Surveillance capitalism, BetterHelp, and federal privacy debate

**Jonathan:** Hey Aaron, thanks for joining us today. **Aaron:** Hey JJ, it's always great to talk to you. **Jonathan:** Yeah, appreciate it. Hey, tell us a bit about your practice and kind of your specialty within Kelley Drye. **Aaron:** Sure. I am a partner in the privacy practice in Kelley Drye’s DC office. One of the things that I love about the work that I do is being able to help companies navigate these rocky shoals that state privacy laws are creating for a lot of different companies in the advertising space. I’m happy to be working with clients on the publisher side, the advertiser side, and in the middle — whether they’re providing data or advertising infrastructure — to figure out this really complex tangle of issues while continuing to use data for advertising and for beneficial purposes. So it’s a lot of fun, it’s very challenging, and every day is different. **Jonathan:** Aaron, thanks. I appreciate you joining us today. We’ve done a couple webinars together on the topics you just kind of touched on. I’ll post them in the comments here in case anybody wants to see some of that great work you did there. But hey, speaking of advertising — one of the things I’ve been thinking about lately that I’d love to get your perspective on — we all know the FTC and other regulators, they go after advertising, often call it surveillance capitalism. One of the things I’ve always wondered about that is — the surveillance capitalism perhaps in the sense of just describing advertising, but then there’s actual surveillance that happens. And we were in London last week for the IAPP conference over there, and they’re still obsessed with cross-border transfers. As I think about that locally, there was an article recently where law enforcement could get access to Ring data and actually video outside of somebody’s home. They captured that. I’m wondering if there’s dissonance there with advertising as surveillance capitalism and actual surveillance, because it seems like it’s a wide gaping hole. And I’m wondering what you thought about that and then how the FTC should look at or enforce government behavior. **Aaron:** Yeah, it’s a really fascinating question and I have some experience in this realm. I was an attorney advisor at the FTC for several years and during my tenure there, a couple of major things happened. The Snowden leaks happened right before I moved to the FTC and then the Safe Harbor program was struck down, Privacy Shield came up in its wake — so I was sort of within the FTC at the time that cross-border transfers became a much bigger political issue and a big practical issue for a lot of companies. I think it’s really important to understand some of the differences in institutional roles that the FTC plays relative to European data protection authorities. They’re both independent in the sense that the FTC is insulated from direct political control, and that’s something that, of course, is very important to the way that DPAs work, but the FTC has no authority over the practices of government agencies, whether they’re state, local, or federal. And I think as sort of part of recognizing the agency’s role as a consumer protection authority and not a government oversight body, the FTC has traditionally been very reluctant to weigh in on anything that has to do with government surveillance — or to put it in maybe different terms, government authority to obtain personal information about individuals. So I’d say that to the extent that some fundamental privacy principles like data minimization or deleting data after it’s no longer needed could be applied to reducing the amount of information available to law enforcement agencies or other government actors — the FTC, I think, in general has shied away from making that connection, and I think that largely still stands to this day. It’s both an institutional value as well as a recognition of the limits of their authority. **Jonathan:** Gotcha. And then, I mean, of course, we have procedures and policies for law enforcement to obtain warrants. Is that sufficient here? I imagine there’s some kind of boundary to data privacy. Useful to know where that is, and if a crime has occurred or is about to occur, makes a ton of sense, I guess. But is that warrant infrastructure enough? Do we need more clarity on what that line is and how much transparency there should be on that and where and what types of data can be made available? **Aaron:** So in general, for those who are concerned with government access to data, the warrant standard is typically held up as sort of the gold standard or the appropriate standard that a law enforcement agency needs to meet in order to obtain personal information, and we see this in telecommunications surveillance most frequently. I think where those questions really come into the foreground is when we have activities that in the past may have been legal or permitted and suddenly become more regulated, more restricted, or even defined as crimes — that can be a relatively sudden change where information that’s been collected in the past and provided in a context of a well-understood relationship might change, or the interest of a third party or an enforcement agency in obtaining the information could change relatively quickly. So it’s a little bit more complicated than just defining the type of process that an agency needs to go through to get information, and it goes back to the underlying legal change and the data practices that are associated with providing private or personal information. **Jonathan:** Yeah. So for example, I mean, you know, fair to say technology generally moves faster than the law. So in the example where now we have video footage because people are using Ring and other things — how do regulators and lawmakers think about technology changes like that in the context of data privacy laws? Is it just a long slow process? Can you share a little on how they may think about that? **Aaron:** Well, I think what’s really interesting about Ring, for example, or video cameras and doorbells is that it sort of changes the role that individuals can play in providing information to law enforcement authorities. So whereas a lot of processes are sort of designed around the idea that some sort of corporate entity — maybe a sophisticated one — will be the one receiving requests and evaluating them and deciding what sorts of information to provide, if you put a lot of the same information in the hands of individuals who might welcome the opportunity to provide it to law enforcement agencies — well, that can change dynamics pretty quickly and pretty significantly within a short period of time. So I think the bigger takeaway is that we tend to think of law enforcement access as being governed by warrants and subpoenas and things like that, but that sort of applies to compelling the production of information, and in a lot of instances we can provide that information voluntarily. And I think that’s sort of the crux of some of the issues that we’re reading about with doorbells and other video footage. **Jonathan:** If I extend that — and we talked about BetterHelp last week — if we extend that to health data and we think about it in a similar way, does HIPAA adequately cover similar availability of data — let’s just say, healthcare data — to law enforcement? Are we covered there? I mean, it seems like BetterHelp exposed a gap in healthcare data that’s available and what companies can do with it. For me — and tell me if this is right — the FTC going after BetterHelp under the FTC Act, I thought there might be a better way that’s a little clearer than deceptive practices and what you can and can’t do with healthcare data. I mean, would you agree with that or is it a different way to think about it? **Aaron:** Well, I think we would all benefit from greater clarity in the form of appropriate federal privacy legislation. I think that’s widely recognized at this point and would help lend predictability to enforcement as well as just understanding the rules of the road a little bit better. I think in the meantime, the gap between HIPAA and the non-HIPAA health privacy world has been there. It’s been a source of concern for the FTC and for other enforcers as well as legislators for a while. I think one of the important takeaways from BetterHelp is that the FTC brought a couple of unfairness counts in the case. I think the agency wants to send the message that certain disclosures of health information — broadly defined — are unfair. And just to dwell on the what-is-health-information question for a second — I think the agency took a really broad view of that. They took the fact that someone had visited BetterHelp or one of its sites as an indication that that individual was seeking counseling or obtaining counseling, had obtained counseling, and so that is, in my view, an inference about a health condition — and it’s a really broad one. So to the extent that folks are out there dwelling on the potential distinction between inferences or inferred health conditions and more direct evidence of treatment or a condition — I think that’s a very tenuous distinction to hold on to right now. **Jonathan:** Yeah, gotcha. Thanks, Aaron. And the theme I’m picking up on here is the FTC and other regulators will use whatever tools they have at their disposal — including unfairness claims — to make these points, but we need more specificity in some of these laws and all these kind of edge use cases, and we’re not quite there yet. But one way to think about the FTC — it’s doing this work that helps us move towards that. Is that fair to say? **Aaron:** It’s it’s fair to say. I think every enforcement action and every piece of guidance that comes out of the FTC warrants close attention and close scrutiny. They’re putting out statements and bringing cases for a reason, and it’s important to dig into them and figure out what the bigger message is. **Jonathan:** Awesome. Thanks, Aaron. Well, I hope to have you back on one of these. I really appreciate you sharing your perspective with us today. **Aaron:** All right. Well, thank you very much. I really enjoyed it.