Jusletter IT

Waiving Data Protection Rights in Online Applications

  • Author: Erich Schweighofer
  • Category: Recension
  • Region: USA
  • Field of law: Data Protection
  • Citation: Erich Schweighofer, Waiving Data Protection Rights in Online Applications , in: Jusletter IT 12 September 2012
A review of Orlan Lee’s book «Waiving our rights – the personal data collection complex and its threat to privacy and civil liberties», Lexington Books, Lanham et al. 2012.
[1]

This book by Orlan Lee1 is a fine piece of research work on personal data collection practices in the USA. It presents a strong statement for stricter data protection rules in the USA where the personal data gathering industry has gone wild and no proper safeguards exist. In a Preface, six Chapters and an Afterword, Lee argues that there is no solution to this problem until the public and the media discover that we all face losing our civil and constitutional rights (both in the USA and the rest of the developed world) by submitting to arbitrary mandatory «voluntary waivers» of our rights contained in online credit and employment applications.2

[2]

In the USA, «consumer reports», and «investigative consumer reports» (primarily for pre-employment screening) include gossip and hearsay on «character», «general reputation», «personal characteristics», and so-called «mode of living»3 (p. 4). These «reports» are regulated only by the Fair Credit Reporting Act, 1970 (FCRA)4, as amended, which was ostensibly «enacted in order to ensure that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce in a fair and equitable manner to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information»5 (p. 63; 209). Under the FCRA, «Consumer reporting agencies (CRAs)» are allowed to collect and distribute personal data to report on «creditworthiness» but also on «character, and general reputation»6 (Preface, p. ix; p. 66 et seq.). CRAs also enjoy a loosely defined immunity from lawsuits for «defamation, invasion of privacy, or negligence» «except for false information furnished with malice or willful intent to injure such consumer»7 (p. 64).

[3]

The United States has no systematic legislation covering all forms of personal data handling. The FCRA was intended only to alleviate the longstanding abuses attributed to the «credit reporting» and financial services industries. However, the new instruments of «consumer report» and «investigative consumer report» are even more intrusive and the safeguards do not work properly. Americans enjoy the constitutional freedom of speech to «report» anything they like about each other – subject to the laws of defamation, invasion of privacy, interference with economic opportunity, breach of confidentiality, etc. CRAs enjoy the further immunity granted by the FCRA for reporting any outstanding credit, debts, liens, money judgments, etc., in the public record8 (p. 64). However, current practice in practically all online employment and credit applications includes a «waiver» of all rights to take action against any gossip or hearsay whatsoever, that a CRA can turn up (Preface, p. xiii et seq.). No one is obliged to do so but in practice, there is no alternative. The mandatory «voluntary waiver» of all potential claims or liabilities contained in practically all online applications simply eliminates all the ordinary protections of law.

[4]

According to Lee’s assessment, the result would be a disaster. The «waivers» in online applications give the CRAs and associated «recruitment assessment» companies investigative powers that the police do not have in the United States. Enhanced powers given by the Fair and Accurate Credit Transactions Act (FACTA)9 amendment to the FCRA also permit vigilante «suspected misconduct» investigations of employees without «probable cause», without judicial warrant, with no assumption of «innocent until proven guilty», no «right to know the nature of an accusation», no «right to confront our accusers», no «rule against double jeopardy», and «no right to sue for defamation» or for «unlawful interference with pursuit of livelihood» (Preface, x; p. 94 et seq.). Further, no proper safeguards exist, when it comes to transmission of inaccurate data (p. 41 et seq.).

[5]
CRAs and their sources enjoy the guarantee of Freedom of Speech in the American Constitution (the «First Amendment») subject that the report is truthful or a matter of public record. But this guarantee is ordinarily limited in the event of suspected criminal investigation by the «Fourth Amendment» that prohibits unreasonable searches and seizures and requires a judicial warrant based on probable cause «supported by oath or affirmation, . . . particularly describing the place to be searched, and the persons or things to be seized»; the «Fifth Amendment» that requires due process where a person cannot be compelled to be a witness against himself in a criminal case or be put at risk of double jeopardy; and, the «Sixth Amendment» that provides the right to know the nature of the accusation and to confront witnesses (chapter 1, examples p. 1).
[6]
However, the «waivers» contained in online applications cover «all claims and liabilities» (p. xiii et seq.), e.g. in a quasi-criminal investigation constitutional guarantees of the «Fourth», the «Fifth», and the «Sixth Amendments» do not apply.
[7]
To give an example of how these «waivers» work, standard online language calls for a «waiver» for CRAs or «recruitment assessment» agencies (the outgrowth of CRAs), to verify credentials and check references and a full «waiver» to access the personal data files of all your schools and universities (Appendix A). In brief, the aim of personal data collection has changed from collection and transmission of credit information to the assessment of «attitude, motivation and behavior» (chapter 2).
[8]
Federal, state, and local government agencies may hold personal data files (Appendix B). Under the federal or state Freedom of Information Act, these files are accessible to the individual concerned. The federal Privacy Act of 1974 only addresses threats to privacy from the public side. Under the Privacy Act (pp. 59 et seq.), even Government agencies are not permitted to consolidate all the separate personal data files in different agencies. Congress and the state legislatures long ago decided that information collected for one purpose should not be systematically combined with data gathered for unrelated reasons (pp. 58 et seq.).
[9]

However, starting with the FCRA and its intent to facilitate the flow of credit information, the U.S. Congress has opened the way to comprehensive personal data collection in the private sector. Rules for privacy protection do not work due to lack of enforcement. CRAs are not required to provide their sources. «Consumer reports» can contain material that is completely anonymous, i.e., what unidentified «friends, neighbors, and associates» (p. 72 et seq.) relate. The «credit check» can develop into a comprehensive, quasi-criminal «investigative consumer report» (p. 75). The person concerned may gain access to the «investigative consumer report», sources deleted, but only after it has been reported. After the information is delivered by CRAs, the person seeking clarification is often lost in «standard replies» with little chance of correcting the information. The FCRA permits the employer or creditor to inform the applicant that the CRA «did not make the decision to take the adverse action and is unable to provide . . . the specific reason why [it] was taken»10 (p. 4). This is totally belied by the financial institutions’ acknowledgement that, it allows «Equifax Decision-Power» (a «specialist CRA»), for example, to scan a prospective client’s confidential financial history for risks and to advise the bank officer to «Up-Sell» financial opportunities (p. 80 et seq.).

[10]
The simple «Credit report» (which still exists) has thus developed into the «investigative consumer report» which amounts to an unmitigated «character and reputation report» based primarily on interviews with anonymous third parties (chapter 3). As early as 1999, the Federal Trade Commission (FTC), the regulatory agency, authorized CRAs in their «Vail Letter» (p. 82 et seq.) to proceed further with the new business opportunity of investigating «suspected misconduct in the workplace» without the «clear and conspicous disclosure» foreseen in the FCRA. Such «communications» (which are not «consumer reports» and, therefore, are not subject to FCRA limitations) can be made to the employer without employee authorisation. The Fair and Accurate Credit Transactions Act (FACTA) of 2003, amending FCRA, has since added legislative approval to this procedure.
[11]

The National Conference of Bar Examiners (NCBE) is a «specialist CRA» that ante-dates the FCRA. It provides investigative material to the «character and fitness committees» for admission to practice of law in the various states. (p. 116). A key case arose in 1953 (p. 123 et seq.), when a war veteran law graduate was summarily excluded from taking the bar exam solely on the basis of his questionnaire. It took an appeal to the U.S. Supreme Court to declare that none of the objections raised against his admission to law practice was illegal or immoral: «A state can require high standards of qualifications, such as good moral character or proficiency in its law . . . but. . . . even in applying permissible standards . . . cannot exclude an applicant when there is no basis for their finding that he fails to meet these standards, or when their action is invidiously discriminatory»11 (p. 124). The Anastaplo case that arose in 1954 (p. 125 et seq.) demonstrates how ludicrous the demons of former times appear in what today seems no more than the rush to «character» judgment conditioned by the prevailing stereotypes of the times12 (p. 126).

[12]

Lee refers (chapter 4) to two areas where the courts and the Congress have permitted «waiver» of basic rights with certain limitations. The U.S. Supreme Court has held that in criminal law matters, «[a] waiver is ordinarily an intentional relinquishment or abandonment of a known right or privilege» (p. 151).13 Under the Miranda14 rule (p. 151), the Court has held that a suspect may waive his rights when arrested, and later change his mind. It is a little more complicated in civil law matters. All financial services companies, today, and many employers, require waiver of the right to sue in the event of a dispute, in favor of mandatory and binding arbitration. Under the Federal Arbitration Act (FAA)15 (p. 157), once a party has waived the right to sue, that is irreversible, unless the contract itself is invalidated by fraud, duress, or unconscionability. On the other hand, the Supreme Court has held that monopoly of financial services companies and universality of the waiver requirement is not such an invalidating defect: «The voluntariness of the [waiver] agreement is irrelevant, if [it] waives compliance with a statutory duty (i.e. compliance with the FAA), it is void. . . whether voluntary or not»16 (p. 162).

[13]

Limits to the «liberty of contract» are discussed in chapter 5. Lee compares the agreement to «waive» «all claims and liabilities», contained in Harvard Universty’s application for employment (p. 1), to the illusory notion of «liberty of contract» in the decision of the U.S. Supreme Court in the 1905 case Lochner v. New York.17 In Lochner, the Supreme Court overturned a New York state health and welfare law limiting the work week for bakers to 60 hours a week, on grounds that «the right to purchase or sell labor is part of the . . . liberty of contract.» Lee argues, «There is no such thing as a contract for review of an application for employment» as this purports to be. The FCRA calls for a «clear and conspicuous disclosure» when a «consumer report» for employment purposes is procured. As the result, the essentially solely self-enforcing Fair Credit Reporting Act is a disaster from the point of view of personal data protection and civil liberties.

[14]
Lee looks to constitutional constraints on the FCRA and CRA practices (chapter 6 – «Can Congress authorize a secret proprietary masterfile on every American?»). He contends that whereas «credit reporting» may fall within Congress’s powers to regulate inter-state commerce, Congress has no power to classify Americans according to «character and reputation», and what it cannot do itself, it cannot authorize a third party commercial entity to do. Relying on U.S. v. Lovett and U.S. v. Brown he summarizes: «[W]hile Congress can make general laws and define behavior that is unacceptable, it cannot establish a system that judges the «character» and «reputation» of single individuals, itself. Nor, one would think, can it authorize private «consumer reporting agencies» (CRAs) to do so» (p. 208).
[15]

Individuals can «waive» their rights, but the FCRA requires «a clear and conspicuous disclosure in writing»18 (p. 4), when a «consumer report» is procured for employment purposes. The further requirements appear to demonstrate legislative intent to uphold the Supreme Court’s language: «intentional relinquishment or abandonment of a known right or privilege». All this speaks against willingness to condone the validity of mandatory «voluntary waiver» (p. 209 et seq.).

[16]

Consumer protection requires a balanced view. Congress may call for good character and reputation. A clause in the Constitution at the beginning of the enumerated powers of Congress prohibits «bills of attainder», i.e., statutes enacted to criminalize certain persons or seize their property without benefit of a judicial trial (see U.S. v. Brown19 (p. 207 or U.S. v. Lovett20 (p. 212)). It is ironical that the U.S. Congress would now allow a vigilante system of quasi-criminal investigation (p. 220). Proprietary secret personal data files are a characteristic of dictatorships but seem to attract the drive for self-executing efficiency in the financial services and the electronic personal data collection industries (p. 220 et seq.). Lee rightly states that these huge private databases on individuals go far beyond the First Amendment: defamation by anonymous sources, interference with another person’s economic or employment apportunity, and collection of dubious material derived from mandatory «voluntary waivers».

[17]
In the Afterword, Lee suggests that American courts will ultimately have to face the phantasy of validity of mandatory «voluntary waiver». What Congress cannot do itself, it cannot entrust a third party commercial entity to do.

Erich Schweighofer is Associate Professor at the University of Vienna, teaching legal informatics, international and European law. He is head of the Centre for Legal Informatics (rechtsinformatik.univie.ac.at), main organiser of the IRIS Internationales Rechtsinformatik Symposium (www.univie.ac.at/RI/IRIS2013) and co-editor of Jusletter IT.

 

Orlan Lee, «Waiving Our Rights: The Personal Data Collection Complex and Its Threat to Privacy and Civil Liberties», ISBN: 9780739167991, £44.95.

 

 

  1. 1 Orlan Lee is a Life Member, Clare Hall, A College of Advanced Study in
    the University of Cambridge.
  2. 2 Thanks are due to Orlan Lee for his comments on an earlier version of this review.
  3. 3 FCRA §610(e), or 15 U.S.C. §1681 h.
  4. 4 FCRA, 15 U.S.C. §1681.
  5. 5 FCRA, 15 U.S.C. §1681 (b); §602 (b); cited in Cushman v. T.U.C. (3rd Cir., 1997).
  6. 6 FCRA, 15 U.S.C., §1681(a)(2).
  7. 7 FCRA, 15 U.S.C., §1681 h(e).
  8. 8 FCRA, 15 U.S.C., §1681 h(e).
  9. 9 FACTA, PL 198-59, 111 Stat. 1952 §601.
  10. 10 FCRA, 15 U.S.C. §1681 b (b)(2)(A).
  11. 11 Schware v. Board of Bar Examiners of New Mexico, 353 U.S. 232 (1957) 239.
  12. 12 Anastaplo, 3 Ill.2d 477; 121 N.E.2d826 (1954); cert. den. 348 U.S. 946 (1954); 366 U.S. 82 (1961).
  13. 13 Johnson v. Zerbst, 304 U.S. 458 (1938).
  14. 14 Miranda v. Arizona, 384 U.s. 436 (1966).
  15. 15 FAA, 43 Stat. 883 (1925), as amended and codifide in 1947 as 9 U.S.C. §§1 et seq.
  16. 16 Shearson/American Express v. McMahon, 482 U.S. 220 (1987).
  17. 17 Lochner v. New York, 198 U.S. 45 (1905).
  18. 18 FCRA, 15 U.S.C. §1681 b (b)(2)(A).
  19. 19 U.S. v. Brown, 381 U.S. 437 (1946) 462, citing U.S. v. Lovett.
  20. 20 U.S. v. Lovett, 338 U.S. 303 (1946).