically, California is home to Silicon Valley, yet in the state that you see the first facial recognition ban and a push for universal privacy. And that's something that I think the rest of the country, that people like you and I who are conversant in this space, should really take a good look at.