Tech faces regulatory fight over privacy
The staging ground for one of the biggest regulatory fights facing the technology industry is far removed from Washington or Brussels, tucked into an alley next to a wine and cheese shop about 30 miles from Silicon Valley.
A barely furnished real estate office in an upscale Oakland neighborhood is the headquarters for backers of a proposed California ballot measure that would provide consumers with increased privacy rights, including the ability to demand that companies do not sell their personal data.
If the initiative, called the California Consumer Privacy Act of 2018, passes, privacy advocates say it will be one of the most meaningful checks in the United States on the growing power of internet behemoths.
The proposed measure is the passion project of an unlikely threesome: a real estate developer, a former CIA analyst and a financial industry executive. They say they have no political aspirations. They are not techies, and they are not your run-of-the-mill privacy zealots. Instead, they say they are like many internet consumers — a little freaked out about tech firms gobbling up people’s personal data.
“People want some basic rights,” said Alastair Mactaggart, the 51year-old real estate developer who has contributed more than $2 million of his own money to get the measure off the ground. “People are resentful but accepting because there isn’t any sense of control about their data.”
The measure has three major components: It gives consumers the right to ask companies to disclose what data they have collected on them, the right to demand that they not sell the data or share with third parties for business purposes, and the right to sue or fine companies that violate the law.
Google, Facebook, major telecommunications companies and California’s Chamber of Commerce have already come out against the initiative, saying it is flawed and a threat to the economic model supporting the internet. They’ve created an organization to fight the measure with a decidedly populist name, the Committee to Protect California Jobs.
Political consultants have told the initiative’s backers that they should prepare for the opposition campaign to spend $100 million. Steve Maviglio, a spokesman for the opposition, declined to put a number on the campaign spending, but acknowledged that there is a lot at stake. “It’s California,” he said. “It’s expensive.”
The initiative has not been certified yet by state officials for the November election, but it is expected to appear on the ballot. Backers said they have submitted more than 600,000 signatures, eclipsing the 366,000 minimum requirement.
Mactaggart said he first became concerned about data privacy when he asked a Google engineer at a cocktail party if he should be worried about all the information that companies were collecting about users. The engineer’s response surprised him: Mactaggart was right to be worried.
Mactaggart said he then reached out to Rick Arney, a finance industry executive who had worked in the California state Senate as a legislative analyst 20 years ago. Their children go to the same school, and Mactaggart knew that Arney was a supporter of ballot measures as a way for ordinary citizens to get something done outside of the political system.
“One of the reasons why it’s brought as a ballot initiative is that there is consensus that Silicon Valley owns Sacramento,” said Chris Hoofnagle, an adjunct professor at the UC Berkeley School of Law and an adviser for the initiative. “There’s no prospect of any consequential consumer privacy legislation.”
But there was a small problem: Neither Mactaggart nor Arney was a privacy expert or policy wonk. So they hired Mary Stone Ross, another neighborhood friend, who worked at the CIA and had been legal counsel for the House of Representatives Intelligence Committee, to oversee the effort.
They spent months talking to technologists, academics and lawyers. They conducted polls and focus groups to understand what people wanted.
After considering various options, they decided against taking a hard-line approach. Companies can still use personal data for their own purposes to sell advertising or improve products. They would be restricted, however, from selling or disclosing that data to someone else for “business purposes” upon a consumer’s request.
The measure is the latest challenge facing Silicon Valley’s web giants. There is a backlash to the data collection practices that underpin how they make money.
In the rest of the world, the clamor for regulation is building. The most notable effort is coming from Europe, which is preparing to enact later this month a stringent set of laws that will restrict how tech companies collect, store and use personal data from people across the region.
In the United States, the California initiative is part of a wave of activity to rein in the sprawl of personal data across the internet in the wake of revelations that the voter profiling firm Cambridge Analytica gained access to the personal information of up to 87 million Facebook users.
Last month, Sens. Richard Blumenthal, D-Conn., and Edward Markey, D-Mass., introduced a bill that sought to establish online protections for consumers by forcing companies to get consent to share or sell personal data. Sens. Amy Klobuchar, D-Minn., and John Kennedy, R-La., also introduced a privacy bill in April.
Gabriel Weinberg, chief executive of DuckDuckGo, a privacy-minded search engine, and a supporter of the California initiative, said he wished the measure had gone further — but any progress is good. “You have to start somewhere,” he said.
Hoofnagle said, however, that the measure’s financial punishments for violators give the law teeth that previous attempts at privacy regulation lacked. It also takes a broader view of what constitutes personal information beyond real names and Social Security numbers — including biometric data and numbers that identify the devices people use.
Opponents of the measure say that those broad definitions of personal data are excessive and that companies can adopt their own privacy rules faster and more effectively.
“Something that takes such a sledgehammer approach to regulating data is extraordinarily concerning,” said Robert Callahan, a vice president of state government affairs at the Internet Association, an industry trade group. “We think the initiative is filled with flaws, and it will have really dangerous consequences for the California economy.”
Google, Facebook, Verizon, Comcast and AT&T each made $200,000 contributions to the committee opposing the proposed ballot measure. After Facebook CEO Mark Zuckerberg testified on Capitol Hill about data privacy last month, the company said it was leaving the group even though it still had concerns about the measure and did not take back its initial contribution. Verizon also pulled out of the coalition earlier this month, saying it wanted to deal with privacy on a national level rather than a state-by-state approach.
The initiative’s backers said they were raising money for their campaign using a crowdfunding approach. But to get their message out and raise awareness of the measure, they are advertising on — where else? — Facebook.
Reflecting on his transformation from wealthy real estate developer to privacy activist, Mactaggart said that after devoting two years and millions of dollars to the campaign, he’s more certain than ever that this initiative is important and necessary — a point brought home during a focus group session that took place in Sunnyvale, with a room full of engineers.
“Of all the focus groups we did around the state, that was the one most vehement about the need for this,” Mactaggart said. “That was really one of the catalyzing moments for me when I was like, ‘Oh, we’re onto something here.’ ”