Pioneering Data Broker Regulation: The Need for City Laws in the Absence of State and Federal Legislation

-- By RubiRodriguez - 01 Mar 2024

Introduction

Surveillance capitalism is the commodification of personal data through extensive monitoring and analysis of consumers’ online activities. Data brokers play a significant role in fueling surveillance capitalism by collecting, organizing, and selling large amounts of personal data to advertisers, marketers, and other third parties, including law enforcement agencies. Data brokers are largely under-regulated, which heightens the risk of data breaches, discrimination in housing, employment, and credit assessments, and warrantless surveillance by government entities, according to reports by the Brennan Center for Justice. With privacy protections lagging at the state and federal levels, cities—which generally have regulatory autonomy over business within their jurisdictions—can play a critical role in spearheading data broker regulation.

Bipartisanship in Data Broker Regulation

The federal government and states have failed to pass legislation to keep up with the development of consumer surveillance business practices. However, bipartisan concern over inadequate regulation of companies that rely on opaque data collection has grown. In February 2024, President Biden issued an executive order limiting the bulk sale of Americans’ personal data to adversarial countries like China and Russia. This comes after Congress has made a bipartisan effort to scrutinize issues data brokers pose on privacy and to consider relevant legislation. While the exact motivation behind bipartisan support remains unclear, whether rooted in apprehension towards competing economies or broader concern over Americans’ data privacy, it is evident that the sale of people’s sensitive data is a complex issue misunderstood by both the public and policymakers. This presents an opportunity to increase public awareness and foster informed discourse on the matter.

The Case for Localism

Cities have historically been viewed as entities with limited authority, acting solely as agents of their state. But during the Progressive Era, a period of extensive political reform to promote government transparency in the early 20th century, the political philosophy of prioritizing local over regional and centralized government proliferated, making way for home rule states. Home rule refers to states granting cities liberal lawmaking and regulatory power often enshrined through constitutional amendments, statues, or case law so long as it is within the bounds of the state and federal constitutions. Nonetheless, conflict in state-local relationships have persisted and were recently underscored by policy responses (or lack thereof) during the pandemic.

Home rule varies from state to state, with some states authorizing significant autonomy to all cities, specific cities, or no cities at all. Although the strength of home rule in cities with the largest economies in the U.S. is debatable, home rule offers cities an opportunity to enact laws and promulgate regulations tailored to their constituents’ specific needs and concerns, like data privacy and consumer protection, that are overlooked by state or federal law. A recent example of this is New York City’s Local Law 144, aimed at regulating specific types of artificial intelligence and requiring employers to audit automatic employment decision tools (AEDTs) for bias and discrimination. This local law has consequences for employers hiring New Yorkers, regardless of where the employers are based even if they outsource the AEDTs from third-party vendors. New York City could implement a similar law to regulate companies relying on third-party data brokers to obtain the personal data of New Yorkers, who make up one of the largest consumer bases worldwide.

City regulatory power through home rule is not to be confused with the prerogatives of State Attorneys General, who possess within their jurisdictions significant regulatory power over businesses nearly akin to that of federal agencies. Indeed, home rule is limited by state constitutions, which, as previously mentioned, often gives rise to state-local tensions. Nevertheless, legal frameworks exist where cities are allowed to regulate beyond that scope of but not in conflict with their state constitutions.

Challenges

Data broker regulations at the municipal level face challenges, particularly with the growing trend towards “smart cities,” which integrate people’s digital information into urban infrastructure and governance systems. Based on an AI Time Journal article, proponents of smart cities point to the potential for sustainable growth and urban development, failing to account for the commodification of behavioral data. The rapid pace at which data-driven technologies are evolving combined with the lack of expertise in government offices creates an imbalance between pursuing the potential benefits of these technologies and the safeguarding of consumer privacy and civil liberties. Crafting data broker regulations requires a nuanced understanding of technology, governance, and public policy as well as robust mechanisms for engagement and oversight by stakeholders, especially those whose information is being collected.

Solutions Beyond Regulation

A couple of potential solutions can address the challenges posed by data brokers and the growing trend of “smart cities.” First, cities can implement public awareness campaigns to educate residents about the risks associated with data brokerage and the importance of data privacy protections. By raising awareness about individual rights, privacy best practices, and avenues for recourse in cases of data misuse, these campaigns empower residents with the knowledge needed to navigate the digital landscape confidently. Second, cities can establish specialized commissions or taskforces dedicated to addressing data privacy issues. These commissions can conduct research, hold public hearings, and propose policy recommendations related to data brokerage regulation. By convening stakeholders from government, industry, academia, and civil society, cities can foster collaborative approaches to data privacy governance, ensuring that regulatory responses are comprehensive, informed, and reflective of diverse perspectives. Through these initiatives, cities can proactively address the challenges posed by the proliferation of data-driven technologies and promote a culture of responsible data stewardship and digital citizenship among its residents.

Conclusion

Cities serve as incubators for experimenting with and learning from novel regulatory approaches, which can be tested and refined. Cities also embody the principles of democracy, where bottom-up policy initiatives can flourish. Through community-driven engagement and participatory decision-making, cities can lead the charge in addressing challenges in a growing digital ecosystem, while promoting transparency, accountability, and ethical data practices that benefit all.

I think this is a very useful start on good ideas. You might want to add a comment or two on the differences between municipal legal staffs and state AGs office when it comes to business regulation of these kinds, and therefore why you might want to think about home rule and state representation issues.

Thank you, I've incorporated edits to reflect your feedback.

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, RubiRodriguez
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.