Risks in Ai Over the Collection and Transmission of Data

• Jurisdiction: United States,Federal
• Publication year: 2018
• Citation: Vol. 1 No. 3

Paul Keller and Sue Ross^*

Technology is moving rapidly. Today's devices have the potential to make daily living more pleasant, more convenient, and significantly safer. But these devices also collect and transmit data, raising questions about what data is collected, what data is transmitted and to whom, and whether the online agreements that are currently used actually obtain user consent to this data sharing. In this article, the authors discuss data collection and transmission, disclosure, online consent, privacy notices, and the scope of consent.

Data, data everywhere, AI makes you think. Data, data everywhere, Do your consent agreements sync?

Autonomous vehicles, drones, home assistants, personal medical devices, smartphones, and smart homes are all becoming part of the local landscape. All of these devices have the potential to make daily living more pleasant, more convenient, and significantly safer. Each device also collects and transmits data, raising questions about what data is collected, what data is transmitted and to whom, and whether the online agreements that are currently used actually obtain user consent to this data sharing.

Data Collection and Transmission

Many readers are probably aware that their phones transmit information, such as the location of the phone as well as any numbers called or URLs of sites visited. Recent news reports describe some additional sharing that may not be as well known:

- One country's government is "building one of the world's most sophisticated, high-tech systems to keep watch over its citizens, including surveillance cameras, facial-recognition technology, and vast computer systems that comb through terabytes of data. Central to its efforts are the country's

[Page 161]

biggest technology companies, which are openly acting as the government's eyes and ears in cyberspace."¹

- Major technology companies are required to help a country's government "hunt down criminal suspects and silence political dissent. This technology is also being used to create cities wired for surveillance." There are plans for 100 such smart city trials in 2018.²

- An artificial intelligence company with ties to the government has assembled a database of 70,000 voice patterns, and there is reportedly a plan in that geographic area "to scan voice calls automatically for the voice-prints of wanted criminals, and alert the police if they are detected."³

- The Los Angeles Special Agent in Charge Intelligence Program reported that two smartphone apps that operate popular drones:

automatically tag GPS imagery and locations, register facial recognition data even when the system is off and access users' phone data . . . user identification, email addresses, full names, phone numbers, images, videos, computer credentials . . . proprietary and sensitive critical infrastructure data, such as detailed imagery of power control panels, security measures for critical infrastructure sites, or materials used in bridge construction. This information is automatically uploaded to computers to which a foreign government most likely has access.

That report concluded with "high confidence a foreign government with access to this information could easily coordinate physical or cyber attacks against critical sites."⁴

Disclosure to Users?

Whether the owners or users of those devices consent to the disclosures described above depends, of course, on the legal requirements.

In the United States there are a few state laws that require disclosure to consumers in the event of a website's, online service's, or app's disclosure of certain personal information. The oldest and probably best known of these laws is California's law,⁵which requires commercial websites or online services that collect

[Page 162]

personal information of California residents to have a privacy policy that discloses, among other things:

- Identify the categories of personally identifiable information collected and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.

- If the operator maintains a process for a consumer to review and request changes to any of his or her personally identifiable information that is collected, provide a description of that process.

- Describe the process by which the operator notifies consumers of material changes to the privacy policy.

- Disclose how the operator responds to web browser "do not track" signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer's online activities over time and across third-party websites or online services, if the operator engages in that collection.

- Disclose whether other parties may collect personally identifiable information about an individual consumer's online activities over time and across different websites when a consumer uses the operator's website or service.

Under federal law, the Stored Communications Act permits service providers to disclose the content of stored electronic communications (emails) without the account holder's consent in only three instances: (1) to the service provider, (2) to the individual account holder, and (3) to law enforcement as required under other provisions of the Wiretap Act and the Stored Communications Act.⁶The Stored Communications Act includes a private right of action for disclosure outside of these three exceptions.⁷

With respect to devices and the information described at the beginning of this article, the option most manufacturers and providers use is individual consent.

Validity of Online Consent

Online agreements typically fall into one of three types: (a) an affirmative agreement (user must click "I agree" or check a box or

[Page 163]

take some affirmative action—called a "clickwrap" or "scrollwrap" agreement); (b) a prominent link to the online terms while the user is taking affirmative action to sign up for a service (called a "sign-in wrap"); or (c) posted terms (called a "browsewrap" agreement). Caselaw is making it increasingly clear that a "browsewrap" agreement will be very difficult to enforce. In April 2015, a federal trial judge created a four-part test for validity and enforceability of internet agreements between a business and consumers:

1. Aside from clicking the equivalent of sign-in (e.g., login, buy-now, purchase, etc.), is there substantial evidence from the website that the user was aware that she was binding herself to more than an offer of services or goods in exchange for money? If not, the "terms of use," such as those dealing with venue and arbitration, should not be enforced against the purchaser.

2. Did the design and content of the website, including the homepage, make the "terms of use" (i.e., the contract details) readily and obviously available to the user? If not, the "terms of use," such as those dealing with venue and arbitration, should not be enforced against the purchaser.

3. Was the importance of the details of the contract obscured or minimized by the physical manifestation of assent expected of a consumer seeking to purchase or subscribe to a service or product? If yes, then the "terms of use," such as those dealing with venue and arbitration, should not be enforced against the purchaser.

4. Did the merchant clearly draw the consumer's attention to material terms that would alter what a reasonable consumer would understand to be her default rights when initiating an online consumer transaction from the consumer's state of residence: The right to (a) not

...