Prefer audio? Subscribe to the podcast!
Yesterday, a coalition of activists and attorneys filed a complaint in the Superior Court of California against the Thomson Reuters Foundation, reports the Washington Post. The organization is perhaps best known for its newsroom, simply known as Reuters. But as discussed a couple weeks back here on Surveillance Today, they also sell a database known as CLEAR which contains "more than 400 million names, addresses and service records from more than 80 utility companies covering all the staples of modern life, including water, gas and electricity, and phone, Internet and cable TV," as originally reported by the Post in late February. As seen on its web page, the product is actively advertised to law enforcement and last month, researchers at Georgetown Law’s Center on Privacy & Technology found that U.S. Immigration and Customs Enforcement is an active consumer of CLEAR.
The plaintiffs, Cat Brooks and Rasheed Shabazz, both residents of Alameda County, California allege that this behavior is illegal in their state under the California Consumer Privacy Act. In the complaint, Brooks details her fear of and past harassment at the hands of white supremacists and receiving hate emails and threats. As an activist in such a situation, she has taken great care to scrub the internet of her data yet found the data in the CLEAR database pertaining to her to be quite extensive.
". . . CLEAR’s database includes extensive information about Ms. Brooks. CLEAR’s 'individual report' on Ms. Brooks includes a trove of information, including a social security number that is only partially redacted, current address, cell phone number, prior addresses, and details about her current employer, her business, and licenses. It also identifies her neighbors, relatives, and 'associates'—both current and past—and provides detailed information about them."
As for Shabazz, a Black Muslim journalist and activist, the CLEAR database contains similarly sweeping information, but also some entirely inaccurate information.
"CLEAR’s profile on Mr. Shabazz’s prior name indicates that Mr. Shabazz was divorced, when he has never legally been married, and that he has been sued for failing to pay child support, when he has no children."
Brooks has also legally changed her name and both individuals found that this "heavily penalizes" their CLEAR "risk inform," a score which Thomson Reuters advertises as providing consumers with "risk insights for individuals and businesses in just one search." CLEAR also contained photos of Brooks.
Justice Catalyst, a nonpfrofit law firm among those representing the plaintiffs released a statement which quotes Brooks:
"As an activist, it is extremely important to me to maintain control over the dissemination of personal information about me and my family, . . . I am bringing this lawsuit to stop Thomson Reuters from selling a product premised on non-consensual invasions of my privacy and the privacy of all Californians."
Shabazz stated, "I do not want this corporation selling my identity while putting me at risk.”
I was able to speak with Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project and one of the nine attorneys representing Brooks and Shabazz. Here's some of our conversation.
Ethan Gregory Dodge: Can you put the legal argument and strategy into simple terms?
Albert Fox Cahn: What the lawsuit is trying to do is leverage California common law and this right of publicity, this right to own the monetization of your own likeness. The simplest way of thinking about it is, if they put Michael Jordan's face on a box of Wheaties, they have to pay him for it. They have to compensate him for taking his likeness and using it.
But what we're seing is, according to our complaint, CLEAR, this service that's used by Thomson Reuters, is allegedly taking lots of people's photos, taking our utility records, taking our credit records, taking all of these data points from our lives -- really intimate and invasive information -- and selling it. Not to just law enforcement, not just ICE, but even private companies and it's really violating that pricinple that someone shouldn't be able to profit off of your likeness without your consent.
EGD: Is there anything reasonable that somebody can do to avoid being in CLEAR's database?
AFC: That's the thing. I haven't seen a really meaningful way to really opt out of it. I haven't seen a way to remove your data, effectively. There are some forms on the website, but I believe many of them require you to submit government ID as part of your request, giving them even more information as part of a process purportedly designed to remove that information.
This is why we need stronger privacy laws and litigation. Even if there is a great way to opt out by navigating to some really obscure page and clicking a bunch of forms, that's not meaningful privacy protections. We need this to be something that is there by default for all Americans, not something that only is available to those who invest huge amounts of time in finding some obscure little form.
You can listen to my entire conversation with Fox Cahn here.
As noted several times in Surveillance Today, the practice of law enforcement obtaining data they would otherwise need a warrant to obtain is increasing. And its one that is apparently catching the attention of lawmakers. The Post reports that Senator Ron Wyden of Oregon plans to introduce a bill "which would aim to stop law enforcement agencies from obtaining consumers’ personal data from brokers without a warrant." Senators in New York State have proposed a similar bill.