Exploring the Digital Frontier: The Urgent Need for Privacy Regulation

Thanks so much for having me.

So it actually began when I was in law school. I knew I wanted to teach law.

It was in the mid nineties just at the time that the, the commercial Internet, was taking off.

And I took a cyber law course, one of the first that was given, and I really thought the issues were fascinating. I also thought the Internet was here to stay. At the time, there was a lot of talk that this was just gonna be a passing fad, and the Internet would would disappear.

But I thought, no. That that this was, this was gonna be big. And at the time, there wasn't a field of privacy. There really wasn't much of a field of cyber law either, but I thought that was probably gonna be the field.

And so I focused my work on cyber law, and privacy was an issue that was barely explored. There was hardly anything out there. So I thought it was an interesting way to start. And then I was intending to go and write about some other issues in cyber law and teach cyber law.

I wasn't planning on teaching privacy.

But, I after doing an article in privacy, a bunch of things happened. One, another professor was hired along with me when I went on the teaching market. He had a case book in cyber law. And so I realized, he's gonna be teaching cyber law, not me.

So since I had done some research and thinking on privacy, I proposed to teach a privacy class. And they said, sure. You know, as long as you teach, your, you know, a required first year course, we'll let you teach this other course. So I said, okay.

I'll I'll I'll do privacy.

And I put together some materials.

I, had, you know, an unpublished paper and privacy, but all of a sudden, I get all these media calls, including from The New York Times, saying, hey. You're a privacy expert. And and it's pretty exciting to be called an expert when, you know, hadn't even finished teaching a semester. I hadn't even published the paper yet, on the topic, and suddenly I'm an expert. So that was kind of neat. It made me realize that there really was a need for this, and the field kept growing.

And, so I did a case book in the area. I took the materials I made for this the class and turned to that in. And then I just one issue after the other just kept arising. And so I don't know exactly when the time turned when I realized, wow.

You know, I there's enough here that I'll never get to other cyber law issues. I don't need to. There there's so much here to explore. I really, you know, hit a really big area, and it was always fun.

It was always exciting. The issues were always changing, and the field was always growing. So, I stuck with it. A lot of surprises, and interesting things along the way.

You know, when I started, it was it was before HIPAA.

It was before the GDPR, long before.

So many of the laws that we talk about today weren't in existence when I started.

So one interesting difference is just how much, has changed in the law, how much law has been passed. Because law is typically very, very slow, and moves at the speed of a turtle. But, in privacy, it's actually moving at the speed of a hare. It's it's pretty remarkable how how much change has happened. Also, the issues and the terms and everything else have changed dramatically.

I remember the days, you know, before the use of the term, you know, AI wasn't really used and talked about that much. It was kind of they were in the AI winter, and no one wanted to talk about AI.

And there really weren't people didn't talk about algorithms. So it's like, what what do I talk about? I wrote an article about computer databases, and that was the term. And then there was a term data mining, then, big data became in vogue.

Then, the use of algorithms and inference was talked about. And then finally, now it's AI. Then there were days where everyone was talking about the cloud. Oh my, the cloud.

Then there was the Internet of things. So there's a lot of things that kind of got very, very hot, terms that arose, debates that happened, and continue to happen.

So it's remarkable just how fast things have changed, how much has evolved in the law. But, also, I think interestingly, and to some extent, ironically, is how much also things have stayed the same.

So when I look back at and for this project of my book, I look back on some of the things I wrote in the early days.

And, the things I warned about, you know, are here.

The problems that were there then are still with us. They're just more acute.

But a lot of the all the key concerns and concepts with AI were really present twenty five years ago, actually.

It's just that AI has made, things faster and more efficient.

But a lot of the issues and the concerns and the problems are are still were there and are still there.

And so I think that's really interesting. It's just this combination of old and new that, exists, with with this. That, in one hand, I can tell a story like hardly anything has changed.

You know, there are problems back then. I warned you, and now I can kinda say I told you so. I told you so. You know, there there's a lot of, issues that were the writing was on the wall, or the problems actually were in existence, and now they're just worse.

On the other hand, there's so much new.

There's so much, interesting things so many interesting things to talk about.

Yeah. So, I mean, yeah, I was writing in the, you know, around two thousand.

And at that point, there was a big debate. Should we have a federal privacy law? Hey. Here we are again, and we're still having this discussion.

There was also the fact I wrote about a problem that I called aggregation of data that, you know, you can take a lot of data, and when you take a lot of pieces of data and you combine them, you can then, make inferences about other things, that people were not expecting to disclose.

And this phenomenon existed twenty five years ago, where, it was possible to track somebody's shopping patterns, track what they bought at the supermarket or what they bought on an online store, and then aggregate that data to figure out other things about people, like their health or their political beliefs.

And that was a problem at the time, and I warned about that problem that that was a it creates a lot of difficulties for the approach of privacy law, which is, yeah, okay. Let's give individuals control. You can decide if you wanna share data.

The problem is, how do you know what you're really sharing if, that data can be combined and then inferences about data that you didn't expect to reveal now suddenly is revealed?

And what we've seen with AI is this is how AI works. A lot of the technologies are taking massive quantities of data, looking for patterns in that data, and then are making inferences about that data. And at the time too, you know, twenty five years ago, I was writing about, you know, concerns about how that data gets used, that it is increasingly used to make decisions about people that have a real impact on their lives, decisions about whether they should be given a loan or credit, whether they, are arrested, whether they get a job, and a variety of other things that would impact their lives. And what we see now with AI is the same phenomenon. You know, the aggregation of data then being used to make decisions about people that have a big impact on their on their well-being, on on their lives, on their opportunities.

I think what we see now, though, is, you know, the algorithms have become more sophisticated. The, the, computing power is much greater.

So the, and the amount of data is much more. So there's so much more data to be used, more computing power to analyze that data, but, ultimately, this was still there all the way back then. It just wasn't quite as vast, sophisticated, vast, and, you know, the inferences made were not as, as telling as they are now.

A change in the nature of contract that, you know, in the past, you know, go back in the days before the Internet and before software took off.

You know, you get a contract and you get, like, a few contracts a year. You you just okay. Here's a contract because you got a gym membership or, you know, a subscription to something. But the number of contracts you get, a person would get in a lifetime, now they get maybe in a week.

And it's staggering.

And contract law has changed, and it's kind of allowed and relaxed the normal rules of contract. Used to be you have to have a meeting of the minds where you have to actually really agree to something. Now, you know, companies can say, here are terms. You know, take it or leave it. And, it doesn't matter if you read it. It doesn't matter if you understand it.

They're just kinda being imposed upon people. And then, you know, the courts just say, oh, yeah. It kinda is we'll just call it a contract. But it's really not.

It's a fundamental dramatic shift in the way contract law works, and it's not really consent. And I've written about this extensively, and I talk about it in the book. I don't think this is consent at all. This is just a total fiction, to think that people are really consenting at all in any which way.

And I don't think they can consent, meaningfully. So it's not the answer isn't just, oh, let's use the GDPR's approach and make people affirmatively consent. Let's just click a button. So then you put the accept button, you know, on the page and, you know, I think everyone's clicked except for the cookies, except for, the terms of service.

They're not gonna read fifty screens.

So that's all a farce. And then the other phenomenon you talked about was, the privacy paradox. This is the term for this phenomenon that when you take a poll, people will say overwhelmingly, like, ninety percent or more will say they really value privacy.

I think it's just, you know, almost poll after poll shows people really care about privacy. They say they do. But then when you look at behaviors, it it seems to be inconsistent with that because people share data all the time. They don't, exercise their privacy rights and access the data and correct the data and delete the data.

And so a number of folks will say, well, based on that, talk is cheap. Behavior is really what we should focus on. And it looks like from how people behave, they really don't care at all about their privacy, and so therefore, we shouldn't do anything to protect it. And and I, write in the book that that's totally wrong.

That's a wrong conclusion to draw.

And that's because the polls and the behavior are actually two different things.

The polls measure how much people value privacy, and, people really value privacy. I think the polls accurately reflect that. The behavior does not reflect the value of privacy.

The behavior is a risk calculation, and it's the decision that people make when they decide whether or not to use technologies or share their data with a website or or a company or whatever.

They're making a calculation. They're looking at the benefits, and they're looking at the costs, the risks. You know, basically, it's simple. Like, should I use this cool app?

Should I use this technology? Should I use a smart doorbell? Should I use a smartphone?

You know, whatever it might be. Should I share my data?

I'm gonna look at what are the benefits to me. And that's really easy to determine. Right? Oh, cool.

I get this cool thing. It's immediate. I'm gonna get it right there. I can easily understand what technology is going to give me, and it's gonna give me real great things.

On the flip side, it's incredibly difficult, actually, I think impossible, for consumers to figure out the risks.

And so they're gonna choose the benefit. When the risks are vague, they're in the future. They don't really know.

And so the phenomenon I talked about earlier where, companies can aggregate data, and the government too, can aggregate data and then make inferences from the data. How do I'd say, okay. You know? Should I share my supermarket purchases, in exchange for a big discount?

Yeah. The discount seems great. You know, nothing I'm buying at the supermarket is all that telling about me. I I don't see what the risk is.

So what? So the so they know that I bought, you know, you know, a particular product or, you know, whatever. Who cares?

Nothing I'm buying is embarrassing. Nothing I'm buying is telling.

The problem is that, you know, that data can be aggregated.

And then from the data, you know, sophisticated AI algorithms can now determine what my political beliefs are based on my purchases, what my health is based on my purchases, what someone's religion might be based on their purchases, and other things based on the buying patterns that they have. Now the consumer has no idea, you know, without being an AI expert, without being a computer scientist, without knowing the data that these algorithms are trained on, they're gonna have no idea what they're what they're revealing about themselves. So how can they make a risk calculation? And if they don't really know what what's gonna happen downstream with the data, they can't make that risk calculation.

What how is that data gonna be used five years from now? Could be five years from now. The government accesses it. Five years from now, and then you're rounded up and, you know, who knows what happens to you.

Or, you know, they, you know, the it's you sent to an insurance company, and as a result, your insurance rates go up or you don't get a loan based on this information.

And you had no idea. It's like, I just thought I was sharing data to get a discount at the supermarket. I didn't realize that these things were gonna happen to me with this information. They're gonna know this.

I don't see how a consumer can make this determination.

I'm an expert. I can't even make these determinations. I can't determine, should I share my information or not? Because if I you know, because I know the known unknowns.

And so the known unknowns are well, first, I wanna have a conversation with the privacy officer. I need to sit down. The privacy notice tells me nothing. It's junk.

It it says meaningless drivel that that's not worth my time.

So I'm gonna sit down with the privacy officer and say, okay. You know, show me your privacy impact assessments. I wanna see them. I wanna see because, you know, just because you say you do an impact assessment doesn't mean it's any good.

I need to see if it's good. So I'm gonna look at what you do. Did you capture all the risks? Did you mitigate all the risks?

How good are they? I wanna see your vendor agreements because a lot of times, the vendors that create the problem and the companies could have hundreds or thousands of vendors. I wanna how good are the agreements? How do you vet your vendors?

Do you monitor your vendors?

I wanna know about that. I wanna talk about the training. You know? Do they do you train your workforce?

I have a company that provides privacy training. What good are policies if you don't teach the workforce to follow them? So you can have the policies. Just words on a page unless people know what they're supposed to do.

So I think that's important, but I wanna see how good their training is and how often they train and the quality of their program.

And and do they do risk assessments, general risk assessments of things? How what are the resources for the privacy program? What's the buy in of the privacy program in the organization, the general organizational's culture about protecting privacy.

On the security side, you know, they say reasonable security, but what does that mean? I wanna know, you know, you know, what do you encrypt and how well do you encrypt it?

Do you train your workforce? Do you do penetration testing? You know? There's a lot of things I'd like to know to know about their oh, and all but about all the security with your vendors, you know, that that's usually the weak link. So I need to know about that.

It's a great question. And my answer is, I don't think there's much a consumer can do. And the law, unfortunately, puts all the onus on the consumer. It says, okay.

You handle this. We'll we'll let you access your data. You can correct your data. You can, opt out of things.

You can delete things. But I don't know when to you know? How do I know when a company doesn't need my data anymore? I don't know.

Do I have to constantly ask them? There's thousands of companies out there with my data, and I don't even know most of the companies that have my data. I'm sorry that I don't have time to become a free proofreader of my records at companies. I I have other things to do.

I even hate when I go, you know, and go to a website and the cookie banner pops up. Like, do you want our cookies, or do you wanna learn about the five thousand flavors of cookies that we have and toggle on and off each one? No. I just wanna see the site.

I don't wanna think about it. I don't wanna learn about cookies. I just wanna read what I came here to read. And I think that that's the problem.

But so what do we do? If if if we if if the law is wrong, they're sort of just throwing it into the lap of the consumer and saying good luck with that. The problem with, the world that we live in now is that a lot of digital technologies and, that use data are not there's no way I know they're safe. No one's looking out for their safety.

And I'm not going to be able to become an expert enough to make sure that they're going to protect my privacy in the way that I would like. And so I think the law needs to hold companies accountable for that and do what it did with cars and workplace safety and food safety and drug safety.

It needs to do the same with digital technologies.

It's got So sorry.

Sort of. I think there's still a room for consent. So I I don't think the government just decide, okay, you know, what's, you know, good for you and not good for you. Just like, you know, there's a lot of choices, and I think that's we need that for privacy and technology that, ultimately, I think, yeah, I can consent to, you know, giving the data.

But the law should prevent a company then from, you know, deriving, inferring, using algorithms to come up with all sorts of data I didn't intend to give them. So if I give them my purchases at the supermarket, they shouldn't be able to try to now figure out all things about my health when I didn't consent for my health. Regulation can be written based on how technology works, and it's really tethered to the way technology operates. And this is actually how the law regulating electronic surveillance, the Electronic Communications Privacy Act, the federal law regulating surveillance, was built around the way that technology looked in nineteen eighty six, and congress hasn't updated it.

So it's been almost forty years.

The law is way out of date. You know? Yeah. The Internet, email, all, you know, came after this law, and it it doesn't make sense. It it doesn't apply in a sensible way because it was built and structured around technology at the time. And a different way of writing the law is to focus more on the goals of, you know, kind of what technology does, how it's used, what what consequences flow from it, and what values we wanna protect. And so you say the law should define those goals.

How the technology works shouldn't matter. It should be that the law is about we wanna achieve these goals no matter what happens with the technology. So an example is there's a law passed in the nineties regulating video privacy.

And the law was written at a time where people were renting video cassette tapes.

And when the law went to define what's covered, it said video cassette tapes and other similar audio video media, you know, that roughly. So a language that was a catchall that basically said, we're gonna write this not tying it to the particular type of technology today, but we're gonna write it so that in the future, we don't know what's gonna happen. But at least the same goals, protecting privacy are gonna apply no matter what is used. And now, you know, that law applies to streaming video and other mechanisms for delivering video, which makes sense. And and the laws evolved, well and were much better, than the ECPA, the law of electronic surveillance, because it was written in a way that wasn't tethered to a particular technology at the time.

And and, ultimately, that that law, the law of video privacy said, look. We really wanna protect video privacy. We want people to be able to watch videos and not worry that, you know, the videos they watch and the data is being gathered and sold to others without people's consent.

Another problem was that, you know, there was talk of doing a comprehensive federal privacy law around two thousand.

At that point in time, hardly any companies and industry wanted to do it. They were all against it, except for a few.

But the vast majority, you know, hated the idea because at that point, there wasn't a lot of privacy regulation.

They were excited because they could kinda fit, fall into the cracks and not be regulated, and they hate being regulated. So they I think I I was at the time, I pointed out that's shortsighted. Like, you know, that that's not you know, it's better to be well regulated and thoughtfully regulated than to kinda hope that, you know, you know, you're just gonna exist in this weird void. It's going to change.

The approach that we had in the United States was laws based on certain economic sectors. Yeah. But the problem is, you know, companies are the sectors aren't fixed. You know, we see that, you know, how the world worked and what what business looked like in the seventies and eighties and nineties is very different than how things are now. We have companies that are doing health and video and and a whole lot of different mixture of things that they didn't have that kind of mix before. So now we have companies that are regulated by dozens of different laws that are inconsistent with each other.

I hope that my legacy will be you know, I changed the conversation. I helped make put the regulation on the wrong track, rather than going in the wrong direction, doing the wrong things that it's doing the right things and that we really have a world where we have, you know, good privacy protective technologies. Because I like the technologies. I'm not a, I'm not a hater of technologies. I use a lot of these technologies, and I like the technologies. I just think, you know, we need to, just like I wouldn't wanna roll back the industrial revolution and, you know, you know, get rid of cars.

But I think we can do a lot better on that. I don't wanna be the the kind of George Orwell told you so too late, and, now you're just saying, if only we had listened to him. So I hope that, you know, that there's a, a chance that, you know, that you know, it's not too late to take a change, to change our direction, to do something, and to regulate privacy well. I think it's still possible, but I definitely think we need a change in thinking and a greater political will, and I hope a little bit more, recognition by industry that, this ultimately is is not gonna be a bad thing for them.

They might think it is, and they think, like, things like preemption. It's gonna be really bad. It'll be better. You know?

That yeah. I wish I could yeah. They you know? I think it would have been better off if they around two thousand had, you know, we had a comprehensive privacy law, but, you know, they they didn't want it then.

And I made the argument, look. It's going to be better for you. You're not going to like the world in ten to fifteen years, but that's too long away. And now they don't like the world the way things are.

I think the same argument can be made. I just hope that, you know, that they'll they'll appreciate it, but it does take some long term thinking and thinking out of the box and historical thinking too to see what is likely to happen.

Sure. So I have a website. My general website is, danielsolove.com. So you can always go there and you'll be able to find my writings, my books.

A lot of my writings are available for free, so you can you can get those. You can also get some of my older books for free. You can download those. The newest book on privacy technology, sorry, you have to pay for it. It's not too expensive. You can get that on Amazon or on, on on Barnes and Noble or online bookstores.

And then if you're interested in, the things I do with privacy training because another hat I wear beyond my professor hat is that I provide training to companies on privacy and end user data security.

That training I provide training for a lot of different companies. The site is techprivacy.com and I put out a lot of materials, some summaries of the laws, a lot of this is free, cartoons and other things that are just information out there. And then for those who want it, there's training for their workforce on what is privacy and what do they need to do to comply with the vast landscape of privacy laws out there. So my job is to try to synthesize all that and create a way to teach laypeople at a workforce what all that means and how it all adds up.

Thanks so much for having me.