| |
| META TOPICPARENT | name="FirstPaper" |
|---|
| |
<
< | Lovecraftian Corporations | >
> | Evasive Maneuvers -- How the Privacy Regulations Can Cover Government Actors in the Future | | | | |
<
< | -- By Anderson Dalmeus - 01 Mar 2024 | >
> | -- By Morgan Carter - 05 Mar 2024 | | | | |
<
< | Corporations have become nearly ubiquitous in the every day life of Americans. They are understood by their branding their products and services and the people who work there. The corporate entity can be understood as a kind of legal fiction ordained by the bureaucracy of the state. However we might also consider taking the phrase “corporate entity” in a very literal sense. That is when we say that google is a corporate entity we do not merely mean to say that it is a short hand for understanding the culmination of disparate processes and projects that form google but rather that google does in fact take on a life of its own by the process of incorporation. This may seem like a tortured conclusion and even now as I write it I can feel myself stretching the phrase “take on a life of its own” but it isn’t an unprecedented interpretation either. This thinking should really just be considered an extension of the reasoning that led the Supreme Court to their decisions in Santa Clara County v. Southern Pacific Railroad and Citizens United v the FEC. Corporations law is designed for the purpose of manifesting the capital C “Corporation” as a distinct legal thing from its property and its labor and these cases tell us that corporations also have 1st amendment rights to free speech and 14th amendment rights to protections from the state. However I will have to break with the Supreme Court in one small detail of their characterization of corporate entities. Rather than viewing them as persons or having personhood they should be viewed the same way one views the abominations of a Lovecraftian horror. They are creatures that exist abstractly and even to begin to perceive them in their true forms fundamentally alters the mind away from the natural reasoning of a human. Their machinations are unknowable in their entirety and their goals are not always anthropomorphic. One might consider that the shareholders or the board of a corporation are ultimately responsible for its decisions but that is like saying the neurons in a person’s brain are responsible for their decisions. It is doubtless true but reveals little about the actual person. The same way the cells of the body come together to form a whole person without ever arguably being able to engage with or understand that they do form that person the workers and owners of a corporation form an 3entity that they will never be able to engage with directly. It is why the law imposes fiduciary duties on board members. Because the corporation cannot speak to any individual piece that makes it any more than I can directly talk to my own cells and these duties prevent the entities constituents from becoming cancerous to it. While it may yet still seem farfetched to claim that a corporation literally does exist as a result of the law, is that more farfetched than selling your time to that corporation? If the corporation is not literally real then where does a someone’s time go when they spend all of those hours working for it? Obviously not to that person because then they’d be working for themselves. That person feeds their time, their energy, their hopes, their dreams and nearly everything they hold dear to that corporation but the corporation doesn’t actually exist. What is to be said of a world where a person can give all that they are into nothing? Certainly we would call this madness. But even then we are simply led back to the Lovecraftian description of the corporation and its impact on those who engage with it. One pours their blood sweat and tears into the void and while it would be an emotionally satisfying to say that the void isn’t there the apparent absence of all the effort poured in is evidence that something is there. If that void were not there to speak of then all that was poured into it would also be there. Likewise it is evident that corporations do exist because something seems to be draining humanity of all its energy and productivity. Something is eating the planets resources at a rate that no mere organism could. One might say humans could do that but as stated before humans are the to corporations as cells are to the human. Individual cells could not do what the entire human could and you could have as many cells in the human body as you would like but they all only move when the greater human acts intentionally. This means that corporations the wretched conglomeration of human activity and productivity are inevitable. The horrific conclusion of a Lovecraftian story is that the eldritch creatures pulling the strings of society are unavoidable and cannot be defeated by humanity. In the Lovecraftian lens this is because they are like natural disasters. Devastating though they may be they are merely a part of life that are simply beyond the control of mankind. But I will take it a step further still. The corporate entity is not merely a force of nature mankind must contend with but rather it is the human nature of any group that grows to be a size large enough to have that complexity. The corporate creature awakens at some point after enough human mass and activity comes about and it begins to consume all that there is to consume. The only choice on the individual level for humans is whether to be part of the entity or to go off the grid. | | | \ No newline at end of file | |
>
> | The California Consumer Privacy Act (CCPA) and other data privacy regulations across the nation were passed with a goal in mind: to protect consumers from the extensive sharing and selling of their data by companies profiting from that personal, and often private, information without consumer knowledge or consent. Similar legislation passed in the years following the CCPA in states like Virginia, Colorado, Utah, and Connecticut. While there are variances across the different consumer data regulations, a consistency across the board is that they are considered progressive steps forward, intended to allow transparency and provide protection for their consumers.
In the time that has passed since the passing of the CCPA (now California Privacy Rights Act (CPRA)), businesses have worked to comply with the obligations imposed, and it seems that more and more legislation aiming to protect consumer data will emerge in the coming years. But the successful implementation of these state privacy regulations has enabled a far more dangerous and pervasive form of data collection, share, and sale of consumer data. It was recently revealed that the United States government has been “buying up reams of consumer data — information scraped from cellphones, social media profiles, internet ad exchanges and other open sources — and deploying it for often-clandestine purposes like law enforcement and national security in the U.S. and abroad.” The digital footprint that any American citizen has, “[t]he places you go, the websites you visit, the opinions you post — all collected and legally sold to federal agencies.” Id.
There is considerable danger and justified discomfort in the knowledge that the United States government is quietly purchasing and collecting consumer data from companies. This data can be, and is, “used for everything from rounding up undocumented immigrants or detecting border tunnels. We’ve also seen data used for man hunting or identifying specific people in the vicinity of crimes or known criminal activity.” See also. We risk turning into an even bigger surveillance state than we already are with government purchasing consumer data, and many of those risks are even higher for minority populations. [see also Carter, forthcoming Columbia Law Review, March 2024].
While consumers may be protected from (some) of the predatory share and sale habits of for-profit businesses thanks to the existing privacy regulatory framework, the United States government has found a way to access this information while not being subject to the requirements of the data privacy regulations specifically designed to avoid such collection as this. This was likely accomplished through a few means. One, the privacy regulations apply to companies that meet certain criteria, and the government and government contractors were probably conducting business with companies that fell outside of these criteria. See id. For example, the CPRA applies “to any for-profit organization, which may do business in the State of California,” (emphasis omitted) and “applies to businesses that:
[1] Have a gross annual revenue of over $25 million in the preceding calendar year, or
[2] Buy, receive, or sell the personal information of 100,000 or more California residents, households, or devices, or
[3] Derive 50% or more of their annual revenue from selling or sharing California residents' personal information[.]”
To avoid the companies who would be subject to regulations like the CPRA, these government organizations and associates need only coordinate with the businesses just outside of these parameters. For instance, the government gleans consumer data from “tiny, obscure data brokers,” with “very little public-facing presence and almost no direct consumer relationship. Some of these companies focus on consumer data. Some focus on social data. Some focus on movement data.”
The second way that government was able to get around the privacy regulations is merely by taking advantage of the functionality of the “opt-out” mechanism. These regulations offer “opt-out” provisions that require businesses that qualify under the legislation to offer consumers the option to either opt out of the sharing of their data, or to be able to see to whom their data is sold.
In the European Union, the General Data Protection Regulation (GDPR) uses an “opt-in” format that requires consumers to intentionally choose to allow their data to be collected and shared by the pages that they visit. In the United States, it is the exact opposite. As a result of this, more data is collected because opting into data collection is the default option. The companies that evade privacy regulations are able to exploit this default option and collect large swaths of consumer data, and profit off of selling it to third parties such as government and government contractors.
For current and upcoming consumer data privacy regulations to improve upon their goal of protecting consumer data and increasing transparency about where consumer data is going, future amendments and regulations should adjust the criteria for qualification under the privacy regulations and should make efforts to move our nation to an opt-in system. On the former point, the current revenue requirement should be lowered to include more businesses than it does at present. Considering the government is currently buying data from “tiny” data brokers, a smaller revenue requirement could help to include some of these parties. Alternatively, the number of residents whose data is bought, received, or sold could be reduced for the same purpose. Including for-profit businesses that receive even 10,000 residents’ personal information, instead of the current 100,000, could be included and help to reduce the degree to which the government is able to quietly access this information.
Also, moving to an opt-out system would at the very least reduce the number of people whose consumer data and private information is caught up in the share and sale data market. The conscious choice to opt into data share would reduce the number of people who do it, and agency could be successfully returned to large swaths of consumers.
The government has been taking advantage of the data privacy regulatory framework as it is today, but there is still time to change it to avoid an even stronger surveillance state. |
|