Law Commons^™

More Than Friends: A New Theory For The Third-Party Doctrine, Eang L. Ngov

American University Law Review

When a person gives information or something tangible to someone or a business, the Fourth Amendment’s third-party doctrine allows the government to obtain that evidence without a warrant or probable cause. The third-party doctrine is premised on the rationale that we hold no reasonable expectation of privacy when we voluntarily expose information to others, that we assume the risk that the third party would share the information, and that we must deal with the consequences of that misplaced trust. The doctrine originated from a series of cases where law enforcement obtained information revealed by criminals through their mistaken trust of …

How To Get The Property Out Of Privacy Law, Jane R. Bambauer

UF Law Faculty Publications

For the last ten years, American rhetoric and state lawmaking has attempted to provide consumers with greater and stickier property interest in their personal information. But the impracticalities of the sticky property model are becoming evident, and will be impossible to ignore as AI becomes more prevalent and useful. This Article critiques the property framework in privacy law, and explains how a risk-based approach can be modernized and implemented instead. An enduring system of privacy laws will manage risks rather than bestowing rights to control and delete information. To do this, data practices should be categorized into safe harbor practices …

Bespoke Regulation Of Artificial Intelligence, Brenda M. Simon

Faculty Scholarship

The decision to regulate artificial intelligence (AI) has far reaching consequences. Determining how to address budding applications of AI technology should depend on their effects. This article describes how regulation should be carefully tailored to avoid harm while maximizing social welfare, building on Orly Lobel's taxonomy of regulatory tools. Part I examines the foundational difficulties in governing AI, including industry influence in regulation and deficiencies in enforcement. Part II elaborates on Lobel's framework, detailing the benefits and limitations of a variety of tools, such as voluntary standards, soft law mechanisms, and public-private partnerships. It describes how bringing in diverse stakeholders …

Reclaiming Personal Privacy Rights Through The Freedom Of Intimate Association, Nancy C. Marcus

Faculty Scholarship

The United States has entered a new constitutional era where substantive due process, under attack by the Supreme Court itself, can no longer be viewed as a solid foundation for the securing of personal privacy rights. In a post-Dobbs v. Jackson Women’s Health Organization world, the right to personal privacy, long understood to be protected under the Fifth and Fourteenth Amendments’ Due Process Clauses, is in need of a new doctrinal home. The evisceration of modern substantive due process in the context of abortion rights implicates and endangers LGBTQ+ rights and other personal privacy rights as well. As such, …

Everybody Wants To Rule The World: Central Bank Digital Currencies In The Era Of Decoupling The World’S Two Largest Economies, James M. Cooper

Faculty Scholarship

Some 130 central banks around the world are experimenting with various levels of a central bank digital currency (“CBDC”), a digitized form of a sovereign-backed, national currency that is a liability of that country’s central bank. Unlike fiat currency, CBDCs are trackable and potentially subject to interference and even freezing by government authorities. CBDCs will affect citizens’ control over commerce, payments, and savings, and impact their privacy rights. The Chinese government has piloted, refined, and rolled out its own CBDC called the Digital Currency/Electronic Payment initiative (“DC/EP”), also known as the digital yuan or e-CNY. The Chinese government is far …

Beyond Neural Data: Cognitive Biometrics And Mental Privacy, Patrick Magee, Marcello Ienca, Nita Farahany

Faculty Scholarship

Innovations in wearable technology and artificial intelligence have enabled consumer devices to process and transmit data about human mental states (cognitive, affective, and conative) through what this paper refers to as ‘‘cognitive biometrics.’’ Devices such as brain-computer interfaces, extended reality headsets, and fitness wearables offer significant benefits in health, wellness, and entertainment through the collection and processing and cognitive biometric data. However, they also pose unique risks to mental privacy due to their ability to infer sensitive information about individuals. This paper challenges the current approach to protecting individuals through legal protections for ‘‘neural data’’ and advocates for a more …

Data In Distress: Effectuating State Data Privacy Laws During Bankruptcy, Cameron Love

Emory Law Journal

In 2000, an online toy retailer, Toysmart.com, attempted to liquidate consumer data to pay creditors in its bankruptcy case. The attempted sale drew objections from the Federal Trade Commission and forty-seven state attorneys general. Five years later, Congress attempted to resolve privacy concerns in bankruptcy, amending the Bankruptcy Code to provide clear procedures for the liquidation of “personally identifiable information.” Recently, scholars have criticized these amendments, characterizing them as “limited,” “outdated,” and “privacy theater.” This Comment adds to these criticisms, arguing the amendments’ failure to mandate consideration of relevant nonbankruptcy law puts these permissive sales procedures on a collision course …

Comparing Gdpr Against The United States’ Approach To Data Breach Notification By Examining Texas And California And The Feasibility Of A Universal Standard, Amrit Nagi

Cybaris®

No abstract provided.

Justice David Hackett Souter And The Right To Privacy, Scott P. Johnson

Mitchell Hamline Law Review

No abstract provided.

Aborted Confidentiality, Stacey A. Tovino

Faculty Articles

As the number of abortion-restricting laws continues to grow in the wake of the Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization, law enforcement officers are increasingly interested in obtaining and using reproductive health information for law enforcement purposes. Although physicians and other covered entities generally are required to keep protected health information (PHI) confidential under the Health Insurance Portability and Accountability Act Privacy Rule, a number of regulatory exceptions historically have permitted covered entities to disclose PHI for civil, criminal, and administrative investigations and proceedings. On April 26, 2024, the Department of Health and Human Services …

Constructing Ai Speech, Margot E. Kaminski, Meg Leta Jones

Publications

Artificial Intelligence (AI) systems such as ChatGPT can now produce convincingly human speech, at scale. It is tempting to ask whether such AI-generated content “disrupts” the law. That, we claim, is the wrong question. It characterizes the law as inherently reactive, rather than proactive, and fails to reveal how what may look like “disruption” in one area of the law is business as usual in another. We challenge the prevailing notion that technology inherently disrupts law, proposing instead that law and technology co-construct each other in a dynamic interplay reflective of societal priorities and political power. This Essay instead deploys …

Regulating For Asymmetric Market Power : Beyond The Consumer Sovereignty Model, Olivier Sylvain

Faculty Scholarship

Recent policy developments suggest that consumer sovereignty models of regulation have substantial, if not fatal, limitations. Binding decisions by the European Data Protection Board in 2023, as well as other recent public law enactments in the EU and the US, overtly reject the assumption that individuals are best situated to manage how companies process or use their personal information. Prevalent online practices are too opaque. And the “ take it or leave it ” services that companies provide render individuals’ rights and commercial choices effectively meaningless. In short, the relative power of consumers as compared to the companies that collect, …

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Measuring Compliance With The California Consumer Privacy Act Over Space And Time, Jens Frankenreiter, Van Tran, Aarushi Mehrotra, Marshini Chetty, Nick Feamster, Lior Strahilevitz

Scholarship@WashULaw

The widespread sharing of consumers personal information with third parties raises significant privacy concerns. The California Consumer Privacy Act (CCPA) mandates that online businesses offer consumers the option to opt out of the sale and sharing of personal information. Our study automatically tracks the presence of the opt-out link longitudinally across multiple states after the California Privacy Rights Act (CPRA) went into effect. We categorize websites based on whether they are subject to CCPA and investigate cases of potential non-compliance. We find a number of websites that implement the opt-out link early and across all examined states but also find …

Valuing Social Data, Amanda Parsons, Salome Viljoen

Articles

Social data production—accumulating, processing, and using large volumes of data about people—is a unique form of value creation that characterizes the digital economy. Social data production also presents critical challenges for the legal regimes that encounter it. This Article provides scholars and policymakers with the tools to comprehend this new form of value creation through two descriptive contributions. First, it presents a theoretical account of social data, a mode of production that is cultivated and exploited for two distinct (albeit related) forms of value: prediction value and exchange value. Second, it creates and defends a taxonomy of three “scripts” that …

Forget About Ferpa: How Foia Protects Student-Athlete Privacy In The Nil Era, Kamron Cox

Vanderbilt Journal of Entertainment & Technology Law

The start of the name, image, and likeness (NIL) era stirred public fervor about the new earning potential of high-profile student-athletes. Since institutional policies and state laws governing NIL require student-athletes to broadly disclose information about their NIL activities to their respective institutions, the several state laws that follow the approach of the federal Freedom of Information Act (FOIA) can jeopardize the privacy of student-athlete NIL information. Major universities have repeatedly resorted to the unreliable defense of the Family Educational Rights and Privacy Act as well as sporadic state legislation to protect student-athlete privacy in the new NIL space. However, …

A Tort For The Digital Age: False Light Invasion Of Privacy Reconsidered, John C.P. Goldberg, Benjamin C. Zipursky

Faculty Scholarship

In his famous 1960 article, William Prosser identified four privacy torts: Disclosure of Private Facts, False Light Invasion of Privacy, Appropriation of Likeness, and Intrusion Upon Seclusion. Although each was recognized in the Second Torts Restatement and by various courts, the false light tort seems to have foundered. Indeed, starting in the late 1980s, prominent courts rejected it and many academics have expressed grave misgivings about it. Often interpreted as a kind of ‘defamation lite,’ the tort seems to its critics an ill-defined wrong that clever lawyers invoke to evade important limitations on defamation liability.

Drawing from case law and …

Synthetic Health Data: Real Ethical Promise And Peril, W. Nicholson Price Ii, Daniel Susser

Other Publications

Modern health research and development faces a dilemma. On the one hand, there is more data than ever — in electronic health records, in lab research, in public datasets, and on the internet — from which to extract potentially transformative scientific insights and to use as the basis for developing breakthrough health care technologies. On the other hand, using this data entails various risks: threats to patient privacy, skewed samples and approaches to analysis that can perpetuate demographic and other biases, and uneven access to data about rare conditions and small patient subgroups. Generating synthetic data has emerged as one …

Brokered Abuse, Thomas E. Kadri

Scholarly Works

This chapter examines how data brokers, companies that collect, sell, and trade personal information, enable and intensify interpersonal abuse. The article analyzes the data brokerage industry’s role in undermining personal obscurity, the relative safety that comes from being difficult to find or understand, and explores how current laws not only fail to address these harms but can make them worse. The chapter argues that existing privacy regimes, particularly those requiring victims to request data removal from individual brokers, impose psychological burdens and can retraumatize victims.

Distinguishing Privacy Law: A Critique Of Privacy As Social Taxonomy, Maria P. Angel, Ryan Calo

Scholarly Works

What distinguishes violations of privacy from other harms? This has proven a surprisingly difficult question to answer. For over a century, privacy law scholars labored to define the illusive concept of privacy. Then they gave up. Efforts at distinguishing privacy came to be superseded at the turn of the millennium by a new approach: a taxonomy of privacy problems grounded in social recognition. Privacy law became the field that simply studies whatever courts or scholars talk about as related to privacy.

And it worked. Decades into privacy as social taxonomy, the field has expanded to encompass a broad range of …

Research Access To Social Media Data: Lessons From Clinical Trial Data Sharing, Christopher J. Morten, Gabriel Nicholas, Salomé Vilgoen

Articles

For years, social media companies have sparred with lawmakers over how much independent access to platform data they should provide researchers. Sharing data with researchers allows the public to better understand the risks and harms associated with social media, including areas such as misinformation, child safety, and political polarization. Yet researcher access is controversial. Privacy advocates and companies raise the potential privacy threats of researchers using such data irresponsibly. In addition, social media companies raise concerns over trade secrecy: the data these companies hold and the algorithms powered by that data are secretive sources of competitive advantage. This Article shows …

The Modern Border: The Government Can Search . . . Anything?, Abigail Nusbaum

FIU Law Review

The evolution of modern technology has introduced new obstacles in interpreting the Fourth Amendment’s application to searches of peoples’ effects. Specifically, the longstanding exception to the Fourth Amendment permitting searches at the international border in the absence of probable cause does not so neatly apply to forensic searches of cell phones. Consequently, a circuit split has emerged on two aspects of the issue: the scope of the border exception and the requisite level of suspicion within that exception. The Supreme Court should find that forensic cell phone searches at the international border implicate Fourth Amendment privacy interests, requiring the border …

The Overton Window And Privacy Enforcement, Alicia Solow-Niederman

GW Law Faculty Publications & Other Works

On paper, the Federal Trade Commission’s consumer protection authority seems straightforward: the agency is empowered to investigate and prevent unfair or deceptive acts or practices. This flexible and capacious authority, coupled with the agency’s jurisdiction over the entire economy, has allowed the FTC to respond to privacy challenges both online and offline. The contemporary question is whether the FTC can draw on this same authority to curtail the data-driven harms of commercial surveillance or emerging technologies like artificial intelligence.

This Essay contends that the legal answer is yes and argues that the key determinants of whether an agency like the …

Privacy Nicks: How The Law Normalizes Surveillance, Woodrow N. Hartzog, Evan Selinger, Johanna Gunawan

Faculty Scholarship

Privacy law is failing to protect individuals from being watched and exposed, despite stronger surveillance and data protection rules. The problem is that our rules look to social norms to set thresholds for privacy violations, but people can get used to being observed. In this article, we argue that by ignoring de minimis privacy encroachments, the law is complicit in normalizing surveillance. Privacy law helps acclimate people to being watched by ignoring smaller, more frequent, and more mundane privacy diminutions. We call these reductions “privacy nicks,” like the proverbial “thousand cuts” that lead to death.
/="/">
/="/">Privacy nicks come …

Against Engagement, Neil Richards, Woodrow Hartzog

Faculty Scholarship

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet

Our goal in this Article is to isolate …

Kafka In The Age Of Ai And The Futility Of Privacy As Control, Daniel Solove, Woodrow Hartzog

Faculty Scholarship

Despite writing more than a century ago, Franz Kafka captured the core problem of digital technologies—how individuals are rendered powerless and vulnerable. Over the past fifty years, and especially in the twenty-first century, privacy laws have been sprouting up around the world. These laws are often based heavily on an Individual Control Model that aims to empower individuals with rights to help them control the collection, use, and disclosure of their data.

In this Article, we argue that although Kafka starkly shows us the plight of the disempowered individual, his work also paradoxically suggests that empowering the individual isn’t the …

Two Ai Truths And A Lie, Woodrow Hartzog

Faculty Scholarship

Industry will take everything it can in developing Artificial Intelligence (AI) systems. We will get used to it. This will be done for our benefit. Two of these things are true and one of them is a lie. It is critical that lawmakers identify them correctly. In this Essay, I argue that no matter how AI systems develop, if lawmakers do not address the dynamics of dangerous extraction, harmful normalization, and adversarial self-dealing, then AI systems will likely be used to do more harm than good.

Given these inevitabilities, lawmakers will need to change their usual approach to regulating technology. …

The Trade Origins Of Privacy Law, Anupam Chander

Georgetown Law Faculty Publications and Other Works

The desire for trade propelled the growth of data privacy law across the world. Countries with strong privacy laws sought to ensure that their citizens’ privacy would not be compromised when their data traveled to other countries. Even before this vaunted Brussels Effect pushed privacy law across the world through the enticement of trade with the European Union, Brussels had to erect privacy law within the Union itself. And as the Union itself expanded, privacy law was a critical condition for accession.

But this coupling of privacy and trade leaves a puzzle: how did the U.S. avoid a comprehensive privacy …

Fintech Lending In India: Taking Stock Of Implications For Privacy And Autonomy, Vidushi Marda, Amber Sinha

Indian Journal of Law and Technology

In the last five years, the Fintech sector has thrived in India, with Machine Learning (ML) driven credit scoring based on alternative data, emerging as a growing segment. The credit scoring industry in India needs to be viewed in light of a careful examination of rights, inclusion, appropriate safeguards and discrimination, currently missing from the discourse and practices. In this paper, we explain how ML-based credit scoring works, and the regulatory and commercial factors that have enabled and impeded its growth in India. Through legal and technological analysis, richened by insights from qualitative interviews with entrepreneurs and practitioners, we provide …

Our Changing Reality: The Metaverse And The Importance Of Privacy Regulations In The United States, Anushkay Raza

Global Business Law Review

This Note discusses the legal and pressing digital challenges that arise in connection with the growing use of virtual reality, and more specifically, the metaverse. As this digital realm becomes more integrated into our daily lives, the United States should look towards creating a federal privacy law that protects fundamental individual privacy rights. This Note argues that congress should emulate the European Union's privacy regulations, and further, balances the potential consequences and benefits of adapting European regulations within the United Sates. Finally, this Note provides drafting considerations of future lawyers who will not only be dealing with the rise of …