every day the world wakes up to news of
privacy
demanding attention
we are in the midst of a digital
revolution
the questions the laws the consequences
keep coming
but our mission remains the same
we must adapt and change as our work is
tested and retested on an almost daily
basis
we believe in the power of sharing ideas
experience and
knowledge which calls us together to
learn from our diverse community
to explore the full spectrum of privacy
we gather to answer the call
[Music]
hello everyone and welcome to the iapp
global privacy summit
my name is vivian arts and i have the
honor of serving as the 2022 chair of
the iapp board of directors
and hello i am patrice ettinger i am the
chief privacy officer at pfizer
and i had the pleasure of serving as the
ipp board chair in 2021
and hello everyone i'm justin weiss i am
the global head of data privacy at
naspers and process i was privileged to
serve as chair in 2020
it has been three
long years
since we last gathered for an iapp
global privacy summit here in washington
the pandemic has affected our lives in
countless ways
we have lost too many family members
friends and colleagues
to this horrible coronavirus
our work
our schools our travel
our ability to gather
has been changed forever
and we cannot fail to mention the
ongoing challenges that our world faces
yes the pandemic continues at the same
time we bear witness to the human
suffering that is occurring in the
ukraine
trevor hughes our president and ceo of
iapp
will be sharing some important updates
from this stage tomorrow about the
iappb's efforts to support those in
crisis due to this heartbreaking
conflict
through all of this the iapp has
continued to pursue its mission to serve
all of you members of the privacy
community
we're very grateful to be able to come
together after three long years
so let's get to work
we have a tremendous conference planned
for all of you
and it is my pleasure to now introduce
our first keynote speaker
professor amy geider
professor geider
teaches at tulane law school in new
orleans and is a journalist turned
lawyer
she is recognized internationally for
her expertise in privacy
media law
totes and the law of higher education
her scholarship explores the tensions
between social regulation
and first amendment values
particularly the shifting boundaries of
press freedoms
and rising public anxieties
about the erosion of privacy
professor guida's latest book seek and
hide the tangled history of the right to
privacy is being released today
there are limited copies available to
you at our bookstore just after the
session
please join us in welcoming professor
guida to the stage
[Music]
hi everyone i'm i'm absolutely uh
delighted to be here
and i'm here because i wanted to
introduce you to re-introduce you really
to a man you surely
already know
it's louis brandeis
this man
louis brandeis is famous in privacy
circles for a lot of reasons he co-wrote
with sam warren the right to privacy the
harvard law review article from 1890
that laid the groundwork for much of our
privacy law today
he had offered a powerful stinging and
nation-changing descent in the olmstead
wiretapping case that today gives us
privacy protections against police
investigations and so much more
we know a lot about brandeis and the way
he influenced our privacy interests but
what isn't as well known is the way that
certain privacy interests influenced him
and that's what i want to share with you
today
three examples of the sorts of things
that stirred privacy concerns in this
father of sorts of american privacy
three stories that you may not have
heard before
and i'll do this in pictures for two
reasons
first because visual images motivated
brandeis and his co-author worn in a big
way
visuals show the technology in play at
the time they wrote the right to privacy
and beyond and these images will help
explain precisely why people were so
worried about privacy back then
second because if you're like me some of
these images some of the stories that go
with the images might surprise you
because of the power of the invasions
first
this
this is an image from a book titled cape
cod folks published in 1881
it's a sketch of grandpa fisher
a character who is hopelessly weak
confused and defenseless
here he's dying his scraggly gray hair
black so that he might look like a man
of thirty only to end up in the author's
assessment neither old nor young human
nor inhuman
trouble was the grandpa fisher was a
real person he really looked like this
this hair dying thing really happened
and the author who wrote cape cod folks
had lived in this very real small town
on cape cod
had worked as a teacher there and had
taken fastidious notes about her
interactions with residents there
cape cod folks was a true expose of
small town life
the day's reality television so to speak
but there were no stars here
one woman died
the official cause of her death was
consumption but everybody knew what had
really killed her
the unpleasant notoriety forced upon her
by that book as her doctor put it
lewis brandeis relatively brand new
attorney handled the case not on her
behalf or her family's behalf
but on behalf of the publisher
what's important here though is that
brandeis argued in effect that this was
indeed an invasion of grandpa fisher's
privacy along with all of the others
it's just that this sort of privacy
invasion didn't yet exist in law he
argued
therefore instead the cape cod folks
book was only a breach of the canons of
propriety and good manners not a legal
violation
the civil law didn't yet address
eavesdropping or looking into one's
windows either brandeis noted so it
certainly didn't recognize this
publication related invasion of the
plaintiff's domestic privacy
later probably not coincidentally just
after brandeis's cousin went missing in
new york city with resulting sensational
press coverage about what may have
happened
brandeis settled the cape cod folks case
that meant that grandpa fisher and all
the outed others got money for their
emotional pain because of what even
brandeis the attorney for the publisher
believed was a privacy invasion
second this
nine years after cape cod folks
this copy of new york illustrated news
came out
it was september of 1890 and that was
three months before brandeis would
publish the right to privacy complaining
about precisely this sort of thing
the headline reads caught by a camera
fiend
the caption a society young lady of red
bank new jersey while sunning herself
after her morning bath is photog
photographed in her gay and limited
attire by a snapshot from a stranger's
camera
and indeed there off to the right of the
tantalizingly busty young woman with the
blouse falling down just so
is a man
camera in hand hiding in the bushes
photographing her
the newspaper would pay anyone who'd
send in such images so this was surely
sketched from that man's real photo
this was precisely the sort of chilling
technological advancement that helped
spark the right to privacy
brandeis and warren were worried
especially about two things that this
newspaper symbolizes
first these nasty so-called detective
cameras that suddenly gave photographers
the ability to surreptitiously
photograph people
women like this one
such cameras were even marketed in ads
that way
second that the scandalous media of the
day pulitzer included could and would
publish such pictures
very clearly something needed to be done
to stop what even the new york times
worried was the growing invasion of
individuals privacy
and so weeks later brandeis and his
co-author warren published the right to
privacy the law review article that
argued that we all have the right to be
let alone
some say it's the most famous law review
of all time the basis for our right to
privacy today
and it worries very much about the
people like those in cape cod folks
whose stories are told against their
wishes
it condemns the technology of the day
that help facilitate such telling the
cameras and the newspapers that to
paraphrase the new york illustrated news
itself allowed graphic illustrations
third
this image
many years later louis brandeis had
become a justice on the united states
supreme court and had learned about a
police practice he found deeply
deserving disturbing
police were eavesdropping on people's
phone conversations by tapping into
phone lines without a warrant
by this time brandeis had come to trust
media more and so he encouraged the
newspaper editors who were his friends
to report on the tactic
he hoped that his fellow justices might
be similarly outraged and would vote to
hear a wiretapping case
the justices thereafter granted
certiorari and agreed to hear the
olmstead case and this is the original
olmstead phone that's here in the
building
anyway in bad news for brandeis and for
all of society at the time the justices
decided that such police activity was
proper
that the phone lines were outside the
home so a warrant wasn't necessary
but brandeis disagreed and wrote
what became a powerfully persuasive
dissent that has now become the law in
the united states
he wrote that in modern times subtler
and more far-reaching devices had been
created to invade privacy making it
possible for others to reveal what was
whispered in the closet
he was especially worried he said about
newer technology including the evil
incident to invasion of privacy of the
telephone that made it possible to
listen in on even the most confidential
of conversations
the brandeis descent in olmstead is a
second reason that brandeis is hugely
famous in privacy circles of course
and the principles in his olmstead
descent are now the foundation for
privacy and police investigations today
in short police need a warrant
but as he worked on his dissenting
opinion in the olmstead case about
wiretaps
brandeis had an even broader sense of
what privacy related things might come
one day
things that may sound troublingly
familiar
he foresaw cloud-based storage and
hacking to some extent
he predicted that the day would come
when people without removing papers from
secret drawers would be able to
reproduce them in court
and thereafter revealed to a jury the
most intimate occurrences of the home
and he'd been just as worried about
radium and photography and the
developing power of television to peer
back into a house to learn its secrets
and maybe even advances in the psychic
and related sciences that could allow
others to explore a man's unexpressed
beliefs
thoughts and
emotions but his in the present law
clerk urged him to scratch all that from
his dissenting opinion as very obviously
impossible
now we know that brandeis wasn't wrong
at all when he saw an effect nanny cams
and doorbell cameras and internet data
tracking that can indeed reveal our very
thoughts
so let's return again to this picture
this is how brandeis wanted you to see
him we're lucky to have it
by 1910 this was the only photograph of
brandeis that brandeis had kept or so he
told a reporter
he'd taken care to destroy all of the
others he said
and those are three stories
really four if you consider the brandeis
photo about what helped in part to
motivate brandeis and his calls for
privacy
he was a man who cared deeply about
privacy
he was worried about the technology that
could invade people's privacy he was
worried about the people who would too
so maybe it's best to leave you with
what brandeis wrote in the right to
privacy and in the olmstead descent
that these sorts of things were the
privacies of life
that they were of far greater importance
than unwarranted governmental quests for
truthful information
that they were of far greater importance
to the individual and the sense of self
than the public's right to know certain
truthful information
that as you know largely remains the law
in the united states today with regard
to this type of privacy
even in an internet age in which much is
recorded and much is published
and even as we grapple with the day's
privacy concerns we have louis brandeis
to thank in large part for that
foundation
thank you
[Applause]
[Music]
well thank you malcolm that was great
and some great takeaways from that that
that talk there my name's steven
reynolds i'm a partner at baker mckenzie
and a member of the iapp board of
directors
our next speaker and final speaker this
evening was sworn in as the chair of the
federal trade commission on june 15
2021.
prior to becoming head of the ftc she
was an associate professor of law at
columbia law school and she also
previously served as counsel to the u.s
health judiciary committee's
subcommittee on antitrust commercial and
administrative law
legal advisor to ftc commissioner rohit
chopra and legal director at the open
markets institute
joining us for her first public address
focused on privacy issues is ftc chair
please welcome to the stage lena kahn
[Music]
hello everybody it's great to see you
all
uh thanks so much to trevor and iapp for
the invitation to speak with you all
today it's a tremendous honor to be here
so it's a striking moment to be
discussing the state of data privacy and
security today with the landscape having
shifted so significantly even over the
last few years
the pandemic hastened the digitization
of our economy and society
further embedding digital technologies
deeper into our lives with schools
workplaces and all manner of life
switching over to virtual formats
effectively overnight
we also saw that this digital transition
was not experienced equally by all
americans since many still lack access
to reliable internet and affordable
personal technologies
the experience of the last couple of
years has both illustrated the
tremendous benefits of these tools as
well as the challenges and risks posed
by this growing dependence
we've seen how security vulnerabilities
can have sweeping effects disrupting
fuel supply for an entire segment of the
country and halting meat processing
operations nationwide
we've also seen how privacy breaches can
be materially consequential with
violations exposing millions of children
during the course of doing their school
work
or resulting in the purchase and sale of
individuals sensitive health data
meanwhile greater adoption of workplace
technology surveillance technologies and
facial recognition tools is expanding
data collection in newly invasive and
potentially discriminatory ways
americans are aware of the stakes and
the potential hazards
one survey showed that close to
two-thirds of americans believe that it
is no longer possible to go through
daily life without companies collecting
data about them
while over 80 percent feel that they
have meager control over the data
collected on them and believe that the
risks of data collection by commercial
entities outweigh the benefits
against this backdrop the federal trade
commission is charged with ensuring that
our legal tools and our approach to law
enforcement keep pace with market
developments and business practices
with its long-standing expertise in how
companies collect and deploy americans
data
along with its unique combination of
enforcement policy and research tools
the ftc is especially well suited to
this task
in my remarks today i will offer a few
observations about the new political
economy of how americans data is tracked
gathered and used
identify a few ways that the federal
trade commission is refining its
approach in light of these new market
realities
and lastly share some broader questions
that i believe these realities raise for
the current frameworks we use for
policing the use and abuse of
individuals data
concerns about americans privacy has
long preceded the digital age
lewis brandeis and samuel warren in 1890
famously sought to define anew the exact
nature and extent of privacy protections
guaranteed by law in the face of quote
recent inventions and business methods
at bottom they explained the law
protects people from the unwanted prying
eyes of private actors almost in the
same way that it protects against
physical injury
similarly lawmakers in 1970 passed the
fair credit reporting act the first
federal law to govern how private
businesses could use americans personal
information
the law prescribed the types of
information the credit reporting
agencies could use and guaranteed a
person's right to see what was in their
file a recognition of the unique harms
that can result when firms have
unchecked power to create dossiers on
people that can be used to then grant or
deny them opportunities
though these basic principles governing
what types of personal information
businesses can and cannot collect and
use extend back decades
the context in which we must now apply
them today looks dramatically different
digital technologies have enabled firms
to collect data on individuals at a
hyper granular level
tracking not just what a purchase of
what a person purchased for example
but also their keystroke usage how long
their mouse hovered over any particular
item
and the full set of items that they
viewed but did not buy
as people rely on digital tools to carry
out a greater portion of daily tasks the
scope of information collected
also becomes increasingly vast ranging
from one's precise location and full web
browsing history to one's health records
and complete network of family and
friends
the availability of powerful cloud
storage services and automated decision
making systems meanwhile have allowed
companies to combine data across domains
and retain and analyze it in aggregated
form at an unprecedented scale
yielding stunningly detailed and
comprehensive user profiles that can be
used to target individuals with striking
precision
some firms like weather forecasting or
mapping apps for example may primarily
use this personal data to customize
service for individual users
others can also market or sell this data
to third-party brokers and other
businesses in ancillary or secondary
markets that most users may not even
know exists
indeed the general lack of legal limits
on what types of information can be
monetized has yielded a booming economy
built around the buying and selling of
this data
this has let firms provide services for
zero dollars while monetizing personal
information a business model that seems
to incentivize endless tracking and
vacuuming up of users data
indeed the value that data brokers
advertisers and others extract from this
data has led firms to create an
elaborate web of tools to surveil users
across apps websites and devices
as one scholar has noted today's digital
economy represents probably the most
highly surveilled environment in the
history of humanity
while these data practices can enable
services in forms of personalization
that could in some instances be
benefiting users they can also enable
business practices that harm americans
in a host of ways
for example we've seen that firms can
target scams and deceptive ads to
consumers who are most susceptible to
being lured by them
they can direct ads in key sectors like
health credit housing in the workplace
based on consumers race gender age
engaging in unlawful discrimination
collecting and sharing data on people's
physical movements and online activity
meanwhile can endanger them enabling
stalkers to track them in real time
and failing to keep sensitive personal
information secure can also expose users
to hackers identity thieves and cyber
threats
the incentive to maximally collect and
retain user data can also concentrate
valuable data in ways that create
systemic risk
increasing the hazards and costs of
hacks and cyber attacks
some moreover have also questioned
whether the opacity and complexity of
digital ad markets could be enabling
widespread fraud and masking a major
bubble
beyond these specific harms the data
practices of today's surveillance
economy can create and exacerbate deep
asymmetries of information exacerbating
in turn imbalances of power as numerous
scholars have noted businesses access to
and control over vast troves of granular
data on individuals can give these firms
enormous power to predict
influence and control human behavior
in other words what's at stake with
these business practices is not just
one's subjective preference for privacy
over the long term but one's freedom
dignity and equal participation in our
economy in our society
our talented ftc teams are focused on
adapting the commission's existing
authority to address and rectify
unlawful data practices
a few key aspects of this approach are
particularly worth noting
first we're seeking to harness our
scarce resources to maximize impact
particularly by focus on focusing on
firms whose business practices cause
widespread harm
this means tackling conduct by dominant
firms as well as intermediaries that may
facilitate unlawful conduct on a massive
scale
for example last year the commission
took action against openx an ad exchange
that handles billions of advertising
requests involving consumer data and the
company was alleged to have unlawfully
collected information from services
directed at children
we intend to hold accountable dominant
middlemen for consumer harms that they
facilitate through unlawful data
practices
second we are taking an
interdisciplinary approach assessing
data practices through both the consumer
protection and competition lens
given the intersecting ways in which
wide
wide scale data collection and
commercial surveillance practices can
facilitate violations of both consumer
protection and antitrust laws we are
keen to marshal our expertise in both
areas to ensure that we are grasping the
full implications of particular business
conduct and strategies
also key to our interdisciplinary
approach is our growing reliance on
technologists alongside the skilled
lawyers economists and investigators who
lead our enforcement work
we have already increased the number of
technologists on our staff drawing from
a diverse set of skill sets including
data scientists and engineers user
design experts and ai researchers and we
plan to continue building up this team
third when we encounter law violations
we are focused on designing effective
remedies that are directly informed by
the business incentives that various
markets favor and reward
this includes pursuing remedies that
fully cure the underlying harm and where
necessary deprive law breakers of the
fruits of their misconduct
for example the commission recently took
action against weight watchers
subsidiary kerbo alleging that the
company had illegally harvested
children's sensitive personal
information including their names eating
habits daily activities
birth date and persistent identifiers
our settlement required not only that
the business pay a penalty for its law
breaking but also also that it delete
its ill-gotten gain
and destroy any algorithms derived from
that data
where appropriate our remedies will also
seek to foreground executive
accountability
through prophylactic limits on
executives conduct
in our action against spy phone for
example the ftc banned both the company
and its ceo from the surveillance
business resolving allegations that they
had been secretly harvesting and selling
real-time access to data on a range of
sensitive activity
lastly we are focused on ensuring that
our remedies evolve to reflect the
latest best practices in security and
privacy
in our recent action against cafe press
for example our settlement remedied an
alleged breach by requiring the use of
multi-factor multi-factor authentication
reflecting the latest thinking in secure
credentialing
even without a federal privacy or
security law
the ftc has for decades served as a de
facto enforcer in this domain using
section 5 of the ftc act and other
statutory authorities to crack down on
unlawful practices
no doubt we will continue using our
current enforcement tools to take swift
and bold action
the realities of how firms surveil
categorize and monetize user data in the
modern economy however invites us to
consider how we might need to update our
approach further yet
first the commission is considering
initiating a rulemaking to address
commercial surveillance and lacks data
security practices
given that our economy will only
continue to further digitize market-wide
rules could help provide clear notice
and render enforcement more impactful
and efficient
second i believe we need to reassess the
frameworks we presently use to assess
unlawful conduct
specifically i am concerned that the
present market realities may render the
notice and consent paradigm outdated and
insufficient
many have noted the ways that this
framework seems to fall short given both
the overwhelming nature of privacy
policies and the fact that they may very
well be beside the point
when faced with technologies that are
increasingly critical for navigating
modern life users often lack a real set
of alternatives and cannot reasonably
forego using these tools
going forward i believe we should
approach data privacy and security
protections by considering substantive
limits rather than just procedural
protections which tend to create process
requirements while sidestepping more
fundamental questions about whether
certain types of data collection and
processing should be permitted in the
first place
the central role the digital tools will
only continue to play invites us to
consider whether we want to live in a
society where firms can condition access
to critical critical technologies and
opportunities on users having to
surrender to commercial surveillance
privacy legislation from congress could
also help assure in this type of new
paradigm
thank you again for inviting me to speak
with you all today this is an incredibly
exciting and momentous time for these
issues with a lot at stake and a
tremendous amount of work to be done and
i'm looking forward to working with you
all as we chart forward the path ahead
thank you
[Applause]
[Music]