[House Hearing, 117 Congress]
[From the U.S. Government Publishing Office]
BIG DATA: PRIVACY RISKS AND NEEDED REFORM IN THE PUBLIC AND PRIVATE
SECTORS
=======================================================================
HEARING
before the
COMMITTEE ON HOUSE
ADMINISTRATION
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTEENTH CONGRESS
SECOND SESSION
__________
FEBRUARY 16, 2022
__________
Printed for the use of the Committee on House Administration
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available on the Internet:
http://www.govinfo.gov/committee/house-administration
______
U.S. GOVERNMENT PUBLISHING OFFICE
49-431 WASHINGTON : 2022
COMMITTEE ON HOUSE ADMINISTRATION
ZOE LOFGREN, California, Chairperson
JAMIE RASKIN, Maryland RODNEY DAVIS, Illinois,
G. K. BUTTERFIELD, North Carolina Ranking Member
PETE AGUILAR, California BARRY LOUDERMILK, Georgia
MARY GAY SCANLON, Pennsylvania BRYAN STEIL, Wisconsin
TERESA LEGER FERNANDEZ, New Mexico
C O N T E N T S
----------
FEBRUARY 16, 2022
Page
Big Data: Privacy Risks and Needed Reforms in the Public and
Private Sectors................................................ 1
OPENING STATEMENTS
Hon. Zoe Lofgren, Chairperson.................................... 1
Prepared statement of Chairperson Lofgren...................... 4
Hon. Rodney Davis, Ranking Member................................ 6
Prepared statement of Mr. Davis................................ 8
WITNESSES
Hon. Hugh N. Halpern, Director, Government Publishing Office..... 10
Prepared statement of Hon. Halpern............................. 13
Shoshana Zuboff, Charles Edward Wilson Professor Emerita, Harvard
Business School................................................ 33
Prepared statement of Prof. Zuboff............................. 35
Caitriona Fitzgerald, Deputy Director, Electronic Privacy
Information Center............................................. 53
Prepared statement of Ms. Fitzgerald........................... 55
Marshall Erwin, Chief Security Officer, Mozilla Corporation...... 74
Prepared statement of Mr. Erwin................................ 76
Daniel Castro, Vice President, Information Technology and
Innovation Foundation.......................................... 82
Prepared statement of Mr. Castro............................... 84
QUESTIONS FOR THE RECORD
Hon. Hugh N. Halpern, Director, Government Publishing Office,
responses...................................................... 110
Caitriona Fitzgerald, Deputy Director, Electronic Privacy
Information Center, responses.................................. 114
Marshall Erwin, Chief Security Officer, Mozilla Corporation,
responses...................................................... 119
Daniel Castro, Vice President, Information Technology and
Innovation Foundation, responses............................... 121
SUBMISSIONS FOR THE RECORD
February 25, 2022, National Association of Assistant United
States Attorneys, submission................................... 126
June 22, 2021, Ranking Member Davis letter to Chairperson
Lofgren, submission............................................ 128
February 15, 2022, CATO letter to Chairperson Lofgren and Ranking
Member Davis, submission....................................... 130
United States District Court for the District of Columbia, United
States v. Michael A. Sussmann, submission...................... 137
Singman, Brooke, Fox News, Clinton campaign paid to `infiltrate'
Trump Tower, White House servers to link Trump to Russia,
Durham finds, submission....................................... 150
BIG DATA: PRIVACY RISKS AND NEEDED REFORMS IN THE PUBLIC AND PRIVATE
SECTORS
WEDNESDAY, FEBRUARY 16, 2022
House of Representatives,
Committee on House Administration,
Washington, DC.
The Committee met, pursuant to call, at 2:03 p.m., via
Webex, Hon. Zoe Lofgren [Chairperson of the Committee]
presiding.
Present: Representatives Lofgren, Raskin, Aguilar, Scanlon,
Leger Fernandez, Davis, Loudermilk, and Steil.
Staff Present: Sean Jones, Legislative Clerk; Jamie Fleet,
Staff Director; Eddie Flaherty, Chief Clerk; Khalil Abboud,
Deputy Staff Director; Tim Monahan, Republican Staff Director;
Caleb Hays, Republican General Counsel and Deputy Staff
Director; Nick Crocker, Republican Deputy Staff Director;
Gineen Bresso, Republican Special Counsel.
The Chairperson. So the Committee on House Administration
will come to order.
I note that a quorum is present. As we begin, I would note
that we are holding this hearing in compliance with the
regulations for Remote Committee Proceedings pursuant to House
Resolution 8.
Generally, we ask Committee Members and witnesses to keep
their microphones muted when not speaking to limit background
noise, and all of us will need to unmute ourselves when seeking
recognition or when recognized to speak. Witnesses will also
need to unmute themselves when recognized for their testimony
or when answering a question.
Members and witnesses, the rules require that we keep our
cameras on at all times. Even if you need to step away for a
moment, please do not leave the meeting or turn your camera
off. I would also like to remind Members that the regulations
governing remote proceedings require that Members cannot
participate in more than one committee proceeding at the same
time.
At this time, I ask unanimous consent that all Members have
five legislative days in which to revise and extend their
remarks and have any written statements be made part of the
record.
And, hearing no objections, that is ordered.
I also ask unanimous consent that the chair be authorized
to declare a recess of the Committee at any point.
And, without objection, that is also so ordered.
We are here today to confront one of the central challenges
of our digital age. As nearly every facet of our society and
economy has moved online, ever greater amounts of digital data
are collected about each of us, spanning everything from who we
are, to what we like, to who we are--who we communicate with,
to what we do, often in minute detail.
While this mass data collection has some productive and
valuable applications, it comes with profound risks that we are
only beginning to truly understand, let alone to regulate
effectively.
Privacy, as it is conventionally understood, means control
over one's own personal information and the freedom to decide
what to share, with whom, and how. We are all familiar with the
classic privacy harms, whether it is government surveillance,
identity theft and other economic crimes, or the social and
economic harm that can befall us when some intimate details of
our life become public against our will.
All these risks are still very much at play today with the
rise of the internet and data-centric business models of many
online firms. However, in some ways, privacy has become a
catchall term for a larger and even more profound set of
potential risks, some of which are truly novel or at least
fundamentally different in the digital age.
What does it mean for our basic autonomy as individuals
when both the government and private companies can amass large
profiles about each of us and use them to predict and even
potentially manipulate our behavior? What does it mean for our
economy when some of the most popular online products and
services revolve around opaque data collection and
personalization? And what does it mean for our democracy when
these data practices shape the public discourse and the flow of
news and information? And what does it mean that, as
individuals and internet users, we have little or no meaningful
ability or visibility into how any of this really works, let
alone genuine control over it?
The American public has long been deeply concerned about
these questions. For example, in 2020, the Pew Research Center
found that half of Americans had limited specific online
activities out of privacy fears. The same year, another poll
found that 88 percent are frustrated that they don't have more
control over their personal information online.
I will note that these fears kind of cross many divisions
in our society: economic, racial, geographic, and partisan. For
all these reasons, the time for a comprehensive Federal policy
framework is long overdue. There have been many proposals and
lots of talk, but little or no action or clear progress.
I will note that Representatives Anna Eshoo and I have
introduced the Online Privacy Act in several Congresses,
including this one. This legislation sets forth the most
thorough and aggressive set of privacy rights among the major
proposals with the clearest restrictions on a wide variety of
abusive and troubling data practices, and the strongest
mechanisms to enforce the law and make digital privacy rights
more than just an abstraction.
The Online Privacy Act also contains a set of privacy
obligations on Legislative Branch agencies that this Committee
oversees, requiring the Government Publishing Office, the
Library of Congress, the Smithsonian, and the Chief
Administrative Officer of the House to each identify concrete
privacy risks in their operations and to take appropriate
remedial steps.
Many of the risks and policy questions around data cut
across both public and private sectors. We can take lessons
from both in determining the best ways to address them. I am
hopeful that today's hearing will not only advance this
conversation, but also reinvigorate congressional attention on
digital privacy toward the ultimate enactment of major reforms.
With that, I am now pleased to recognize our Ranking
Member, Congressman Rodney Davis, for any comments that he
would like to make.
Welcome, Rodney.
[The statement of The Chairperson follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Davis. Well, thank you, Madam Chairperson.
And thanks to our witnesses for joining us for today's
hearing. It is a hearing on a rare topic for this Committee,
but no doubt an important one: online data privacy. Yet policy
discussions on creating nationwide privacy standards and a
framework for enforcement need to take place in the primary
committees of jurisdiction: Energy and Commerce and the
Judiciary. It is clear to me that this discussion should be led
by those primary committees and jurisdiction, and we should let
them work out the underlying policy details before we consider
application to the Legislative Branch.
304 bills have been referred to this Committee by the
House, yet we are devoting our time today to this topic. It is
rare we are even meeting on potential legislation this
Congress. We have had exactly one other hearing on the policy
underlying a bill and exactly zero markups.
Further, this Committee has not held comprehensive standard
oversight hearings with our entities in nearly three years. For
us not even to discuss FEC or EAC oversight hearings in an
election year is shocking to me.
Eight months ago, I sent a letter to the Chairperson asking
for this Committee to fulfill its duty and conduct oversight
hearings with each of our Legislative Branch entities. Eight
months later, I still have not received a response from the
Chairperson, and the Committee continues to shirk its duties.
I look forward to this Committee having more oversight
hearings soon to address the concerns that fall more directly
within this Committee's jurisdiction.
Regarding the topic at issue today, the call for a workable
national framework, increased transparency, and overall
accountability in the technology industry, is all but universal
at this point. Data privacy is at the forefront because it
affects everyone. We all see the need. As a parent of three
young adults, I believe this issue deserves not only Congress'
attention, but it also demands it.
All anyone has to do is watch the news to see how data
privacy affects everyone. Last week, filings by Special Counsel
John Durham alleged that, in 2016, Democratic operatives,
perhaps including Marc Elias, who multiple members of this
Committee are familiar with, in his attempts to--in his
attempts to challenge the legitimacy of elections, sought to
exploit their access to non-public and/or proprietary internet
data to create a narrative tying President Trump to Russia, in
the words of one outlet, to infiltrate Trump Tower and White
House servers to link Trump to Russia. Talk about an election
subversion. Unbelievable.
So, a responsible and workable nationwide solution for data
privacy that can protect Americans' privacy and also curb bad
political actors from attempting to subvert our political
discourse is necessary. I know that our Chairperson has a
special interest in this topic, and I imagine that her desire
to raise the profile of her legislation is why we are here
today. So, let's discuss it.
I spoke with my good friend, Energy and Commerce Ranking
Member Cathy McMorris Rodgers, since her committee would be
primary, and she offered me a lot of good thoughts, things I
assume she would say if this hearing were before her committee,
where it belongs first.
First, we share more personal information online now than
ever before. As the internet has grown, so has the opportunity
for our personal information to be used by people or businesses
that we never intended.
Second, privacy does not end at State lines. This is a
nationwide Commerce Clause issue that requires a congressional
response. Americans cannot rely on conflicting State laws to
keep their information safe. A patchwork solution is not viable
for a concern that affects all of us. The only way to provide
transparency in how Americans' information is collected, used,
and shared is with a uniform approach.
We must also ensure that any congressional response is
forward thinking and comprehensive while still being workable
for compliance. Solutions that do not account for burdens
placed on small businesses and innovators, such as the GDPR in
the EU or the CCPA in California, are doomed to fail.
Finally, those who misuse personal information must be held
accountable. There have been proposals that call for the
creation of a new Federal agency to enforce its provisions. The
Federal Trade Commission already has jurisdiction over these
matters, as well as a longstanding relationship with the
States' AGs. Creating a new agency to do the FTC's job is
bureaucratic waste at the highest level.
Americans' call for a comprehensive solution to Big Data
privacy issues is loud and clear, and they deserve an answer,
an answer that is built with bipartisan buy-in, transparency,
and accountability.
Even though this Committee isn't where we should be hosting
this portion of this discussion, I am looking forward to
today's panels, and I yield back.
[The statement of Mr. Davis follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairperson. The gentleman yields back.
I just would note for the record that the Committee's
jurisdiction is generally determined by House Rules
specifically, House Rule X--and this Committee has been, along
with other committees, assigned jurisdiction.
I want to thank the Ranking Member for his comments.
I would also like to recognize our first witness, who is
someone who has led the U.S. Government Publishing Office with
great distinction of late.
He is the 28th person to lead the GPO since it opened its
doors in 1861 and has served in this role in 2019. Hugh
Nathaniel Halpern was selected this month--the GPO was selected
as one of the best employers in the country, ranking first on
Forbes' list of midsize agencies in government services.
I really do think, Hugh, that it is a reflection on your
leadership as well as your fine staff at the GPO.
As you know--this is not your first time to be a witness--
your entire written statement will be made part of the record,
and we would ask that you summarize your testimony in about
five minutes.
So, Mr. Halpern, you are now recognized for five minutes.
STATEMENT OF HUGH HALPERN, DIRECTOR, GOVERNMENT PUBLISHING
OFFICE, WASHINGTON, D.C.
Mr. Halpern. Thank you so much and thank you for
acknowledging the achievement of making that Forbes list. I
will take some credit if it is assigned, but it really belongs
to the men and women here at GPO. So, thank you so much for
having me today, both to the Chairperson and to the Ranking
Member, and all the Members of the Committee.
I appreciate the opportunity to testify about GPO's
approach to handling personally identifiable information,
commonly known as PII. On behalf of GPO's more than 1,500
craftspeople and professionals, know that we take our
responsibility seriously to protect PII every day.
GPO operates as a hybrid. It is a government agency that
operates as a business, complete with customers, products, and
profit and loss. Thus, we face many of the same kinds of
problems facing private-sector firms when it comes to the
handling of PII.
GPO is entrusted with PII belonging to our teammates,
customers, and, by nature of our business, the general public.
Robust protection of PII is critical to building trust with our
customers and stakeholders. Without that trust, we can never
achieve our vision of an America informed.
GPO operates a Privacy Program overseen by our privacy
officer in our information technology business unit. This
program establishes a framework for the protection of PII
itself, regardless of how it is stored, as well as the
protection of related information systems.
The program has several fundamental principles. First,
access to PII is limited to only those agency teammates and
contractors with a specific need.
Second, each business unit has someone who is responsible
for the privacy function and answers to that business unit's
leadership.
Third, any GPO teammate or contractor that suspects a
breach in PII security is obligated to report the problem as
soon as possible.
Fourth, violations will be addressed by appropriate
corrective action, including termination for our teammates,
debarment for contractors, and criminal prosecution if
appropriate.
While my written testimony goes into more detail as to how
this program works, today I would like to talk about three
separate examples of privacy issues at GPO and how we deal with
them.
First, GPO and its print procurement contractors produce
materials that require the use of PII. For instance, GPO's
Security and Intelligent Documents Unit manufactures and
personalizes trusted traveler smart cards, such as the global
entry card used to at border crossings for identification and
for expedited processing.
By the very nature of these products, GPO must handle vast
amounts of highly sensitive PII within our systems. GPO works
closely with its customers to maintain a series of firewalls
that ensure that GPO only receives encrypted PII that is only
decrypted when it is needed to produce and distribute those
cards. When GPO finishes production of the product, that PII is
scrubbed from our systems. You can't leak information you don't
have.
Second, there are vast amounts of PII included in some of
our regular publications, such as the Congressional Record and
Federal Register. The good news, particularly with the Federal
Register, is that most of that PII is contained in historic
volumes, and very little is being published currently. Where it
is, we have both automated and manual systems to redact that
information from our digital collections when we find it.
The bigger challenge is with historic information,
particularly as we work to digitize older collections. For
instance, at one time, it was common for the Department of
Defense to include military officers' Social Security numbers
on promotion lists later printed in the Congressional Record.
As we digitize volumes that contained that information, we
scan for it and redact that PII in preparation before posting
it on Govinfo.gov, our ISO-certified, trusted digital
repository. And, while we alert our partners when we find PII
in tangible collections that we don't possess ourselves, we do
not have the resources to visit every collection across the
country and manually redact that information.
The third and final category are instances where the
information is not quite PII but is information that people
don't want easily accessible on the internet. This comes up
most often with our collection of U.S. court opinions on
Govinfo.gov, and that is the repository's single largest
collection of data. It is understandable that some parties of
Federal court cases may not want that information to be easily
accessible, and they often come to GPO asking us to remove that
opinion from our collection.
However, it is important to remember that GPO is only
making that data accessible, and it is not our data. Our
Library Services Division refers individuals to petition the
owner of the data, the Administrative Office of the U.S.
Courts, to have the opinion sealed and removed from our systems
if the judge determines that public disclosure is problematic.
I hope that this overview of our operations was helpful in
your exploration of this critical issue. I look forward to
answering any questions you may have and assisting the
Committee with its inquiry.
Thank you so much.
[The statement of Mr. Halpern follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairperson. Thank you so much, Director Halpern. It is
great to hear this testimony.
Now is the time when Members can ask questions, and we will
turn first to the Ranking Member, Mr. Davis, for five minutes
of his questions.
Mr. Davis. You would think I would know how to work the
mute button right now, Madam Chairperson. I apologize for the
delay.
Hugh, great to see you, man.
Mr. Halpern. You, too.
Mr. Davis. I looked. The last time you were called to
testify before this Committee was on March 30--March 3rd of
2020----
Mr. Halpern. Yes.
Mr. Davis [continuing]. Nearly two full years ago. It is
nice to finally have you back, but I wish it was to get a
comprehensive update on GPO's operations and the initiatives
you have launched and successes you have had as well as the
agency's health post pandemic.
Unfortunately, we are here to talk about a much narrower
topic, but one that GPO clearly excels at, and that is
protecting the PII, the personally identifiable information you
spoke about, and its work to print passports, create global
entry cards, and other sensitive projects.
In your testimony, you shared the impressive work GPO has
undertaken to follow the recommendations laid out by the
National Institute of Standards and Technology and their guide
to protecting the confidentiality of PII.
Do you currently believe that you, as the Director of GPO,
have all the necessary authority to continue a high level of
excellence in protecting PII?
Mr. Halpern. Thanks so much for the question.
The short answer is, at the moment, I think we do. We have
got the authority we need to work with our customers, to design
systems that protect the PII that they give us, and in our
relationship with our own vendors, whether that is a contractor
that we hire on behalf of the executive branch for work that
they are doing for the IRS or other government agencies. That--
we are able to construct systems that protect that level of
PII.
Now, one of the things that we must remain vigilant about
is the PII of our own teammates. And frankly, if there was a
large body of PII that the agency maintains, that is it. It is
our payroll information. It is our time and attendance
information. It is our personnel files.
We work both with folks here in the building and with our
vendors over at the Department of Agriculture, who handle our
payroll and other systems, to make sure that that information
is protected. We are doing our level best to protect the nearly
1,600 people who work here at GPO from running into any
problems, as well as the information of anybody who is working
with GPO or working with our customers.
Mr. Davis. Great. How often is GPO's privacy program
reassessed or updated to remain at this high level of
effectiveness?
Mr. Halpern. So, it is constantly undergoing assessment.
Our--the directive that governs our privacy program is supposed
to be reviewed, I believe, every three years. We are constantly
going through our policies, our procedures, and our actual
practices to make sure that we are doing our level best. And
that is both on the digital side, where we have an extremely
competent team on our information technology team, but also
just with our safety and security team.
Now, I get an update three, four times a year as our safety
and security team walks the building to make sure that things
are shipshape. I can tell you they have flagged folks who have
inadvertently left PII sitting on their desk, not having it
stored properly. So, it is a good reminder to all of us that we
need to be proactive in protecting this information, whether it
is digitally or tangibly here in the real world.
Mr. Davis. I couldn't agree more.
One last question. What has GPO learned from the OPM breach
that happened several years ago?
Mr. Halpern. I think it is very similar to the lessons that
a lot of government agencies are learning. We have got to
secure our systems, and we spend a lot of resources. We have a
dedicated appropriation for that purpose. And it requires a lot
of vigilance on our part.
And, you know, knock on wood, thank God, certainly during
my tenure here, we have not had anything that even indicated
that folks were close to a breach of those kinds of systems,
and it is something we dedicate a lot of resources to every
single day.
And, you know, the one thing that the OPM breach, I think,
taught all of us is you can't rest on your laurels. Security
needs to be everybody's job every single day.
Mr. Davis. Well, thanks, Hugh.
Thank you, Madam Chairperson. I yield back.
The Chairperson. Thank you.
I now recognize Mr. Raskin for his questions for five
minutes.
Mr. Raskin. Thank you, Madam Chairperson, and thanks for
calling this important hearing.
Ms. Fitzgerald, discrete bits of personal information can
seem relatively harmless or trivial, but, when they are all
combined together with other data, they can have a far more
sweeping impact and create special dangers.
What lessons does this point contain for privacy
regulation? What are the biggest risks that Congress should be
considering in terms of the large-scale aggregation of data?
The Chairperson. I would note that Ms. Fitzgerald is on our
second panel, so----
Mr. Raskin. Oh, I am sorry. I thought I saw her there.
Forgive me. Then I will come, then, to Mr. Halpern.
So, what are the greatest privacy risks that GPO faces in
its operations? What are the specific harms in this area that
you are most focused on right now?
Mr. Halpern. Well, as I was saying, I think the largest
single trove that we maintain over a long--over a longer period
is our employees' own data. And that is something that we are
focused very, very closely on protecting.
Most of the other places where we have PII and we need to
focus on that, we have developed systems to make sure that we
are holding onto that PII for the minimum amount of time
possible.
So, for instance, in the example I used with the global
entry card, we literally have a contractor sitting on the other
side of the wall from our smart card manufacturing facility who
will send the encrypted data that we will need to produce those
cards into the smart card room, we will utilize that
information to produce those cards, and then scrub that from
our systems, send it back to the customer once we are done with
it, so that we are not holding on to any more data than we
need.
Our biggest problem in terms of other folks' data is
historical data. And, as we fulfill, I think, the greater
public good of working backwards and trying to digitize old
records, we are going to find more PII because, frankly, twenty
or thirty years ago, folks were a lot less conscious about what
they were putting in a congressional hearing or the
Congressional Record or the Federal Register. Because those
were all tangible documents, it was a lot harder for somebody
to get that information and then to do something with it,
because the internet just wasn't developed as it is now.
We have got a program in place to scan for PII in those
older documents. And, as we digitize them, we are working to
redact that from our digital collections.
Mr. Raskin. Thank you for that. I know that GPO routinely
publishes documents and information that originate elsewhere in
the Federal Government, so you are not the original custodian
and source of all the information you publish. And so how does
this affect your privacy policies and practices?
Mr. Halpern. We are often the middle person in this
transaction. The good example is the one I gave in my testimony
about U.S. courts--court opinions. As you can well imagine,
there are a lot of opinions that folks may not be happy are out
there in the world or easily searchable. And, while as a
general matter, that serves a greater public good, there is
that problem with, you know, maybe having an opinion where
there is information in there that somebody is uncomfortable
with having out in the public.
So, what we have done is we have a number of different
places. If you go to gpo.gov/privacy, it talks about our entire
privacy program, including who you need to talk to over at the
Administrative Office of the U.S. Courts to deal with a court
document that may have issues.
Similarly, just a few years ago, we revamped our Ask GPO
system, which is now powered by a modern contact management
system. And there, we have also got links so that, if folks
find an opinion or something like that that raises an issue,
they can ask about it, we can root that to the proper person
and make sure they get the information to talk to the
Administrative Office of the U.S. Courts to get that particular
record sealed if that is appropriate.
In terms of----
Mr. Raskin. Thank you so much.
I yield back, Madam Chairperson.
Mr. Halpern. Thanks.
The Chairperson. Thanks so much, and I will recognize the
gentleman from Georgia now for his questions for five minutes,
Mr. Loudermilk.
Mr. Loudermilk. Well, thank you, Madam Chairperson.
And, Hugh, it is good to see you again.
Mr. Halpern. Likewise.
Mr. Loudermilk. I appreciate all the work that you are
doing over at GPO. And you said something a few minutes ago
that was music to my ears, and I have been saying this ever
since I have been in Congress. It is a lesson I learned working
in intelligence on the IT side when I was in the Air Force. One
of the primary principles that was just engraved into our every
policy we have is you don't have to secure what you don't have.
If you don't need it, then discard it.
We had procedures built around that to analyze data,
whether we needed it or not. You had to justify keeping it. And
then it was destroyed.
The problem we have--I have been saying this ever since I
have been in Congress, and especially on Financial Services
Committee, as we are dealing with these same issues--is there
is many in Congress and in the Federal Government that aren't
applying that principle, and so much legislation is being
passed that is getting the Federal Government to grab more data
or forcing businesses to acquire more data of individuals, and
somebody is keeping that and storing it as data that does not
need to be kept.
I appreciate hearing you say that because there is very few
government officials or, quite frankly, people in Congress that
you ever hear say that: If you don't need it then don't keep
it.
So, has GPO experienced any data breaches or identified
attempted attacks in recent years?
Mr. Halpern. So yes, on the attack side. No on the breach
side. The good news is my IT security folks were doing their
job, and to the best of our knowledge, we have not had a
breach, certainly during my tenure or even in the years leading
up to it.
Shortly after I became the Director of GPO--I still
remember it--I was at an event on Saturday night at my
synagogue when I suddenly learned that somebody that we believe
affiliated with the Iranians had defaced the front of one of
our sites. The good news is that is all the farther they got.
We were able to restore that site. We are in the process--we
are in the process of moving that over to a more secure
infrastructure.
And, the good news is that my team has a really good
process in place to make sure that our systems are secure. As
updates come out, they are tested thoroughly before we do those
upgrades. So we don't necessarily have--we don't necessarily
have the exposures you might have from unknown vulnerabilities.
So we really work hard to try and get that right.
Mr. Loudermilk. Well, it sounds like you are doing a good
job at that, because, if you would have answered my question
then, ``Well, we haven't had any data breaches and no attempted
attacks,'' I would have said, ``Then you are not doing your
job,'' because I guarantee you, you are being attacked. And, if
you don't know it, then there is something wrong.
Also, the updates, they are crucial. That is what caused
the Equifax data breach, was simply a failure in the IT
department to not do a firmware update that was needed to be
done.
So, I am comfortable with the answers you have given. And
that is why we haven't seen any data breaches. In the thirty
years I spent in IT and data security, I could tell you the
question isn't if you are going to be hacked; it is when. It is
going to happen at some point, and it is a race to stay just
ahead of the bad guy.
I use the analogy of when I used to hunt in Alaska, and we
would go bear hunting. Somebody inevitably would put on a pair
of tennis shoes and say: What that is for? So, well, if we see
a grizzly, I want to have my tennis shoes on.
They say: Well, you can't outrun a grizzly.
They would say: No, I just have to outrun you.
All right? So, it is the same thing, is you have got to
stay ahead of the bad guy and stay one step above someone else
because, if they can't get into you, they will go on to
somebody else.
So, it sounds like I have already heard the answer to this
question, but do you have all the tools you need to keep
carrying out this level of privacy and security, or is there
additional things that we can do in Congress to help?
Mr. Halpern. At the moment, I think we are in pretty good
shape. The things are--we have the flexibility. We have the
tools that we need. Obviously, it is always a question of
resources, but, as we start automating processes here at GPO,
we are really focused on figuring out how we make our dollars
go farther. And that has really been one of the hallmarks of
GPO all through history.
So, we are putting that emphasis on security and trying to
do it with tools we have got. And, where we don't have tools,
we make the investments we need. That is--you know, to some
extent, that is one of our advantages. Only about twelve
percent of our total revenue comes from appropriations. The
rest is what we charge our customers.
So, the State Department expects us to keep their passports
fully secure, and we spend a lot of money doing that. But the
State Department reimburses us for those investments. And the
same with our other customers. We are pretty comfortable with
where we are, but we are always happy to talk about things and
figure out how we can do better.
Mr. Loudermilk. Well, this is an ever-changing environment,
and it is a job that is never done, because once you think that
you are secure and you are not staying on top of it, the bad
guys are going to beat us. Thank you for all you are doing.
Madam Chairperson, I yield back.
The Chairperson. The gentleman yields back.
Mr. Aguilar is recognized for five minutes.
Mr. Aguilar. Thank you, Madam Chairperson.
And thanks, Director Halpern, for the update and the
information. A lot to review here, and I appreciate your
commitment to safeguarding that PII.
What I was kind of interested in is--and you talked about
some of the digital versus the historical documents that you
are in charge to protect. Your testimony kind of speaks to that
and said that 97 percent of the Federal documents now are born
digital.
So, what distinctions does GPO make between the digital
versus paper documents in terms of privacy risks and how they
can be addressed by your team and by the contractors, and how
has that transition been to the Digital Age and the privacy
risks that are associated with that on your operational side?
Mr. Halpern. Thanks so much, sir, for that.
The short answer is that, for new documents that we
produce, we have an airtight system for trying to scan those
documents as we are producing them, looking for PII. As I
mentioned, with the Federal Register, they are under the OPM
policies regarding PII, so there is not a lot that is coming
in.
We do need to check the Congressional Record, and we work
very hard to redact any PII that might appear there. But I
think even Congress is being more circumspect about that stuff
going forward.
Our biggest problem is stuff that exists in the tangible
form, so a printed paper that was printed historically twenty
or thirty years ago, or even a lot longer. And what we are
running into are two issues there. One is, as we are trying to
digitize that information. We are taking committee hearings
from the 1970s or the 1980s and trying to digitize those and
put them on Govinfo.gov.
There, both our contractor and our library team are looking
at those documents. Where they see and where they catch PII, we
are redacting that from the digital copies that go online.
When it comes to those paper documents, we simply don't
have the capacity to literally travel the world to find every
copy of the Congressional Record from the late 1800s forward,
check those volumes for PII, and redact them. So we are, in
some respects, reliant on our partners, the Federal depository
libraries and our other libraries across the world, where a lot
of this information goes.
But, that said, as I mentioned before, I think, because
that information is comparatively hard to access--you need to
go to a physical place, and you need to open a physical volume
to find that--because it is harder to access, that is a little
bit lower of a threat than what is going out in the digital
domain.
It is not a zero threat, but--and, where we find PII, we
try to try and redact it. We just don't have the resources in
terms of people, money, and all those kinds of things to do a
full scrub for every place where one of these paper documents
might exist in the world.
Mr. Aguilar. Understood. And how do you kind of keep--what
is the digital, you know, kind of hygiene? How do you stay
ahead of the evolving threats and the digital privacy landscape
piece of it? Is it through the OPM guidance? Is it through, you
know, contractors, or how do you kind of stay ahead of the
risks that are in front of you?
Mr. Halpern. So, one of the great things about being a
legislative branch agency is we can take the best practices all
across the government. We are not necessarily confined by what
OPM provides.
I know that our IT security team both works with the other
CISOs here in the Legislative Branch as well as broader across
the government. As we do work for our other Federal customers,
we are obviously talking to them, figuring out what their
requirements are, and how we can meet those. So, there is a lot
of variety of avenues for us to be exposed to the sort of
changing landscape and what folks' requirements are, and we are
always going to make sure that our systems are designed in such
a way as to protect the security of those documents.
Whether it is producing smart cards, whether it is the U.S.
passport, one of the reasons that they come to GPO is because
we can produce those documents securely in government
facilities with the highest quality you are going to find any
place in the world and do it at a reasonable price and in a
reasonable timeframe.
So----
Mr. Aguilar. Thanks.
Mr. Halpern [continuing]. We think we have got some
advantages there.
Mr. Aguilar. Thank you so much. Appreciate it.
I yield back, Madam Chairperson.
The Chairperson. Thank you. Mr. Steil is now recognized for
five minutes.
Mr. Steil. Thank you very much, Madam Chairperson.
Mr. Halpern, appreciate you being here today.
Long day on Zoom staring at screens for all of us, and I
think we are all looking forward to getting back in person
before too long. But I appreciate you being here, and I think
maybe in a future Committee hearing, we will get an opportunity
to talk to some of your Legislative Branch colleagues, what is
just a critical issue.
I can't tell you how often I hear from folks across
Wisconsin about the importance of data privacy. They are
thinking about it. They are thinking about being hacked. There
is really a timely Politico article that came out just a little
bit ago talking about our reporters being hacked through apps.
It is nonstop that this is something that we are talking about,
and I think important that we are talking about it here.
The proposed piece of legislation that would mandate GPO
action in the data privacy space, the Online Privacy Act of
2021 that we are talking about, were you consulted in the
drafting of the legislation, specifically Section 5?
Mr. Halpern. We were not consulted on the front end,
although we did have subsequent discussions with the Committee.
From our reading, it is a flexible standard in the proposed
legislation, and it is something that we think we can meet with
the program that we are running today, and it will give us an
opportunity to take a look at and make sure that there is--if
there are any places where we need to tighten things up, we
definitely can do that.
Mr. Steil. Understood. Appreciate your commentary on that.
That is helpful.
Under national data privacy laws, there is really--it is
really kind of a balance in ways to minimize compliance costs
for small businesses while still providing appropriate levels
of protection to individuals. Can you kind of comment on how
you try to strike that balance?
Mr. Halpern. So, for most of our interactions with small
businesses, that is through our print procurement program. And
the requirements there are largely driven by our customers.
Now, that said, there are any number of small and medium
size businesses that can participate in our print production or
print procurement program. To give you an idea, I was just up
in Pennsylvania--I think it was a few months ago--and we
visited with one of our contractors that does a lot of work
with GPO. And we use that contractor specifically because they
have a great system for keeping track of information and
keeping track of documents with sensitive information in it and
give us a great paper trail. They do a fantastic job of
handling those types of jobs for us and doing it in a way where
we are confident that that information is safe and secure.
I think there are some other companies across the country
that can do that work for us. There aren't a ton, to be a
hundred percent honest with you. And, when we have run into
problems where, say, one contractor has experienced labor
shortages, which isn't something that is uncommon these days,
there aren't a lot of other places to go. But some of the small
and medium size businesses that we work with have gotten really
good at having internal systems that can protect that
information. And, frankly, sometimes they do a better job of it
than some of our larger contractors.
Mr. Steil. Great. I appreciate that feedback, Mr. Halpern.
Madam Chairperson, I will yield back.
The Chairperson. The gentleman yields back.
Ms. Scanlon is recognized for five minutes.
Ms. Scanlon. Thank you, Madam Chairperson.
Mr. Halpern, what remedial measures do the GPO have in
place if one of its publications contains nonpublic personal
information about a private individual, especially if it is
sensitive or otherwise potentially harmful in nature?
Mr. Halpern. Absolutely. As I mentioned, we have both
automated and manual systems to redact information that is
found in our digital collection.
So, for instance, let's just say for the sake of argument
something slipped through tonight's edition of the
Congressional Record. There was something that had some PII in
it and all our checks failed. The good news is, when that is
brought to our attention, our team can go in, change the record
in Govinfo.gov, our trusted digital repository, and redact that
information out of the digital record.
We can't really fix the printed copies, but the volume of
those copies for something, say, like the Congressional Record
is much smaller than it was even a decade and a half ago.
So, to give you an idea, in the 1990s, the daily
circulation of the Congressional Record was north of 20,000
copies a day. Today, we are only producing about 1,500 copies a
day. So, it is a much smaller universe in the printed world,
and we have tools in place to fix any problems that might occur
on the back end through our digital systems.
Ms. Scanlon. I mean, when you were talking about the court
systems, that kind of caught my attention, because that is
where I spent my pre-congressional career, and certainly judges
will talk about a lot of facts as they are ruling on a case.
So, you know, would an affected individual have the right or
the ability to get personally identifiable information deleted,
redacted, or otherwise remediated?
Mr. Halpern. So, the way that works right now, it is not
our process; it is the court's process. So, they can petition
the Administrative Office of the U.S. Courts, and it is up to
the judge to decide whether or not to seal those particular
records or parts of a record.
And, depending on that decision, we will either pull the
record out of Govinfo.gov, or put in a redacted version
depending on what the constraints are of the judge's order.
As I mentioned in my testimony, this is sort of that gray
area. It doesn't necessarily fall into the category of the
standard PII, people's Social Security numbers, their other key
identifiers. But it may describe facts that somebody is
uncomfortable with. And, in those kinds of cases, we are not
going to be the best folks to make a decision as to whether
that needs to stay in the public domain or it needs to be
removed. The judge who was involved in that case or another
judge really needs to be the person who makes that decision.
And, depending on what that decision is, we will act
accordingly.
Ms. Scanlon. Well, if it was something within your domain,
is there currently a right of an individual to be able to get
personally identifiable information redacted? If, for example,
a Social Security number or a--I don't know--a credit card
number or something somehow had slipped through, is there a
right to have it removed?
Mr. Halpern. I can get back to you on what the statutory
background is on that. I can tell you, for GPO's policies and
directives, if we come across that information and can redact
it from our--primarily from our digital collection, we are
going to do so. And, if somebody brings that to our attention,
it may not be the person whose information that is. It could be
a third party.
But, if we become aware of that and we--you know, we agree
that that is PII, we will make the effort to redact that from
the digital side.
Ms. Scanlon. Okay. Thank you.
Madam Chairperson, I yield back.
The Chairperson. Thank you.
I now recognize the gentlelady from New Mexico for five
minutes.
Ms. Leger Fernandez. Thank you so very much, Chairperson
Lofgren. And thank you for holding this hearing, because I can
tell you that this issue comes up a lot as I talk to my
constituents. They are concerned, and we are concerned with
regards to the manner in which our data is protected.
Director Halpern, I truly appreciated your comments about
how protection of our personal data held by the government is
linked to people's trust in our government, and I think you
would agree that this link will only grow stronger as more of
our lives move into the digital space.
I also appreciated your comments about how GPO and other
Federal agencies are discussing best practices with each other.
Do you believe that--can you elaborate a bit more on what we
are doing here at the Legislative Branch that we might
strengthen based on the information you are hearing and sharing
with the other Federal agencies so that we can make sure that
we have those protections against the cyber-attacks, as well as
protecting individuals' personal information as you described
it?
Mr. Halpern. Sure. I will do my best.
Then--it happens on a number of different axes is probably
the best way to think of it. As I mentioned before, our
computer information security folks have a lot of back and
forth, and there is a lot of discussion about what are those
best practices, how do we secure our systems?
And, frankly, particularly with GPO and the Congress, there
is a lot of interchange that occurs on a daily basis. You are
sending us information. We are sending it back to you. And we
are working with the Library to make things available via
Congress.gov.
So, there is a lot of discussion about those particular
flows, and, frankly, what our CISOs are experiencing day to
day: Where are these attacks coming from? How do you secure
against them? And what are the appropriate countermeasures?
The other area that we are working on is our obligation as
an employer. So, I just got the update this morning. Right now,
we are at 1,547 people working directly for GPO, plus, you
know, a few hundred contractors. We have an obligation to
secure that information--payroll information, health
information, all sorts of things.
The Chief Administrative Officer of the House has a similar
obligation. So our officials are talking all the time about how
we--how we maintain our systems both from the cyber standpoint
and from the more mundane operational standpoint.
And as I mentioned before, my safety and security team
literally walk our building. We have a million square feet
under roof, and we walk every inch of that building. And one of
the things that they look for is, is there PII not being stored
properly?
That is a little bit harder to do in the congressional
space. You know, I spent thirty years working in the House, so
it is a little bit different there. But, some of those same
practices, whether it is the Chief Administrative Officer or
the Secretary of the Senate or House Sergeant at Arms, all of
us are talking all the time to try and figure out what is the
best way forward? And there is a lot of information sharing
that goes on.
Ms. Leger Fernandez. Thank you so much. And I take it that
you have no control over, you know, the fact that--and I think
we will hear testimony that every search is saved and mined,
right? So, as individuals might be searching within the
Congressional Record for information, that--tell me, do we--do
you have any way of protecting any of those searches, or is
that something that is left to the individual with regards to
his or her computer use and privacy settings?
Mr. Halpern. So, it is a great question, and I will get you
a more detailed answer as to the information we retain and
don't retain.
The short answer is, is we try to retain the minimum amount
of information we possibly can about searches in Govinfo.gov or
any of our other systems.
So, for instance, in the case of Govinfo.gov, we use the
smallest, most mundane kinds of cookies we possibly can. We
don't track people across the internet. And, frankly, unlike
Congress.gov, we don't have logins, we don't persistently save
those searches for folks.
That said----
Ms. Leger Fernandez. I see my time has expired. I do thank
you and your organization for respecting, as is proper, the
privacy of the users in the documents and in the searches.
I yield back, Madam Chairperson.
The Chairperson. Thank you.
Just a couple of further questions.
First, Director Halpern, I just want to commend you and
your staff for your proactive work protecting privacy. It is
admirable. And in your statement, you said you can't, if you
don't save the material, it can't be abused.
And that is the principle of the Online Privacy Act, to
really prevent the unnecessary retention of information,
because if you don't have it, you can't data mine it, you can't
abuse it.
And that is what you are doing in your agency and something
that I think we want to look at. Because if you are using a
search engine to search something in the Congressional Record,
the search engine retains it, even though you don't.
And so, government--you are doing the right thing, but
people's searches or inquiries can still be abused and
manipulated.
Just two quick questions.
First, really you are doing everything with NIST and OMB
guidance and your directives. You are doing that because you
want to do the right thing. But it is not--your policies are
not required by law at this time, are they?
Mr. Halpern. No. The short answer is, it is one of the
blessings and curses of being in the Legislative Branch.
I actually, am a big Article I guy, so I like the
flexibility that this gives us to survey the landscape and pick
the policies that meet our values.
Our values are we are going to protect our customer. We are
going to be transparent with folks. And we are going to do
everything we do, whether it is with our folks here in the
building or our customers, in a respectful way. And part of
being respectful is protecting that data.
The good news is, while there may not be pure statutory
requirements that say you have to do this, one, we believe that
our oversight committees expect us to do this, and it is the
right thing to expect. And two, our customers expect us to do
it.
And both of those are driving imperatives for us here at
GPO, and it helps us get into the position where it is easier
for us to do the right thing that we were planning to do
anyway.
The Chairperson. All right.
Just one final question. In your written testimony, you
mention that GPO distinguishes between high impact and low
impact personally identifiable information. I am interested in
how or whether you reevaluate the level of risk for different
types of PII that may change over time.
And as you classify that, do you consider the potential
impact when information is aggregated by third parties in
combination with other personally identifiable information, for
example, using machine learning or other data processing
techniques that are outside of your agency?
Mr. Halpern. We are always trying to learn. And there are
a lot of very clever folks across the country who are coming up
with new ways to use that sort of ubiquitous data that is out
there. But we do draw a distinction between certain kinds of
PIIs.
So, for instance, those unique identifiers, your Social
Security number, the card numbers, or passport numbers that the
Department of State or Department of Homeland Security use,
those are key pieces of information that have the potential to
unlock so much else, including biometrics and a whole slew of
other things. We are going to work much harder to protect that
information.
Lower impact data are things like addresses, photos, names,
and that stuff is really kind of ubiquitous. So, for instance,
when you do a special order and you are congratulating the
coach of your high school football team, you are going to call
that person by that name, and that is PII. But we are not going
to redact that from the Congressional Record, because that,
one, isn't a huge security risk, and two, if we did, it totally
eviscerates the point of that special order.
The Chairperson. Exactly.
I want to thank you, Director Halpern, for your great
testimony today. And as you know from your years here on the
Hill, we do keep the record open if we have additional
questions. So, if that occurs, we will send them right on to
you and I know you will get back to us.
I just want to thank you for being here with us today. It
has been very informative. And please let your team know how
much we think of them and how proud we are of them.
Mr. Halpern. Thank you very much, ma'am. I really
appreciate it.
The Chairperson. Thank you.
We will now go to our second panel of witnesses and let me
briefly introduce them.
First, we have Shoshana Zuboff, who is the Charles Edward
Wilson Professor Emerita at Harvard Business School.
Professor Zuboff is an internationally recognized expert
and the author of several major works on digital privacy
issues, such as ``In the Age of the Smart Machine: The Future
of Work and Power'' and ``The Support Economy: Why Corporations
Are Failing Individuals and the Next Episode of Capitalism.''
Her most recent book, ``The Age of Surveillance Capitalism:
The Fight for a Human Future at the New Frontier of Power,''
investigates the new surveillance economy, which is driven by
consumer data.
Our next witness is Caitriona Fitzgerald, who is the Deputy
Director at the Electronic Privacy Information Center, or EPIC.
She leads EPIC's policy work, working to advance strong
privacy, open government, and algorithmic fairness and
accountability laws. She recently authored, ``Grading on a
Curve: Privacy Legislation in the 116th Congress,'' which sets
out the key elements of modern privacy law, including the
creation of a U.S. data protection agency.
The next witness is Marshall Erwin, who is the Chief
Security Officer of Mozilla, where he focuses on data security,
privacy, and surveillance.
He has previously worked as a counterterrorism and
cybersecurity analyst and has served as the counterterrorism
and intelligence adviser to Senator Susan Collins on the Senate
Homeland Security and Government Affairs Committee and was the
intelligence specialist at the Congressional Research Service.
And finally, we have Daniel Castro, Vice President of the
Information Technology and Innovation Foundation, or ITIF, and
the Director of the Center for Data Innovation, an ITIF-
affiliated research institute focusing on the intersection of
data technology and public policy.
I will remind the witnesses that your entire written
statements--which, by the way, are excellent--will be included
and made part of our permanent record, and that that record
will remain open for at least five days for additional material
to be submitted.
We ask that you summarize your testimony in five minutes so
that the Members of the Committee will have time to pose
questions to you.
So, first, Professor Zuboff, we would love to hear from you
for five minutes.
STATEMENTS OF MS. SHOSHANA ZUBOFF, CHARLES EDWARD WILSON
PROFESSOR EMERITA, HARVARD BUSINESS SCHOOL; MS. CAITRIONA
FITZGERALD, DEPUTY DIRECTOR, ELECTRONIC PRIVACY INFORMATION
CENTER; MR. MARSHALL ERWIN, CHIEF SECURITY OFFICER, MOZILLA
CORPORATION; AND MR. DANIEL CASTRO, VICE PRESIDENT, INFORMATION
TECHNOLOGY AND INNOVATION FOUNDATION
STATEMENT OF SHOSHANA ZUBOFF
Ms. Zuboff. Chairperson Lofgren, Ranking Member Davis, and
Members of the Committee, thank you so much for this
opportunity to discuss the challenges of privacy, privacy law,
in a world without privacy.
I have spent the last 43 years of my life studying the rise
of the digital as an economic force that is driving our
transformation into an information civilization. Over these
last two decades, I have observed as the fledgling internet
companies morphed into a sweeping surveillance-based economic
order founded on the premise that privacy must fall, empowered
by economic operations that I have called surveillance
capitalism.
Surveillance capitalism maintains core elements of
traditional capitalism--private property, commodification,
market exchange, growth, and profit--but these cannot be
realized without the technologies and social relations of
surveillance.
Hidden methods of observation secretly extract human
experience, until recently considered private, and translate it
into behavioral data. These methods operate outside of human
awareness, engineered to do so, robbing actors of the right to
know and with it the right to combat.
Ill-gotten human data are then immediately claimed as
corporate property, private property, available for
aggregation, computation, prediction, targeting, modification,
and sales.
The theory of surveillance capitalism challenges this
property claim and redefines it as theft. Surveillance
capitalism was invented at Google during the financial
emergency of the dot-com bust. It migrated to Facebook, became
the default model of the tech sector, and is now reordering
diverse industries, from insurance, retail, banking, and
finance, to agriculture, automobiles, education, healthcare,
and much, much more.
As one tech executive recently described it to me, all
software design assumes that all data should be collected, and
most of this occurs without the user's knowledge.
All roads to economic and social participation now lead
through surveillance capitalism's institutional terrain, a
condition that has only intensified during these two years of
global plague.
The abdication of these spaces to surveillance capitalism
has become the meta crisis of every republic because it
obstructs solution to all the other crises for which we require
information integrity and the sanctity of communications.
The world's liberal democracies now confront a tragedy of
the ``un-commons'' as mission critical information in
communication spaces, that most people have assumed to be
public, are now owned, operated, and mediated by private
commercial interests for profit maximization, while almost
entirely unconstrained by public law. No democracy can survive
these conditions.
The deficit I describe here reflects a larger pattern. The
United States and the world's liberal democracies have thus far
failed to construct a coherent political vision of a digital
century that advances democratic values, principles, and
government, while the Chinese, for example, in contrast, have
focused on designing and deploying digital technologies in ways
that advance their system of authoritarian rule.
This failure left a void where democracy should be, leaving
our citizens now to march naked into the third decade of
surveillance capitalism without the rights, laws, and
institutions necessary for a democratic digital future.
Instead, we have stumbled into an accidental dystopia, a
future that we did not and would not choose. In my view, we
must not and cannot allow this to be our legacy.
Survey evidence, some of which has already been referred to
here, now shows that Americans are moving ahead of their
lawmakers in a massive rupture of faith with these companies.
We see extraordinary majorities calling for action to curb
the unaccountable social power of these firms, a realization
that the emperor of surveillance capitalism not only has no
clothes, but is dangerous, and a clear sense that human rights,
the durability of society, and democracy itself are on the
line. What was undiscussable has become discussable. What was
settled is now being questioned.
To end, we are still in the very early days of our
information civilization. This third decade is a crucial
opportunity to build the foundations for a democratic digital
century. Democracy may be under siege, but it is, however
paradoxically, the kind of siege that only democracy can end.
Thank you so much for your attention.
[The statement of Ms. Zuboff follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairperson. Thank you very much, Professor.
Let me call now on Ms. Fitzgerald for her testimony for
five minutes.
STATEMENT OF CAITRIONA FITZGERALD
Ms. Fitzgerald. Thank you, Chairperson Lofgren, Ranking
Member Davis, and Members of the Committee. Thank you for
holding this important hearing and the opportunity to testify
today.
I am Caitriona Fitzgerald, Deputy Director at the
Electronic Privacy Information Center, or EPIC.
EPIC is an independent, nonprofit research organization in
Washington, D.C., established in 1994 to protect privacy,
freedom of expression, and democratic values in the Information
Age. For over 25 years, EPIC has been a leading advocate for
privacy in both the public and private sectors.
The United States faces a data privacy crisis. Large and
powerful technology companies invade our private lives, spy on
our families, and gather the most intimate details about us for
profit. These companies have more economic and political power
than many countries and States.
Through a vast, opaque system of databases and algorithms
we are profiled and sorted into winners and losers based on
data about our health, finances, location, race, and other
personal information.
Private companies are not the only problem. Government
agencies have also dramatically increased the collection and
use of personal data, often purchased, or obtained from those
same private companies, while failing to address the
significant risks to privacy and cybersecurity.
The impact of this uncontrolled data collection and use by
both private companies and the government is especially harmful
for marginalized communities, fostering systemic inequities.
These industries and systems have gone unregulated for more
than two decades, and this is where it has left us. The system
is broken. Technology companies have too much power and
individuals have too little.
To restore the balance, we need comprehensive baseline
privacy protections for every person in the United States,
changes to the business models that have led to today's
commercial surveillance systems, and limits on government
access to personal data. Most crucially, we need strong
enforcement of privacy protections.
In my written statement I go into detail about the crisis
we face and the elements of a strong privacy law, but I want to
focus here on the importance of enforcement.
Without strong enforcement, many businesses will simply
ignore privacy laws and accept the small risk of an enforcement
action as a cost of business, as we have seen with privacy laws
enacted in Europe and in several States.
Strong enforcement must include a private right of action.
This is not new. Congress included private rights of action in
the Cable Communications Privacy Act, the Video Privacy
Protection Act, FCRA, TCPA, and the Driver's Privacy Protection
Act. The statutory damages set in those privacy laws are not
large in individual cases, but they really provide powerful
incentives for companies to comply with privacy laws.
Strong enforcement also requires Congress to establish an
independent data protection agency, or a DPA. The United States
is one of the few democracies in the world that does not have a
data protection agency. U.S. companies are leaders in
technology, and the U.S. Government should be a leader in
technology policy.
When you think about the omnipresence of technology in our
lives and our economy, it seems obvious that we should have
Federal agencies dedicated to overseeing and regulating it.
A data protection agency could promote innovation and
competition while protecting privacy by setting rules that help
level the playing field for smaller technology companies who
currently struggle to compete with tech giants.
A DPA could also be a central authority within the Federal
Government on privacy issues. We saw a glaring example of
agency failure to properly consider privacy risks of data
collection just this month. The IRS sparked outrage after a
report surfaced that it had contracted with third-party vendor
ID.me to require taxpayers to submit to facial recognition to
access tax records online.
Thankfully, following pressure from advocates and Members
of Congress, the IRS backtracked, but this contract should have
never been signed in the first place. A DPA could ensure that
privacy is carefully considered when agencies are weighing
contracts like this.
There is broad support for this idea. A recent Data for
Progress poll showed that 78 percent of Americans across the
political spectrum support establishing a data protection
agency.
The good news is that Congress, and indeed this Committee,
has a strong bill before it that would restore privacy online
for Americans.
The Online Privacy Act, filed by Chairperson Lofgren and
Representative Eshoo, is a comprehensive framework that would
place strict limits on the collection and use of personal data,
extend civil rights protections online, and establish strong
enforcement mechanisms via a private right of action and the
creation of a U.S. data privacy agency.
EPIC recommends swift action on the Online Privacy Act.
There is widespread bipartisan agreement that we need a Federal
privacy law. It is time for Congress to act.
Thank you for the opportunity to testify today.
[The statement of Ms. Fitzgerald follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairperson. Thank you very much, Ms. Fitzgerald.
We will turn now to you, Mr. Erwin, for your testimony for
five minutes.
STATEMENT OF MARSHALL ERWIN
Mr. Erwin. Thank you, Chairperson Lofgren, Ranking Member
Davis, and Members of the Committee. Thank you for offering me
the opportunity to testify today.
My name is Marshall Erwin. I am the Chief Security Officer
at Mozilla.
Mozilla is a nonprofit organization and open-source
community. Our products, including the Firefox browser, are
used by hundreds of millions of people around the world.
Mozilla is constantly investing in security and privacy and
advancing movements to build a healthier internet.
Now, in our view, privacy online is a mess today. Consumers
are constantly under attack. They are stuck in a vicious cycle
in which their data is collected without their knowledge or
understanding, then shared to build profiles about them. That
data is then used to target and manipulate them in ways that
can be actively harmful.
Today I am going to talk about what Mozilla is doing to
address this problem and then what we think Congress needs to
do.
In the Firefox browser there have been two focus areas for
us.
The first is that we have been driving major initiatives,
such as the standardization of TLS 1.3 or founding Let's
Encrypt, a free nonprofit certificate authority. This has
resulted in an increase in encrypted web traffic up to almost
85 or 95 percent from below fifty percent a few years ago.
What this is doing is protecting your browsing activity and
your information from attackers in the middle of a network who
would otherwise collect that information to use it to build a
profile about you.
The second big area of focus for us has been on eliminating
what we call cross-site tracking. These are parties following
you around from the website to website that you visit, again
collecting your information about your browsing activity and
then building that profile about you.
In 2019, we turned on what we called Enhanced Tracking
Protection in the browser, turned that on by default because we
believe the onus shouldn't be on consumers to protect
themselves from opaque risks they can't see or understand.
So that is just a little bit of what we have been doing to
try to address this problem. I want to talk a little bit about
what we think Congress needs to do, first focusing on baseline
Federal privacy legislation, and then talk a little bit about
transparency into online harms.
First, in our view, technical privacy protections from
companies and baseline regulations are complementary and
necessary. Neither alone are sufficient. The internet was not
designed with privacy and security in mind, which is why
technical solutions like the ones that we offer are necessary
to create a less permissive environment overall.
At the same time, we can't solve every privacy problem with
a technical fix. There is an essential role for regulation here
as well.
To give you just one example, we know that dark patterns
are pervasive across the software and applications that people
use. Unfortunately, there is little that a browser can do when
a person visits a website directly and then is deceived into
handing over their information without proper consent or
understanding.
And this is where law plus a robust enforcement regime must
step in. That is why provisions like the one in the Online
Privacy Act, which would prohibit dark patterns, are so
critical.
More generally, Mozilla supports privacy and data
protection laws around the world, including in the United
States. The U.S. must enact baseline privacy protections to
ensure that the public and private actors treat consumers
fairly. We need clear rules of the road for entities using
personal data, strong privacy rights for people who are
interacting with those entities, and effective authorities,
agencies with the authority to take enforcement action.
Second, it is important to complement Federal privacy
legislation with solutions that provide direct transparency and
accountability into online harms.
Many of the harms that we see today are a direct result of
the pervasive data collection happening. We know from recent
whistleblower disclosures things like recommendation systems
and targeting systems can have pernicious effects if abused.
These systems are really powered by people's data. It is
easier to discriminate against people, manipulate people, or
deceive people if you know more about them. Therefore privacy
and some of these online harms are really inherently linked.
The problem is that this harm is mostly hidden from the
public and from regulators. That is why we have called for
things like an establishment of a safe harbor to protect
researchers doing investigations into the activities of major
online platforms.
This would protect research into the public interest and
help us better understand the harm happening on these
platforms. There is a real public benefit that can be had here
by such a safe harbor.
Similarly, we have advocated for more robust disclosure
regimes governing online ads. We have been leading the push for
full ad disclosure in the European Union. We are encouraged by
recent proposals in Congress that would require disclosure of
ads for public benefit and understanding.
These approaches would provide transparency into the opaque
world of online advertising. It is necessary, and we think it
could be done without creating privacy risks.
In conclusion, at Mozilla we seek to advance privacy
technology and to ensure that privacy considerations are at the
forefront of policymakers' minds in considering how to protect
consumers and grow the economy.
We appreciate the Committee's focus on these issues and
look forward to the discussion.
[The statement of Mr. Erwin follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairperson. Thank you, Mr. Erwin.
And now we turn to our last but certainly not our least
witness, Mr. Castro, for your testimony for five minutes.
STATEMENT OF DANIEL CASTRO
Mr. Castro. Thank you. Chairperson Lofgren, Ranking Member
Davis, and Members of the Committee, I appreciate the
invitation to speak with you today.
U.S. data privacy is at a crossroads. Many consumers are
justifiably frustrated by the frequency with which they learn
about new data breaches and the seeming lack of accountability
for those who misuse their personal information.
At the same time, many firms are overwhelmed by a tsunami
of new data-protection obligations and growing restrictions on
how they can use personal information for legitimate business
purposes. All are often confused by the multitude of ever-
changing laws and regulations.
Three States, California, Virginia, and Colorado have
passed comprehensive data privacy legislation, and many other
States are considering it. Over the past three years, 34 State
legislatures have introduced a total of 72 bills and more are
coming.
These new State privacy laws can impose significant costs
on businesses, both direct compliance costs and decreases in
productivity, and undermine their ability to responsibly use
data to innovate and deliver value to consumers.
Moreover, these laws create high costs, not just for in-
State businesses, but also for out-of-State businesses that can
find themselves subject to multiple and duplicative laws. For
example, California's recently enacted privacy law will likely
cost $78 billion annually, with California's economy bearing
$46 billion and the rest of the U.S. economy bearing the other
$32 billion.
In the absence of Federal data privacy legislation, the
growing patchwork of State privacy laws could impose out-of-
State costs between $98 billion and $112 billion annually. Over
a ten-year period, the costs would exceed $1 trillion. The
burden on small businesses would be substantial, with U.S.
small businesses bearing $20 billion to $23 billion annually.
The United States needs a new Federal data privacy law, but
it should not back away from the light-touch approach it has
historically taken to regulating the digital economy. Instead,
it should focus on the following goals.
First, data privacy legislation should establish basic
consumer date rights. For example, Congress should give
individuals the right to know how organizations collect and use
their personal data or when their information has been part of
a data breach.
Congress should also give consumers the right to access,
port, delete, and rectify their sensitive data in certain
contexts. For example, consumers should have a right to obtain
a copy of their health or financial data and move it to a
competing service.
Second, lawmakers should establish uniform privacy rules
for the entire Nation by preempting State and local privacy
laws. Consumers should have the same protections regardless of
where they live, and companies should not be faced with 50
different sets of laws and regulations.
A patchwork of State laws, with varying definitions and
standards, creates a complex regulatory minefield for
businesses to navigate, especially if potential violations risk
costly litigation.
Third, Congress should ensure there is robust and reliable
enforcement of Federal privacy law. Congress should not create
a private right of action, and instead rely on Federal and
State regulators to hold organizations accountable.
Illinois, which has a private right of action for its
biometrics law, has seen hundreds of lawsuits in the past two
years even when there has been no consumer harm.
And, to avoid unnecessary litigation, businesses should
have a reasonable period to address a violation without penalty
in cases with no demonstrable consumer harm, such as a sixty-
day notice-and-cure period.
Fourth, Congress should set a goal of repealing and
replacing potentially duplicative or contradictory Federal
privacy laws. The U.S. Code right now is littered with privacy
statutes, from major sections on health and financial data to
narrow ones on video rental histories, and each one has its own
set of definitions and rules to comply with.
Finally, Federal data privacy legislation should minimize
the impact on innovation. To that end, Congress should not
include data-minimization, purpose-specification, or privacy-
by-design requirements because these provisions can reduce
access to data, limit data sharing, and constrain its use,
thereby limiting beneficial innovation.
Congress has the benefit of hindsight to avoid some of the
problems found in other data privacy laws, particularly
Europe's GDPR, or General Data Protection Regulation. The GDPR
has imposed massive compliance costs on businesses, not only in
the EU, but around the world. For example, Fortune 500
companies have spent nearly $8 billion to comply with the GDPR.
Unfortunately, the GDPR has not delivered on many of its
goals. For example, the EU's own surveys show that the law has
had virtually no impact on consumer trust in the internet. A
majority of companies also report that some of the most
expensive requirements, like appointing a data protection
officer, serve no valuable business function.
Policymakers should also be aware of the unintended
consequences of poorly crafted legislation, such as not
considering the implications of a law on emerging technologies
like artificial intelligence and blockchain.
Finally, Congress should note that the primary purpose of
the GDPR was to harmonize data protection laws across EU member
states. Ironically, as States pursue their own laws, they are
creating the exact type of fragmentation in the U.S. that the
EU created the GDPR to solve.
So, therefore, it is essential for Congress to act swiftly
to pass comprehensive privacy legislation that preempts State
laws, streamlines regulation, establishes basic consumer data
rights, and minimizes the impact on innovation.
Again, thank you for the opportunity to be here today. I
look forward to any questions.
[The statement of Mr. Castro follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairperson. Thank you very much, Mr. Castro, and to
all our witnesses.
We will go now to Members of the Committee who may have
questions, and I will turn first now to our Ranking Member, Mr.
Davis.
Mr. Davis. Thank you, Madam Chairperson.
And thanks again to our witnesses. Enjoyed your testimony.
Mr. Castro, let me start with you.
There have been proposals introduced in Congress that if
implemented would create a private right of action for
individuals and a collective right of action for certain
nonprofits to sue on behalf of individuals. Is this the best
approach to ensure protection and accountability for a Federal
data privacy framework?
Mr. Castro. No, I don't think it is. Right now, we have a
very effective regulator in the FTC and we have State attorney
generals that can obviously also take up that slack.
What we have seen in States that have implemented these
private rights of action, like with the Biometrics Information
Privacy Act, once a court ruled that you could bring lawsuits
under this for cases where there is no actual harm to
consumers, we saw a flood of lawsuits. And these lawsuits are
being driven by class action lawsuits where they are just going
after the attorney fees, and this has led to very significant
fines without any real payoff for consumers.
So, in the past year we have seen over $100 million in
settlements for companies like Facebook, ADP, Walmart, Six
Flags, Wendy's, TikTok, and the list goes on. And these aren't
instances, again, where we have seen any consumer harm. It was
pure technical violations.
That is not an effective use of dollars that could be going
back into investing in technology and processes that would
protect consumers' privacy, make it more secure, and protect
them from harm.
So, a private right of action, to me, is just taking money
out that could be used on actual protections for consumers.
Mr. Davis. Well, thank you, Mr. Castro.
Hey, I am sure you have read the media reports about
Special Counsel John Durham's allegations that Democrat
political attorneys perhaps, Marc Elias specifically,
infiltrated servers at The Trump Organization and at the White
House.
Would nationwide data privacy legislation have protected
President Trump from these data espionage attempts?
Mr. Castro. Well, it depends. Certainly, privacy
legislation would restrict what companies might be able to keep
on hand and what they might share.
But at the end of day, what you really want to see if you
want better security is better transparency, so consumers know
what they are getting. In this case, The Trump Organization,
the Trump campaign, would know what kind of security and
privacy controls they are getting when they purchase a service,
and they will know how their data could be shared.
And so, getting more transparency is really what we should
be looking for in the future.
Mr. Davis. Well, I agree, transparency matters. But so do
penalties for bad actors if these allegations are borne out.
Do you know if the FTC would have any enforcement penalties
if these allegations were borne out?
Mr. Castro. The FTC can impose penalties on companies for
violations. Particularly the way this works right now is most
companies have statements in their privacy policies, their
terms of service, that say, we respect your privacy, and we are
going to secure your data. And when they do not do that, that
is a misrepresentation, and the FTC can and has gone after
companies for that.
We can certainly consider giving the FTC more authority.
Certainly, if we are increasing their budget, I think we should
be saying exactly what we want them to be doing with that
additional money. I think that is the best way to go forward.
What we don't want to do, I think, is give the FTC too much
latitude, though, to start doing its own rulemaking that goes
outside of congressional intent, because it becomes very risky,
that the FTC might decide that they want to start deciding how
companies should design their websites or how they should be
designing their mobile apps, all under the name of maybe
ensuring consumers aren't being manipulated. But on the other
hand, the FTC is not made up of engineers and user experience
designers.
Mr. Davis. Very good points. But this agency does exist to
address concerns already.
The Online Privacy Act of 2021, a bill referred secondarily
to this Committee, calls for the creation of a new Federal
agency called the Digital Privacy Agency.
Not only is this a clear example of Congress shifting its
legislative authority to the executive branch, but it also
seems like an extreme waste of resources given the existing
structure already established in the Federal Trade Commission
and with the States' attorneys general.
Mr. Castro, do you believe that a new Federal agency is
necessary to accomplish the goal of data privacy?
Mr. Castro. I think the FTC has the authority it needs and
the reputation and experience to do this job. I don't think we
need a new agency to solve that problem.
I would also mention that when we think about protecting
consumer privacy, this overlaps with fraud and security, and
that is something the FTC is also focused on or should be
focused on. And I think if we split up that mission, we weaken
protection for consumers.
Mr. Davis. Well, Mr. Castro, thanks for joining us, and to
all the witnesses.
I yield back the balance of my time, Madam Chairperson.
The Chairperson. Thank you.
Mr. Raskin, you are now recognized five minutes.
Mr. Raskin. Thank you, Madam Chairperson.
Ms. Fitzgerald, I was eager to ask you the question about
the aggregation of data, about how the aggregation and
processing of data in large quantities can pose risks that
might not be apparent when we are just talking about a single
piece of discrete information. I am wondering what can be done
about that.
Ms. Fitzgerald. Thank you, Representative Raskin.
I think the lesson we can take from all these data points
being combined about us is, one, it shows how important it is
to have a comprehensive privacy law that covers personal data
generally rather than the sectoral laws--HIPPA, FCRA, COPPA,
FERPA, the acronyms go on and on--that leave huge gaps in
protection for personal data not covered by those laws.
And these flows of personal data also show why notice and
consent doesn't work. The breadth of the commercial
surveillance industry is just impossible for the vast majority
of internet users to fully grasp. A user may consent to have
the website they are visiting use their data, but does that
mean they are consenting to that data being passed on to
hundreds of data brokers they have never heard of?
We saw an example of this last summer when a Catholic
priest was outed by a news outlet who obtained supposedly
anonymized location data from the dating app Grindr. I know
that following that revelation you and Rep. Porter sent a
letter to the FTC and FCC, signed by a few members of this
Committee, asking them to conduct a rulemaking to strengthen
privacy protections for location data. And that is something
that could also be integrated into privacy legislation.
Mr. Raskin. Thank you much.
Ms. Zuboff, I have read your book about surveillance
capitalism. I know it is hard to synthesize an entire book, but
who is Big Brother today? Is Big Brother the state as we have
traditionally conceived it, or is Big Brother corporate--the
corporate sector, or is it some combination thereof?
Ms. Zuboff. Well, thank you so much, Representative Raskin.
I am flattered and thrilled to hear that you have read my book.
So, thank you for that as well.
As you know, because you have read the book, I develop a
concept that I call Big Other. So Big Brother was a notion of a
totalitarian state, which had a very specific ideology and
wanted people to believe certain things and talk in certain
ways and act in certain ways.
We have surveillance capitalism, not a totalitarian state.
Surveillance capitalism really doesn't care what you think. It
doesn't care what you believe. It doesn't care how you act.
What it does care about is that you think and believe and
act in ways that it can capture the data to do the aggregation
that you are asking about, because with that aggregation is the
possibility of computation, applying artificial intelligence,
coming up with predictive algorithms, targeting methodologies.
With those targeting methodologies, various functions are
achieved, including increasing engagement, which is a euphemism
for increasing the footprint for greater data extraction.
And also, as we increase engagement, using our knowledge
from this deep computation, AI, using our knowledge about you
for things like subliminal cues, psychological microtargeting,
engineered social comparison dynamics, so we really, really
know a lot about you.
And that way we can use messaging and different--not only
the content of messaging, but the forms of messaging, to
actually begin to modify your behavior, and to do that in a way
that is consistent with the commercial objectives of the
company and its business customers.
So, at the end of the day, this Big Other is a--sorry. I
will just wrap it up with the notion that this Big Other is
ubiquitous, is pervasive, it is not totalitarian, but it is
full-on control, and full-on opacity, full-on power.
Mr. Raskin. We haven't yet enacted a comprehensive Federal
privacy statute to address the rise of the Big Other. But a lot
of States and some other countries have attempted to do so.
I wonder if you can just tell us what you think have been
the best lessons and the best efforts at a comprehensive
privacy framework to protect us individually, but also to
protect the people's possession of interest and ownership of
their own characteristics and their own behavior.
Ms. Zuboff. Well, the gold standard right now, and we
couldn't have said this a few weeks ago, but the Digital
Services Act and the Digital Markets Act in the EU. These are
not the total solution. We have very specific things to
accomplish ahead of us.
As far as setting a new standard, defining a new frontier
for the kinds of rights--when I use the word ``users'', I try
to do it with air quotes, because users is all of us. Users is
kind of the synonym for humanity at this point.
And these pieces of legislation, they are ambitious, they
are comprehensive, they have the buy-in of the European
Parliament now and the member states. A few details left to be
worked out in the spring.
But these set a new standard for rights of users, the
enforcement powers of a government to really for the first time
put democratic governance back in control of our information
and communication spaces, to work with the private sector,
rather than have the private sector as what it has been for the
past two decades, a completely autonomous force, essentially
unimpeded by relevant law.
And all the social harms that we have been describing this
afternoon are the result of that situation.
The Chairperson. Thank you so much. And the gentleman's
time has expired.
We will turn now to the gentleman from Georgia, Mr.
Loudermilk for five minutes.
Mr. Loudermilk. Well, thank you, Madam Chairperson.
And it is a very interesting topic that we are talking
about, I have been dealing with for quite some time.
Mr. Castro, one of the issues that I have seen from a
financial services perspective, and I assume it is going to be
the same here, is the multitude of data privacy standards and
laws we have across the country in the different States.
You mentioned in your testimony that there were 34 State
legislatures that introduced bills in the space from 2018 to
2021. I want to get your thoughts on the importance of having a
uniform Federal standard for data privacy that would go across
the board.
Mr. Castro. Yes. I really appreciate that question. Thank
you so much, Representative Loudermilk.
For I think so many companies, especially the smaller
companies, when you think about data privacy, we are often--I
think the first thing people think about are Facebook and
Google.
But these laws impact everyone. They impact the local
florist, the barber shop, the grocery stores. And complying
with those laws can be very expensive and very difficult,
because even though at the end of the day most of these laws
are basically saying the same thing, they say it all a little
differently.
And actually, complying with those laws so that you are not
held in violation, so that, especially if there is a private
right of action, so that you are not sued for making technical
violation if you have not, for example, put a certain term up
on your privacy policy on your website, you might be in
violation of California's law.
All these obligations add costs for businesses. And these
businesses, instead of hiring another engineer or giving a
raise to their workers, they must go out and hire a privacy
lawyer. A lot of the privacy lawyers really like privacy laws
because it is good business for them.
And the issue here is we don't need more laws, we need one
good law. I am glad to see we are having this conversation,
because I think we can get to that one good law. Hopefully we
can get there sooner rather than later, because the more we
wait the higher those costs get.
Mr. Loudermilk. So, what kind of effect does this have on
American competitiveness in the international marketplace?
Mr. Castro. It is very significant right now. When we think
about--a lot of U.S. companies are doing a very good job with
protecting privacy better than, for example, companies in
China. But because the U.S. does not have a Federal law and we
have taken a sectoral approach and other countries have not
taken that sectoral approach, a lot of countries will say the
U.S. doesn't care about privacy.
I don't think that is true. I don't think that is true in
terms of when I hear the FTC defending the work that they are
doing. I think they are doing very respectable work. I think
the State attorney generals are doing great work. I think some
of the State laws can even be effective.
And so, I don't think it is fair to say the U.S. isn't
doing good work on privacy. But we don't have a national
privacy law. And so, so often that fact is used to say a U.S.
company should not get a particular contract.
We are seeing that used right now. That is hurting
transatlantic data flows in part because European lawmakers are
saying the U.S. isn't doing enough to protect consumer privacy.
So, I think one of the best ways we can promote U.S.
competitiveness, again not just from the tech sector but across
the board, is to create this Federal law so that we can show
the U.S. is taking this seriously.
Mr. Loudermilk. I think everybody on this Committee is
committed to and I think most individuals recognize the
importance of protecting personal data and an individual's
privacy. Definitely, I do as well, and I know you do.
But with that being said, you mentioned in your testimony a
concern that I share as well, which is the compliance cost to
small businesses due to State privacy laws.
Is there a State that you can point to that has
successfully executed a data privacy law that balances those
concerns?
Mr. Castro. I think Virginia is probably the closest we
have gotten so far. They are trying to strike the right
balance.
Again, the biggest problem is that when you see these State
laws, the State legislatures are not thinking about the costs
that would be borne by States outside their borders.
And so, again and again, as we see each new State go down
this path, they are putting up laws that force companies to go
rehire lawyers, to ask them to reevaluate their privacy
policies, make technical changes to their systems, all the same
compliance, again, without any discernible improvement in
actual consumer privacy.
And so, if the goal is consumer privacy, let's address this
top down rather than have fifty different rules for how to do
it and have so much more consumer confusion about what is going
on and who is protecting your data.
Mr. Loudermilk. All right. I agree wholly.
I see my time is quickly running out. So, thank you for
that.
And, Madam Chairperson, I yield back.
The Chairperson. The gentleman yields back.
Mr. Aguilar is recognized for five minutes.
Mr. Aguilar. Thank you, Madam Chairperson.
Mr. Erwin, I wanted to talk with you a little bit about the
lessons that Mozilla has learned from its own experience in
building privacy-protective tools. That may be relevant to us
here in the public sector and for government agencies that we
have oversight over to consider how they are going to handle
personal information and to minimize risk for their own
operations.
What are your thoughts on what you have learned and what is
applicable to the public space?
Mr. Erwin. Yes. So, I think there are two important ways
that we approach this question.
The first is to think about, like, our core privacy
practices and the data that we are going to collect from our
consumers and how we are going to be really transparent and
provide them with control of that.
We really work hard to sort of follow these what typically
is referred to as data-minimization practices where we are
really only collecting what we need to run our business and
optimize and build a great product for our users.
And that is a practice that, frankly, isn't followed very
expansively across our industry with the underlying problems
that I think that we see and really think needs to be fixed.
And then once we have that data, we will work to protect it
aggressively, which is I think basic applicability of this idea
of data minimization, and plus sort of a strong set of security
controls on the back end is one that really needs to apply both
to the public and the private sector.
We also work hard to build kind of what I mentioned
earlier, these privacy features into the browser that protect
our users from web encryption, blocking, tracking in the
browser.
The interesting thing that--experience we have there is,
like, that can be a little bit disruptive for the industry in a
way that, like, right now we have a permissive internet, many
parties that depend on that permissiveness to build their data
practices and build their business.
That is fundamentally actually a problem. And so, some
amount of disruption is healthy. We don't always get a positive
response when we roll out privacy features. I think that is a
positive signal that we are going in the right direction. But
it certainly creates a little bit of headwind for us when we
try to roll out privacy features.
Mr. Aguilar. Understood. Sometimes being at the forefront
means that you take on a lot of folks with differing viewpoints
as well.
Ms. Fitzgerald, what are some of the best ways that we can
limit the risks and harms of the aggregations of personal
information over time from multiple different sources that we
know exist?
Ms. Fitzgerald. Thank you, Representative Aguilar.
I think this process of data minimization that has been
talked about a few times, especially in the first panel, I was
thinking if private companies treated our data like the GPO
did, we would be in much better shape. The point was made, if
you don't have it, you don't have to protect it.
So, the obligation should be on the companies to minimize
the amount of data they are collecting, delete it when they
don't need it anymore. That protects users from having their
information passed on and it protects them in the case of a
data breach.
Mr. Aguilar. Thanks. I appreciate that.
Mr. Erwin, back again, what are some of the privacy risks
and harms that we have that may not have a primarily
technological solution? I guess what I am trying to ask is
issues that instead require changes to business practices or
laws. We are trying to balance the regulatory side here, and I
wanted your thoughts on how we balance those pieces.
Mr. Erwin. Yes. So, we bump up against this problem all the
time in our work in the browser where, for example, the
challenges that we can solve, a user visits a website, for
example, and there is a hidden third party on that website that
the user doesn't know about and is collecting data about them.
That is a third-party relationship. We can do something
about that in the browser, because typically there is, like, a
network request, to get a little bit technical, that calls out
to that third party. So we can actually just block that.
So that is typically the role of, like, the browser, or the
operating system can jump in and say, we are going to prevent
these third parties from sort of tracking your behavior.
What we can't do as much of is when the user has a direct,
first-party, what we refer to as a first-party relationship
with a website or business. And that comes down to a question
of business practices, not technical problems. And there is
little we can do to sort of adjudicate the relationship between
a user who has decided to engage directly with a first-party
business, but that business isn't upstanding, and the user
might not know about it.
And that is where I think law and regulation really needs
to step in where the technical fixes ultimately aren't going to
get us what we need.
Mr. Aguilar. I appreciate that. Thanks so much.
I yield back.
The Chairperson. The gentleman yields back.
Mr. Steil is recognized for five minutes.
Mr. Steil. Thank you very much, Madam Chairperson.
I want to pick up where my colleague Mr. Aguilar left off a
little bit. But I want to shift over to you if I can, Ms.
Fitzgerald, on the topic.
I was reading some of your testimony, and you referenced
that the biometric and genetic data is especially sensitive, it
deserves stricter regulation. Is that correct?
Ms. Fitzgerald. Yes, absolutely.
Mr. Steil. And you raised some concerns about how
healthcare data is used. Is that correct?
Ms. Fitzgerald. Yes. Health data is particularly sensitive.
Mr. Steil. And so, I think a lot of people think that HIPPA
is protecting their healthcare data, as it extends to big tech
or health apps, but that is not correct. Would you agree?
Ms. Fitzgerald. Right. HIPPA only applies to the
relationship with your doctor and with your health insurance
company and with certain health exchanges, it doesn't cover
health data that is in apps.
Mr. Steil. Yes, I think that is a really interesting
distinction that I think a lot of Americans might find
interesting, and building on what was previously being
discussed with Mr. Erwin on these kind of third-party apps,
third-party relationships that exist on certain websites and
the impact that this could have.
And so Congress recently passed the 21st Century Cures Act
to protect patient data, in particular to require patient data
to move from the doctor's office to healthcare apps of the
patient's choosing. There are a lot of reasons that is a good
thing. There are some things that we want to make sure we get
right.
Because you want to be able to make sure patients can
control their data. But I also want to ensure that they don't
lose control of their data by sending it in a third party that
they might not be aware of would find interest in their
healthcare data, their biometric data, or others.
Do you think the risk is bigger in some of these apps that
might send--that individuals, that the risk might be greater if
they are sending information to some of these types of apps
kind of under the rules and regulations of the 21st Century
Cures Act?
Ms. Fitzgerald. The reason biometric data is so sensitive
is because we can't change it. We can't change our face print,
we can't change our fingerprints.
Mr. Steil. So, let's shift off for a second. I totally
agree. I think that is a great topic.
Let's shift and talk about medical data. Does that give you
unique concern?
Ms. Fitzgerald. Yes, sure, because of the ways it can be
used against us. You think about the insurance companies using
it to determine our rates or even an employer possibly not
wanting to hire someone with a health condition if they are
going to be paying their health insurance premiums.
Mr. Steil. I appreciate your commentary. I think it is an
area that we need to just really keep an eye on. I think there
is a lot of real positive things. We want to make sure
innovation is here in the United States. We want patients to
control their data.
But at the same time, we want to make sure that patients
are protected, and where there might be a third-party player
involved where the patient might not fully appreciate the risk
that they are engaging in, in sharing their data. I just think
it is something that we really should spend time and think
about.
Let me shift gears if I can. Thank you very much, Ms.
Fitzgerald.
Let me shift gears to you, Mr. Castro.
There is a lot of laws that govern privacy for different
types of institutions. The Gramm-Leach-Bliley Act Federal law
required financial companies to explain their information-
sharing practices to their customers and to safeguard some of
their data.
And before creating new laws, I think there is a real
opportunity for Congress to look at how current privacy laws
are working and how they interact with each other so that we
are not duplicative of regulations.
And so, could you shine some light, since the passage of
GDPR in the EU, what have we seen in that sweeping legislation?
Has it stifled innovation? Has it grown innovation? What big
takeaway should we take from that, from the EU's work?
Mr. Castro. In many areas it certainly has stifled
innovation. When you look at the cost of compliance, when you
look at the impact it has had on startups in the European tech
economy, there are many areas where just the data points again
and again show that European businesses are suffering.
The one area----
Mr. Steil. So let me, Mr. Castro, only because we have got
limited time, if we shift gears slightly and we say let's jump
over to California.
California Consumer Privacy Act, what lessons can we take
away from the State of California if we were to take that and
run that out nationally.
Mr. Castro. One of the biggest problems with California is
we have seen hundreds of lawsuits related to enforcement. That
has been a problem.
One of the biggest positives of it is the idea of a thirty-
day cure, which I think could be extended nationally, where the
goal is not to penalize companies for mistakes, but to get them
to take corrective action. That has been----
Mr. Steil. Thank you very much. Only cognizant of time. I
appreciate everybody's time here.
I think what is really important is we have got a lot of
laws already on the books, State laws, we can look at the EU,
we can look at what financial services committees are doing, we
can look at the 21st Century Cures Act. I think it is critical
that we are looking at all of these legislations, learning
lessons from them, so we can help consumers protect their data,
but also maintain innovation here in the United States of
America.
I appreciate you holding today's hearing, Madam Chairperson
and I will yield back.
The Chairperson. The gentleman yields back.
Ms. Scanlon is recognized for five minutes.
Ms. Scanlon. Thank you, Madam Chairperson.
I guess I would like to pull on this thread a little bit
more since we certainly do hear quite a bit about this on the
company side and the agency side: How do they navigate all
these different laws that are being promulgated between States,
but also between countries, because, as we are aware, the
internet does not have national boundaries in the same way?
So, Ms. Fitzgerald, could you talk about that? What are the
most important privacy rights that you have seen that have been
proposed that you think Congress should work on adopting?
Ms. Fitzgerald. Well, the most important thing, I think,
when you are thinking about privacy legislation is we can't
just be telling people what companies are collecting about
them. That is not enough. We need to put obligations on the
companies that are collecting data to limit that collection,
limit what they are doing with it after they collect it and
have them delete it when they are done using it.
Ms. Scanlon. Okay. In terms--do you have any suggestions
about which are the best models for us to look at, whether
there is State models, or the EU has been mentioned?
Ms. Fitzgerald. Sure. So, I think State models, you know,
California has the strongest right now in the United States.
The CCPA in California is the strongest model we have seen.
But, that still is even limited, only allows users to opt out
of the sale of their personal data. It doesn't as much put
obligations on companies to minimize the data they are
collecting.
The Online Privacy Act by Chairperson Lofgren is a great
model. That includes data minimization. It also includes
provisions protecting against discriminatory uses of data. That
is really important.
You also want to make sure you are requiring algorithmic
fairness and accountability. We don't want to make the same
mistakes with AI that we have made with data collection. This
is the next wave of technology. Let's get ahead of it, set the
rules now, encourage companies to innovate around privacy and
autonomy.
Ms. Scanlon. Okay. I mean, one of the typical--I don't
know--tools that people talk about with the privacy laws is the
notion of consent. I gather that you are a little bit skeptical
about the usefulness of consent as a focus of privacy
protections.
Can you talk about that a little bit?
Ms. Fitzgerald. Yes. Absolutely. There is just no way for
an individual to understand kind of the web that their data
gets passed through if they are consenting. You know, if you
are just hitting that consent button to make the banner go away
on a website----
Ms. Scanlon. Yes.
Ms. Fitzgerald [continuing]. You don't realize that what
you are saying is: Sure, take my personal data and do whatever
you please with it. There are no rules.
Ms. Scanlon. Right. Well, and certainly we have seen that
proliferate recently with--to get access to almost anything,
you either decide to click, or you decide not to----
Ms. Fitzgerald. Exactly.
Ms. Scanlon [continuing]. Protect it.
So, with respect to discriminatory data uses, how do we
address that? What are your top-line recommendations there?
Ms. Fitzgerald. Well, groups such as Color of Change,
Lawyers' Committee for Civil Rights, Leadership Conference have
great proposals on what we need to do to make sure that civil
rights are protected online, you know, making sure that--I
don't know--public accommodations are protected; you know, that
extends to online spaces.
You need to make sure that the algorithms that companies
are using are not being used in ways that deprive people of
life opportunities like, you know, ads for housing and ads for
jobs, that those are data--our personal data isn't being used
to show those in discriminatory ways.
Ms. Scanlon. That is interesting.
Okay. Thank you, Madam Chairperson. I yield back.
The Chairperson. The gentlelady yields back.
The gentlelady from New Mexico is now recognized for five
minutes.
Ms. Leger Fernandez. Thank you so much, Madam Chairperson.
As we have heard today, our personal data is extremely
valuable. You know, we take a question, a quiz on Facebook,
look up directions. The companies collect our information. They
then sell our information, often without our consent, to a
third party. And then they use our information--our
information--for a range of activities, from showing an ad for
clothing, to sometimes more dangerous, like targeting
disinformation to manipulate our behaviors or beliefs.
And it is all invisible to the true owners of the data. Me,
my neighbors, our fellow Americans, I want to focus a bit on
how data privacy or the lack thereof impacts our elections and
our democracy. The Elections Subcommittee of this Committee
recently held a roundtable in Miami on the creation and
dissemination of disinformation about our elections and the
pandemic, and this disinformation targets Spanish-speaking
communities.
We learned how the disinformation is then exported to other
States, including New Mexico, and then amplified based on this
data harvesting that we have heard about today and read in this
testimony.
Ms. Fitzgerald, you noted that actors can weaponize our
data to undermine our election integrity and democratic
institutions. In practice, what does this weaponization look
like?
Ms. Fitzgerald. Sure. Thank you, Representative Leger
Fernandez.
You know, just as advertising companies use profiles about
us to manipulate us into purchases, you know, so too can they
manipulate our views by filtering the content we see. So, the
ways they can do that are--you know, The Markup did a great
investigation right after January 6th showing the two different
Facebooks that Republicans and Democrats were seeing. And it is
just a stark view of kind of the different information that
both sides are seeing and how that shapes your views.
Even if someone doesn't click through to an article, just
seeing that headline, having it in the back of their head as
they are voting, it is--these companies are able to kind of
manipulate our political views by determining what we see.
Ms. Leger Fernandez. Professor Zuboff, I really appreciated
your poignant written remarks about how democracy is
simultaneously the only legitimate authority capable of helping
the surveillance capitalism but also a prime target. So, I
appreciate that and would welcome you expanding on that, but
the question I want to get to first is Mr. Castro suggested
that a private right of action is unnecessary and that we
should focus solely on transparency.
Do you agree, and, if not, why?
The Chairperson. You need to unmute, Professor Zuboff.
Ms. Zuboff. Sorry.
I don't agree with that. I think the private right of
action is very important. When we pass a law, whether it is the
California law or any other law, that is only the beginning.
What must happen is these laws are tested, and they evolve, and
they develop. As a society, we learn what they can mean, what
they can mean for us, and how they are going to protect us in
society.
So, what the private right of action does is it creates the
opportunity not only for individuals, but for groups of people,
for collectives to really bring issues into the judicial
system, to have those issues explored, and to create
precedence.
And this is--you know, this is what is called the life of a
law, how the law evolves and how we can move forward into this
century, not just with statutes that are frozen in time, but
with laws that are evolving according to what Justice Brandeis
once called the eternal youth----
Ms. Leger Fernandez. Right.
Ms. Zuboff [continuing]. Of the law, because we have these
kinds of international processes. So this really is----
Ms. Leger Fernandez. Yes, and I wanted to completely agree.
Our civil rights laws would have had no effect if we hadn't had
the right of private action.
I did want to ask you, though, to elaborate in the few
seconds left with regards to what you believe is most important
to protect our democracy in an Online Privacy Act?
Ms. Zuboff. Well, the first thing is you notice so much of
our discussion has been we minimize data or how is the data
used and things like that. Once we start a discussion talking
about data, we have already lost primary ground.
The key thing is now that we are all targets for massive
scale secret data collection, much of which should not be
collected in the first place. The decision should lie--the
decision rights should lie with the individual: Do I want to
share this information about the cancer that runs in my family,
and do I want to share that with a research operation or a
federation of researchers that are going to make progress on
this disease and help the world? Maybe so.
But do I want Google or Facebook or any other company to
just be inferring information about my cancer from my searching
and my browsing? Absolutely not.
So we need to reestablish decision rights, as Justice
Douglas offered in 1967, the idea that every individual should
have the freedom to select what about their experience is
shared and what remains private. These decision rights are the
cause of which privacy is the effect.
We need to establish now finally in law juridical rights
that give us the choice of what is shared and what remains
private. Then we have got a whole new ball game where all kinds
of innovations like Mozilla and all of the Mozillas that are
waiting to come on stream, not just obviously in search and
browse, but in all kinds of businesses, in every sector.
Ms. Leger Fernandez. Thank you.
Ms. Zuboff. We are all waiting to get in the game.
Ms. Leger Fernandez. Thank you. I know we have overgone
our time limit.
Thank you, Madam Chairperson----
Ms. Zuboff. Thank you.
Ms. Leger Fernandez [continuing]. And I yield back.
The Chairperson. The gentlelady yields back.
I just have a few final questions.
First, thanks to all of the witnesses for really very
excellent, interesting, and enlightening testimony.
I wonder, Mr. Erwin, in your testimony, you refer to dark
patterns as one of several privacy abuses that demand
regulation, that technology alone couldn't adequately address
them.
Can you explain in further detail for the Committee and for
those watching this hearing what dark patterns are, what are
some of the most troubling examples of dark patterns, and what
is the best legal approach to reining them in?
Mr. Erwin. Yes. A dark pattern is a sort of broad umbrella
term used to refer to what is typically sort of user
experiences that can deceive a user into opting into data
collection or consenting to data collection without being
explicit about what is really happening under the hood. And
that can be--a dark pattern could be sort of text that is
intended to deceive the user, or it might be sort of if you
have got to click through five things to opt out of the data
collection. All of those, I think, are typically--are sometimes
referred to as dark patterns.
We see those everywhere across the web. And, as I
mentioned, that is the type of area where the browser can't
really do much when the user is actively engaging with the
first party. It is an area where I think we really do need to
see some regulatory engagement.
Obviously, like, we don't want a regulator designing a user
experience in the browser. Sort of our user experience team
doesn't want me designing the experience in the browser, so we
definitely don't want a regulator doing that. But actually,
acting to say here is what the standard should be, and here is
what looks like a deceptive practice, and here is what is a
sound practice; that is where I think we really do need to see
a regulatory voice.
The Chairperson. Standards instead of design?
Mr. Erwin. Yes.
The Chairperson. You know, we have talked a lot about the
rights of individuals for privacy and, you know, some of the
disinformation, digital addiction, harmful impacts on children
on certain internet platforms. But I think whether there should
be a private right of action.
I think the core issue really, as Mr. Halpern said, if you
don't have the data, you can't use it to manipulate. And I
think--it is my view that the victims of manipulation, whether
it is for political, societal, cultural, or commercial
purposes, it is not just the individuals being manipulated but
the public at large.
If you are manipulating for a commercial purpose, you are a
Big Tech company and you have got all this data, you know, you
are at an unfair advantage to smaller companies that have not
acquired all that data. If you are manipulating for a cultural
or societal purpose to move society in one direction or
another, the public is also a victim of that. Individuals have
been removed from their agency and have been -- and are less
free because a private corporation is manipulating them through
their own data.
So, let me ask you, Ms. Fitzgerald, isn't really the crux
of this to restrain the collection and retention of data?
Ms. Fitzgerald. Yes, absolutely. It is not enough to--for
users to just know what companies are collecting about us. It
has to be restrained. The obligations have to be on the data
collectors to limit what they are collecting.
The Chairperson. I just want to mention briefly--and maybe
any of the witnesses can talk. Ms. Fitzgerald, you may have
studied this in your nonprofit. You know, I am a fan of the
FTC, but I have been advised by many who served there that the
sheer number of individuals who are really technologically
savvy is fairly minimal compared to the actual army of digital,
you know, engineers, software-savvy people in these large
companies, and that, frankly, they are no match for the
gigantic companies with the computer and digital expertise that
those companies have, which is why we are looking at how do we
better arm a regulatory agency to actually be successful in
facing off with these gigantic corporations?
Is that capacity of the FTC off base, Ms. Fitzgerald, in
your view?
Ms. Fitzgerald. Absolutely. I mean, look, we are encouraged
by recent actions at the FTC on privacy, but the FTC has
limited resources and an incredibly broad mandate that covers
everything from antitrust to horse racing safety, tractor
parts, and laundry tags. The task of data protection is best
done by a specialized, independent regulator. When you think
about the outsized presence of technology in our lives and our
economy, I just think this is something where, twemty years
down the line, no one will question why we have a data
protection agency just as now we don't question why we have an
FAA or an EPA.
The Chairperson. Let me just ask a question of you, Mr.
Erwin. In your written testimony, you state, quote, ``it is
important that competition concerns not be a pretext to prevent
better privacy for everyone.''
Can you explain that tension and how Congress might strive
to strike the right balance on that?
Mr. Erwin. Yes. I mean, this is something we see often.
Again, like the basic challenge we have here right now is the
internet was designed in a very permissive way, and that allows
for a large diversity of parties to collect data.
In some cases, those are the largest parties, but also the
smaller ones. And closing down some of these privacy gaps
necessarily means denying data to both the big parties and the
small ones. And sometimes we will hear this argument that we
shouldn't close the privacy gap because that will have certain
competition implications.
We really sort of reject that stream of thinking, the basic
idea being that, like, we should leave the internet being more
permissive in order to protect some set of business models.
You know, what we want to see is an overall but more
protective platform that has an even playing field that all big
and small companies can compete on. That is the approach that
we, I think, are in favor of. We are going to push back
aggressively on any suggestion that we should leave privacy
holes in the browser or in your operating systems in order to
protect some certain business model that might be competing
against Big Tech.
The Chairperson. Right. I will just close with this.
I live in California. The California law has not really
stopped the kind of collection that I think its authors
intended.
I will say, however, that, despite some decrying the
regulation, the formation of businesses in the tech sector is
at an all-time high. Business is good. Actually, job creation
in Silicon Valley is carrying the entire State. So, it has not
had these horrible impacts in the tech sector.
I am mindful that, if we constrain the collection and
retention of data by internet companies, especially in the
internet space, it will require a change in their business
models. I think that is necessary because, right now, the
propensity and the capacity to manipulate every person in
America is unacceptably high.
So, I am wondering, Professor Zuboff, you talked about, in
your New York Times essay recently, about how democracies are
confronting the tragedy of the uncommons and how we need to get
back to protect our society, for lack of a refined thing.
Can you expand what is the most important thing to
accomplish that goal in your judgment?
Ms. Zuboff. Well, you know, the digital century opened
with great promise. It was supposed to be the democratization
of knowledge. I am not ready to let that dream die.
The problem is we have gone on this kind of accidental
path. In my written testimony, I gave a lot of background as to
how that happened. A certain market ideology, certain national
security concerns, the accidents of financial emergency in
Silicon Valley, and how surveillance capitalism was invented in
order to get tiny little Google in the year 2000, you know,
over the hurdle when its investors threatened to pull out in
the dot-com bust--a bunch of accidents, and that is why I call
where we are an accidental utopia.
But what we really have is an opportunity for the digital
century to be a century where data is being used to further the
needs of society, to solve our core, most important problems.
And data collection is being used in ways that are aligned with
what we consider in the digital century to be necessary
fundamental rights.
This is work that we have not yet undertaken. We have got
to figure it out. It would be like having lived through the
20th century without ever having tackled workers' rights or
consumers' rights and the laws to oversee those rights and the
institutions to oversee all of that. We created all that in the
20th century.
We are in a new century, new material conditions, new kind
of capitalism. We have got to do that fundamental creative work
all over again. And that, finally brings us to a point where
right now, there is this very in-depth census of how artificial
intelligence is developing around the world, the ecosystem of
artificial intelligence, and what it shows very plainly is that
the five Big Tech companies own almost all of the artificial
intelligence scientists, the science, the data, the machinery,
the computers, everything pertaining to artificial intelligence
is concentrated in a small handful of companies.
All of that knowledge and capability and material is going
to work to solve the commercial problems of these companies and
their business customers--surveillance capitalism. It is not
being used for society.
So, the public is being--not only is agency being
subtracted from individual life, but the benefits of the
digital are being sequestered from the life of our publics, our
societies, our democracies. We have the opportunity to get that
back and get us back on track to a digital century that
actually fulfills its promise of knowledge, democratization,
and really solving the problems that face us. That is what it
is all about.
The Chairperson. Thank you so much, Professor.
And thanks to all of our witnesses.
As I mentioned, the record of this Committee will be held
open for at least five days. The Committee may have additional
questions for you, and, if so, we will send them to you and
humbly request that you answer them. I think that we have
advanced our knowledge of this situation substantially today,
and it is due to the very helpful and thoughtful testimony
provided by these excellent witnesses.
At this point, our hearing will be adjourned, and we will
see the Members of the Committee tomorrow for our oversight
hearing of the Capitol Police.
So, with that, without objection, this hearing is adjourned
with thanks.
[Whereupon, at 4:22 p.m., the Committee was adjourned.]
=======================================================================
QUESTIONS FOR THE RECORD
=======================================================================
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
=======================================================================
SUBMISSIONS FOR THE RECORD
=======================================================================
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]