California AG office on March 11th released a second round of modifications for their proposed regulations to implement the California’s Consumer Privacy Act, aka CCPA, among which Section 999.315(d) gives consumers a global opt-out option through a single-click button embedded in the browser. If the rule gets passed, consumers can stop companies from “selling” (as broadly defined by CCPA) their personal data everywhere just by clicking that one button, and companies have to respect it even if the opt-out conflicts with the existing privacy control set up previously by the same consumer with the same company. Two weeks later, a group of advertising industrial associations challenged the proposed government rule for violating their First Amendment rights. More specifically, the ads group argued that their dissemination of consumers’ personal data they collected constitutes corporate commercial speech, which is protected under the First Amendment. Their argument details can be found here.
This blog post is not to rebut or support the ads group, but I find the interweaving of commercial speech and privacy regulation fascinating. Having been working in the privacy field for a few years, I understand how privacy protection can accomplish the First Amendment rights, or the opposite. For example, privacy is essential to the anonymity right, which is vital to free speech; and location tracking can deter people from visiting a religious place or attending an anti-war protest. Without privacy, free speech gets handicapped. Now the ads group claimed that privacy conflicts with free speech, that the privacy rule restricting companies from selling personal data constitutes a threat to the constitutionally protected commercial speech. Can these arguments co-exit? With that curiosity, I dived into my law school notes of the First Amendment class, trying to tease out why and how.
Starting from the three landmark cases
The Supreme Court first time officially granted commercial speech the First Amendment protection in the 1976 case Virginia State Board of Pharmacy v. Virginia Citizens Consumer Council Inc. A consumer group challenged a state law prohibiting pharmacies from advertising the prices of prescription drugs, arguing the law impeded their right of receiving advertising information from pharmacists. At that time, when deciding validity of commercial regulations, the Supreme Court – under the impact of the post-Lochner era – tended to promote economic liberty and thus strike down commercial regulations. But Justice Blackmum who wrote for the majority distinguished Virginia Pharmacy from the precedents, reasoning that this case was not just about commercial regulation, but also the free flow of information. Finding advertising facilitate the free flow of information and help consumers make well-informed decisions among the drugs with strikingly varying prices, Blackmum concluded that advertising, which is a typical type of commercial speech, should get protected by the First Amendment, though the protection may not be of the same degree as compared to other core First Amendment speeches like political speech.
Four years later came Central Hudson Gas & Electric Corp. v. Public Service Commission, the case establishing that famous four-prong test for assessing the constitutionality of government regulations challenged under the commercial speech doctrine. Central Hudson-test requires four factors that courts should look into when deciding such cases: (1) whether the speech concerns lawful activity and is not misleading, (2) whether the government has a substantial interest in regulating, (3) whether the regulation directly and materially advances that substantial interest of the government, and (4) whether the regulation is narrowly tailored. This is also known as the intermediate level of scrutiny within the First Amendment jurisprudence. Simply speaking, Central Hudson allows a government to regulate commercial speech, but that regulation must be necessary and approportionate to address a substantial state interest.
In the following years, the Supreme Court revisited and further refined the Central Hudson-test in a few other cases. The most relevant one in respect to today’s data practice in the digital era is Sorrell v. IMS Health Inc, decided in 2011. The state Vermont banned the sale of prescriber-identifying information – the data reflecting doctor’s prescription practices – by pharmacies to pharmaceutical manufacturers for marketing purposes. Many pharmacies were selling that data to data brokers like IMS Health, who then re-sold the data to enable pharmaceutical manufacturers to find out which physicians may bring more sales and thus conduct target advertising accordingly. The Court decided that data dissemination by IMS Health is constitutionally protected commercial speech. However, the Court then deviated from Central Hudson by applying a heightened standard of scrutiny, reasoning that the Vermont regulation is content- and speaker-based restriction that traditionally should be subject to the strict scrutiny rather than the intermediate one.
So, does selling personal data constitute commercial speech?
To answer this question needs to first define what is commercial speech. As mentioned above, commercial speech is typically associated with advertisement and solicitations. Virginia Pharmacy does not give a specific definition about this, but says commercial speech does “no more than propose a commercial transaction,” widely cited in later cases. Along that vein, does a company’s sale of (or sharing with others) consumers’ personal data propose a commercial transaction?
Sorrell stated “the creation and dissemination of information are speech within the meaning of the First Amendment” because disclosing and publishing information is “most essential to advance human knowledge and to conduct human affairs.” I think Sorrell majority is right to support commercial speech so that the pharmaceutical manufacturers can advertise information and consumers can know better. However, the personally identifiable information of doctor’s prescription practice is a different information — it is not created by pharmacies or pharmaceutical manufacturers, and many doctors probably have no intention to express or disseminate that information, at least when without their consent. Prescriber-identifying information is the personal information of prescribers sold to the pharmaceutical manufacturers by a data broker to help identify the targeted audience of the manufacturers’ marketing campaign. Sorrell seems to have confused these two distinct types of information. Speech is to express something of the speaker. The activity of selling other’s personal data is not.
Moreover, Virginia Pharmacy was decided with a focus on consumer protections, and the Supreme Court emphasized on the interests of the speech recipients (listeners) rather than the speakers. So the rationale underlying “protecting commercial speech is to protect free flow of information” is reaching out to take care of the consumers’ interests. Contrarily, Sorrell is posed against consumers, by allowing data brokers to continue exploiting consumers’ personal data without permission.
Between privacy and commercial speech
Weaponizing free speech by companies against privacy regulation is not new. In February, the internet service providers (ISPs) cited First Amendment in a lawsuit against a Maine privacy law restricting the ISPs’ collection and use of online customer personal data. Back to 2017, the ISP industry also similarly claimed free speech rights to kill the FCC privacy rules that require ISPs to be more transparent about their personal data practice.
While I can see how these Supreme Court cases on commercial speech may be used by both sides of such arguments, I am wondering whether things may become more clarified if we zoom out a little bit, asking what the First Amendment fundamentally protects.
I still recall the very first day of my First Amendment class, when I was planted with the concept “the free marketplace of ideas” from where I stepped on an amazing pilgrimage of free speech and realized how fundamental it is to a democratic society and indispensable to other forms of freedom. How companies’ use and selling of consumers’ personal data, particularly when it is built upon people’s unawareness or even against people’s own will, can contribute to such marketplace of ideas, society democracy and individual freedom rights? And on the other hand, the Supreme Court has confirmed in Sorrell that privacy regulation protecting personal data can be a substantial government interest; and a lot of studies and media reports have shown that companies selling personal data has been causing significant public concerns and eroding public trust, exactly where the privacy regulations are growing amidst.
Ultimately, free speech is to protect the people – so is privacy.
