IN Senator Proposes Bill to Secure Privacy

By: Whitney Downard | January 13, 2023 | Indiana Capital Chronicle

Americans have no federally protected data and privacy protections, leaving individuals and companies scrambling to control a huge flow of information that could damage billions of lives.

A small number of states have started introducing their own laws to enshrine these protections and Indiana could be next.

“Right now, there is no legislation at the federal level that protects consumers and only five states [California, Colorado, Connecticut, Utah, Virginia] so far have this,” Sen. Liz Brown said about her proposed legislation, Senate Bill 5. “We will be at the forefront of protecting consumer data privacy.”

Brown, a Republican from Fort Wayne, presented her data privacy bill as part of the Senate Republican agenda earlier this week, re-introducing a bill she filed last year.

The bill would come as a win for everyone from technology companies to everyday consumers, Brown said, except for the bad actors profiting from the sale and misuse of sensitive information about Hoosiers.

“(Technology companies) want assurance that they know how to act in this space but they also want their customers to be assured they’re taking good care of (consumers’) data,” Brown said.

What companies might know about their users

With technological advances come additional layers of surveillance, some used to enhance how a consumer interacts with an organization’s website or business model. For example, a local grocery store offering customers points toward future purchases with each item they buy.

But the program also allows the store to track what a customer orders and when, even anticipating future purchases. That information can be packaged and sold to a third party, who can use that information to tailor advertising or other marketing materials for that customer.

“They know when, for example, my grandchildren visit because I probably went down and bought diapers and baby food,” Brown said. “They probably know more about us than the Amazons of the world.”

Brown’s bill would allow consumers to ask these entities who hold their personal data, called controllers, to stop selling their data to a third party, correct inaccuracies, obtain their own copy of that information or delete it altogether.

“If you really don’t want anyone to have it or if you want to check it, then you’ll have the ability to do that,” Brown said.

Businesses must also improve the ways they safeguard that data, preventing some of the data breaches Hoosiers have experienced – whether with local healthcare entities or multinational consumer credit reporting agencies.

The “bill of rights” codified in the bill closely resembles Virginia’s legislation, which went into effect this year. Brown’s bill gives companies three years to comply and doesn’t apply to most small businesses.

“We want to give (companies) time to implement those security measures that they’re going to need and understand how to control the data,” Brown said.

In contrast to European data protection laws, one of the first efforts to institute protections worldwide, Brown’s bill doesn’t address censorship or content issues. But it does penalize companies who don’t follow the law – $7,500 per violation.

According to the Attorney General’s Office, which oversees data privacy cases now and would have expanded authority under this bill, these types of cases have grown in number and complexity.

“Particularly, we want to protect consumers’ ability to opt-out of targeted ads, which could include sensitive personal information that should remain PERSONAL,” an office spokesperson said in a statement. “Along with the modernization of our laws, more resources will be necessary to fund additional professionals and investigative tools. We will work with legislators to make sure Hoosiers know how their data is being processed.”

Tracking someone else without their knowledge

Another bill under consideration in the General Assembly would be Brown’s bill creating a law against non-consensual tracking, a practice that was previously legal.

In 2021, Apple released its AirTag, a $29, disc-shaped device that can be used to remotely track objects such as keys or luggage. Other, similar devices exploded in popularity, enabling stalkers and abusers nationwide to track their victims without their knowledge. Anyone can also order vehicle tracking devices on Amazon.

In response to a flurry of articles early last year criticizing the company for its lack of protections, Apple released an update that automatically alerts its users to AirTags following them. Android users must download and proactively use Apple’s Tracker Detect app to get the same services.

Those actions didn’t prevent two women from filing a class action lawsuit against Apple in December, who alleged former partners used the devices to stalk them.

“Again, technology has gotten ahead of us and so we have some protections but they don’t go far enough,” Brown said. “It’s useful when you want to track someone you know but not appropriate when you’re doing so without their permission.”

Sens. Mike Young and Mike Crider have also introduced virtually identical bills to Brown on nonconsensual tracking.

Brown said the issue of tracking came to her attention following the story of an Indianapolis woman who was allegedly stabbed by an ex-boyfriend.

Brown’s bill does create a carveout for law enforcement “lawfully engaged in their duties,” such as a warrant. However, if the suspect removes a legally placed tracking device from their vehicle police cannot use that to search their property – as ruled by the Indiana Supreme Court in 2020.

In that case, the Warrick County Sheriff’s office tracked a suspected drug dealer’s car, who later removed the tracking device. Arguing he stole their technology, police obtained a warrant and searched his home. But the court ruled against the officers.

Some issues may need to be discussed in committee, such as the case of one of the women suing Apple. In that case, a New York woman said an abusive partner used an AirTag to track their child and harass her. Under Brown’s bill, that would still be legal because of the shared parentage but could be reviewed later, Brown said.

Regardless, Brown said action was needed on both tracking and data privacy and will improve the lives of Hoosiers.

“This is really going to be a game changer for the state of Indiana,” Brown said.