The Washington PostDemocracy Dies in Darkness

The Technology 202: More than 200 companies are calling for a national privacy law. Here's an inside look at their proposal.

with Bastien Inzaurralde

Ctrl + N

Want more tech policy news? Sign up to get The Technology 202 in your inbox

A broad coalition of more than 200 retailers, banks and technology companies is releasing new recommendations for national privacy legislation today in a clear push to get out in front of lawmakers promising to rein in their data collection practices in the next Congress.

The Business Roundtable’s consumer privacy legislation framework, provided exclusively to The Technology 202, calls on the United States to adopt a national privacy law that would apply the same data collection requirements to all companies regardless of sector -- while ramping up Federal Trade Commission staffing and funding to enforce the rule. It calls on companies to give consumers more control of their data and form a national standard for breach notification. 

“We see a real need to both protect consumers at a time when digital services and the digital economy is so important and expanding, and at the same time, making sure we’re advancing global competitiveness,” Julie Sweet, chief executive of Accenture North America, who chairs the Business Roundtable's technology committee, tells me. 

Members of the Business Roundtable include chief executives from companies such as Apple, Walmart and Wells Fargo. And some of its top executives such as J.P. Morgan chief executive Jamie Dimon and AT&T chief executive Randall L. Stephenson will meet with policymakers including Ivanka Trump and Sen. Mark Warner (D-Va.) at a CEO Innovation Summit in Washington later today. 

The fact that such a wide cross-section of companies -- far beyond the technology campuses of Silicon Valley – are actively seeking ways to change the collection and storage of data online reflects a sea change for the privacy debate in the United States. Companies such as Salesforce or Verizon, for instance, may not be in the eye of the political storm in Washington recently in the way that, say, Facebook has – but they also have skin in the private debate.

After all, every company is a technology company; it’s not just popular social networks or search engines that will be subject to national privacy legislation but any company that handles personal information online. As the Marriott data breach highlighted just last week, companies that are rarely associated with the technology industry hold tremendous amounts of data about individuals -- and they may not be doing enough to protect it. 

All this puts even more pressure on policymakers -- especially Democrats who have pledged to get tough on Big Tech as they take over the House. They will need to craft a bill that fulfills their promise to crack down on tech companies’ highly publicized misuse of their customers’ data but that also does not impede businesses big and small, in every sector from retail to media.

The Business Roundtable's framework is relatively broad -- and that reflects the challenge. Its recommendations to lawmakers include: 

  • Streamlining existing federal data collection laws so there aren't conflicting regulations. Historically, federal  law has been sector-specific, with different standards for businesses handling sensitive information such as financial services or healthcare.
  • Some self-regulation: Companies should adopt some widely considered best practices, such as considering privacy from the design phase of a product or conducting consumer or conducting privacy assessments. But the law shouldn't mandate that. 
  • Ensuring any law has flexibility to determine what kind of consent consumers need to have for their data. It does specify that companies should recognize consumers' right to transparency about how their data is being used and provide ways for them to access and change their data, and delete it under certain circumstances. 
  • Creating a national standard for breach notification laws that would take the place of state laws. But it does not get into specifics about when a company should notify consumers it was hacked.  It just says within a "reasonable" time.
  • Putting the FTC as lead agency to enforce the law. It also calls on state attorneys general to coordinate with the federal government. Currently, state attorney generals have been some of the most powerful enforcers in data breach cases.
  • Considering how the law will impact small businesses that do not process much personal data. Lawmakers should be wary of the risks a privacy law poses to innovation, it says. 

What's more, Business Roundtable does not include some of the highest profile technology companies that have recently been under fire for their mishandling of user data. For instance, Google, Facebook and Amazon are not members. (Amazon founder and chief executive Jeffrey P. Bezos also owns The Washington Post.) 

It's a big tech day in Washington, and it remains to be seen whether privacy will be top of mind. Technology executives, including some who are also part of the Business Roundtable such as Oracle chief executive Safra Catz, are expected at a separate White House lunch on innovation with the Trump administration -- in what's appears to be easing an easing of tensions after President Trump's clashes with Silicon Valley on issues ranging from anti-conservative bias to antitrust issues. (IBM, whose chief executive is also attending, tells me for instance its priorities for that meeting include artificial intelligence and quantum computing.)

Whether or not it comes up at the White House today, the devil will be in the details as lawmakers try to craft a privacy bill before 2020, when a law in California is slated to go into effect

Already, Democrats are saying they will not support a national bill that is weaker than protections consumers have in local jurisdictions. And as my colleague Aaron Gregg reported, some Democrats in the wake of the Marriott breach want the U.S. to adopt fines that are similar to the EU's  General Data Protection Regulation , which contains fines up to 4 percent of a company's global revenue if it fails to comply with its requirements.

Jay Stanley, a senior policy analyst with the ACLU, said any company that handles personal information is going to have to tighten its ship if a national law passes. But some companies will feel the burden of a national privacy law more than others, whether or not they’re considered a technology company, given the way many operate in today’s digital economy.

“If you’re in the business of profiting off of shady intrusions on people’s privacy, then I think you need to worry,” Stanley said. “There is a reckoning that’s taking place right now.”


BITS:  A trove of documents released by a British lawmaker yesterday could fuel other investigations of Facebook from lawmakers around the world. The documents offered a rare glimpse into the inner workings of  the company, revealing  how company executives internally discussed issues ranging from privacy to competitors' access to data. 

Here's the top issue to watch: "The internal communications, some of them from Facebook CEO Mark Zuckerberg, appear to show Facebook trading access to user data in exchange for advertising buys and other concessions, which would contradict Facebook’s long-standing claim that it doesn’t sell people’s information," The Washington Post's Craig Timberg, Elizabeth Dwoskin and Tony Romm reported.  Emails dated from October 2012 show that chief executive Mark Zuckerberg was considering  ways to monetize this resource. “Without limiting distribution or access to friends who use this app, I don’t think we have any way to get developers to pay us at all besides offering payments and ad networks,” Zuckerberg said in one of the emails released yesterday.

Facebook quickly went on the defensive, with Zuckerberg posting on his personal Facebook page that the documents were just part of discussions. “We've never sold anyone's data,” he wrote. Yet Damian Collins, who is leading the parliamentary investigation into Facebook, said the social giant had “whitelisting agreements with certain companies” to access user data after the social network restricted such access in 2014 and 2015.

NIBBLES: There is no indication that Zuckerberg will relinquish his position as chairman of Facebook's board of directors despite the latest scandal. As CNBC's Salvador Rodriguez noted, “there is almost nothing” the board could do to remove him even if it tried. Zuckerberg is the majority vote holder and could show the door to any director seeking to push him out, according to CNBC. “If Zuckerberg wants to stay chairman then Zuckerberg is going to stay chairman,” Stuart Grant, co-founder and managing director of Bench Walk Advisors who previously sued Facebook, told Rodriguez.

Meanwhile, Facebook Chief Operating Officer Sheryl Sandberg received the backing of the company's board in another scandal. The board defended Sandberg's decision to inquire whether philanthropist George Soros shorted Facebook's stock as “entirely appropriate,” the Wall Street Journal's Deepa Seetharaman reported. Nevertheless, the accumulation of controversies is taking a toll on Facebook's workforce. “Current and former employees describe a tense and, at times, hostile atmosphere inside the company, one in which both senior employees and even staunch loyalists are contemplating their futures,” BuzzFeed News's Charlie Warzel and Ryan Mac wrote.

BYTES: The documents indicate that Facebook users and developers were kept in the dark about the company’s data collection practices. “Company product managers discussed testing new features to collect call logs on Android smartphones in a way that might have made it harder for users to understand what they were giving away. They debated collecting call log data from users in ways that would bypass the privacy permissions people normally check off when signing up for an app,” Craig, Tony and Lizza also reported. 

Facebook even realized that it could result in backlash against the company, at one point discussing how the media might portray it. “This is a pretty high-risk thing to do from a PR perspective but it appears that the growth team will charge ahead and do it,” the email read.

In addition to privacy concerns, the documents called attention to the company’s hard-nosed tactics in dealing with competitors, particularly the Vine video app owned by Facebook rival Twitter. A Facebook manager suggested the company immediately cut off the app’s access to data, according to the documents. “Yup, go for it,” Zuckerberg replied in one of the emails.

Rus Yusupov, co-founder of Vine, recalled the episode on Twitter:


-- The release of the Facebook documents prompted a flurry of reactions on Twitter:

Collins, the British lawmaker who released the documents, explained his decision on Twitter.

Sen. Richard Blumenthal (D-Conn.) said the FTC “must act decisively & vigorously” following the release of the Facebook documents.

Bloomberg News’s Sarah Frier said the emails also show “how ruthless” the social network is with its competitors.

The revelations could raise legal issues for Facebook, according to Columbia Law School professor Tim Wu.

And Cher also weighed in.


-- The White House is hosting tech executives and academics for a discussion about innovation. The guests, per my colleague Tony Romm, include Sundar Pichai, chief executive of Google, Satya Nadella, chief executive of Microsoft, Ginni Rometty, chief executive of IBM, Safra Catz, chief executive of Oracle, Steven Mollenkopf, chief executive of Qualcomm and Steve Schwarzman, chief executive of the Blackstone Group. On the academic side, Farnam Jahanian, president of Carnegie Mellon University and Rafael Reif, president of MIT, will also attend the event.

 — Google maintains an advertising service for small local businesses in China that doesn’t generate significant revenue but helps the U.S. company remain on good terms with Chinese authorities, according to the Information’s Wayne Ma. Google helps smaller businesses place ads abroad through its Google Export Experience Centers — a service that Chinese companies cannot provide under the country’s censorship rules — but also receives some perks from public officials, the Information reported.

“The officials shower the centers with incentives like free rent, according to government statements and people familiar with the deals, and promote them through elaborate ribbon-cutting ceremonies,” Ma wrote. “The centers help Google build political goodwill by aligning with China’s economic goals to boost exports from small businesses.”

— Tensions already running high between Washington and Beijing just went up a notch after Canadian officials said a top executive from Chinese tech company Huawei Technologies faces extradition to the United States. “Meng Wanzhou, a senior executive who is also the daughter of the tech giant’s founder, Ren Zhengfei, was arrested in Vancouver on Dec. 1, according to Canada’s Department of Justice,” The Post’s Emily Rauhala and Ellen Nakashima reported.

— Encryption-cracking quantum computing is coming — though not right away. “Quantum computers with the ability to crack today’s encrypted systems are at least 10 years away from development, according to a report compiled by the National Academies of Sciences, Engineering, and Medicine,” Nextgov’s Frank Konkel reported. “However, the report — released Tuesday — makes clear that quantum computers pose a dramatic threat to the encryption that secures today’s networks and computer systems and calls for the development of cryptography immune to quantum computers as fast as possible.”


— Waymo is starting the United States's first commercial driverless service in Arizona, marking a major break in the expansion of autonomous vehicles. “It’s a big leap between testing this stuff and booking and transporting a passenger who’s paying money for a service,” Costa Samaras, an automation expert at Carnegie Mellon University, told my colleague Michael Laris. “This is real.”

Waymo One, as the service is called, is launching in Chandler and other communities near Phoenix. “Waymo, part of Alphabet Inc., is starting small, rolling out the service first to hundreds of the company’s local volunteer testers, and only in part of this sprawling region of almost 5 million people,” Michael reported. But expanding driverless vehicles will require winning over the public. “There is significant public skepticism about self-driving cars, and polls find most people don’t want to ride in them,” according to my colleague.


— A majority of New Yorkers support Amazon’s plan for their city but are having mixed reactions about the incentives that the company is receiving. “Fifty-seven percent of New York City residents who responded to the poll approved of Amazon building one of two secondary headquarters in the Long Island City area of Queens, more than double the 26 percent who said they oppose the move, according to a Quinnipiac University poll,” Reuters reported. “Respondents were divided on the $2.8 billion in tax breaks and incentives offered to attract Amazon, with 46 percent supporting them versus 44 percent who oppose the package, the poll found.” 


— More news generating buzz on the Web:

Alex Jones grovels in a frog costume, and other symptoms of Twitter withdrawal (Avi Selk)



  • CEOs from Walmart, The Boeing Company, IBM , AT&T Inc. and other top companies are speaking at a CEO Innovation Summit with Ivanka Trump and Senator Mark Warner at The Anthem in Washington.
  • Executives from Microsoft, Google, Qualcomm and Oracle visit the White House for a roundtable discussion on innovation.
  • Microsoft President Brad Smith participates in a discussion on facial recognition at the Brookings Institution.

Man arrested after Cheesecake Factory promotion chaos:

Police arrested a man on Dec. 5 at a Cheesecake Factory in Arlington, Va., where a crowd of unruly DoorDash drivers were picking up orders. (Video: Remy Hendra via Storyful)

George W. Bush honors his father with tearful eulogy:

Former president George W. Bush eulogized his late father, former president George H.W. Bush, at Washington National Cathedral memorial service on Dec. 5. (Video: The Washington Post, Photo: Bonnie Jo Mount/The Washington Post)