Op-Ed: The federal American Data Privacy and Protection Act protects everybody's data

By David Brody

July 28, 2022 3 AM PT

When a business signals “whites only,” it does not matter if it is written in ink or pixels, words or code. The discrimination is the same. The harm is the same. And the legal consequences should be the same.

Yet our laws and courts often treat discrimination on the internet differently. Because there is no comprehensive online federal privacy law, online entities can collect, use, buy and sell data about our identities and then discriminate against us. Bipartisan legislation working its way through Congress right now can change this.

Everyday life — including finding a job, buying a house, starting a business and shopping — now occurs online. Civil rights in online commerce are just as important as equal opportunity in person.

Existing antidiscrimination laws often cannot help because they were written before the internet was created. Some, including the Civil Rights Act of 1964, do not cover shops or have unresolved questions as to how they may apply to online businesses. Others apply only to specific sectors, like housing and employment, but may not cover new types of algorithmic services that match individuals to these opportunities, or new forms of commerce such as influencers or gaming. Some federal laws do not apply to discrimination on the basis of sex or religion.

Under current federal law, it is legal for an online retailer to charge higher prices to women or to refuse to sell products to Christians. Algorithms used for targeting advertisements and decision-making frequently produce unequal outcomes in housing, employment, credit, healthcare, education and other businesses. And individuals have little recourse against algorithms and artificial intelligence models that reinforce the biases and racism that pervade our society as a legacy from historical segregation. Consistently, Black and brown individuals have been shown to be disproportionately affected by discriminatory uses of personal data.

Facebook-owner Meta, for example, recently settled a civil rights lawsuit brought by the Justice Department and agreed to change practices that delivered housing ads in a manner that discriminated against people of color. Academic research has shown that facial recognition technology disproportionately discriminates against Black and brown people, and especially misidentifies Black women. Amazon at one time consulted a hiring algorithm that penalized resumes for including the word “women’s” and gave lower priority to applicants from two all-women’s colleges.

All of that could be remedied by the American Data Privacy and Protection Act, a bipartisan and bicameral effort to safeguard data privacy and civil rights online. The legislation is one of the most significant developments in federal internet policy in decades. It would build out our civil rights infrastructure to fight discrimination in a data-driven economy. It recently advanced out of committee with overwhelming support: a 53-2 vote.

The American Data Privacy and Protection Act protects civil rights online. It prohibits discriminatory uses of personal data; requires bias testing for algorithms that determine access to and eligibility for essential economic opportunities; requires companies to collect, use or share only as much data as is necessary to provide services consumers expect; and provides for reasonable enforcement. Importantly, the bill allows individuals to sue companies that violate their rights. The Federal Trade Commission, state attorneys general and state privacy agencies would also be able to enforce the law.

There are ways in which the legislation could be improved, such as adding a requirement that companies use independent auditors to test their algorithms. But in all, the law is a crucial step toward ensuring that all Americans have equal opportunity on the internet, meaningful privacy rights and equal access to online goods and services.

Like any bipartisan bill, compromise is necessary for enactment. The American Data Privacy and Protection Act would block some state laws that address the same issues, while preserving others such as civil rights or consumer protection laws.

California has better privacy laws compared with other states, but that does not mean they are actually and objectively strong. Some in California don’t want to see its laws superseded. But state laws cannot extend outside the states in question. Consumers in other states should not be left vulnerable; the price to achieve protections for everyone is a uniform federal standard. The price is steep, but worth it.

Moreover, according to an analysis by privacy advocates, the proposed federal law is stronger than any of the state data protection laws, including California’s.

For example, unlike the federal legislation, the state data laws do not expressly prohibit discriminatory uses of information collected online. They don’t require that algorithms are tested for bias or that companies provide consumers with privacy by design. And they don’t provide the right to sue.

The analysis shows that the federal bill also has stronger provisions for guarding kids’ data, location tracking, health information and for regulating data brokers.

Privacy rights are civil rights. Data privacy laws should ensure that who we are cannot be used against us unfairly. Lawmakers need to protect all Americans by passing the American Data Privacy and Protection Act.

David Brody is the managing attorney of the Digital Justice Initiative at the Lawyers’ Committee for Civil Rights Under Law.