Losing the fight against Big Data

SACRAMENTO, Calif. — Two years ago, Target suffered a major data breach in which the records of 110 million customers were stolen by hackers. Customers might never have known their information had been compromised, however, if it weren’t for a 2004 California law — the first of its kind and emulated around the country — requiring companies to notify customers when such thefts occur.

These days, though privacy legislation is facing new and difficult hurdles in the Golden State. As a result, the state famous for being ahead of the curve on issues ranging from environmental conservation to equal pay is falling behind in protecting digital privacy.

In the last two years alone, a number of meaningful measures introduced in the state capitol to regulate personal information have failed. One such effort would have helped define what information your car systems collects about you and what it does with data it downloads from your phone, if synced to the car, such as your address book. Another sought to shed light on a hidden market for DNA. Many hospitals collect DNA at birth to screen for congenital health issues, and there are no laws preventing them from storing it indefinitely or selling it to for-profit researchers.

“I ran a bill saying hospitals just have to let parents know this is happening. I could not get it through committee,” said Assembly Member Mike Gatto, chair of the Assembly Committee on Privacy and Consumer Protection. “I’ve met with all these security experts and they all say you have to stop thinking about if; you have to start thinking about when all this personal data will be stolen.” 

While privacy groups and the tech industry have made progress in protecting users’ privacy from government surveillance, the industry is staunchly opposed to similar regulations that would require it to disclose its own data collection practices and use of customer data.

“We in California really did establish some important precedents that turned into national policy,” said Kevin Baker, former top Judiciary Committee staffer in the state Assembly, now with the American Civil Liberties Union. “I’m not sure anybody thinks of us in those same terms anymore.” 

This shifting of gears began a decade ago, when tech companies began spending heavily on lobbying groups and the growing fortunes of the industry became closely intertwined with the state economy. California’s budget largely depends on personal income tax, half of which comes from the top 1 percent of earners — many of whom work directly or indirectly in the tech industry. Coupled with a change in the election law that has pushed state politics toward the center, more business-friendly Democrats are being elected than ever before. The effect: the state’s historically strong voice on consumer issues is slowly being supplanted with pro-“innovation” arguments at the cost of consumers’ interests, critics say.

What lawmakers decide in California, moreover, has an impact around the country. And legislators are listening.

“There are folks who will do what the tech industry wants them to do,” said Mark Stone, who chairs the Assembly Judiciary Committee, which reviews many privacy-related bills. “And that’s what we saw with the privacy bills that came through last year.”

California’s efforts to protect consumer privacy were grounded in the state’s constitution, which is one of just a few that grants citizens an explicit right to privacy. Voters added that right via an amendment back in 1972, but the ballot statement those voters read in support of it is more relevant than ever:

“Computerization of records makes it possible to create ‘cradle-to-grave’ profiles of every American,” it reads. A right to privacy “prevents government and business interests from collecting and stockpiling unnecessary information about us.” 

In this spirit, the ’90s and early 2000s saw the passage and expansion of a number of landmark state privacy measures such ones on data breach notification, increased protection for telephone calling-pattern data and the Shine the Light law, the brainchild of State Sen. Liz Figueroa, which gave consumers the ability to inspect and limit what informatoin financial institutions can share about them.

That momentum hit a speed bump, though, when Google started its California lobbying operation in 2004. Around that time, Gmail — then a brand new product — rolled out a new form of keyword advertising that scanned the bodies of users’ emails. Figueroa alleged that this amounted to an illegal wiretap on personal communication and moved to ban the practice.

Her bill faced fierce opposition from the company, and with strong industry pressure and a lack of support from other legislators, the measure failed.

A month later, Google launched a record $120,719.68 lobbying campaign — still by far the most the company has ever spent in a single quarter — on “discussions regarding spyware, email, scanning, phishing, general technology issues,” according to lobbying disclosure records. 

Other tech companies soon followed suit. Over the years, an ecosystem of trade groups and lobbying firms has developed to represent the industry’s interests in Sacramento. 

TechNet, one of the biggest tech lobbying firms in the state, spent nearly half a million dollars on lobbying in the 2013-14 session, up from just under $150,000 when it started in 2007. Another firm, the Internet Association, is one of the newest but is also extremely active. It has lobbied on more than 40 measures since it was founded in 2013 and often sends a representative to testify in committee hearings. In October, it hosted a policy conference in Silicon Valley at which Assembly Member Evan Low, who represents the area, announced the new Technology and Innovation Caucus. The group aims to work with the industry to help “foster innovation” in the state.

Ride-sharing company Uber was one of the biggest tech companies to spend money on lobbying in the 2013-14 legislative session. While fighting a 2015 bill intended to curb the misuse of customer location data, Uber, along with a half dozen other groups, argued that the bill would shut down ride-sharing businesses and rallied customers and drivers to defend the companies. The bill died in committee. 

Lawmakers say the technology industry’s unwillingness to find common ground has already set it apart.

“What makes the tech industry different is the laws being proposed have not been onerous by any stretch,” said Assembly Member Mike Gatto, chair of a new committee on privacy and consumer protection. “The companies don’t trust government, and they don’t even see why they should be a part of the law.”

Lobbying is only one element that has bolstered the tech industry’s influence. Recent changes in California’s electoral system and the economics of how the state funds its initiatives have incentivized making business interests a top priority.

In 2012, California changed its election laws to become a “top-two” primary system, in which the two largest vote-getters in the primary, regardless of party, face off in November. Under the old system, the Democratic primary was often the only competitive race, since many California districts have little Republican support. 

Now candidates have to prepare for both a competitive primary and a potentially competitive November election against a member of their own party, requiring twice as much fundraising.

The top-two system and similar reforms are also pushing vocal consumer advocates out of the Legislature in favor of more moderate, business-friendly Democrats, some political analysts say. In a general election between two Democrats, the logic goes, a candidate can plan a successful strategy by appealing to the center.

In 2014, Democratic candidates outwardly courted Republican voters by highlighting common ground on policy issues, according to California political analyst Tony Quinn in an article published earlier this year in the California Journal of Politics and Policy.

Other reforms, such as a 2010 rule change requiring only a simple majority to pass the budget, as well as statewide redistricting that year, have also played a part in pushing the state toward the center.

It’s still too early to see how this change is affecting statewide politics, but privacy advocates say they’re already seeing Democrats embracs the business community over consumer groups. “That’s completely changed the political culture here,” said Samantha Corbin, a Sacramento lobbyist who represents privacy groups. 

A number of legislators who were fierce privacy advocates have left office and been replaced by ones with stronger business ties. For instance, State Sen. Mark DeSaulnier, who became a U.S. congressman late last year, authored an ultimately unsuccessful attempt at regulating data brokers — companies that buy and sell consumer data. His seat was filled by Democrat Steve Glazer, who came in second in the Democratic primary and wouldn’t have been eligible to run in November under the old rules. 

Glazer, a self-described centrist, won the general election by more than nine points in a race that cost a record $12.1 million. According to state campaign finance data and MapLight, a nonpartisan political money-tracking group, more than 10 percent of outside spending came from JobsPAC, the California Chamber of Commerce’s political action committee set up to fund Democratic candidates who are likely to support business interests.

In his first few weeks after being sworn in, Glazer, more often than any other Democrat, broke with his party. He voted against a guaranteed family-leave bill on the chamber’s “Jobs Killer” list and abstained in a vote on a minimum wage increase.

Moderate Democrats in Sacramento are in the process of forming their own caucus in order to create voting blocs on key issues. That still “enigmatic” group, as described by the Los Angeles Times, has declined to disclose an official list of its members or detail its leadership structure. It has weighed in successfully, though, on recent environmental and labor battles.

For example, the governor’s office estimated that Facebook’s initial public offering in 2012 would add $1.9 billion to state revenues. The extra cash was meant to head off the governor’s proposed cuts in schools and social programs for the poor and disabled. But the IPO underperformed and the state lost an anticipated $600 million in revenue, forcing the governor to revise the state budget. 

As former State Sen. Joe Simitian told the San Jose Mercury News at the time, “If Facebook is on a roller coaster ride, we’re on the roller coaster with them.”

Personal income tax revenue is also volatile since income from high earners depends largely on capital gains, which is an unpredictable source of revenue, according to a report from the Legislative Analyst’s Office, the state’s nonpartisan fiscal advisory agency. 

“Capital gains and stocks, where much of the revenue comes from, that’s the stuff that goes like gangbusters and then falls through the floor,” said Kim Rueben, who sits on the Council of Economic Advisors for the California controller. 

In 2014, California voters passed Proposition 2, which created a rainy day fund to mitigate any future market drop. Reuben says it’s a step in the right direction but has testified before the Legislature urging even stronger measures. The most recent LAO fiscal outlook report dedicates a section to the Bay Area and the state economy’s reliance on its success.

This dependency on a fickle revenue stream, driven largely by the tech sector, in which fortunes seem just an app-launch away, has left some in the state reticent to pass any regulation that could slow its rise. 

Jim Beall, a member of the new Technology and Innovation Caucus told the San Jose Mercury News last year, “We don’t want any legislation to have a negative impact on jobs in Silicon Valley.” The interview was right after he voted against a bill opposed by the tech industry, which would have allowed users to remotely deactivate their phones in the event of theft.

As technology has become a vital part of daily life, privacy concerns have continued to grow. Educating the Legislature is key, privacy advocates say.

“The number of bills that try to address privacy doubles every year, but it doesn’t mean that the legislators and staff are much more informed, and it doesn’t mean getting them enacted is any easier,” said Lee Tien, senior staff attorney at the Electronic Frontier Foundation. 

This year a new legislative committee was created specifically to address privacy issues. So far, the Assembly Committee on Privacy and Consumer Protection, chaired by Gatto, has contributed to bills on drones and body cameras and one that would require makers of Internet-connected televisions to inform users when TVs are recording and transmitting room audio. 

But it’s hard to tell yet what effect the new committee will have and if it will be a success for consumer privacy protection. The committee, which was created in part to ease the workload of the Judiciary Committee, also includes representatives of Silicon Valley, which some worry will limit its effectiveness.

“[The committee was created] also in a way to get it out of that Judiciary space and into something that might be a little friendlier to the industry’s perspective,” said Stone.

Two members of the Privacy Committee, Ian Calderon and Evan Low, are also the founding co-chairs of the new California Legislative Technology and Innovation Caucus, which was launched at the fall policy event put on by the Internet Association. Two other members of the Privacy Committee also belong to the caucus.

Californians who want to resolve legislative gridlock also have the prospect of initiating a ballot measure. Such a process is expensive, however, and could also face fierce industry opposition. A recent San Francisco ballot initiative to regulate home-sharing faced $8.5 million in spending from AirBnb, which opposed the initiative, according to MapLight. The proposition failed.

But despite pressure, lobbyist Corbin and others see this tension as something California is uniquely positioned to resolve. 

“The truth is everyone is looking at California hoping we can figure it out,” Corbin said. “Because we have been a leader on this issue and because the state is a hub for innovation in technology, we have a responsibility to do it right.”