Podcast: Designing a Federal Privacy Standard, With Rep. Suzan DelBene (D-WA)

Congress is rightly considering substantial reforms to federal data-privacy law. In particular, there is a pressing need to preempt states from subjecting organizations to multiple, conflicting privacy rules. The debate now is not over whether to pass new legislation, but how to design such a law to protect consumers while encouraging continued innovation. Rob and Jackie discuss one proposal with its sponsor, Rep. Suzan DelBene (D-WA), honorary co-chair of ITIF.

Mentioned

• Robert D. Atkinson, Daniel Castro, and Doug Brake, “Technology Should Be Part of Any Stimulus Plan,” ITIF Innovation Files blog post, March 13, 2020.
• Office of Rep. Suzan DelBene (D-WA), “DelBene Introduces Legislation to Protect Consumer Privacy,” news release, March 29, 2019.
• ITIF, “DelBene Privacy Bill Would Protect Consumers Without Undermining Innovation,” news release, March 29, 2019.
• ITIF, “ECJ’s Irresponsible Decision in Schrems Case Will Wreak Havoc on Global Data Flows,” news release, July 16, 2020.

Related

• Daniel Castro, Ben Miller, and Adams Nager, “Unlocking the Potential of Physician-to-Patient Telehealth Services” (ITIF, May 2014).
• Daniel Castro, “5 Lessons the U.S. Can Learn from European Privacy Efforts,” Government Technology, July-August, 2019.

Auto-Transcript

Rob Atkinson: Welcome to Innovation Files. I’m Rob Atkinson, founder and president of The Information Technology and Innovation Foundation. We’re a DC based think tank that works on technology policy.

Jackie Whisman: And I’m Jackie Whisman. I handle outreach at ITIF, which I’m proud to say is the world’s top ranked think tank for science and technology policy.

Rob Atkinson: And this podcast is about the kinds of issues we cover at ITIF, from the broad economics of innovation to specific policy and regulatory questions about new technologies. In this episode, we’re talking to ITIF’s honorary co-chair, Congresswoman Suzan DelBene, about her priorities in Congress, including her work on broadband access and privacy.

Jackie Whisman: We’ve covered these topics on previous episodes of the podcast, and we’re always asking our experts, “Well, what can Congress do to fix this?” And the congresswoman is working to fix it, so let’s get right to it. Suzan DelBene has represented the first district of Washington state since 2012, and serves on the House Ways and Means Committee and the Select Committee on the Modernization of Congress. She’s also vice chair of the New Democrat Coalition, and most importantly for us is honorary co-chair of ITIF. She has such an interesting and diverse career before running for Congress, and has been a leader on innovation policy issues since day one. So we’re so happy to have you here, Congresswoman.

Suzan DelBene: Thanks for having me. It’s great to be here.

Jackie Whisman: To kick things off, I’d love for you to describe the district that you represent in Washington State. I think it perfectly illustrates the concept of a digital divide that we’ve been hearing a lot about lately. And in so many ways, your district is a microcosm of what we see around the country.

Suzan DelBene: Absolutely. Besides also being the most beautiful district in the country, it really does have the extremes. I represent, one of the global leader areas that leads in technology around the world, but also you can drive an hour away from the headquarters of a company like Microsoft and be in a place where we don’t have rural broadband, let alone even decent cell service. That really highlights the challenge we face. When we talk about rural broadband and internet access, I think people think, “Well, there’s some places that are extremely far away. But in my regions, those places are right next door.” We knew there were significant disparities already. But now we see even greater disparities with the pandemic. And we look at things like education and students who have incredible opportunities for online learning. And then in another part of my district, students who don’t have access to online learning at all.

So I think when we talk about disparities that exist, and we know that these disparities have long-term impacts in terms of economic development in regionss that don’t have broadband access, but also for education, for young people and their opportunities to learn, especially in the environment we’re in. So we have to, when we talk about infrastructure, we have to talk about technology infrastructure and how critical that is because if we don’t do that, we’re going to continue to see this disparities grow even more, both economically and in terms of opportunities for students and for workers.

Rob Atkinson: Absolutely. One of the things I think that’s interesting as you listen to what the company announcements are these days, a lot of companies, not just tech companies, are saying, “Post-COVID, we may not go back to the same office environment that we had before. We’re going to be a lot more flexible letting workers work remotely.” And so there may be workers who are already out in places in your district without broadband who won’t be able to take advantage of that. If those places really got viable broadband, you can imagine economic development opportunities as more workers move there to take advantage of this. I mean, there’s some beautiful places. Seattle is beautiful, but there’s some wonderful places that maybe people want to live out more in the country.

So one of the ways that people have talked about, our experts have talked about doing that is so-called TV band white spaces. These are essentially the channels between the channels, if you will, where there’s nothing going on. And it’s pretty valuable spectrum that’s really, really excellently designed for broadband, fixed wireless broadband. Some of the large technology companies have developed technologies to make that a reality and programs and all. Do you think that’s a good approach? And what are the kinds of things maybe Congress could do to help that along?

Suzan DelBene: I think it’s a good approach. I think we need a lot of different approaches to handle the different environments that our communities have because we know that there’s not a one size fits all environment. We have areas that are very mountainous and have trouble with certain types of connectivity. We also have big agricultural areas, and that’s actually a place where there’s been a lot of work on white spaces, where I think there’s a lot of potential. I think the main thing we can do in Congress, one is to do the mapping that needs to be done, so we really know where there’s connectivity and where there isn’t, to make sure that with are really doing the work to use whatever technologies make sense, to make sure there’s access.

I mean, folks have been rolling out hotspots, but it’s hard to roll out a hotspot if you don’t even have decent cellular connectivity in an area, so that might work in some places, not in others. So there’s the: What do we do in the short-term to help especially during a pandemic? And what’s the long-term infrastructure need? And I think we should use whatever available new technologies there are. Clearly, one thing Congress can do is help look at issues of resources to make sure we get that infrastructure in place, look at spectrum and availability to help address these issues, and provide incentives and resources to help make sure it happens. And like I said, and to track the results we’re getting because talking about rural broadband is not a new issue. And I feel like we should’ve made much more progress than we have so far. And there’s just not always going to be a financial incentive to do that in some of our very rural areas, so there is a huge public interest in terms of making sure that happens.

Rob Atkinson: It’s kind of frustrating, at least to us, because we’ve been talking about white spaces in rural areas probably since 2008 I think. And one of the reasons why it’s such a good idea in our view is if you’re in Seattle, the TV band is pretty congested. You’ve got all the major networks and other ones. But if you’re out in a rural area, you might not have any TV, or if you do, you might maybe only have a couple of over the air channels. So there’s lots of space there, but not so much maybe in Seattle or New York City. And something that I think the FCC could’ve done more work on earlier, they’re making progress now, but it just goes to show that I think this should be a wake up call to the country. We’ve got to solve this problem in the next few years because hopefully COVID is the last time we’re going to see something like this, but maybe not. And we’re going to need it regardless, whether we’re having a COVID crisis or not.

Suzan DelBene: And the disparities existed before the COVID crisis too. To your point, one of the mayors in a rural part of my district made a point of saying, “I can’t have economic development. There are businesses who want to locate here. There are people who want to live here. But without basic, reliable Internet access, it’s just not an option.”

Jackie Whisman: Pivoting a little to privacy, which is an important issue to so many of us, and one of your signature policy issues, you introduced federal data privacy legislation last year that takes a really pragmatic approach to the issue. But I guess first I want to ask why you think a national privacy standard is necessary.

Suzan DelBene: First, I’d say we need to make sure that we have laws in place to protect people’s civil rights, civil liberties, human rights, in a digital world. And we’re behind there. And one of the most basic things that we need to do is make sure that people have control over their most personal information, and that’s privacy. And we talk about privacy. We talk about it in so many areas, and yet in the United States, we don’t have a consistent privacy policy. In fact, we really don’t have one at all. Some states have taken efforts here. California passed a law. My state has worked on legislation, nothing that has passed yet. But we need a federal law. We need to make sure that people’s information is protected everywhere in our country, and if we’re also going to be a leader in helping set global standards, then we need to have a domestic policy that we can bring to the table too.

So this is an urgent issue because as we move forward and look at things like artificial intelligence and facial recognition, and start talking about how we move forward there, really, we fundamentally need to build on top of privacy. I think privacy is kind of the foundational element. And then we need to continue to look going forward at how people’s information is protected, how we make sure that we address disparities and technology. We’re only going to move forward if we start at the beginning, and the beginning is privacy in my opinion.

Rob Atkinson: One of the issues that I think had to been driving Congress to do something here was the California privacy bill, which just went into effect a few weeks ago. And I don’t think that’s an ideal bill from a number of perspectives. One, it’s a state bill, and if you’re a company like Microsoft, or CitiBank, or whoever you are, it’s very difficult to have 50 different rules. That’s why Europe passed the GDPR, their privacy bill, so they didn’t have 27 different rules. And then on top of that, the state AG in California, they did a study. And they found the compliance costs were over $60 billion a year, so incredible costs. And I know that’s one of the reasons you introduced your legislation was to get a national framework, which is super important.

And then on top of that, just today while we’re recording this, the European Court of Justice just ruled in what’s called Schrems case, about the ability of American companies to move data on European persons back to the US. Essentially, they can’t do it, or it’s much more difficult now to do it, which is very troubling. And I think, again, if we had a privacy bill, it would maybe make that a little easier. Your thoughts on that?

Suzan DelBene: Absolutely. I mean, Europe have moved forward with GDPR. And frankly, GDPR is becoming more of an international standard in a lot of cases because it’s the only thing out there. It would be very hard, especially for small businesses, if we had 50 different standards across our country. And we need to have a strong standard and a strong enforceable standard. And so in legislation I introduced, it’s having a strong national standard. We talk about enforcement and how that will take place because if we don’t have that in place, people won’t know what their rights are when they travel from one state to another. Or you might get a new dialogue box popping up asking you to agree to a slightly different agreement because what you agreed to in one state may not be the same in the other. And that’s why the EU moving forward with a collective policy has been so important, as you mentioned.

But we need to have our policy in place if we’re going to move forward and address all of the other issues that we’re seeing with technology. And frankly, when we look at the court ruling in the EU, as you just mentioned, part of it is we don’t have a privacy standard here. And if we do have a privacy standard, I also think that would make a lot of folks in the EU feel more comfortable about how we’re handling data, and the rules we’re putting in place and the enforcement that would be there. We need to move for a variety of reasons, and we’re behind. I also am the co-chair of the Digital Trade Caucus. And trade is another place where these issues are going to come up more and more, and again, highlights the need for us to have privacy standards so that we can move forward on digital trade as well.

Jackie Whisman: And how do you think that data privacy legislation will help American businesses and consumers?

Suzan DelBene: Well, I think first of all, for consumers, they want to be in control of their data. Their data, their personal data, especially their very sensitive personal data, shouldn’t be used without their consent. They should be able to know how it’s going to be used and agree with that. And so kind of this idea of opt in I think is very important. And if businesses who want to protect data as well want to know kind of: What’s the best way to do that? What are the guidelines that are in place if you’re a small business?

You want to know what is the bar that you have to hit to make sure you’re in compliance. And so some folks try and don’t quite know. It’s a world that changes frequently. And so I do think that we need to have a consistent, strong federal legislation that helps. And then we need to work internationally because folks are trying to make sure that their many businesses, even small businesses, are working internationally. And only if we have a domestic standard are we going to be really able to come to the table internationally and help set those global standards.

Rob Atkinson: If you asked sort of inside the beltway prognosticators in the privacy space last year, I think the betting odds, if there were a betting pool for this, which there probably should be, make a lot of money if you sort of had inside trader knowledge. Basically, it was kind of, well, maybe there’ll be a privacy bill by the time the California bill goes into effect. And clearly, we haven’t had that. And to me, that challenge is sort of this Goldilocks conundrum. There’s some folks who want it, if you will, too soft, and some folks who want it too hard. In other words, there are some people who want a very tough kind of GDPR bill, which in our view would be a little bit overboard. There are other folks, sometimes Republicans, who don’t want to do as much, if anything. And obviously, one of the big sticking points was private right of action.

Your bill was kind of that Goldilocks bill, which seemed like it was a nice compromise. I use that in a very good sense of the term. It tried to balance both the concerns of over regulating and under regulating. Where do you see us going now? Obviously, nothing’s going to happen this year, but in a new Congress next year. Do you think something will happen? And you think it’ll be kind of a compromise middle ground position?

Suzan DelBene: Well, first I think people have to feel a sense of urgency about this. I do, which is why I’ve been pushing on these issues pretty much since I’ve been a member of Congress, and things like email privacy, because we still don’t have a warrant standard on all email. And so that’s why when we talk about making sure basic, even in this case, basic Constitutional rights are upheld in a digital world. Congress has to step up. And these issues aren’t always partisan. But I think one of our biggest challenges is that lawmakers don’t always understand them. And when lawmakers don’t understand them, they’re hesitant to take a position because they’re not sure what the right or wrong position is. And I think that has led to a lot of the kind of stalemate in moving forward on privacy.

So I encourage folks to make sure they’re educating lawmakers, talking to them about how critically important this is, that EU Court of Justice should provide another sense of urgency at how critically important this is. And it is about, as we continue to see folks using technology in so many ways, it is about putting those basic protections in place. And privacy, as I said, is fundamental. I’ve also tried to make sure that we start with the core element of privacy. There are so many other things that we need to work on. And so I think this is foundational, but I do not think it is at all comprehensive.

I think there’s more work we’re going to need to do as we look at things like, as I said, AI, facial recognition, et cetera. But if we can’t do the basic element of privacy, we will struggle. So I do think there’s an opportunity. People need to feel that sense of urgency and realize how important it is that we have a federal standard, and that we decide at the federal level how enforcement will work. I think those two components, which are key components of my bill, help us to move forward, and then be able to do the work that we need to do in these other areas as well.

Rob Atkinson: You mentioned the email privacy, which again, we’ve been long, long crying out on that one. It’s just bizarre when you think about it. If I store my email on my laptop, there’s a different standard for the government to get access to it as if I store it 10 miles away with a wire called a broadband wire on a computer that somebody else owns, IE, the cloud. It’s a law that made sense when it was started when we didn’t have the cloud, but it doesn’t make sense now.

Suzan DelBene: Technology has changed. And when we look at what took place when the Electronic Communications Privacy Act was passed back in 1986, yes, maybe leaving messages on a server, they would’ve been considered abandoned. But it is surprising that here we are today, that one of the most basic, fundamental things we could do is pass email privacy act. And yet since I’ve been a member of Congress, that hasn’t been something we’ve been able to get through the House and the Senate. And so that really highlights how hard it is because that shouldn’t be controversial at all. It is really about updating a law to represent Constitutional rights in a digital world. So that’s why all of this is so hard.

Rob Atkinson: But luckily, you are still fighting. And one thing I will add, a lot of people who maybe aren’t in Washington can get discouraged when you hear conversations like that. But usually, Congress gets around to doing the right thing. It just doesn’t happen sometimes in the first few years. But eventually, things do get done. And so I think this is one of those cases where I’m optimistic. I don’t know when it’ll happen, but I think it will happen.

Suzan DelBene: I think it will too. I think I continue to push and educate folks on these issues. I do think that public pressure as well, highlighting that this is a priority. I think sometimes technology issues have been back burner. They’ve been really important for some groups, but they haven’t had the broad public awareness. And I do think that has been changing too, whether it’s email privacy, or broad privacy legislation, or even when we look at kind of everybody has an experience in terms of how their information’s been used in a way that they didn’t expect. And I think that broad public awareness will really impact policy. And so I’m hopeful we will get it through. I just think we’re behind. We should’ve had it through already.

Jackie Whisman: Well, final fun question. What is the technology you’re most excited about for the future?

Suzan DelBene: Well, there’s a lot of things. That’s a hard question to answer because there’s so many things.

Jackie Whisman: Especially for a technologist.

Suzan DelBene: Right, exactly. But one thing, and maybe it’s because of what’s happening in our world right now, one thing I’ve been very excited about and that’s moving forward pretty quickly right now is telehealth. One, because it’s been accelerated, waivers allowed telehealth to operate more broadly in our country, given the pandemic and how important that is. And I think we’re seeing the just incredible opportunity, not just in a pandemic, but for folks in rural areas who might not have access, for seniors who it’s hard to get out and go to a doctor anyway, even more risky in a pandemic. So there’s huge opportunities for us to expand access to healthcare, use our healthcare resources wisely, have a better experience for patients. Mental health is another place where we know we need greater investments, and telehealth can help there. So we have really big opportunities, and I think the pandemic has allowed people to see some of those opportunities more. And so I think we’ll see a lot of movement there as a result of this, and with some policy changes going forward. But privacy matters there too, so another pitch for privacy.

Jackie Whisman: Yeah.

Rob Atkinson: That’s an area, again, we wrote a report on that about four years ago, or five or so, calling on Congress to pass national legislation to enable that. It stalled out as a bipartisan bill. But again, I’m hopeful in the next Congress, people now realize, boy, this is super important, and again, have a national framework, partly for privacy, partly for state interoperability and regulatory rules, so a lot to do next session.

Suzan DelBene: Yep, a lot to do. And I think there’s a lot we can get done. We just need to keep pushing folks. And maybe because everybody’s using technology a lot more now, they’ll understand the urgency and we’ll see more progress. I’m hopeful, and I think we will get there. I just want us to get there faster.

Rob Atkinson: Absolutely.

Jackie Whisman: Well, we’re glad you’re there. And thanks for being here.

Suzan DelBene: Thanks. Thanks for having me. It was great to talk to you. And hopefully, I’ll get to see folks in person sometime soon.

Jackie Whisman: One of these days.

Suzan DelBene: Yeah, exactly.

Jackie Whisman: All right. Well, that is it for this week. If you liked it, please be sure to rate us and subscribe. You can find the show notes and sign up for our weekly email newsletter on itif.org. Feel free to email show ideas or questions to [email protected]. And follow us on Twitter, Facebook, and LinkedIn, @ITIFdc.

Rob Atkinson: Thanks for listening. We have more episodes and great guests lined up. New episodes will drop every Monday morning, so we hope you’ll tune in next week.