Political Science

                Social media presents a problem for many users. They want to be on social media, but they also want to control the information that people can get from it. Yet, people cannot learn enough about privacy risks to make informed decisions about their privacy, nor can they understand the harm that emanates from how their personal data will be aggregated and analyzed over the years by thousands of firms. This myth of the privacy paradox was the subject of Jacob Little’s senior thesis.

                Currently, most people are protected by a patchwork of state laws that apply to how

databases use sensitive information (horizontal privacy laws) and that regulate a specific subset of data (vertical privacy laws). This patchwork exists because technology moves very fast, privacy has never really been a salient issue, Big Tech is a powerful lobby, and gridlock at the federal level makes a universal standard difficult to achieve.

                The general problem is that Americans’ data is collected, traded, and used under a fragmented system of inconsistent state laws and poorly enforced federal laws. This creates confusion and risks for consumers, compliance challenges for firms, and a national security risk in the global data economy.

However, there are several specific problems associated with this. First, consent is not real because few actually read the consent forms. Second, cybercrime is escalating each year. Third, states lack the capacity to enforce state laws. Fourth, these laws do not do well at protecting children. Fifth, businesses in multiple states spend too much on complying with different state laws. Sixth, many businesses do not comply with the laws for various reasons.

To determine the best law, Little identified several criteria for evaluating prospective solutions. First, a data privacy solution should protect individual autonomy, limit data collection to what is necessary and consensual, and uphold the dignity of the person (ethics). Second, it should seek to create a constitutionally sound framework that balances national uniformity with the preservation of state authority to innovate further (legal). Third, a politically feasible policy should appeal to Republicans (the biggest opponents), key stakeholders, and maintain bipartisan support. Fourth, the benefits should outweigh the costs (viability). Fifth, it should be implemented efficiently, supported by adequate resources, and enforced effectively without unnecessary administrative disruption of duplication of effort (administrative feasibility). Sixth, it should be internationally competitive. Seventh, it should empower Americans to understand and protect their data, and strengthen the nation’s overall culture of digital responsibility and accountability (culture).

Little then identified several policy options. First, the status quo continues deferring to state regulation. Second, we could expand the Federal Trade Commission's authority to achieve data minimization and strong consent requirements. Third, we could have a federal baseline law that allows states to go beyond those standards. Fourth, we could have a comprehensive federal law that preempts state laws. Finally, we could focus on enhanced sectoral data regulation and enforcement.

He finds the status quo is the worst option because it perpetuates failure and leaves millions of Americans unprotected. He also finds the enhanced sectoral regulations and stronger FTC power problematic. The sectoral regulations leave large amounts of data unprotected, which will not satisfy Americans or global data privacy leaders. The expanded FTC powers are commendable, but unlikely to be accomplished in the face of immense opposition from Big Tech’s incredibly powerful lobbying arm.

Of the two remaining options, he prefers the hybrid model over the federal law with broad preemptions. The universal law sacrifices state innovation and autonomy and will result in an erosion of privacy in some states. The benefit of the hybrid law is that it achieves a high level of data privacy, extends, rather than overrides, the existing framework, has strong political support, incentivizes tech firms to succeed with de-identified data, and is internationally competitive.

This leads him to support the American Privacy Rights Act. First, it mandates affirmative express consent for data transfers. Second, it grants a private right of action. Third, it regulates data brokers and targeted advertising. Fourth, it provides broad protection for all non-public personal information about consumers, such as financial details and contact information. Fifth, it has strict protection for “sensitive covered data”- Health data, genetic information, information related to sexual behavior, and information related to private communications. Finally, it promotes the use of de-identified data and human decision-making processes.