Welcome to Tech Talk. Bye.

Welcome to CDT's tech talk where we dish on tech and Internet policy while also explaining what these policies mean to our daily lives. I'm Brian Wasilowski and it's time to talk tech. CDT is a nonpartisan organization, but let me speak for myself by saying it was a pretty repulsive first week for the current administration if you love civil liberties. One of the many awful executive orders the president signed stopped the application of privacy act provisions to non US persons. CDT's president and CEO was part of the team at the Department of Homeland Security that helped develop the policy this executive order removes, And she'll be joining us to address why we are opposing the president's actions. We'll also hear from the author of our body our bodies, our data about the huge market out there for personal health data and who is really benefiting. Here's a hint. It's not the patients. Hopefully, you have read the recent impassioned post from our president and CEO about the president's executive order that ended a policy of applying some privacy act provisions to non US persons. Well, it was so impassioned because Nula was one of the leaders that helped develop and implement the policy while at the Department of Homeland Security, and she is also someone who immigrated to the country. It very much resonated with her on a personal level. The order essentially makes it so that non US citizens or persons, such as people applying to immigrate to the country, cannot request to see the official records the the US government holds on them. Nuala O'Connor returns to Tech Talk to share more about this. Welcome, Nuala. Hi, Brian. Thanks for having me. Oh, always a pleasure. Of course, you always gotta have your boss on. Right? So so first, because this is so wonky for people, but you did a great job of breaking down what it really means. Tell us what this executive order changes. Thank you so much, Brian. So the privacy act indeed

before this week was the province of wonky government lawyers and folks who cared about bowels of buildings in Washington DC full of file cabinets and and and lots and lots of paper mostly. But really the privacy act is the comprehensive federal privacy law in The United States governing what your US government knows about you. So, you know, The US as you know is criticized around the world for not having comprehensive sectoral approach, meaning different sectors of industry are covered by different laws. But the federal government has long been covered by a comprehensive law dating back to 1974, really, and the creation of the first mainframe databases and the ability of the government to collect and process and store a lot of information about you, the citizen, or you, the citizen, or you, the visitor or immigrant or a legal permanent resident of this country. What the privacy act requires is is basic privacy fundamentals. The right to know what your government has about you. The right to see it in limited but real circumstances, things that aren't classified or or top secret, etcetera, and be able to obviously correct it if the files are wrong. This is incredibly important if you are applying for citizenship or applying for some kind of legal status or immigration status or refugee status. And again, you know, the cases I've seen where people have lost these documents in in harrowing situations, sometimes you just need to see the file in order to get a copy of your own birth certificate or or other documents. So it's but it's an important principle on a not only on a personal level, but on a on a comprehensive kind of legal level that there should be no secret government databases. This is an age old principle of privacy law and frankly of fairness, and it's an important check and balance on government power. And so to say we're gonna cut off people's ability to see what the government has about them and to create essentially secret or or opaque databases is a pretty scary thought around not only here in The United States, but around the world.

So just to clarify that Americans, an American citizen or as we say a a person, and I guess in the legal terms, has the right to look at what the government has about us. But this applies to a non US citizen. I know is not the right term. It's persons in the legal sense, have the right to see what the US government is holding about them. Is that something that other countries allow? You know? Because I could feel as though some people would think

reciprocity here or something like that. You've nailed it. And so what's different about US law, what has been different is that, interestingly, The US was one of the first countries to go on record to have some of these rights for their own citizens. This is the privacy act of 1974. Privacy law spread kind of like wildfire across Europe and and the rest of the world through the eighties and the nineties. Most of the European data protection laws actually date from after The US privacy law but include rights for all persons. So an important principle here is many privacy laws around the world treat all persons the same regardless of their citizenship. The US privacy act historically and on the face of the statute only provides rights to US persons. And so you're right. You're struggling we're struggling over the language. A US person is a US citizen or a legal permanent resident, an LPR. An LPR is also known to all of us as a green card holder. Why Brian mentioned earlier I care so much about this is I was a green card holder for almost half of my life. The first, half of my life till I went off to college, I was a green card holder living legally in The United States. My parents waited a long time for their visas from Ireland, and they will tell you all about that story sometime. But, you know, they feel very strongly about legal immigration and, the treat the fair treatment of citizens and immigrants to this country. I care about the dignity of all persons regardless of their citizenship, and I believe that our laws should treat humans with dignity under these principles. That's a principle that's ensconced in other nation's laws that the US Privacy Act does not frankly reflect the greatest, extent possible, but a number of us working in the federal government. And really, I'd I'd love to take all the credit for this. The many of these policies predate my time at the Department of Homeland Security. Members of our team at DHS had worked at justice and had implemented these kinds of policies really because it's more efficient. And when I let me talk about what policy I'm talking about. What it means is we applied privacy act principles to all persons regardless of citizenship, going above and beyond what the law required, but really out of a sense of fairness and a a sense of fair play and equality for all human beings. Also, operationally, it's just easier. If you've got one database that has people who are US citizens or persons and non US citizens or persons, to figure out who is a citizen, who's not a citizen when they make an application to see their file, frankly, is is kinda difficult. It's additionally burdensome. You'd have to require more information about the person making the request or you'd have to bifurcate the systems. And we all know how strapped US federal agencies are for for money and resources in the IT space. Asking them to build a whole separate system to house information about non US persons or US persons and provide different systems and different processes to all the employees working on those requests would actually been a huge burden on the US government. So you've got all these com what I would call commingled or combined systems. Also, you've got a huge system, INS, the Immigration and Naturalization Service among them and chief among them, where people change status. So suddenly, you've got a person who wasn't a US citizen who now is. You're gonna have to go and find their file legally, physically, or digitally and yank them out of the system and put them in a different system. That just seems like a big pain in the tush, frankly. So so operationally and in terms of cost savings and if I'm being flippant, but in terms of real cost savings and efficiency for federal government employees and resources, it makes more sense. And, oh, by the way, it's also the right thing to do and it respects the human rights and dignity of all persons in the system. And, oh, by the way, it also puts us on parity with the rest of the world in passing these laws. So for lots of good reasons, but esoteric and really operational, it was the right thing to do. It was the easy thing to do. It was kind of a no brainer. I had tremendous support from Tom Ridge, our secretary of homeland security at the time, and the whole team at the privacy office at DHS. And again, building on a history of that kind of positive treatment of visitors and residents in this country, it's simply the right thing to do. What this order last week did is undo all that work. Undo all and walk back all of those positive strides made by folks, both political and career employees of the federal government, in trying to do the right thing for for legal permanent residents and visitors to this country. So it's an incredible disappointment. Frankly, that news is overshadowed by much even even more, you know Of course. Incredible news and and and shocking news about treatment of of visitors and and immigrants and refugees to this country. And I'm sure we will cover some of those issues in future podcasts.

That We've have we've have a lot to cover now in our first week. So we'll pick them off, you know. A very technical but very important

signal that it sends about how we're gonna treat people coming to this country. And then I could go on and on on on, you know, how I feel about the importance of immigrants in in the social fabric and in the history of The United States. But more imminently, it also sends a very disturbing signal to our friends, not only in Europe but around the world as we try to negotiate cross border data flows and global treaties on the use of information on the free flow of goods, services, data, and people. And so while, you know, there was a lot of kind of shock and and and awe in the privacy community on on Thursday and Friday when this came out, about the privacy shield and about the current status of the agreements. It does not imminently undo or, you know, immediately undo privacy shield or any of the existing agreements,

signal that this administration believes in the principle that that US persons are entitled to a different treatment under this law, which on the face of the law is not inaccurate. But it sends a very concerning signal that we are not

treatment of all persons under private law. Is a truly nonpartisan issue. You were under a Republican president, and it continued under a Democrat. So it seems strange that this is now getting hacked. The great thing is you did such an eloquent job of running through that. I have no questions. She actually ticked them all off from, you know, why are secret databases bad to the business perspective to privacy shield. So that's great. Any last thoughts from you on this? Or in general, you know, the week, you know, would we be remiss, as you said, to really it's been gosh. Has it only been ten days? Maybe a few more, you know, kind of what we've seen and what it means for

beyond this issue, civil liberties, especially the the digital rights that we advocate for. We're very concerned about the treatment of all people at the border. And while it is true that that that our rights at the border are are quite limited, that the rights of the of a state of any state to decide who comes and goes into the country, and to assess threats is real. We're gonna fight hard any excessive intrusion into people's daily digital lives, whether through their cell phones, whether through their social media postings, whether through, you know, the the things that they have on their person when they arrive at the border. This is a an issue of basic human dignity and c CDT stands for the rights of the individual regardless of nationality or country of origin or personal, attributes or, or status. And this is just the beginning of this

fight. Well, thank you, Nuala. If you haven't already read Nuala's post, please visit cdt.org. We've also created a medium account for Nuala, so check that out. And, she's gonna be writing a lot more. So visit that. We're gonna see some wonderful things. Always a pleasure, Nuala. Thank you, Brian. There's almost no information about you that is more personal than medical data. This could be as simple as your weight or blood pressure, but also includes the prescriptions you take or STIs you've had in the past. All of this information might be useful to you your doctor, but it's also extremely valuable to businesses in the medical space such as healthcare providers and drug companies. In his new book, Our Bodies, Our Data, Adam Tanner takes a look at the multibillion dollar industry that is built on our medical data and explores why the true goal of more patient data, improved medical care is mostly eluding us. I'm thrilled to welcome Adam to Tech Talk. Thanks for joining, Adam. How are you? Good. Good. Nice to be with you. So tell me a bit about the book. What was it that what's it about? I mean, I kinda gave an intro. And what what motivated you to write it?

to strengthen privacy protections. So tell us tell me a bit, about what is exactly out there. You touched on it a little bit, and certainly, we all have that experience of going to our our doctor and feeling as though there's some sort of electronic record. But you kinda touched on it. There's a much bigger train. What is your trail of data? What is out there?

that outsiders may be able to piece together and figure out who you are. So then in reality, you know, anonymized data is kind of a loaded word. It's kind of de identified data that may not be too hard to reidentify. Is that what you're saying? I think so. What has happened is with computerization becoming,

Yeah. I know. That's a great great example because it wouldn't it seems to me pretty easy to identify Adam from that, you know, if they just know a little bit about you and can kind of piece that together. So expand on this a little bit. It's a multibillion dollar industry. Why is this information so valuable? How is it being used? And what are the companies or, you know, the different business models that are built off of it?

you know, anonymized or de identified data, does that remove that from protection? And HIPAA, I'm gonna mess up exactly what the acronym stands for, but it's the health privacy law.

Interesting. So let's get back to, I mean, this has kind of freaked me out. Well done. That's definitely made me think about my health data and my, actually, doctor's appointment tomorrow. I I work, I go through one of those kind of fancy concierge ones where it's all about, you know, making appointments online, getting your results, you know, via an app. So a lot to think about there. But you did raise this a little bit. There are certainly good uses for this data. But, you know, certainly in your book, you make the case that they aren't really being fully realized. Why is that? How can how can we make it so that patient data, health data is actually used to improve our health?

Information, that remains quite elusive. Yeah. It sounds like it it might be difficult to change doctors and, you know, have all your data follow you from one doctor to the other and and all that sort of stuff. So is there advice, you know, average citizen, someone who, you know, cares about their health, wants to have more control of their health data? I mean, for whatever reason it is, whether it's to just get better better care or if it's just, you know, privacy concerns. Do you have any advice on how, you know, if it's if it's our body and our data, how we can take better control of it?

to medicine and if so, to whom. That's a great point. And of course, everyone should exercise their choice to donate to the Center for Democracy and Technology. We're a great nonprofit. So I'll put the plug in there. But more importantly, you should definitely all check out Adam's new book, Our Bodies, Our Data. Hopefully, this excited everyone about it. Pick up a copy. Adam, thank you so much for joining Tech Talk. This was truly informative.

That's it for this episode of Tech Talk. Be sure to check out Nuala's post at cdt.org and follow CDT across social media platforms to keep up to date on how we are addressing the flurry of activity from the new administration. It's definitely a time we all need to stand up for our civil liberties, and CDT has never been more committed to advocating for everyone's digital rights. I'm Brian Wasilowski. Thanks so much for listening.