Google Responds Promptly to ECJ Ruling on “Right to Be Forgotten”

In a move “welcomed” by privacy advocates, Google today released a web form that allows Europeans to request removal of links to Internet contents that allegedly violate the individuals’ “right to be forgotten.”  The form reflects part of Google’s response to the May 13 landmark rulingfrom the European Court of Justice (ECJ) holding that Google can be forced to remove certain search results if they link to Web pages that contain information infringing the privacy of EU citizens.

Google has said it will “assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information.”  Reflecting the ECJ ruling, Google indicated that its evaluation will include looking at whether the search results include “outdated information” about the individual, as well as if there is a “public interest” in the information.  Google said that public interest could be demonstrated by the information relating to financial scams, professional malpractice, criminal convictions, or public conduct of government officials.

If a request appears valid, it is expected that Google will remove the link from search results pages and post a notice that indicates the request was made, as it does for copyright takedown requests.

Requesting individuals will need to provide proof of their identity as a European citizen and a designation of the country whose law applies to the take-down request.

The form notes that the submission is part of the process that will include consultations with and guidance from data protection authorities.  The Article 29 Working Party is scheduled to meet next week to discuss implementation of the ECJ decision uniformly across Europe.

European Commission Vice President Viviane Reding said that Google’s launch is “a good development.”

Relatedly, Google announced it was establishing an international committee to evaluate issues of dealing with requests to “be forgotten,” including Frank La Rue, U.N. Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, Peggy Valcke, Director, University of Leuven law school, Jose Luis Piñar, former Spanish DPA, Jimmy Wales, Founder of Wikipedia, and Luciano Floridi, Information Ethics Professor at the Oxford Internet Institute.

David Smith, Deputy Commissioner (Head of Data Protection) in the UK Information Commissioner’s Office has said there is space’ to strike a balance between the right to privacy and the public’s right to know. ‘It is important to keep the implications in proportion and recognize that there is no absolute right to have links removed.”

Today’s development reflect Google’s awareness that it needs to comply with the ECJ decision, of course, but that it also continues to feel an obligation to promote free expression and the availability of information.

Facebook Making More Privacy-Friendly Changes

Facebook today is announcing two important new steps that should make a big difference for users.

First, for new Facebook users, the default audience of their first post will be set to Friends. Previously, for most people, it was set to Public.

Additionally, for people already on Facebook, a new and expanded “privacy checkup” tool will take users through a few steps to review things like who they’re posting to, which apps they use, and the privacy of key pieces of information on their profile.

These changes come on the heels of the social media giant rolling out a new opt-in location feature, warnings to users who post publicly, anonymous log-in and new app controls.

We have been pleased to be able to provide input on privacy enhancing options to Facebook product managers and policy experts. It’s great to see the company really turning the corner on privacy and providing features and defaults that help ensure users are in control of their data. For Facebook to continue to grow and be used by users in new ways, users must feel confident that they are in charge of what they share, so these changes are certainly good for both the company and its users.

FPF list of Federal Anti-discrimination laws

Civil rights groups have recently highlighted the importance of respecting civil rights in this era of “big data” . The White House has echoed these concerns in its Big Data Privacy Review. As supporters of the benefits of responsible data use, we thought it would be helpful to companies and advocates to have a convenient list of existing federal laws that prohibit discrimination in a variety of contexts. If we’ve missed any laws, let us know at  [email protected].

Americans with Disabilities Act of 1990 (ADA)/ Rehabilitation Act of 1973

The Americans with Disabilities Act (ADA), 42 U.S.C. 12101-12213, prohibits employers from discriminating against people with disabilities (including mental illness) in any aspect of employment, including applications, interviews, testing, hiring, job assignments, evaluations, compensation, leave, benefits, discipline, training, promotions, medical exams, layoffs, and firing.

The ADA also has provisions that apply to public accommodations: restaurants, hotels, theaters, doctors’ offices, pharmacies, retail stores, museums, libraries, parks, private schools, day care centers, and credit services may not discriminate on the basis of disability, and reasonable changes in policies, practices, and procedures must be made to avoid discrimination. The ADA requires facilities and public transportation methods to be accessible to disabled people, although there are exceptions in some cases where doing so would be an undue burden.

With regards to the federal government, The Rehabilitation Act of 1973, Pub.L. 93–112, 87 Stat. 355, prohibits discrimination on the basis of disability in programs conducted by federal agencies, in programs receiving federal financial assistance, in federal employment, and in the employment practices of federal contractors. The standards for determining employment discrimination under the Rehabilitation Act are the same as those used in title I of the Americans with Disabilities Act.

Age Discrimination Act of 1975

The Age Discrimination Act of 1975, 34 CFR Part 110, holds that no person in the United States shall, on the basis of age, be excluded from participation, in be denied the benefits of, or be subjected to discrimination under, any program or activity receiving Federal financial assistance. However, discrimination is acceptable if (A) such action reasonably takes into account age as a factor necessary to the normal operation or the achievement of any statutory objective of such program or activity; or (B) the differentiation made by such action is based upon reasonable factors other than age. The Age Discrimination regulation is enforced by the US Office for Civil Rights.

Age Discrimination in Employment Act (ADEA)

In addition to the 1975 Act, The Age Discrimination in Employment Act (ADEA), 29 U.S.C. 621-634, prohibits private discrimination based on age against employees who are at least 40 years old. Prohibited activities include discrimination on the basis of age in hiring, promotion, discharge, compensation, or terms, conditions or privileges of employment. It also prohibits employers from retaliating against an applicant or employee for asserting his or her rights under the ADEA.

Title II/III of the Civil Rights Act of 1964/Civil Rights Act of 1886

The Civil Rights Acts are all designed to eliminate discrimination based on race, color, religion or national origin. Title II of the Civil Rights Act of 1964 (42 U.S.C. 2000e et seq.) outlaws discrimination in hotels, motels, restaurants, theaters, and all other public accommodations engaged in interstate commerce; however “private” clubs are exempted. Meanwhile, Title III prohibits state and municipal governments from denying access to public facilities on the basis of race, color, religion or national origin. Lastly, the Civil Rights Act of 186642 U.S.C. § 1982, allows all US citizens “to inherit, purchase, lease, sell, hold, and convey real and personal property.”

Title VI of the Civil Rights Act of 1964/Title IX of the Education Amendments of 1972

Title VI of the Civil Rights Act, 42 U.S.C. § 2000d et seq, prohibits discrimination against any person on the basis of race, color, or national origin in programs or activities receiving federal financial assistance. Title VI is most commonly applied to publicly funded schools, but also can apply to law enforcement. The Office for Civil Rights (OCR) within the US Department of Education is responsible for enforcing Title VI as it applies to the programs and activities that it funds. Prior to Title VI’s passing, Executive Order 8802 was signed by President Franklin D. Roosevelt on June 25, 1941 in order to prohibit racial discrimination in the national defense industry and by private contractors.

In addition to Title VI of the Civil Rights Act, Title IX of the Education Amendments of 1972, 20 U.S.C. sections 1681 through 1688, also affects public schools. Title IX prevents any education program or activity receiving federal financial assistance (such as public schools) from excluding from participation, denying benefits, or discriminating on the basis of sex.

To further assist non-native English speakers, President Clinton signed Executive Order 13166, “Improving Access to Services for Persons with Limited English Proficiency,” in 2000. The order requires federal agencies to examine the services they provide, identify any need for services to those with limited English proficiency (LEP), and develop and implement a system to provide those services so LEP persons can have meaningful access to them.

Title VII of the Civil Rights Act of 1964

Title VII of the Civil Rights Act of 1964 (42 U.S.C. 2000e et seq.) is specifically aimed at employment discrimination. The title prohibits employers (“who [have] fifteen (15) or more employees for each working day in each of twenty or more calendar weeks in the current or preceding calendar year”) from discriminating against applicants and employees on the basis of race, color, religion, sex, and national origin (including membership in a Native American tribe). It was amended again in 1978 to prohibit discrimination on the basis of pregnancy as well.

Title VII prohibits employers from retaliating against an applicant or employee who asserts his or her rights under the law. (In the federal government, the NO-FEAR ACT, Public Law 107–174, requires an agency to provide annual notice to its employees, former employees, and applicants concerning their rights and remedies under the employment discrimination and whistleblower protection laws.) Title VII also prohibits some practices that seem neutral but have a disproportionate impact on a protected group of people, unless there is a valid reason for the discriminatory practice. Lastly, Title VII prohibits harassment in the workplace based on membership in a protected class.

Title VII has been developed extensively through case law interpreting it. For instance, on July 1, 2011, the EEOC ruled that job discrimination against lesbians, gays and bisexuals was a form of sex-stereotyping and thus constituted a form of discrimination “based on . . . sex” in violation Title VII. On April 20, 2012, the EEOC went further and ruled that gender identity was also a protected class under Title VII. A recent ruling in TerVeer v. Billington confirms that an employee can bring a claim under Title VII’s ban on sex discrimination whenever an employer commits harassment because he or she views the employee’s sexual orientation as “not consistent with acceptable gender roles.” Although the ruling interprets Title VII broadly, it is unclear whether other courts will follow suit, or if specific legislation is necessary to explicitly prohibit discrimination on the basis of gender identity.

The Community Reinvestment Act (CRA)

Unlike the Home Mortgage Disclosure Act (discussed below), which mainly requires disclosure, the CRA (12 U.S.C. 2901 et seq.) seeks affirmatively to encourage institutions to help to meet the credit needs of the community served by each covered institution, and to discourage discriminatory redlining of poor neighborhoods. The CRA requires that each insured depository institution create and evaluate a record describing how it helps meet the credit needs of its community. These CRA ratings take into account lending discrimination by those institutions. The Board of Governors of the Federal Reserve System (FRB), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) all conduct CRA investigations. These entities take CRA ratings into consideration when approving applications for new bank branches or for mergers or acquisitions.

Equal Credit Opportunity Act of 1974 (ECOA)

The ECOA, 15 U.S.C. § 1691 et seq., prohibits credit discrimination on the basis of race, color, religion, national origin, sex, marital status, age, whether the candidate receives public assistance, and whether the candidate has exercised his or her rights under the Consumer Credit Protection Act. Creditors may ask a candidate for protected information in certain situations, but the creditor may not use it when deciding whether to offer the candidate credit, or when setting the terms of credit. In addition, creditors cannot (1) ask about marital status if a candidate is applying for separate credit (except in community property states), (2) ask the candidate if they plan to have children/additional children (though they can ask about obligations relating to current children), or (3) disallow certain forms of regular income.

The Federal Reserve Board’s Regulation B, found at 12 CFR Part 202, implements the ECOA. Regulation B describes lending acts and practices that are specifically prohibited, permitted, or required. Official interpretations of the regulation are found in Supplement I to 12 CFR Part 202. The Consumer Financial Protection Bureau enforces against most violations of the ECOA.

The Equal Pay Act (EPA)

The EPA, 77 Stat. 56, mandates that employers must give men and women the same pay if they perform the same work. While the work does not have to be identical, it must be substantially similar. That is, if men and women perform jobs that require the same skills, effort, and responsibility under similar working conditions, they are performing the same work. Employers may not give male and female employees different wages based on sex, but may discriminate on the basis of (i) a seniority system; (ii) a merit system; (iii) a system which measures earnings by quantity or quality of production; or (iv) a differential based on any other factor other than sex.

Equal Protection Clause of the U.S. Constitution

Beyond specific federal laws, The United States Supreme Court has ruled that it violates the Fourteenth Amendment of the US Constitution for a state government to fail to provide equal protection for its people under the law. (Equal Protection also applies to the Federal government under the Fifth Amendment). In practice, this means that whenever there is state action, courts will apply a tiered scrutiny system depending on whether the government’s action involves a “suspect class,” such as race, religion, or gender, or a “fundamental right” such as the right to vote or procreate. The Supreme Court has held that under the Equal Protection Clause, public schools may not segregate students on the basis of race (See Brown v. Board of Education, 347 U.S. 483 (1954)). The Equal Protection Clause has also been used to invalidate state laws and practices that discriminate on the basis of sex, such as in Reed v. Reed, 404 U.S. 71 (1971). Whether the Equal Protection Clause prohibits discrimination on the basis of sexual orientation is still somewhat unclear (see United States v. Windsor, 570 U.S. 12 (2013) (striking down the Defense of Marriage Act, but not on the basis of Equal Protection).

Fair Housing Act of 1968 (Amended in 1974)

The Fair Housing Act, 42 U.S.C. 3601, originally prohibited discrimination in real estate sales, rental, lending, insurance, and all related services based on race, color, sex, religion, national origin, familial status and handicap. Among other things, the Fair Housing Act now prohibits discrimination in the following areas: refusal to rent, sell, or negotiate for housing; making housing unavailable; setting different terms, conditions or privileges for the sale or rental of a dwelling; providing different housing services or facilities; falsely denying the availability of housing for inspection, sale or rental; blockbusting; denying persons access to or membership in a facility or service related to the sale or rental of housing; refusing to make a mortgage loan; refusing to provide information regarding loan products; imposing different terms and/or conditions on a loan, including interest rates, points, or fees; discriminating in the appraisal of property; refusing to purchase a loan; or advertising or making statements that indicate limitations or preferences based on membership of a protected group.

Although the precise contours of the law on disparate impact as it applies to lending discrimination are under development, it has been clearly established that proof of lending discrimination using a disparate impact analysis encompasses several steps. The single fact that a policy or practice creates a disparity on a prohibited basis is not alone proof of a violation. Where the policy or practice is justified by “business necessity” and there is no less discriminatory alternative, a violation of the Fair Housing Act (or the Equal Credit Opportunity Act) will not exist. However, even if a policy or practice that has a disparate impact on a prohibited basis can be justified by business necessity, it still may nonetheless be found to be discriminatory if an alternative policy or practice could serve the same purpose with less discriminatory effect.

The Federal Trade Commission Act/Robinson-Patman Act

Section 5 of the FTC Act, 15 U.S.C. Sec. 45, prohibits ‘‘unfair or deceptive acts or practices in or affecting commerce.’’ The prohibition applies to all persons engaged in commerce, including banks. The FTC, which enforces the Act, has identified three factors that it considers when applying the prohibition against consumer “unfairness.” These are: (1) whether the practice injures consumers; (2) whether it violates established public policy; (3) whether it is unethical or unscrupulous. To justify a finding of unfairness the injury must satisfy three tests. It must be substantial; it must not be outweighed by any countervailing benefits to consumers or competition that the practice produces; and it must be an injury that consumers themselves could not reasonably have avoided. Discriminating against consumers with respect to pricing may be grounds for FTC enforcement if it qualifies under these factors.

Price discrimination may also violate the Robinson–Patman Act of 1936 (or Anti-Price Discrimination Act, Pub. L. No. 74-692, 49 Stat. 1526 (codified at 15 U.S.C. § 13)). The Supreme Court upheld the FTC’s ability to enforce the Robinson-Patman Act in FTC v. Morton Salt Co., 334 U.S. 37 (1948). However, the Robinson-Patman Act requires “competitive injury,” and is not designed to serve as a consumer protection law.

Genetic Information Nondiscrimination Act (GINA)

The Genetic Information Nondiscrimination Act (GINA) can be found at 42 U.S.C. 200 et seq. This 2008 law prohibits private employers (as well as people insured through Medicare) from using an applicant’s or employee’s genetic information as the basis for employment decisions, and requires employers to keep genetic information confidential. It also prohibits group health plans and health insurers from denying coverage to a healthy individual or charging that person higher premiums based solely on a genetic predisposition to developing a disease in the future. However, the law does not cover life, disability, or long-term care insurance, which may cause some reluctance to get tested.

Home Mortgage Disclosure Act (HMDA)

The HMDA, 12 U.S.C. 2801 et seq., seeks to prevent lending discrimination by requiring public disclosure of certain information regarding mortgage loan applications. Regulation C of the law requires lending institutions to report public loan data partly in order to identify possible discriminatory lending patterns. Using the loan data submitted by these financial institutions, the Federal Financial Institutions Examination Council (FFIEC) creates tables for each metropolitan statistical area (MSA) or metropolitan division (MD) (where appropriate), and individual institution disclosure reports. The HMDA is a tool that is generally used to discover discrimination; it does not explicitly prohibit it.

The Immigration Reform and Control Act of 1986 (IRCA)

The IRCA, Pub.L. 99–603, 100 Stat. 3445, makes it illegal for an employer to discriminate with respect to any aspect of employment (including hiring, firing, pay, job assignments, promotions, layoff, training, fringe benefits, and any other term or condition of employment), based upon an individual’s citizenship or immigration status. National origin discrimination involves treating people (applicants or employees) unfavorably because they are from a particular country or part of the world, because of ethnicity or accent, because they are married to (or associated with) a person of a certain national origin, or because they appear to be of a certain ethnic background (even if they are not). The law also prohibits employers from hiring only U.S. citizens or lawful permanent residents unless required to do so by law, regulation or government contract.

The Omnibus Crime Control and Safe Streets Act of 1968 (and similar laws affecting law enforcement)

The Omnibus Crime Control and Safe Streets Act of 1968, (42 U.S.C. § 3789d and 28 C.F.R. §42.201 et seq.), prohibits employment discrimination on the basis of race, color, national origin, religion, or sex, in OJP, OVW, and COPS funded programs or activities. Section 504 of the Rehabilitation Act, 29 U.S.C. § 794 and 28 C.F.R. § 42.501 et seq., also prohibits discrimination on the basis of disability in OJP and COPS funded programs or activities. Section 1407 of the Victims of Crime Act (VOCA) of 1984, 42 U.S.C. § 10604, prohibits discrimination on the basis of race, color, national origin, religion, sex, or disability in VOCA funded programs or activities. All of these laws are enforced by the Department of Justice Office of Civil Rights (OCR).

In addition, Executive Order 11478 (signed by Richard Nixon in 1969) covers the federal civilian workforce, including the United States Postal Service and civilian employees of the United States Armed Forces. It prohibits discrimination in employment on the basis of race, color, religion, sex, national origin, handicap, and age.

The Voting Rights Act of 1965

The Voting Rights Act of 1965, 42 U.S.C. §§ 1973 et seq., was enacted to prevent and remedy racial discrimination in voting. Section 2 prohibits voting practices that have the purpose or result of discriminating against members of a racial or minority language group.  Plaintiffs must establish, “based on the totality of circumstances, . . .  that its members have less opportunity than other members of the electorate to participate in the political process and to elect representatives of their choice.”  Section 2 has been used most frequently to challenge election systems that dilute minority voting strength, such as literacy tests and similar devices that were historically used to disfranchise racial minorities.

Meanwhile, Under Section 5, specific states and counties with a history of discrimination must receive federal preclearance before they implement any change affecting voting. These jurisdictions may also have to provide language assistance to language minority groups. Finally, the law prohibits intimidating, threatening, coercing another person with the purpose of interfering with their right to vote.

Peter Swire on Economic Espionage

FPF Senior Fellow Peter Swire writes today about a recent slate of indictments against members of China’s People’s Liberation Army for economic espionage.

Swire argues that industrial cyber-espionage is distinct from intelligence surveillance. Specifically, economic espionage is a crime. Further, such espionage has serious economic consequences:

Criminal laws against industrial espionage serve broader goals than simply vindicating the victim. Protection of trade secrets fosters economic efficiency and protects investment and investment in intellectual property. As a matter of new technology, companies invest in trade secrets while they prepare to enter a market, and many innovations then ripen into patents that are published to the world and make the innovation known to follow-on innovators. Military-grade cyber-attacks on those trade secrets steal from the innovator and also reduce the expected profit from the hard work of developing new products and services.

A related efficiency harm is that it is costly and difficult for ordinary corporations to protect themselves against military-grade cyber-attacks. The spending needed to protect trade secrets against that level of attack imposes costs across the broad swathes of industry that compete with other countries.

Polonetsky: Trust, transparency best in-store deal for shoppers with mobile phones

Mall operators and retailers can ensure that they use consumer data in a trustworthy manner by making sure they do business with companies who have committed to baseline rules for responsible data use.

[via RetailingToday]

Judge Narrows Subpoena For New Yorkers’ Airbnb Records in Privacy-Protective Ruling

Late last fall we posted about Attorney General Schneiderman’s troubling attempts to subpoena data on 15,000 New York City-based users of Airbnb, the service best known for allowing people to rent out their spare bedrooms or their homes while on vacation. Schneiderman was trying to find landlords who were renting their apartments out long-term through Airbnb as makeshift hotels, while failing to pay the requisite hotel taxes. While recognizing the city’s compelling need to find tax scofflaws, FPF was critical of Schneiderman’s approach, as it required Airbnb to reveal the vacation habits of thousands of New Yorkers (even ones not suspected of any wrongdoing), including residents’ names and contact information, dates of guest stays, rates charged, and any communications between users and Airbnb about tax issues.

We are happy to report that State Supreme Court Judge Gerald Connolly ruled in Airbnb’s favor, generally siding with the company’s argument that the subpoena was overly broad. Although Judge Connolly’s opinion implies that a narrower subpoena of Airbnb’s records is likely to be upheld, the judge wrote that the subpoena “as drafted, seeks materials that are irrelevant to the inquiry at hand and accordingly, must be quashed.” Specifically, judge Connolly criticized the subpoena because it included information on residents outside of New York City, as well as rentals of fewer than 14 days (which are legal under New York Law).

Although no one should not be able to avoid the law simply by doing business online, overly broad subpoenas for innocent customer information harm consumer trust, which in turn cripples online business as well as individual freedom. We applaud Judge Connolly for correctly identifying the overbreadth problem with Schneiderman’s subpoena, and we expect that a more balanced request will follow.

FPF Statement on White House Big Data Report

Today, the White House released its report on big data and the future of privacy.  The Future of Privacy Forum (FPF), a DC-based think tank advocating responsible privacy and data practices, has closely followed the work of the Review Group.

“Today’s White House report on Big Data carefully identifies most of the key issues in this emerging and critical debate, and in various ways seeks to constructively address each of them through legislative policy, agency action, and funding efforts. The report is a full-barrel effort to move the dialogue forward in a way that demonstrates a deep commitment to the benefits of Big Data, while at the same time balancing appropriate concerns about privacy. Above all, it was very positive to see the White House commit to essential, long-overdue reform to the Electronic Communications Privacy Act,” said Jules Polonetsky, co-chair and executive director, FPF.

“We’re especially pleased to see the Administration reiterate support for and carefully advance a Consumer Bill of Rights, it’s commitment to funding of critical privacy technologies, getting consensus among federal agencies with regard to the impact of big data on civil liberties, and taking a comprehensive and careful look at the use of Big Data in education – which can have significant value but must address children’s privacy in a responsible way. Finally, we welcome the report’s call for a smart update to education privacy laws continue to address children’s privacy protections,” said Chris Wolf, co-chair and founder, FPF.

FPF previously submitted comments for the Review Group’s consideration in March.

Japan Approved to Participate in APEC’s Cross-Border Privacy Rules System

The Asia-Pacific Economic Cooperation (“APEC”) has approved Japan as its newest participant in the Cross-Border Privacy Rules (CBPR) system. The CBPR system is a voluntary program that establishes a baseline privacy certification process for the transfer of personal data among the 21 APEC member countries. To date, the United States, Mexico, and Japan have joined; meanwhile Canada recently committed to participating.

To be approved as a participant in the CBPR system, countries must submit a letter of intent to participate, and must fulfill other requirements, such as declaring an intent to make use of APEC-approved “Accountability Agents.” The countries must also describe their laws and enforcement mechanisms related to the protection of personal data. The letters are reviewed by the CBPR Joint Oversight Panel, which determines whether the country may participate.

“The participation of Japan to the CBPR system will make the system stronger, and will provide a key anchor in the Pacific for this regional system,” said FPF Policy Director Josh Harris. FPF is engaged in a series of efforts across the Asia Pacific to promote a more streamlined privacy landscape. FPF is currently working with the United States Department of Commerce and the Federal Trade Commission to provide technical assistance to interested APEC countries, and to advance this initiative through strategic partnerships with key industry stakeholders in each country.