Today, EFF joined the Rights Working Group and 65 advocacy organizations in sending letters opposing the Secure Communities Program in preparation for the Subcommittee on Immigration Policy and Enforcement hearing on the issue scheduled for November 30.

Under Secure Communities, local law enforcement agencies have lost control over the data they collect for purely local purposes. They are required to submit fingerprints and detailed information on all individuals they arrest to the Federal Bureau of Investigation (FBI), which then sends a copy of the data to the U.S. Immigration and Customs Enforcement (ICE).  ICE then checks the immigration status of the individuals, and moves to deport those who do not have appropriate residency standing.  Notably, individuals can be arrested, fingerprinted, and deported even if they are not convicted of a crime. For example, individuals engaged in civil disobedience at a protest rally but whose charges are later dismissed or individuals who are wrongfully arrested due to racial discrimination or false evidence could find their fingerprint data collected and face potential deportation. In fact, ICE reports that 21% of the program’s deportees were never convicted of a crime, contrary to the due process principles that are fundamental to the American legal system.

In its letter to the Subcommittee, EFF raised concerns that the Secure Communities Program fails to meet the standards of the Fair Information Practice Principles: Framework for Privacy Policy at the Department of Homeland Security (FIPPS). These principles create a foundation to ensure that the Department of Homeland Security will uphold the privacy rights of individuals even when conducting investigations of importance to national security.  DHS is responsible for overseeing the Secure Communities Program, and thus the entire program should adhere to the FIPPs.  More broadly, the FIPPs provide a framework for the collection and usage of personal information generally, and can be seen as guiding principles for government and nongovernmental agencies dealing with sensitive personal information in a wide range of circumstances.

The FIPPs define 8 principles, including: 

Purpose Specification: DHS should specifically articulate the authority that permits the collection of PII and specifically articulate the purpose or purposes for which the PII is intended to be used.

Data Minimization: DHS should only collect PII that is directly relevant and necessary to accomplish the specified purpose(s) and only retain PII for as long as is necessary to fulfill the specified purpose(s).

Use Limitation: DHS should use PII solely for the purpose(s) specified in the notice. Sharing PII outside the Department should be for a purpose compatible with the purpose for which the PII was collected.

The Secure Communities Program runs counter to these principles by transferring data between agencies in ways that exceed the purpose for which the data was originally collected.  In particular, fingerprint data of individuals booked into jails is obtained for the purpose of identification and checking preexisting criminal history; it is not collected to review an individual’s immigration status for possible deportation. Being booked into a jail – especially when one is not convicted of a crime – should not give the government carte blanche to share one’s personal information between government agencies. This secondary usage of the data is incompatible with the purpose for which the data was originally collected, and the transfer of data from detention facilities such as local jails to a central database within ICE violates the principles of use limitation and data minimization.

The expediency of the Secure Communities process comes at the cost of dearly held American rights to privacy and due process, and sacrificing civil liberties for such expediency in immigration enforcement creates a dangerous precedent.  The Secure Communities of today may be only the first step in DHS’s efforts to expand its dragnet data collection program. While Secure Communities is currently operating with data collected from arrestees, if left unchecked this program has the potential to expand to personally identifiable information from a range of other sources.

The Secure Communities Program sets a dangerous precedent for overcollection and misuse of sensitive personally identifiable information, with ramifications for the privacy and due process rights of all Americans.

Check out EFF's letter here. And anyone local to San Francisco can learn more about the privacy and security implications of Secure Communities at the Securing Our Rights event this Thursday and Friday.