Arizona should follow Calif. digital privacy path

Despite the protests, the new California law gets the property rights issue correct. We should each own our personal data.

In Arizona politics, this appears to be a season to bash California.

The opponents of the clear energy initiative, mandating that regulated utilities get 50 percent of their power from renewable sources by 2030, routinely denounce it as a California idea being thrust on Arizona by a California billionaire, Tom Steyer. A standard part of Gov. Doug Ducey’s economic pitch is a denunciation of California.

My son and I discuss this in a recent episode of our podcast, The Political Notebook. It mystifies both of us. Obviously, the politics of California and Arizona are much different. But California, and Californians, are pleasant and don’t seem likely political bogeymen.

I assume, however, that the attacks on California are poll-tested. So, with a bit of trepidation, I proffer the following: California just came up with an idea Arizona should emulate.

The subject is digital privacy. And the idea is the California Consumer Privacy Act of 2018, which was recently signed into law.

The measure gives people considerably greater control over their personal data on the internet.

Companies collecting personal data have to reveal what they have on a particular individual if asked. And they have to delete it if asked.

An individual can prevent personal data from being sold to a third party. Internet companies cannot make service contingent on allowing personal data to be used for other purposes.

Internet companies are screaming about the new law, although they reluctantly went along with it to avoid an even more stringent initiative that had qualified for the ballot.

Despite the protests, the new California law gets the property rights issue correct. We should each own our personal data. Those who want to use or profit from it should have to get our permission.

It was once thought that privacy had become passé in the internet era. And

certainly there remains an internet ethic of indiscriminately sharing intimate and highly personal information that causes the more prudish among us to wince.

But, on policy, internet privacy seems to be on the march.

The California law actually doesn’t go far enough. It relies on what is known as an opt-out option. Internet companies can sell your personal data to others unless you tell them they can’t.

The European Union recently implemented a new digital privacy policy, the General Data Protection Regulation, that has an opt-in requirement. Internet companies cannot provide personal data to third parties without express authorization. And the authorization cannot be blanket or the default alternative. Specific permission from specific individuals has to be given for each category of data-sharing the company wants to engage in.

Even the U.S. Supreme Court is reinvigorating the Fourth Amendment’s protection of personal records in light of the comprehensive collection of digital data. The court recently ruled that law enforcement must obtain a warrant based upon probable cause to collect cellphone location data.

The Fourth Amendment, however, only protects our personal information against fishing expeditions by the government. It doesn’t protect us against companies collecting our data and using it without our permission or against our wishes.

I’m as big a believer in the corrective power of market forces as there is. And there are some internet companies that market themselves on the basis of restricting the collection and use of personal data to that strictly required to provide the service the customer has requested of them.

That said, personal digital data should be regarded as a property right. And one of the highest purposes of law is to protect and enforce property rights.

Ideally, this would be done at the national level. This is unquestionably a matter of interstate commerce. And it would be better for commerce if there were a single national law, even one that pre-empted state laws.

Congress should pass something comparable to the European Union’s opt-in requirement. But the U.S. Senate is dysfunctional, and will remain so as long as the filibuster rule is in effect.

In the absence of congressional action, state laws protecting individuals’ property rights regarding his personal internet data are better than no laws.

This is one issue on which Arizona should follow California’s lead.