Law Commons^™

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Reflections On “Personal Responsibility” After Covid And Dobbs: Doubling Down On Privacy, Susan Frelich Appleton, Laura A. Rosenbury

Scholarship@WashULaw

This essay uses lenses of gender, race, marriage, and work to trace understandings of “personal responsibility” in laws, policies, and conversations about public support in the United States over three time periods: (I) the pre-COVID era, from the beginning of the American “welfare state” through the start of the Trump administration; (II) the pandemic years; and (III) the present post-pandemic period. We sought to explore the possibility that COVID and the assistance programs it inspired might have reshaped the notion of personal responsibility and unsettled assumptions about privacy and dependency. In fact, a mixed picture emerges. On the one hand, …

A Concrete Proposal For Data Loyalty, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

Congress and state legislators are finally experimenting with new privacy frameworks, rights, and duties to move past the thoroughly critiqued “notice and choice” model for data privacy. While many new privacy proposals seek a more fortified version of the fair information practices, some legislators have placed a duty of data loyalty at the heart of their proposed privacy bills. This is important because a duty of data loyalty has the potential to anchor American privacy law in a way analogous to how the European Union approach is grounded in fundamental rights of privacy and data protection.

Unfortunately, there remains some …

Comments Of The Cordell Institute On The Prevalence Of Commercial Surveillance And Data Security Practices That Harm Consumers, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

These comments are a response to the Federal Trade Commission's 2022 advance notice of proposed rulemaking (“ANPR”) requesting public comment on the prevalence of commercial surveillance and data security practices that harm consumers (Commercial Surveillance ANPR, R111004).

In an increasingly digitized world, data collection, processing, and transfer have become integral to market interactions. Our personal and commercial experiences are now mediated by powerful, information-intensive firms who hold the power to shape what consumers see, how they interact, which options are available to them, and how they make decisions. That power imbalance exposes consumers and leaves them all vulnerable. We all …

The New Bailments, Danielle D'Onfro

Scholarship@WashULaw

The rise of cloud computing has dramatically changed how consumers and firms store their belongings. Property that owners once managed directly now exists primarily on infrastructure maintained by intermediaries. Consumers entrust their photos to Apple instead of scrapbooks; businesses put their documents on Amazon’s servers instead of in file cabinets; seemingly everything runs in the cloud. Were these belongings tangible, the relationship between owner and intermediary would be governed by the common-law doctrine of bailment. Bailments are mandatory relationships formed when one party entrusts their property to another. Within this relationship, the bailees owe the bailors a duty of care …

The Surprising Virtues Of Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

Legislating Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

Artificial Intelligence And The Challenges Of Workplace Discrimination And Privacy, Pauline Kim, Matthew T. Bodie

Scholarship@WashULaw

Employers are increasingly relying on artificially intelligent (AI) systems to recruit, select, and manage their workforces, raising fears that these systems may subject workers to discriminatory, invasive, or otherwise unfair treatment. This article reviews those concerns and provides an overview of how current laws may apply, focusing on two particular problems: discrimination on the basis of protected characteristics like race, sex, or disability, and the invasion of workers’ privacy engendered by workplace AI systems. It discusses the ways in which relying on AI to make personnel decisions can produce discriminatory outcomes and how current law might apply. It then explores …

Ai And Inequality, Pauline Kim

Scholarship@WashULaw

This Chapter examines the social consequences of artificial intelligence (AI) when it is used to make predictions about people in contexts like employment, housing and criminal law enforcement. Observers have noted the potential for erroneous or arbitrary decisions about individuals; however, the growing use of predictive AI also threatens broader social harms. In particular, these technologies risk increasing inequality by reproducing or exacerbating the marginalization of historically disadvantaged groups, and by reinforcing power hierarchies that contribute to economic inequality. Using the employment context as the primary example, this Chapter explains how AI-powered tools that are used to recruit, hire and …

A Relational Turn For Data Protection?, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

While most approaches to privacy and data protection focus on the data, this paper explores an alternative approach that focuses on relationships. This means looking more closely at how the people who are exposing their information and the people that are inviting that disclosure relate to each other. It is concerned with what powerful parties owe to vulnerable parties–not just with their personal information, but with the things they see, the things they can click, and the decisions that are made about them. It’s less about the nature of data and more about the nature of power. And it can …

The Invalidation Of The Eu-Us Privacy Shield And The Future Of Transatlantic Data Flows: Testimony Of Professor Neil Richards Before The United States Senate, Neil M. Richards

Scholarship@WashULaw

This is the prepared testimony and statement for the records, including responses to questions for the record of Professor Neil Richards before the United States Senate Commerce Committee on December 9, 2020. The testimony explains that while Congress has failed to pass a comprehensive privacy bill despite many opportunities, the judgment of the European Court of Justice in Data Protection Commissioner v. Facebook, (commonly known as “Schrems 2”) represents a real opportunity for it to do just that in the near future. The testimony argues first that Congress should not just pass a comprehensive privacy bill, but one that gets …

Privacy's Constitutional Moment And The Limits Of Data Protection, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

America’s privacy bill has come due. Since the dawn of the Internet, Congress has repeatedly failed to build a robust identity for American privacy law. But now both California and the European Union have forced Congress’s hand by passing the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). These data protection frameworks, structured around principles for Fair Information Processing called the “FIPs,” have industry and privacy advocates alike clamoring for a “U.S. GDPR.” States seemed poised to blanket the country with FIP-based laws if Congress fails to act. The United States is thus in the midst …

Welcome To Cordell Perspectives, Neil M. Richards, Jonathan W. Heusel

Scholarship@WashULaw

The world around us is changing. Let’s talk about it together. Introducing a series of articles and opinions by the world’s leading experts concerning COVID-19 as it relates to precision medicine and data privacy: Welcome to Cordell Perspectives.

Data Mining And The Challenges Of Protecting Employee Privacy Under U.S. Law, Pauline Kim

Scholarship@WashULaw

Concerns about employee privacy have intensified with the introduction of data mining tools in the workplace. Employers can now readily access detailed data about workers’ online behavior or social media activities, purchase background information from data brokers, and collect additional data from workplace surveillance tools. When data mining techniques are applied to this wealth of data, it is possible to infer additional information about employees beyond the information that is collected directly. As a consequence, these tools can alter the meaning and significance of personal information depending upon what other information it is aggregated with and how the larger dataset …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

Criminal Employment Law, Benjamin Levin

Scholarship@WashULaw

This Article diagnoses a phenomenon, “criminal employment law,” which exists at the nexus of employment law and the criminal justice system. Courts and legislatures discourage employers from hiring workers with criminal records and encourage employers to discipline workers for non-work-related criminal misconduct. In analyzing this phenomenon, my goals are threefold: (1) to examine how criminal employment law works; (2) to hypothesize why criminal employment law has proliferated; and (3) to assess what is wrong with criminal employment law. This Article examines the ways in which the laws that govern the workplace create incentives for employers not to hire individuals with …

Four Principles For Digital Expression (You Won't Believe #3!), Neil M. Richards, Danielle Keats Citron

Scholarship@WashULaw

At the dawn of the Internet’s emergence, the Supreme Court rhapsodized about its potential as a tool for free expression and political liberation. In ACLU v. Reno (1997), the Supreme Court adopted a bold vision of Internet expression to strike down a federal law–the Communications Decency Act–that restricted digital expression to forms that were merely “decent.” Far more than the printing press, the Court explained, the mid-90s Internet enabled anyone to become a town crier. Communication no longer required the permission of powerful entities. With a network connection, the powerless had as much luck reaching a mass audience as the …

The Third-Party Doctrine And The Future Of The Cloud, Neil M. Richards

Scholarship@WashULaw

When the government seeks electronic documents held in the cloud, what legal standard should apply? This simple question raises fundamental questions about the future of our civil liberties in the digital world. In a series of cases, government lawyers have argued that information shared with digital intermediaries—including emails and cloud-stored documents—can be seized without a warrant. Their argument rests upon a controversial Fourth Amendment principle known as the “Third-Party Doctrine,” which maintains that information shared even with trusted “third parties” loses a reasonable expectation of privacy under the Fourth Amendment, and with it, the protection of the warrant requirement. Criminal …

Secret Government Searches And Digital Civil Liberties, Neil M. Richards

Scholarship@WashULaw

In Secret Government Searches and Digital Civil Liberties, Neil Richards tackles the issue of what he describes as “secret government searches”—namely, examples of government surveillance that remain a secret to the search target. These can be physical or digital, carried out with a warrant or without, and unknown to everyone but the government or facilitated by a private company that is prohibited from notifying the target. Richards places these secret searches in historical, technological, and constitutional context and argues that they are unprecedented, historically and technologically, and inconsistent with key constitutional values, including freedom of thought, freedom of expression, and …

Trusting Big Data Research, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Although it might puzzle or even infuriate data scientists, suspicion about big data is understandable. The concept doesn’t seem promising to most people. It seems scary. This is partly because big data research is shrouded in mystery. People are unsure about organizations’ motives and methods. What do companies think they know about us? Are they keeping their insights safe from hackers? Are they selling their insights to unscrupulous parties? Most importantly, do organizations use our personal information against us? Big data research will only overcome its suspicious reputation when people can trust it.

Some scholars and commentators have proposed review …

Privacy's Trust Gap: A Review, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

It can be easy to get depressed about the state of privacy these days. In an age of networked digital information, many of us feel disempowered by the various governments, companies, and criminals trying to peer into our lives to collect our digital data trails. When so much is in flux, the way we think about an issue matters a great deal. Yet while new technologies abound, our ideas and thinking — as well as our laws — have lagged in grappling with the new problems raised by the digital revolution. In their important new book, Obfuscation: A User’s Guide …

The Atlantic Divide On Privacy And Speech, Neil M. Richards, Kirsty Hughes

Scholarship@WashULaw

When does a right to privacy become a right of censorship? Conversely when does freedom of speech become a carte blanche to violate the dignity and autonomy of others? Discussions of privacy throughout the world frequently boil down to these questions. Despite the parallel relationships between privacy and speech in the United Kingdom and America, and despite their shared legal heritage, the two legal systems have struck the balance in radically different ways. In the United States, decisions balancing privacy and the First Amendment have invariably favoured the free speech interest, at least where a press defendant published lawfully-obtained “newsworthy” …

Taking Trust Seriously In Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Trust is beautiful. The willingness to accept vulnerability to the actions of others is the essential ingredient for friendship, commerce, transportation, and virtually every other activity that involves other people. It allows us to build things, and it allows us to grow. Trust is everywhere, but particularly at the core of the information relationships that have come to characterize our modern, digital lives. Relationships between people and their ISPs, social networks, and hired professionals are typically understood in terms of privacy. But the way we have talked about privacy has a pessimism problem – privacy is conceptualized in negative terms, …

How Should The Law Think About Robots?, Neil M. Richards, William D. Smart

Scholarship@WashULaw

The robots are coming. We don’t mean this in a scary, apocalyptic way, like in The Terminator or Battlestar Galactica, or in a tongue-in-cheek way, like in the Flight of the Conchords song “The Humans are Dead.” What we mean is this: Robots and robotic technologies are now mature enough to leave the research lab and come to the consumer market in large numbers. These early technologies are just the start, and we might soon be witnessing a personal robotics revolution. These systems have the potential to revolutionize our daily lives and to transform our world in ways even more …

People Analytics And The Regulation Of Information Under The Fair Credit Reporting Act, Pauline Kim, Erika Hanson

Scholarship@WashULaw

People analytics — the use of big data and computer algorithms to make personnel decisions — has been drawing increasing public and scholarly scrutiny. Concerns have been raised that the data collection intrudes on individual privacy, and that algorithms can produce unfair or discriminatory results. This symposium contribution considers whether the Fair Credit Reporting Act’s regulation of consumer information used for employment purposes can respond these concerns. The FCRA establishes certain procedural requirements, and these can sometimes help individual workers challenge inaccurate information about them. However, the statute does little to curb intrusive data collection practices or to address the …

Big Data And The Future For Privacy, Neil M. Richards, Jonathan H. King

Scholarship@WashULaw

In our inevitable big data future, critics and skeptics argue that privacy will have no place. We disagree. When properly understood, privacy rules will be an essential and valuable part of our digital future, especially if we wish to retain the human values on which our political, social, and economic institutions have been built. In this paper, we make three simple points. First, we need to think differently about "privacy." Privacy is not merely about keeping secrets, but about the rules we use to regulate information, which is and always has been in intermediate states between totally secret and known …

Market Norms And Constitutional Values In The Government Workplace, Pauline Kim

Scholarship@WashULaw

The conventional wisdom that public employees enjoy greater rights by virtue of the Constitution may no longer hold true. In recent cases, the Supreme Court has analogized public and private employment, with the effect of eroding the speech and privacy rights of government employees. This essay critically examines this trend, arguing that reliance on an analogy to the private sector is mistaken, because the arguments for giving private employers broad managerial discretion do not apply with the same force, or at all, to government employers. Rights-based arguments do not apply to government agencies, which are publicly-funded to achieve publicly-defined purposes …

Information Privacy Law Scholars' Brief In Spokeo, Inc. V. Robins, Neil M. Richards, Julie E. Cohen, Chris Jay Hoofnagle, William Mcgeveran, Paul Ohm, Joel R. Reidenberg, David Thaw, Lauren E. Willis

Scholarship@WashULaw

This brief, submitted to the Supreme Court of the United States by 15 information privacy law scholars in the case of Spokeo, Inc. v. Robins (No 13-1339), argues that in enacting the Fair Credit Reporting Act (FCRA), Congress crafted a bargain between aggressive, secretive data-aggregating businesses and the public: if those businesses limited disclosures and made reasonable efforts to adhere to practices ensuring “maximum possible accuracy,” they would enjoy a safe harbor from litigation under many other state and federal theories. The FCRA’s consumer transparency requirements and remedial provisions were designed to encourage steady improvement in consumer reporting practices and …

Intellectual Freedom And Privacy, Neil M. Richards, Joanna Cornwell

Scholarship@WashULaw

This essay offers an account of the complex ways intellectual freedom and privacy are interrelated. We pay particular attention to both the constitutional dimensions of these important values, as well as the important roles that social and professional norms play in their protection in practice. Our examination of these issues is divided into three parts. Part I lays out the law and legal theory governing privacy as it relates to intellectual freedom. Part II examines a special context in which law and professional norms operate together to protect intellectual freedom through privacy–the library. Finally, Part III discusses how government actions …