No U.S. Action, So States Move on Privacy Law

Over two dozen privacy laws have passed this year in more than 10 states, in places as different as Oklahoma and California. Many lawmakers say that news reports of widespread surveillance by the National Security Agency have led to more support for the bills among constituents. And in some cases, the state lawmakers say, they have felt compelled to act because of the stalemate in Washington on legislation to strengthen privacy laws.

“Congress is obviously not interested in updating those things or protecting privacy,” said Jonathan Stickland, a Republican state representative in Texas. “If they’re not going to do it, states have to do it.”

For Internet companies, the patchwork of rules across the country means keeping a close eye on evolving laws to avoid overstepping. Many companies have an internal team to deal with state legislation. And the flurry of legislation has led some companies, particularly technology companies, to exert their lobbying muscles — with some success — when proposed measures stand to harm their bottom lines.

“It can be counterproductive to have multiple states addressing the same issue, especially with online privacy, which can be national or an international issue,” said Michael D. Hintze, chief privacy counsel at Microsoft, who added that at times it can create “burdensome compliance.” For companies, it helps that state measures are limited in their scope by a federal law that prevents states from interfering with interstate commerce.

This year, Texas passed a bill introduced by Mr. Stickland that requires warrants for email searches, while Oklahoma enacted a law meant to protect the privacy of student data. At least three states proposed measures to regulate who inherits digital data, including Facebook passwords, when a user dies.

Some of the bills extend to surveillance beyond the web. Eight states, for example, have passed laws this year limiting the use of drones, according to the American Civil Liberties Union, which has advocated such privacy laws. In Florida, a lawmaker has drafted a bill that would prohibit schools from collecting biometric data to verify who gets free lunches and who gets off at which bus stop. Vermont has limited the use of data collected by license plate readers, which are used mostly by police to record images of license plates.

California, long a pioneer on digital privacy laws, has passed three online privacy bills this year. One gives children the right to erase social media posts, another makes it a misdemeanor to publish identifiable nude pictures online without the subject’s permission, and a third requires companies to tell consumers whether they abide by “do not track” signals on web browsers.

But stiff lobbying efforts were able to stop a so-called right to know bill proposed in California this year that stood to hurt the online industry. The bill would have required any business that “retains a customer’s personal information” to share a copy of that information at the customer’s request, as well as disclose which third parties have received the information. The practice of sharing customer data is central to digital advertising and to the large Internet companies that rely on advertising revenue.

“ ‘Right to know’ is an example of something that’s not workable,” said Jim Halpert, a lawyer with the national firm DLA Piper, who leads an industry coalition that includes Amazon, Facebook and Verizon. “It covers such a broad range of disclosures. We advocated against it.”

More than a year ago, the White House proposed a consumer privacy bill of rights, but Congress has not yet taken on the legislation. And a proposed update to the 27-year-old Electronic Communications Privacy Act has stalled. The proposal would require law enforcement agencies to obtain a warrant, based on probable cause, before they could read through emails.

Several legislators said they felt compelled to act because Congress had not. “They don’t act in the best interest unless it’s in their best interest,” said Daniel Zolnikov, a first-time legislator in Montana. Mr. Zolnikov, a Republican, suggested that the lack of action was because of lobbying efforts from “special interests” on Capitol Hill.

So Mr. Zolnikov took up the privacy issue in his state house: Montana became the first state in the nation this year to pass a law that requires police to obtain a search warrant before it can track a suspect’s whereabouts through cellphone records.

According to a survey conducted in July by the Pew Internet Center, most Americans said they believed that existing laws were inadequate to protect their privacy online, and a clear majority reported making great efforts to mask their identities online. Some of those surveyed said they cleared browsing histories, deleted social media posts or used virtual networks to conceal their Internet Protocol addresses — and a few even said they used encryption tools.

Many states have already responded to those opinions. In the last couple of years, about 10 states have passed laws restricting employers from demanding access to their employees’ social media accounts.

California set the stage on digital privacy 10 years ago with a law that required organizations, whether public or private, to inform consumers if their personal data had been breached or stolen. Several states followed, and today, nearly every state has a data breach notification law.

This year, California amended that landmark law, adding an Internet user’s login name and password to the menu of personal information that is covered. The California attorney general’s office also has a full-time unit to enforce digital privacy laws.

But even in California, the steps taken on privacy legislation are not sweeping overhauls like those supported by the White House. And some bills in the state never become law at all. Last year, the Legislature passed a bill compelling police to seek a warrant before searching cellphone records to track a suspect’s location. Gov. Jerry Brown vetoed it, saying it did not strike “the right balance” between the needs of citizens and the police.

John Pezold, a Republican representative in Georgia, said that issues like creating jobs were more pressing than privacy for many of his constituents. But he said the issue of digital privacy was beginning to bubble up, especially because of the recent reports on eavesdropping by the federal government.

“They’re becoming increasingly wary that their lives are going to be no longer their own,” said Mr. Pezold, who plans to introduce a broad consumer privacy bill in the next legislative session. “We have got to protect that.”

Bits Blog: With Montana’s Lead, States May Demand Warrants for Cellphone Data

The law rarely keeps up with technological advances – except in Montana.

Legislators in that state recently passed a bill that requires the police to obtain a search warrant, based on probable cause, before they can use a cellphone carrier’s records to establish a suspect’s location.

That kind of “metadata” can be incredibly valuable, as law enforcement agencies discovered long before the rest of us. The cellphones we carry everywhere establish a clear log of our daily travels and can go a long way in telling the story of our lives.

In recognition of that fact, the Montana Legislature this spring passed a location information privacy bill, which requires a search warrant for location information recorded by an “electronic device.” There are exceptions to the warrant requirement, including when the cellphone is reported stolen or to respond to a cellphone user’s emergency call.

Steve Bullock, the governor of Montana, signed it into law on May 6. The American Civil Liberties Union, which tracks cellphone tracking laws across the country, called it the first such state legislation.

In so doing, Montana stole California’s thunder: that state’s Legislature had passed a warrant law for location tracking last year, but Gov. Jerry Brown vetoed it, saying that it did not “strike the right balance” between the needs of citizens and law enforcement.

Over a dozen other states have eyed similar measures just this year. In Maine, a location information privacy bill went to the governor’s desk last Wednesday. In Texas, a similar bill failed to muster enough votes in the Statehouse. The Massachusetts Legislature is scheduled to hold a hearing next Tuesday on a measure that would require search warrants for location records as well as content of cellphone communications.

Congress has been slow to act on the issue. Bills have been introduced in both the House of Representatives and the Senate, with little movement. The courts meanwhile have rendered mixed verdicts on how law enforcement can extract location history from telecommunications carriers.

Among the most remarkable is an armed robbery trial in Maryland, where the police obtained 221 days of cellphone location data for the suspects. The law enforcement authorities obtained a court order from a magistrate, but not a warrant.

The A.C.L.U., along with several other groups, filed an amicus brief in the case this week in the Fourth Circuit Court of Appeals, arguing that at a minimum, the police should obtain a warrant, based on probable cause, to gain access to cellphone location records.

The Supreme Court has yet to weigh in on the legal limits of location tracking using a cellphone, though it ruled in a landmark 2012 case that the police must obtain a search warrant before placing a GPS tracking device on a suspect’s vehicle.

Major Banks Aid in Payday Loans Banned by States

With 15 states banning payday loans, a growing number of the lenders have set up online operations in more hospitable states or far-flung locales like Belize, Malta and the West Indies to more easily evade statewide caps on interest rates.

While the banks, which include giants like JPMorgan Chase, Bank of America and Wells Fargo, do not make the loans, they are a critical link for the lenders, enabling the lenders to withdraw payments automatically from borrowers’ bank accounts, even in states where the loans are banned entirely. In some cases, the banks allow lenders to tap checking accounts even after the customers have begged them to stop the withdrawals.

“Without the assistance of the banks in processing and sending electronic funds, these lenders simply couldn’t operate,” said Josh Zinner, co-director of the Neighborhood Economic Development Advocacy Project, which works with community groups in New York.

The banking industry says it is simply serving customers who have authorized the lenders to withdraw money from their accounts. “The industry is not in a position to monitor customer accounts to see where their payments are going,” said Virginia O’Neill, senior counsel with the American Bankers Association.

But state and federal officials are taking aim at the banks’ role at a time when authorities are increasing their efforts to clamp down on payday lending and its practice of providing quick money to borrowers who need cash.

The Federal Deposit Insurance Corporation and the Consumer Financial Protection Bureau are examining banks’ roles in the online loans, according to several people with direct knowledge of the matter. Benjamin M. Lawsky, who heads New York State’s Department of Financial Services, is investigating how banks enable the online lenders to skirt New York law and make loans to residents of the state, where interest rates are capped at 25 percent.

For the banks, it can be a lucrative partnership. At first blush, processing automatic withdrawals hardly seems like a source of profit. But many customers are already on shaky financial footing. The withdrawals often set off a cascade of fees from problems like overdrafts. Roughly 27 percent of payday loan borrowers say that the loans caused them to overdraw their accounts, according to a report released this month by the Pew Charitable Trusts. That fee income is coveted, given that financial regulations limiting fees on debit and credit cards have cost banks billions of dollars.

Some state and federal authorities say the banks’ role in enabling the lenders has frustrated government efforts to shield people from predatory loans — an issue that gained urgency after reckless mortgage lending helped precipitate the 2008 financial crisis.

Lawmakers, led by Senator Jeff Merkley, Democrat of Oregon, introduced a bill in July aimed at reining in the lenders, in part, by forcing them to abide by the laws of the state where the borrower lives, rather than where the lender is. The legislation, pending in Congress, would also allow borrowers to cancel automatic withdrawals more easily. “Technology has taken a lot of these scams online, and it’s time to crack down,” Mr. Merkley said in a statement when the bill was introduced.

While the loans are simple to obtain — some online lenders promise approval in minutes with no credit check — they are tough to get rid of. Customers who want to repay their loan in full typically must contact the online lender at least three days before the next withdrawal. Otherwise, the lender automatically renews the loans at least monthly and withdraws only the interest owed. Under federal law, customers are allowed to stop authorized withdrawals from their account. Still, some borrowers say their banks do not heed requests to stop the loans.

Ivy Brodsky, 37, thought she had figured out a way to stop six payday lenders from taking money from her account when she visited her Chase branch in Brighton Beach in Brooklyn in March to close it. But Chase kept the account open and between April and May, the six Internet lenders tried to withdraw money from Ms. Brodsky’s account 55 times, according to bank records reviewed by The New York Times. Chase charged her $1,523 in fees — a combination of 44 insufficient fund fees, extended overdraft fees and service fees.

For Subrina Baptiste, 33, an educational assistant in Brooklyn, the overdraft fees levied by Chase cannibalized her child support income. She said she applied for a $400 loan from Loanshoponline.com and a $700 loan from Advancemetoday.com in 2011. The loans, with annual interest rates of 730 percent and 584 percent respectively, skirt New York law.

Ms. Baptiste said she asked Chase to revoke the automatic withdrawals in October 2011, but was told that she had to ask the lenders instead. In one month, her bank records show, the lenders tried to take money from her account at least six times. Chase charged her $812 in fees and deducted over $600 from her child-support payments to cover them.

“I don’t understand why my own bank just wouldn’t listen to me,” Ms. Baptiste said, adding that Chase ultimately closed her account last January, three months after she asked.

A spokeswoman for Bank of America said the bank always honored requests to stop automatic withdrawals. Wells Fargo declined to comment. Kristin Lemkau, a spokeswoman for Chase, said: “We are working with the customers to resolve these cases.” Online lenders say they work to abide by state laws.