Federal privacy legislation that protects civil rights is critical for all Americans

We should celebrate the fact that Congress is considering legislation that would give all Americans robust privacy protections. Equally important, pending privacy legislation would implement the first significant, nationwide expansion of civil rights protections in over a decade. In addition to provisions that would give individuals more control over their information, the bill would bar businesses and nonprofits from using personal data in a manner that discriminates on the basis of race, color, religion, national origin, sex, or disability. While work remains to ensure Congress’s efforts are protective and practical, we must seize the opportunity to advance the civil rights of all Americans in this digital era. Risks stemming from digital services have never been more complex, and the need for meaningful safeguards has never been more urgent. 

Civil rights are the nonpolitical rights of a person, enshrining the laws and values crucial to a functioning democracy and society. We think of civil rights as affecting only a few, but civil rights affect everyone. Civil rights protections have expanded to include a broad array of communities that we, as a society, recognize need further protection as a result of historical and societal harms. These groups are not limited by race, and include people with disabilities, women, members of the LGBTQIA+ community, those from different national origins, and those subject to age discrimination. Each of us depend on someone whose civil rights are at stake in this country. 

In many ways, privacy — particularly in the context of digital services, electronic data flows and personal data — is a civil right. In addition to privacy, it’s crucial that a data protection law incorporates explicit legal safeguards against direct discrimination and indirect harms (disparate impact) to marginalized communities. For example, a data protection law should prohibit data-based discrimination in areas such as housing, lending, education, and employment, where modern harms and denials of opportunity are now, for the most part, decided by algorithms. As a result, data can be used against people, with consequences that we are just now beginning to appreciate, and existing laws do not clearly provide the protections needed in a modern age. 

It is these rights — civil rights — that are directly addressed by current bills pending in Congress. What is at stake is bigger than the interests of individual states: it affects the lives of a majority of Americans. State laws, including the California Privacy Rights Act and laws passed in Colorado, Utah, Connecticut, and Virginia, typically codify existing civil rights laws, but to date have not extended civil rights protections. The U.S. needs a law that will implement clear and meaningful civil rights safeguards. 

Marginalized communities across the nation deserve and require robust privacy and civil rights protections. This includes Indigenous communities in Kansas and Oklahoma, Latino communities in Arizona, and Black people in Mississippi, Alabama, and Louisiana. Without a federal standard, these communities will be even more vulnerable to discrimination in housing, credit, and employment opportunities, which are increasingly determined by data-driven algorithms or artificial intelligence that can easily reproduce societal biases or lead to discrimination based on training data that does not reflect the diversity of America.

An example of how to implement these protections can be in the American Data Privacy and Protection Act (ADPPA), a significant bipartisan bill currently being considered in the House. The proposed law has some shortcomings, which many have been engaged at addressing. ADPPA does not include some provisions that civil and human rights groups would prefer, such as enhanced damages (or treble damages) for victims of civil rights violations. Additionally, portions of the bill could be revised to provide greater regulatory clarity for covered entities, including small businesses and nonprofits.

ADPPA’s approach to civil rights, however, is commendable. For instance, ADPPA clarifies that online discrimination is illegal and would be the first federal law explicitly extending civil rights protections online. As technologies and business practices have evolved, civil rights laws drafted in the 1960s and 1970s have not kept pace. ADPPA would modernize civil rights for the digital age: It is significantly stronger than the current frameworks in place and would update existing civil rights protections, further clarifying that digital discrimination is illegal and mandating that companies take meaningful steps to address algorithmic discrimination, not just against marginalized communities, but against children as well. 

Marginalized communities across this country deserve privacy protections that explicitly name them as protected, now more than ever. The civil rights provisions of the ADPPA offer a concrete path to substantial protections for these communities. Policymakers must consider what it would mean to lose this important opportunity by failing to come to the table. We cannot walk away from this proposal, and instead must ensure that all of our leaders in Congress and across all sectors of the digital economy meaningfully engage. Only when these protections are codified will we be assured that more people are able to fully participate in a connected future with protection against discrimination. The stakes are too high to waste this opportunity.

Bertram Lee is Senior Policy Counsel, Data, Decision Making, and Artificial Intelligence at the Future of Privacy Forum (FPF), a non-profit that serves as a catalyst for privacy leadership and scholarship, advancing principled data practices in support of emerging technologies.