Utility companies will no longer share data with ICE — but many loopholes remain

A nationwide group of companies from the power, water, cable TV, and telecommunications sectors have agreed that they will no longer sell customer information to data brokers used by ICE and law enforcement agencies. The news has been hailed as an important step by privacy advocates, who have long criticized the practice as a privacy violation that lets law enforcement obtain personal information from third parties without appropriate review.

The announcement comes from a letter sent Wednesday by Senator Ron Wyden (D-OR) to the Consumer Financial Protection Bureau (CFPB), and reported by The Washington Post.

The companies concerned belong to the National Consumer Telecom & Utilities Exchange (NCTUE), a credit reporting agency that lets members log the payment histories of their customers in a shared central database. This data was then shared with credit bureau Equifax, which uses such payment information records in credit score reporting.

However, the same data was then resold by Equifax to CLEAR — an extensive database of personal information that was used by ICE investigators, as reported by the Post in February.

According to the letter sent by Sen. Wyden, the NCTUE directed Equifax to stop selling data to CLEAR as of October 2021. However, any customer data in the database before this point will remain accessible and includes some information — such as dates of birth and Social Security numbers — that will not change over time.

Wyden’s letter asks the CFPB to prevent credit agencies from selling personal data to law enforcement agencies via data brokers — a practice that the senator has campaigned against for years.

“Every branch of government has ignored the corrosive effect of data brokers for decades,” said Sen. Wyden in an email statement to The Verge. “Investigations by journalists, researchers and my office have finally shined a light on just how widespread the sale of Americans private data is. I’ve told anyone who will listen that Congress’s top tech priority should be passing strong legislation to protect Americans’ privacy and security. I hope Democrats don’t pass on the chance to put privacy protections into black letter law until it’s too late.”

The use of data obtained from third-party brokers in law enforcement has drawn strong criticism from privacy advocates, since it effectively creates a loophole that lets agencies skirt processes of judicial review, such as the need to obtain a warrant.

“Part of why utility records are so insidious is that you can opt out of a lot of digital services, but it’s hard to opt out of having electricity or running water,” said Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project (STOP). “To make those lifeline utilities yet another tracking tool for ICE put undocumented families in an intolerable position.”

“No matter where this information is coming from, the police shouldn’t be able to buy their way around the constitution,” Cahn added.

The CLEAR database, which is operated by media company Thomson Reuters, is currently subject to a class action lawsuit filed in California by STOP, Gibbs Law Group, Justice Catalyst Law, and Gupta Wessler PLLC. The lawsuit contends that the sale of information in the database violates the privacy of California residents. A motion to dismiss the lawsuit from Thomson Reuters was rejected by a judge in April. The case is currently at the discovery phase.