Blog

Privacy in US Elections: When An Absentee Ballot Requires You to Publicly Divulge Information

The much-anticipated mid-term elections are finally upon us. If you have any hesitations about exercising your right to vote, here is your friendly (and forceful) reminder to go vote! If this is a surprise to you that it is Election Day, do your research and still go vote!

Ok, now we can move past the soapbox and address a privacy issue that our team stumbled across in the absentee ballot process. For anyone who follows XPAN’s business, or is aware of our sometimes-hectic schedules, our team travels quite a bit. And, unfortunately, some of this travel falls on election day, forcing some of us to use absentee ballots to vote.

If you have never participated in the absentee ballot process, it can be pretty painless. For many jurisdictions, you fill out a form (providing some key information) and mail it to your local board of elections. Prior to the election, you receive the absentee ballot form, that you fill out, vote, and then return to the board of elections (via mail or in-person). There are deadlines (so that can be tricky) – so think early and plan ahead. (Note: this is a highly simplified explanation and each state has their own unique differences).

While most of this process did not raise alarm bells, the shock came when I realized that, upon sealing my ballot and placing it in the envelope provided to mail it back to the board of elections, the outside of the envelope required me to provide personal information that I consider highly sensitive. Here is a screenshot of the Absentee Elector’s Declaration from an absentee ballot used in Pennsylvania (with pertinent privacy information redacted- of course).

The second sentence asks me to provide the number of years that I have lived at my residence (which I then am asked to provide). And, then it is followed by providing that exact address and then my signature attesting my absentee ballot. In a digital age, if someone were to take a photo of my signature, it would not take a highly technical person to use that signature for evil. Yes, could you likely find and/or figure out some of this information somewhere online? Yes. But, that is besides the point. This is a form I am required to fill in order to exercise my right to vote – I either provide the information or may not be able to vote.

We often focus on privacy practices within the private sector, but the public sector has a plethora of personal data on individuals and, in some instances, requires us to divulge this personal information in methods that could violate our privacy. This absentee ballot envelope is a great example. Providing this information is relevant, but is there a way to do so without having it on the outside of the envelope where presumably, anyone could view it. And it does not stop with absentee ballots. In many instances attorneys are required to use government forms and file using government websites that seem, shall we say, less than secure. It is not like attorneys can simply say that they do not want to use the online form or email personal information unencrypted to governmental agencies, they must do so in order to represent their clients. But at what cost?

Both the private and the public sector need to start thinking of designing processes and forms with privacy in mind (in other words, incorporating “Privacy-by-Design”). Thinking of privacy (and let’s not forget security) early on in the development of any business function (even a form that is filled out either internally or externally), can help to move us towards a more privacy-oriented approach across sectors. This absentee ballot is a great example: how can we rethink the way the government collects our information to meet the goals of ensuring the integrity of elections while also protecting our privacy? Just some food for thought. And PLEASE do not forget to vote!

Happy Election Day!

*****

Nothing contained in this blog should be construed as creating an attorney-client relationship or providing legal advice of any kind. If you have a legal issue regarding cybersecurity, domestic or international data privacy, or electronic discovery, you should consult a licensed attorney in your jurisdiction.