Cybersecurity Policy Report, Parties Raise Privacy Concerns Over California LifeLine Proposal, (Aug 15, 2024)

By Carrie DeLeon

While consumer advocates generally support the California Public Utilities Commission’s proposal to establish a process for Californians without a Social Security number (SSN) to enroll in the California LifeLine program, they raised concerns about consumer privacy and the use of identify verification software.

The commission’s proposal includes a four-phase approach to implement the non-SSN enrollment pathway that “allows for an expedient near-term solution and later refinements.” In phase 1, staff recommends updating the application process by allowing individuals to check a box certifying that they are applying without an SSN. During phase 2, staff will work with the program administrator to integrate LexisNexis TrueID, a new identity verification software, to expand the acceptable forms of identification for individuals applying without an SSN. In phase 3, service providers would implement the identity software onto their platforms. An optional phase 4 includes transitioning the enrollment processes for all applicants to the third-party administrator (TPA), according to the proposal.

The Utility Reform Network (TURN) and the Greenlining Institute (GLI), in joint comments, said they supported the proposal but recommended some changes to “clarify and strengthen” the decision. Among other things, they seek clarification that LexisNexis will not retain any LifeLine consumer data to sell because LexisNexis will delete LifeLine applicants’ data immediately after completing an identification check.

“These California LifeLine consumer privacy protections are important because eligible consumers may be discouraged from applying for and receiving California LifeLine services if they fear their privacy and personal information may be compromised. Assuring LifeLine applicants that their privacy and personal information will be protected is particularly pressing given LexisNexis’ contractual relationship with the Department of Homeland Security’s U.S. Immigration and Customs Enforcement division. Without explicit assurances, using LexisNexis and TrueID will raise concerns that LexisNexis will share information about California LifeLine applicants without SSNs with its partners or other databases,” they said.

The PUC said in a draft order that although it would authorize the TPA and service providers to use identity verification software to verify applicants’ identity documents, “this authorization must remain consistent with Californians’ constitutional right to privacy and the California Consumer Privacy Act.

“All California LifeLine applicants, whether they provide an SSN on their application or not, deserve assurance that identity verification software will not infringe upon this right. The TPA and service providers may not use applicants’ information for unauthorized purposes,” the commission said.

TURN and GLI said they understood the proposal to mean that LexisNexis would not retain any LifeLine consumer information and, therefore, LexisNexis would not have any LifeLine consumer information to sell or share. “As such, the Proposed Decision should explicitly state that CCPA and the LexisNexis privacy policies are generally applicable consumer privacy laws and policies that provide an added layer of protection—and that the Commission’s data minimization requirement would effectively opt out all LifeLine consumers from having their information sold or shared by LexisNexis because LexisNexis will immediately delete LifeLine consumer data after completing an identification check.”

Similarly, a group of low-income advocates, including Legal Aid Association of California, Homeless Action Center, and Maternal and Child Health Access, said they supported that the proposed decision “confirms LifeLine will be accessible to people who cannot provide an SSN, and that it provides a clear timeline for implementation of Phase 1,” but “strongly oppose the integration of TrueID into the application process for people without SSNs.”

“Weighing the tradeoff between integrating TrueID to increase the list of foreign identity documents against serious accessibility and privacy concerns, Low-Income Advocates stand by our position not to use TrueID. We reiterate that this is a false tradeoff because the LifeLine program does not need to use TrueID to expand the list of identity documents so that the program can be more accessible. All other public benefit programs in California at much higher price points do not require use of TrueID and accept more extensive lists of identity documents. They also have a low incidence of fraud. Reviewing eligibility documents is squarely within the responsibilities of a public benefits administrator in this case, the TPA. Creating a more arduous application process for people without SSNs has a potential discriminatory impact,” according to the low-income advocates.

The commission, they said, is proposing to “outsource making determinations about individuals who may not have legal status in the United States to a third-party vendor that sells information to ICE and will use facial recognition and artificial intelligence to make these decisions. Additionally, the Commission would be approving the use of an application that requires extremely low-income individuals, many of whom may be disabled and/or limited English proficient, to upload documents through an application, even though they are applying for a phone.”

The advocates further point out that no other public benefit agency in California requires that low-income immigrants provide their private information and images to a data broker to confirm their identity, and most have a more extensive list of identity documents that they accept.

“While the TPA presently references LexisNexis to verify identity, what is proposed here is different because people will be forced to input their own data and image into LexisNexis as a condition of receiving a public benefit. Low-Income Advocates have serious concerns about whether this proposal violates Californian’s Constitutional right to privacy, State Sanctuary law, as well as other state laws, and the Commission’s own Privacy Policies.”

News: StateLegislation DataPrivacy