Mr. Chairman, my name is Solveig Singleton and I am a lawyer and the director of information studies at the Cato Institute. Thank you for this opportunity to comment on the idea of a privacy commission. My testimony will examine the role such a commission would play in the debate about privacy. I will offer several important issues as examples of important contributions that such a commission might make. These will include:
- A review of how the vast amounts of information requested by the federal government can affect our rights to travel and work, and how to prevent abuses.
- How to apply the Fourth Amendment of the U.S. Constitution, which describes lawful searches and seizures, to new computer and wireless communications networks.
- In the private sector, the impact of broad privacy legislation or regulation on small businesses, consumers, charities, and grassroots groups.
Privacy, The Federal Government, and the Fourth Amendment
Government has unique powers of investigation, arrest, and trial that the private sector lacks. These unique powers make the possession of information by government fundamentally alarming in a way that uses of information in the private sector are not. This century alone contains far too many examples of governments—including our own—that have abused information they were entrusted with.
Just in the past decade, massive government databases have grown up. Beyond the census, social security, and the Bank Secrecy Act, there’s a National Directory of New Hires with everyone in it (child support), federal mandates for drivers’ licenses and birth certificates, pilot programs for “employment eligibility confirmation” (immigration), the evolution of the social security card into a de facto national identifier, a new employment database for the Workforce Investment Act, a national medical database with unique health identifiers, and the National Center for Education Statistics. On top of those new databases have come new proposals for monitoring and tracing citizen’s activities, such as FIDNET.
A privacy commission could play a vital part in increasing Congress’s understanding of how government information gathering and surveillance affects U.S. citizen’s freedoms to work and travel, seek medical treatment, or exercise other rights overall. Most data-collecting proposals come with benefits attached—Aid to Families with Dependant Children, immigration law enforcement, or proposals to enforce child support orders—and each proposal standing alone seems well-intentioned enough on its face. But must we treat everyone like a deadbeat dad in order to catch a few wrong-doers? Will more government demands for information and identification turn holding a job or moving from state to state into a privilege enjoyed by those with the right paperwork? This is the kind of question that a privacy commission would be ideally situated to investigate, to consider the implications of these databases as a whole, rather than in a piecemeal fashion.
Second, there is the question of whether the means by which information is collected is consistent with the Fourth Amendment. The Fourth Amendment of the United States Constitution provides that:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or Affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Today, however, some police practices, such as the aggressive “stop and frisk” searches used on the occasion of the death of Amadou Diallo in New York City, seem to bypass this showing of probable cause. Some have proposed to allow “surreptitious” searches of homes for encryption keys. The “Know Your Customer” rules that the FDIC formally proposed—and backed down from—just last year remain in place as informal agency guidelines followed by many banks. The brunt of careless or unconstitutional searches will be borne, as always, by those least able to defend themselves—immigrants, small businesses, and minorities.
A privacy commission could provide much-needed perspective on an age when law enforcement has access to satellite photos, infrared, plaint-text readers, and many other surveillance data. The commission might be asked to study the application of the Fourth Amendment to police practices, business records, and new computer networks. The commission could also provide valuable information about alternatives law enforcement techniques (such as the use of informants) that do not jeopardize the safeguards provided by the Fourth Amendment.
Data Protection and the Private Sector
A privacy commission could also fill significant holes in Congresses understanding of another completely different aspect of privacy, the use of information about consumers by private sector businesses. Private sector businesses have little power to violate citizen’s rights with the information they hold; consumers do not need to be protected from people trying to invent and sell goods and services. Nevertheless, the use of consumer information by the private sector has become controversial. Horror stories and consumer surveys have taken the place of leadership from legislators. There is some danger that broad legislation or regulation could be passed with bizarre and painful consequences for the information economy.
For example, little information is available on the probable impact of privacy regulation on small businesses (including web sites), startups, charities, and grassroots groups. The experience of Europe with privacy regulation suggests that regulation makes the kind of information that these groups use to get their foot in the door of civil society much less readily available, and much more expensive than when information flows freely throughout the economy.
In addition, a privacy commission should ask how privacy regulation would effect the availability of products, services, and information to consumers. Information about the impact of such regulation on the prices and selection of goods and services to consumers is vitally needed, and this information cannot be provided by shallow surveys of web policies or public opinions.
Finally, a privacy commission should consider how to best defend consumers from real dangers such as identity theft and fraud. Treating legitimate businesses like stalkers is not the answer. Would the use of biometric identifiers like voiceprints or fingerprints help businesses with security concerns? How can law enforcement be more effective in enforcing existing laws against fraud and identity theft?
Conclusion: The Need for a Balanced and Scholarly Commission
A privacy commission could play a vital role in informing Congress, and, ultimately, the American public, about the changing relationship between the federal government and its citizens that comes with the growth of federal databases and investigative powers. This “Big Picture” of this issue has never been addressed. Databases and powers of search and seizure have grown up on a piecemeal basis. But Congress would be right to ask whether the result has has been a systemic shift in the powers of government with relation to the people.
Likewise, a privacy commission could play a very important role in ensuring that Congress does not adopt radical proposals to regulate private-sector uses of information without fully understanding their economic consequences. The usual rule for people interacting with one another is that each is free to learn from the other, and make free use of the knowledge gained in the exchange. That is how the economy has long operated (with a few exceptions). Abandoning the free flow of information is a truly drastic measure, and should not be considered without a complete understanding of its economic impact.
My primary misgiving about the idea of a privacy commission is that its work cannot provide a solid foundation for Congressional understanding of these issues unless the commission is balanced. It is easy to imagine a commission composed mainly of a bunch of the usual suspects with an agenda, with little new to offer in terms of serious analysis of privacy issues. In my view, the proper role of a commission would be to provide objective analysis and scholarship—the politics is for Congress. It might help to limit such a commission’s role to that of a fact-finder, for example, rather than asking that its primary role be to recommend one policy over another.