Consumer Protection Law Commons^™

The United States: Big Data, Little Regulation, Megan Valent

University of Miami Business Law Review

In the United States today, there is no single law to address the privacy concerns associated with the collection of consumer data. Lawmakers have introduced policies that seek to address data privacy at the federal level, but Congress has not yet acted to create a comprehensive law to protect consumers. On the contrary, in 2016, the European Union passed its General Data Protection Regulation to address the dangers associated with “Big Data” and to give consumers control over their data.

Unfortunately, in the United States consumers are often unaware of how their data is being handled and what is done …

Modern Privacy Advocacy: An Approach At War With Privacy Itself?, Justin "Gus" Hurwitz, Jamil N. Jaffer

Pepperdine Law Review

This Article argues that the modern concept of privacy itself, particularly as framed by some of its most ardent advocates today, is fundamentally incoherent. The Article highlights that many common arguments made in support of privacy, while initially seeming to protect this critical value, nonetheless undermine it in the long run. Using both recent and older examples of applying classic privacy advocacy positions to key technological innovations, the authors demonstrate how these positions, while seemingly privacy-enhancing at the time, actually resulted in outcomes that were less beneficial for consumers and citizens, including from a purely privacy-focused perspective. As a result, …

Saving America’S Privacy Rights: Why Carpenter V. United States Was Wrongly Decided And Why Courts Should Be Promoting Legislative Reform Rather Than Extending Existing Privacy Jurisprudence, David Stone

St. Mary's Law Journal

Privacy rights are under assault, but the Supreme Court’s judicial intervention into the issue, starting with Katz v. United States and leading to the Carpenter v. United States decision has created an inconsistent, piecemeal common law of privacy that forestalls a systematic public policy resolution by Congress and the states. In order to reach a satisfactory and longlasting resolution of the problem consistent with separation of powers principles, the states should consider a constitutional amendment that reduces the danger of pervasive technologyaided surveillance and monitoring, together with a series of statutes addressing each new issue posed by technological change as …

Privacy's Constitutional Moment And The Limits Of Data Protection, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

America’s privacy bill has come due. Since the dawn of the Internet, Congress has repeatedly failed to build a robust identity for American privacy law. But now both California and the European Union have forced Congress’s hand by passing the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). These data protection frameworks, structured around principles for Fair Information Processing called the “FIPs,” have industry and privacy advocates alike clamoring for a “U.S. GDPR.” States seemed poised to blanket the country with FIP-based laws if Congress fails to act. The United States is thus in the midst …

A Relational Turn For Data Protection?, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

While most approaches to privacy and data protection focus on the data, this paper explores an alternative approach that focuses on relationships. This means looking more closely at how the people who are exposing their information and the people that are inviting that disclosure relate to each other. It is concerned with what powerful parties owe to vulnerable parties–not just with their personal information, but with the things they see, the things they can click, and the decisions that are made about them. It’s less about the nature of data and more about the nature of power. And it can …

The Path To Standing: Asserting The Inherent Injury Of The Data Breach, Jennifer M. Joslin

Utah Law Review

Data breaches are on the rise as consumers continue to exchange personally identifiable information for goods and services in sectors from retail to healthcare. In the aftermath of a data breach, it has been difficult for victims of the breach to establish Article III standing to sue in federal courts. The primary hurdle for those seeking a remedy for the theft of their data has been showing that they have suffered an injury-in-fact. Plaintiffs typically assert an injury based on the increased risk of identity theft following a breach. However, courts have divided on whether such an injury satisfies the …

Identities In Critical Condition: The Urgent Need To Reevaluate The Investigation And Resolution Of Claims Of Medical Identity Theft, Stephanie Lindgren

Mitchell Hamline Law Review

No abstract provided.

Consumer Protection—Exploring Private Causes Of Action For Victims Of Data Breaches, Justin H. Dion, Nicholas M. Smith

Faculty Scholarship

Data breaches are becoming a norm in modern life. Every year it seems that bigger and bigger attacks are launched, and more and more individuals are harmed. The law has responded by increasing states’ ability to prosecute cybercriminals. A glaring hole exists in this protection though. The state is largely an unharmed party. The real harm is done to individual citizens affected by the breaches. Their data is compromised, their identities are stolen, and their livelihoods are placed at risk. This Article will analyze the issue and propose a solution for increased consumer protection in addition to the current criminal …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

Technology Regulation By Default: Platforms, Privacy, And The Cfpb, Rory Van Loo

Faculty Scholarship

In the absence of a technology-focused regulator, diverse administrative agencies have been forced to develop regulatory models for governing their sphere of the data economy. These largely uncoordinated efforts offer a laboratory of regulatory experimentation on governance architecture. This symposium essay explores what the Consumer Financial Protection Bureau (CFPB) has done in its first several years to regulate financial technology (“fintech”), in the context of broader technology-related concerns identified in the literature. It begins with a survey of what the CFPB has undertaken using more traditional administrative agency tools—enforcement and rulemaking—in areas such as privacy, consumer control over data, and …

Consumer Bitcredit And Fintech Lending, Christopher K. Odinet

Faculty Scholarship

The digital economy is changing everything, including how we borrow money. In the wake of the 2008 crisis, banks pulled back in their lending and, as a result, many consumers and small businesses found themselves unable to access credit. A wave of online firms called fintech lenders have filled the space left vacant by traditional financial institutions. These platforms are fast making antiques out of many mainstream lending practices, such as long paper applications and face-to-face meetings. Instead, through underwriting by automation — utilizing big data (including social media data) and machine learning — loan processing that once took days …

Cancelled Credit Cards: Substantial Risk Of Future Injury As A Basis For Standing In Data Breach Cases, Jennifer Wilt

SMU Law Review

No abstract provided.

The Gdpr’S Version Of Algorithmic Accountability, Margot Kaminski

Publications

No abstract provided.

Yershov V. Gannett: Rethinking The Vppa In The 21st Century, Ariel A. Pardee

Maine Law Review

Almost anyone with a smartphone can recall a time when an online advertisement followed them from webpage to webpage, or mobile browser to mobile application, or even jumped from a mobile device to a desktop web browser. While some people see it as a harmless—or even helpful—quirk of the online world, others find it creepy and intrusive. In the absence of significant government regulation of online advertising practices, particularly aggrieved individuals have sought relief in the courts by alleging violations of ill-fitting statutes drafted decades ago. This note explores just such a case, Yershov v. Gannett, in which the First …

Comments To The Federal Trade Commission On The Can-Spam Rule Review, 16 C.F.R. Part 316, Project No. R711010, Roger Allan Ford

Law Faculty Scholarship

These comments respond to the Federal Trade Commission’s request for public comment on the CAN-SPAM Rule, 16 C.F.R. Part 316.

The CAN-SPAM Act set a minimum baseline for consumer protections that senders of unsolicited commercial email must respect. These protections have been largely effective at giving consumers the ability to manage how a large group of companies uses their email addresses for marketing. At the same time, the Act has had little effect on the volume of unsolicited commercial email or on the amount of email sent by scammers and fraudsters. The Act and its implementing Rule, then, have been …

Ispy: Threats To Individual And Institutional Privacy In The Digital World, Lori Andrews

All Faculty Scholarship

What type of information is collected, who is viewing it, and what law librarians can do to protect their patrons and institutions.

Social Data Discovery And Proportional Privacy, Agnieszka Mcpeak

Cleveland State Law Review

Social media platforms aggregate large amounts of personal information as "social data" that can be easily downloaded as a complete archive. Litigants in civil cases increasingly seek out broad access to social data during the discovery process, often with few limits on the scope of such discovery. But unfettered access to social data implicates unique privacy concerns—concerns that should help define the proper scope of discovery.

The Federal Rules of Civil Procedure, as amended in 2015, already contain the tools for crafting meaningful limits on intrusive social data discovery. In particular, the proportionality test under Rule 26 weighs the burdens …

Paying For Privacy And The Personal Data Economy, Stacy-Ann Elvy

Articles & Chapters

Growing demands for privacy and increases in the quantity and variety of consumer data have engendered various business offerings to allow companies, and in some instances consumers, to capitalize on these developments. One such example is the emerging “personal data economy” (PDE) in which companies, such as Datacoup, purchase data directly from individuals. At the opposite end of the spectrum, the “pay-for-privacy” (PFP) model requires consumers to pay an additional fee to prevent their data from being collected and mined for advertising purposes. This Article conducts a simultaneous in-depth exploration of the impact of burgeoning PDE and PFP models. It …

Trusting Big Data Research, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Although it might puzzle or even infuriate data scientists, suspicion about big data is understandable. The concept doesn’t seem promising to most people. It seems scary. This is partly because big data research is shrouded in mystery. People are unsure about organizations’ motives and methods. What do companies think they know about us? Are they keeping their insights safe from hackers? Are they selling their insights to unscrupulous parties? Most importantly, do organizations use our personal information against us? Big data research will only overcome its suspicious reputation when people can trust it.

Some scholars and commentators have proposed review …

Newsroom: Freedman On Credit Reports 02-12-2016, Roger Williams University School Of Law

Life of the Law School (1993- )

No abstract provided.

Use Of Facial Recognition Technology For Medical Purposes: Balancing Privacy With Innovation, Seema Mohapatra

Faculty Scholarship

No abstract provided.

The Notion And Practice Of Reputation And Professional Identity In Social Networking: From K-12 Through Law School, Roberta Bobbie Studwell

Faculty Scholarship

No abstract provided.

The Sixth Pillar Of Anti-Money Laundering Compliance: Balancing Effective Enforcement With Financial Privacy, Maria A. De Dios

Brooklyn Journal of Corporate, Financial & Commercial Law

The U.S. government has responded to the increase of financial crimes, including money laundering and terrorist financing, by requiring that financial institutions implement anti-money laundering compliance programs within their institutions. Most recently, the Financial Crimes Enforcement Network exercised its regulatory powers, as authorized by the Treasury Department, by proposing regulations that now explicitly add customer due diligence to the preexisting anti-money laundering regime. The policy behind the government’s legislative and regulatory measures is clear—financial institutions must ensure that they are protected from and not aiding in the illegal efforts of criminals. The complexity and insidiousness of these financial crimes makes …

When The Default Is No Penalty: Negotiating Privacy At The Ntia, Margot E. Kaminski

Publications

Consumer privacy protection is largely within the purview of the Federal Trade Commission. In recent years, however, the National Telecommunications and Information Administration (NTIA) at the Department of Commerce has hosted multistakeholder negotiations on consumer privacy issues. The NTIA process has addressed mobile apps, facial recognition, and most recently, drones. It is meant to serve as a venue for industry self-regulation. Drawing on the literature on co-regulation and on penalty defaults, I suggest that the NTIA process struggles to successfully extract industry expertise and participation against a dearth of federal data privacy law and enforcement. This problem is most exacerbated …

Taking Trust Seriously In Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Trust is beautiful. The willingness to accept vulnerability to the actions of others is the essential ingredient for friendship, commerce, transportation, and virtually every other activity that involves other people. It allows us to build things, and it allows us to grow. Trust is everywhere, but particularly at the core of the information relationships that have come to characterize our modern, digital lives. Relationships between people and their ISPs, social networks, and hired professionals are typically understood in terms of privacy. But the way we have talked about privacy has a pessimism problem – privacy is conceptualized in negative terms, …

People Analytics And The Regulation Of Information Under The Fair Credit Reporting Act, Pauline Kim, Erika Hanson

Scholarship@WashULaw

People analytics — the use of big data and computer algorithms to make personnel decisions — has been drawing increasing public and scholarly scrutiny. Concerns have been raised that the data collection intrudes on individual privacy, and that algorithms can produce unfair or discriminatory results. This symposium contribution considers whether the Fair Credit Reporting Act’s regulation of consumer information used for employment purposes can respond these concerns. The FCRA establishes certain procedural requirements, and these can sometimes help individual workers challenge inaccurate information about them. However, the statute does little to curb intrusive data collection practices or to address the …

Sacrificing Privacy For Convenience: The Need For Stricter Ftc Regulations In An Age Of Smartphone Surveillance, Ashton Mckinnon

Journal of the National Association of Administrative Law Judiciary

This comment aims to focus on the most frequently used connector that consumers treasure not only for convenience but also as a lifelong necessity - the smartphone. The FTC needs to enforce federally mandated guidelines that will allow the consumer to use technology without the technology using the consumer. Part II of this comment focuses on the type of information that can be collected by various companies, service providers, and agencies from an individual's smartphone, and the intentions of these collectors behind use of this information. Part III evaluates how applications (apps) contribute to this scheme, and, specifically, apps' recordkeeping …

Robots In The Home: What Will We Have Agreed To?, Margot E. Kaminski

Publications

A new technology can expose the cracks in legal doctrine. Sometimes a technology resists analogy. Sometimes, through analogies, it reveals inconsistencies in the law, or basic flaws in framing, or in the fit between different parts of the legal system. This Essay addresses robots in the home, and what they reveal about U.S. privacy law. Household robots might not themselves uproot U.S. privacy law, but they will reveal its inconsistencies, and show where it is most likely to fracture. Just as drones are serving as a legislative “privacy catalyst” — encouraging the enactment of new privacy laws as people realize …

Information Privacy Law Scholars' Brief In Spokeo, Inc. V. Robins, Neil M. Richards, Julie E. Cohen, Chris Jay Hoofnagle, William Mcgeveran, Paul Ohm, Joel R. Reidenberg, David Thaw, Lauren E. Willis

Scholarship@WashULaw

This brief, submitted to the Supreme Court of the United States by 15 information privacy law scholars in the case of Spokeo, Inc. v. Robins (No 13-1339), argues that in enacting the Fair Credit Reporting Act (FCRA), Congress crafted a bargain between aggressive, secretive data-aggregating businesses and the public: if those businesses limited disclosures and made reasonable efforts to adhere to practices ensuring “maximum possible accuracy,” they would enjoy a safe harbor from litigation under many other state and federal theories. The FCRA’s consumer transparency requirements and remedial provisions were designed to encourage steady improvement in consumer reporting practices and …

Regulating The Internet Of Things: First Steps Toward Managing Discrimination, Privacy, Security, And Consent, Scott R. Peppet

Publications

The consumer "Internet of Things" is suddenly reality, not science fiction. Electronic sensors are now ubiquitous in our smartphones, cars, homes, electric systems, health-care devices, fitness monitors, and workplaces. These connected, sensor-based devices create new types and unprecedented quantities of detailed, high-quality information about our everyday actions, habits, personalities, and preferences. Much of this undoubtedly increases social welfare. For example, insurers can price automobile coverage more accurately by using sensors to measure exactly how you drive (e.g., Progressive 's Snapshot system), which should theoretically lower the overall cost of insurance. But the Internet of Things raises new and difficult questions …