Civil Society and the Crisis of Privacy Law

Based on interviews with key players, public reports, and previously undisclosed primary sources, this Article tells the inside story of the American Data Privacy and Protection Act (ADPPA) and the role of privacy nonprofit organizations in crafting it. It uses ADPPA’s drafting as a case study about larger questions of expertise, the lawmaking process, and the role of law in setting the context of advocacy. The Article’s descriptive argument is that background law and the dynamics of privacy policymaking in the United States Congress channeled and constrained the choices made by privacy civil society organizations while negotiating and drafting key parts of ADPPA. Those choices focused on the nature of civil society’s expertise within the legislative process and the kinds of policy proposals nonprofit advocates brought to the table.

The Article’s normative argument is that those choices created a privacy law that is ill-suited to addressing the privacy challenges of artificial intelligence (AI). Following Thomas Kuhn’s model of normalization, anomaly, and paradigm shift, the ADPPA case study surfaces how the law places limits on civil society and the need for new approaches to privacy law and civil society expertise in the age of AI.