Law Commons^™

Face Off: An Examination Of State Biometric Privacy Statutes & Data Harm Remedies, Maya E. Rivera

Fordham Intellectual Property, Media and Entertainment Law Journal

As biometric authentication becomes an increasingly popular method of security among consumers, only three states currently have statutes detailing how such data may be collected, used, retained, and released. The Illinois Biometric Information Privacy Act is the only statute of the three that enshrines a private right of action for those who fail to properly handle biometric data. Both the Texas Capture or Use Biometric Identifier Act Information Act and the Washington Biometric Privacy Act allow for state Attorneys General to bring suit on behalf of aggrieved consumers. This Note examines these three statutes in the context of data security …

C Is For Cookie: Is The Eu's New "Cookie Law" Good Enough To Protect My Data?

The International Lawyer

[...]data breaches have consistently increased in recent years, with almost 1,300 breaches in 2017 and over 600 as of July 24, 2018.11 This is obviously a problem that affects millions of people across the globe each year and is expected to continually increase as the global economy becomes ever more digital, forcing some to call for action. [...]the comment will speculate as to any potential legal developments as a result of the GDPR's implementation in the European Union and ways that it may evolve over time to affect not only the European Union but also other nations that do business …

Killer Apps: Vanishing Messages, Encrypted Communications, And Challenges To Freedom Of Information Laws When Public Officials "Go Dark", Daxton R. Stewart

Journal of Law, Technology, & the Internet

Government officials such as White House staffers and the Missouri governor have been communicating among themselves and leaking to journalists using apps such as Signal and Confide, which allow users to encrypt messages or to make them vanish after they are received. By using these apps, government officials are "going dark" by avoiding detection of their communications in a way that undercuts freedom of information laws. This article explores the challenges presented by government employee use of encrypted and ephemeral messaging apps by examining three policy approaches: (1) banning use of the apps, (2) enhancing existing archiving and record-keeping practices, …

Privacy In The Age Of Medical Big Data, W. Nicholson Price Ii, I. Glenn Cohen

Articles

Big data has become the ubiquitous watch word of medical innovation. The rapid development of machine-learning techniques and artificial intelligence in particular has promised to revolutionize medical practice from the allocation of resources to the diagnosis of complex diseases. But with big data comes big risks and challenges, among them significant questions about patient privacy. Here, we outline the legal and ethical challenges big data brings to patient privacy. We discuss, among other topics, how best to conceive of health privacy; the importance of equity, consent, and patient governance in data collection; discrimination in data uses; and how to handle …

The Department Of Justice Versus Apple Inc. -- The Great Encryption Debate Between Privacy And National Security, Julia P. Eckart

Catholic University Journal of Law and Technology

This article is an attempt to objectively examine and assess legal arguments made by Apple Inc. (Apple) and the Department of Justice (DOJ) concerning the DOJ’s use of the All Writs Act[1] (AWA) to require Apple to provide technical assistance to the DOJ so that it could access the encrypted data from the locked iPhone of Syed Rizwan Farook, commonly referred to as the San Bernardino shooter. The DOJ’s initial ex parte application focused on meeting the requirements of United States v. New York Telephone Co.[2] concluding the court order was authorized and appropriate. Apple not only argued …

Privacy In Gaming, N. Cameron Russell, Joel R. Reidenberg, Sumyung Moon

Fordham Intellectual Property, Media and Entertainment Law Journal

Video game platforms and business models are increasingly built on collection, use, and sharing of personal information for purposes of both functionality and revenue. This paper examines privacy issues and explores data practices, technical specifications, and policy statements of the most popular games and gaming platforms to provide an overview of the current privacy legal landscape for mobile gaming, console gaming, and virtual reality devices. The research observes how modern gaming aligns with information privacy notions and norms and how data practices and technologies specific to gaming may affect users and, in particular, child gamers.

After objectively selecting and analyzing …

The Future Of Facial Recognition Is Not Fully Known: Developing Privacy And Security Regulatory Mechanisms For Facial Recognition In The Retail Sector, Elias Wright

Fordham Intellectual Property, Media and Entertainment Law Journal

In recent years, advances in facial recognition technology have resulted in a rapid expansion in the prevalence of private sector biometric technologies. Facial recognition, while providing new potentials for safety and security and personalized marketing by retailers implicates complicated questions about the nature of consumer privacy and surveillance where a “collection imperative” incentivize corporate actors to accumulate increasingly massive reservoirs of consumer data. However, the law has not yet fully developed to address the unique risks to consumers through the use of this technology. This Note examines existing regulatory mechanisms, finding that consumer sensitivities and the opaque nature of the …

Consumer Protection—Exploring Private Causes Of Action For Victims Of Data Breaches, Justin H. Dion, Nicholas M. Smith

Faculty Scholarship

Data breaches are becoming a norm in modern life. Every year it seems that bigger and bigger attacks are launched, and more and more individuals are harmed. The law has responded by increasing states’ ability to prosecute cybercriminals. A glaring hole exists in this protection though. The state is largely an unharmed party. The real harm is done to individual citizens affected by the breaches. Their data is compromised, their identities are stolen, and their livelihoods are placed at risk. This Article will analyze the issue and propose a solution for increased consumer protection in addition to the current criminal …

"You Have The Data"...The Writ Of Habeas Data And Other Data Protection Rights: Is The United States Falling Behind?, Sarah L. Lode

Indiana Law Journal

In Part I of this Note, I will discuss the writ of habeas data that has been developed primarily, but not exclusively, in Latin American countries. I will discuss the intricacies of the writ, how it evolved, and how it is applied today. Using Argentina as an example, I will discuss how the writ would be used by an Argentine citizen to protect her personal data. Part II summarizes the previously employed data protection scheme in the European Union, the Data Protection Directive (“the Directive”), and will also discuss the new EU data protection regulation, the General Data Protection Regulation …

Data Protection In An Increasingly Globalized World, Nicholas F. Palmieri Iii

Indiana Law Journal

With the rise of the internet in recent decades, it has become increasingly easy for various enterprises—including retailers, advertising agencies, and service providers—to acquire, use, and even share the personal details of their users. Such a trend is unlikely to decrease in the coming years; in fact, internet usage is only likely to increase as more and more people gain access to the internet. In the wakeof recent data breaches, including the now infamous breach of Equifax as well as the scandal involving Facebook and Cambridge Analytica, people are even more aware of the need for (and the risk of …

Secrets Of The Deep: Defining Privacy Underwater, Annie Brett

UF Law Faculty Publications

The drones are coming, But not just to your neighborhood skies – to the world’s oceans. From recreational robots designed to autonomously follow divers and record video of them to low-cost, remotely operated submersibles that put ocean exploration in the hands of the general public to sophisticated military submersibles able to autonomously gather intelligence throughout the oceans, the underwater drone market is exploding. But unlike on land, this explosion has not been accompanied by similar discussion of privacy concerns. Instead, the ocean’s rapid shift away from an inaccessible operational sanctuary is one that is happening largely silently. And it is …

Cops And Cars: How The Automobile Drove Fourth Amendment Law, Tracey Maclin

UF Law Faculty Publications

This is an essay on Professor Sarah A. Seo’s new book, Policing the Open Road: How Cars Transformed American Freedom (Harvard Univ. Press 2019). I focus on Professor Seo’s analysis of Carroll v. United States, 267 U.S. 132 (1925) and Brinegar v. United States, 338 U.S. 160 (1949). Carroll is important not only because it was the Court’s first car case. Understanding Carroll (and Brinegar, which solidified and expanded Carroll’s holding) is essential because, nearly one hundred years later, its logic continues to direct how the modern Court resolves Fourth Amendment claims of motorists. Put simply, a majority of today’s …

Data Subjects' Privacy Rights: Regulation Of Personal Data Retention And Erasure, Alexander Tsesis...

University of Colorado Law Review

No abstract provided.

Global Platform Governance: Private Power In The Shadow Of The State, Hannah Bloch-Wehba

Faculty Scholarship

Online intermediaries—search engines, social media platforms, even e-commerce businesses—are increasingly required to make critical decisions about free expression, individual privacy, and property rights under domestic law. These requirements arise in contexts that include the right to be forgotten, hate speech, “terrorist” speech, and copyright and intellectual property. At the same time, these disputes about online speech are increasingly borderless. Many laws targeting online speech and privacy are explicitly extraterritorial in scope. Even when not, some courts have ruled that they have jurisdiction to enforce compliance on a global scale. And governments are also demanding that platforms remove content—on a global …

Privacy And Legal Automation: The Dmca As A Case Study, Jonathon Penney

Articles, Book Chapters, & Popular Press

Advances in artificial intelligence, machine learning, computing capacity, and big data analytics are creating exciting new possibilities for legal automation. At the same time, these changes pose serious risks for civil liberties and other societal interests. Yet, existing scholarship is narrow, leaving uncertainty on a range of issues, including a glaring lack of systematic empirical work as to how legal automation may impact people’s privacy and freedom. This article addresses this gap with an original empirical analysis of the Digital Millennium Copyright Act (DMCA), which today sits at the forefront of algorithmic law due to its automated enforcement of copyright …

The Federalism Challenges Of Protecting Medical Privacy In Workers' Compensation, Ani B. Satz

Faculty Articles

This Article is the first to address the challenges of federalism in protecting medical privacy in workers’ compensation after the promulgation of the HPR and to propose legal change. The Article argues that workers’ compensation programs must align with the federal privacy protections of the HPR and proposes actions for the U.S. Department of Health and Human Services (HHS) and states to remedy departures. Part I discusses the complex relationship between the HPR and workers’ compensation. This relationship is often misunderstood by legislatures and courts, compounding the challenges of federalism in this area. Specifically, Part I addresses the HPR’s § …

The Role Of Satellites And Smart Devices: Data Surprises And Security, Privacy, And Regulatory Challenges, Anne T. Mckenna, Amy C. Gaudion, Jenni L. Evans

Faculty Scholarly Works

Strava, a popular social media platform and mobile app like Facebook but specifically designed for athletes, posts a “heatmap” with consensually-obtained details about users’ workouts and geolocation. Strava’s heatmap depicts aggregated data of user location and movement by synthesizing GPS satellite data points and movement data from users’ smart devices together with satellite imagery. In January of 2018, a 20-year-old student tweeted that Strava’s heatmap revealed U.S. forward operating bases. The tweet revealed a significant national security issue and flagged substantial privacy and civil liberty concerns.

Smart devices, software applications, and social media platforms aggregate consumer data from multiple data …

Data Subjects' Privacy Rights: Regulation Of Personal Data Retention And Erasure, Alexander Tsesis

Faculty Publications & Other Works

The European Union's right to erasure came into effect May 25, 2018, as Article 17 of the General Data Protection Regulation ("GDPR"). Unlike the U.S. "marketplace of ideas" model of free speech, the GDPR gives greater weight to data subjects' privacy interests than to audiences' curiosity about others' intimate lives. The U.S. and EU models advance human thirst for knowledge through open and uninhibited debates, whereas the internet marketplace tends to favor social media companies' commercial interests: put more specifically, free speech is not entirely harmonious with the interests of social media intermediaries whose algorithms tend to favor companies' bottom …

Marketplace Of Ideas, Privacy, And The Digital Audience, Alexander Tsesis

Faculty Publications & Other Works

The availability of almost limitless sets of digital information has opened a vast marketplace of ideas. Information service providers like Facebook and Twitter provide users with an array of personal information about products, friends, acquaintances, and strangers. While this data enriches the lives of those who share content on the internet, it comes at the expense of privacy. Social media companies disseminate news, advertisements, and political messages, while also capitalizing on consumers' private shopping, surfing, and traveling habits. Companies like Cambridge Analytica, Amazon, and Apple rely on algorithmic programs to mash up and scrape enormous amounts of online and otherwise …

Identities In Critical Condition: The Urgent Need To Reevaluate The Investigation And Resolution Of Claims Of Medical Identity Theft, Stephanie Lindgren

Mitchell Hamline Law Review

No abstract provided.

Nova Law Review Full Issue Volume 43, Issue 3

Nova Law Review

No abstract provided.

Strict Liability For Genetic Privacy Violations In The Age Of Big Data, Benjamin Sundholm

Faculty Publications

(Excerpt)

The ethical issues implicated by the misuse of genetic information have been smoldering for over half a century, and the age of big data has turned them into a five-alarm fire. In recent years, medical researchers and commercial enterprises have been using technological advancements to develop a variety of innovative ways to use genetic information. For example, it is becoming increasingly common for people to learn more about their health and family history by paying direct-to-consumer (“DTC”) companies to analyze their genetic data. DTC companies store the results of these tests electronically and often share them with pharmaceutical companies …

Discipline And Policing, Kate Levine

Faculty Publications

A prime focus of police-reform advocates is the transparency of police discipline. Indeed, transparency is one of, the most popular accountability solutions for a wide swath of policing problems. This Article examines the “transparency cure” as it applies to Police Disciplinary Records (“PDRs”). These records are part of an officer’s personnel file and contain reported wrongdoing from supervisors, Internal Affairs Bureaus, and Citizen Complaint Review Boards.

This Article argues that making PDRs public is worthy of skeptical examination. It problematizes the notion that transparency is a worthy end goal for those who desire to see police-reform in general. Transparency is …

Florida Law, Mobile Research Applications, And The Right To Privacy, Stacey A. Tovino

Faculty Articles

This Article investigates whether state law contains comprehensive privacy, security, and breach notification standards that could apply to independent scientists who conduct mobile app mediated health research. Focusing only on Florida law, this Article assesses potentially relevant and applicable sources of privacy, security, and breach notification standards for health data of the type obtained during mobile app mediated health research studies. This Article concludes that, with one exception, Florida law tends to fall into one of two categories: (1) the law contains at least one data privacy, security, or breach notification standard, but the standard is limited in application to …

Recording As Heckling, Scott Skinner-Thompson

Publications

A growing body of authority recognizes that citizen recording of police officers and public space is protected by the First Amendment. But the judicial and scholarly momentum behind the emerging “right to record” fails to fully incorporate recording’s cost to another important right that also furthers First Amendment principles: the right to privacy.

This Article helps fill that gap by comprehensively analyzing the First Amendment interests of both the right to record and the right to privacy in public while highlighting the role of technology in altering the First Amendment landscape. Recording information can be critical to future speech and, …

Stirring The Pot: A Response To Rothman's Right Of Publicity, Stacey Dogan

Faculty Scholarship

Any commentary on Jennifer Rothman’s terrific book has to begin with a compliment to her extraordinary commitment to the right of publicity. For the uninitiated, her website, Rothman’s Roadmap to the Right of Publicity, provides a treasure trove of information about the right of publicity in each of the fifty states. Professor Rothman has also written several articles and a number of excellent amicus briefs in some of the most important right-of-publicity cases in recent years. Finally, this latest contribution—her book—harnesses this exhaustive research and presents it as a historical narrative that is comprehensive, thoughtful, and readable. This book will …

Data Mining And The Challenges Of Protecting Employee Privacy Under U.S. Law, Pauline Kim

Scholarship@WashULaw

Concerns about employee privacy have intensified with the introduction of data mining tools in the workplace. Employers can now readily access detailed data about workers’ online behavior or social media activities, purchase background information from data brokers, and collect additional data from workplace surveillance tools. When data mining techniques are applied to this wealth of data, it is possible to infer additional information about employees beyond the information that is collected directly. As a consequence, these tools can alter the meaning and significance of personal information depending upon what other information it is aggregated with and how the larger dataset …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

Policing, Databases, And Surveilance: Five Regulatory Categories, Christopher Slobogin

Vanderbilt Law School Faculty Publications

Databases are full of personal information that law enforcement might find useful. Government access to these databases can be divided into five categories: suspect-driven; profile-driven; event-driven; program-driven and volunteer-driven. This chapter recommends that, in addition to any restrictions imposed by the Fourth Amendment (which currently are minimal), each type of access should be subject to its own regulatory regime. Suspect-driven access should depend on justification proportionate to the intrusion. Profile-driven access should likewise abide by a proportionality principle but should also be subject to transparency, vetting, and universality restrictions. Event-driven access should be cabined by the time and place of …

The Ironic Privacy Act, Margaret Hu

Faculty Publications

This Article contends that the Privacy Act of 1974, a law intended to engender trust in government records, can be implemented in a way that inverts its intent. Specifically, pursuant to the Privacy Act's reporting requirements, in September 2017, the U.S. Department of Homeland Security (DHS) notified the public that record systems would be modified to encompass the collection of social media data. The notification justified the collection of social media data as a part of national security screening and immigration vetting procedures. However, the collection will encompass social media data on both citizens and noncitizens, and was not explicitly …