This commentary is by Jessamyn West, who is a library technologist at Kimball Public Library in Randolph. She has taught a workshop on practical internet privacy for the past 10 years.
As a strong supporter of increased privacy protections for all technology users and a library professional, I believe S.71, a bill currently before the Legislature that would establish baseline data privacy rights for Vermonters and put limits on how businesses collect, use and sell personal data, will help. Here is why.
I come from a library background; libraries are also strong advocates for patron privacy. We do this through patron education and data minimization, keeping information only as long as we need it for our work. After that, we don’t keep that data. We don’t need it. Patrons can choose to store this information, but the default setting is privacy.
Legislation has helped libraries tremendously, including Act 150, which increased patron privacy. S.71 will help Vermont help people keep their personal data more secure and less likely to be lent, sold or otherwise transferred. These are people who, I assure you, have no idea how much information is being collected about them. Data minimization also protects users in the event of a data breach. I was one of the few people who sued Equifax after its massive data breach in 2017, a big deal at the time and now sadly almost normal. And I won.
My library work involves helping technology users do basic things like setting up an email account, accessing their healthcare portal, downloading and signing up for apps, and managing their passwords and cloud storage. I help people sign up for and log in to a lot of things.
The level of anti-privacy coercion that I see in my regular workday is shocking. Every app wants access to your contacts, your location, your birthday, your phone number and your address — meaning ads and other trackers can follow you around the internet and into your home.
People do not understand that they can sometimes say no to giving businesses information like this. Data collectors would like them not to know this. Deceptive patterns built into software designs mean that the way to say no to an app’s request for your personal details is often smaller and harder to see than the one where you give up your personal data, especially for those with poor eyesight.
I have a patron who comes in for help using YouTube, which is owned by Google. She uses it to listen to music or to play music for yoga classes she teaches. What she doesn’t realize is that Google also owns Nest, Fitbit, Waze and Google Docs. With default settings, Google tracks every video you’ve watched, how much of it you watched, where you were when you watched it, what device you watched it on and what you watched next.
Combine that with your workout paths, driving directions, thermostat settings and the documents you work on, and you have a fairly complete picture of where you live, where you go, how you spend your time — even how warm you like your living room.
People in the library make jokes about how they talked about a thing and then saw an ad for that thing, but honestly, they have no idea how that all works.
My patron does not know any of this. She does not change the default settings on her software. She does not know how to. The defaults are all set for maximum data collection for all but the most privacy-forward companies. The privacy settings are often hidden layers deep in menus, which can be hard for people to access — if they even know they exist — especially for people with poor motor skills. You shouldn’t need really good eyesight or steady hands to be able to keep your personal information private.
One role of government is to protect people who are not privacy warriors from having their consent violated and their personal information collected, aggregated and shared. Businesses should not have been violating privacy like this in the first place. Telling them to dial it back should be the least that legislators can do.
This is not just about Vermont. In this age of extreme concern that private data is being used by public and private entities to do things like put people in private prisons, disenfranchise people of color or control women’s access to healthcare and their own reproductive rights, this is the minimum we can do to preserve people’s civil liberties.
It draws a line in the sand and makes a clear statement: Privacy is important and Vermont cares about it.
