We Deserve Transparency And Accountability From COVID Tracing Apps, And Sen. Kevin Thomas Of New York Wants To Make That Happen

It has become a matter of life and death that we discover ways to monitor and mitigate the impact of COVID-19 globally. This argument is undeniable, but the tactics as to how to make it happen are still up for debate. The problem, as Brittany Kaiser, Co-Founder of the Own Your Data Foundation and author of Targeted, laid out last week in an interview with Bloomberg is that “many of the big companies and governments that are implementing contact tracing apps don’t have a great history of respecting data protection and privacy.” Yet they are moving forward, full steam ahead, without changing any of their policies in regards to how data should be recognized or respected as a private asset of the individual creating it.

Many may say that we do have privacy legislation that has been put into place, and they wouldn’t be entirely wrong. Since the GDPR in 2018 we’ve seen an abundance of privacy legislation argued, proposed, and put into law across the world. Although these new laws represent progress, every piece of legislation fails to resolve two major fundamental aspects—accessibility and accountability. New York State Senator Kevin Thomas wants to be the first in the world to change that.

It’s Time To Make Privacy Rights Accessible And Hold Companies Accountable

Modern data policies have taken great strides toward protecting consumer data on a contractual basis. However, the assumption underlying these policies is that the general public is literate enough, both in the traditional and technological sense, to read, understand and act on long, dense legislative acts, technical manuscripts, and corporate policies. If not, consumers are forced to have blind faith in the people behind the curtain. This is where privacy legislation fails and consumer trust breaks down.

Although necessary, enhanced back-end security, legislative orders, and contractual obligations do little to increase consumer trust or technical comprehension. This is because the consumer experience of privacy is not written in law, policy, or code, it is engaged with at the device level—through an interface that the consumer interacts with on a day-to-day basis. It is here that the consumer has the opportunity to understand and engage with their rights. This is also where trust can be built.

The Importance Of Accessibility And Accountability In Privacy Legislation

Brittany Kaiser finished her Bloomberg interview by declaring how important it is that we “make sure citizens are informed and aware of what these apps are and what they’re capable of.” Unfortunately, as previously mentioned, there isn’t a single piece of privacy legislation in the world that considers accessibility. And without accessible notices how are people supposed to hold companies accountable? The answer is that we can’t.

This happens for multiple reasons but the two biggest are that 1) companies have no financial incentive to show consumers how much they’re being taken advantage of, and 2) legislators are just beginning to wrap their heads around the complexity of the internet themselves, despite it playing a major role in society for more than two decades now. The bill proposed by Senator Thomas would change this.

Bill #4884A starts by aligning with the best aspects of other legislative acts across the world, legally mandating strictly defined access rights and prohibited use cases, as well as term and purpose limitations. The bill covers all of the seven basic rights we’ve seen in other jurisdictions:

1. The Right to Opt-Out
2. The Right to Access
3. The Right to Rectification
4. The Right to Deletion
5. The Right to Portability
6. The Right to Restrict Processing
7. The Right to Dispute Automated Decision Making

These are all points that must remain fundamental to any privacy legislation proposed moving forward. However, unlike other legislation around the world, Senator Thomas’ bill doesn’t stop there.

The biggest idea proposed in the entire bill is that all policies should be summarized at a 4th-grade reading level.

Why is this so important? Because the average American reads at somewhere near an 8th-grade reading level. The New York Times and other major publications are often written at a 5th to 8th-grade reading level. Yet the average privacy policy on the internet reads at a post-graduate reading level. That means that even if the average person had a desire to dig into what’s going on and protect themselves, they wouldn’t be able to comprehend it without the help of a lawyer. Moreover, the internet is overwhelmed with children, none of whom are anywhere near capable of understanding the dangers of what they’re getting into.

Without the ability to comprehend what’s written in any given policy all other Rights become superficial band-aids that legislators have put into place just to pacify their critics. Senator Thomas is the first in the world to recognize that this needs to change. What Senator Thomas’ bill has done, whether intentional or not, is introduce what should become the 8th fundamental Right for all privacy legislation moving forward: the Right to Understand.

If passed, this would be the first bill in the world to give consumers an honest opportunity to act on their rights. Whether the consumer acts or not is their choice but never before has such a noble idea been proposed, despite its simplicity.

Additionally, Senator Thomas has added much thicker demands for transparency. The bill would require data protection audits that include an assessment of the potential for harm and how said harms will be mitigated, documentation of technical specifications so post-hoc impacts can be traced back to their origins, as well as a description of the training data, among other things, to hold companies accountable. Taking it one step further, Senator Thomas also wants these audits to be made public.

This bill would mark the first time in internet history that consumers have documentation that is both detailed enough to allow for public scrutiny and accessible enough to read. In short, Senator Thomas’ proposal would be the first to open up the black box we’ve all be waiting to see inside of. All of this paired with sizable pecuniary obligations in the event of a breach of the law makes this bill the first in the world to recognize that data protections need to made for humans, not just lawyers and machines. 

A Healthier Relationship with Data and a Better Future For Internet Privacy

There’s no doubt that we need to figure out a better, more efficient way to track COVID-19, and that the solution will most likely be digital. If done ethically, with consumer privacy in mind, I’m confident a large percentage of the population would willfully opt-in to the system to avoid the pain we’re going through in a world of unknowns.

However, I’m also quite certain that none of us want to be on the receiving end of a system of privacy invasion gone astray. Avoiding that will require radical changes in policy, and New York’s COVID tracing legislation, as proposed by Senator Kevin Thomas, might just be the bill that ignites that flame.

It’s time we move our world toward a safer, healthier relationship with data, the internet, and our basic right to privacy. Here’s how you can help:

1. If you’re not living in New York, forward this article to anyone you know who might have the ability and/or passion to help.
2. If you support the bill, write a memorandum of support and submit to anyone at the Internet & Technology Committee in New York.
3. Call your representatives using this contact list.
4. Write an article about the bill and your opinion about it.
5. Share the bill, this article, or whatever you create with online forums and groups you’re a part of.
6. Tweet about it and tag representatives using this contact list.
7. Use the language to influence your work and/or build upon. It may not be perfect, but it is a great legal floor to start with.

For more details about Bill #8448A, read the full text here (only 6 pages)