Amendment to Cybersecurity Act Would Deter Federal Government Privacy Abuses

Lord Acton’s beard absolutely knows that power corrupts

In the ongoing debate over the Senate’s Cybersecurity Act of 2012 (S. 3414), one major point of contention is whether the bill adequately safeguards individuals’ private data from governmental abuses. While CEI praised recent changes to the bill’s information sharing provisions, we remain seriously concerned about the bill’s implications for privacy competition and trust in cloud computing.

Next week, the Senate is expected to vote on a flurry of amendments to S. 3414, some of which are available here. One smart proposal, spearheaded by Sen. Daniel Akaka, would amend the Cybersecurity Act and several existing laws to better ensure the federal government doesn’t abuse the information it acquires and maintains about private individuals.

Among other positive changes, Sen. Akaka’s amendment would deter the federal government from willfully abusing private data and require the government to notify persons whose data is breached.

Deter Government From Willfully Abusing Private Data – The amendment would amend the Privacy Act of 1974 to ensure that individuals who suffer actual harms due to certain willful or intentional privacy violations by government can obtain meaningful recourse. This statutory change would address a gaping hole in the Privacy Act created by the Supreme Court’s recent opinion in FAA v. Cooper, 132 S. Ct. 1441 (2012), which held that victims of certain privacy violations by government cannot recover damages caused by mental and emotional distress—even where victims can prove they suffered severe mental anguish.

In Cooper, the Social Security Administration violated the Privacy Act by disclosing the HIV-positive status of Stan Cooper to the FAA and Department of Transportation. Even though the trial court concluded the SSA willfully violated Cooper’s privacy, the Supreme Court held that he couldn’t recover proven emotional damages. The Court reasoned that because waivers of sovereign immunity must be made explicitly by Congress, the reference to “actual damages” in the Privacy Act should be construed narrowly and, therefore, only encompasses pecuniary losses.

The holding in Cooper—regardless of its propriety as a matter of law—undermines a core objective of the Privacy Act: deterring federal agencies from abusing personal information. This is so because many harms caused by wrongful disclosures of sensitive personal information come not in the form of pecuniary losses, but in severe mental anguish. To remedy this problem, Sen. Akaka’s amendment would allow victims of Privacy Act violations to recover proven emotional harms (in addition to proven pecuniary losses). The amendment would provide the same recourse to victims of governmental violations of S. 3414.

Require the Government to Notify Persons Whose Data is Breached – S. 3414 greatly expands the government’s role in cybersecurity by, among other things, enabling more information to flow from private companies to governmental agencies. While such sharing is supposed to improve cybersecurity, more information changing hands means new vulnerabilities.

Sen. Akaka’s amendment directs the Secretary of Homeland Security to establish requirements for agencies to provide timely notification in the event of beaches, both to individuals whose privacy was violated and to the federal cybersecurity centers established by the bill. The amendment also requires agency heads to comply with the policies and mandates annual reports on compliance.

Conservatives and libertarians who value our framers’ classical liberal heritage should support laws that deter the federal government from abusing the vast troves of information it holds about each of us. F.A. Hayek once summed up the classical liberal tradition as follows:

[Classical liberals’] chief concern was not so much with what man might occasionally achieve when he was at his best but that he should have as little opportunity as possible to do harm when he was at his worst. It would scarcely be too much to claim that the main merit of the individualism … advocated is that it is a system under which bad men can do least harm. It is a social system which does not depend for its functioning on our finding good men for running it, or on all men becoming better than they now are, but which makes use of men in all their given variety and complexity, sometimes good and sometimes bad, sometimes intelligent and more often stupid.

By limiting how government may use the data it collects and checking against the abuses of such data, Sen. Akaka’s amendment is consistent with Hayek’s vision of man’s constrained knowledge.  Much like the Fourth Amendment, such an approach balances the need for security with safeguards necessary for liberty to endure.

Ryan Radia contributed to this post.