�鶹������ý

In our increasingly digitized world, it is critical to protect individuals’ privacy. As policymakers consider passing meaningful privacy legislation, civil rights protections are a critical but mostly overlooked component. To have effective privacy legislation, we must ensure that companies’ data practices do not violate individuals’ civil rights—especially when it comes to marginalized communities. Problematic commercial data practices disproportionately harm people of color—especially Black and Brown communities—women, immigrants, religious minorities, members of the LGBTQ+ community, low-income individuals, and other marginalized communities. Centering these communities in this work helps us understand exactly how high the stakes are and underscores the need for solutions that directly mitigate these harms. Without civil rights protections adapted for the twenty-first century, the discriminatory data practices adopted by online companies will continue to have long-lasting, severe consequences.

Commercial data practices enable myriad forms of abuse. They facilitate voter suppression, digital redlining, discriminatory policing, retail discrimination, digital inequity, the amplification of white supremacy, identify theft, the endangerment of personal safety, and more. Experts have long known that data practices can lead to discriminatory outcomes in access to housing, jobs, and other critical aspects of our livelihood, yet these practices remain in place.

Data is used for discriminatory purposes, with even innocuous data points becoming proxies for protected classes. Policymakers cannot ignore these tangible bad outcomes. The stakes are particularly high for marginalized communities in five areas: employment discrimination, housing discrimination, disproportionate surveillance, socioeconomic inequality, and personal safety.

To ensure justice and equity, and to curtail these extensive harms, individuals need multiple avenues of redress when their privacy and civil rights are violated. The Department of Justice and the Department of Housing and Urban Development are already empowered to enforce existing civil rights statutes, and individuals’ privacy and civil rights would be better protected if the Federal Trade Commission, too, were empowered with rulemaking authority. Additionally, Congress must ensure that privacy laws include strong civil rights protections and preserve the ability of states to play a vital role in protecting civil rights and consumer privacy. Further, to ensure that the debate on privacy centers perspectives from marginalized communities, the tech policy community needs to reflect the country’s diversity. Including more voices in the policy debate leads to better policy solutions.

Civil rights protections must apply to the digital economy. Though we have a number of federal civil rights statutes that exist to protect individuals from unjust treatment by various institutions, these laws are insufficient for protecting against the discriminatory practices that have expanded into the digital realm. As the fight for civil rights grapples with the harms posed by data and technology, these new developments are also making it increasingly challenging to enforce civil rights laws. Further guidance and broader policy changes are needed to resolve the ambiguities around applying civil rights laws to these novel means of discrimination.

For the first time since the Children’s Online Privacy Protection Act in 1998, U.S. policymakers are having serious discussions about passing meaningful legislation to protect consumer privacy. Renewed congressional focus comes in the aftermath of multiple high-profile data breaches and privacy scandals, unexpected backlash when Congress overturned the broadband privacy rules implemented by the Federal Communications Commission,¹ and the European Union’s General Data Protection Regulation going into effect. While the debate is long overdue, it has focused myopically on requiring transparency and consent for certain data practices and whether federal legislation should preempt state laws like the California Consumer Privacy Act. Too little of the conversation has been dedicated to ensuring that companies do not violate individuals’ civil rights through their data practices. In this formative stage, it is vital to center civil rights issues in the privacy legislation debate. Otherwise, we will miss a golden opportunity to protect against data practices that lead to civil rights harms.

This report builds on an event hosted on May 9, 2019 by Color of Change and �鶹������ý’s Open Technology Institute that explored how to protect civil rights through better privacy protections.² Francella Ochillo, then vice president and general counsel of the National Hispanic Media Coalition (NHMC), delivered opening remarks. A subsequent panel, moderated by Color of Change’s senior campaign director Brandi Collins-Dexter, brought together Erin Shields, national field organizer for internet rights at MediaJustice;³ Alisa Valentin, then communications justice fellow at Public Knowledge; Miranda Bogen, senior policy analyst at Upturn; Priscilla González, campaign director at Mijente; and Gaurav Laroia, policy counsel at Free Press. The panel discussed key questions regarding privacy, digital rights, and civil rights, including: what role does technology play in our society?; how are marginalized communities disproportionately harmed by data practices and privacy infringements?; and what are some of the ongoing efforts and interventions to address these concerns?

“Privacy is not just transactional. Privacy is a civil right,” Valentin stated on the panel.¹ Historically, the concept of the right to privacy in the United States has been shaped by Louis Brandeis, who first articulated privacy in 1890 as “the right to be let alone.”² Later, as a Supreme Court Justice, he explained how the principles of the Fourth Amendment include protection of privacy against the state, enabling all citizens to conceal their unexpressed beliefs, political dissent, thoughts, and emotions from government surveillance.³ Justice Brandeis saw anonymity as a precondition for freedom of thought.⁴ In today’s networked world, we continue to struggle with balancing the right to dissent, organize, and speak truth to power with the right to feel safe and protected, and to experience digital sanctuary. The right to privacy should include ensuring freedom from the predatory business practices that replicate outlawed models of discrimination.

Privacy should mean personal autonomy and agency, but commercial data practices increasingly impede the autonomy and agency of individuals who belong to marginalized communities.⁵ Black people, women, LGBTQ+ individuals, persons with disabilities, and immigrants and refugees have long fought for civil rights protections in the brick-and-mortar economy. Discriminatory practices have expanded into the online world, but enforcement against that inequity has been insufficient. Data is used for discriminatory purposes, with even innocuous data points becoming proxies for protected classes, and policymakers cannot ignore these tangible bad outcomes. Ultimately, everyone deserves the “right to determine what information is collected on you, how it’s stored, and what it’s used for,” as Shields argued. Our laws should be updated to recognize and address discrimination brought about through harmful commercial data and surveillance practices.⁶

Ultimately, everyone deserves the “right to determine what information is collected on you, how it’s stored, and what it’s used for."

A number of federal civil rights statutes currently exist to protect individuals from unjust treatment by various institutions.⁷ These statutes prohibit different types of discrimination, are applied under different circumstances, and are intended to safeguard specific classes of individuals with legally protected characteristics.⁸ For instance, Title VII of the Civil Rights Act of 1964 prohibits discrimination in employment on the basis of race, color, religion, national origin, or sex, and Title II of the act bars discrimination on the basis of race, color, religion, or national origin in public accommodations.⁹ The Fair Housing Act, enacted in 1968, prohibits discrimination in the sale or rental of housing on the basis of race, color, religion, national origin, sex, disability, or familial status.¹⁰ The Equal Credit Opportunity Act, enacted in 1974, prohibits discrimination against credit applicants on the basis of race, color, religion, national origin, sex, marital status, age, or source of income.¹¹

These laws have been instrumental in addressing some of the injustices faced by marginalized communities in the United States, especially Black communities. As Ochillo explained in her opening remarks:

Landmark legislation of the civil rights movement that was passed in the 1960s was built on a movement of resistance and sacrifice that lasted for centuries since the first group of slaves arrived on American shores. Hundreds of years later, after people of all races were confronted with the brutality and leftover horrors of oppression, Congress passed civil rights laws to ensure that everyone had the right to be free from certain types of discrimination, ensuring that every American has the right to fair and equal treatment.

But the struggle to enforce these laws continues to this day, and data practices have enabled historical forms of oppression and discrimination to carry over into the digital realm with offline consequences. As Shields noted, “Like a virus, discriminations from before have mutated.”¹² Commercial data practices enable, among other things, voter suppression, digital redlining, discriminatory policing, retail discrimination, digital inequity, the amplification of white supremacy, identify theft, and the endangerment of personal safety.¹³ By collecting and using data, companies can leverage new data and surveillance tools that enable racial profiling and discrimination.¹⁴ Further, automating decision-making using data and predictive tools can discriminate against marginalized communities¹⁵ and exacerbate hidden biases in data.¹⁶ Experts have long known that data practices can lead to discriminatory outcomes in access to housing, jobs, and more. Therefore, as Shields stated, protecting privacy is essential to “shift[ing] power imbalances in a mostly unregulated data space.”

Civil rights protections must also apply to the digital economy. As Ochillo elaborated,

When [civil rights] laws were codified, no one imagined a scenario where tech platforms would be able to discriminate online in ways that legislation intended to prevent in our neighborhoods. Today, my data profile can determine whether I will have access to certain types of employment or housing opportunities, or whether I will be excluded. It will have an impact on how much I make or pay for a mortgage. And the profiles that companies create about me behind closed doors will live online indefinitely and remain difficult for me to change. That is why we need privacy laws that acknowledge enduring economic, political, and cultural consequences of discrimination that still exists in our country today.¹⁷

Without incorporating civil rights protections into privacy legislation, the situation Ochillo described is unlikely to change.

Companies should be prohibited from using individuals’ personal data to discriminate against members of marginalized communities. Many civil society organizations, including Color of Change and �鶹������ý’s Open Technology Institute, have called upon Congress to protect civil rights, equity, and equal opportunity in the digital ecosystem.¹⁸ In April 2019, 26 civil society organizations sent a letter to Congress on the need for federal privacy legislation to address the discriminatory effects of commercial data practices, arguing that “personal data are the raw materials that fuel discrimination. … For too long, corporations have ignored the digital pollution that their commercial data practices generate; they must be held accountable for the negative externalities of their business models.”¹⁹ Privacy legislation must address these harms.

The idea of privacy as it is often discussed and understood has little value when it excludes certain communities. For hundreds of years, many people in the United States have not been granted true anonymity and autonomy.¹ Lantern laws in the eighteenth century dictated that Black, mixed-race, and Indigenous enslaved people had to carry candle lanterns with them after sunset.² Many enslaved people were tracked and documented meticulously, and slave branding was used as a precursor to modern biometric ID.³

Today, many people still lack true anonymity and autonomy. Most public transportation is equipped with surveillance devices,⁴ and individuals have to give up a certain amount of data to participate in social safety net programs.⁵ While these trends impact more white people in terms of sheer numbers, Black and Indigenous people are disproportionately impacted per capita.⁶ In any number of ways, details about your life that may seem innocuous become a handful of carefully chosen factors that can determine whether you are more likely to be surveilled by government or corporations—details like whether you use an Android phone or iPhone, attend public or private school, are incarcerated or in contact with a loved one who is incarcerated, or live in a neighborhood where the police are overly present. These details are also factors that are inextricably and tacitly linked to race, class, and cultural identity.

While these trends impact more white people in terms of sheer numbers, Black and Indigenous people are disproportionately impacted per capita.

Without bright-line, twenty-first century civil rights protections, the discriminatory data practices adopted by online companies will continue to have long-lasting, severe consequences. They disproportionately harm people of color—especially Black and Brown communities—women, immigrants, religious minorities, members of the LGBTQ+ community, low-income individuals, and other marginalized communities. Centering these communities in this work helps us understand exactly how high the stakes are, and underscores the need for solutions that directly mitigate these harms.

Our panel discussion covered five particular areas that exemplified the high stakes: employment discrimination, housing discrimination, increased surveillance, socioeconomic inequalities, and personal safety.

Companies can use data in ways that facilitate gender- and race-based employment discrimination.⁷ Many hiring processes have moved online; not only do companies list ads for job openings online, but humans or computers (through algorithms built and programmed by humans) increasingly decide who sees the openings.⁸ Algorithms may also screen job applicants’ resumes, analyze job interviews, and more.⁹ Employers are now trying to leverage new hiring tools with the stated goals of creating more efficiencies and improved personalization, such as reducing the cost per hire and optimizing the quality of hire.¹⁰ However, is “personalization” actually just “discrimination,” as Bogen argued? As companies attempt to maximize efficiency and personalization in the hiring process, it may be that they are actually just discriminating against people of color, women, and other underrepresented groups.

Advertising platforms, for instance, can enable employment discrimination by choosing who sees particular job ads, which has serious implications for job opportunity. When recruiters advertise positions, they often pay for digital advertising on large online platforms to maximize their reach and effectiveness.¹¹ These platforms in turn leverage the troves of user data they have amassed and give employers the ability to dictate audience parameters to target ad delivery. Facebook, for instance, used to allow targeting based on demographic data, and still allows targeting based on categories that may be highly correlated with race and other protected classes, such as inferred interests.¹² Though the employers set initial targeting parameters, the ad platforms may ultimately determine who within a target audience sees an ad based on their own prediction of how likely a user is to engage with the ad or apply for the position.¹³

Online employment ads have been delivered in discriminatory ways. Numerous studies have established that Facebook’s ad delivery algorithm has discriminated based on race and gender. In response, the platform has adopted several policies to avoid discrimination for certain types of ads, including eliminating the option to allow age-, gender-, or zip code-based targeting.¹⁴ In 2018, ProPublica found that Facebook allowed employers to advertise jobs selectively to users of specific genders.¹⁵ Fifteen employers, including Uber, advertised jobs exclusively to men, and a community health center in Idaho advertised job openings for nurses and medical assistants only to women.¹⁶ Another recent study found that this discrimination persists in job listings even when advertisers do not target specific demographics and are trying to reach a broad audience.¹⁷ Advertisers can also still exclude users based on interests that are highly correlated with race by using custom audiences or location.¹⁸ As Bogen explained on the panel, “All the data still exists in the infrastructure, they just took away some of the tools [used for explicit discrimination], but those algorithms look at historical information being pushed forward into the future.”¹⁹

Predictive technologies also discriminate in hiring. Increasingly, predictive technologies that rely on data are used in recruiting, screening, interviewing, and selecting candidates. Without clear transparency and oversight, these technologies can lead to bias, thereby undermining equity in hiring.²⁰ In particular, Bogen highlighted that discrimination can occur as recruiters attempt to leverage the power of data toward streamlining candidate screening: “Amazon’s racist hiring AI was saying women were probably not good candidates because they didn’t resemble the candidates that the company had seen in the past. These are tangible outcomes that weren’t in the conversation before that are now becoming more clear.”²¹ These outcomes, according to Bogen, make it obvious that machines, too, can be racist as they are often a reflection of society and can perpetuate and exacerbate biases.²² Yet, the public lacks transparency into most of these practices.

Access to housing has been recognized as a basic human right, one that is a necessary condition for other economic, social, and cultural rights. The process for securing housing has moved increasingly online. Whereas, home buyers in the 1980s typically perused newspaper ads to find a home, 44 percent of home buyers in 2016 looked for properties online first.²³ This process is also vulnerable to discrimination.

Housing discrimination is not new. The Fair Housing Act prohibits certain types of housing discrimination. But online means of housing discrimination have supplemented offline means. Historically, Shields relayed on the panel, marginalized communities have engaged with the legal system to gain rights to material conditions like housing. “As our lives have become increasingly digitized,” she said, “discrimination from before has mutated… [An] example could be racial covenants and redlining in housing. This has mutated into Facebook allowing housing providers to select racial categories of who’s seeing ads for housing.”²⁴

Targeting online housing ads is already a civil rights issue. In 2016, ProPublica found that Facebook’s platform allowed advertisers to exclude Black, Hispanic, and other groups called “ethnic affinities” from seeing housing ads.²⁵ A recent study found that, in the same way that gender- and race-based discrimination persists in job listings, discrimination occurs in the targeting of housing ads even when advertisers do not opt to target specific demographics.²⁶ Further, advertisers can still discriminate by selecting audience parameters that are highly correlated with race, such as inferred interests or location.²⁷

Facebook’s platform allowed advertisers to exclude Black, Hispanic, and other groups called “ethnic affinities” from seeing housing ads.

Secondary, nonconsensual data collection on these large platforms can also lead to further housing discrimination, with some companies collecting personal information without clearly disclosing what is being collected and what it might be used for. This secondary use of data, in previous cases, has allowed companies to repurpose user data, without consent, to build tools that make segregation worse. As Laroia explained on the panel, “It is fundamentally immoral that companies are using information about your ordinary life online, and that information is being turned around and used to build tools that facilitate segregation—to fundamentally undo the important rights and progress we’ve made to build a more equitable society.”²⁸ Facebook, for instance, originally collected users’ phone numbers for two-factor authentication, but also used that information to deliver targeted advertising.²⁹ Using phone numbers, one can find a wide range of personal information, including names, education and career histories, and locations—all of which can be used as a proxy for facilitating housing discrimination through targeted ad delivery.³⁰

Digital surveillance disproportionately violates the privacy of those communities already marginalized and unreasonably suspected. The history of surveillance of marginalized communities in the United States dates back to colonial times. As media activist Malkia Cyril said at the 2017 Color of Surveillance conference, “Surveillance technologies have been used to separate the citizen from the slave, to protect the citizen from the slave.”³¹ Records of slaves in plantation ledgers served as proto-biometric databases and, combined with slave passes, slave patrols, and fugitive slave posters, were the precursors to modern policing and tracking.³² New technology and commercial data practices have continued this legacy of surveillance with a disparate impact on marginalized communities, especially immigrants and communities of color. For instance, commercial databases have been accessed by government surveillance programs and law enforcement agencies, without a warrant or probable cause, and were used to target people of color.³³ Social media data can also be used for racial profiling.³⁴

Companies are utilizing commercial data practices that rely on privacy intrusions, leading to increased surveillance. Mijente, which has historically focused on immigrant rights, learned that Immigration and Customs Enforcement (ICE) used Palantir’s services to track and detain undocumented immigrants.³⁵ ICE built profiles of immigrant children and their family members, logging relatives and guardians who showed up to claim unaccompanied minors in Palantir’s investigative case management system.³⁶ According to González, federal agencies and local law enforcement across the country were able to share surveillance data to locate, detain, and deport immigrants using Palantir’s software, thereby circumventing sanctuary policies that prohibit cooperation between ICE and local police in certain cities, and exacerbating the family separation crisis. As González noted, “Immigrants, people of color, vulnerable communities usually serve as laboratories for testing new technologies,” as companies leverage new ways of commodifying data, often without regard for civil and human rights.³⁷

There is a history of using personal information to surveil minorities in the United States.³⁸ In the aftermath of the September 11 attacks, the Bush administration enacted the National Security Entry-Exit Registration System (NSEERS) to register non-citizen visa holders, primarily from Muslim-majority countries.³⁹ While this system is now defunct, new practices have cropped up that continue to subject members of marginalized communities to undue surveillance. In June 2019, the U.S. State Department began collecting and reviewing all social media accounts and identities of people entering the country.⁴⁰ This practice “only further illustrates the extent to which social media is now being weaponized against immigrant and non-immigrant minority populations.”⁴¹ Individuals’ personal data feeds into database screening and watchlists that determine who can work, vote, fly, and more—which in turn can enable discrimination and profiling, bearing significant risks to the civil rights and liberties of marginalized communities.⁴²

Data practices also disproportionately harm Black and Brown communities. Shields noted that there have been long-standing movements to acknowledge the discriminatory impact of data with Black- and Brown-led research, noting examples like Our Data Bodies and the Stop LAPD Spying Coalition. Our Data Bodies (ODB) has exposed how conviction and incarceration data on individuals can be used as a barrier to employment, services, and housing, and its disproportionate effect on Black residents.⁴³ The Stop LAPD Spying Coalition has publicized surveillance techniques and resources used by the Los Angeles Police Department to discriminate against people of color, including how the department’s use of predictive policing has criminalized spaces in Los Angeles mostly occupied by Brown and Black residents.⁴⁴

Discriminatory data practices also perpetuate, and even escalate, socioeconomic inequities. Companies may use information about people in ways that entrench existing wealth disparities, such as using data on bill payments and credit scores to reject requests for bank loans.⁴⁵

Exploitation of data in these ways leads to socioeconomic harm for specific groups of people who have historically been subject to discrimination. Ochillo gave the example of companies using data on customers’ income levels and zip codes to “personalize” prices and products for people living in specific neighborhoods. A person living in a wealthier neighborhood may have access to better prices or products than someone living in a poorer neighborhood. As Ochillo said, “Data that is originally collected with good intentions can easily be repurposed to discriminate or over-police in communities of color.”⁴⁶ Surveillance and violations of privacy also perpetuate digital inequality and the socioeconomic divide. Valentin pointed to Mary Madden’s writings on how poor people “experience these two extremes: hypervisibility and invisibility,”⁴⁷ lacking both the agency and resources to challenge undue harms.⁴⁸ Low-income individuals are subject to greater suspicion and monitoring when applying for government benefits, and live in heavily policed neighborhoods. They can be unfairly targeted by predictive policing tools. At the same time, if low-income individuals are not visible enough online, they can also lose out on education and job opportunities. Low-income communities are also most likely to suffer from surveillance and violations of their privacy and civil liberties, as low-income internet users are significantly less likely than those in high-income households to use privacy settings to limit who can see what they post online (57 percent vs. 67 percent).⁴⁹

“Data that is originally collected with good intentions can easily be repurposed to discriminate or over-police in communities of color.”

The collection and misuse of personal information can cause physical and emotional harm. Data is directly linked to personal safety, especially when that data is used to identify people or determine their location. In particular, data practices can facilitate and locate targets for hate campaigns, physically endangering individuals’ lives.

Violent hate groups use online platforms and services to target specific populations. “Data manipulation techniques have been used to…stir hate and division within communities and against religious minorities,” Ochillo pointed out. Civil rights groups like Muslim Advocates have called on social media platforms to rein in the amplification of white supremacist hate groups.⁵⁰ By using search engine optimization strategies to exploit “data voids,” or search terms that lack robust results, bad actors can “hijack” certain issues and reach potential new audiences.⁵¹ As this rhetoric spreads online, it can lead to real-life violence, as several incidents have demonstrated. For instance, Robert Bowers, who murdered worshippers at a Pennsylvania synagogue in October 2018, was active on Gab, a Twitter-like platform used by white supremacists.⁵² And a recent study led by New York University found that online hate speech on Twitter predicts real-life racial violence.⁵³

In addition, there are significant risks to personal safety associated with the sharing of individuals’ location data. Motherboard published an extensive report earlier this year on how major telecom companies like AT&T, Sprint, and T-Mobile sold access to their customers’ real-time location data to location aggregators, who then resold the data to law enforcement agencies, car salesmen, property managers, bail bondsmen, and bounty hunters.⁵⁴ This data likely included “assisted GPS” data, which is used by first responders to locate 911 callers in emergency situations and can specify a person’s location inside a building. The precise location data was allegedly used by two bounty hunters who tracked a man on the run from a first degree drug charge in Minnesota to a car dealership in Texas.⁵⁵ All three men died in the ensuing shootout, which also endangered other customers at the dealership.⁵⁶

The civil rights implications of these data and surveillance tactics are many. Such data could be used to track undocumented immigrants and their families. It may be used to identify groups of people or communities and expose their meeting locations, information that could then be used to allow hate crimes and identity-based violence. For instance, Grindr, a popular LGBTQ+ dating app, disclosed the HIV status, GPS location, email addresses, and other profile information from its users to third parties without user consent.⁵⁷ It is paramount, therefore, to protect members of marginalized communities in a way that accounts for the greater risk to their civil rights that privacy violations pose.

The lack of consumer privacy protections in the United States has given way to myriad harms to marginalized communities. Envisioning privacy as a civil right can help curtail the extensive discriminatory harms discussed above. Yet as the fight for civil rights grapples with the harms posed by data and technology, these new developments are also making it increasingly challenging to enforce civil rights laws.¹ To ensure justice and equity, it is crucial that voices from these communities are well represented as we debate policy solutions at government agencies and in federal and state legislation.

Government agencies should protect privacy and civil rights whenever possible. Agencies like the Department of Justice and the Department of Housing and Urban Development (HUD) are empowered to enforce existing civil rights statutes. In March 2019, HUD charged Facebook with housing discrimination, alleging that its targeted advertising platform violated the Fair Housing Act by “encouraging, enabling, and causing” unlawful discrimination by restricting who can view housing ads.² This action came after Facebook settled a series of civil rights lawsuits alleging housing and employment discrimination by the National Fair Housing Alliance and others.³

Even agencies that do not have explicit civil rights mandates can help. For instance, the Federal Communications Commission (FCC) has rules protecting the privacy of cell phone users, and the rigorous enforcement of those rules can help protect civil rights. As referenced above, Motherboard found that the major wireless carriers were selling customer location data to third parties without requiring proof of lawful orders or customer consent. The FCC could enforce its privacy laws as argued in a recent complaint filed by �鶹������ý’s Open Technology Institute, Georgetown Law Center on Privacy & Technology, and Free Press, which would provide more privacy protections against potentially discriminatory and dangerous uses of highly sensitive location information of cell phone users.⁴

Nonetheless, further guidance and broader policy changes are needed given the ambiguities around how to apply civil rights laws to these novel means of discrimination. For instance, while the Voting Rights Act prohibits voter suppression by violence or intimidation, it does not prohibit voter suppression by deception, which is typically how voters are disenfranchised online.⁵ We saw this in the 2016 election, where Russian interference efforts deliberately targeted Black Americans using personal information that was weaponized to deceive and disenfranchise voters.⁶

To ensure that privacy enforcement captures these civil rights violations, one possibility is empowering the Federal Trade Commission (FTC) to protect privacy and civil rights with rulemaking authority. The FTC is the primary government agency responsible for protecting privacy, but its current privacy enforcement powers are limited to its authority to protect against deceptive and unfair practices, which does not sufficiently allow the agency to protect privacy.⁷ Instead, the FTC should be empowered with rulemaking capacity that would sufficiently allow it to provide more guidance and regulatory certainty on what privacy laws require from companies as technology and business practices continue to evolve in the digital economy. However, relying exclusively on the FTC to enforce civil rights protections is insufficient, given that the agency is resource-constrained and cannot take every case.⁸ Thus, individuals require additional avenues for recourse through other agencies, states, and courts, too.

Congress must ensure that privacy laws include strong civil rights protections. Free Press and the Lawyers’ Committee for Civil Rights Under Law recently published model legislation outlining how Congress can ensure that personal data is not used to discriminate against protected classes in areas like employment, housing, and education.⁹ They also propose classifying online businesses as public accommodations. As it stands, “The bar downstairs has more obligations regarding civil rights in general to the public than any online platform does,” Laroia said on the panel.¹⁰ “That varies by state, but there’s no federal consensus on that. … By classifying online businesses as public accommodations, we [would] make it unlawful to process personal information in a manner that segregates, discriminates, or otherwise makes unavailable those goods and services.”¹¹

This model legislation would require companies to audit algorithms for privacy risk and robust transparency.¹² It also gives the FTC the ability to enforce the law.¹³ Lastly, it would give people a private right of action to protect their civil rights. A private right to action is critical because, as Laroia explained, the public cannot rely exclusively on government agencies to protect civil rights, “so it’s important that ordinary people and advocates can protect their rights when government agencies are falling down on the job.”¹⁴

States play a vital role in protecting civil rights, and any legislation should preserve that role. For instance, in July 2018, the Washington State attorney general investigated Facebook for unfair and deceptive practices and ultimately agreed to a settlement that required Facebook to alter its advertising platform by removing the option for advertisers to exclude ethnic and religious minorities, immigrants, LGBTQ+ individuals, and other protected groups from seeing their ads.¹⁵ State civil rights laws in some cases, including the Washington case, are more protective than federal civil rights laws, making it inappropriate for any federal civil rights law to preempt state civil rights laws or for federal privacy laws to preempt state laws.

Ultimately, to ensure that the debate on privacy centers perspectives from marginalized communities, the tech policy community needs to reflect the country’s diversity. Valentin has written about #TechPolicySoWhite to underscore the importance of diversifying the tech policy space.¹⁶ Impacted communities—especially Black communities—must be included in discussions about privacy, she said on the panel, particularly because stakeholders define “privacy” differently, depending on the community and cultural background. As Valentin wrote:

If someone is not a person of color, they are likely to lack the experience to find policy solutions that positively impact communities of color. Therefore, I believe it is important to get in the practice of passing the microphone to individuals who can accurately identify the issues and subsequent solutions that will benefit these communities. The same applies to people who attempt to speak on behalf of women, low-income communities, disabled communities, or the LGBTQ community…pass the mic. It is important to recognize that there are gaps in the knowledge of every well-intentioned, non-marginalized ally. Thus, it is important to identify those gaps in one’s knowledge, speak with the affected parties to gain more understanding, and subsequently uplift their voices during these important debates.¹⁷

Laroia echoed that including more voices in the policy debate also leads to better policy solutions:

By genuinely thinking about the most affected communities in the work we do, we’re actually able to solve the problems. We think the privacy conversation has moved not just because the downside risks have become more apparent, but because the circle of people who care about these issues is becoming wider, giving the privacy debate a different kind of moral center than it had before.¹⁸

For privacy legislation to fully protect against the wide array of civil rights harms that come about from commercial data practices, we must center the communities most directly affected by those practices.

No legislation can truly be comprehensive or effective at protecting privacy unless it addresses civil rights. Problematic data practices have severe implications for employment discrimination, housing discrimination, increased surveillance, socioeconomic inequities, and personal safety. They are particularly damaging for marginalized communities, with both public and private organizations using data to discriminate based on race, gender and sexual identity, citizenship status, ethnic and religious affiliations, socioeconomic status, health, and disability. Some of this can be observed in the use of technology and data analytics techniques by law enforcement to surveil and target people believed to be higher security risks, which are often racially biased and rest on existing prejudices about certain communities.

There are a variety of avenues for change, discussed above, that can help prevent these harmful civil rights violations arising from problematic data practices. Federal agencies should enforce civil rights and privacy laws. Congress must ensure that privacy laws include strong civil rights protections and preserve the ability of states to play a vital role in protecting civil rights and consumer privacy. All of these avenues for change, however, must center civil rights perspectives.