Flood of Federal Legislation Introduced - AI and Data Usage
By: Rebecca A. Bortolotti
In the wake of allegations involving Cambridge Analytica and various campaigns, several bills have been introduced to address the compilation and use of data gathered from a multitude of sources. As advancements in technology, including the use of AI, continue to explode, constituents are becoming increasingly concerned about what data is being compiled about them and how that data is being utilized to influence their decision-making. Several bills have been introduced since January of 2019. Ultimately, law makers are grappling with the application of existing laws to the new circumstances that have arisen from the use of AI and the large amounts of data that can now be processed. There is also a clear indicator that law makers seek investment by the US Government in AI-related resources to position the country for a new world where AI is mainstream.
American Dissemination Act of 2019 (S. 142)
S. 142 seeks to extend the Privacy Act of 1974, which limited dissemination of personal information by government agencies, to “covered providers” of internet services. Covered providers include a service that uses the internet and collects records. Records include information beyond traditional personally identifiable information and would include education, employment history, biometric data such as fingerprint, voice print, retina or iris images or other unique physical representations, and user-generated content. S.142 seeks the promulgation of regulations that limit dissemination of the records, the ability for individual to access their own records kept by a company, and the ability of individual to correct any errors.
Social Media Privacy Protection and Consumer Rights Act of 2019 (S. 189)
S. 189 elevates the visibility of the type of data compiled through use of an online account. S. 189 requires that prior to a user creating an account and using that account on a “covered online platform,” the operator of the platform must allow the user to elect that his or her data not be collected and used in any manner. Notably, S.189 requires a notification of the user within 72 hours if a privacy or security issue has occurred either against user’s election or in breach of the privacy and security features of the platform.
Commercial Facial Recognition Privacy Act of 2019 (S. 847)
S. 847 provides the limitation on the use of facial recognition data and requires user notification whenever their facial recognition data is used or collected. The bill also requires third-party testing before the technology can be utilized commercially to ensure it is unbiased and does not cause harm to consumers.
Algorithmic Accountability Act of 2019 (S. 1108)
S. 1108 requires evaluation of highly sensitive automated systems. The bill focuses on large companies with access to significant amounts of data. The bill targets automated systems that affect a consumer’s legal rights, attempts to predict or analyze their behavior, involves large amounts of sensitive information, or monitors large publicly accessible locations.
Privacy Bill of Rights Action of 2019 (S. 1214)
S. 1214 proposes a broad definition of personal information that is protected from compilation and disclosure. The bill defines personal information as “information that directly or indirectly identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to, a particular individual.” The bill creates a right of a customer to receive notice of the collection, retention, use and sharing of personal information compiled in a central, user-friendly location. Of note, this bill, rather than including an opt-out provision, includes an opt-in provision. The opt-in provision creates an affirmative obligation on the part of the covered entity to obtain approval for the collection, use, retention, sharing or selling of the individual’s personal information.
AI in Government Act of 2019 (S. 1363)
S. 1363 seeks to create a new office within the Administration called “AI Center of Excellence.” The AI CoE will be charged with advising and promoting the efforts of the US government to develop innovative uses of AI.
Artificial Intelligence Initiative Act “AI-IA” (S. 1558)
S. 1558 seeks to ready the US for an AI economy by building an AI-ready workforce and accelerating the delivery of AI applications to government, educational institutions, and private institutions. The bill creates a national agency to coordinate federal AI efforts, including the creation of standards for evaluating AI algorithms and their effectiveness, as well as the quality of the underlying data sets. The bill also seeks to require the Department of Energy to create an AI research program and state of the art facilities to support the program.
Do Not Track Act (S. 1578)
Akin to the Do Not Call lists, S. 1578 provides for an opt-out of data tracking by users. The bill would allow for the option to block any secondary data tracking that is not necessary to the functioning of a particular service.
Voter Privacy Act of 2019 (S. 2398)
S. 2398 attempts a narrowly tailored approach to protecting voters from psychological manipulation online by amending the Federal Election Campaign Act of 1971. The bill provides a right of access of voters to understand the categories and specific pieces of personal information that a company has obtained about the voter and the right to seek deletion and prohibit the transfer of that personal information. In the event a company receives personal information, the company must inform the voter as to the scope and purpose of receiving such information. Finally, and most significantly, the bill seeks to prohibit a company from using a voter’s personal information to deliver targeted communications to that individual.
Given the importance of the issue to many, we are likely to see additional bills introduced. However, passing these bills into law and adopting the regulatory environment for understanding and implementing could take several years.