Consumer Protection Law Commons^™

Increasing Lapses In Data Security: The Need For A Common Answer To What Constitutes Standing In A Data Breach Context, Aaron Benjamin Edelman

Journal of Law and Policy

As the number of data breaches continues to rise in the United States, so does the amount of data breach litigation. Many potential plaintiffs who suffered as victims of data breaches, however, find themselves in limbo regarding the issue of standing before a court because of a significant split on standing determinations amongst the federal circuit courts. Thus, while victims of data breaches oftentimes have their personal information fall into the hands of nefarious characters who intend to use the information to a victim’s detriment, that may not be enough to provide victims a right to sue in federal court …

It's Nothing Personal: Why Existing State Laws On Point-Of-Sale Consumer Data Collection Should Be Replaced With A Federal Standard, Kate Mirino

St. John's Law Review

(Excerpt)

Accordingly, this Note proposes a contemporary-minded federal solution to preempt and standardize the various, outmoded state approaches in this field. Part I engages in a historical overview of the development of information privacy law in the United States. Part II provides a summary and comparison of the existing state rules at play. Part III discusses the negative consequences—both to consumers and to businesses—of inconsistent regulation in this area, and explains why a federal solution is necessary. Part IV outlines the parameters of the federal regulation proposed by this Note.

Table Of Contents, Seattle University Law Review

Seattle University Law Review

No abstract provided.

The Equifax Data Breach: An Opportunity To Improve Consumer Protection And Cybersecurity Efforts In America, Gregory S. Gaglione Jr.

Buffalo Law Review

No abstract provided.

Identities Lost: Enacting Federal Law Mandating Disclosure & Notice After A Data Security Breach, John Ogle

Arkansas Law Review

Identity theft is real, it’s here, and consumers need protection. Over the past five years hackers have stolen billions of consumers’ sensitive information like social security numbers, addresses, and bank routing numbers from companies that have neglected their security measures. Most of the time these security breaches are easily preventable. Companies sometimes wait weeks, months, or even years to inform the customers whose information was stolen because there is no federal law that requires disclosure. As of 2018, all 50 states have adopted security breach notification laws that require companies to inform consumers that their information may have been stolen …

Privacy And Connected Objects, Nicolas Karsenti

Canadian Journal of Law and Technology

Our society perennially seeks to multiply its connectivity in the name of greater efficiency. Over the past few years, several devices that had previously been quite basic have been made ‘‘smarter” in order to facilitate a consumer’s life. A recent study highlights that some of the most common reasons for using ‘‘smart” objects are home automation and remote control. Thus, convenience is driving companies, particularly appliance makers, to connect their devices to the internet in order to make them ‘‘smart”. These range from intelligent thermostats, smart fridges, connected pacemakers, smart watches and personal assistants (PAs) such as Alexa, Siri or …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

No abstract provided.

Identities In Critical Condition: The Urgent Need To Reevaluate The Investigation And Resolution Of Claims Of Medical Identity Theft, Stephanie Lindgren

Mitchell Hamline Law Review

No abstract provided.

Protecting Consumers In The Age Of The Internet Of Things, Nicole Smith Futrell

Faculty Scholarship

“Wake up, baby!”

Imagine waking up in the middle of the night to the sound of a stranger speaking to your baby through the baby monitor. For one Texas couple, this horror story became reality when a man hacked their internet-connected monitors to watch and stalk their child. In a similarly horrifying scenario, a hacker stalked Miss Teen USA, Cassidy Wolf, for a year via her webcam. The stalker had 24/7 access to her webcam and also traced the keystrokes on her keyboard to learn her passwords for various web accounts. Subsequently, the hacker used private information he learned about …

Genetic Data Privacy Solutions In The Gdpr, Kristi Harbord

Texas A&M Law Review

The intersection of healthcare and technology is a rapidly growing area. One thriving field at this intersection involves obtaining, processing, and storing genetic data. While the benefits have been great, genetic information can reveal a great deal about individuals and their families. And the information that can be conveyed from genetic data appears limitless and is constantly growing and changing. Many entities have begun storing, processing, and sharing genetic data on a very large scale. This creates many privacy concerns that the current regulatory framework does not account for. The line between patient data and consumer data is blurred; many …

Privacy's Law Of Design, Ari Ezra Waldman

Articles & Chapters

Privacy by design is about making privacy part of the conception and development of new data collection tools. But how should we interpret “privacy by design” as a legal mandate? As it transitions from an academic buzzword into binding law, privacy by design will, for the first time, impose real responsibilities on real people to do specific things at specific times. And yet, there remains significant disagreement about what privacy by design actually means in practice: we have yet to define its who, what, when, why, and how. Different approaches to privacy by design have tried to answer those questions …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

The Equifax Data Breach And The Resulting Legal Recourse, Caitlin Kenny

Brooklyn Journal of Corporate, Financial & Commercial Law

What happens when one’s sensitive information falls into the wrong hands? With the twenty-first century’s advancement of technology comes the increasing problem of data breaches wherein sensitive information is exposed. On September 7, 2017, Equifax, one of three major United States credit reporting agencies announced one of the largest data breaches in the history of the United States. The data breach affected approximately 145 million consumers and subsequently a wave of consumer class actions followed. This Note clarifies why class action lawsuits and arbitration are not viable legal remedies for massive data breaches where entities like credit reporting agencies are …

Workplace Privacy In The Age Of Social Media, Tess Traylor-Notaro

Global Business Law Review

This note addresses the lack of adequate protections in Ohio for social media privacy laws in the workplace and compares proposed legislation in Ohio to legislation that has passed in other states. It examines the provision of the SCA including the definition of "user" and whether social media sites fall under its umbrella. It also looks at the safeguards and limitations of the SCA and how it is used to protect a private employee’s social media account. It analyzes the state statutory laws in Arkansas, Illinois, and California passed specifically to prevent employers from requesting passwords to personal Internet accounts. …

Consumer Law Immersion, Kevin M. Mcdonald, Karl Hochkammer, Steven Wernikoff

Global Business Law Review

As part of Washington University School of Law’s (WashULaw) Online Master of Legal Studies (MLS) program, students attend optional weekend immersion courses at the law school in St. Louis in both the spring and fall. We recently taught a course on consumer law over the spring 2018 weekend session held on March 23-25, 2018. In attendance were twenty-two students, most of whom were enrolled in the MLS program. Several were foreign lawyers and one was an LL.M. student. This article summarizes our three-day experience and concludes with our key learnings that incorporate feedback we received from students both during and …

Sexual Privacy, Danielle Keats Citron

Faculty Scholarship

Those who wish to control and expose the identities of women and people from marginalized communities routinely do so by invading their privacy. People are secretly recorded in bedrooms and public bathrooms, and “up their skirts.” They are coerced into sharing nude photographs and filming sex acts under the threat of public disclosure of their nude images. People’s nude images are posted online without permission. Machine-learning technology is used to create digitally manipulated “deep fake” sex videos that swap people’s faces into pornography.

At the heart of these abuses is an invasion of sexual privacy—the behaviors and expectations that manage …

Privacy Of Information And Dna Testing Kits, Shanna Raye Mason

Catholic University Journal of Law and Technology

In modern times, consumers desire for more control over their own health and healthcare. With this growing interest of control, direct to consumer DNA testing kits have never been more popular. However, many consumers are unaware of the potential privacy concerns associated with such use. This comment examines the popularity and privacy risks that are likely unknown to the individual consumer. This comment also addresses the shortcomings of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as well as the Genetic Information Nondiscrimination Act of 2008 (GINA) in regard to protecting individual’s genetic information from misuse. This comment …

The Gdpr’S Version Of Algorithmic Accountability, Margot Kaminski

Publications

No abstract provided.

Alexa, Who Owns My Pillow Talk? Contracting, Collaterizing, And Monetizing Consumer Privacy Through Voice-Captured Personal Data, Anne Logsdon Smith

Catholic University Journal of Law and Technology

With over one-fourth of households in the U.S. alone now using voice-activated digital assistant devices such as Amazon’s Echo (better known as “Alexa”) and Google’s Home, companies are recording and transmitting record volumes of voice data from the privacy of people’s homes to servers across the globe. These devices capture conversations about everything from online shopping to food preferences to entertainment recommendations to bedtime stories, and even phone and appliance use. With “Big Data” and business analytics expected to be a $203 billion-plus industry by 2020, companies are racing to acquire and leverage consumer data by selling it, licensing it, …

Commodifying Consumer Data In The Era Of The Internet Of Things, Stacy-Ann Elvy

Articles & Chapters

Internet of Things (“IOT”) products generate a wealth of data about consumers that was never before widely and easily accessible to companies. Examples include biometric and health-related data, such as fingerprint patterns, heart rates and calories burned. This Article explores the connection between the types of data generated by the IOT and the financial frameworks of Article 9 of the Uniform Commercial Code and the Bankruptcy Code. It critiques these regimes, which enable the commodification of consumer data, as well as laws aimed at protecting consumer data, such as the Bankruptcy Abuse Prevention and Consumer Protection Act, various state biometric …

Video Review; Routine Data Sharing Practices Place Video-Streaming Providers In The Crosshairs Of The Video Privacy Protection Act, Jeremiah P. Ledwidge

Brooklyn Journal of Corporate, Financial & Commercial Law

The Video Privacy Protection Act of 1988 (VPPA) creates a private cause of action for any consumer whose personally identifiable information has been disclosed by a video tape service provider to a third party. The rapid growth of media companies that provide free internet-based video-streaming services, and the technologically-advanced advertising methods employed to fund this business model, have created uncertainty regarding the specific consumer segments the VPPA is designed to protect. The extensive role that third-party providers play in the collection, analysis, and segmentation of user data in the personalized advertising process raises justifiable privacy concerns for consumers. Recent VPPA …

Who Are The Real Cyberbullies: Hackers Or The Ftc? The Fairness Of The Ftc’S Authority In The Data Security Context, Jaclyn K. Haughom

Catholic University Law Review

As technology continues to be an integral part of daily life, there lies an ever-increasing threat of the personally identifiable information of consumers being lost, stolen, or accessed without authorization. The Federal Trade Commission (FTC) is the U.S. government’s primary consumer protection agency and the country’s lead enforcer against companies subject to data breaches. Although the FTC lacks explicit statutory authority to enforce against data breaches, the Commission has successfully relied on Section 5 of the FTC Act (FTCA) to exercise its consumer protection power in the data security context. However, as the FTC continues to take action against businesses …

Guardians Of The Galaxy Of Personal Data: Assessing The Threat Of Big Data And Examining Potential Corporate And Governmental Solutions, Timothy A. Asta

Florida State University Law Review

No abstract provided.

Yershov V. Gannett: Rethinking The Vppa In The 21st Century, Ariel A. Pardee

Maine Law Review

Almost anyone with a smartphone can recall a time when an online advertisement followed them from webpage to webpage, or mobile browser to mobile application, or even jumped from a mobile device to a desktop web browser. While some people see it as a harmless—or even helpful—quirk of the online world, others find it creepy and intrusive. In the absence of significant government regulation of online advertising practices, particularly aggrieved individuals have sought relief in the courts by alleging violations of ill-fitting statutes drafted decades ago. This note explores just such a case, Yershov v. Gannett, in which the First …

Comments To The Federal Trade Commission On The Can-Spam Rule Review, 16 C.F.R. Part 316, Project No. R711010, Roger Allan Ford

Law Faculty Scholarship

These comments respond to the Federal Trade Commission’s request for public comment on the CAN-SPAM Rule, 16 C.F.R. Part 316.

The CAN-SPAM Act set a minimum baseline for consumer protections that senders of unsolicited commercial email must respect. These protections have been largely effective at giving consumers the ability to manage how a large group of companies uses their email addresses for marketing. At the same time, the Act has had little effect on the volume of unsolicited commercial email or on the amount of email sent by scammers and fraudsters. The Act and its implementing Rule, then, have been …

Averting Robot Eyes, Margot E. Kaminski, Matthew Rueben, William D. Smart, Cindy M. Grimm

Maryland Law Review

No abstract provided.

In Defense Of The Long Privacy Statement, Mike Hintze

Maryland Law Review

No abstract provided.

Ispy: Threats To Individual And Institutional Privacy In The Digital World, Lori Andrews

All Faculty Scholarship

What type of information is collected, who is viewing it, and what law librarians can do to protect their patrons and institutions.

Looking Backward, Moving Forward: What Must Be Remembered When Resolving The Right To Be Forgotten, Katherine Stewart

Brooklyn Journal of International Law

In May 2014, the European Court of Justice decided Google Spain v. AEPD and González and granted citizens the right to be forgotten, rather, the right to request any search engine offering services to European consumers to remove certain results displayed after a search of a citizen’s name. This decision has also resulted in an ongoing battle between Google and the Commission Nationale de l’Infomatique et des Libertés (CNIL), France’s data protection authority. The CNIL believes that Google must apply the right to be forgotten to all domains worldwide, including Google.com. Google, however, has been reluctant to do so, given …

It Depends: Recasting Internet Clickwrap, Browsewrap, "I Agree," And Click-Through Privacy Clauses As Waivers Of Adhesion, Charles E. Maclean

Cleveland State Law Review

Digital giants, enabled by America’s courts, Congress, and the Federal Trade Commission, devise click-through, clickwrap, browsewrap, "I Agree" waivers, and other legal fictions that purport to evidence user "consent" to consumer privacy erosions. It is no longer enough to justify privacy invasions as technologically inevitable or as essential to the American economy. As forced consent is no consent at all, privacy policies must advance with the technology. This article discusses adhesion waivers, the potential for FTC corrective action, and a comparison to privacy policies of the European Union.