The New State Privacy Officer Is Appointed — Now What?

The Banjo controversy that engulfed Utah highlighted the dangers associated with government use of surveillance software and sparked the passage of Utah’s Privacy Protection Amendments (PPA). 

This change of law came on the heels of Utah’s decision to suspend, and then cancel, its $21 million contracts with the private company, Banjo. These contracts were created to build an intricate, real-time surveillance system, but negotiations unraveled following reports that Banjo’s founder and CEO had past connections to neo-Nazi groups. 

These revelations triggered a review of the services promised by these contracts. This review found that the building of a massive government surveillance database is no longer a dystopian speculation, but a reality. The software boasted the ability to listen to 911 calls, scan social media posts, monitor traffic cameras, and aggregate a large amount of data — providing quick and precise details of individual behavior in a dashboard.

The privacy concern is not that numerous technological data points or databases exist. It’s that, in each case, information about individuals is collected for a specific purpose and then later used for a completely different purpose.

Although Utah’s contract with Banjo died, citizens lack assurance that a similar system will not be adopted by state agencies in the future.

PPA passed unanimously, showing a powerful consensus by policymakers to address the problems arising from the breakneck speed with which personally invasive technologies are currently flooding the market.

In December 2021, State Auditor John Dougall appointed Whitney Phillips as State Privacy Officer, a position created by the passage of the PPA. Phillips’ role is part of the law’s rigorous vetting process, designed to ensure government use of current and emerging technology does not violate citizens’ privacy rights. 

Phillips’ duties include investigating and reviewing government privacy practices, making recommendations for reforms regarding the state’s handling of citizens’ information, and updating the public of these findings.

Phillips will also work with a review committee created by the PPA to assist in the work of analyzing the merits, problems, and constitutional concerns of existing and future technology used by agencies to collect, retain, and distribute data within Utah’s executive branch.

Phillips comes to her position well qualified. Prior to her current appointment, she served over five years as the Chief Privacy Officer for the Utah State Board of Education. As she moves forward with her review, four problems should be prioritized.

First, the underlying problem presented by systems such as Banjo: data sharing between government departments. When the government collects information to be used for one purpose, it should not be used for any other purpose.

Second, all personally identifiable information collected by the state, such as information required for the issuance of a driver’s license, should not be made available to federal law enforcement or public universities for health care studies absent individual, informed consent. 

Third, information collected by the state related to individuals’ use of controlled substances prescribed to them for medicinal use should not be exposed to law enforcement without a proper warrant.

Fourth, the use of Utah’s emergency cell phone alert system and technology intended for use by DOT to track the spread of COVID-19 should be immediately reviewed. 

Utah needs to adopt protections and restrictions for government use of data after it is collected for one purpose by a government agency or its legal agents.

Eventually, the digitization of our biometric data (facial, retinal, voice, DNA, fingerprints, etc.) will be so commonplace that it will become impossible to ignore the consequences that come with unfettered government access and use. 

But by then, it will be too late.

How Utah approaches these important issues now will have significant repercussions for generations to come. The work of Phillips and her colleagues will be vital in protecting the privacy of Utahns. Now is the time to act in defense of Utahns’ privacy interests. 

If we fail to maintain strong boundaries between citizen and state, we risk creating a society in which privacy itself becomes an archaic concept, known only to students of history.