The current wave of privacy scholars has a lot to keep up with. University of Minnesota School of Law Associate Dean for Academic Affairs Bill McGeveran is at the forefront of trying to get students up to speed. Not only does McGeveran do so through his teachings at Minnesota, but he also published a casebook, "Privacy and Data Protection Law," which is being used as a core text by other universities offering data privacy courses. Additionally, McGeveran has a background in crafting the laws he teaches about, having worked previously as a senior legislative aide to U.S. Sen. Chuck Schumer, D-N.Y., when Schumer was seated in the U.S. House.
In this Member Spotlight, McGeveran discusses the state of privacy in academia, the privacy aspects of his institution's response to COVID-19, and his thoughts on the future of state privacy laws and its many potential lenses.
The Privacy Advisor: Let’s start with privacy in academia. We sit here and talk about how privacy professionals are covering a lot of ground these days in the space. Does your teaching provide that broad coverage or are you more narrow with the topics you’re presenting?
McGeveran:
The Privacy Advisor: Is there one topic you’re hammering away at that the privacy community may overlook while you perceive it to be crucial knowledge?
McGeveran: Every teacher is different with what they emphasize. I’m certainly trying to help students see, among many other things, the tenacity of the paradigm presented by consent or notice and choice, and its shortcomings. We’re at an inflection point in privacy law where we have relied heavily on disclosures and opt outs. Privacy experts know all the evidence is telling us that’s not doing the trick. Laws are just now figuring out what might cut it instead. Also, I try to go into the importance of understanding how multi-layered privacy law is. Having a student late in the course be able to see a problem and spot all the different legal interventions that might matter there is pretty fulfilling.
The Privacy Advisor: Does the privacy boom we’re seeing extend to the college students as far as their interests and potential career paths go?
McGeveran: There’s great growth in schools. There’s a ways to go and some schools don’t offer even one basic data privacy course. But with the places that do have it, and there’s more of them all the time now, the number of interested students is mushrooming. It’s in the news and people are just generally more conscious of it, but people also see it as a viable career path that they didn’t necessarily see 10 years ago. I have an old IAPP mailer taped to my office door that says “Privacy’s not dead, it’s hiring.” That’s an important message for students to hear. I do privacy pathways for the IAPP here at the university where students get their certification and get a shadowing opportunity with somebody in the Twin Cities privacy community, which allows them to hear all about the different paths people have taken to the space. Even there you see some of the veterans that stumbled upon it by accident.
The Privacy Advisor: As associate dean for the law school, you were in charge of establishing COVID-19 protocols and general responses ahead of a return to campus. What has that looked like from a privacy perspective?
McGeveran: I think my institution has been pretty careful about privacy. For example, the administration is giving contact tracing information, but it’s anonymized so you’re not necessarily exposing individuals. I’ve also been taking my son on college tours and there is one school I won’t name that uses the CLEAR Health Pass app to prove vaccination status, including the facial recognition components, just to be the parent on campus tagging along for the tour. So there’s definitely some schools that have not figured this out yet or a way that is respectful of the larger privacy implications, but I think Minnesota has been good and conscious about people’s rights. Like we have exemptions for the vaccine mandates and mask requirements in place, but we find out only that people have attested and not what they’ve said. So overall I think it’s done pretty well.
The Privacy Advisor: You were a leading voice in the Uniform Law Commission’s efforts to draw up a unified privacy law framework, serving as the committee's rapporteur before COVID-19 obligations at the university pulled you away from the process halfway through. You’ve read the final draft of the Uniform Personal Data Protection. What do you think of the final product and the tact it took?
McGeveran: We’re seeing this play out as U.S. Congress and individual states debate the issue. The ULC process is a radical consensus-driven process. Anybody can be an observer and show up to these meetings, and there’s input from all over the place. It’s also voted on in various stages with representation from all over the place. It’s never the case that the final product reflects any individual’s full set of preferences. That goes for the rapporteur, the chair or anyone. I think there’s a lot of value to having a uniform floor, because we are seeing post-CPRA that other states are doing things that overlap, but not entirely with California. I don’t think that serves anybody’s interests. I’m sure people have lots of things they would like to see added to it, but it’s still better to have a floor than not.
The Privacy Advisor: I and many others agree with you that uniformity is a goal in state privacy law efforts. But can these efforts to piecemeal provisions from various proposals, thus creating common threads and alignment of laws in different states, as effective as devising that unified standard?
McGeveran: You hope the end goal of things isn’t necessarily uniform, but maybe consistent is the right term. It doesn’t have to perfectly match up, but it needs to be something a company operating in a lot of jurisdictions can do the right thing without a lot of administrative effort. But all of common law and tort law emerged with different experiments in different places that eventually cohered. That’s often how the law operates. That’s in some ways how it’s operating on an international level right now where you have some countries going for GDPR adequacy and then others like the U.K. taking the GDPR model and sanding off some of the perceived rough edges. The word uniformity just misleads us sometimes when we really want consistency and energy. Piecemealing could provide both those.
The Privacy Advisor: Hit us with your 2022 state and federal privacy law predictions. Will this be a year to remember or are we looking at something equal to or less than what we saw with 2021’s outcome?
McGeveran: Political predictions are always hazardous. I think we’re going to see the continued passage of laws, but I don’t foresee this avalanche. It’s an election year. The California law with CPRA is still rolling itself out, which might make people kind of wait a little longer to see how it works on the ground with regulations and the privacy regulator. It’s probably going to be more of a state here and there, but lots more energy, hearings and movement. However, I can confidently predict there’s almost zero chance of anything happening in U.S. Congress. Tons of people are working hard to make it happen, but it’s not there yet.
Photo by Keagan Henman on Unsplash
