EPIC - Electronic Privacy Information Center

Previous Top News: 2016

2016 |
2015 |
2014 |
2013 |
2012 |
2011 |
2010 |
2009 |
2008 |
2007 |
2006 |
2005 |
2004 |
2003 |
2002 |
2001 |
2000 |
1999 |
1998

EPIC Defends Right of Data Breach Victims to Bring Suit. EPIC has filed an amicus brief urging a federal appeals court to overturn a decision that limits the ability of data breach victims to sue. The plaintiffs sued a payroll company after their Social Security Numbers and other identifying information were exposed. A lower court dismissed the case because fraudulent transactions had not yet occurred. EPIC argued that data breach victims can sue without having to wait for specific damages. EPIC cataloged the epidemic of data breaches in the US, and explained why companies should be liable when they fail to protect the consumer data they collect. EPIC regularly files briefs defending consumer privacy. (Apr. 19, 2016)
European Parliament Adopts Comprehensive Data Protection Regulation . The European Parliament finalized a historic reform of EU data protection legislation, which will have legal force in July 2018. "The new General Data Protection Regulation will enable people to regain control of their personal data in the digital age," said Parliament Member Jan Philipp Albrecht. The rules include data breach notification, coordinated enforcement, enhanced penalties, strengthened consent, and new measures to promote privacy innovation. EPIC and EU and US consumer groups have supported the European law, stating that it provides "important new protections for the privacy and security of consumers." (Apr. 14, 2016)
U.S. Government Sued Over Refusal to Notify Users of E-mail Searches. Microsoft has sued the Department of Justice, arguing that orders which prevent the company from notifying users about surveillance are unconstitutional. These secrecy orders, issued in connection with orders to disclose users’ private information, arise in thousands of cases each year. EPIC has supported similar challenges to “gag orders" and has opposed the expansion of “no notice” searches. EPIC has also recommended notice requirements for e-mail searches. (Apr. 14, 2016)
House Moves Forward on Modest ECPA Updates. The House Judiciary Committee has voted 28-0 in favor of the Email Privacy Act, H.R. 699, a bill that would establish a warrant requirement for the disclosure of all electronic communications. The law would also require notice to customers whose communications have been collected. With 314 members of the House cosponsoring, the bill is slated to be considered by the House on April 25th. Senator Leahy, who has sponsored an identical bill in the Senate, said that "Congress has waited far too long to enact these reforms." But the bill stops short of several updates recommended by EPIC, including protections for location data, data minimization requirements, and end-to-end encryption for commercial e-mail services. (Apr. 14, 2016)
EU Officials Call for Changes in Privacy Agreement. European privacy officials announced today that there must be changes in the draft proposal for EU-US data transfers. The Article 29 Working Party has "strong concerns" that the current text fails to provide adequate protection against commercial misuse and bulk surveillance. The Working Party cited the complexity of the redress mechanism, the lack of independence of the ombudsman, as well as the broad uses of personal data that would be permitted under the agreement. Privacy and consumer organizations have urged the EU to oppose the Privacy Shield proposal. (Apr. 13, 2016)
Senate Examines FTC's Antitrust Enforcement. The Senate Judiciary Committee recently examined the scope and application of the FTC's Section 5 antitrust enforcement authority at the hearing "Section 5 and 'Unfair Methods of Competition': Protecting Competition or Increasing Uncertainty?" EPIC Advisory Board member Tim Wu testified in support of the agency's approach, which he called "an important protection for competition." EPIC has urged the FTC to use Section 5 authority to protect consumers, arguing against Google's acquisition of DoubleClick and Facebook's acquisition of WhatsApp. EPIC has also recommended a transparent process for evaluation of substantial changes in business practices by companies subject to FTC consent orders. (Apr. 13, 2016)
EPIC Advises HHS to Safeguard Substance Abuse Patient Records. In comments to the Department of Health and Human Services, EPIC criticized the agency's proposed revisions to confidentiality rules for substance abuse patient records. The proposal would weaken consent requirements for disclosing patient records and allow linkage of substance abuse records to other databases. EPIC explained that patient privacy and public health policy require strong confidentiality protections. EPIC warned that the changes proposed by HHS would compromise record confidentiality and reduce the effectiveness of public health programs. EPIC consistently advocates for strong confidentiality protections for medical records. (Apr. 12, 2016)
President Obama: In Digital Age, People Have New Set of Privacy Expectations. In remarks at the University of Chicago Law School yesterday, President Obama named privacy as one of the constitutional issues that will be increasingly salient in the years to come. "In a society in which so much of your life is digitized, people have a whole new set of privacy expectations that are understandable,” said the President. Obama said the encryption debate was “just the tip of the iceberg of what we’re going to have to figure out.” In its brief in Apple v. FBI, EPIC recently argued that cell phone encryption was adopted to protect consumers from crime. EPIC routinely files amicus briefs in cases that raise novel privacy and civil liberties issues. (Apr. 8, 2016)
EPIC, Coalition Oppose NSA Data Transfer Plan. EPIC and over 30 organizations have urged the Obama Administration to halt proposed changes to Executive Order 12333 that would permit the NSA to transfer raw data collected to law enforcement agencies. The NSA’s vast data collection activities are traditionally limited to intelligence purposes. The proposal will permit use of NSA data by law enforcement and make personal data more widely available across the federal government. Last year, EPIC urged the Privacy and Civil Liberties Oversight Board to increase oversight of 12333. EPIC called for: (1) new limits on data collection and disclosure; (2) audit trails for surveillance activities; and (3) published legal justifications for surveillance programs. The Board is currently reviewing surveillance under EO 12333. (Apr. 8, 2016)
FAA Considers Removing Safety Rules for Small Drones, Also Ignores Privacy Concerns. The report of a secret FAA committee would relax safety rules for drones operating over populated areas. The report also makes no mention of the privacy risks of aerial surveillance by small drones. Like the FAA registration task force, the FAA small drones committee was composed of mostly industry members and did not include any privacy or consumer protection groups. The report recommends allowing drones to fly within 20' above a person or within 10' next to a person. EPIC previously sued the FAA for failing to establish privacy rules for commercial drones. EPIC v. FAA is pending before the D.C. Circuit. EPIC also filed a FOIA lawsuit against the FAA for the records of the secret drone task force meetings. (Apr. 8, 2016)
TACD Opposes "Privacy Shield," Urges Rejection by EU. The Transatlantic Consumer Dialogue has urged the European Commission to reject the "Privacy Shield," a proposal to continue the transatlantic transfer of personal data from Europe to the United States. TACD warned that Privacy Shield "does not adequately protect consumers' fundamental rights to privacy" and that it does not provide "effective and meaningful data protection." European officials are carefully reviewing the proposal. EPIC and a coalition of NGOs have urged the US to adopt a robust data protection law and end 702 surveillance. The TACD is a forum of more than 70 consumer organizations in Europe and the United States. (Apr. 7, 2016)
DHS, Federal Agencies Publish 2016 FOIA Reports. Most federal agencies, including the Department of Homeland Security, have now published the 2016 FOIA Reports. These annual reports, required by former Attorney General Holder's 2009 FOIA Memo, describe each agency's compliance with the FOIA, including steps to taken to improve processing and promote openness. The federal FOIA ombudsman is currently investigating the practices of six DHS component agencies in response to a 2015 letter from EPIC and open government advocates. EPIC and other have recently urged the President to support bipartisan legislation aimed at improving the FOIA. (Apr. 6, 2016)
EPIC Sues Agency for Drone Task Force Meeting Records. EPIC has filed a FOIA lawsuit against the Department of Transportation for records of the closed-door meetings of the "Drone Registration Task Force". The agency created the Task Force late last year to develop recommendations for registering commercial drones. The Task Force--whose membership included no civil liberties organizations or privacy advocates--met in secret last November before releasing a report. EPIC submitted extensive comments to the Task Force. EPIC's lawsuit was filed just after the FAA's Aviation Rulemaking Committee of industry groups and agency officials recommended easing restrictions that prohibit businesses from flying unmanned aerial vehicles. In EPIC v. FAA, EPIC has also challenged the FAA's failure to establish privacy rules for drones. (Apr. 4, 2016)
EPIC to FTC: Google's April Fool's Disaster Likely Violates Consent Order . Google's April Fool's joke — a change in the operation of Gmail without user consent — has backfired, spectacularly. Many Gmail users inadvertently enabled the "Mic Drop" button on important emails, allowing Google to insert a GIF into their reply and then irreversibly mute the conversation. Users were outraged and Google reversed the change. EPIC informed the FTC that Google's prank also likely violates the FTC's 2011 consent order with the company following the rollout of Google Buzz. EPIC has repeatedly urged the FTC to enforce this consent order against Google, which requires the company to obtain "express affirmative consent" before changing its business practices. (Apr. 1, 2016)
FCC Moves Forward With Narrow Privacy Rules. The Federal Communications Commission has voted to adopt a Notice of Proposed Rulemaking on consumer privacy regulations. The proposal follows Chairman Wheeler's earlier draft proposal, which EPIC explained was too limited to safeguard online privacy. During the vote, Commissioner Ajit Pai echoed EPIC's view that the rulemaking should not focus solely on ISPs. EPIC has argued that the FCC proposal ignores invasive practices by Internet firms, including search companies and social media firms that track and profile Internet users. EPIC previously urged the Commission to "address the full range of communications privacy issues facing US consumers" and to apply the Consumer Privacy Bill of Rights to communications data. (Mar. 31, 2016)
EPIC Scrutinizes DHS "Insider Threat" Database. In comments to DHS, EPIC criticized a proposed "Insider Threat" database that would gather vast amounts of personal data on individuals outside the federal agency. EPIC urged DHS to limit the scope of data collection and drop proposed Privacy Act exemptions. Citing the recent surge in government data breaches, including the breach of 21.5 m records at OPM, EPIC warned that DHS data practices pose a risk to federal employees. EPIC has previously advocated for privacy protections in background checks and consistently warned against inaccurate, insecure, and overbroad government databases. (Mar. 29, 2016)
EPIC Names New Advisory Board Members . EPIC has announced the 2016 members of the EPIC Advisory Board. They are Malavika Jayaram, Max Schrems, Katie Shilton, Stephen Vladeck, Anne L. Washington, and Shoshana Zuboff. The EPIC Advisory Board is a distinguished group of experts in law, technology, and public policy, who contribute to EPIC's work on privacy and human rights issues. Joining the Board of Directors of EPIC in 2016 are Danielle Citron, author of "Hate Crimes in Cyberspace." and Frank Pasquale, author of "The Black Box Society: The Secret Algorithms that Control Money and Society." (Mar. 28, 2016)
EPIC Successfully Obtains Boater Tracking Documents, Settles Case with Homeland Security . After successfully obtaining nearly 2,500 pages of documents concerning a controversial boater tracking program, EPIC has settled a Freedom of Information Act lawsuit with the Department of Homeland Security about the "Nationwide Automatic Identification Systems." According to the documents released to EPIC, the DHS believes that boaters have "no expectation of privacy with regard to any information transmitted" about the location of their boats. The documents also reveal that the agency fuses tracking data with other government data to develop detailed profiles on boaters. EPIC did not objet to the use of NAIS for marine safety; the concern is government surveillance. EPIC has also opposed a DHS plan to collect and maintain records on sea travelers. (Mar. 28, 2016)
Ninth Circuit Sends NSA Surveillance Case Back to Lower Court. A Federal Appeals court has remanded a case challenging the NSA's bulk collection of telephone records. In Smith v. Obama, the Ninth Circuit Court of Appeals instructed the lower court to consider the impact of the USA Freedom Act, which ended the bulk data collection program. EPIC, joined by thirty-three technical experts and legal scholars, filed an amicus brief in the case, arguing that modern communications systems are "entirely unlike the telephone network of the 1970s" and that a 1977 case concerning "pen registers" no longer applied. EPIC also challenged the NSA bulk collection program in a petition to the Supreme Court. (Mar. 24, 2016)
FTC Issues Warning on Cross-Device Tracking and Surveillance Apps . The Federal Trade Commission has issued warnings to 12 Android app developers that use audio beacons to track consumers across their devices and monitor TV viewing habits. The smartphone apps contain Silverpush software that constantly listens for inaudible signals emitted by TV commercials and secretly collects and transmits viewing data. The announcement appears to be a response to two earlier complaints filed by EPIC with the Commission. EPIC previously urged the FTC to limit "cross-device tracking" technology that links consumers' smartphone activity with what they see on their laptop or television. EPIC also urged the FTC and the Department of Justice to investigate "always-on" consumer devices for possible violations of the Wiretap Act, state privacy laws, or the FTC Act. (Mar. 22, 2016)
EPIC Urges FCC to Broaden Scope, Substance of Draft Privacy Rules. EPIC has released a memo on the FCC's draft broadband privacy rules, urging the Commission to broaden its scope and strengthen its substantive data protections. The draft rules, previewed in a fact sheet on March 10, 2016, would apply to Internet service providers (ISPs) but not to email, search, or social media services. EPIC explained that the proposal's "framing of the communications privacy challenges facing US consumers is incomplete and fails to address the full range of activities that threaten online privacy." EPIC further explained that the proposal's focus on "choice, transparency and security" will fail to safeguard consumer privacy. EPIC has urged the Commission to apply the Consumer Privacy Bill of Rights to communications data. (Mar. 20, 2016)
EPIC Intervenes in Privacy Case before European Court of Human Rights. Today EPIC filed a brief in a case before the European Court of Human Rights. The case involves a challenge brought by 10 human rights organizations arguing that surveillance by British and U.S. intelligence organizations violated their fundamental rights. In its brief, EPIC explained that the NSA's "technological capacities" enable "wide scale surveillance" and that U.S. statutes do not restrict surveillance of non-U.S. persons abroad. "The NSA collects personal data from around the world and transfer that data without adequate legal protections." EPIC routinely files amicus briefs in federal and state cases that raise novel privacy issues. This is EPIC's first brief for the Court of Human Rights in Strasbourg. (Mar. 18, 2016)
EPIC's Rotenberg Urges European Parliament to Condition "Privacy Shield' on End of 702 Surveillance. Speaking before the European Parliament on "Privacy Shield," Marc Rotenberg outlined several flaws in the proposed EU-US data transfer agreement, including a weak privacy framework, lack of enforcement, and a cumbersome redress mechanism. In the short term, Rotenberg recommended that the EU condition acceptance of the Privacy Shield on the end of the "702 program," which permits bulk surveillance on Europeans by the US. EPIC along with other NGOs has urged the European Commission to rewrite the Privacy Shield, saying it fails to safeguard human rights and does not reflect changes in US law as required by the Schrems decision. (Mar. 17, 2016)
President Obama Nominates Merrick Garland for Supreme Court. The President has nominated D.C. Circuit Chief Judge Merrick Garland for the United States Supreme Court. Garland, a former prosecutor and head of the Department of Justice's Criminal Division, has served on the D.C. Circuit for 15 years. EPIC has previously urged the Senate to hold hearings and explore the views of earlier Supreme Court nominees, including Justice Kagan, Justice Sotomayor, and Chief Justice Roberts. EPIC frequently files amicus briefs in the US Supreme Court, including Spokeo v. Robins and Utah v. Strieff in the current term. (Mar. 16, 2016)
Drone Privacy Safeguards Move Forward in Senate. A Senate committee has adopted several key privacy amendments concerning drone operations in the US. The amendments, sponsored by Senator Markey (D-Mass), limit the scope of drone surveillance and require more accountability for drone operators. Markey stated, "As more and more drones take flight in our skies, the need to protect Americans' privacy is paramount." EPIC urged Congress and the FAA to establish limits on drone surveillance and recommended the FAA establish a database detailing drone surveillance capabilities. EPIC has sued the FAA for its failure to establish commercial drone privacy rules. (Mar. 16, 2016)
NGOs - "Privacy Shield" is Failed Approach for EU-US Data Protection. More than twenty civil society groups has urged European leaders to oppose adoption of the "Privacy Shield" for EU-US data flows. The NGOs state that the political agreement fails to provide sufficient data protection and does not respect the decision of the European Court of Justice in the Schrems case. The groups said the US must make changes in domestic laws and international commitments to comply with the decision and permit transfers of personal data. EPIC has launched "Data Protection 2016" to support stronger privacy safeguards in the US. (Mar. 16, 2016)
Senate Passes FOIA Reform Bill. The Senate has passed by unanimous consent the Freedom of Information Improvement Act of 2015. The bill, cosponsored by Senator Patrick Leahy (D-VT) and Senator John Cornyn (R-TX), requires federal agencies to operate under a "presumption of openness," and places time limits on the FOIA's Exemption 5. Senator Leahy said that the bill "will help open the government to the 300 million Americans it serves and ensure that future administrations place an emphasis on openness and transparency." The House passed a similar bill in January 2016. Differences between the two versions must now be reconciled before President Obama can sign the bill into law. EPIC and a coalition of open government advocates urged the President to support the bipartisan legislation. (Mar. 16, 2016)
Senate to Consider FAA Funding but Drone Privacy Safeguards Missing. On March 16, 2016 the Senate will consider the FAA Reauthorization bill. Senator John Thune introduced the legislation to fund the operations of the the federal agency responsible for aviation safety. The bill requires drone operators to post privacy policies, but provides no meaningful privacy safeguards that would limit surveillance by drone operators. EPIC has urged Congress and the FAA to establish real limits on surveillance by drones. EPIC also recommended that the FAA to establish a national database detailing the surveillance capabilities of commercial drones. And after the agency failed to establish privacy rules mandated by Congress, EPIC filed a lawsuit, EPIC v. FAA that is now pending before the DC Circuit Court of Appeals. (Mar. 14, 2016)
EPIC to Testify before Pennsylvania Senate on Domestic Drone Surveillance. EPIC Domestic Surveillance Project Director Jeramie Scot will testify at a hearing on before the Pennsylvania Senate Majority on "Unmanned Aerial Vehicles." The hearing will address the private and public sector use of drones. In a prepared statement, EPIC’s Scott urges the Pennsylvania Senate to enact legislation to limit both law enforcement and commercial drone surveillance. EPIC states, “The increased use of drones to conduct various forms of surveillance must be accompanied by increased privacy protections.” EPIC previously sued the FAA for failing to establish federal privacy rules for commercial drones. EPIC v. FAA is pending before the D.C. Circuit. (Mar. 14, 2016)
EPIC Publishes 2016 FOIA Gallery. In celebration of Sunshine Week, a national recognition of public access to information, EPIC has unveiled the 2016 FOIA Gallery. Since 2001, EPIC has released annual highlights of EPIC's most significant open government cases. In 2015, EPIC obtained records on e-voting tests from the Department of Defense, a secret EU-US data transfer agreement, and a massive boater tracking program operated by the DHS. In the latest FOIA Gallery, EPIC also highlights the victory in EPIC v. DOJ a FOIA case concerning electronic surveillance reports, EPIC v. NSA about cyber surveillance, and EPIC's role as "friend of the court" in an open government case before the California Supreme Court. (Mar. 11, 2016)
FCC to Consider Privacy Rules for ISPs. The FCC will consider a proposal for consumer privacy regulations on March 31st. According to a fact sheet, the rulemaking will "apply the privacy requirements of the Communications Act" to broadband internet access services (ISPs) but not Internet websites, search services, and social media platforms. While ISPs are engaged in invasive consumer tracking and profiling practices, focusing only on these providers misses a vast amount of data collection activities by other service providers. In a previous letter to the FCC, EPIC urged the Commission to establish a broad framework for communications privacy, based on Fair Information Practices. Separately, EPIC filed a petition with the FCC, joined by 29 organizations, to end the mandatory retention of consumer data. (Mar. 10, 2016)
FCC Reaches Settlement with Verizon over Hidden "Super Cookies". The Federal Communications Commission reached a settlement with Verizon Wireless for its practice of placing hidden, undeletable "super cookies" on customers' smartphones without their knowledge or consent. The settlement requires Verizon to notify its customers of its targeted advertising practices and to obtain opt-in consent before sharing consumer data with third parties. Verizon must also pay a $1.35 million fine. EPIC has recently urged the FCC to undertake a broad rulemaking on communications privacy issues facing consumers, including the invasive and ubiquitous tracking practices of ISPs. EPIC has also urged the Federal Trade Commission to limit the use of persistent identifiers. (Mar. 10, 2016)
New Congressional Report Explores Legal Issues Regarding Compelled Decryption. "Encryption: Selected Legal Issues," a new report from the Congressional Research Service, explores two important legal questions that arise from government requests for compelled decryption: the Fifth Amendment right agains self-incrimination and the scope of the All Writs Act, the federal statute at issue in Apple v. FBI. EPIC filed a "friend of the court" brief, joined by eight other consumer privacy organizations, in support of Apple's challenge in the FBI iPhone case, pointing to the increased risk of cell phone theft and financial fraud that would result from compelled encryption. (Mar. 8, 2016)
EPIC, Consumer Privacy Groups Urge FCC to Protect Consumer Privacy. EPIC, joined by nearly a dozen consumer privacy groups, submitted a letter to the FCC reviewing the invasive consumer tracking and consumer profiling practices of Internet service providers (ISPs), which "underscore the imperative for the FCC to exercise the full extent of its rulemaking authority to protect consumer privacy." The letter explained why encryption and virtual private networks ("VPNs") are insufficient to protect consumers from ISP surveillance. The letter described how the Federal Trade Commission's reactive, "notice and choice" approach to privacy fails to provide meaningful protections for consumers. EPIC previously urged the FCC to undertake a broad rulemaking on "the full range of communications privacy issues facing US consumers." EPIC has worked with the FCC to promote consumer privacy in the communications field for more than 20 years. (Mar. 7, 2016)
DHS Privacy Office Releases 2015 Data Mining Report. The Department of Homeland Security has released the 2015 Annual Data Mining Report. The report describes several of the Agency's profiling systems that assign secret "risk assessments" to U.S. citizens. EPIC recently prevailed in a FOIA case involving a controversial DHS passenger screening program, the "Analytic Framework for Intelligence." In EPIC v. USCG, another case concerning a DHS profiling program, EPIC uncovered records about a program to track boaters operating in US waters in which DHS stated that boaters "have no expectation of privacy." The 2015 DHS report indicates expansion of agency profiling programs, including the "Automated Targeting System." (Mar. 4, 2016)
EPIC Files Brief in Support of Apple and Consumers in FBI iPhone Case. Today EPIC filed a "friend of the court" brief, joined by eight other consumer privacy organizations, in support of Apple's challenge in the FBI iPhone case. In Apple v. FBI, EPIC argued that the "security features in dispute in this case were adopted to protect consumers from crime." EPIC explained that an order to compel Apple to take extraordinary measures to undo these features places at risk millions of cell phone users across the United States. EPIC routinely files amicus briefs in cases that raise novel privacy and civil liberties issues. EPIC has filed two briefs in the United States Supreme Court in the past year in cases concerning consumer privacy and also the Fourth Amendment. (Mar. 3, 2016)
Bill to Establish Digital Security Commission Introduced in House. Rep. Lieu (D-CA) has cosponsored bipartisan legislation to create a Digital Security Commission that will explore how law enforcement should pursue investigations without undermining constitutional privacy protections or American competitiveness. Rep. Lieu emphasized, "strong national security and a strong economy requires strong encryption." The legislation comes as Apple opposes a court order to compromise iPhone security to allow government access. Congressman Lieu called upon "the FBI and DOJ to withdraw their coercive demands of Apple and allow the democratic process to work." In 2015, EPIC gave the Champion of Freedom Award to Apple CEO, Tim Cook, for his work protecting privacy and promoting encryption. (Mar. 2, 2016)
TSA Ignores Federal Court, Public Comments and Mandates Airport Body Scanners. The Transportation Security Administration has issued a final rule on airport body scanners, nearly five years after the D.C. Circuit Court of Appeals ordered the agency to "promptly" solicit public comments on the controversial scanners. In 2011, EPIC successfully challenged the TSA's unlawful deployment of airport body scanners. Despite public comments that overwhelmingly favor less invasive security screenings, the agency will continue to use invasive body scanners at airports. The agency also states that it may mandate airport body scanners. EPIC and 25 organizations have urged Congress to hold a hearing on TSA's decision to end the opt-out for airport body scanners. The agency previously informed the D.C. Circuit that the body scanner program was optional. The Court concluded because "any passenger may opt-out of AIT screening in favor of a patdown" there was no violation of the Fourth Amendment. (Mar. 2, 2016)
Diffie, Hellman Win Turing Award for Public Key Encryption. Whitfield Diffie and Martin Hellman have received the 2016 Turing Award for the discovery of public key encryption, the cornerstone of network security. The award is named for Alan Turing, a computer scientist who helped pioneer modern computing and broke the German Enigma code, hastening the end of the Second World war. The Turing award is considered the Nobel Prize of computer science and is given for major contributions of lasting importance by the Association of Computing Machinery. Diffie, a member of the EPIC Advisory Board, was one of the founders of the Electronic Privacy Information Center and received the EPIC Lifetime Achievement Award in 2012. (Mar. 1, 2016)
EPIC Files Brief in Suit Over Faulty Background Checks. EPIC has filed an amicus brief in Smith v. LexisNexis Screening Solutions. The case was brought by a job applicant who was denied employment after a background report incorrectly stated that he had a criminal record. A court found that LexisNexis had violated Fair Credit Reporting Act by failing to take reasonable steps to ensure "maximum possible accuracy" in the report. LexisNexis appealed. In the amicus brief, EPIC highlighted the industry practice of selling background reports with inaccurate information. EPIC argued that companies should be strictly liable when they fail to maintain accuracy in these reports. In 2005, EPIC filed a famous FTC complaint about the data broker ChoicePoint, which ultimately led to a $10 million dollar settlement. (Mar. 1, 2016)
NY District Court Denies Government Demand to Unlock iPhone. Magistrate Judge Orenstein denied a government request under the All Writs Act to force Apple to unlock an iPhone. Judge Orenstein stated "the government's construction of the [All Writs Act] produces absurd results in application." The ruling comes the day before a Congressional hearing to address recent efforts to force Apple to decrypt iPhones. Apple is opposing a court order in another case that would require the company to make changes to the iPhone to enable government access. In 2015, EPIC gave the Champion of Freedom Award to Apple CEO, Tim Cook, for his work protecting privacy and promoting encryption. (Feb. 29, 2016)
"Privacy Shield" Released, New Questions Raised. The text of the "Privacy Shield" was released today by European Commission and the US Department of Commerce. The arrangement was intended to bring EU-US data transfers in line with the recent decision of the European Court of Justice in the Schrems case. But the framework appears to provide less protection than the Safe Harbor arrangement it replaces. New exceptions take broad categories of personal data entirely outside the scope of the agreement. Max Schrems said "this is far from what the Court required and does not seem like a stable solution." Privacy experts will now assess the text and determine whether it provides an adequate basis for the transfer of personal data. EU and US NGOs have urged the US to update its privacy laws. (Feb. 29, 2016)
NSA to Disclose Agency Records to Other Federal Agencies, Implicating Federal Privacy Act. According to the New York Times, the NSA plans to disclose intercepted private communications to other federal agencies, including records of communications concerning US persons. The substantial change in agency practices "would relax longstanding restrictions on access to the contents of the phone calls and email." In 2013, EPIC and a group of legal scholars and technical experts, petitioned the NSA to undertake a public rule making on "the agency's monitoring and collection of communications traffic within the United States." EPIC has previously urged the Department of Defense to ensure that the NSA complies with the federal Privacy Act and has opposed expansion of the "Operations Records" database. (Feb. 26, 2016)
European Commission Wrongly Denies EPIC's Request For "Privacy Shield". The European Commission has wrongly denied EPIC's Freedom of Information request for the text of the "Privacy Shield." The Commission said the adequacy decision about Safe Harbor is "in preparation" and "negotiations with the U.S. are still ongoing." The Commission confused the text of the political agreement, known as "the Privacy Shield," with a legal determination about whether the agreement meets EU data protection law. EPIC will pursue public release of the Privacy Shield, which was previously announced, and then the release of the adequacy determination when it is final. EU and US Consumer and privacy organizations have opposed the agreement because it fails to provide adequate privacy protections. (Feb. 26, 2016)
Apple Opposes FBI Decryption Order. Today Apple filed a "motion to vacate" a court order that would require the company to make changes to the iPhone to enable law enforcement access to personal information. In its brief, Apple asserts that this case is about "the ability to force companies like Apple to undermine the basic security and privacy interests of hundreds of millions of individuals around the globe." Apple argued that the FBI's requested court order violates the First and Fifth Amendments. Consumer Reports found that more than 3.1 million cellphones were stolen in 2013, and noted that "efforts by the telecom industry to reduce thefts don't seem to be helping matters." In 2015, EPIC gave the Champion of Freedom Award to Apple CEO, Tim Cook, for his work protecting privacy and promoting encryption. (Feb. 25, 2016)
House Members Seek Answers on FBI Stingray Agreements. Two leading members of the House Judiciary Committee sent a letter to FBI Director James Comey regarding Stingray surveillance devices, which intercept cellphone communications. Representative Jim Sensenbrenner (R-Wisc) and Representative Sheila Jackson Lee (D-Tx) sharply criticized the FBI's use of "non disclosure agreements" that prohibit local law enforcement agencies from discussing the use of Stingrays, even in court proceedings. The representatives noted that such secrecy "shields the technology from debate." They asked the FBI to answer specific questions about the agreements. In 2013, EPIC first uncovered these secret Stingray agreements in a Freedom of Information Act suit against the FBI. (Feb. 25, 2016)
Writers Side with Apple in Encryption Fight with FBI. In a letter to the Attorney General, leading writers and artists protested the FBI's "efforts to force Apple to create software that could effectively enable the U.S. government to unlock any iPhone." The letter from the PEN America Center highlights how "intrusions on privacy damage creative expression and free speech." EPIC has long supported strong encryption as key to the future of privacy and security. EPIC recently gave the 2015 Champion of Freedom Award to Apple CEO Tim Cook for his work in promoting encryption and protecting privacy and security. The 2016 EPIC Awards dinner will be held on June 6th in Washington, DC. (Feb. 24, 2016)
EPIC FOIA - Information about Controversial DNA Forensic Technique Released. In response to EPIC's FOIA request, the California Department of Justice has released records on a controversial forensic technique. The records show that in 2014, the state agency spent more than $300,000 on STRMix, a secret technique for matching DNA. Investigators in Australia subsequently found an error in the STRMix code that produced incorrect results in 60 criminal cases, including a high-profile murder case. STRMix promises prosecutors the ability to "[c]arry out familial searches against a database, searching for close relatives of contributors to mixed DNA profiles" but the algorithm remains secret. EPIC is pursuing FOIA requests on the secret DNA matching algorithms with state agencies across the U.S. (Feb. 23, 2016)
EPIC Recommends Greater Accountability for Government Screening Database. EPIC submitted comments to DHS urging the agency to improve transparency and privacy protections for the controversial Terrorist Screening Database that is used for Watchlist programs, such as the No Fly List, containing information that is often inaccurate and incomplete. The agency solicited comments on a proposal to remove Privacy Act safeguards while simultaneously expanding data collection and distributing data more widely across the DHS. EPIC and many other organization opposed the establishment of the Screening Database and called for the suspension pending a full review of the privacy and security implications. EPIC has testified before Congress about the risks of the Watchlist program. (Feb. 23, 2016)
President Announces $19 billion Cybersecurity Plan. President Obama has proposed a $19 billion Cybersecurity National Action Plan that aims to modernize government IT and improve Americans' cybersecurity. The government will reduce reliance on social security numbers and promote increased use of multi-factor authentication. The plan will also establish a Commission on Enhancing National Cybersecurity. A Federal Privacy Council will coordinate federal privacy guidelines but lacks authority to enforce Privacy Act obligations. EPIC has repeatedly urged federal agencies to uphold Privacy Act protections. (Feb. 23, 2016)
Supreme Court to Consider Fourth Amendment ID-Check Case. The Supreme Court will hear arguments today in Utah v. Strieff. At issue is the use of evidence obtained from government databases following an illegal police stop. In a brief signed by twenty-one technical experts and legal scholars, EPIC warned about the vast amount of personal data, much of it inaccurate, stored in government databases and pointed to the failure of the Justice Department to enforce Privacy Act safeguards. EPIC argued that "a diminished Fourth Amendment standard coupled with a weakened Privacy Act is truly a recipe for a loss of liberty in America." EPIC had filed amicus briefs in several related Supreme Court cases, including Hiibel v. Sixth Judicial District, Tolentino v. New York, and Herring v. U.S.. (Feb. 22, 2016)
California AG Releases 2016 Data Breach Report, Retail and Financial Sectors Most Vulnerable. A new report from California Attorney General Kamala Harris examines data breaches in California from 2012 to 2015. There were 657 data breaches during the last four years, which compromised over 49 million records. The retail sector experienced the largest share of breaches at 25%, followed by the financial sector at 18%. Among several recommendations, the report recommends that organizations adopt strong encryption. "Government and the private sector have a shared responsibility to safeguard consumers from threats to their privacy, finances, and personal security," Attorney General Harris stated. The Attorney General received a 2015 EPIC Champion of Freedom Award. EPIC recently launched "Data Protection 2016," a non-partisan campaign to make data protection an issue in the 2016 election. (Feb. 18, 2016)
Apple Opposes FBI Decryption Order. Apple has opposed a court order that would require the company to make changes to the iPhone to enable law enforcement access to personal information. The order followed an FBI application under the All Writs Act, a law from 1789. Apple CEO Tim Cook wrote in response that the government's action "would undermine the very freedoms and liberty our government is meant to protect." In 2015, EPIC gave the Champion of Freedom Award to Mr. Cook for his work protecting privacy and promoting encryption. The EPIC 2016 Awards dinner will be held June 6 in Washington, DC. (Feb. 17, 2016)
EPIC Prevails in Passenger Screening Lawsuit Against DHS. EPIC has prevailed in EPIC v. DHS, a case involving a controversial passenger screening program operated by Customs and Border Protection. The agency combines detailed personal information with secret algorithms to assign "risk assessments" to travelers, including US citizens. EPIC sued the DHS and argued that the agency unlawfully withheld records under the Freedom of Information Act. Today, a federal judge concluded that EPIC "has the more convincing argument" and that the agency failed to disclose information about the "Analytic Framework for Intelligence" program. (Feb. 17, 2016)
"Judicial Redress Act" Provides Little Redress. The Judicial Redress Act of 2015, enacted by Congress and now on to the President for signature, fails to extend Privacy Act protections to non-U.S. citizens. EPIC previously recommended changes to protect transborder data flows. The bill, as adopted, coerces European countries to transfer data to the US, even without adequate protection, or be denied legal rights. Congress adopted the narrow amendment to the Privacy Act without any changes to benefit U.S. citizens even after a data breach compromised 21.5 records maintained by the Office of Personnel Management. EPIC explained that the OPM breach made clear the need for updates to the federal privacy law. (Feb. 12, 2016)
Google Concedes "Right to be Forgotten" Applies Worldwide. After waging an unproductive battle against the privacy rights of Internet users, Google will finally remove links to sensitive personal information. Google had challenged the legal authority of the Spanish people to protect their personal information, but lost the case Google v. Spain before the top court in Europe. Google then claimed that the links to personal data should only be removed in the country where the Internet user resided. Privacy experts said Google's position made no sense for the "global Internet." The French data protection agency threatened Google with sanctions. Google again fought back, claiming it did not need to comply with decision of the Court of Justice of the European Union. Now the company has decided to comply with the law. (Feb. 11, 2016)
Department of Commerce: Privacy Shield "does not exist". As a response to EPIC's Freedom of Information request for the "Privacy Shield," the Commerce Department responded that "the record you requested does not exist." EU and US officials celebrated earlier this month that the EU and the US reached an agreement for transatlantic data transfers but they did not make the agreement public. Apparently there was nothing to make public since the agreement does not exist. The EPIC FOIA request is designated DOC-ITA-2016-000577. (Feb. 10, 2016)
EPIC to Argue before Federal Appeals Court for Drone Privacy Rules. EPIC President Marc Rotenberg will argue EPIC v. FAA before the D.C. Circuit Court of Appeals on February 10, 2016. EPIC, joined by more than 100 groups and experts, petitioned the agency to conduct a public rule-making on the privacy impact of increased drone deployment in the United States. The FAA acknowledged the importance of privacy and responded in November 2014 that it would undertake the rulemaking. But in early 2015, the agency reversed course and announced it would not establish privacy safeguards for commercial drones. As of February 5, 2016, the agency has granted more than 3,300 waivers to drone operators who lack certification to demonstrate airworthiness. (Feb. 9, 2016)
Hackers Breach US Government Database, No Recourse for Non-Americans. Less than a week after the European and US governments struck a deal for a framework to permit transborder data flows of personal data, hackers breached sensitive personal data at the US Department of Homeland Security. The DHS stores vast amounts of personal information on non-US persons, including detailed travel information. Under current law, non-US persons have no legal rights when federal agencies fail to safeguard their personal data. EPIC is seeking release of the so-called "Privacy Shield" and has launched a new campaign to promote Data Protection in the United States. (Feb. 9, 2016)
EPIC Launches "Data Protection 2016" to Make Privacy a Campaign Issue. Noting widespread concern about the state of privacy in America, EPIC has launched "Data Protection 2016," a non-partisan campaign to make data protection an issue in the 2016 election. EPIC President Marc Rotenberg said, "Data breaches, identity theft, and government surveillance are critical issues facing American voters, yet the candidates have said hardly a word." Security expert Bruce Schneier said, "Privacy is a critical issue that touches many aspects of Americans' lives. The Presidential candidates need to have a plan to protect our personal information." DataProtection2016 shows widespread support for stronger privacy protections in the United States. Campaign materials, including buttons and stickers, are available. Donations will support the work of EPIC. (Feb. 7, 2016)
Court Orders DOJ to Justify Withholding of FISA Reports in EPIC FOIA Suit. A federal court in Washington, DC ruled today that the Justice Department's explanation for withholding information about the Foreign Intelligence Surveillance Court was "manifestly insufficient." In EPIC v. Department of Justice, EPIC is seeking release of FISA surveillance reports routinely provided to Congress. The court ordered the government to submit the reports for review, and to provide specific reasons for withholding the material sought by EPIC. For almost 20 years, EPIC has made available information about FISC orders and surveillance reports. As EPIC explained to the court, release of these materials is of the "utmost importance to the public." (Feb. 4, 2016)
EPIC Seeks Release of "Privacy Shield," Secret Data Transfer Agreement. EPIC has filed emergency Freedom of Information requests with the US and the EU for release of a secret agreement for the transfer of personal data across the Atlantic. A new framework was required by a recent decision of the European Court of Justice. But European and American consumer organizations say the "Privacy Shield" does not provide adequate protection for the transfer of personal data. EPIC stated, “The public has a right to know whether this agreement provides adequate legal protection.” EPIC previously obtained the secret EU-US Umbrella Agreement in FOIA litigation. (Feb. 4, 2016)
Privacy Commissioners to Review "Privacy Shield". The Article 29 Working Party, the association of European Data Protection Commissioners, has said it will review the adequacy of the "Privacy Shield" proposal for transborder data flows. The Working Party said there must be (1) clear and precise rules, (2) a "necessary and proportionate" standard for data collection and access, (3) independent oversight, and (4) effective remedies for the individual. The Working Party also said it must first receive the relevant documents to assess the legal force of the arrangement and whether it will resolve "wider concerns raised by the Schrems judgement." (Feb. 3, 2016)
Anticipating Annulment, EU-US Negotiators Sign Off on "Privacy Shield". Disregarding a decision of the European Court of Justice, negotiators for the US Commerce Dept., the FTC, and the European Commission have agreed to allow the continued transfer of consumer data without adequate legal protection. A virtually identical arrangement was recently struck down by the Court in the Schrems case as a violation of multiple rights of Europeans, including rights to privacy, data protection, and effective redress. Consumers in the US have also expressed concern about rising levels of data breach, identity theft, and financial fraud. EPIC and many EU and US consumer organizations urged negotiators to establish strong safeguards for the transfer of personal data. (Feb. 2, 2016)
EPIC Urges Supreme Court to Uphold Fourth Amendment Safeguards for Police Stops . EPIC has filed a "friend-of-the-court" brief in Utah v. Strieff, a U.S. Supreme Court case about whether the Fourth Amendment allows evidence to be admitted after an illegal stop. Mr. Strieff was unlawfully detained by an officer, who checked his ID and then arrested him on an unrelated outstanding warrant. In a brief, signed by twenty-one technical experts and legal scholars, EPIC detailed a number of sweeping government databases that contain inaccurate and detailed records about Americans' noncriminal activity. EPIC argued that "a diminished Fourth Amendment standard coupled with a weakened Privacy Act is truly a recipe for a loss of liberty in America." EPIC previously argued against compelled identification during police stops in Hiibel v. Sixth Judicial District and Tolentino v. New York. (Jan. 29, 2016)
Schrems Responds to US Lobby Groups on Safe Harbor. In a brief but clearly argued letter to European data protection authorities, Max Schrems writes that "attempts by lobby groups and the US government to 'reinterpret' or 'overturn the clear judgement of the Union's highest court are fundamentally flawed." Schrems brought the successful case to the European Court of Justice that struck down the Safe Harbor arrangement. The Schrems letter, released on International Data Protection Day, also states that a new transfer agreement must provide "protection against government surveillance and "essentially equivalent" protection against the commercial use of data by certified companies." Max Schrems received the 2013 EPIC Champion of Freedom Award. (Jan. 29, 2016)
"Clock is ticking" on Safe Harbor, says European Consumer Organization. BEUC, the consumer organization of the European Union, has urged European policy makers to accept a revised Safe Harbor arrangement only if it complies with the Schrems decision and "guarantees that EU citizens' fundamental rights are upheld when their data is exported to the United States." Last year, 40 consumer privacy organizations in Europe and the United States urged US Secretary Pritzker and EU Commissioner Jourova to take specific steps to close the widening EU-US data divide. Secretary Pritzker has been unwilling to meet with consumer organizations. (Jan. 29, 2016)
EPIC Celebrates International Privacy Day. EPIC celebrates January 28, International Privacy Day, which commemorates the signing of Convention 108, on January 28, 1981. The Privacy Convention was the first binding international treaty for privacy and data protection. EPIC and consumer organizations have called on the United States to ratify Convention 108. NGOs and Privacy experts have also expressed support for the Madrid Declaration, a substantial document that reaffirms international instruments for privacy protection, identifies new challenges, and calls for concrete actions. (Jan. 28, 2016)
EPIC Gives 2016 Freedom Award to Viviane Reding. EPIC has awarded the 2016 International Champion of Freedom Award to former EU Justice Minister Viviane Reding. Ms. Reding led the effort in the European Common for adoption of the new European privacy law, the General Data Protection Regulation. The EPIC awards was presented at the annual conference on L3Computers Privacy and Data Protection in Brussels. The US EPIC Champion of Freedom Awards will be presented on June 6, 2016 in Washington, DC. (Jan. 28, 2016)
U.S. Law Firm Argues U.S. Privacy Law "Essentially Equivalent". A recent report from a U.S. law firm concludes that the United States offers essentially equivalent privacy protection to Europe. The report also finds that "This body of laws ensures that government access to data for law-enforcement and intelligence purposes is limited to what is necessary and proportionate." Of course, all travel records of Europeans are routinely transferred to the U.S. Department of Homeland Security without any legal protection. Under Section 702 of the Patriot Act, the US government routinely obtains vast amounts of personal data on non-US persons, including communications logs and website activity. Executive Order 12333 provides even broader surveillance authorities. (Jan. 27, 2016)
Pew Survey: Americans Unhappy with How Personal Data is Used by Companies. According to the recent survey of the Pew Research Center, Americans are cautious about disclosing personal data in commercial settings. They are also frequently unhappy with how companies use their data afterwards. For example, 55% of adults said it would be unacceptable for a "smart thermostat" to track their movements around their home in exchange for a discount on their energy bill. And a majority said it would not be acceptable for a car insurance company to monitor a driver's speed and location in exchange for safe driving discounts. EPIC had urged the Federal Trade Commission to investigate Google's acquisition of Nest and has a complaint pending before the FTC regarding "always on" devices. (Jan. 26, 2016)
EPIC and Consumer Privacy Groups File Brief Supporting FCC in Telephone Privacy Case. EPIC and six consumer privacy organizations have filed a "friend-of-the-court" brief in support of the Federal Communications Commission in ACA International v. FCC. The case was brought against the FCC by industry groups charged with violating the Telephone Consumer Protection Act. The FCC had made clear that companies cannot make automated or prerecorded calls to consumers without their consent. EPIC argued in its brief that widespread adoption of cell phones "has amplified the nuisance and privacy invasion caused by unwanted calls and text messages." EPIC and the consumer organizations urged the federal court to uphold the FCC order safeguarding consumers. (Jan. 25, 2016)
EPIC v. DOJ: EPIC Prevails, DOJ Releases Secret EU-US Umbrella Agreement. After months of delay, the Department of Justice has finally released to EPIC the full text of the EU-US Umbrella Agreement. EPIC sued the DOJ last year after the agency failed to act on EPIC's FOIA request for the secret agreement. Today's release comes on the heels of EPIC's opposition to the agency's attempt to further delay the Agreement's release. The Umbrella Agreement outlines data transfers between EU and US law enforcement agencies, and is the basis for the Judicial Redress Act currently before Congress. EPIC has criticized the legislation, and recently urged the Senate to delay action on the bill until the DOJ releases the Umbrella Agreement and the Judiciary Committee holds a hearing on the legislation. (Jan. 25, 2016)
EPIC Seeks to Intervene in Privacy Case Before European Court of Human Rights. EPIC has asked the European Court of Human Rights for permission to submit an amicus brief in a case concerning mass surveillance. Ten international human rights NGOs brought the case to challenge UK surveillance laws and practices. The case concerns Tempora, PRISM, and Upstream programs, and the interception of communications by UK intelligence services and the National Security Agency. EPIC proposes to assist the Court in understanding U.S. surveillance law, and to provide relevant information EPIC has obtained through freedom of information litigation. EPIC routinely files amicus briefs in cases concerning emerging privacy and civil liberties issues. (Jan. 22, 2016)
Supreme Court Rules Settlement Offers Can't Moot Consumer Class Actions. The Supreme Court has ruled that a company cannot terminate class action litigation by strategically making a settlement offer of full relief to individual plaintiffs. The case, Campbell-Ewald Co. v. Gomez, involved a consumer who refused to drop his Telephone Consumer Protection Act lawsuit in exchange for such an offer. The defendant company argued that the offer, which exceeded the statutory damages under the TCPA, mooted his case. The Justices disagreed, ruling 6-3 that "an unaccepted settlement offer has no force. Like other unaccepted contract offers, it creates no lasting right or obligation." EPIC routinely works to protect consumer privacy interests in class action settlements. (Jan. 20, 2016)
EPIC Urges FCC to Establish Communications Privacy Protections for Consumers. EPIC has submitted a letter to the Federal Communications Commission urging the agency to undertake a rulemaking to protect the communications privacy of consumers. EPIC asked the FCC to explore "the full range of communications privacy issues facing US consumers." EPIC proposed that the FCC implement Fair Information Practices and the Consumer Privacy Bill of Rights; adopt data minimization requirements; promote Privacy-Enhancing Technologies; and require opt-in consent for the use or disclosure of consumer data. EPIC suggested that the FCC model its communications privacy rules on the Code of Fair Information Practices for the National Information Infrastructure. EPIC has worked with the FCC to promote consumer privacy in the communications field for more than 20 years. (Jan. 20, 2016)
Senator Franken Presses Google on Student Privacy. Senator Al Franken (D-MN) asked Google to explain what the company does with student data, including: what types of data Google collects, to whom Google discloses student information, and whether students and schools “have control over what data is being collected and how the data are being used?” Senator Franken stated, “I believe Americans have a fundamental right to privacy, and that right includes a student or parent’s access to information about what data are being collected about them and how the data are being used.” EPIC has called for a Student Privacy Bill of Rights, an enforceable student privacy and data security framework. (Jan. 16, 2016)
EPIC Urges Senate to Postpone Action on Judicial Redress Act . Today EPIC urged the Senate Judiciary Committee to postpone action on the Judicial Redress Act until the Department of Justice releases a secret data transfer agreement on which the bill is based. The so-called Umbrella Agreement outlines data transfers between law enforcement agencies in Europe and the United States. EPIC has sued the DOJ for release of the document. EPIC also urged the Senate Committee to conduct a public hearing on Privacy Act modernization following the massive data breach at the office of Personnel and Management.EPIC previously wrote to the House Judiciary Committee to recommend updates to the Privacy Act. (Jan. 16, 2016)
EPIC Urges FAA to Make Drone Surveillance Capabilities Public. In comments to the FAA, EPIC urged the agency to make public the surveillance capabilities of drones operated in the United Staes. EPIC also proposed privacy safeguards for personal information. EPIC stated, "It is not the personal information of the drone registrant that should be readily available to the public, but the technical capabilities of the registered drone." The FAA recently published a rule requiring drone registration, which EPIC supported. EPIC previously sued the FAA for failing to establish privacy rules for commercial drones. EPIC v. FAA is pending before the D.C. Circuit Court of Appeals. (Jan. 15, 2016)
Court Upholds Facebook Settlement, Allows Continued Use of Kids' Images in Ads . A federal appeals court has upheld a 2013 settlement agreement in Fraley v. Facebook, a consumer privacy class action involving Facebook's use of young children's names and images for advertising without consent. That practice is currently prohibited in seven states. Questions were also raised about the cy pres determinations. In dissent, Judge Bea stated that the "district court abused its discretion in approving the final settlement." In an amicus brief to the Ninth Circuit, EPIC urged the appeals court to overturn the deal, explaining that the settlement is unfair to class members and authorizes continued privacy violations. In 2010, EPIC and a coalition of consumer privacy organizations filed an extensive complaint with the Federal Trade Commission that eventually required Facebook to improve its privacy practices. (Jan. 14, 2016)
EPIC, Coalition Call for Congressional Hearings on Unlawful TSA Mandate for Body Scanners. EPIC and 25 organizations have urged Congress to hold a hearing on TSA's decision to end the opt-out for airport body scanners. Dozens of organizations petitioned the DHS secretary in 2010 to solicit public comments on the original program. In EPIC v. DHS the lawsuit that followed, the D.C. Circuit ruled that TSA violated federal law when it installed body scanners in airports without public comment. The agency said at the time that the body scanner program was optional. The Court also concluded because "any passenger may opt-out of AIT screening in favor of a patdown" there was no violation of the Fourth Amendment. (Jan. 13, 2016)
Amid Criticism of Agency Compliance, House Passes Substantial FOIA Reforms. Congress has passed the FOIA Oversight and Implementation Act, H.R. 653, which would limit exemptions that allow agencies to withhold public records, create an online portal for FOIA requests, and require agencies to post frequently requested documents. Open government advocates and members of Congress have criticized federal agencies for lax compliance with the Freedom of Information Act. The House Oversight Committee concluded that "[e]xcessive delays and redactions" have undermined the Act." The FOIA Ombudsman criticized the Transportation Security Administration for its "weak management" and lack of a "FOIA tracking system." EPIC has pursued many FOIA cases. EPIC and a coalition previously urged President Obama to strengthen the FOIA by committing to a "presumption of openness" and narrowing the use of FOIA exemptions. (Jan. 11, 2016)
Supreme Court Denies EPIC's Petition to Obtain Cellphone Shutdown Policy. Today, the U.S. Supreme Court declined to review EPIC v. DHS, concerning the government's cellphone shutdown policy. EPIC had pursued the secret policyafter government officials disabled cellular service at a BART station in San Francisco during a peaceful protest. A district court in Washington, D.C. ruled in EPIC's favor when the DHS sought to withhold the policy, but the court of appeals later overturned the ruling. EPIC urged the Supreme Court to review the case to resolve a conflict between the D.C. Circuit and the Second Circuit Courts of Appeals. EPIC also pointed to competing public safety interests when cell service is disabled, but the Court declined. Despite today's order, EPIC successfully obtained a redacted version of the shutdown policy. (Jan. 11, 2016)
Uber, New York AG Reach Settlement Over Rider Data Privacy Practices . The New York Attorney General’s office has announced a settlement in its investigation of Uber’s collection and misuse of rider locational data, as well as its failure to provide timely notice of a data breach affecting 50,000 Uber drivers. The investigation was prompted by public outcry over Uber’s “God View” tool that allowed Uber employees to obtain a specific rider’s real-time and historic location data without permission. The settlement requires the Uber to encrypt rider locational data and enhance its data security. EPIC previously filed a complaint with the FTC, charging that Uber’s plan to track users and gather contact details is an unlawful and deceptive trade practice. In the Huffington Post, EPIC also recommended privacy law to regulate Uber and other companies in the ride-sharing industry. (Jan. 7, 2016)
EPIC Urges HHS to Protect Privacy of Human Research Subjects. In comments to the Department of Health and Human Services, EPIC pointed out several flaws in proposed revisions to the "Common Rule," ethical rules regarding biomedical and behavioral research involving human subjects. While EPIC supports the agency's proposals to strengthen requirements for informed consent and to adopt a broad definition of Personally Identifiable Information, many of the proposed changes "place research interests ahead of the privacy interests" and fail to address the risks to human subjects of "Big Data" research. EPIC previously expressed concern about proposed changes to the Common Rule and continually advocates for health privacy rights. (Jan. 7, 2016)
DHS Releases Drone Privacy Best Practices. The Department of Homeland Security has released a set of drone privacy best practices. The best practices reflect many of the recommendations made by EPIC in testimony to Congress, including limiting data collection, use, dissemination, and retention. The recommendations also propose a redress program so individuals can challenge inappropriate collection. The best practices are only guidelines, but a Presidential Memorandum on drones and privacy requires that all federal agencies to establish and publish drone privacy procedures by February 2016. EPIC has sued the Federal Aviation Administration, EPIC v. FAA to establish privacy rules for commercial drones. Oral arguments are scheduled before the D.C. Circuit Court of Appeals on February 10. (Jan. 6, 2016)
EPIC Warns Education Department of Research Database Privacy Risks. In comments to the Education Department, EPIC objected to the Department's recent proposal to gather detailed student information. The Department plans to collect student data, including discipline records, to assess "data-driven instruction professional development." The Department also proposes to disclose the data to private contractors. EPIC suggested that the agency use aggregate data instead of students' personally identifiable information so as to reduce the risk that might result from a data breach. EPIC noted that the agency's Inspector General recently found that "information systems continue to be vulnerable to serious security threats." EPIC has called for a Student Privacy Bill of Rights, an enforceable privacy and data security framework. (Jan. 6, 2016)
EPIC Seeks Default Judgment in Umbrella Agreement Lawsuit . In its fight to obtain a copy of the EU-US Umbrella Agreement, EPIC asked a federal court in Washington, D.C. today to grant default judgment against the Department of Justice. EPIC sued the agency to obtain the secret agreement, which concerns the transfer of personal information between the EU and US. After the DOJ failed to answer EPIC's complaint, the court entered default against the agency. The Agreement is central to pending legislation, which the Senate Judiciary Committee is set to debate this month yet the DOJ has not made the document available to the public or to Members of Congress. (Jan. 6, 2016)
EPIC Opposes Sea Traveller Surveillance Program. In comments to the DHS, EPIC criticized a proposal to collect detailed records on people traveling by boat. The DHS is planning to track people arriving and departing the United States by sea, including between ports within the United States. However, DHS will ignore Privacy Act protections, and make the data collected routinely available to private companies and foreign governments. The proposal, explained EPIC, would "create a massive government database of detailed personal information that lacks accountability." EPIC has opposed other boat surveillance programs. And a FOIA case pursued by EPIC about a controversial boater tracking program revealed that the DHS fuses tracking data with other intelligence data to develop detailed profiles on boaters. (Jan. 4, 2016)