 Thank you so much. Thank you so much. Welcome to the 35th annual Benjamin I. Wheeler's lecture and luncheon. We are so so glad to have you here with us today and I can't tell you how it warrants my heart to look around the audience and see so many familiar faces. It's just fantastic. So we're honored both to have our amazing Wheeler members but also we're also honored to have Professor Urban and Chancellor Chris joining us today here also. Thank you guys both for being here. Now before I introduce Professor Urban I want to call attention to our fantastic musicians over here in the corner. This is the Cal Alumni Jazz Quartet. This ensemble is made up of talented alumni and sometimes students sit in and they're dedicated to fostering community for the performance study and promotion of jazz at UC Berkeley and we're super grateful they're going to be performing throughout the entire today. Some hep fact for you, hep cats. Earl Father Hines was a Wheeler member so we got our bona fideas there. For those of you who know Earl Father Hines was. So just just to call out a little bit we've got we've got Robert on guitar. We've got Bill on drums. We've got Ed on bass and we've got Sam who is the leader manager for over 25 years on trumpet. Thank you guys. And that was the coolest swinginess version of the fight song I think I've ever heard so I think it's my new favorite version. So we have so both for Professor Urban and when the Chancellor give the remarks you'll notice on your table there's some three by five cards and pencils. So if you have questions all you need to do is write them down and then hold it up and then we have Samantha and Damon over here are going to be coming around and collecting those and then we'll be answering. We'll be asking the questions up here so easier for everyone to hear that way and no mic passing. So alright so without further ado Professor Urban is a clinical professor of law at the UC Berkeley School of Law where she is the director of policy initiatives at the Samuelson's Law Technology and Public Policy Clinic. Her research focuses on information policy, intellectual property, privacy and data protection and security. She's regularly collaborates with technologists and academics in disciplines other than law to develop empirically grounded understandings of how new technologies and the regulatory structures around them interact with civil liberties, innovation and creative expression. Please join me in welcoming Professor Urban. I feel there are many steps to getting situated at the moment so please bear with me. Alright good morning. I'm absolutely delighted to have the opportunity to join you today for the annual I'd Wheeler Society lecture and luncheon. My name is Jennifer Urban and I am as as Melanie said a clinical professor at the School of Law here at UC Berkeley and the director of policy initiatives for the Samuelson Law Technology and Public Policy Clinic and a faculty co-director for the Berkeley Center for Law and Technology. Last year the governor Governor Gavin Newsom appointed me chairman of the board of the governing board for the new California Privacy Protection Agency which was created by California voters via Proposition 24 the California Privacy Rights Act of 2020. I introduced those aspects of my work because I must be clear the lawyers in the audience will understand that today I speak only for myself not for the board not for the California Privacy Protection Agency nor for the university my clinic or any of our clients. My deep thanks to Rob and Melanie for the kind invitation Melanie for the lovely introduction and to both of them for making sure I have what I need and I really want to thank all of the members of the Wheeler Society for having me today and taking some time to think about privacy. It's a great honor to address a group of people who by definition are exceptionally community-minded and no less important forward-thinking and I'm excited and delighted to talk to you about privacy which is poised at a watershed in the United States. After years decades really in the wilderness privacy issues began receiving a tension in the press around 10 years ago and now they're regularly covered. I just checked my open browser windows for major newspapers while I was writing this and I discovered at least six or eight headlines related to privacy after the recent Supreme Court decision security issues data breaches and a number of other things. Recent laws especially in California which I'll talk about portend what I think is a true change. At the same time the title of these remarks asks what I think is a fair question and in case you don't have the title of the remarks it's privacy of the people for the people by the people question mark and I'm very cheeky and actually stealing from Abraham Lincoln and the Gettysburg address so you know be kind but I think it's a really fair question. Do we in fact live in a world where privacy is or even can be for the people by the people of the people excuse me and perhaps most controversially by the people. I have two propositions to put on the table. First I assert that privacy is something we've gotten wrong for a while quite a long while in part because it's been passed off as of the people but has not actually been and is something that recently maybe we are getting right. Second and I do realize it may not always seem like this I believe that privacy policy is democratizing after a long sojourn outside the apparent reach of we ordinary folks and we are at a point where the decisions of the people are crucial in other words privacy understanding and policy must be by the people again. We'll see if I can convince you here's what I'm going to do I'll give you a necessarily woefully incomplete tour of privacy in the last couple of decades a little bit of storytelling a little bit of empirics tiny bit of theory and then I'll see if I can advance my propositions with some real-world examples and some old-fashioned exhortation. As you can see we have no visuals and I like pictures but we're going to do this the old-fashioned way and we are going to have to cast our minds and our imaginations out and make our own pictures. We'll both we'll all try so let's start with a story the story of privacy or a story of privacy in the 21st century I'm mostly going to talk about information privacy mostly in the United States and mostly about how so-called information privacy relates to private actors. Obviously that's not the whole story obviously as it relates to our conception of ourselves as the people in a democracy though I'll talk about that connection later. Okay here's my story the 21st century dawned with a mythos about privacy and its central theme was that privacy was a dead letter the theme dated from at least the 1940s and had gained strength over the decades in support of this mythos certain facts were marshaled for one new technologies allowed information collection sharing and use on an unprecedented scale. For two and this is arguably new people didn't seem to care in fact they embraced the change. If you cast back circa 2000 the worldwide web had become established and may the internet accessible for everybody even the less technically inclined as long as you had a connection. Also AOL was still around if you preferred a more controlled environment. People were starting to go online in large numbers writing on message boards sharing secrets making geo cities pages finding niche interest groups and I'll just keep going until I hit something that everybody in the room remembers. Posting things about themselves basically and others that could be accessed by anyone who happened by leaving records that would soon be searchable forever more and already being tracked by cookies used to serve ads to them. Email took over workplace communications and people were saying anything and everything in this medium which was basically a post card. Privacy issues didn't seem to be of interest to the press there were a few scholars focused on privacy public interest organizations understandably were focused on what they saw as more immediate and concrete needs housing food medical care. Even civil liberties organizations were mainly focused on government activity. The big brother rather than the little brother. Congress had an updated privacy laws in any meaningful way since the electronic communications privacy act in 1986 although it did embed privacy protections in the telecommunications act of 1996. The prevailing narrative was that privacy was of little value to consumers a word I use advisedly and we'll get back to that who were choosing convenience connection maybe even radical transparency over personal privacy and importantly that they were willingly sacrificing privacy for free services that they demanded in a world where peer-to-peer file sharing free music some of you may remember your kids being into this it rocked the entertainment industry and it rocked publications experimenting with paywalls they often had to give them up nascent social media sites charge no money and drew multitudes who share deeply personal information apparently willy-nilly in this world consumers and especially young people seem too many to be insisting on free and not caring about privacy. There wasn't also a more privacy-centric narrative of the early web and I'm gonna ask everybody to make it the picture in your mind exemplified by the famous New Yorker cartoon of a dog on a computer saying to another dog on the internet no one knows you're a dog and there was probably some truth to that while tracking technologies were more limited and there were certainly exceptions some of today's privacy rights organizations got their start around this time for example but the cache arguably was with people like Sun Microsystems co-founder Scott McNeely who proclaimed in 1999 he have zero privacy anyway get over it and his many imitators I never would have predicted before it happened that one of my other areas of study copyright law would be fashionable and interesting before privacy but sure enough file sharing made it so now I'm mostly focusing on a story about individuals and private actors but the relationship of the people to the government also contributed to the overall narrative the early 21st century mythos also set privacy against security especially after the shock and tragedy of September 11th revelations that law enforcement and intelligence agencies had failed to share information and failed to connect the dots were taken to mean that information gathering more surveillance more observation was what was necessary to prevent another attack and so the USA Patriot Act was passed only 45 days after September 11th and it came to Congress as a wish list from law enforcement and intelligence dusted off taken from the shelf and rushed to Congress we entered a world with the Internet and people sharing on the Internet along with people seriously saying with regard to security why have nothing to hide even while there were dissidents who complained about so called security theater and the naked machines and the airport meanwhile all those free services had to make a living somehow advertising was a ticket and targeted advertising personalized to individual consumers and targeted to their worries desires and general preferences that was embedded in all that information that they were emitting with the innovation ads were and still are sold and automated real time auctions based on tracking data and profiles built about individuals more and more information supported more and more detailed profiles sort of shadow people for many of us to sell ads again of course the 21st century data explosion occurred because of technological innovations that connected us more completely than ever before and that grew and continue to grow and their ability to store and analyze ever larger amounts of information at lower costs and ever before but the shape of the change for example the fact that it was so underpinned by advertising and ad markets was both influenced and enabled by this particular privacy mythos I mentioned that an aspect of the mythos an important part was an understanding that privacy was dead or at least a little in fading importance to the polity and the evidence for this came from people's apparent actions and choices but the interpretation of that evidence was based on the hero of the mythos Homo economicus and please forgive me I'm not only mixing Greek and Latin but I'm sure I'm butchering them both so you know I have a science degree and a law degree and just please forgive me the Homo economicus had a whole legal and privacy framework built around him. Homo economicus the economic man is a rational actor the late 20th century and early 21st century archetype of an individual making rational choices in the marketplace of life. Free markets unleash Homo economicus to shape society through his choices which he makes to maximize his preferences and interests. Homo economicus in his early form roams at least as far back in time as Adam Smith and John Stuart Mill but he really got rolling in the 20th century when he became the embodiment of rational choice theory and one way to understand liberty. Now this understanding has never applied with the same force to everyone. This is why I'm gendering Homo economicus he and why you can imagine him to be white economically secure non-disabled probably middle-aged or younger in age but not a child and so forth and of course real economic theory considerably adds nuance and is more complete. Still Homo economicus is a private powerful mythological hero in the story. You can say he stands in for the people. Consumers make individual free market choices and through their choices they dictate what products services and privacy protections will be offered or not. Privacy is a forum by the people. Imagining Homo economicus running around making rational decisions in the American marketplace also helps us understand why the law governing all those data flows largely came down to something called notice and choice. In the notice and choice regime companies provide notice of their practices related to consumer privacy. Guess where they are they're in the privacy policies everybody knows about privacy policies right yeah so that's where they are in the privacy policies we've all come to know. Consumers Homo and S economic I read these notices and they make rational decisions according to their overall preferences including preferences about privacy but also price service offering and other attributes. Although the concept of providing notice and offering a choice is actually loosely based on the 1970s era fair information practice principles a United States creation and export that has influenced many other parts of the world notably Europe. Most of the substance of the principles such as minimizing data collection to what is necessary and offering data subjects the ability to participate meaningly in some decisions was trimmed away in favor of a bare two step process. Notice the consumer via the privacy policy or terms of service which we probably all love more than privacy policies and the consumer's choice to accept or not. Privacy enforcement in large part has addressed deceptions in these privacy policies rather than the fairness of their underlying terms. So notice historically has been a pretty limited concept choice has to choice has generally meant a choice to interact with their use or not the company's products or services read the privacy policy. Find the terms acceptable choose to use the company. Find the terms unacceptable find a competitor with better terms. Outside of certain sectors for example healthcare data when it's in the hands of health providers credit reports video rental records and there's a story there that we can get into in the questions if you want and a few other things. The market-based notice and choice approach became hegemonic in the United States was encouraged by regulators and it structured the new data intensive marketplace. Where did this come from? Why is this our model rather than for example something more like a continental European model which is rooted in dignity and enlightenment values that are also part of America's heritage. Certainly our broader American mythos of market-based freedom is relevant. In practical terms however the hegemony of the notice and choice regime is in no small part due to the prolific influential work of Professor Allen Weston. Professor Allen Weston who passed away in 2013 was a founder of contemporary information privacy theory and practice. His 1967 book Privacy and Freedom is a seminal work in information privacy and I highly recommend it. Today however Professor Weston's influence stems largely from the dozens of public opinion poll surveys he conducted often on behalf of corporate clients which probed individuals attitudes towards privacy and technology. Over many decades both industry actors and policymakers who relied on the survey work and advocated its use and it was arguably excuse me at peak influence around the turn of the century. And here I have to really thank my colleague Professor Chris Hoefnegel who turned me on to thinking about how Professor Weston's survey work interacted with his academic work and what that really meant for us. Weston developed a model of consumer preferences that lent strong support to the notice and choice approach and this is a predominant and feature of his influence on policy. In his model which he used surveys to segment people with he segments people into three classes excuse me consumers the definitely consumers in Weston's model. Based on their privacy preferences privacy fundamentalists privacy pragmatists and the privacy unconcerned. Privacy pragmatists were both the largest group at around 55% and the heroes of Weston's story as well as our homo economicist story. Weston characterized this group is supporting to leave it to the market approach and exercising informed and rational choice. In 2001 congressional testimony he described privacy pragmatists as knowledgeable sophisticated and discerning. This group weighs the value to them and society of various business or government programs calling for personal information examines the relevance and social propriety of the information sought wants to know the potential risks to private or security and goes on and learns a lot of other stuff and then decides whether they will agree or disagree with specific practices. The pragmatists and Weston's model favored voluntary standards and they didn't favor law unless it became absolutely necessary. Privacy fundamentalists by contrast were about 25% and Weston characterized them as placing an especially high value on privacy favoring strong laws and rejecting organizations claims to need personal information. The privacy unconcerned were about 20% of the respondents. They didn't see what the privacy fuss as Weston put it was and they had no trouble handing over information. This was a highly influential network excuse me framework and as our mythos incorporated the understanding that 75% of people were either privacy pragmatists or entirely unconcerned it didn't seem like there was a need for political debates of a privacy. Decisions were being made and would be made in the marketplace and so as the 21st century continued to unfold data intensive practices developed and expanded rapidly with little legal or political constraint. We quickly moved off the web into the Internet of Things with smart devices collecting lots of data, mobile phones, tracking people's location wherever they would go, the smart electricity grid helping us understand our energy choices but also moving outside of the house information about what is going on within the home at a great level of detail and of course cloud computing and I I'm not sorry I don't have a picture of a cloud, a silly picture of a cloud which doesn't mean anything because cloud computing of course is just somebody else's computer and so we moved on. Now I've sketched the mythos for you and I think it's limited but a fair version of the received wisdom about privacy in the 21st part of the 21st century but that is not to say that it was ever fully true or ever fully accepted. Scholars and regulators began to question the Notice and Choice model and though it continued and continues today in some form by 2010 Daniel Weitzner who was then a senior policy official at the National Intellect Communications and Information Administration asserted that there are essentially no defenders anymore of the pure notice and choice model. It's no longer adequate but we continued with it for a long time and while the targeted ad model may have been and still is described as foundational to making possible the benefits of the web and social media there was always a steady rumble of discontent punctuated by periodic consumer backlash well before today's so-called tech lash took hold. Some of you probably remember Bruce Schneier saying don't make the mistake of thinking you're the customer you're not you're the product its customers are the advertisers that got a lot of attention. There were data breaches after data breaches after data breaches. There were various things that companies tried that consumers didn't like like Black Friday some stores decided to try to track people around and target as them and that wasn't that wasn't positively received or one company started taking the contact list off your phone in order to offer you more friends but people didn't like that either. And there was data breach after data breach after data breach and then we started seeing reporters like Julia Anglin and Kashmir Hill and others to write about privacy and we started to see more of a debate about it. Then the Snowden revelations happened and there was upset and backlash more gas from companies data breach after data breach after data breach. Meanwhile privacy had been seen around the year 2000 as a scholarly backwater but privacy scholarship exploded and began to rapidly advance our understanding of privacy is actually understood experience and practice. I cannot even begin to do this work justice so I won't try but I'll give a few illustrative examples and here I have to highlight Berkeley a little bit because Berkeley scholars were well ahead of the trend and had one of the most robust programs and privacy law and policy in the country by the very early part of the century and have been influential. For example my BCLT colleague Dildre Mulligan of the School of Information and the first director of the Samuelson Clinic is both a brilliant theorist and a pragmatic policy designer who is the reason we know about data breach after data breach after data breach. She understood that people may on part be basing their decisions on no information and she persuaded the California legislature to pass the very first data breach notification law in the United States in 2002 and suddenly we knew that there were all these data breaches. My colleague Chris Hoofnagle with graduate students elucidated the use of cookie tracking including unexpected places and mobile phone tracking and my colleague Paul Schwartz interrogated the idea of PII some of you may remember this personally identifiable information like a name and an address and maybe social security number. This is what was protected if there was a law. He explained along with others that wasn't going to cut it that those were not the only pieces of information that were personal to someone. Other scholars elsewhere showed that some of our understandings were just wrong so LaTanya Sweeney at Harvard showed that de-identified data wasn't supposed to be harmful because it was anonymous was often readily de-identifiable in dramatic form when she vividly demonstrated that she could re-identify the governor of Massachusetts with something that was like a zip code and some other piece of information that did not involve his name or his address. For my part I worked with Professor Hoofnagle and statistician Sue Lee to explore the mythos of homo economicus and privacy pragmatism underlying the Notice and Choice regime and the general belief that consumers were choosing against privacy in the marketplace. Over the course of several years we use national survey research to probe Americans understanding attitudes and preferences and testing them against Professor Weston's segmentation model against propositions made to consumers in the marketplace and other aspects of the mythos. For one we wanted to see if Professor Weston's privacy pragmatists were really understanding and weighing options and doing all that exploration making rational choices. So we used Weston's segmentation to split respondents and we came up with very similar numbers 56% privacy pragmatists 20% privacy fundamentalists and 16% unconcerned and then we did two things. First we gave respondents short quizzes to test their knowledge three true or false questions relevant to contemporary debates about online privacy and you know what we're going to do now. We are going to take the quiz and I really wish I had a slide for this but I'm everyone I'm just going to have to read them out and everyone will listen so here's they're very short and there are only three questions listen carefully. When you use the Internet to learn about medical conditions advertisers are not allowed to track you in order to target advertisements true or false who thinks true a few who thinks false oh my you are now we'll get to this you're all privacy fundamentalists. Here's the second question free websites that are supported by advertising are allowed to sell information gathered from users of the site even if they have a privacy policy who thinks that's true very good. Does anybody think it's false now in California not when we ask this question but today that is actually not necessarily true. And I will get to that here's the third question when visiting free websites supported by advertising you have the right to require the website to delete information it has about you true or false. There's a true back there any other truths. Okay false all right that one's a little bit more evenly split at the time we asked the question that was absolutely false now in California it's true so I'll talk about that. So you all were really on the ball and know your privacy maybe you decided to come to the lunch and it was about privacy but our nationwide survey respondents were not so not so on top of it. Not so on top of it and made some mistakes. So in all three cases the largest group answered incorrectly or don't know by a pretty wide margin but a pretty good minority also selected the correct answer. So then we tested this against the segmentation who got it right out of Weston's model there was a knowledge gap but the choosy privacy pragmatists were not the knowledgeable group rather the privacy fundamentalists answered all three knowledge questions correctly in a much greater proportion than the other groups they even got a majority on question to 52% of them answered correctly nobody else got out of the 30s for any of the questions and 40% excuse me so in several surveys we had a number of these over those are just three questions but we found similarly across surveys and across several years that people made understandable assumptions about what their rights and protections were and they were usually wrong because the notice and choice mode provided very little protection. So over several surveys we also tried to test what people really wanted to do this we presented respondents with business propositions that were drawn from the actual marketplace for example we asked whether they would accept companies collecting location data to send them ads whether they were in the stores or if they'd share their email address with retailers they patronized I'm just going to mention two because the results were all pretty similar. First we asked whether respondents would be willing to share contact information on their phones with the social networking app so the app provider could suggest more connections attentive listeners will find that familiar example this scenario track apps use of excuse me and then the secondly we asked respondents whether they'd be willing to share contact list information with the coupons app they'd already downloaded so it could also offer coupons to people in their contact list this was also based on an existing coupons app that was in the marketplace so we had an offered exchange and there was a clear benefit there was a reason to collect this information respondents overwhelmingly rejected both scenarios as they did other propositions that involved contemporary practices for collecting and using data 81% of respondents said they would definitely or probably not allow the contact collection in order to suggest friends and 93% so they would definitely not allow or probably not allow the coupons app 75% of them would definitely not allow it further despite Western's prediction that data practices would follow pragmatist preferences we found high levels of rejection from all the respondents including the pragmatists when we presented them with this and other value propositions which we tried to present very neutrally but just give them the actual deal that was being made privacy pragmatist and appear to be neither knowledgeable about privacy or particularly pragmatic or inclined to share their data the parent choices in the marketplace the underlying evidence for the profiling mythos might not necessarily reveal consumers preferences accurately well we can draw direct conclusion for the reason it plausibly indicates the lack of knowledge and maybe a lack of the kind of obvious choice that we were able to give our respondents for contributing factors recall that the contact list were originally collected without any notice and without the consumers knowing what they were being offered in return ours and other research has repeatedly shown consumer knowledge gaps for example in older studies although people know better now consumers interpreted the existence of a privacy policy as evidence reasonably that a company protected privacy and also assume there were laws protecting privacy in alignment with their preferences still other limitations although people have learned more over time other limitations persist for example Lori Craner and others have done a lot of research to show how absolutely impossible it is to actually read privacy policies and understand them they calculated how many hours it would take to read policies and they calculated the opportunity cost which was in the hundreds of millions of dollars and there's also the question of whether meaningful choice is presented the contact list example I find interesting in part because the backlash actually resulted in a targeted choice not you can have this app or not have this app but let the app collect your contacts or not there is now a robust body of fascinating well I think it's fascinating research which is growing all the time illuminating what really seems to be going on with consumers and privacy economists like Alessandro acoustic and qualitative researchers like Jennifer King and Dana Boyd have shown that consumers actually constantly negotiate the boundaries of their disclosures according to their understandings and preferences they just don't necessarily have all the information or all the choices that they might want so for example acoustic and others have showed that users of a major social media network exhibited what he called privacy seeking behavior over time as the network offered them more privacy options they took them like making post-private or only showing them to some connections even as they revealed more and more information about themselves within the context of those choices and controls Helen Nissenbaum an information professor at Cornell Tech expands on these observations and formalizes them in her model of privacy and context this recognizes that people have different ethical norms and preferences depending on the context of information sharing and it's actually a formal model that I won't go into but for example a data subject can be a patient and the recipient a doctor this is a health context with a relationship of trust and a transmission principle that the patient will offer information and the doctor will keep the information confidential and use it for the patient's health but those of you who are close enough to see that I have surgical staples in my head aren't going to ask me about them are you because we are in a different context we are in a semi-professional semi-celebratory social context and we're acquaintances or maybe strangers and in that context you know it would seem kind of weird and creepy if you were quizzing me about the surgical staples in my head so most of you would see that as a norm that you wouldn't breach Nissenbaum argues that context must be understood and contextual integrity maintained to understand what is appropriate in any given scenario and this sheds light on all that sharing people weren't just posting their information willy-nilly they were connecting with friends they were connecting with people they had some kind of contact with this doesn't mean that actions even apparently contextual ones always reflect underlying preferences either as we've seen information asymmetries where the consumer usually doesn't know very much can be persistent and they can be permonitious and choices can still be very limited in practice and this is especially true for the majority of us across the population who don't fit the homo-economicus archetype so for example the decision to post pictures of your home may mean one thing to our homo-economicus it may mean something very different if you're risking being bedlined or having your mortgage what is it called refinance come back at you with a higher interest rate because you're in a neighborhood that the algorithm sees as more risky scholars like Sophia Noble and Ruhab Benjamin have done pioneering work showing how things like race and gender end up impacting what is offered and what is acceptable and there are class socioeconomic class critiques and and many others many scholars have probed these issues I actually think they're summed up pretty well by a friend of mine my hairdresser who's not happy about this staples and who has given me permission to quote her she's a devout person and she encapsulates her experience of trying to make informed privacy choices this way I don't feel good about it I don't think I like what I'm being offered I don't trust it but I don't feel like I have any real choice so I click I agree and I pray so here we are though it may not seem like it every day in the marketplace all of these things have actually unsettled the old privacy mythos well it took a few years for a political discourse in law to catch up we are now certainly at a watershed and witnessing a change in direction I'll sketch some examples of that change but I'm going to focus on California which has been a leader in privacy for decades and then turn to where we may be going there are a number of shifts so for example I mentioned my colleague Paul Schwartz who recognized that these little crabbed definitions of personal information weren't enough another big recognition was the recognition that we could harness many maybe all of the benefits of data-rich analytics without necessarily needing to compromise privacy Cynthia Dwork and other mathematicians realized that we could use math and we could find out lots of things from rich data sets but at just a little bit of obfuscation which would keep querying the database from revealing any person we figured out the importance of privacy by design from the beginning rather than trying to fix it later but the theme today and I think the most important shift although it's probably one of the more contestable is what I see as the return for vocal return of vocal public demand for better terms belying the dead letter mythos and here at California is a great example California we love California it's a home of high tech industry it's home of biotech we are no strangers to the benefits of intensive data analysis we also have a long tradition of leading the United States in privacy and data protection in California we enjoy an explicit right to privacy in our constitution which can be enforced against both public and private actors we also enjoy the benefits of legal protections from that first data-reached law in the country to Cal APA which actually required companies to post privacy policies data to a data broker registry to and others and a legislature that is currently working on laws relating to children's privacy smart speakers among others so California just by itself as you know the innovator that uses the data and also the innovator and privacy complicates the narrative but the main reason we are currently acknowledged as a leader is the California consumer privacy act of 2018 or CCPA that's why the answers to the questions change the CCPA was the first comprehensive consumer privacy law by which i mean it's not sectorally limited to health data or genetic data or our credit reports or what have you in the united states it began as a citizen ballot initiative now it was carried by Alistair McTager who is a real estate guy and who had resources to try to deal with what he saw as a real problem but he is just an ordinary citizen he's not a privacy expert he's not a you know privacy industry guy and he got a lot of support for this so much support that the legislature went ahead and passed it before it ended up on the ballot and then this was extended and strengthened further in 2020 when proposition 24 the California Privacy Rights Act of 2020 did go on the ballot and was passed as a citizen ballot initiative with a large percentage of the vote adding further protections to the CCPA and creating the California Privacy Protection Agency which is the first dedicated privacy and data protection authority in the united states i think this is exemplary of a change and it's also something that californians should know about so i'll talk about it a little bit the CCPA right now grants us all rights and protections and it will grant us more in january when the CPRA amendments take full effect how it treats the problem is a sort of a combination in many ways the CCPA would look pretty familiar to our homo economicist hero central mechanisms are consumer choice and control and encouraging competitive offerings in the marketplace doesn't abandon notice and choice but rather the CCPA seeks to make notice and choice workable by consumers implementable by businesses and privacy something businesses can compete on at the same time though the CCPA affirm expressly reaffirms the californians as natural persons have fundamental privacy interests and deserve those meaningful choices and control of their personal information because of that at the top of the law the findings say fundamental to californians constitutional right of privacy is the ability of individuals to control the use including the sale of their personal information so to try to address some of the defects in the bear notice and choice model CCPA beefs up notice and a beefs up choice from the business side at the point of collection covered businesses have to disclose the categories of personal information they collect the purposes they're collecting them for how long they intend to keep it whether they will sale or share it and to whom actually businesses also have to notify consumers that they have rights and on the consumer side the law provides california consumers with something we never had before but we had a minimal some we had something small before because we're in california but nobody else had it which is a right to know that's the right to know the personal information that the business is collecting about you why they're doing it what they're doing with it and where they got it this is information that has not necessarily been available before although in recent years some businesses have provided it second the CCPA tries to address consumer powerlessness and lack of meaningful choice by giving the power to the consumer with a basket of rights that can be exercised rather than just being you take my business and product or you leave it california consumers under the CCPA right now have the right to opt out of the sale of their personal information and sale is defined as any valuable consideration so this you know there's often data for data exchanges and things like that and that's a sale and soon the sharing which is for contextual behavioral advertising and they have a right for a business to delete personal information so the answer to the question changed when the ccp cpra excuse me amendments take effect in january californians will also have the right to have businesses correct and accurate personal information that is told about them and to limit the use of sensitive personal information so sensitive personal information includes things like identification numbers precise geolocation genetic and biometric data religious beliefs union membership sexual orientation other things that are especially sensitive to a person but you might need a business to use and you can limit that to what is necessary to provide the expected goods or services the cp cca also then protects against discriminating excuse me prohibits discriminating or retaliating against consumers who exercise those rights so they can provide a financial incentive or other incentives for data but in general they can't just withdraw still we have each of us and lots and lots of businesses so the ccp a tries to make it really easy to exercise rights first it requires businesses to respect what's called an opt-out preference signal which is a technical little message communication that you can set on your browser so that when you surf the web it's always telling websites where you go that you want to opt out of sale and it allows consumers to designate third-party agents to go ahead and opt out for them and there are both for-profit and non-profit agents in california right now taken all together the law creates a framework within which california consumers and businesses have options for actual bargain for exchanges and because information is available and consumer choice is protected businesses have mechanisms for competing on privacy whereas before if they said what they were doing with a lot of specificity and they gave choices other businesses didn't have to do that and so maybe they couldn't compete as well but now they can then there's implementation enforcement this is where the new agency comes in in many countries around the world dedicated privacy and data protection authorities are responsible for protecting consumers and providing guidance to businesses and enforcing the law california voters created the very first dedicated privacy agency with proposition 24 the agency is vested with full administrative power authority and jurisdiction to implement the california consumer privacy act including promulgating regulations which we're doing right now and i hope you will comment and enforcing the law starting in july 2023 here the agency collaborates with the attorney general the attorney general enforces through the courts civil lawsuits and the agency is responsible for administrative fines and cease and desist letters the agency also can audit businesses as an expert agency the cppa is also directed to promote public awareness of data privacy to make those questions a little easier to answer provide guidance to businesses and consumers advise the legislature on privacy related bills and and and things like that however what i really think is interesting about the law and the privacy of the privacy agency is that in addition to trying to make a notice in choice meaningful and workable the law shows its grounding in more substantive conceptions of privacy in part to what it tells the agency to do exemplifies the renewed connection between privacy choice in the marketplace and why people should have the choice in the first place the agency is described in the law as an independent watchdog whose mission is to protect consumer privacy that should ensure businesses and consumers are well informed about their rights and obligations and vigorously enforce the law against businesses that violate consumer privacy rights direction and mission are even more clear the law is to be implemented with the goal of strengthening consumer privacy while also giving attention to the impact on business and innovation but the mission of the agency is as follows the agency is charged with protecting the fundamental privacy rights of natural persons with respect to the use of their information by implementing the ccpa and the law follows that up with other things besides the dedicated agency it brings back in some of the fair part of the FIPS there's data minimization in the ccpa businesses can no longer just willy-nilly collect your information and then use it for any purpose they want there are protections against dark patterns you know those really annoying pop-ups when you say no and they say are you sure and you say no and you say don't you want to save money and you say no and so on and so forth or accept all or some other choice that isn't you know a real choice and those are dark patterns and the law prohibits them structurally the initiative adds a really interesting feature the law cannot be amended unless the amendments are in furtherance of the purpose of the statute and that way it gives a floor to privacy for Californians and it is hard to water down so this is a real change and maybe it's not complete probably there's more to do i'm know there's more to do to get privacy right but i think this is evidence that we are starting to get privacy right it's it's more implementable by consumers and businesses it's more grounded in the reality of the marketplace it's more grounded and shared values and fundamental interests and it's representative of long-term public investment in those interests in the form of the agency now here's the harder claim to meet California as evidence of privacy policy democratizing after that long soldier i mentioned that the agency and the law were developed from public demand and citizen initiative the law provides individuals with tools to actually effectuate choices if they choose to participate it builds structures for public participation the public awareness and guidance functions of the agency and through regulations where we invite and listen to public comment and we've since been followed by Colorado Virginia Connecticut Utah and other states are actively considering comprehensive privacy laws it's a bottom-up request at the level of the state although there now is also a federal bill moving you know last week i drove through san francisco and i couldn't believe it my i saw companies competing on privacy now because of my role at the agency i cannot say the name of the businesses but there was a large device manufacturer everybody knows they have multiple billboards that just said privacy that's our product there was another company touting the government won't protect your privacy we will and another that simply said choose privacy choose us this to me is an absolute watershed moment so maybe i've persuaded you all that we got privacy wrong and navigating closer and that there is demand and room for public participation for the people to shape privacy for themselves i hope i have that is not to say though that the job is complete by any means a polity needs a narrative and deep probably a mythos of some sort to make decisions for itself and when the old mythos fractured under the scrutiny and put consumer backlash we don't necessarily have a new one yet in its place and this brings me to the supreme court dobs fee jackson women's health organization was an earthquake that hit after i submitted my abstract for my talk today dobs which is the case that overturned roe versus wade really made me feel unmoored as i read it it turned upside down expectations and understandings that have been in place literally my entire life in turning over those expectations and understandings dobs shows us that we can't not that we ever could but it is a really strong signal that we cannot forget other forms of privacy the oldest deepest forms that are located in dignity bodily autonomy and one's most intimate spaces and relationships they are as justice thomas's concurrence makes explicit in which he calls for his colleagues to reconsider decisions on marriage freedom and even contraception these deeper rights are potentially under threat it also reminds us that privacy can be fundamental to many other things even it turns out in the reaction of some governors and legislatures to the dobs decision core things like the right to travel unimpeded between states at the same time old arguments about information privacy versus other kinds of maybe more important privacy collapse under dobs effects period tracking apps location tracking that shows you at the reproductive health office cloud-based calendars that show your medical appointments and could be subpoenaed and handed over to law enforcement these are all the stuff of information privacy and they are the stuff of bodies and gender and sex and intimacy and the other deeply personal stuff of life dobs shows dramatically the difference between the conception of data as a commodity of our data as what Shoshana Zupoff has called raw materials for a machine of advertising to sell us period underpants since we're talking about dobs and gain our data and and a deeper conception of privacy one version of which is described by my former colleague David Sklansky as a refuge in his view each of us needs a private enclave locations and aspects of our lives that are shielded from public scrutiny Sklansky argues that this is why even David Brinn an influential enthusiast for transparent society warns and David quotes him we will always need some zone of sanctuary where we can feel unobserved some corner where our hearts can remain forever our own it also shows the value of Nissenbaum's ethical rubric and how bereft privacy is when it is only considered as an individual thing pregnancy intimacy the path of a life these are more than reducible things Robert Post usefully describes privacy another former colleague not as a thing that people have but as a set of quote social norms that define the forms of respect that we owe to one another norms that are part of the decency of civilization so we need to do some work we could do worse than turning back to professor Weston though i can't agree with his segmentation model or its ramifications his academic work remains seminal in that work Weston saw privacy as a fundamental liberal value that all humans and even animals seek in privacy and freedom he presciently wrote in 1967 remember the real need is to move from public awareness of the problem of privacy degradation to a sensitive discussion of what can be done to protect privacy in an age when so many forms of science technology environment and society press against it from all sides to his credit professor Weston didn't just offer his survey research and policy debates he also sought to sharpen the public discussion around privacy he pressed policymakers to define privacy and to establishment as a concrete topic in political debates so that decisions could flow from meaningful discussions we would do well to undertake that work with all the empathetic imagination we can muster and with all the energy of a democratic polity i look forward to the conversation fia lux thank you oh i forgot about the questions so thank you thank you so much professor urban that was that was a great talk very insightful and lots of really really great questions from the audience a lot of them regarding a sort of the the last bit that you covered there but so i don't know if we'll be able to get through all of them but some good ones here so do you have any thoughts or comments on bio or genetic data that is not protected by HIPAA such as 23andMe data that's a really great question and i'm going to touch on two aspects of it which the questioner obviously already understands one is that i talked about the fact that in the united states by and large although not so much in california now we have what's called sectoral privacy and sectoral privacy means that privacy protections may apply to certain kinds of information and also certain parties so what the questioner is referring to is the fact that if you give your data to a covered health organization under HIPAA then it is protected but 23andMe or other sort of third party companies aren't covered by HIPAA and so it's data like anything else again not in california genetic information is sensitive information but often it's like anything else so that is one aspect of the question that i think is important and really important to understand the other aspect of the question gets at this issue of dignity and autonomy and individuality versus what we owe each other genetic information is probably the easiest piece kind of information with which to see that it's not just about you anytime you reveal your genetic information you reveal the genetic information of your family you reveal the genetic information of people who may not want that information revealed who may not want the answers that to questions that weren't asked by the information being garnered and analyzed and used and so i think it's a really genetic information has been you know obviously a boon in so many ways but it really sharpens the questions about what are the ethics and morality that for example nissenbaum asks and how we should think about privacy in a richer way than simply something that has to do with only the individual thank you this one is does the EU have a primary model or something worthy of our attention oh thank you yes i didn't have time to talk about it um but the ccpa echoes in part actually the general data protection regulation in the european unit europeans and european america are actually not as far apart i think as many people think at least not california and europe um but europe does actually start from a different premise we start from this opt-out premise data is all good and you can opt out europe starts from the premise that if you're going to process someone's information you better have a good reason to begin with um and probably you're going to have to ask permission unless it's for certain kinds of purposes and those rights the right to know the right to opt out the right to delete the right to correct those are all rights that europeans enjoy under the general data protection regulation the other thing that they share the laws share which is maybe maybe not not as desired is you know all those cookie banners that you get those are all because of the general data protection regulation and now we all get do not sell my personal information and that is because of the california lot so they these laws have a sort of a kinship and a model that is local so it is tailored for local conditions but it shares some norms and it shares some sort of fundamental features and that is recognized in our law in part through the fact that the agency is told to cooperate with other jurisdictions in california the us and actually around the world in order to try to enhance that cooperation and norming process that's great i kind of feel these next two questions are are are two parts but they're from different people but so one so this is sort of a berkeley brag it says jennifer can you share with the audience that berkeley has launched the world's first cyber security clinic a citizen clinic training berkeley students from across the campus to help nonprofits at risk of cyber attacks including privacy violations and the other question is please speak about the dark web okay say no more okay so my dear colleague you've already heard about chris hoofnegel some of you may know him is the director of the center for long-term cyber security here on berkeley which is an interdisciplinary center that brings together law computer science sociology and all kinds of disciplines to understand cyber security and we do have a clinic where students can actually help nonprofits protect themselves in hostile situations we also have my clinic the samaritan clinic which one of the things that was so visionary about dear dromologon's work is as the first director of the clinic she had our law students doing privacy policy work from the very beginning in 2001 and 2002 and accordingly our students are able to get involved not just in research but in serving those cyber security clients in serving nonprofits and individuals to the legal clinic and really understanding how privacy operates in our world that's great so the rest of them really are about behavioral-based advertising tracking from everything from people seeking abortions to the january 6 insurrectionists so all around do you have could you just speak a little bit about that and should we you know just do your thoughts about all of the sure and i forgot the dark web by the way oh yeah so maybe maybe um that person can find me during lunch and i'll talk about i'll tell me talk about behavioral tracking and advertising so this is one of the things that the really really data-rich environments allow because you can now collect so much information about people but also about things like households and about behavior on the web you can build these really detailed profiles profiles that are even sometimes predictive and that's why the ccp protects profiles specifically so profiles might not actually be named however if you were to look at them you could immediately identify people and they're one of the things the profiles and their uses are one of the things that i think really have turned the tide in terms of the mythos sort of breaking down and people saying hang on just a minute we're not sure we're okay with that so an old example from oh gosh 2012 or something like that was the example that some of you may have read about of a father who found out his daughter was pregnant because target figured out she was pregnant because she bought like lotion i mean it wasn't even a pregnancy test but if you put enough pieces of information together you can make predictions and you can in the advertising universe hopefully target things that are really valuable to people it's really hard i think one of the things that created negative reaction to this is that without meaning to and without knowingly disclosing anything that might be deeply personal to you you can leak information in such a way that somebody you didn't intend is going to know something very personal about you and or make decisions about you and those decisions can be really fundamental so that's another thing i didn't mention about the ccpa which is that it actually also covers algorithmic decision making algorithmic decision making we've all been subject to it we're not basically aware of it it's just an algorithm you know for example um collecting a bunch of information about your income and your payment history and your neighborhood and spitting back out of mortgage rate for you i hope that example made it immediately obvious that algorithmic decision making has been shown over and over to be racist to be sexist to be inaccurate because it's based on training data that reflects the society that we live in and because it's not necessarily all that good sometimes it is sometimes it isn't but these behavioral profiles and this sort of using all this data to make a decision without the person themselves ever being involved um is what what um this archetypal work looks like and ray and some of the questions um that it raises for society that i think we need to consider very carefully i have a recent paper with margo konvinsky at colorado in which we argue for a right to contest algorithmic decisions for the person to be able to get back there in the loop um with the machines making the decisions and contest those decisions because often the person will be the one who knows more even though the algorithm has a beguiling um sort of uh look of authority um so for example there's um uh algorithm that was deciding benefits for home health care and it was cutting people's home health care just right and left and nobody knew why because you know no one knew what the algorithm was doing and it turns out it just whoever programmed it didn't think to include diabetes or cerebral palsy um in the algorithm for the algorithm to consider these are not uncommon conditions um and it was making mistakes and leaving people without their home health care so lots of decisions like that that are based on sort of de-identified in theory data that can have real ramifications um in the world thank you so much thank you thank you and you join me everyone thanks everyone so enjoy your lunches and our lovely musicians are back to serenades and uh we'll be back around dessert time to introduce the chancellor thank you so much enjoy your lunch thank you ah there we go thank you so much our fantastic musicians one more time so before i introduce the chancellor i just want to remind everyone if you have questions there are the note cards and pencils at your table so just write them down raise your hand and daemon and sam will be around to to gather this up so we can ask questions after so i'm sure the chancellor doesn't really need an introduction but i'm going to do it anyway so carol chris began her term as the 11th chancellor of the university of california berkeley on july 1st 2017 chancellor chris is a celebrated scholar victorian literature well known as an advocate for quality accessible higher education a proponent of the value of broad education and liberal arts and sciences and a champion of women's issues and diversity on college campuses it's my incredible privilege and honor to introduce chancellor carol chris thank you malony it is such a pleasure to see you all here today i think one of the things the pandemic has done is make us all so value occasions when we can be together like this and the setting is so beautiful beautiful day and thank you jennifer for sharing your insights in your important work and it's just a wonderful occasion today to celebrate our community and the members of the benjamin eyed wheeler society this is the 35th annual benjamin eyed wheeler society lecture and luncheon you and the people around you represent just a portion of the nearly 3 000 members of the benjamin eyed wheeler society we have wheeler members from the graduating class of 1934 all the way to 2018 so wheeler um wheeler society members from 26 years old all the way up to 108 years old the most popular degree among new is business administration closely followed by history and then political science and the largest concentration of wheeler members in a single graduating class is the class of 1966 and i have great pleasure in saying that because i'm class of 1966 although not from berkeley there are 53 members of the class of 1966 in the benjamin eyed wheeler society you're a very well educated group with about 650 about 650 of you have graduate degrees and over half of that group are double bears so congratulations i want to thank you all for supporting berkeley through a legacy gift i'm grateful that you've chosen to participate in the extraordinary tradition of giving that goes back to our very first planned gift a charitable trust from jane sather that was arranged more than a century ago by uc president wheeler in fact at my lunch table we were talking about president wheeler and his relationship to another great great benefactor of this campus phoebe apperson hurst your commitment is vital to our effort to build our endowment and ensure a strong and steady fiscal foundation for generations to come your support means a great deal particularly in these volatile times the good news is the your commitments and those of others across our community have led to a record breaking year for fundraising the fiscal year that just ended on june 30th we raised 1.2 billion dollars from over 63 000 donors our friends donors and partners such as you are changing the look and feel of the campus providing new housing new career paths new scholarships and athletic opportunities we're in the middle as i think most of you know of a six billion dollar campaign which doesn't end for another year and a half but we're already at 5.8 billion so thank you there are many many signs that our community of alumni cal parents and friends care deeply about berkeley on march 9th our eighth big give 14 732 individual donors which is a 15 increase over the year before raised 20 739 3038 which is a 70 percent increase in dollars 2700 of these donors made a donation for the first time and it's one of the main ways in which students and very young alumni often make their first gift often to student-sponsored organizations and initiatives so i'm so pleased to see over and over again that our community continues to come together to celebrate berkeley and to support it as a place of unparalleled opportunity our future is bright because we're building it together and because it's rooted in an extraordinary tradition the impacts of this ambitious philanthropic campaign will change the look and feel of the campus the lives of our students the broader berkeley community and ultimately the world as we continue to emerge from coven it brings me great pleasure to anticipate students coming back in the fall it's hard to believe but the fall semester is only a month away the freshman class the freshman coming to campus in the fall is the most competitively admitted in berkeley's history they were selected from 128 thousand applicants when they return they're going to find philanthropy really changing the face of the campus if any of you drive down oxford street you'll see a very big building going up on oxford and university that's anchor house that's going to be a new residence hall for transfer students and it's a philanthropic gift to the campus so such an amazing gift and it's a gift that gives twice because all the money that we will save by virtue of the fact that this is a gift and won't have any debt service will go into scholarships for our neediest students and then in the fall we're going to break ground on the building called the gateway that will be home to the first new college at berkeley in 50 years that's the college of computing data science and society and that's again a philanthropically funded building it'll go where the old tolman hall used to be tolman was demolished because of its lack of seismic safety and the gateway is going to be a real gateway an incredible landmark building for the campus so that's thrilling and there's so many other ways in which the campuses the lives of those in the campus community are enriched by gifts like yours for scholarships for basic needs for what we call discovery experiences which are independent creative and research projects this has been a hard two years but as a reflect on the challenges of our current moment i'm heartened to see the many ways we have worked together to problem solve and create together we're participating in the unfolding story that is berkeley through research education innovation public policy and public service we're facilitating vital change and all of you members of the benjamin eyed wheeler society are lighting the way toward that better world the possibilities we're co-creating are extraordinary your support enables our faculty and students to build strength to deepen their work and find new ways of engaging and leading i hope you're inspired by this event and by one another as i am by you and your commitment to berkeley thank you for being here fiat lux and go bears and now i'm happy to answer your questions so i have six questions and they're all the same question and i guess that this is going to be the question people were going to ask even before they asked it and you're probably guessing what it is too so in regards to ucla in the back 12 do the regions have any power to overrule that decision i have zero power to overrule that decision but i'm going to insist that ucla give back our fights long it's really i mean it was a startling decision certainly to me and to i think everyone who who you know found out read it in the newspaper just like our governor it has enormous consequences for what is now the pack 10 not the pack 12 and i i can't say very much about the pack 10's discussions because they're all confidential but i want to assure you that it's a big piece of every week meeting with the other presidents and chancellors of the pack 10 to try to figure out what our options are analyzing our options we want to keep cal sports and and cal football strong and trying to figure out the best best path to do that and we don't want our athletes traveling across half the country to play their games another question very very popular topic housing what is cal shortfall if there is one in student housing and what are the plans to try to close that gap in student housing and in particular uh if you had mentioned the development at people's park yes i would i wasn't sure when you said this is the question that's on everybody's mind whether it was going to be about people's park or it was going to be about the pack 12 i should have guessed the pack 12 but we are i made a commitment when i became chancellor to double um cal's housing capacity within 10 years and we are moving on anchor house that's about 775 beds we had a gift of an apartment building in emoryville that was constructed for the campus that's about 150 beds about 100 apartments and that's for graduate students we also are going to break ground very soon on a set of apartments in right next to university village in albany for graduate students that'll also be about 750 beds and yes indeed we will build on people's park it's complicated we're currently being restrained by an order that doesn't allow us to proceed with construction i'm sure you follow the news that there are some neighborhood groups that think cal should not not only should cal not grow anymore but that it's become too big already and the paradoxical way in which they um uh they act on that is to stop our housing projects which is not um and not very sensible but let me tell you about some of the things that have happened with people's park we had at the beginning of June about 60 campers in the park we committed this was a commitment with the city to rent a motel on university avenue it's the roadway in for 18 months and offer the people camping in people's park housing at the roadway in and people were very really skeptical they said the campers are not going to accept this housing indeed they did accept it and i don't know how many of you um drive past the park but the number of tents um is dramatically reduced and um it just suggests what should be self-evident which is the solution to homelessness is housing and um the plan for the park is for there to be a residence hall there it'll be again about it'll be about a thousand 100 um beds um and uh a park which is being designed by mccarthur winter water hood who's on our faculty and then permanent supportive housing for the homeless on about a quarter of the site and that'll be it's about 185 beds 125 apartments um so that's what the plan for the park is well thank you so much join me all in thanking chancellor thank you thank you all so much for joining us here today we are so excited that you came out and i hope you had as great a time as i did today and we want to just once again say how grateful you are to all be part of cal's legacy we couldn't do what we do here without you so feel free to stay as long as you like to mingle to enjoy those lovely desserts and to listen to our lovely musicians um but when you're ready the valet is when you're ready the valley will be here it's in a different place though so instead of where it picked you up you're gonna go out this way down the ramp or the stairs at the bottom there and then the valley will meet you there just make it easier and there'll be staff there too to help direct you along the way so stay enjoy yourselves thank you so much all and fiat luxe and go bears