Watching You Systematic Federal Surveillance of Ordinary Americans by Charlotte Twight

No. 69 October 17, 2001

To combat terrorism, Attorney General John empower the federal government to obtain a Ashcroft has asked Congress to “enhance” the detailed portrait of any person: the checks he government’s ability to conduct domestic surveil- writes, the types of causes he supports, and what lance of citizens. The Justice Department’s leg- he says “privately” to his doctor. Despite wide- islative proposals would give federal law enforce- spread public concern about preserving privacy, ment agents new access to personal information these data collection systems have been enacted contained in business and school records. Before in the name of “reducing fraud” and “promot- acting on those legislative proposals, lawmakers ing efficiency” in various government programs. should pause to consider the extent to which the Having exposed most areas of American life lives of ordinary Americans already are moni- to ongoing government scrutiny and recording, tored by the federal government. Congress is now poised to expand and univer- Over the years, the federal government has salize federal tracking of citizen life. The instituted a variety of data collection programs inevitable consequence of such constant surveil- that compel the production, retention, and dis- lance, however, is metastasizing government semination of personal information about every control over society. If that happens, our gov- American citizen. Linked through an individ- ernment will have perverted its most fundamen- ual’s Social Security number, these labor, med- tal mission and destroyed the privacy and liber- ical, education and financial databases now ty that it was supposed to protect.

Charlotte Twight is a professor of economics at Boise State University, a lawyer, and the author of Dependent on D.C.: The Rise of Federal Control over the Lives of Ordinary Americans (Palgrave/St. Martin’s, January 2002), from which this is excerpted. The outgrowth of When a large part of the information information about the individual. If a con- all-encompassing about economic statistics or administra- temporary novelist were to portray the emer- tive arrangements is collected and issued gence of such a government in America, his federal collection by the government, investigators and novel undoubtedly would be regarded as of personal critics are forced to approach the very futuristic fiction, in the same vein as George officials they may criticise for the infor- Orwell’s 1984. information is mation that might give substance to Yet this national portrait is no longer fic- increased govern- their criticisms. tion. The foregoing description is of a gov- ment power and ernment that now wields exactly those omi- H. B. Acton (1971)1 nous powers over the citizenry: America’s concomitant federal government at the beginning of the individual twenty-first century. The logical outgrowth dependence on Dependency’s Forgotten of such all-encompassing federal collection Vector: Government- of personal information is increased govern- government. ment power and concomitant individual Compelled Information dependence on government. Altered political Imagine for a moment a nation whose transaction costs again have supplied the central government mandated ongoing col- means, with the information-collection lection of detailed personal information— authority described in this chapter emerging individually identified—recording each citi- both as a product and instrument of transac- zen’s employment, income, childhood and tion-cost manipulation. subsequent educational experiences, medical Governments long have recognized infor- history (including doctors’ subjective impres- mation collection’s capacity to erode individ- sions), financial transactions (including ual autonomy by fostering deep personal copies of personal checks written), ancestry, uncertainty about the uses to which the living conditions (including bathroom, information will be put. Law professor Paul kitchen, and bedroom facilities), rent or Schwartz described this linkage clearly: mortgage payments, household expenses, roommates and their characteristics, in- Personal information can be shared to home telephone service, automobile owner- develop a basis for trust, but the manda- ship, household heating and sewage systems, tory disclosure of personal information number of stillbirths, language capability— can have a destructive effect on human and periodically even demanded to know independence. . . . Totalitarian regimes what time each person in the household usu- have already demonstrated the fragility ally left home to go to work during the previ- of the human capacity for autonomy. ous week. Imagine further that such a gov- The effectiveness of these regimes in ren- ernment assigned every citizen a central gov- dering adults as helpless as children is in ernment identification number at birth and large part a product of the uncertainty mandated its use in reporting the informa- that they instill regarding their use of tion listed above. Suppose the same govern- personal information.2 ment were actively considering mandatory nationwide use of a “biometric identifier,” With respect to U.S. government data collec- such as fingerprints or retinal scans, along tion in the 1990s, he added: “Americans no with a new counterfeit-proof permanent gov- longer know how their personal information ernment identification card incorporating will be applied, who will gain access to it, and the individual’s government-issued number what decisions will be made with it. The and other personal information, encoded in resulting uncertainty increases pressure for magnetic strips and embedded computer conformity. Individuals whose personal data chips capable of holding up to 1,600 pages of are shared, processed and stored by a myste-

2 rious, incalculable bureaucracy will be more nationwide as mandated by the 1996 likely to act as the government wishes them Health Insurance Portability and to behave.” With extensive federal data col- Accountability Act (HIPAA); lection creating ever greater incentives to • Education databases—revealing federal behave as government wishes us to behave, databases mandated by Goals 2000 and the result is metastasizing government con- related 1994 education acts that estab- trol. Indeed, Schwartz viewed the computer’s lish detailed national records of chil- ability to digitize personal information as dren’s educational experiences and offering “the state and society a powerful way socioeconomic status; and to control the behavior of individuals.”3The • Financial databases—describing provi- result—and often the purpose—is a profound sions of federal statutory law requiring erosion of individual autonomy. banks and other financial institutions to This chapter focuses on existing central create permanent, readily retrievable government data-collection programs that records of each individual’s checks, share one defining characteristic: they com- deposits, and other financial activities. pel production, retention, and dissemination of personal information about every These databases, linked by individuals’ Social American citizen.4 Their target is ordinary Security numbers, now empower the federal There is always American citizens carrying out ordinary day government to obtain an astonishingly an asserted bene- to-day activities of life. Although these pro- detailed portrait of any person in America, fit to be obtained, grams by no means constitute the whole uni- including the checks he writes, the types of verse of federal data-collection activity, today causes he supports, and even what he says a plausible cover they are the government’s most critical infor- “privately” to his doctor. story. mational levers for institutionalizing govern- Of course, federal officials always provide ment control, individual dependence, and an appealing reason for such governmental unprecedented threats to cherished intrusion into our private lives, however American liberties. Even within this circum- inadequate the reason or unconstitutional scribed sphere, the immense volume of feder- the intrusion. As we have seen, they pre- al data collection defies brief summary. dictably use political transaction-cost manip- Accordingly, this chapter highlights the ulation in their effort to minimize resistance, development and recent expansion of increasing the transaction costs to private individuals of perceiving—and taking collec- • Databases keyed to Social Security numbers— tive action to resist—governmental encroach- examining unchecked use of Social ments. There is always an asserted benefit to Security numbers as a fulcrum for gov- be obtained, a plausible cover story. ernment data collection about individu- The ostensible reasons have been diverse. als, and probing current legislative We have been told that government-mandated efforts to establish a national identifica- use of Social Security numbers in electronic tion card; databases will help to “reduce fraud”—tax • Labor databases—analyzing statutory pro- fraud, welfare fraud, the usual litany. We have visions aimed at building a federal data- been told that requiring businesses to contact base of all American workers and requir- the government for approval before hiring ing employers to obtain the central gov- anyone will help in “cracking down on illegal ernment’s approval before hiring immigration.” We have been told that forcing employees; private physicians to record what we say to • Medical databases—assessing creation of a them in confidence will “reduce health care “unique health identifier” and imple- fraud,” promote “efficiency,” allow “better mentation of uniform electronic data- emergency treatment,” make it “easier for the bases of personal medical information patient” to keep track of his medical records,

3 and the like. We have been told that govern- from public view, buried in what writer Claire ment tracking of what public school teachers Wolfe called “land-mine legislation” that record concerning our children will assist in people don’t notice until they step on it.5In students’ selection of a “career major,” other cases Americans were encouraged to enhance assessment of school courses, and view new proposals piecemeal, a strategy that facilitate identification of students needing forestalled public perception of the conflu- help. We have been told that government ent streams of nationwide government-man- requirements that banks keep microfilm dated data centralization and their likely copies of all the checks we write will “reduce eventual result. Incrementalism again served white-collar crime” and “inhibit money laun- activist policymaking. Information-law dering.” Who could oppose such worthy goals scholar Simon Davies judged the public’s unless he has something to hide? “greater acceptance of privacy-invasive The immense powers now exercised by the schemes” in recent years to be in part a result federal government have made these ration- of “[p]roposals . . . being brought forward in ales inevitable. Having empowered the feder- a more careful and piecemeal fashion,” which al government to exert centralized control may be “lulling the public into a false sense of over far-flung human endeavors, most security.”6 Americans want government officials to Given that piecemeal progression, legisla- administer the programs effectively and tors and members of the popular press today responsibly. But doing so necessitates seldom discuss the likely cost of government “reducing fraud” and “promoting efficiency” data centralization in terms of lost liberty. in the programs, legitimate objectives that Perhaps “liberty” does not resonate so often become chameleonic rationales that strongly or create as powerful an image for ultimately are invoked in the service of ille- most people as “cracking down on illegal gitimate ends. The pattern is unmistakable: immigration” or “reducing health care with vast federal power comes vast federal fraud.” Liberty, after all, is an abstraction surveillance, providing plausible cover for whose concrete reality often is not appreciat- those seeking to further extend the central ed until its opposite is experienced firsthand. government’s purview. Yet we ignore at our peril the long-cited “use Political transaction-cost manipulation of personal information systems by Nazi has framed the issue in other ways besides Germany to enable the identification and these appealing rationales. Indeed, the back- location of a target race.”7Race-based gov- drop for this chapter’s discussion is the ubiq- ernment roundups of law-abiding citizens Legislators and uitous political transaction-cost manipula- also occurred in America less than sixty years tion, described in earlier chapters, that facili- ago, similarly facilitated by government data members of the tated passage of the statutes that originally collection. As Cato Institute policy analyst popular press authorized and gave rise to this data collec- Solveig Singleton and others have reported, today seldom dis- tion: the Social Security Act, the health care “In the U.S., census data were used to find legislation, the education statutes, and the Japanese-Americans and force them into cuss the likely like. That history will not be repeated here. camps,”8a historical reality that gives fresh cost of govern- Instead, this chapter provides additional meaning to a 1990 U.S. Census instruction examples of political transaction-cost manip- stating that “It is as important to get infor- ment data central- ulation specifically involving the data collec- mation about people and their houses as it is ization in terms tion aspects of those laws, focusing on their to count them.”9By 2002, however, events of of lost liberty. use to support the central government’s the 1940s have become only a “vague memo- accelerating quest for detailed personal data ry”—and, except for the elderly, not a living about each and every American citizen. memory at all.10 In some cases discussed below, the data- So today Congress proceeds apace. base maneuvers were deliberately obscured Having exposed most areas of our lives to

4 ongoing government scrutiny and recording, of permanent account numbers pertaining Our privacy, our Congress now is working to expand and uni- to individual persons,” the department or personal identity, versalize federal tracking of law-abiding citi- agency “shall . . . utilize exclusively the Social zens’ private lives. Concurrently, new devel- Security Act account numbers” assigned pur- our indepen- opments in biometry are producing tech- suant to that act.15 dence, and our nologies that most observers concede The full impact of Roosevelt’s order was “imperil individual autonomy” and pose not felt until computers became available. freedom hang in “real threats to the fabric of contemporary Gradual computerization made SSN-based the balance. society.”11The next generation awaits the full record systems increasingly appealing flowering of these technologies and their throughout the 1960s. In 1961 the Civil availability to governments. Our privacy, our Service Commission first ordered the use of personal identity, our independence, and our SSNs to identify all federal employees. The freedom hang in the balance. Internal Revenue Service (IRS) began using SSNs as taxpayer identification numbers in 1962. Department of Defense military per- Linking Personal Records: sonal records were identified by SSN begin- A “De Facto National ning in 1967; the SSN became the Medicare 12 identifier in the 1960s. Thereafter SSN use Identification Number” spread unabated: The Social Security number (SSN) has become a key to detailed government knowl- By the 1970s, the SSN floodgates had edge of our private lives. Even the secretary of opened fully. Congress in 1972 amend- the Department of Health and Human ed the Social Security Act to require the Services (HHS) has described American use of SSNs for identifying legally- Social Security numbers as a “de factoperson- admitted aliens and anyone applying al identifier.”13Kristin Davis, senior associate for federal benefits. In following years, editor of Kiplinger’sPersonal Finance Magazine, additional legislation required the SSN described “the growing use of social security for the identification of those eligible to numbers as an all-purpose ID” as the “single receive Medicaid, Aid to Families with biggest threat to protecting our financial Dependent Children (“AFDC”) bene- identities.”14 Since the Social Security pro- fits, food stamps, school lunch pro- gram’s inception in the 1930s, when officials gram benefits, and federal loans.16 slighted public fears that identification of citizens for Social Security purposes implied Moreover, the 1970 Bank Secrecy Act, dis- regimentation, that reality has relentlessly cussed later in this chapter, required all emerged. financial institutions to identify customers Federal officials long denied that SSNs by SSN and preserve detailed records of their would function as national identification customers’ personal checks and other finan- numbers. They were supposed to be mere cial transactions. “account numbers” denoting an individual’s The Privacy Act of 1974 did not stop the “old-age insurance account” in which his flood.17Although it purported to restrict fed- “contributions” were set aside in a federal eral dissemination of SSNs, it not only “trust fund” for his retirement. But expan- exempted existing federal SSN use that had sion of SSN use came quickly, much of it been previously authorized by statute or reg- ordered by the federal government. President ulation but also created a massive exemption Franklin Roosevelt began the process in 1943 allowing disclosure of personal information by ordering that thereafter, whenever the obtained by federal officials if the disclosure head of any federal department or agency involved a “routine use” of the data. Two found “it advisable to establish a new system years later, utterly countermanding any

5 notion of restricting SSN use and dissemina- assignment of SSNs at birth, the federal gov- tion, Congress included in the Tax Reform ernment has financed state “Enumeration at Act of 1976 a provision that gave states free Birth” programs to secure issuance of the rein to use SSNs. It stated: numbers as a routine part of birth certificate registration, a process that is now opera- It is the policy of the United States that tional in all fifty states. any State (or political subdivision there- A coordinated government effort now of) may, in the administration of any under way to require even greater use of SSNs tax, general public assistance, driver’s will further centralize federal monitoring of license, or motor vehicle registration all American citizens. Its elements include law within its jurisdiction, utilize the social security account numbers issued • federal mandates attempting to regulate by the Secretary for the purpose of state drivers’ licenses and birth certifi- establishing the identification of indi- cates; viduals affected by such law, and may • federal “work authorization” databases require any individual who is or appears covering all working Americans and to be so affected to furnish to such keyed to SSNs; For approximate- State (or political subdivision thereof) • federal development of a “unique health ly the first fifty or any agency thereof having adminis- identifier” for each American in imple- years of the Social trative responsibility for the law menting uniform electronic databases involved, the social security account of private medical histories; Security program, number . . . issued to him by the • federal implementation of education one did not Secretary.18 databases; and • federal development and issuance of acquire an SSN Incrementalist policies continued to new “tamper resistant” Social Security until beginning advance SSN use, as illustrated by the grad- cards, perhaps with biometric identi- one’s first job, ual introduction of requirements that Social fiers, viewed by many as precursor of the Security numbers be obtained for young chil- long-feared “national identity card.” usually around dren. For approximately the first fifty years of age sixteen. Today the Social Security program, one did not The education, medical history, and work every child must acquire an SSN until beginning one’s first authorization databases are discussed sepa- job, usually around age sixteen. Today every rately below. First I shall discuss the driver’s acquire an SSN at child must acquire an SSN at birth or short- license, birth certificate, and tamper-resistant birth or shortly ly thereafter. How did policymakers accom- Social Security card provisions. plish such a radical change? Much as one In 1997 an unprecedented federal asser- thereafter. conditions dogs: a bit at a time—and always tion of control over state-issued drivers’ with a reward attached. First, Congress licenses tested the limits of public tolerance required in 1986 that every child claimed as a for expanding federal control over tradition- dependent on federal tax forms have an SSN al state functions. Although this particular by age five. Then in 1988 they reduced it to statutory language was repealed two years age two. Then in 1990 they reduced it to age later, similar provisions linger, and the one. Finally, in 1996, they passed a global episode highlights both the direction of cur- requirement that an SSN must be presented rent congressional efforts and how the game for anyone of any age claimed as a dependent is being played. on any federal tax form. No SSN, no federal The provision was buried in an omnibus tax deduction.19In general, to obtain any fed- bill, the 749-page Omnibus Consolidated eral benefit today, tax-related or otherwise, Appropriations Act of 1997, which included one must present the Social Security num- the “Illegal Immigration Reform and bers of all parties affected.20 To facilitate Immigrant Responsibility Act of 1996” (the

6 “Immigration Reform Act”) that contained the valid.” Either way, the SSN was readily at relevant language.21The key provisions began hand—and easily cross-linked electronically to on page 716, sandwiched between a section any alternative identifier a state might adopt. entitled “Sense of Congress on Discriminatory Proposed federal DOT rules implementing Application of New Brunswick Provincial Sales these provisions were published in 1998.22 Tax” and another entitled “Border Patrol But section 656(b) was short lived. On Museum.” So well concealed, the provisions October 9, 1999, Congress passed a lengthy were difficult to spot even if you already knew appropriations bill covering appropriations they were there. for the DOT and related agencies. The forty- Section 656(b) of the Immigration second page of that legislation contained a Reform Act dealt with “State-Issued Drivers single sentence, with no heading or other Licenses and Comparable Identification explanation, that stated in its entirety: “Sec. Documents.” The language made compli- 355. Section 656(b) of division C of the ance with federal rules specifying characteris- Omnibus Consolidated Appropriations Act tics for these documents mandatory without of 1997 is repealed.”23 Section 656(b) thus actually saying so. It simply prohibited feder- perished through the same transaction-cost al agencies from accepting a state-issued dri- manipulating strategies that had enabled its ver’s license for identification purposes passage in 1997. Like other incrementally unless it satisfied federal requirements. installed federal controls, however, it will no Instead of telling the states “you must,” it doubt rise again. And, as shown in the next made it nearly impossible for state residents section’s discussion of the new-hire legisla- to interact with the federal government if the tion, a similar driver’s license measure state did not comply. This charade of volun- appeared elsewhere in the Immigration tariness was buttressed by hard cash—grants Reform Act. to states “to assist them in issuing driver’s The other prong of current federal efforts licenses and other comparable identification to control state-issued identification docu- documents that satisfy the requirements” ments entails regulation of the states’ issued by the federal government. issuance of birth certificates. Enacted into Compliance required the states to follow law as sec. 656(a) of the same 1996 federal Department of Transportation (DOT) Immigration Reform Act, it has not been regulations specifying both the form of the dri- repealed. The tactic was the same, requiring ver’s license and federally acceptable “evidence that federal agencies could not accept birth of identity” in issuing the license. Raising the certificates for official purposes unless the specter of biometric identifiers, it required birth certificate complied with federal regula- Federal agencies “security features” intended to “limit tamper- tions specifying “appropriate standards for ing, counterfeiting, photocopying, or otherwise birth certificates.”24 Bribes followed in the could not accept duplicating, the license or document for fraud- form of grants to states to help them issue birth certificates ulent purposes and to limit use of the license or birth certificates that “conform to the stan- for official pur- document by impostors.” In addition, the dards” in the federal regulation. Federal statute mandated that in general the driver’s grants also were authorized for states to help poses unless the license or other identification document had to them develop the “capability to match birth birth certificate include a social security account number “that and death records” and to finance related can be read visually or by electronic means.” demonstration projects. An explicit objective complied with States could avoid including the SSN on the was to “note the fact of death on the birth federal regula- license only by requiring “every applicant for a certificates of deceased persons.” However tions. driver’s license . . . to submit the applicant’s fleeting, the sole federal concession was to social security account number” and “not require a single design” for birth certifi- “verify[ing] with the Social Security cates in all states and to allow state differ- Administration that such account number is ences in the “manner and form” of storing

7 Data mergers and birth records and producing birth certifi- transactions were exchanges of personal exchanges are not cates. The substance was another matter. information about all of us between Perhaps the most ominous of Congress’s aberrations, and innocuously titled “Improvements in • The IRS and the Social Security they are not limit- Identification-Related Documents” required Administration (SSA); development of “prototypes” of a “counterfeit- • The SSA and the Health Care Financing ed to information resistant Social Security card.”25 Congress Administration; about suspected specifically mandated that the prototype card • The Postal Service and the Department criminals: they “shall employ technologies that provide securi- of Labor; ty features, such as magnetic stripes, holo- • The Justice Department and the are a systematic grams, and integrated circuits.” Integrated cir- Department of Veterans Affairs; policy tool of cuits? Integrated circuits open the door to bio- • The IRS and state social services agen- today’s federal metric identifiers and the storage of vast cies; amounts of personal data on each person’s gov- • The Department of Education and government. ernment-required Social Security card, a theme HHS; and that recurred in government discussions of the • The SSA and the state courts.30 “unique health identifier” for medical records.26 And they are not just aiming these changes at These data mergers and exchanges are not new people entering the Social Security system. aberrations, and they are not limited to infor- The statute required the Social Security com- mation about suspected criminals: they are a missioner and the comptroller general to study systematic policy tool of today’s federal gov- the “cost and work load implications of issuing ernment, extending far beyond the agencies a counterfeit-resistant social security card for all covered by the Computer Matching and individuals over a 3, 5, and 10 year period.”27 Privacy Protection Act.31 These new cards “shall be developed so as to Consider exchanges involving the Social provide individuals with reliable proof of citi- Security Administration (SSA). Its own regu- zenship or legal alien status.” Proof of citizen- lations state that SSA officials “disclose ship? Federal officials have claimed that such a information when a law specifically requires document is not a “national identification it,” including: card” because—note well—we will not be required to carry it around with us at all times.28 disclosures to the SSA Office of Not yet, anyway. Inspector General, the Federal Parent Despite all such protestations, the SSN is Locator Service, and to States pursuant now at the heart of a vast array of govern- to an arrangement regarding use of the ment databases, and linkage of those sepa- Blood Donor Locator Service. Also, rate databases occurs regularly despite peri- there are other laws which require that odic statutory lip service to individual priva- we furnish other agencies information cy. It is all perfectly legal under the 1988 which they need for their programs. Computer Matching and Privacy Protection These agencies include the Department Act discussed later in this chapter. of Veterans Affairs . . . , the Immigration Privacilla.org reported in March 2001 that and Naturalization Service . . . , the agencies covered by the act listed forty-seven Railroad Retirement Board . . . , and to such exchanges “from September 1999 to Federal, State, and local agencies February 2001” alone, meaning that a “feder- administering Aid to Families with al government agency quietly announce[d] a Dependent Children, Medicaid, unem- new plan to exchange and merge databases of ployment compensation, food stamps, personal information about American citi- and other programs.32 zens” more frequently than “once every other week.”29 Among the listed data-sharing And, of course, the IRS. “Information” is

8 defined to mean “information about an indi- DEX [Beneficiary Data System] and vidual” which “includes, but is not limited SDX [Medicare eligibility and to”: Supplemental Security Income pay- ment] data systems. From the Internal vital statistics; race, sex, or other physical Revenue Service, AFDC receives data characteristics; earnings information; relating to the tax interception and par- professional fees paid to an individual ent locator programs. Within state gov- and other financial information; benefit ernment, AFDC receives information data or other claims information; the from the Employment Security Division social security number, employer identi- (worker’s compensation and employ- fication number, or other individual ment) and the Child Support identifier; address; phone number; med- Enforcement Unit (child support pay- ical information, including psychologi- ments). AFDC offices also receive infor- cal or psychiatric information or lay mation about unemployment payments information used in a medical determi- from other states.34 nation; and information about marital and family relationships and other per- Over time the program’s broad reach pre- sonal relationships.33 dictably has spawned increasingly intrusive TANF’s broad data collection and data sharing in the name reach predictably Even without the SSA’s much reviled on-line of curtailing welfare fraud. has spawned dissemination in 1997 of the agency’s data- A similar pattern is evident in the federal base of “Personal Earnings and Benefit Child Support Enforcement program. As increasingly Estimate Statement” information on Schwartz has recounted, after the program’s intrusive data Americans, making the data electronically creation in 1974, parent locator services in accessible via the Internet to third parties every state were granted access to ever more collection and without the subject individual’s knowledge government databases of personal informa- data sharing in or consent, the SSA’s broad regulatory power tion. Their use of the SSN passkey was the name of cur- to transmit personal information to other authorized in 1976, when “Congress explicit- government agencies seriously compromises ly authorized the use of social security num- tailing welfare individual privacy. bers in searches of federal and state data fraud. Concrete examples of the data linkages banks for information leading to the loca- across government agencies are provided by tion of these delinquent parents of AFDC the Aid to Families with Dependent Children families.”35Thereafter Congress gave the par- (AFDC) program—now called Temporary ent locator services access to IRS records and Assistance to Needy Families (TANF)—and extended the data matching program to all the Child Support Enforcement (CSE) pro- families, making even non-AFDC families gram. In describing the effects of computeri- subject to “data matching and tax intercep- zation of federal records, law professor Paul tion with the IRS.” Schwartz quoted a state Schwartz stated that “AFDC has progressed director of CSE as saying, “Some people from midnight searches of the welfare bene- would say that’s Big Brotherism. Well, it is.”36 ficiary’s home to continuous searches of the Every child support enforcement unit beneficiary’s personal data.” Explaining “the (CSEU) has access to all the AFDC data listed enormous amount of information to which above as well as to the Federal Parent Locator AFDC offices have access” and the “extensive database. That database in turn contains data bases that are manipulated in adminis- information from “the Social Security tering the AFDC program,” Schwartz added: Administration; the Department of Defense; the Veterans Administration; the Motor From the Social Security Administra- Vehicle Bureau of the state in which the tion, AFDC receives access to the BEN- CSEU is located; the IRS, including 1099

9 forms; and commercial credit bureaus. The current, continually updated, detailed elec- parent locator also allows searches of state tronic data about where and for whom each data bases, three states at a time.”37 individual in America is working. To over- Pervasive government extraction of per- come resistance to such federal surveillance, sonal data that are stored and linked via com- Congress has used several rationales. pulsory use of SSNs is today’s reality. As Recurrent excuses for increasing federal sur- more and more Americans worry about the veillance of every working American are damage that Social Security numbers have inflicted on our privacy, the federal govern- • controlling illegal immigration; ment responded with the Social Security • locating absent parents who owe child Number Confidentiality Act of 2000. A reas- support payments; suring title, indeed. But the substance of that • preventing welfare fraud; and statute only demonstrated the flagrant disre- • supporting workforce investment. gard for American citizens’ privacy that has characterized federal officials’ actions for These purported rationales have become ritual decades. The new statute’s sole purpose was incantations; once they are uttered, Congress to instruct the secretary of the treasury expects a mesmerized citizenry to grant what- henceforth to “ensure that Social Security ever liberty-curtailing federal powers Congress account numbers (including derivatives of demands. So far the strategy has worked. such numbers) are not visible on or through During the 1990s federal authority to col- unopened mailings of checks or other drafts” lect labor-related data skyrocketed. The feder- issued by the federal government!38 al government’s desires were particularly evi- Incrementalism, misrepresentation, hid- dent in a 1992 amendment to the Job Training ing threatening measures in larger bills, and Partnership Act that ordered the commission- other forms of transaction-cost manipula- er of labor statistics, cooperating with state tion have spawned a system of linked federal governments, to “determine appropriate pro- databases that now make it virtually impossi- cedures for establishing a nationwide database ble for a person to opt out of, let alone active- containing information on the quarterly earn- ly resist, the federal government’s monitor- ings, establishment and industry affiliation, ing of ordinary, law-abiding American citi- and geographic location of employment, for zens. As we move toward the equivalent of a all individuals for whom such information is national identity card tied to the ubiquitous collected by the States,” including “appropri- SSN, the threat to privacy is clear. Although ate procedures for maintaining such informa- As we move it will not be labeled a national identity card, tion in a longitudinal manner.”40 Stephen Moore of the Cato Institute correct- Four years later, further statutory changes toward the equiv- ly stated in his testimony on a related bill supported these ends. The first was part of the alent of a nation- that if it “looks like a duck, . . . quacks like a Personal Responsibility and Work Opportunity 39 al identity card duck, . . . walks like a duck . . . [i]t’s a duck.” Reconciliation Act of 1996, the 1996 welfare reform act.41For the stated purposes of pre- tied to the ubiqui- venting welfare fraud and enforcing child sup- tous SSN, the Tracking (and Preventing) port obligations, the law established “Directory threat to privacy Your Employment: of New Hires” electronic databases at both the “Illegal Aliens” and Other state and the national level, simultaneously is clear. authorizing pervasive new data sharing among Excuses federal and state agencies. Despite the law’s wel- fare motif, neither the state nor national direc- A key aspect of the federal government’s tories are limited in any way to individuals ongoing effort to establish the equivalent of receiving public assistance or paying or receiv- a national identity card is its quest to obtain ing child support. Instead, these new databases

10 cover every working individual in America who sharing with other state and federal agencies enters the workforce or changes jobs.42 and with “information comparison services” Journalist Robert Pear has called it “one of the is mandated. Access to the new hires data- largest, most up-to-date files of personal infor- base is granted to the secretary of the trea- mation kept by the government” whose size sury (IRS), and the SSA is to receive “all infor- and scope “have raised concerns about the mation” in the national directory. The potential for intrusions on privacy.”43 statute instructs the secretary of HHS and The 1996 law specifies that each state the secretary of labor to “work jointly” to must establish a State Directory of New find “efficient methods of accessing the Hires that “shall contain information sup- information” in the state and federal directo- plied . . . by employers on each newly hired ries of new hires.47 employee.” Each employer is mandated to Other major changes in 1996 came via the turn over to state officials “a report that con- Illegal Immigration Reform and Immigrant tains the name, address, and social security Responsibility Act of 1996. Although its number of the employee, and the name and most ominous provisions were cast as pilot address of, and identifying number assigned programs, their scope and structure clearly under . . . the Internal Revenue Code [to] the indicated the direction of things to come. employer.”44 State officials then must give Using the rationale of controlling illegal Although the this information, along with wage and immigration, this 1996 statute established most ominous unemployment data on individuals, to the pilot programs requiring employers to seek provisions of the federal government for inclusion in its the central government’s certification of a National Directory of New Hires. As Forbes person’s “work authorization” before finaliz- Illegal writer Brigid McMenamin stated, “The new- ing an offer of employment. The manner in Immigration hire legislation is one of dozens of federal which the federal government’s approval and state laws that force U.S. employers to must be sought substantially overlaps the Reform and moonlight as unpaid police, nannies and tax pressure for SSN-based national identifica- Immigrant collectors.”45 Within each state, the State tion cards and enhanced SSN-based state dri- Responsibility Directory of New Hires must be matched vers’ licenses discussed earlier. against a mandatory “state case registry” con- Congress created three “pilot programs Act of 1996 were taining “standardized data elements for both for employment eligibility confirmation”: cast as pilot pro- parents (such as names, social security num- the “basic” pilot program, the “citizen attes- grams, their bers and other uniform identification num- tation” pilot program, and the “machine- bers, dates of birth, and case identification readable-document” pilot program. scope and struc- numbers), and . . . such other information . . . Underlying all three was Congress’s mandate ture clearly indi- as the Secretary may require.”46 that the U.S. attorney general establish a SSNs provide the key link between the pilot “employment eligibility confirmation cated the direc- electronic databases. State agencies are system,” keyed to information provided by tion of things to required to “conduct automated compar- the SSA and the Immigration and come. isons of the social security numbers reported Naturalization Service (INS). The idea is to by employers . . . and the social security num- create a federal database capable of confirm- bers appearing in the records of the State case ing any individual’s SSN and his INS-decreed registry” to allow state agencies to enforce work eligibility before an employer finalizes child-support obligations by mandatory the hiring of that person. Prior to passage of wage withholding. States also are ordered to the pilot program law, John J. Miller, vice require SSNs of applicants for any “profes- president of the Center for Equal sional license, commercial driver’s license, Opportunity, and Stephen Moore of the occupational license, or marriage license” Cato Institute described such proposals as and to include SSNs on certain court orders follows: “In other words, the government and on death certificates. Broad information would, for the first time in history, require

11 employers to submit all of their hiring deci- federally desired format and application sions for approval to a federal bureaucrat.”48 process for state drivers’ licenses, then partic- Although individual firms’ election to partic- ipating firms can avoid mandatory use of the ipate was voluntary, the reward for partici- federal work eligibility confirmation system pating was protection from both criminal by inspecting the job applicant’s state driver’s and civil liability for “any action taken in license. good faith reliance on information provided The machine-readable-document pilot through the confirmation system.”49 program came even closer to a national iden- The three pilot programs show that a tity card approach. For firms to participate in national identification card system is coming it, their state must have adopted a driver’s ever closer. The “basic” program instituted a license format that includes a “machine- system of federal government confirmation readable social security account number.” of work eligibility. When hiring, recruiting, Participating firms then “must make an or referring any individual, participating inquiry through the confirmation system by firms must obtain the potential employee’s using a machine-readable feature of such SSN, or INS identification number for aliens, document” to obtain confirmation from the and require presentation of specified identi- federal government of the work eligibility of fication documents. The firms then must use new employees.54 The potential for future the government’s “confirmation system” to linkage of such procedures to the new skill get federal approval for the hiring decision. certificate programs called for by the 1994 The statute required that, within three work- School-to-Work Opportunities Act is all too ing days after hiring a person, the employer evident. “shall make an inquiry . . . using the confir- After establishing the infrastructure for a mation system to seek confirmation of the national identification card, the 1996 identity and employment eligibility of any Immigration Reform Act, like other recent indiviual.”51If the firm continues to employ statutes, included a provision headed “No the individual after a “final nonconfirma- National Identification Card,” which pro- tion” of work eligibility through the federal claimed that “[n]othing in this subtitle shall electronic database system, penalties of be construed to authorize, directly or indi- $2,000 to $10,000 per unauthorized hire may rectly, the issuance or use of national identi- be imposed.52 fication cards or the establishment of a With the citizen attestation pilot pro- national identification card.”55 Such provi- gram, linkages with other parts of the coor- sions, appearing ever more frequently in fed- Firms must use dinated federal data expansion effort became eral legislation, merely highlight the clear apparent. While extending the approach of and present danger of exactly the type of sys- the government’s the “basic” pilot program, the idea here is to tem disavowed. Given this brazen political “confirmation waive the requirement for work eligibility transaction-cost manipulation, we should system” to get confirmation in certain circumstances if the take the advice of the newspaper comic strip job applicant claims to be a U.S. citizen—but character Cathy, who, after hearing her federal approval only if the state in which a participating firm mother repeatedly state that she did not for hiring is located has adjusted its drivers’ licensesto want any popcorn, delighted her mother by include “security” features such as those buying her a box of popcorn. Cathy decisions. described in the previous section. The statu- explained to her astonished boyfriend that in tory language is almost identical to that of her family it was important to “pay attention the repealed sec. 656(b), requiring each state to the nouns,” not the verbs and adverbs.56 As driver’s license to contain both a photograph Congress repeatedly insists that it has no and “security features” that render it “resis- interest in national identification cards, we tant to counterfeiting, tampering, and fraud- would be well advised to start paying atten- ulent use.”53If a state has complied with the tion to the nouns.

12 A bill introduced in 1997, H.R. 231, tem” intended to “enumerate, estimate, and With laws now reflected the continuing congressional pres- project employment opportunities and con- on the books, we sure to move the nation closer to a national ditions at national, State, and local levels in a identification card system. Like the pilot pro- timely manner.” Designed to include infor- do have a nation- gram legislation, H.R. 231 prominently dis- mation on all of us and our employment, this al ID-card sys- played a provision entitled “Not A National system is to document the “employment and Identification Card.” Further embracing the unemployment status of national, State, and tem; the real spirit of political transaction-cost manipula- local populations” and incorporate “employ- question is how tion, H.R. 231 was appealingly labeled as a ment and earnings information maintained much additional bill “To improve the integrity of the Social in a longitudinal manner.” Despite require- Security card and to provide for criminal ments for the data’s “wide dissemination,” personal infor- penalties for fraud and related activity involv- the statute reassured us that this vast array of mation we will 58 ing work authorization documents for pur- information would remain “confidential.” pour into it. poses of the Immigration and Nationality Behind nomenclature that continues to con- Act.” Testifying before Congress on this bill, ceal more than it reveals to ordinary Americans, Stephen Moore described it as a dangerous government pressure thus persists for an ever extension of pilot work-authorization pro- increasing repository of personal information to grams that had already created “an insidious fatten and consolidate national employment national computer registry system with the databases and identification systems. It is hard to federal government centralizing work autho- disagree with McMenamin’s judgment that rization data on every one of the 120 million “[t]he endgame is a single system rigged to keep Americans in the workforce.” Moore told the track of everything about each employee, from House Judiciary Committee’s Subcommittee résumé through pension plan, and to calculate on Immigration and Claims: every item to the last penny, and spit out all of the required reports on schedule.”59The Workforce The centralized computer registry sys- Investment Act and the federal pilot work-autho- tem is dangerous enough. But to add to rization program were steps in that direction, that a photo i.d. card issued to every cit- steps likely to be validated regardless of their actu- izen that matches up with the comput- al effects. As Moore remarked regarding the work- er data base is to put in place the entire authorization program, “It is almost a certainty infrastructure of a national i.d. card sys- that no matter how big a failure this new system tem. All that is missing is the nomen- proves to be, within ten years the registry will be clature. As someone once put it: this is applied to all workers in the nation.”60Talismanic about as ill-fated as giving a teenager a objectives such as controlling illegal immigration, bottle [of] booze and keys to a motorcy- enforcing child support obligations, and sup- cle, but getting him to promise that he porting workforce investment continue to pro- won’t drink and drive. You’re just ask- vide fertile ground for rationalizing increased ing for trouble.57 government surveillance of the employment and whereabouts of every person in America. We have already asked for trouble. With laws now on the books, we do have a national ID-card sys- tem; the real question is how much additional Tracking Your Personal personal information we will pour into it. Medical History: Vastly more was poured into it in 1998. The Workforce Investment Act (discussed in The “Unique Health Chapter 5) specifically authorized the secre- Identifier” tary of labor to “oversee the development, maintenance, and continuous improvement Further jeopardizing our privacy and indi- of a nationwide employment statistics sys- vidual autonomy is the 1996 federal mandate

13 (discussed in Chapter 6) for a unique nation- will allow “[a]nyone who knows your special wide health identifier for each individual to health-care number” to be “privy to some of be used in standardized electronic databases your most closely guarded secrets.”62 of personal medical information. Federal Despite such outcries, even today neither officials are quick to point out that they are the public nor the media have fully awakened not planning a single national database of to the scope of HIPAA. When the New York such information. But what they do intend is Timeson July 20, 1998, ran a front-page story to create the functional equivalent of such a entitled “Health Identifier For All Americans database. Once the formats are standardized Runs Into Hurdles,” the nearly two-year-old and identifiers specified, they plan to link fact that such a unique health identifier was and merge the databases virtually at will so as mandated by statutory law was described to accomplish whatever degree of centraliza- elsewhere in the media as breaking news. tion of personal medical information the Depicting the Clinton administration as government desires. Indeed, a federal report “quietly laying plans to assign every entitled “Toward a National Health American a ‘unique health identifier,’” the Information Infrastructure” so stated, not- Timesdescribed the identifier as a “computer ing that “[c]urrently, health information is code that could be used to create a national Federal officials stored in many locations,” but the “NHII database that would track every citizen’s plan to link and [National Health Information Infrastruc- medical history from cradle to grave.” merge the data- ture] seeks to connect that information Meanwhile the federal bureaucracy pro- where links are appropriate, authorized by ceeded systematically to carry out its statuto- bases virtually at law and patient permissions, and protected ry duty to select a health identifier. Yet even will so as to by security policies and mechanisms.”61 As as HHS was developing a “White Paper” sug- we saw in Chapter 6, the central government gesting alternative ways of implementing the accomplish what- used similar language in HIPAA privacy regu- identifier, the administration tried to soothe ever degree of lations that actually reduced privacy—autho- the public by falsely asserting a personal centralization of rizing broad access to medical records by gov- “confidentiality right,” a “‘right to communi- ernment agencies without patient consent cate with health care providers in confidence personal medical and permitting consent to be coercively and to have the confidentiality of the indi- information the obtained. Make no mistake about it: despite vidually identifiable health care information government the comforting tone of the bureaucratic lan- protected,’” as proclaimed in November 1997 guage, under the HIPAA-spawned regula- by the President’s Quality Commission. Of desires. tions it is the federal government that hence- course, no one knowledgeable of HIPAA’s forth will determine what medical data electronic database and health identifier pro- exchanges are considered “appropriate,” visions had objective grounds for believing what exchanges are “authorized by law,” such rights to be secure under existing statu- what constitutes patient “consent,” and what tory law. Indeed, HHS itself stated in 1998 “security” policies will be deemed sufficient. that the President’s Quality Commission and People familiar with HIPAA’s encroach- the HHS secretary already had “recognized ments find few words strong enough to that we must take care not to draw the impart the magnitude of the threat to per- boundaries of the health care system and per- sonal privacy involved. Forbeseditor-in-chief missible uses of the unique identifier too nar- Steve Forbes described it as a “breathtaking rowly.”64 Given the predilections of federal assault on the sanctity of your medical officials and the proposals at hand, the prob- records”; Newsweek’s writers described the lem is quite the opposite. “big, ugly fact” that under HIPAA “every On July 2, 1998, HHS released its lengthy detail of your medical profile may well land White Paper entitled “Unique Health in this new system without your consent,” Identifier for Individuals.” In this chilling explaining that the new national databank document HHS calmly discussed exactly

14 what Orwellian form the “unique health fiers, HHS listed as a positive aspect of the identifier” would take and what degree of unenhanced SSN that it “is the current de encroachment on individual privacy would facto identifier” and that people “are accus- be compelled. Along with other proposals, tomed to using their SSN as an identifier” HHS considered the following alternatives, and “would not be required to adjust to suggested by the American National change.” One alternative proposal would add Standards Institute (ANSI), as “candidate to the SSN a “check digit” for fraud control. identifiers”: Another would “use the SSN as the health identifier for those individuals to whom it is • Social Security number (SSN), including acceptable, but offer an alternative identifier the proposal of the Computer-based to others.” From a political transaction-cost Personal Record Institute (CPRI); manipulation perspective that proposal • Biometric identifiers; holds appeal, for it would give the appear- • Directory service; ance of individual control without the reality. • Personal immutable properties; (Does anyone think that there wouldn’t be a • Patient identification system based on data table linking the SSN and the “alterna- existing medical record number and tive” identifier?) Amazingly, listed among practitioner prefix; potential negative aspects of this proposal • Public key-private key cryptography was the fact that a “potential stigma could be method; and a sample attached to the alternate identifier” since “a • Universal Healthcare Identifier (UHID) request for the identifier might be interpret- developed by the American Society for ed to mean that the individual has some- Testing and Materials (ASTM). thing to hide”! HHS also was troubled by this proposal because of the department’s In evaluating these and other proposals, HHS “anticipat[ion] that, given the choice, signifi- grouped them into four categories: those cant numbers of individuals would request based on the SSN, those not based on the the alternate identifier.” SSN, those that don’t require a “universal, Equally stunning were proposals to unique identifier,” and hybrid proposals. require biometric identifiers as the unique Despite the range of alternatives, HHS noted health identifier. The HHS White Paper that “Many of the proposals involve either the described biometric identifiers as “based on SSN, SSA’s enumeration process [including its unique physical attributes, including finger- “Enumeration at Birth” process], or both.” prints, retinal pattern analysis, iris scan, voice The federal drive to link birth and death pattern identification, and DNA analysis.” No mention was records with SSNs seen elsewhere also Listed negative aspects of this alternative recurred here, in this case augmented by link- were chiefly mechanical obstacles—the fact made of loss of age to the health identifier. Noting that all that there is now “no infrastructure” to sup- liberty or threat SSN-dependent proposals would “benefit port such identifiers, that the necessary “spe- of a police state, from further improvements in the process cial equipment” would “add to the cost” of for issuing and maintaining both SSNs and this alternative, and the like.67 Cost and unless that was birth certificates,” the HHS document sug- equipment issues thus were set against the what was meant gested that an “improved process could benefit of “uniqueness” that this alternative begin with a newborn patient in the birth would provide. Only the fact that biometric by “linkages that hospital” where “at once the proper authori- identifiers are already used in law enforce- would be ties would assign a birth certificate number, ment and judicial proceedings prompted punitive.” assign an SSN, and assign the health identifi- HHS to state that their usage in health care er.”65 That goal echoes throughout today’s might make it “difficult to prevent linkages multifaceted federal data-collection efforts. that would be punitive or would compromise In considering SSN-based health identi- patient privacy.” No mention was made of

15 Doesn’t anyone loss of liberty or threat of a police state, verification process, but other unauthorized wonder why the unless that was what was meant by “linkages users would be prohibited from linking the that would be punitive.” two numbers.” In conjunction with the central govern- In addition to biometric identifiers, UHID/SSA proposal, HHS praised the SSA ment would like another proposal in the group not based on as an “experienced public program with a SSNs was a “civil registration system.” Such a national identification system that includes to keep track of system would “use records established in the most U.S. citizens and with the infrastruc- information current system of civil registration as the ture necessary to issue and maintain the about our library basis to assign a unique, unchanging 16-posi- health care identifier.” HHS stated that tion randomly-generated (in base 10 or base selecting the SSA “as the responsible author- cards and mem- 16) identifier for each individual.” This iden- ity for assigning the health care identifier bership in civil tifier “would link the lifetime records of an builds on the present infrastructure for issu- organizations? individual’s human services and medical ing SSNs” and would allow us to “restrict the records” and “track these and other encoun- identifier to health care uses that can be pro- ters with the civil system,” including “state tected with legislation or regulation.”69 birth files,” visas, “SSA records and military There was more, including some less intrusive identification,” and “library card and mem- measures, but these excerpts convey the spirit of bership in civil organizations, etc.”68Doesn’t this shocking document. In late July 1998, after the anyone wonder why the central government New York Timesstory publicized the issue, executive would like to keep track of information branch officials took steps to distance themselves about our library cards and membership in from the unique health identifier. It was a remark- civil organizations? HHS noted that able display, given that the statutory provisions— although such a system “meets the require- including the lack of privacy restrictions—were ment of HIPAA for a standard, unique health Clinton administration creations. Nonetheless, on identifier for each individual,” it “would be July 31 Vice President Al Gore ceremoniously pro- likely to raise very strong privacy objections.” claimed a new White House commitment to a Evidently, from HHS’s perspective, the pub- multifaceted “Electronic Bill of Rights,” which lic’s “strong privacy objections” are the only included, among many other things, restrictions barrier to police state methods. on dissemination of people’s medical records. A hybrid proposal that elicited strong Bowing to public pressure, the vice president said HHS support was called “Universal that the administration would not proceed with Healthcare Identifier/Social Security Admin- the unique health identifier until Congress passed istration” (UHID/SSA). The UHID is an appropriate privacy legislation.70 identifier up to 29 characters long, including Soon thereafter, in fall 1998, Congress a 16-digit sequential number, some check specifically prohibited HHS from spending digits, and an “encryption scheme identifier.” money on developing a unique health identifi- HHS noted that the UHID/SSA proposal, by er for individuals, initiating a moratorium selecting the SSA as a “trusted authority” to that has been renewed annually. Nevertheless, maintain the system, “echoes the call for HIPAA’s statutory mandate was not repealed. improvements to the birth certificate process The relevant language remains unequivocal, to ensure reliable issuance of SSNs and stating that the “Secretary shall adopt stan- UHIDs at birth.” The SSA would issue the dards providing for a standard unique health UHID with each new SSN, and those with- identifier for each individual . . . for use in the out SSNs “would be issued UHIDs as they health care system” and “shall adopt security generate their first encounter with the health standards” and standards to enable electronic system.” Although the UHID would not exchange of health information.71 appear on the Social Security card, the “SSA With a final HHS medical privacy rule would maintain the database linking the now in place, Congress is well positioned to SSN with the health identifier for its internal permit a unique health identifier standard to

16 be promulgated. After all, few have noticed ment power. Dr. Richard Sobel of Harvard that the much ballyhooed “privacy” rule Law School understood this clearly. actually reduces our privacy, permitting Assessing the impact of the new national widespread dissemination of our personal database and unique health identifiers, he medical records without our consent (as stated: “What ID numbers do is centralize described in Chapter 6). The dominant mes- power, and in a time when knowledge is sage issuing from government officials and power, then centralized information is cen- the popular press has been: relax; we have a tralized power. I think people have a gut privacy rule; no more need to worry! In this sense that this is not a good idea.”73Whether political context, politicians who support the that “gut sense” will find effective political federal powers granted by HIPAA possess the voice is the troublesome question. perfect transaction-cost-manipulating ratio- nale for proceeding with the unique identi- fiers, no matter what the eventual conse- Tracking Your Child’s quences regarding our medical privacy. Education: The “National One thing is clear: unless the relevant Center for Education HIPAA provision is repealed, sooner or later the new health identifiers will become a real- Statistics” If centralized ity. Under HIPAA, it is the law. Moreover, If centralized information is centralized information is even if HIPAA’s unique health identifier pro- power, the information now being collected centralized vision were repealed, our omnipresent Social about children’s educational performance is Security numbers would serve the same func- especially disturbing. Today federal data col- power, the infor- tion. In light of the 1998 HHS White Paper, lection, its scope expanded by the 1994 edu- mation now the real question is how intrusive the identi- cation acts, permeates our educational sys- fiers will be. Other key rules, including the tem. As with medical and employment infor- being collected HHS “Standards for Electronic mation, here too individually identified about children’s Transactions” discussed in Chapter 6, already information is being centralized in cross- educational per- have been promulgated to implement the linked electronic databases nationwide, and uniform electronic databases of personal we are again being asked to trust that it will formance is espe- medical information and widespread data not be misused. cially disturbing. exchanges envisioned by HIPAA. The data- Recent experience in Fairfax County, bases are under construction. Virginia, suggests what such legislation has Once this medical information is assem- spawned. In January 1997 the Washington Post bled, its likely uses and constituencies will reported several Fairfax County school board multiply. As early as June 1997, Newsweek members “challeng[ed] a planned $11 mil- reported that “[o]rganizations clamoring for lion computer database that would let unfettered access to the databank include schools compile electronic profiles of stu- insurers, self-insured employers, health dents, including hundreds of pieces of infor- plans, drugstores, biotech companies and mation on their personal and academic back- law-enforcement agencies.” Moreover, as grounds.” The database would “be used to with the U.S. Census, pressure will material- track students from pre-kindergarten ize to expand the centralized information’s through high school” and “could include scope. By 1997 the National Committee on information such as medical and dental his- Vital and Health Statistics already had “ten- tories, records of behavioral problems, family tatively recommended that this mother lode income and learning disabilities.” Fairfax was of medical information be further augment- “considering providing some of the data to a ed by specifics on living arrangements, nationwide student information network schooling, gender and race.”72 run by the U.S. Department of Education,” The issue is not just privacy; it is govern- possibly making the database “compatible

17 with a nationwide data-exchange program, required to be linked with and accessible to organized by the Department of Education, other users such as state and local education that makes student information available to agencies, providing file transfer services and other schools, universities, government agen- allowing DOE to disseminate, among other cies and potential employers.”74 things, “data published by the National That nationwide data-exchange net- Center for Education Statistics,” a directory work—orchestrated by the federal govern- of “education-related electronic networks ment and extended through the 1994 educa- and databases,” and “such other information tion acts—now is the lifeblood of centralized and resources” as DOE “considers useful and data collection about American students and appropriate.” Sixteen regional “educational preschoolers, creating vast and potentially ill- resources information center clearinghous- protected computerized records about chil- es” support the data dissemination, along dren and families throughout America. The with a National Library of Education intend- data-exchange pathways are (perhaps inten- ed to serve as a “one-stop information and tionally) complex, largely connected via the referral service” for all education-related Office of Educational Research and information produced by the federal govern- Improvement within the U.S. Department of ment.78 Through the School-to-Work Op- Education (DOE). portunities Act the Labor Department is That office, administered by the assistant required to act jointly with DOE to “collect secretary for educational research and and disseminate information” on topics that improvement, stands at the apex of the data- include “research and evaluation conducted centralization hierarchy, broadly empowered concerning school-to-work activities” and to “collect, analyze, and disseminate data “skill certificates, skill standards, and related related to education” and charged with assessment technologies.”79 “monitoring the state of education” in A spider web of data exchange is the America.75 Included within the Office of planned outcome. But central to the entire Educational Research and Improvement are process is the National Center for Education Statistics (the “National Center”). It is the • the National Center for Education federal entity most directly and extensively Statistics; involved in receiving individually identifiable The National • five national research institutes;76 information about American children and Center for • the Office of Reform Assistance and their education. Dissemination; The National Center has authority to Education • the National Educational Research “collect, analyze, and disseminate statistics Statistics is the Policy and Priorities Board; and and other information relating to education” • “such other units as the Secretary [of in the United States and elsewhere.80 It is federal entity Education] deems appropriate.”77 authorized to collect data on such things as most directly and “student achievement,” the “incidence, fre- extensively Horizontal data linkages between subordi- quency, seriousness, and nature of violence nate units in this hierarchy are made explicit affecting students,” and, still more intrusive- involved in receiv- by a statutory requirement that the Office of ly, “the social and economic status of chil- ing individually Reform Assistance and Dissemination create dren.” The clear implication is that schools identifiable an “electronic network” linking most educa- will be required to obtain information from tion-related federal offices as well as “entities children and their families on such topics. In information engaged in research, development, dissemi- addition, to carry out the National about American nation, and technical assistance” through Assessment of Educational Progress (NAEP), grants, contracts, or cooperative agreements the commissioner of education statistics is children and their with DOE. authorized to “collect and report data . . . at education. The federal education network is further least once every two years, on students at ages

18 9, 13, and 17 and in grades 4, 8, and 12 in tion. Aside from the possibility of illicit Aside from the 81 public and private schools.” States partici- breaches of confidentiality, specific statutory possibility of pating in the NAEP testing process thus gen- exceptions to confidentiality requirements erate additional individually identified stu- threaten to undermine any such security. To illicit breaches of dent information for the federal government. begin with, information about institutions confidentiality, Making education data from diverse and organizations that receive federal grants sources dovetail at the national level is an or contracts is not protected.84Moreover, the specific statutory explicit federal objective. The commissioner National Center’s records—“including infor- exceptions to of education statistics is authorized to gath- mation identifying individuals”—are made confidentiality er information from “States, local education- accessible to a bevy of federal officials and al agencies, public and private schools, their designees, including the U.S. comptroller requirements preschools, institutions of higher education, general, the director of the Congressional threaten to libraries, administrators, teachers, students, Budget Office, and the librarian of Congress, undermine the general public,” and anyone else the com- as well as the secretary of education, again missioner “may consider appropriate”— with the boilerplate admonition that individ- security. including other offices within DOE and ually identifiable information is to be used “other Federal departments, agencies, and only for statistical purposes.85Separate DOE instrumentalities” (the IRS, SSA, and federal privacy regulations also countenance myriad health care database authorities come to disclosures without the consent of the subject mind). To facilitate centralization of the individuals, among them disclosures made for data, the commissioner is empowered to “routine uses” (one of the major loopholes in establish “national cooperative education the 1974 federal Privacy Act discussed above) statistics systems” with the states to produce and those made either to another government and maintain “comparable and uniform agency “for a civil or criminal law enforcement information and data on elementary and sec- activity” or to Congress.86 ondary education, postsecondary education, The Family Educational Rights and Privacy and libraries” throughout America.82 Act (FERPA) similarly fails to protect individu- The scope of these databases is so large and als effectively against disclosure of student their information so personal that even Congress information to the federal government. understood the need to genuflect toward privacy Although FERPA’s rules in general prevent edu- and confidentiality. Indeed, the education cational agencies and institutions from disclos- statutes purport to protect individually identifi- ing personal information about students with- able information, directing the federal bureaucra- out their consent, FERPA explicitly permits cy to “develop and enforce” standards to “protect release of such information to authorized rep- the confidentiality of persons” in its data collec- resentatives of the U.S. comptroller general, the tion and publication process. Individually identi- secretary of education, and state educational fiable information is said to be restricted to use authorities whenever individually identifiable for statistical purposes only. In addition, the records are “necessary in connection with the NAEP provisions prohibit the commissioner of audit and evaluation of Federally-supported education statistics from collecting data “not education program[s], or in connection with directly related to the appraisal of educational the enforcement of the Federal legal require- performance, achievement, and traditional ments” related to such programs. In other demographic reporting variables,” admonishing words, FERPA simply does not protect us the commissioner to insure that “all personally against disclosure of student records to the fed- identifiable information about students, their eral government. Again federal bureaucrats are educational performance, and their families” will admonished that, unless “collection of person- remain “confidential.”83 ally identifiable information is specifically Unfortunately, such provisions do not authorized” by federal law, “any data collected guarantee the security of personal informa- by such officials shall be protected in a manner

19 which will not permit the personal identifica- other financial institutions to create perma- tion of students and their parents by other than nent records of each individual’s checks, those officials,and such personally identifiable deposits, and other banking activities. Along data shall be destroyed when no longer needed” with the FDIC’s ill-fated proposal89 in for the above purposes.87How such destruction December 1998 to require banks to scruti- could be enforced and electronic copies pre- nize every customer’s banking records for evi- vented are unanswered—and unanswerable— dence of “unusual” transactions—which in questions. The officials themselves have effect would have mandated warrantless unquestioned access to such personally identi- searches of private financial records—the leg- fied information, without the subject individ- islation authorizing these intrusions and ual’s consent. That much lawmakers intended. U.S. Supreme Court cases upholding them But disclosures beyond those intended by illuminate the tenuous status of privacy in lawmakers also are inevitable. Together the America today. statutes have spawned huge databases con- The pivotal legislation was the Bank taining individually identifiable personal and Secrecy Act of 1970.90In the name of assem- educational information, widely distributed, bling banking records with “a high degree of whose use is supposed to be confined to “sta- usefulness in criminal, tax, and regulatory Disclosures tistical” endeavors. The laws don’t block the investigations and proceedings,” Congress beyond those government’s collection of individually identi- empowered the secretary of the treasury to intended by law- fiable information, only its use. The risk anal- require every federally insured bank to create: ogy cited earlier—giving a teenager keys to a makers also are motorcycle, handing him a bottle of liquor, 1. a microfilm or other reproduction of inevitable. and admonishing him not to drink and each check, draft, or similar instrument drive—is applicable; once again we’re just “ask- drawn on it and presented to it for pay- ing for trouble.” Even criminal penalties ment; and authorized for individuals convicted of violat- 2. a record of each check, draft, or simi- ing confidentiality provisions of these laws do lar instrument received by it for deposit little to lessen legitimate privacy concerns. or collection, together with an identifi- By placing vast discretion regarding col- cation of the party for whose account it lection and distribution of personal informa- is to be deposited or collected.91 tion in the hands of federal officials, and by largely preventing citizens from blocking That requirement entailed microfilm records transfer of information to the central govern- of every detail of each customer’s bank ment, these laws again subordinate privacy to account—each check, each deposit—with the imperative of federal prying into people’s each account identified by the holder’s Social private lives. As Electronic Privacy Security number.92 The statute authorized Information Center director Marc Rotenberg similar record keeping to be required of unin- remarked concerning compilation of data- sured institutions, including even credit card bases on students such as those proposed in companies.93 Putting further discretionary Fairfax County, “‘The privacy concerns are power in the treasury secretary’s hands, the really extraordinary.’”88 simultaneously passed Currency and Foreign Transactions Reporting Act required individ- uals and financial institutions to report the Tracking Your Bank “payment, receipt, or transfer of United Account: The Bank Secrecy States currency, or such other monetary Act and Its Progeny instruments as the Secretary may specify, in such amounts, denominations, or both, or Privacy in America is further jeopardized under such circumstances, as the Secretary by federal statutory law requiring banks and shall by regulation prescribe.”94What could

20 not be learned about an individual from such labeled premature until such time as they can records? be deemed too late.97 Court challenges quickly arose. In 1974 Justice Marshall’s “hollow charade” assess- the U.S. Supreme Court in California Bankers ment was vindicated two years later by the Association v. Shultzupheld the constitutional- Court’s 1976 decision in United States v. Miller.98 ity of the record-keeping requirements of the Stating flatly that depositors have “no legiti- Bank Secrecy Act against challenges ground- mate ‘expectation of privacy’” in their bank ed in the First, Fourth, and Fifth Amend- records, the Court there held that the “depos- ments to the U.S. Constitution.95 Although itor takes the risk, in revealing his affairs to the Court stated that the act did not abridge another, that the information will be conveyed any Fourth Amendment interest of the by that person to the Government,” a conclu- banks against unreasonable searches and sion not altered by the fact that the Bank seizures, the Court explicitly reserved the Secrecy Act mandated creation of the question of the Fourth Amendment rights of records.99Accordingly, the Court held that a banks’ customers if bank records were dis- depositor’s Fourth Amendment rights were closed to the government as evidence not abridged by the government’s acquisition through compulsory legal process. The of account records from his banks as part of a Court stated that “[c]laims of depositors criminal prosecution, even if the subpoena for against the compulsion by lawful process of the documents was defective. bank records involving the depositors’ own The case was too much for even Congress transactions must wait until such process to stomach. In response to U.S. v. Miller, issues.” Dissenting, Justice Thurgood Congress in 1978 passed the Right to Marshall stated: Financial Privacy Act (“Financial Privacy Act”), attempting to restore some protection The plain fact of the matter is that the of personal financial records in the wake of Act’s recordkeeping requirement feeds the Bank Secrecy Act’s forced disclosures.100 into a system of widespread informal The central idea of the Financial Privacy Act access to bank records by Government was to prevent federal government authori- agencies and law enforcement personnel. ties from obtaining personal financial If these customers’ Fourth Amendment records held by banking institutions unless claims cannot be raised now, they cannot either the customer authorized the disclo- be raised at all, for once recorded, their sure or the bank was responding to a proper- checks will be readily accessible, without ly issued subpoena, administrative sum- judicial process and without any showing mons, search warrant, or “formal written The case was too of probable cause, to any of the several request” by a government authority.101 agencies that presently have informal In broad outline, the act prohibits banks much for even access to bank records.96 from disclosing personal financial records Congress to maintained pursuant to the Bank Secrecy Act stomach. In Justice Marshall added that it was “ironic unless the federal authority seeking those that although the majority deems the bank records “certifies in writing to the financial response to U.S. customers’ Fourth Amendment claims pre- institution that it has complied” with the v. Miller, mature, it also intimates that once the bank Financial Privacy Act.102 That certification has made copies of a customer’s checks, the may be based on any of the above rationales Congress in 1978 customer no longer has standing to invoke including a federal official’s “formal written passed the Right his Fourth Amendment rights when a request,” the lenient prerequisites for which to Financial demand is made on the bank by the potentially undermine the statute’s core Government for the records.” He called the objectives. Such a request requires mere gov- Privacy Act. majority’s decision a “hollow charade” ernment assertion that “there is reason to whereby Fourth Amendment claims are to be believe that the records sought are relevant to

21 We continue to a legitimate law enforcement inquiry,” in certain situations.105 rely on accompanied by government notification of These exceptions along with the porosity the bank customer at his last known address. of the statute’s strictures made the Financial Congress—the But “law enforcement inquiry” is used as a Privacy Act weak grounds for protection very source of the term of art in the statute. Defining it to from unwarranted federal scrutiny of our include any “official proceeding” inquiring personal bank transactions. Of course, that is initial privacy into a failure to comply with a “criminal or no surprise. We surely cannot expect federal breach—to civil statute or any regulation, rule, or order officials who still claim power to order third- formulate laws issued pursuant thereto,” the statute explicit- party microfilming of our personal banking ly includes the broad sweep of federal regula- records to always show delicate restraint in supposed to pro- tory matters and thereby radically expands using them. Yet we continue to rely on tect our financial the bank records that can be targeted and Congress—the very source of the initial priva- privacy. disclosed in the name of “law enforcement cy breach—to formulate laws supposed to inquiry.” Moreover, the notification require- protect our financial privacy. ment can be met by simply mailing a copy of It happened again in 1999 with passage of the request to the targeted bank customer the Gramm-Leach-Bliley Act.106 That act “on or before the date on which the request repealed the 1933 Glass-Steagall Act and was made to the financial institution.” loosened legal restrictions on banks’ ability Unless the individual then takes specific to engage in related endeavors such as securi- steps to resist the disclosure by filing and ties transactions.107 Old barriers between substantiating a motion with a U.S. district banking, insurance, and securities businesses court within fourteen days after the request were removed. A vast array of financial ser- was mailed (not received), the bank is permit- vices thus could be provided by affiliated ted to give the government the records it companies, creating enormous potential eco- wants. Once obtained by federal authorities, nomic efficiencies. the bank records can be shared with other Unfortunately, the Gramm-Leach-Bliley federal agencies or departments if the trans- Act also created an enormous threat to the ferring entity certifies in writing that there is privacy of personal information held by the “reason to believe that the records are rele- newly interlocked companies. To ease our vant to a legitimate law enforcement inquiry minds, the authors of the act mandated cer- within the jurisdiction of the receiving tain privacy procedures for affected financial agency or department.”103 In light of such institutions, stating that it is “the policy of procedural impediments to private resistance the Congress that each financial institution and the magic words “law enforcement activ- has an affirmative and continuing obligation ity” that allow countless channels of federal to respect the privacy of its customers and to access to personal bank records, it is clear in protect the security and confidentiality of whose favor the deck is stacked. those customers’ non-public personal infor- Besides the looseness evident in these mation.”108Despite those fine words, howev- statutory provisions, two other major prob- er, the privacy regulations again were stacked lems pervade the Financial Privacy Act: its against the actual preservation of privacy. specific exclusions and, more generally, the Consider first the pass-through of person- unreliability of Congress as protector of al financial information to the government financial privacy. Sixteen listed “exceptions” permitted by the Gramm-Leach-Bliley Act. to the Financial Privacy Act allow govern- After setting forth rules intended to limit ment authorities to avoid its provisions in a financial firms’ disclosure of personal infor- wide variety of circumstances.104In addition, mation to nonaffiliated third parties, the act the act allows government authorities to then listed numerous exceptions to those pri- obtain emergency access to financial records vacy rules, allowing extensive disclosure of from banks and other financial institutions personally identifiable information, among

22 them print. Among those who would prefer not to have personal information about themselves • disclosures “to law enforcement agencies shared with nonaffiliated companies, how (including a Federal functional regulator, many do you suppose take the time to read the Secretary of the Treasury . . ., a State and respond to each of those little pam- insurance authority, or the Federal Trade phlets? And how many would consent if the Commission), self-regulatory organiza- pamphlets instead asked for our actual per- tions, or for an investigation on a matter mission to disclose that personal informa- related to public safety”; and tion about us? Of course, Congress under- • disclosures “to comply with Federal, stands these realities as well as we do. State, or local laws, rules, and other As obliging Congresses continue to cob- applicable legal requirements; to comply ble together loose statutes such as the with a properly authorized civil, crimi- Gramm-Leach-Bliley privacy provisions and nal, or regulatory investigation or sub- the Financial Privacy Act, we now know that poena or summons by Federal, State, or even such porous protections could be with- local authorities; or to respond to judi- drawn, our financial privacy utterly cial process or government regulatory destroyed, without constitutional objection authorities having jurisdiction over the from the U.S. Supreme Court. In such cir- We now know financial institution for examination, cumstances, congressional architects of the that even porous compliance, or other purposes as autho- nationwide structure of financial records protections could rized by law.”109 now threatening our privacy are unlikely to provide reliable protection. be withdrawn, In other words, having facilitated much our financial pri- broader integration of personal data by financial firms, Congress immediately made Government As Privacy vacy utterly provision for the federal government and Protector? destroyed, with- state governments to get their hands on it. out constitution- It is therefore not surprising that the In 1974 Congress passed the omnibus Gramm-Leach-Bliley Act’s restraints on Privacy Act, cited earlier in this chapter, to al objection from financial firms also were structured to make regulate disclosure of personal information the U.S. Supreme sure that lots of personal data would be by federal agencies. Even that long ago Court. shared. The act requires financial institu- Congress recognized the damage that federal tions to notify customers periodically of the record keeping and disclosure could do, as institution’s disclosure and privacy policies lawmakers made explicit in the “findings” regarding affiliated as well as nonaffiliated accompanying the act: parties. With respect to nonaffiliated third parties, however, the main restraint on dis- 1. the privacy of an individual is directly closure was structured as an “opt out” provi- affected by the collection, mainte- sion that requires a financial institution to nance, use, and dissemination of per- send customers a notice (a) describing the sonal information by Federal agencies; disclosures of their personal information 2. the increasing use of computers and that the firm may make to nonaffiliated sophisticated information technology, third parties, and (b) specifying to whom the while essential to the efficient opera- customer should write to prevent such dis- tions of the Government, has greatly closure.110If the customer fails to communi- magnified the harm to individual priva- cate his objection to the disclosure, the dis- cy that can occur from any collection, closure can legally occur. That is why we have maintenance, use, or dissemination of been receiving all those little “Our Privacy personal information; Policies” pamphlets with all that little tiny 3. the opportunities for an individual

23 to secure employment, insurance, vacy vis-à-vis federal government “collection, and credit, and his right to due maintenance, use, and dissemination” of per- process, and other legal protections sonal information. are endangered by the misuse of cer- In 1988, as people became increasingly tain information systems; alarmed about government centralization of 4. the right to privacy is a personal and personal information, Congress purportedly fundamental right protected by the sought to strengthen the Privacy Act by adding Constitution of the United States; the Computer Matching and Privacy and Protection Act.114 Again, however, the statutory 5. in order to protect the privacy of indi- privacy protections amounted to less than met viduals identified in information sys- the eye, creating procedural hurdles rather than tems maintained by Federal agencies, firm obstacles to database matching. The 1988 it is necessary and proper for the act continued to allow such exchanges provid- Congress to regulate the collection, ed that the “computer matching program” was maintenance, use, and dissemination “pursuant to a written agreement between the of information by such agencies.111 source agency and the recipient agency” that met specified procedural requirements. Federal Despite that clear acknowledgement of the database-matching activities through the “new federal threat to personal privacy, the 1974 hires” database, pilot programs for work autho- Privacy Act112—riddled with exceptions and rization, child support enforcement programs, counterbalanced by disclosure mandates in and other programs confirm that this act pro- the Freedom of Information Act —failed to vided scant impediment to the continuing fed- fulfill the promise these declarations seemed eral data quest. As noted earlier, some forty- to hold. The Electronic Frontier Foundation seven instances of federal database exchanges was unequivocal in its 1994 assessment, stat- involving personal information about ing that in meritorious cases “it is extremely Americans occurred pursuant to this statute difficult for individuals to obtain relief under within a recent eighteen-month period alone. the . . . Privacy Act” and calling the Act’s bias Based on this and other evidence, Privacilla.org in favor of government record keepers “one concluded in its 2001 report that the Computer of the most ugly faces of privacy.”113 Matching and Privacy Protection Act, by “regu- No stronger proof of the act’s failure larizing transfer of citizen data among federal could be given than the fact that all of the agencies,” in reality “sanctions and contributes privacy-destroying measures discussed in to the federal government’s threat to priva- Federally this chapter were initiated or sustained after cy.”115 Openly acknowledging such ongoing the Privacy Act’s adoption and are deemed federal data-sharing activity—indeed bragging required data- compatible with its mandates. The federally about it—a government report published in bases of personal required expansion of use of Social Security 1998 reassured citizens that their information- information numbers, the federal databases of “new collection burden is minimized because hires,” the employment-authorization data- “Agencies are working together to share infor- continue to bases, the federal mandates for uniform elec- mation across programs so that people only proliferate. tronic databases of personal health informa- need respond to a single collection from one tion and “unique health identifiers,” the agency rather than multiple collections from expanded federal collection of individually many agencies.”116 identified educational information, the con- Today, federally required databases of per- tinued federal requirement that financial sonal information continue to proliferate. institutions microfilm our checks and One measure of their current scope is that, in deposits in case the federal government the 2000 Code of Federal Regulations,the index desires to examine them—all of these now entryunder the heading “Reporting and coexist with a law ostensibly assuring our pri- recordkeeping requirements” by itself was

24 sixty-four pages long! Moreover, the federal Legislation aside, the personal behavior of For fiscal year government now reports an annual “infor- government officials offers little hope that 2000 the federal mation collection budget” showing the num- they can be trusted to behave ethically with ber of hours acknowledged to be the central respect to the personal data now at their fin- government esti- government’s “information collection bur- gertips. Republicans and Democrats alike mated over seven dens imposed on the public.” For fiscal year succumb to temptation when the stakes are 2000 that document estimated perceived to be high enough. Republican billion hours as 7,447,200,000 hours—over seven billion President Richard Nixon in 1971 expressed the time cost of hours—as the time cost of the information his intention to select as IRS commissioner the information collection burden imposed on private citi- “a ruthless son of a bitch,” who “will do what zens by federal departments and agencies.117 he’s told,” will make sure that “every income collection burden That is equivalent to forcing over three and a tax return I want to see I see,” and “will go imposed on pri- half million private individuals to work full after our enemies and not go after our vate citizens by time at uncompensated labor for the entire friends.”120 It was widely reported that year just to gather the data that the federal Democratic President Bill Clinton, for simi- federal depart- government demands. lar reasons, apparently sanctioned the illegal ments and Information on such a scale would not be transfer of more than nine hundred FBI files collected unless federal officials regarded it as to the White House. And, ironically, federal agencies. instrumental in changing people’s behavior— agencies such as the IRS routinely have used social behavior, economic behavior, political privacy legislation to shield evidence of their behavior. And, of course, it is: collective out- own misdeeds.121Does anyone contemplat- comes as well as actions by individuals can be ing today’s ubiquitous federal collection of and are influenced by means of such pro- personal data still imagine that political lead- grams. Far from innocuous, this data collec- ers cannot and will not abuse this system for tion and the intensity of its pursuit reveal the their own ends? Each passing administration enormous value placed on such intelligence by demonstrates anew Dr. Sobel’s succinct federal officials. Rep. Jim McDermott (D., observation that “centralized information is Wash.), one of the few congressmen who centralized power.”122 actively resisted HIPAA’s 1996 authorization The converse is also true: with today’s of uniform national electronic databases for technology, centralized power is centralized health care, later stated, “There is no privacy information. Substantive powers of govern- anymore,” adding that “It has been eroded in ment spawn correlative record-keeping pow- so many ways that you can find out almost ers; as federal power grows, so does related anything about anybody if you know how to data collection. Personal freedom according- work the computer well enough.”118 ly gives ever more ground to expanding gov- Others cite the fundamental inconsisten- ernment responsibility. Given these cy between privacy and government. Noting inevitable tendencies, Cato Institute policy that “privacy is inconsistent with so much of analyst Solveig Singleton proposed a better what government does,” a 2001 report pre- way to protect privacy: pared by Privacilla.org stated that “[e]ven the best-intended government programs have as The better model for preserving privacy part of their design the removal of citizens’ rights and other freedoms in the U.S. is power over information about themselves,” to restrict the growth of government often making it “outright illegal for citizens power. As the federal government to protect their privacy.” The report conclud- becomes more entangled in the busi- ed that “[w]hen government has collected ness of health care, for example, it information from people under the authori- demands greater access to medical ty of law, people’s ability to protect privacy in records. As tax rates grow higher and that information is taken away.”119 the tax code more complex, the Internal

25 Revenue Service claims more power to repeated instances privacy-jeopardizing pro- conduct intrusive audits and trace cus- visions have been hidden in omnibus bills tomer transactions. Only holding back hundreds of pages long, making it difficult the power of government across the for lawmakers, let alone citizens, to see them board will safeguard privacy—and with- and react before they become law. out any loss of Americans’ freedom.123 Misinformation has also helped, especially when uncritically repeated by the media—the Of course, the Founders tried to hold back appealing justifications, the ignored data- the power of government through the U.S. collection authority. In the case of HIPAA, Constitution. As author and critic H. L. despite outspoken efforts in 1996 by Mencken explained: Representative McDermott and several other legislators to publicize the extraordinary [Government] could do what it was threat to privacy contained in the provisions specifically authorized to do, but noth- for uniform electronic databases and unique ing else. The Constitution was simply a health identifiers, neither Congress nor the record specifying its bounds. The media spread the story. Although some did- fathers, taught by their own long n’t know, some definitely did. Yet, two years The federal debates, knew that efforts would be later, face-saving untruths or careless report- data-collection made, from time to time, to change the ing further obscured the events of 1996. programs now Constitution as they had framed it, so When the “unique health identifier” story they made the process as difficult as was reported in 1998 as breaking news, the themselves serve possible, and hoped that they had pre- Associated Press, for instance, uncritically as instruments vented frequent resort to it. Unhappily, reiterated statements attributed to an they did not foresee the possibility of unnamed “Republican congressional aide” of political making changes, not by formal act, but claiming that “[m]embers of Congress did transaction-cost by mere political intimidation—not by not recognize the privacy implications of augmentation. recasting its terms, but by distorting its what they had done until media reports meaning. If they were alive today, they about the issue came out this week.”126 would be painfully aware of their over- Thus instituted, the federal data-collec- sight.124 tion programs described in this chapter now themselves serve as instruments of political As we have seen, this avoidance of the formal transaction-cost augmentation. Their effect amendment process has been an integral in raising the cost to individuals of resisting part of the political transaction-cost manipu- intrusive government power is evident. How lation undergirding the twentieth-century might an individual even resist federal infor- expansion of federal authority and the corre- mation collection about himself? With data sponding erosion of individual liberty. largely collected by third parties and trans- Though fiercely concerned about privacy, ferred to the central government without the for decades Americans have allowed the jug- subject individual’s consent, personal infor- gernaut of federal data collection to roll on, mation is now collected whenever an individ- unmindful of writer and editor A. J. Nock’s ual touches the fabric of society in almost insight that “whatever power you give the any way: getting a job, seeking medical care, State to do things foryou carries with it the attending school, maintaining a bank equivalent power to do things toyou.”125 account. Will not fear of government misuse Public passivity on this issue reflects the of such personal information inevitably usual politico-economic forces, central mold a more compliant citizenry? among them high costs of resistance exacer- Many who prize liberty and privacy—so eas- bated by federal officials’ manipulation of ily assuaged, so vulnerable to political transac- political transaction costs. As we have seen, in tion-cost manipulation—were, in late 1998,

26 cheerfully celebrating a spurious victory creation of a Federal Intrusion regarding the unique health identifier, appar- Detection Network, or Fidnet, and ently comforted by Vice President Al Gore’s specifies that the data it collects will be commitment to an “Electronic Privacy Act.” gathered at the National Infrastructure But the vice president’s own press release, Protection Center, an interagency task though it noted a raft of new controls the force housed at the Federal Bureau of administration wanted to place on private Investigation. . . . The plan focuses on businesses’ use of personal information, was monitoring data flowing over Govern- nearly silent regarding governmentuse of per- ment and national computer networks. sonal information, stating only an intention That means the systems would poten- to “launch a ‘privacy dialogue’ with state and tially have access to computer-to-com- local governments” that would include “con- puter communications like electronic sidering the appropriate balance between the mail and other documents, computer privacy of personal information collected by programs and remote log-ins.128 governments, the right of individuals to access public records, and First Amendment val- Civil liberties groups expressed their strong ues.”127With existing statutes and regulations opposition to the proposal, likening the plan usurping personal privacy more aggressively “to a computerized version of a random with each passing day, it is much too late for a search.”129James Dempsey, a staff lawyer for bureaucratic “privacy dialogue.” the Center for Democracy and Technology, And the federal government keeps push- said that the plan “involves monitoring all ing. On July 28, 1999, a news story titled legitimate communications in order to identi- “U.S. Drawing Plan That Will Monitor fy the few unauthorized communications . . . a Computer Systems” ran on the front page of potential civil-liberties nightmare.”130 the New York Times. The report revealed a fed- The invasive statutes and regulations eral government proposal to establish a com- described in this chapter have brought us to puter monitoring system “overseen” by the this point. The government data collection FBI that, among other things, would scruti- now authorized would have seemed unimag- nize private e-mail communications between inable in an America whose citizens once individuals not suspected of any wrongdo- boldly and meaningfully proclaimed individ- ing. The ostensible rationale for monitoring ual liberty. What important personal infor- such private communication was “anti-ter- mation is not now at the fingertips of curious rorism” and protection against “intruders” federal officials? Whatever does remain pri- attacking government computers. Reporter vate is increasingly vulnerable to proposals It is much too John Markoff summarized the proposal as such as the one just described. And the follows: future? Centralized power is centralized late for a bureau- information; centralized information is cen- cratic “privacy [The draft plan] calls for a sophisticated tralized power. The usual consequences are dialogue.” software system to monitor activities well known: “As history has shown, the col- on nonmilitary Government networks lection of information can have a negative and a separate system to track networks effect on the human ability to make free used in crucial industries like banking, choices about personal and political self-gov- telecommunications and transporta- ernance. Totalitarian regimes have already tion. . . . As part of the plan, networks of demonstrated how individuals can be ren- thousands of software monitoring pro- dered helpless by uncertainty about official grams would constantly track comput- use of personal information.”131 er activities looking for indications of Reducing central government power is the computer network intrusions and only alternative to such dependence. As gov- other illegal acts. The plan calls for the ernment data mandates proliferate and

27 Reducing central encryption issues loom larger, those who cling trade secrets.” James A. Srodes, “Protect Us from Environmental Protection,” World Trade,July 1998, government to government as privacy’s bulwark may well pp. 14–15, at p. 14. See also 15 U.S.C. secs. 4901-11 reflect on Electronic Frontier Foundation (1998); 15 U.S.C. secs. 175–76, 178, 182 (1997). power is the only cofounder John Perry Barlow’s statement that “[t]rusting the government with your privacy 5. Claire Wolfe, “Land-Mine Legislation,” 1997. alternative to Posted by America-Collins, http://www.america- is like having a peeping Tom install your win- dependence. 132 collins.com (Internet); america-collins@america- dow blinds.” In assessing the privacy impli- collins.com (E-mail); 5736 Highway 42 North, cations of the mandated unique health identi- Forsyth, Georgia 31029, 912-994-4064 (office). fiers and uniform electronic databases of per- 6. Simon G. Davies, “Touching Big Brother: How sonal medical information, physician Biometric Technology Will Fuse Flesh and Bernadine Healy was succinct: “Government Machine,” Information Technology & People, vol. 7, does a lot of things well, but keeping secrets is no. 4, 1994. not one of them.”133 7. Ibid. (“Nazi Germany”).

8. Solveig Singleton, “Don’t Sacrifice Freedom for Notes ‘Privacy,’” Wall Street Journal, June 24, 1998, p. A18 (“Japanese-Americans”). See also Solveig Singleton, This chapter is adapted and reprinted with permis- “Privacy As Censorship: A Skeptical View of sion of the publisher from my article, “Watching Proposals to Regulate Privacy in the Private You: Systematic Federal Surveillance of Ordinary Sector,” Policy Analysis no. 295 (Washington, D.C.: Americans,” Independent Review: A Journal of Cato Institute, 1998). Political Economy,vol. 4, no. 2, Fall 1999 pp. 165–200, © Copyright 1999, The Independent Institute, 100 9. The long form of the 1990 U.S. Census Swan Way, Oakland, California 94621-1428; required respondents to answer questions about http://www.independent.org. their ancestry, living conditions (including bath- room, kitchen, and bedroom facilities), rent or 1. Harry B. Acton, The Morals of Markets: An Ethical mortgage payment, household expenses, room- Exploration,in David Gordon and Jeremy mates and their characteristics, in-home tele- Shearmur, eds., The Morals of Markets and Related phone service, automobile ownership, household Essays (1971; reprint, Indianapolis: Liberty Fund, heating and sewage systems, number of still- 1993), p. 133. births, language capability, and what time each person in the household usually left home to go 2. Paul Schwartz, “Data Processing and Government to work during the previous week. The form stat- Administration: The Failure of the American Legal ed that “By law [Title 13, U.S. Code], you’re Response to the Computer,” Hastings Law Journal,vol. required to answer the census questions to the 43, 1992, part 2, pp. 1321–89, at pp. 1363–64. best of your knowledge,” adding that the infor- mation requested “enable[s] government, busi- 3. Ibid., pp. 1343 (“powerful way to control”), ness, and industry to plan more effectively.” 1374 (“mysterious, incalculable bureaucracy”). Nowhere did it state that sec. 221, Title 13 of the U.S. Code also specifies a maximum penalty of 4. Government collection of trade data and busi- $100 for someone who chooses not to answer. ness information is not discussed here. Those See U.S. Dept. of Commerce, Bureau of the important aspects of government data collection Census, 1990, Form D-2 (OMB no. 0607-0628). were highlighted by the Environmental Protection Except for the stillbirth and in-home telephone Agency’s expansion of its “Toxic Release Inventory” service inquiries, all of the above questions were to require businesses to report production data so repeated in the 2000 U.S. Census long form. U.S. detailed that Kline & Co. (a member of the Society of Dept. of Commerce, Bureau of the Census, 2000, Competitive Intelligence Professionals) judged its Form D-61B (OMB no. 0607-0856). wartime impact as “the equivalent of having the U.S. voluntarily turn over its code book to its enemies.” 10. Simon G. Davies, “Touching Big Brother: Quoted in Pranay Gupte and Bonner R. Cohen, How Biometric Technology Will Fuse Flesh and “Carol Browner, Master of Mission Creep,” Forbes, Machine” (“vague memory”). October 20, 1997, pp. 170–77, at p. 176. Posting the information on its Internet website, the EPA “over- 11. Ibid. rode heated industry protests and made it easy for corporate trade secret thieves to make off with bil- 12. Schwartz, “Data Processing and Government lions of dollars’ worth of America’s most proprietary Administration: The Failure of the American Legal

28 Response to the Computer,” p. 1356, n. 165 White Paper,sec. III(A)(3). (describing each individual’s social security num- ber as a “de facto national identification number”). 20. See, for example, Public Law 105-34, 105th Cong., 1st sess., August 5, 1997, Title X, secs. 13. Department of Health and Human Services, 1090(a)(2), (4), 111 Stat. 961–62, which amended Unique Health Identifier for Individuals: A White Paper the statute governing the Federal Parent Locator (Washington, D.C.: July 2, 1998), sec. III(A)(1). Service to provide that “Beginning not later than October 1, 1999, the information referred to in 14. Kristin Davis, quoted in Theodore J. Miller, paragraph (1) [42 U.S.C. sec. 653(b)(1), governing “Look Who’s Got Your Numbers,” Kiplinger’s “Disclosure of information to authorized per- Personal Finance,July 1998, p. 8. Kristin Davis sons”] shall include the names and social security authored “The Bonnie and Clyde of Credit Card numbers of the children of such individuals” and Fraud” in the same Kiplinger’sissue at pp. 65–71. further that the “Secretary of the Treasury shall Theodore Miller is the magazine’s editor. have access to the information described in para- graph (2) [42 U.S.C. sec. 653(b)(2)] for the pur- 15. President Franklin D. Roosevelt, “Numbering pose of administering those sections of Title 26 System for Federal Accounts Relating to Individual which grant tax benefits based on support or res- Persons,” Executive Order 9397, November 22, idence of children.” See also 42 U.S.C. secs. 1943. Reproduced in Code of Federal Regulations, 651–52 for relevant AFDC provisions. Title 3 (Washington, D.C.: U.S. Government Printing Office, 1957), chapter 2, pp. 283–84. 21. Omnibus Consolidated Appropriations Act, 1997, Public Law 104-208, 104th Cong., 2d sess., September 16. William H. Minor, “Identity Cards and 30, 1996, 110 Stat. 3009; Illegal Immigration Reform Databases in Health Care: The Need for Federal and Immigrant Responsibility Act of 1996, Public Law Privacy Protections,” Columbia Journal of Law and 104-208, 104th Cong., 2d sess., Division C, Social Problems,vol. 28, no. 2, 1995, pp. 253–96, at September 30, 1996, 110 Stat. 3009-546 ff. pp. 262–63. See also Robert Pear, “Not for Identification Purposes (Just Kidding),” New York 22. Department of Transportation, National Times,July 26, 1998, the New York Timeson the Highway Traffic Safety Administration, Proposed Web. Some people seemed reluctant to admit Rule, “State-Issued Driver’s Licenses and what was being done with SSNs. When I wrote to Comparable Identification Documents,” Federal complain about usage of my SSN as my “account Register,vol. 63, June 17, 1998, pp. 33219–25; Code number” on my federally insured student loan, a of Federal Regulations, Title 23, Part 1331. In a pas- “loan servicing representative” from Academic sage that would make the Framers’ blood boil, the Financial Services Association (AFSA) replied: Department of Transportation explained that, “Your AFSA account number is not your social under the proposed rule, “States must demon- security number since it begins with a portfolio strate compliance with the requirements of the reg- number SM 799 B followed by 10 digits”--despite ulation by submitting a certification to the the fact that my Social Security number consti- National Highway Traffic Safety Administration.” tuted the next nine of those digits. I see his point: it’s really so much different if “SM 799 B” pre- 23. Department of Transportation and Related cedes one’s Social Security number! (Letter of Agencies Appropriations Act,2000, Public Law 106- June 11, 1986). 69, 106th Cong., 1st sess., October 9, 1999, 113 Stat. 986, sec. 355, at 113 Stat. 1027. 17. Privacy Act of 1974, Public Law 93-579, 93d Cong., 2d sess., December 31, 1974, 88 Stat. 1896. 24. Illegal Immigration Reform and Immigrant Codified to 5 U.S. Code sec. 552a (1996). Responsibility Act of 1996,Public Law 104-208, 110 Stat. 3009-716, sec. 656(a). 18. Tax Reform Act of 1976, Public Law 94-455, 94th Cong., 2d sess., October 4, 1976, 90 Stat 25. Ibid., sec. 657. Virtually identical language 1525 ff., at 90 Stat. 1711-12. This law also made was included in the Personal Responsibility and Work mandatory use of the SSN for federal tax purpos- Opportunity Reconciliation Act of 1996, Public Law es a matter of statutory law rather than IRS regu- 104-193, 104th Cong., 2d sess., August 22, 1996, lation. See William H. Minor, “Identity Cards and 110 Stat. 2105, sec. 111. Databases in Health Care: The Need for Federal Privacy Protections,” Columbia Journal of Law and 26. Miller and Moore reported in 1995 that Social Problems, vol. 28, no. 2, 1995, pp. 253–96, at Drexler Technology Corporation recently had pp. 264–65 on this point. patented an “optically readable ID card . . . [that] can hold a picture ID and 1,600 pages of text,” 19. See Department of Health and Human cards that could be mass produced for less than Services, Unique Health Identifier for Individuals: A $5.00 each. John J. Miller and Stephen Moore, “A

29 National ID System: Big Brother’s Solution to Committee, Subcommittee on Immigration and Illegal Immigration,” Cato Policy Analysis no. 237 Claims, May 13, 1997. Available at http://www. (Washington, D.C.: Cato Institute, September 7, cato.org/testimony/ct-sm051397.html. Stephen 1995). Available at http://www.cato.org. Moore is an economist with the Cato Institute.

27. Illegal Immigration Reform and Immigrant 40. Job Training Partnership Act, Public Law 97-300, Responsibility Act of 1996,Public Law 104-208, 110 97th Cong., 2d sess., October 13, 1982, 96 Stat. Stat. 3009-719-20, sec. 657. 1322; Public Law 102-367, 102d Cong., 2d sess., September 7, 1992, 106 Stat. 1085, sec. 405(a). 28. For example, see H.R. 231, 105th Cong., 1st sess., January 7, 1997, a proposed bill “To improve 41. Personal Responsibility and Work Opportunity the integrity of the Social Security card and to Reconciliation Act of 1996, Public Law 104-193. provide for criminal penalties for fraud and relat- ed activity involving work authorization docu- 42. Although it contains information about all ments for purposes of the Immigration and working individuals, the National Directory of Nationality Act.” Section 1(c) of the bill stated: New Hires is housed within the federal govern- “NOT A NATIONAL IDENTIFICATION ment’s “Federal Parent Locator Service.” CARD—Cards issued pursuant to this section shall not be required to be carried upon one’s per- 43. Robert Pear, “Government to Use Vast son, and nothing in this section shall be con- Database to Track Deadbeat Parents,” New York strued as authorizing the establishment of a Times,September 22, 1997, the New York Times on national identification card.” the Web.

29. Privacilla.org, “Privacy and Federal Agencies: 44. Personal Responsibility and Work Opportunity Government Exchange and Merger of Citizens’ Reconciliation Act of 1996, Public Law 104-193, sec. Personal Information Is Systematic and Routine,” 313(b). Special Report, March 2001, p. 1 (available at http://www.privacilla.org). 45. Brigid McMenamin, “Payroll Paternalism,” Forbes,April 16, 2001, p. 114. 30. Ibid. 46. Personal Responsibility and Work Opportunity 31. Ibid., p. 3. Privacilla.org stated that “In fact, Reconciliation Act of 1996,Public Law 104-193, sec. 311. the list of programs notsubject to the Computer Matching and Privacy Protection Act is longer 47. Ibid., sec. 311, sec. 316, sec. 317. than the list of programs that are.” Emphasis in original. 48. Miller and Moore, “A National ID System: Big Brother’s Solution to Illegal Immigration.” 32. Code of Federal Regulations, Title 20, Chap. III, Subpart C, sec. 401.120, April 1, 1997. 49. Illegal Immigration Reform and Immigrant Responsibility Act, Public Law 104-208, sec. 403. 33. Ibid., sec. 401.25. 50. The basic program required the attorney gen- 34. Schwartz, “Data Processing and Government eral to secure participation by at least “5 of the 7 Administration: The Failure of the American States with the highest estimated population of Legal Response to the Computer,” p. 1357. aliens who are not lawfully present in the United States.” Ibid., sec. 401, 110 Stat. 3009-655 ff. 35. Ibid., p. 1367. 51. Ibid., sec. 403(a), 110 Stat. 3009-659 ff. 36. Ibid., pp. 1367-69. Schwartz cites Jerrold Brockmyre, director, Michigan Office of Child 52. Ibid., 110 Stat. 3009-662, referencing U.S. Support Enforcement, as quoted in Nancy Code,Title 8, sec. 1324a(a)(1)(A). See also U.S. Herndon, “Garnish: Dad,” Christian Science Code, Title 8, sec. 1324a(e)(4). Monitor,November 28, 1988, at 25. 53. Ibid., sec. 403(b), 110 Stat. 3009-662 ff. See 37. Ibid., p. 1369. also the discussion in the preceding section of this chapter of the now repealed sec. 656(b), 110 38. Social Security Number Confidentiality Act of Stat. 3009-718 (“state-issued drivers licenses and 2000, Public Law 106–433, 106th Cong., 2d sess., comparable identification documents”). November 6, 2000, 114 Stat. 1910 (H.R. 3218). 54. Ibid., sec. 403(c), 110 Stat. 3009-663 ff. At the 39. Stephen Moore, “A National Identification same time, the Immigration and Naturalization System,” testimony before the House Judiciary Service (INS) has moved toward a “machine read-

30 able passport program” for aliens. A federal statute Americans Runs into Hurdles,” New York Times, signed into law October 30, 2000, advanced a July 20, 1998, p. A1. planned automated entry-exit control system for aliens by making airlines’ and other carriers’ elec- 64. Department of Health and Human Services, tronic transmission of passenger data to the INS a Unique Health Identifier for Individuals: A White Paper, prerequisite for visa waivers for aliens traveling on secs. II(B) [“confidentiality right,” quoting the those carriers. See Visa Waiver Permanent Program President’s Quality Commission], II(C) [“not to Act, Public Law 106-396, 106th Cong., 2d sess., draw the boundaries . . . too narrowly”]. October 30, 2000, 114 Stat. 1637 ff. (H.R. 3767). Since U.S. citizens’ passports already are machine 65. Ibid., sec. III(A). readable, such automated passenger data collec- tion systems hold the potential for U.S. govern- 66. Ibid., secs. III(B)(1)-III(B)(3). ment tracking of U.S. citizens traveling abroad. 67. Ibid., sec. III(C)(2). 55. Ibid., sec. 404(h), 110 Stat. 3009-665. 68. Ibid., sec. III(C)(4). 56. “Cathy” is created by nationally syndicated cartoonist Cathy Guisewite. 69. Ibid., sec. III(E)(1).

57. Moore, “A National Identification System,” 70. White House Press Release, “Vice President Gore testimony May 13, 1997. Announces New Steps toward an Electronic Bill of Rights,” July 31, 1998. See also John Simons, “Gore to 58. Workforce Investment Act of 1998,Public Law Propose Consumer-Privacy Initiative,” Wall Street 105-220, 105th Cong., 2d sess., August 7, 1998, Journal, July 31, 1998, p. A12; Sheryl Gay Stolberg, 112 Stat. 936 ff., sec. 309, 112 Stat. 1082–83. “Privacy Concerns Delay Medical ID’s,” New York Times, August 1, 1998, the New York Times on the Web; 59. McMenamin, “Payroll Paternalism,” p. 120. Joel Brinkley, “Gore Outlines Privacy Measures, But Their Impact Is Small,” New York Times,August 1, 60. Moore, “A National Identification System,” 1998, the New York Timeson the Web. testimony May 13, 1997. He added: “I have worked in Washington for fifteen years mainly 71. For example, an HHS appropriations bill covering the federal budget, and I have never signed into law in December 2000 contained a encountered a government program that didn’t section that stated: “None of the funds made work—no matter how overwhelming the evidence available in this Act may be used to promulgate or to the contrary.” adopt any final standard under section 1173(b) of the Social Security Act (42 U.S.C. 1320d-2(b)) pro- 61. Department of Health and Human Services, viding for, or providing for the assignment of, a National Committee on Vital and Health unique health identifier for an individual (except Statistics, Toward a National Health Information in an individual’s capacity as an employer or a Infrastructure(Washington, D.C.: June 2000), sec. 5 health care provider), until legislation is enacted (available at http://ncvhs.hhs.gov/NHII2kReport. specifically approving the standard.” Consolidated htm). Quoted in Health Freedom Watch (March–April Appropriations Act, 2001, Public Law 106-554, 2001), p. 5 (http://www.forhealthfreedom.org). 106th Cong., 2d sess., December 21, 2000, 114 Stat. 2763, sec. 514 at 114 Stat. 2763A-71. Health 62. Steve Forbes, “Malpractice Bill,” Forbes, Insurance Portability and Accountability Act, Public October 6, 1997, p. 27. Ellyn E. Spragins and Mary Law 104-191, 104th Cong., 2d sess., August 21, Hager, “Naked before the World: Will Your 1996, 110 Stat. 1936, sec. 262(a), amending 42 Medical Secrets Be Safe in a New National U.S.C. 1301 et seq. by adding sec. 1173. Databank?” Newsweek,June 30, 1997, p. 84. Although the federal government already has 72. Spragins and Hager, “Naked before the access to millions of medical records through World,” p. 84. Medicare, Medicaid, and federal subsidies for State Children’s Health Insurance Programs, the uni- 73. Dr. Richard Sobel, Harvard Law School, quot- form electronic databases of health information ed in Sheryl Gay Stolberg, “Health Identifier for authorized by HIPAA involve the government in All Americans Runs into Hurdles,” p. A13. everyone’s health care, whether or not they receive federal subsidies. On the failure of the December 74. Tod Robberson, “Plan for Student Database 28, 2000, HHS final privacy regulations to safe- Sparks Fears in Fairfax,” Washington Post, January guard this information, see Chapter 6. 9, 1997, p. A01 (www.washingtonpost. com).

63. Sheryl Gay Stolberg, “Health Identifier for All 75. Educational Research, Development, Dissemination,

31 and Improvement Act of 1994, Public Law 103-227, and sec. 1232g(b)(1)(C). 103d Cong., 2d sess., Title IX, March 31, 1994, 108 Stat. 212 ff., sec. 912. 88. Quoted in Robberson, “Plan for Student Database Sparks Fears in Fairfax,” p. A01. 76. These include the National Institute on Student Achievement, Curriculum, and 89. Federal Deposit Insurance Corporation, Assessment; the National Institute on the Notice of Proposed Rulemaking, “Minimum Education of At-Risk Students; the National Security Devices and Procedures and Bank Institute on Educational Governance, Finance, Secrecy Act Compliance,” Federal Register,vol. 63, Policy-Making, and Management; the National December 7, 1998, pp. 67529–36. Withdrawal of Institute on Early Childhood Development and the “Know Your Customer” proposal was Education; and the National Institute on announced in Federal Deposit Insurance Postsecondary Education, Libraries, and Lifelong Corporation, Withdrawal of Notice of Proposed Education. See ibid., sec. 931. Rulemaking, “Minimum Security Devices and Procedures and Bank Secrecy Act Compliance,” 77. Ibid., Public Law 103-227, sec. 912. Federal Register, vol. 64, March 29, 1999, p. 14845. The FDIC received 254,394 comments on the 78. Ibid., sec. 941(f) (clearinghouses); sec. 951(d) proposed mandate for “Know Your Customer” (national library of education). The statute also programs, of which only 105 favored the pro- amended federal vocational education legislation posed rule. to require state boards of higher education to pro- vide data on graduation rates, job placement 90. Bank Secrecy Act of 1970, Public Law 91-508, rates, licensing rates, and high school graduate 91st Cong., 2d sess., Title I, October 26, 1970, 84 equivalency diploma (GED) awards to be “inte- Stat. 1114. grated into the occupational information system” developed under federal law. Ibid., sec. 991. 91. Ibid., sec. 101.

79. School-to-Work Opportunities Act of 1994, Public 92. Although the Bank Secrecy Act’s power Law 103-239, 103d Cong., 2d sess., May 4, 1994, extended to microfilming all checks and deposits, 108 Stat. 568 ff., sec. 404. early on the secretary of the treasury decided to mandate microfilming of checks and deposits of 80. The functions of the National Center for $100 or more. Education Statistics were amended by the Improving America’s Schools Act, Public Law 103-382, 93. Public Law 91-508, Title I, sec. 123. 103d Cong., 2d sess., October 20, 1994, 108 Stat. 4029 ff., Title IV, secs. 401 ff., at sec. 403. Title IV of 94 The Currency and Foreign Transactions the Improving America’s Schools Act was entitled Reporting Act comprised Title II of the same the National Education Statistics Act. statute: Currency and Foreign Transactions Reporting Act, Public Law 91-508, 91st Cong., 2d sess., Title 81. National Education Statistics Act of 1994, Public II, October 26, 1970, 84 Stat. 1118; see sec. 221, Law 103-382, 103d Cong., 2d sess., Title IV, sec. 222. The act also required detailed reporting October 20, 1994, 108 Stat. 4029 ff., sec. 404 (“vio- regarding monetary instruments of $5,000 or lence”), sec. 411 (“grades 4, 8, and 12”). more received from or sent to individuals in places outside the United States. Regarding the 82. Ibid., sec. 405 (“may consider appropriate”), federal government’s exuberance in applying for- sec. 410 (“uniform information”). feiture penalties under this statute and a 1998 U.S. Supreme Court decision disallowing one 83. Ibid., sec. 411. exercise of such power, see Roger Pilon, “High Court Reins in Overweening Government,” Wall 84. Ibid., sec. 408. Street Journal,June 23, 1998, p. A20; and James Bovard, “The Dangerous Expansion of Forfeiture 85 Ibid., sec. 408(b)(7). Laws,” Wall Street Journal,December 29, 1997, p. A11. The U.S. Supreme Court decision discussed 86. Code of Federal Regulations,Title 34, Subtitle A, in Pilon’s article was United States v. Bajakajian, 524 July 1, 1997, sec. 5b.9. U.S. 321 (1998).

87. Family Educational Rights and Privacy Act, Public 95. California Bankers Association v. Shultz, 416 U.S. Law 93-380, 93d Cong., 2d sess., Title V, August 21 (1974). 21, 1974, 88 Stat. 571, as amended, sec. 513. Emphasis added. Codified as U.S. Code, Title 20, 96. Ibid., 416 U.S. 51-52 (“must wait”); 416 U.S. sec. 1232g, 1998. See 20 U.S.C. sec. 1232g(b)(3) 96-97 (Marshall dissenting).

32 97. Ibid., 416 U.S. 97. and to “acquire and retain the shares of any com- pany engaged in any activity” that the regulators 98. United States v. Miller, 425 U.S. 435 (1976). determine to be “financial in nature or incidental to such financial activity,” or “complementary to 99. Ibid., 425 U.S. 442-43. a financial activity” so long as it “does not pose substantial risk to the safety or soundness of 100. Right to Financial Privacy Act, Public Law 95- depository institutions or the financial system 630, 95th Cong., 2d sess., Title XI, November 10, generally.” Ibid., sec. 103(a). The law specifically 1978, 92 Stat. 3697 ff.; codified to U.S. Code,Title stated that “[l]ending, exchanging, transferring, 12, sec. 3401 ff. investing for others, or safeguarding money or securities” and “[p]roviding financial, investment, 101. Ibid., sec. 3402. or economic advisory services, including advising an investment company” were to be considered as 102 . The act also permits financial institutions to activities “financial in nature.” “Insuring, guaran- notify government authorities of information teeing, or indemnifying against loss, harm, dam- “which may be relevant to a possible violation of age, illness, disability, or death, and acting as a any statute or regulation,” but such information principal, agent, or broker for purposes of the is confined to identifying information concern- foregoing” also were designated as permitted ing the account and the “nature of any suspected activities of financial holding companies. Ibid. illegal activity.” Ibid., sec. 3403. 108. Ibid., sec. 501(a). 103. Ibid., sec. 3401 (“law enforcement inquiry”), sec. 3408 (notification by mail), sec. 3412 (sharing 109. Ibid., sec. 502(e). records with other agencies). 110. Ibid., sec. 502(b). 104. Ibid., sec. 3413. These include, among other things, disclosure to the IRS pursuant to the 111. Privacy Act of 1974, Public Law 93-579, 93d Internal Revenue Code; disclosure pursuant to Cong., 2d sess., December 31, 1974, 88 Stat. 1897, “legitimate law enforcement inquiry respecting sec. 2(a). Codified to U.S. Code, Title 5, sec. 552a name, address, account number, and type of (1998). account of particular customers”; disclosure pur- suant to “Federal statute or rule promulgated 112. Freedom of Information Act,Public Law 89-554, thereunder”; disclosures pursuant to “considera- 89th Cong., 2d sess., September 6, 1966, 80 Stat. tion or administration” of Government loans or 383, as amended. Codified to U.S. Code, Title 5, loan guarantees; disclosure sought to implement sec. 552 (1998). withholding taxes on Federal Old-Age, Survivors, and Disability Insurance Benefits; and disclosure 113. Quoted in Judith Beth Prowda, “Privacy and to the Federal Housing Finance Board or Federal Security of Data,” Fordham Law Review, vol. 64, home loan banks. Moreover, in 1997 a district 1995, pp. 738–69, at pp. 749–50. court held that the Financial Privacy Act does not apply to state or local government attempts to 114. Computer Matching and Privacy Protection Act, access these records. See U.S. v. Zimmerman,957 Public Law 100-503, 100th Cong., 2d sess., F.Supp. 94 (N.D. W.Va., 1997). October 18, 1988, 102 Stat. 2507–14, sec. 2; codi- fied at U.S. Code, Title 5, sec. 552a(o). 105. Government authorities may obtain such emergency access if they declare that “delay in 115. Privacilla.org, “Privacy and Federal Agencies: obtaining access to such records would create Government Exchange and Merger of Citizens’ imminent danger of—(A) physical injury to any Personal Information Is Systematic and Routine,” person; (B) serious property damage; or (C) flight Special Report, March 2001, p. 1 (47 database to avoid prosecution,” provided that they subse- exchanges), p. 4 (“regularizing transfer”). quently file in court a sworn statement by a super- Available at http://www.privacilla.org. visory official and provide notification as specified in the act. Right to Financial Privacy Act, Public Law 116. Office of Management and Budget, Office of 95-630, sec. 3414(b). Information and Regulatory Affairs,Information Collection Budget of the United States Government--Fiscal 106. Gramm-Leach-Bliley Act, Public Law 106-102, Year 1999(Washington, D.C.: U.S. Government 106th Cong., 1st sess., November 12, 1999, 113 Printing Office, 1999), p. 10. Stat. 1338 (S. 900). 117. Office of Management and Budget, Office of 107. The Gramm-Leach-Bliley Act allowed finan- Information and Regulatory Affairs, Information cial holding companies to “engage in any activity” Collection Budget of the United States Government--Fiscal

33 Year 2000(Washington, D.C.: U.S. Government Medical Identification Law,” posted by Cable Printing Office, 2000), p. 83. News Network, July 23, 1998 (www.CNN.com).

118. Quoted in Stolberg, “Health Identifier for All 127. White House Press Release, “Vice President Americans Runs into Hurdles,” p. A13. Gore Announces New Steps Toward An Electronic Bill of Rights,” July 31, 1998. 119. Privacilla.org, “Privacy and Federal Agencies: Government Exchange and Merger of Citizens’ Personal 128. John Markoff, “U.S. Drawing Plan That Will Information Is Systematic and Routine,” pp. 4–5. Monitor Computer Systems,” New York Times, July 28, 1999, p. A1, A16. 120. Quoted by Wall Street Journal Board of Editors, “Politics and the IRS,” Wall Street Journal, 129. John Simons, “White House Computer- January 9, 1997, p. A10. Monitoring Plan Raises Concerns over Civil Liberties,” Wall Street Journal,July 29, 1999, p. A4. 121. Shelley L. Davis, Unbridled Power: Inside the Secret Culture of the IRS(New York: HarperCollins, 130. Ibid., quoting James Dempsey. For an electronic 1997), pp. 164–68. copy of the government’s draft plan (“National Plan for Information Systems Protection,” dated June 7, 122. As quoted above in Stolberg, “Health Identifier 1999) see the Center for Democracy and Technology’s for All Americans Runs into Hurdles,” p. A13. website, http:// www.cdt.org/policy/terrorism/fidnet.

123. Solveig Singleton, “Don’t Sacrifice Freedom for 131. Paul M. Schwartz, “The Protection of Privacy ‘Privacy,’” Wall Street Journal, June 24, 1998, p. A18. in Health Care Reform,” Vanderbilt Law Review, vol. 48, no. 2, 1995, pp. 295–347, at p. 307. 124. H. L. Mencken, “The Suicide of Democracy,” in Mayo DuBasky, ed., The Gist of Mencken: Quotations from 132. John Perry Barlow, quoted in Judith Beth America’s Critic (May 12, 1940, Baltimore Sun; reprint, Prowda, “Privacy and Security of Data,” Fordham Metuchen, N.J.: Scarecrow Press, 1990), p. 350. Law Review, vol. 64, 1995, pp. 738–69, at p. 765. Prowda cited Jeff Rose, “Right to E-mail Privacy 125. Albert Jay Nock, “The Criminality of the Would Seem Self-Evident, San Diego Union State,” in Charles H. Hamilton, ed., The State of the Tribune,March 1, 1994 (Computerlink), at 3, as Union: Essays in Social Criticism (Indianapolis: the source for the Barlow quotation. Liberty Fund, 1991), p. 274. Emphasis in original. 133. Bernadine Healy, “Hippocrates vs. Big 126. Associated Press, “Congress Won’t Delay Brother,” New York Times,July 24, 1998, p. A21.

Published by the Cato Institute, Cato Briefing Papers is a regular series evaluating government policies and offering proposals for reform. Nothing in Cato Briefing Papers should be construed as necessarily reflecting the views of the Cato Institute or as an attempt to aid or hinder the passage of any bill before Congress. Additional copies of Cato Briefing Papers are $2.00 each ($1.00 in bulk). To order, or for a complete listing of available studies, write the Cato Institute, 1000 Massachusetts Avenue, N.W., Washington, D.C. 20001, call (202) 842-0200 or fax (202) 842-3490. Contact the Cato Institute for reprint permission.

34