[T]he government and corporations have more ways than ever to collect electronic information about people, and the legal system has struggled to keep up.
Vermont, like other states around the country, is considering a new law that would limit access to private information collected through drones, image capture, cellphones and databases.
The state currently has no law protecting the right of Vermonters to keep digital information private.
The Vermont Senate’s proposed Electronic Communications Privacy Act, S.155, aims to change that. It bans the police use of “stingrays,” devices that are used by law enforcement in other states, but not used here, to intercept cellphone calls. In addition, the bill requires police to get a warrant to use a drone for an investigation. There is a limit on how long police can retain pictures of license plates. And judges are required to review secret inquest proceedings used in police investigations.
The Senate will vote on S.155 on Wednesday.
Sen. Dick Sears, D-Bennington, says the legislation is “historic.” “There was no privacy bill before,” Sears said. “We made tremendous strides.”
Sears describes S.155 as a “good solid bill,” and says it is the result of a “compromise between what law enforcement wanted — they preferred nothing — and what the ACLU wanted.”
But Allen Gilbert, executive director of the Vermont ACLU, says he is “disappointed” with the legislation because it doesn’t go far enough to protect Vermonters’ privacy. Important provisions, he says, were stripped out of the bill in the final review by the Senate Judiciary Committee. Gilbert said he will lobby to restore the protections in the House version of the bill.
Gilbert says the legislation will not protect citizens from unwarranted police surveillance and data breaches that compromise private health records.
“Basically the electronic privacy bill codifies what current practice is,” Gilbert said.
The ACLU fought to limit police retention of electronically captured pictures of license plates to 24 hours. Under S.155, law enforcement can keep the records collected by automatic license plate readers for 18 months.
“The one thing that has come out of all this is that everyone should be concerned about much greater surveillance in the future,” Gilbert said.
While police must get a warrant to use a drone for investigatory purposes, Gilbert says “there are lots of things that can seem like an investigation.”
“Sometimes it’s described by police as something different such as watching the traffic going into and out of an event,” he said. “We’re concerned that they would like to have the ability to use a drone to do that — without getting a permit.”
When police rely on surveillance with drones or license plate readers to catch criminal activity, there is a danger that it can be used to exonerate suspects and that approach to enforcement could turn the Anmerican legal system on its head, Gilbert says.
“When you think about how that could play out, it’s a rationalization, it’s an argument for building a surveillance systems so we can prove our innocence when we’re accused of a crime,” Gilbert said. Instead of innocent until proven guilty, citizens could be guilty until proven innocent — “by surveillance camera, the drone or god knows what else.”
The ACLU also wanted to limit police access to Internet Protocol addresses. IP addresses are linked to a trail of personal digital data that Gilbert says should be protected.
“What looks in the digital world to be as innocuous as a telephone number or street address is actually a much more complicated bit of information that … makes it easy for law enforcement to get an incredible amount of information about us,” Gilbert said.
The bill originally required law enforcement to obtain a warrant for an IP address. That requirement was dropped back to a subpoena.
John Treadwell, an assistant attorney general, said IP addresses are a crucial part of a daisy chain of information police use to track child pornographers.
Lawmakers removed a section of the bill that would have given Vermont patients a “private right of action,” or the right to sue and recover damages from medical providers when health information is disclosed. Sears said he didn’t think the provision would have survived the Senate Health and Welfare Committee. Because the language was struck, Sears was able to fast track the bill to the floor for a vote on Wednesday.
Paul Harrington, director of the Vermont Medical Society, said patient records are protected under HIPPA, and the Vermont Attorney General enforces the law. The provision would have made doctors liable under state law for inadvertently releasing information about patients in telephone consultations and use of software programs that automatically pull up lists of patients.
The state’s hospitals take privacy very seriously, said Jill Olsen, a lobbyist for the Vermont Association of Hospitals and Health Care Systems. “We believe we already have strict regulatory oversight and lots of incentive to get this right,” she said.
A private right of action clause could result in a class action lawsuit in a major breach situation when no actual harm has occurred, Olsen said. Damage awards might exceed insurance coverage, she said.
Gilbert said while medical providers have the best of intentions to ensure records are kept private “but it’s actually not happening all the time and there is no recourse where an individual’s records are breached without authorization.”
The Vermont Attorney General only reports larger security breaches, Gilbert said.
