Electronic Privacy Information Center

?? EPIC News Roundup In the past two weeks, EPIC has spoken with the press on issues from DOGE’s invasive government data access to the Drug Enforcement Agency (DEA)’s phone tracking program: ???? President Trump signed an Executive Order requiring federal agencies to modify guidelines restricting unclassified data access. John Davisson, EPIC Director of Litigation, was quoted in Fierce Healthcare: “This is the loudest signal yet to federal agencies that they’re expected to ignore privacy and security safeguards and give the Department of Government Efficiency [DOGE] full control over the data they hold. Nominally limiting DOGE access to what is ‘consistent with law’ is meaningless when the administration is already systematically violating federal privacy laws.” https://lnkd.in/gUzTccQj? ??? Last week, the Trump administration sought to remove two Democratic commissioners from the FTC and removed site blog posts criticizing Big Tech. The deletion of the blog posts “combined with the illegal removal of commissioners, who have been extremely effective regulators and critics of big tech, certainly points to the commission laying off of regulating the companies that are engaged in these harmful, large scale personal data abuses.” said Davisson to The Record. https://lnkd.in/edfbaf5K? ??? Jeramie Scott, Director of the EPIC's Project on Surveillance Oversight, was featured in Forbes discussing Clearview AI's attempts to purchase hundreds of millions of arrest records. “Scott pointed out that linking individuals to mugshots and related information can fuel bias among human reviewers using the system. ‘This is especially concerning given that Black and brown people are overrepresented in the criminal legal system.” https://lnkd.in/dGU3YZrD? ?? Scott also talked to The Intercept about the DEA’s phone call data collection program: “There should have been no question from the very start that this program needed a proper legal analysis, to determine whether there was the authority for the government to obtain this type of information in bulk through administrative subpoenas. It’s a real failure of oversight and accountability that years went by without a proper legal analysis.” https://lnkd.in/gtVir2jN To see more of the latest privacy news updates, visit: https://lnkd.in/gEMvciMd #News #NewsUpdate

On Sunday, genetic testing company 23andMe filed for bankruptcy. Millions of customers have their personal data at risk as it becomes unclear what the company will do with the information, and where the data will be sold and used. This is concerning given that 23andMe data have been subject to racially targeted data breaches in the past. ?? EPIC has been diligently speaking with the press to raise awareness about the dangers of 23andMe’s bankruptcy. We have a blog post dissecting the lack of privacy safeguards surrounding consumer genetic data: https://lnkd.in/e2hRNUSQ? ??? This Monday, EPIC Senior Counsel Sara Geoghegan chatted with BBC on the concerns over 23andMe customer data privacy. “The bankruptcy of 23andMe shows that these direct to consumer genetic companies have relationships with pharmaceutical companies, AI companies, health insurance companies, marketing companies, and law enforcement. And this information is a valuable asset that is going to be sold off in a bankruptcy proceeding, where it will be owned and accessed by a new entity, an outcome that most customers could not have expected when they gave their swab to 23andMe.” ??? Geoghegan was also quoted in The Washington Post: “Corporate changes can so drastically alter the safeguards for our sensitive personal information. The pinkie promise that these companies will protect your sensitive information is not meaningful. We need meaningful, enforceable privacy regulations in place to best protect us.” https://lnkd.in/dFYrHUq8? ??? Speaking to NPR, EPIC Counsel Suzanne Bernstein emphasized that “The scale of how much highly sensitive data 23andMe has is unique...We would recommend taking those actions and advocating to your state and federal representatives to pass strong consumer privacy laws.” https://lnkd.in/g--vQgKG? Federal health privacy laws like HIPAA only apply to healthcare providers and insurers, leaving consumer genetic data unprotected and at risk of breaches and misuse. EPIC encourages 23andMe customers to delete their genetic data immediately. This incident underscores the need for continuous advocacy toward comprehensive federal and state protections that prioritize consumer privacy protection and ownership over their own genetic data. #23andMe #GeneticData #HealthPrivacy

EPIC joined 8 other national and Maryland-based public interest groups to send a letter to the Maryland Senate Committee on Finance, opposing a bill that would establish an AI working group with no public interest representatives. The bill, H.B. 956, includes representatives from several industry sectors, including real estate, e-commerce, and biotechnology but no public interest voices from labor, civil rights, consumer protection, or privacy groups. ?? As the letter states, “We fear there would be an insurmountable bias toward regulation that benefits companies instead of protecting Marylanders.” EPIC also testified in front of the Maryland Senate Committee last Thursday against the lack of academic and civil society perspectives in the working group, and to caution against using this bill as a stand-in for meaningful, substantive AI regulations. EPIC urges the Legislature to prioritize placing commonsense guardrails on the discriminatory use of automated decision systems instead of establishing an unbalanced working group. Read the full letter ??: https://lnkd.in/gpicvtfM?? Watch the testimony ??: https://lnkd.in/gCjDeX_K #AIGovernance #AILegislation #Maryland

Last night, Virginia Gov. Youngkin vetoed a proposed Virginia bill seeking to regulate high-risk AI systems used in key decision contexts, such as housing and employment. ?? https://lnkd.in/eWj-9Mah ? While regulating AI used to make these life-altering decisions is an urgent need, EPIC opposed the VA bill because it failed to meaningfully address algorithmic discrimination. https://lnkd.in/eUrXpf7k ? “The bill contained too many loopholes and exemptions to adequately protect Virginians from the harms of discriminatory, unproven AI systems,” said Kara Williams, EPIC Law Fellow. ? Some of the most concerning loopholes include: only regulating AI systems that are “specifically intended to autonomously make” consequential decisions; defining “consumer” to exclude workers; including overly broad trade secrets exemptions; and exempting entire industries. ? These many carveouts would have allowed companies to decide for themselves whether or not they needed to follow the law, effectively exempting the very AI systems that the law is meant to regulate. ? Numerous other states are considering similar AI legislation, and lawmakers should take care not repeat Virginia's mistakes. EPIC is eager to work with state lawmakers working on AI issues. ?? ?

Privacy and transparency can coexist in a healthy democracy ??. Last Thursday, EPIC’s Jeramie Scott spoke on a breakout session panel at Sunshine Fest on Privacy and Transparency. Joined by fellow panelists Frank Lo Monte of CNN, Jasmine McNealy of the University of Florida, and Richard Varn of the Coalition of Sensible Public Records Access, the panelists spoke about how we can balance privacy with transparency when releasing information to the public. What a way to wrap up #SunshineWeek!

?? Americans are rightly concerned about the privacy of their genetic data as 23andMe goes up for sale. https://lnkd.in/eKYYP6Em Given 23andMe's poor track record for data security and the lack of strong consumer data privacy protections in the U.S., consumers should delete their genetic and personal data from their 23andMe account while they still can. https://lnkd.in/e2hRNUSQ California Attorney General Rob Bonta issued an urgent "Consumer Alert" outlining the steps that consumers can take to request that 23andMe delete their genetic data ???: https://lnkd.in/es6KMEcJ #23andMe #DNA #Genetics #PrivacyAwareness #ConsumerPrivacy

An?executive order?issued by President Trump on Thursday signals the administration’s intent to further defy federal privacy safeguards, force states to hand over their own sensitive datasets, and potentially make legally protected statistical information available to the Elon Musk-led DOGE for its own ends. The order, which makes no mention of privacy, would consolidate control over federal databases of personal records to an unprecedented degree and grant the “Department of Government Efficiency” (DOGE) sweeping access to nearly every American’s sensitive personal information. “It’s clear the president and the DOGE think there’s no scrap of Americans’ personal data they shouldn’t have access to, no matter what the law says,” said EPIC Director of Litigation John Davisson. “The only ‘abuse’ here is coming from inside the White House. The president should immediately rescind this executive order.” Although the order nominally states that agencies should only take actions “consistent with law,” the Elon Musk-led DOGE has already forced agencies to systematically violate the Privacy Act, the Federal Information Security Modernization Act, and other Congressionally-enacted data protection safeguards. EPIC and an anonymous government worker, together with counsel at Democracy Forward, brought suit against the Treasury Department and the Office of Personnel Management last month over prior DOGE database incursions. Read EPIC’s full statement: https://lnkd.in/eh2s5GFN ? ?

EPIC is backing an effort by Rep. Trahan to gather information from the public about how the Privacy Act of 1974 should be updated. Adopted by Congress in the aftermath of Watergate, the Privacy Act is the principal law governing the collection & disclosure of personal information held by federal agencies. https://lnkd.in/eEujf7Pz ? Over the past two months, the Privacy Act has come under direct attack by DOGE, which has seized access to numerous agency databases of sensitive personal information in violation of the Privacy Act. EPIC and others have filed suit to halt these extraordinary privacy violations. https://lnkd.in/ew-KjNkh “For fifty years, the Privacy Act has stood as a bulwark against the mishandling and political weaponization of personal information held by federal agencies,”?EPIC Director of Litigation John Davisson said in support. “But decades of technological change and the current administration’s assault on privacy underscore the urgent need to strengthen those defenses. Rep. Trahan’s inquiry into how the Privacy Act should be updated and fortified could not be timelier. EPIC strongly endorses this effort, and we look forward to working together with Rep. Trahan to restore privacy protections and the rule of law to the federal government’s safekeeping of personal information.” Comments in response to Rep. Trahan’s inquiry are due by April 30. https://lnkd.in/eY4CkhU5

#SunshineWeek is every week for us. EPIC has been a staunch advocate for an open government since our founding. Read our timeline below to learn about some key #OpenGovernment events that have promoted public #transparency and accountability, from the 1966 Freedom of Information Act to EPIC’s recent FOIA litigation initiatives. ? Learn more about Sunshine Week: https://sunshineweek.org/ Read about the EPIC’s Open Government work: https://lnkd.in/eXJpsmnC ? #OpenGov #FOIA

Happening today! ?? ??