The Best Law You’ve Never Heard Of
Taking back control of our personal data can feel like a lost cause. But there’s hope!
Americans should feel angry about companies harvesting every morsel of our data to sell us sneakers or rate our creditworthiness. But a data protection law that few of us know about should also give us hope.
I’m talking about the Biometric Information Privacy Act of Illinois, or BIPA. It’s one of the toughest privacy laws in the United States. And it passed in 2008, when most of us didn’t have smartphones and couldn’t have imagined Alexa in our kitchens.
It applies only to Illinois residents and limits no more than what companies do with data from our bodies, like face scans and fingerprints. But its principles and legacy show that effective laws can wrest a measure of control from information-hogging companies.
The law’s pedestrian origin belies how consequential it came to be. In 2007, a company that let customers pay in stores with their fingerprints went bust, and it discussed selling the fingerprint database. People who thought that was creepy wanted to stop such activities.
Few outsiders paid attention to negotiations over BIPA, and this may have been the secret to its success. Now, tech companies unleash armies to deflect or shape proposed regulations.
And third, the law lets people — not just the state — sue companies. (More on this below.)
BIPA didn’t, however, stop the data-surveillance economy from growing out of control.
But Schwartz said that companies’ collection of our personal information would have been worse without the law. “BIPA is the gold standard and the kind of thing we’d like to see in all privacy laws,” he said.
BIPA also shows that we shouldn’t feel helpless about controlling our personal information. The data-surveillance machine can be tamed. “The status quo is not preordained,” Schwartz said.
I try not to bore you (and myself) with the law-making sausage. Allow me, though, to sneak in two terms to keep an eye on as more states and Congress consider regulation on technology companies including in data privacy, online expression and restraints on their powers.
The first one means, basically, that anyone can sue a tech company — not just government officials.
Broadly, politicians on the left (and lawyers) say that private lawsuits are an effective measure for accountability. Lawmakers on the right and many businesses say they’re a waste of time and money.
This right to sue will be a central point of contention in just about any fight over technology regulation.
Democrats in Congress said that they want to tame Big Tech’s power by, for example, letting merchants who feel their businesses are crushed by Amazon sue the company for anticompetitive actions. This is a deal breaker for many Republicans.
And on pre-emption: It essentially means that any federal law trumps state laws.
Category: Technology
Source: New York Times