When whistleblower Christopher Wylie told the New York Times and the Guardian about a British consulting firm called Cambridge Analytica collecting Facebook users’ personal data without their consent, there was a public uproar. This spurred the online movement #DeleteFacebook on Twitter. Facebook agreed to pay nearly $650,000 in fines to the United Kingdom’s Information Commissioner’s Office, but no meaningful change to privacy law has since occured at the federal level.

For Woodrow Hartzog, a professor at Northeastern’s School of Law and Khoury College of Computer Sciences, this case is the latest in a string of debacles that demonstrate the need for new data privacy rules.

In their paper, “The Surprising Virtues of Data Loyalty,” Hartzog and co-author Neil Richards, a professor at Washington University School of Law, discuss the data loyalty responsibilities for companies that process human information.

“My co-author and I actually drew from some of the oldest sets of privacy related rules that we have … when you go to your doctor and you share information, they are bound via duties of confidentiality and loyalty based on bedrock virtues that we value in society,” Hartzog said. “So I began to think with my co-author, what would it look like if we took that general principle that you should be loyal to the people that trust you in ways that make them vulnerable? What would those rules look like at scale?”

Recently, Hartzog and Richards’s paper won the 12th annual Privacy Papers for Policymakers Award. The Future of Privacy Forum, or FPF, — a non-profit organization that works to bring together industry, academia and other thought leaders to explore principled data practices — hosted a virtual event that allowed the winning authors to present their work with policymakers around the world Feb. 10.

According to Amber Ezzell, a Christopher Wolf Diversity Law Fellow at the FPF, members of the FPF advisory board act as volunteer judges to review the researchers’ submitted papers in a first-round review. After that, the top 10 to 15 papers are “whittled down” to the top five to seven papers that are received that year.

“The Privacy Papers for Policymakers award … is designed to recognize leading privacy scholarship that’s particularly pertinent to policymakers in Congress, at U.S. agencies, at the federal level, as well as international data protection authorities,” Ezzell said. “Each of the winning papers that’s recognized highlights work that analyzes current and emerging privacy issues … and we award those that propose solutions or new means of analysis that lead to real world policy solutions not just in the United States but in Europe, Asia and other regions across the world.”

Having previously won this award nine times, Hartzog says he hopes his research has real world implications. 

Both Hartzog and Richards have worked closely with lawmakers to introduce bills concerning data loyalty, care and confidentiality at the federal and state level. And yet, Hartzog says that progress has been limited.

“Certainly, it’s a struggle … but of course, we knew that would be the case going in because what we’re advocating for is a massive change from the current approach … And so no major change like that comes easy … Even though it is a struggle, it’s one that we’re happy to be contributing to … we know that sometimes major reform like this takes a long time. That’s been the case in the past and I anticipate it will be in the future,” Hartzog said.

During the event, keynote speaker Colorado Attorney General Phil Weiser spoke of the partisan issues that impact the data privacy field. 

“The issues of privacy should not be framed in a partisan way. They should not become part of the log jam in Washington,” Weiser said. “The idea of dialogue that we used to have in Washington that the founders envisioned is absent … in an ideal, better world, we would see leadership in Congress engaging in the ideas and the discourse we have [at FPF].”

According to Hartzog and Richards, the data loyalty model for which they advocate in their paper can allow for bipartisan support. 

“Frankly, US privacy sort of lacks an identity. It’s all over the place. It’s a little bit confused. And this [data loyalty model] is one way for us to unite around a common point because things like legitimate interest or data processing … don’t really resonate with people, certainly not the public. But almost everybody can relate to being betrayed,” Hartzog said.

Weiser also stressed the importance of lawmakers and practitioners working in tandem with academics, such as those who were honored by the Privacy Papers for Policymakers Award.

“We have a lot of work to do ahead of us, those of us who are in the public policy realm. Those of you here from the academy, we need you. We need you helping us reflect on what we’re doing, helping us get better, helping us bring together the right sorts of people and this is going to be an interdisciplinary conversation in the best of all ways,” Weiser said.