Questions for the Proposed Privacy Commission

Share

Mr. Chairman, my name is Solveig Singleton and I am alawyer and the director of information studies at the CatoInstitute. Thank you for this opportunity to comment on the idea ofa privacy commission. My testimony will examine the role such acommission would play in the debate about privacy. I will offerseveral important issues as examples of important contributionsthat such a commission might make. These will include:

  • A review of how the vast amounts of information requested bythe federal government can affect our rights to travel and work,and how to prevent abuses.
  • How to apply the Fourth Amendment of the U.S. Constitution,which describes lawful searches and seizures, to new computer andwireless communications networks.
  • In the private sector, the impact of broad privacy legislationor regulation on small businesses, consumers, charities, andgrassroots groups.

Privacy, The Federal Government, and the FourthAmendment

Government has unique powers of investigation, arrest, and trialthat the private sector lacks. These unique powers make thepossession of information by government fundamentally alarming in away that uses of information in the private sector are not. Thiscentury alone contains far too many examples ofgovernments--including our own--that have abused information theywere entrusted with.

Just in the past decade, massive government databases have grownup. Beyond the census, social security, and the Bank Secrecy Act,there's a National Directory of New Hires with everyone in it(child support), federal mandates for drivers' licenses and birthcertificates, pilot programs for "employment eligibilityconfirmation" (immigration), the evolution of the social securitycard into a de facto national identifier, a new employment databasefor the Workforce Investment Act, a national medical database withunique health identifiers, and the National Center for EducationStatistics. On top of those new databases have come new proposalsfor monitoring and tracing citizen's activities, such asFIDNET.

A privacy commission could play a vital part in increasingCongress's understanding of how government information gatheringand surveillance affects U.S. citizen's freedoms to work andtravel, seek medical treatment, or exercise other rights overall.Most data-collecting proposals come with benefits attached--Aid toFamilies with Dependant Children, immigration law enforcement, orproposals to enforce child support orders--and each proposalstanding alone seems well-intentioned enough on its face. But mustwe treat everyone like a deadbeat dad in order to catch a fewwrong-doers? Will more government demands for information andidentification turn holding a job or moving from state to stateinto a privilege enjoyed by those with the right paperwork? This isthe kind of question that a privacy commission would be ideallysituated to investigate, to consider the implications of thesedatabases as a whole, rather than in a piecemeal fashion.

Second, there is the question of whether the means bywhich information is collected is consistent with the FourthAmendment. The Fourth Amendment of the United States Constitutionprovides that:

The right of the people to be secure in their persons, houses,papers, and effects, against unreasonable searches and seizures,shall not be violated, and no Warrants shall issue, but uponprobable cause, supported by Oath or Affirmation, and particularlydescribing the place to be searched, and the persons or things tobe seized.

Today, however, some police practices, such as the aggressive"stop and frisk" searches used on the occasion of the death ofAmadou Diallo in New York City, seem to bypass this showing ofprobable cause. Some have proposed to allow "surreptitious"searches of homes for encryption keys. The "Know Your Customer"rules that the FDIC formally proposed--and backed down from--justlast year remain in place as informal agency guidelines followed bymany banks. The brunt of careless or unconstitutional searches willbe borne, as always, by those least able to defendthemselves--immigrants, small businesses, and minorities.

A privacy commission could provide much-needed perspective on anage when law enforcement has access to satellite photos, infrared,plaint-text readers, and many other surveillance data. Thecommission might be asked to study the application of the FourthAmendment to police practices, business records, and new computernetworks. The commission could also provide valuable informationabout alternatives law enforcement techniques (such as the use ofinformants) that do not jeopardize the safeguards provided by theFourth Amendment.

Data Protection and the Private Sector

A privacy commission could also fill significant holes inCongresses understanding of another completely different aspect ofprivacy, the use of information about consumers by private sectorbusinesses. Private sector businesses have little power to violatecitizen's rights with the information they hold; consumers do notneed to be protected from people trying to invent and sell goodsand services. Nevertheless, the use of consumer information by theprivate sector has become controversial. Horror stories andconsumer surveys have taken the place of leadership fromlegislators. There is some danger that broad legislation orregulation could be passed with bizarre and painful consequencesfor the information economy.

For example, little information is available on the probableimpact of privacy regulation on small businesses (including websites), startups, charities, and grassroots groups. The experienceof Europe with privacy regulation suggests that regulation makesthe kind of information that these groups use to get their foot inthe door of civil society much less readily available, and muchmore expensive than when information flows freely throughout theeconomy.

In addition, a privacy commission should ask how privacyregulation would effect the availability of products, services, andinformation to consumers. Information about the impact of suchregulation on the prices and selection of goods and services toconsumers is vitally needed, and this information cannot beprovided by shallow surveys of web policies or public opinions.

Finally, a privacy commission should consider how to best defendconsumers from real dangers such as identity theft and fraud.Treating legitimate businesses like stalkers is not the answer.Would the use of biometric identifiers like voiceprints orfingerprints help businesses with security concerns? How can lawenforcement be more effective in enforcing existing laws againstfraud and identity theft?

Conclusion: The Need for a Balanced andScholarly Commission

A privacy commission could play a vital role in informingCongress, and, ultimately, the American public, about the changingrelationship between the federal government and its citizens thatcomes with the growth of federal databases and investigativepowers. This "Big Picture" of this issue has never been addressed.Databases and powers of search and seizure have grown up on apiecemeal basis. But Congress would be right to ask whether theresult has has been a systemic shift in the powers of governmentwith relation to the people.

Likewise, a privacy commission could play a very important rolein ensuring that Congress does not adopt radical proposals toregulate private-sector uses of information without fullyunderstanding their economic consequences. The usual rule forpeople interacting with one another is that each is free to learnfrom the other, and make free use of the knowledge gained in theexchange. That is how the economy has long operated (with a fewexceptions). Abandoning the free flow of information is a trulydrastic measure, and should not be considered without a completeunderstanding of its economic impact.

My primary misgiving about the idea of a privacy commission isthat its work cannot provide a solid foundation for Congressionalunderstanding of these issues unless the commission is balanced. Itis easy to imagine a commission composed mainly of a bunch of theusual suspects with an agenda, with little new to offer in terms ofserious analysis of privacy issues. In my view, the proper role ofa commission would be to provide objective analysis andscholarship--the politics is for Congress. It might help to limitsuch a commission's role to that of a fact-finder, for example,rather than asking that its primary role be to recommend one policyover another.

Solveig Singleton

Subcommittee on Government Management, Information, and Technology
Committee on Government Reform and Oversight
United States House of Representatives