Internet Law Commons^™

Verification Dilemmas In Law And The Promise Of Zero-Knowledge Proofs, Kenneth A. Bamberger, Ron Canetti, Shafi Goldwasser, Evan J. Zimmerman

Faculty Scholarship

Individuals who wish to access a website or qualify for a loan are expected to expose personally identifying information, undermining their privacy and security. Firms share proprietary information in dealmaking negotiations which, if the deal fails, may be used by the negotiating partner for a competitive advantage. Regulators are expected to disclose their algorithmic tools to comply with public transparency and oversight requirements, a practice that risks rendering these tools circumventable and ineffective. Litigants might have to reveal trade secrets in court proceedings to prove a claim or defense. Such “verification dilemmas” — costly choices between opportunities that require the …

A Proportionality-Based Framework For Government Regulation Of Digital Tracing Apps In Times Of Emergency, Sharon Bassan

Dickinson Law Review (2017-Present)

Times of emergency present an inherent conflict between the public interest and the preservation of individual rights. Such times require granting emergency powers to the government on behalf of the public interest and relaxing safeguards against government actions that infringe rights. The lack of theoretical framework to assess governmental decisions in times of emergency leads to a polarized and politicized discourse about potential policies, and often, to public distrust and lack of compliance.

Such a discourse was evident regarding Digital Tracing Apps (“DTAs”), which are apps installed on cellular phones to alert users that they were exposed to people who …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

Table of Contents

Legislating Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

Understanding American Privacy, Neil M. Richards, Andrew B. Serwin, Tyler Blake

Scholarship@WashULaw

This Article is an explanation of some of the key features of American privacy law for a general audience. In particular, it tries to explain American privacy law against the critique that because the US currently lacks a European-style privacy law, the United States lacks much in the way of privacy law. We argue that the lack of a European-style data protection law in the United States is not the end of the analysis. This article therefore offers a basic roadmap to American privacy law for the uninitiated. In order to understand American privacy, we believe that it is important …

The Surprising Virtues Of Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

On The Propertization Of Data And The Harmonization Imperative, Luis Miguel M. Del Rosario

Fordham Law Review

The digital age has paved the way for unforeseen and unconscionable harms. Recent experiences with security breaches, surveillance programs, and mass disinformation campaigns have taught us that unchecked data collection, use, retention, and transfer have the potential to affect everything from health-care access to national security. And they have shown the growing need for a solution that addresses this proliferation of intangible collective harms. This Note champions data propertization—the process of establishing a bundle of rights in data comparable to those that comprise property interests—as the proper method for preventing and redressing data harms. More specifically, this Note analyzes Illinois’s …

Legislating Data Loyalty, Woodrow Hartzog, Neil Richards

Faculty Scholarship

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

The Wild West Of Data Privacy: Why Rhode Island Needs To Enact Comprehensive Legislation To Protect Consumers’ Data, Candace Quinn

Roger Williams University Law Review

No abstract provided.

‘‘Don’T Take On The Responsibilty Of Somebody Else’S Fu**Ed Up Behavior”: Responding To Online Abuse In The Context Of Barriers To Support, Chandell Gosse

Canadian Journal of Law and Technology

Responsibilization, in a true circular fashion, is not only born of but also benefits institutional (e.g., social media companies and law enforcement) and cultural power structures (e.g., misogyny and patriarchy). When targets of online abuse take responsibility for the abuse launched against them, that assumption of responsibility requires energy, and that energy is taken away from efforts to hold institutions and perpetrators accountable. Responsibilization tries to tranquilize change in the service of power. The tricky thing about interrupting this process is that it requires more than just offering better support. It also requires exposing, challenging, and dismantling harmful ideologies, belief …

Let The Machines Do The Dirty Work: Social Media, Machine Learning Technology And The Iteration Of Racialized Surveillance, Subhah Wadhawan

Canadian Journal of Law and Technology

Post 9/11, where the current social and cultural temperature has constructed Islam as interchangeable with terrorism, digital intermediaries have responded with increased censorship of speech related to, emerging from, or advocating Islamic ideology. At the heart of this paper is the argument that digital intermediaries have relied on the opaqueness of machine learning technology (‘‘MLT”) to realize racialized surveillance, whereby speech concerning Islamic content has been disproportionally censored. This paper maps out how inherent biases concerning the ideology of Islam have been interwoven into the coding and machine learning used by the major tech giants. As a result of the …

Delineating The Legal Framework For Data Protection: A Fundamental Rights Approach Or Data Propertization?, Efe Lawrence Ogbeide

Canadian Journal of Law and Technology

The Charter of Fundamental Rights of the European Union, like other key legal instruments around the globe, grants citizens the right to privacy in Article 7. The Charter, however, further provides for the right to data protection in Article 8. Simply put, the implication of Article 8 of the Charter is that the right to data protection is a fundamental right. The central question in this article is whether data protection indeed qualifies to be categorized as a fundamental right. If not, what other approach(es) to data protection may be implemented?

Onlife Harms: Uber And Sexual Violence, Amanda Turnbull

Canadian Journal of Law and Technology

Uber markets itself as a technology company that is managed primarily by ML algorithms with the support of human engineers. Yet, in its 2019 Report, the role that its technology played in relation to sexual violence is, for all intents and purposes, absent. Likewise, solutions dealing specifically with the role of technology in facilitating gender-based violence are also missing from the series of initiatives in which Uber has invested that are aimed at preventing sexual violence. Uber was not sufficiently rigorous in defining the problem it was trying to solve. It was a missed opportunity that has resulted in continued …

Technologies Of Servitude Understanding Firmware Tpms As Interests In Personal Property, Anthony D. Rosborough

Canadian Journal of Law and Technology

Widespread computerization and embedded system design has facilitated the pervasive and latent implementation of technological protection measures (‘‘TPMs”) to restrict device firmware access. Often referred to as ‘‘digital locks,” these restrictions impose a whole host of limitations on how owners use and manage the increasing number of products and devices in which they are incorporated. In many cases, TPM restrictions can prevent activities with social, environmental, and economical benefits, including repair, repurposing, and interoperability. In response, governments around the world are now revisiting and scrutinizing their TPM anti-circumvention laws within copyright and competition policy. Beyond these perspectives, this article looks …

Officially Obsolete? A Critical Examination Of The Canadian Official Marks Regime And Its Waning Relevancy In Trademark Law, Maddison Tebbutt

Canadian Journal of Law and Technology

When the Trademark Act (‘‘TMA”) came about in 1985, a unique aspect of Canadian trademark law was created: the official marks regime under section 9(1)(n). The official marks regime is available to public authorities and universities as a means of sidestepping the lengthy and expensive process of trademark registration and providing special protection for official marks. Once public authorities and universities obtain an official mark through this system, they are entitled to an expansive monopoly that allows them to use their mark for commercial use, while simultaneously keeping the official mark out of the public domain. Moreover, while …

Bringing Section 8 Home: An Argument For Recognizing A Reasonable Expectation Of Privacy In Metadata Collected From Smart Home Devices, Ana Qarri

Canadian Journal of Law and Technology

Internet of Things devices (also known as smart home devices) are a fast-growing trend in consumer home electronics. The information collected from these devices could prove very useful to law enforcement investigations. These individual pieces of metadata — the collection of which might appear harmless on its face — can be highly revealing when combined with other metadata or information otherwise available to law enforcement. This article builds an argument in favour of recognizing a reasonable expectation of privacy in metadata collected from smart home devices under section 8 of the Canadian Charter of Rights and Freedoms. This article presents …

From Nyan Cat To Nfts: Determining How Canada’S Cultural Property Export And Import Act Applies To Digital Works, Mitchel Fleming

Canadian Journal of Law and Technology

One of Canada’s principal pieces of legislation enacted to protect its cultural patrimony is not well equipped to deal with the rise of digital content creation. Digital works, particularly NFTs, pose a unique challenge to the established regime. This paper seeks to understand how these artistic developments fit within the current legislative framework and whether legislative action is needed to bring these revolutionary mediums within the scope of the Cultural Property Export and Import Act. Ultimately, the author concludes that while digital works may be captured by the Act under specific circumstances, the protectionist policies of the past are …

In Celebration Of Dissents (And Lengthy Textbooks): How Digital Became Different For The Fourth Amendment And Why It Is Time For A Real Warrant Default, Stephen E. Henderson

Faculty Articles

The last decade has brought tremendous change to the Fourth Amendment, finally resulting in a ‘digital is different’ norm. We stand at an inflection point between a monolithic, analog past and a murky future of yet-unarticulated constitutional digital policing rules. It is a good time, then, to reflect upon how we came to be here and where we ought to go. This Essay first looks back to a monumental, majestic dissent: that of Justice Louis Brandeis in the 1928 decision of Olmstead v. United States. Every American, and especially every law student, ought to know that opinion, and judges …

Requiring What’S Not Required: Circuit Courts Are Disregarding Supreme Court Precedent And Revisiting Officer Inadvertence In Cyberlaw Cases, Michelle Zakarin

Scholarly Works

As the age of technology has taken this country by surprise and left us with an inability to formally prepare our legal system to incorporate these advances, many courts are forced to adapt by applying pre-technology rules to new technological scenarios. One illustration is the plain view exception to the Fourth Amendment. Recently, the issue of officer inadvertence at the time of the search, a rule that the United States Supreme Court has specifically stated is not required in plain view inquiries, has been revisited in cyber law cases. It could be said that the courts interested in the existence …

Individuals As Gatekeepers Against Data Misuse, Ying Hu

Michigan Technology Law Review

This article makes a case for treating individual data subjects as gatekeepers against misuse of personal data. Imposing gatekeeper responsibility on individuals is most useful where (a) the primary wrongdoers engage in data misuse intentionally or recklessly; (b) misuse of personal data is likely to lead to serious harm; and (c) one or more individuals are able to detect and prevent data misuse at a reasonable cost.

As gatekeepers, individuals should have a legal duty to take reasonable measures to prevent data misuse where they are aware of facts indicating that the person seeking personal data from them is highly …

Uncertain Terms, Leah R. Fowler, Jim Hawkins, Jessica L. Roberts

Notre Dame Law Review

Health apps collect massive amounts of sensitive consumer data, including information about users’ reproductive lives, mental health, and genetics. As a result, consumers in this industry may shop for privacy terms when they select a product. Yet our research reveals that many digital health tech companies reserve the right to unilaterally amend their terms of service and their privacy policies. This ability to make one-sided changes undermines the market for privacy, leaving users vulnerable. Unfortunately, the current law generally tolerates unilateral amendments, despite fairness and efficiency concerns. We therefore propose legislative, regulatory, and judicial solutions to better protect consumers of …

You Are Not A Commodity: A More Efficient Approach To Commercial Privacy Rights, Benjamin T. Pardue

Washington Law Review

United States common law provides four torts for privacy invasion: (1) disclosure of private facts, (2) intrusion upon seclusion, (3) placement of a person in a false light, and (4) appropriation of name or likeness. Appropriation of name or likeness occurs when a defendant commandeers the plaintiff’s recognizability, typically for a commercial benefit. Most states allow plaintiffs who establish liability to recover defendants’ profits as damages from the misappropriation under an “unjust enrichment” theory. By contrast, this Comment argues that such an award provides a windfall to plaintiffs and contributes to suboptimal social outcomes. These include overcompensating plaintiffs and incentivizing …

From The Golden Gate To London: Bridging The Gap Between Data Privacy And The Right Of Publicity, Kristin Kuraishi

Brooklyn Journal of International Law

Currently, there is no global standard or recognition for the right of publicity. Even within the United States, the recognition, scope, and protections vary by state. As the world becomes increasingly reliant on social media for news, information, communication, and recommendations, micro-influencers and non-celebrities require a way to control their developed and curated name, image, and likeness from unauthorized commercial uses by others. Advertising is occurring more frequently online, and brands recognize the power that micro-influencers have on commerce. Some countries, like the United Kingdom, do not recognize the right of publicity, potentially leaving many individuals without recourse for the …

Digital Privacy Rights And Cloud Act Agreements, Tim Cochrane

Brooklyn Journal of International Law

The United States (US) and United Kingdom (UK) will soon bring into force a new international law enforcement data sharing ‘CLOUD Act agreement’ (US-UK Agreement), the first of its kind under the Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act). These agreements enable law enforcement in one state to directly request data from service providers based in the other state. They respond to long-standing concerns with the main mechanism for obtaining overseas data, mutual legal assistance (MLA). The US and UK claim the US-UK Agreement will significantly speed up data access relative to MLA while “respecting privacy and …

Gdpr, Pipl & Lgpd: Privacy Regulations & Policies Across The Globe, Raymond H. Geistel

Cybersecurity Undergraduate Research Showcase

Several privacy laws around the world are adopting similar regulations to the GPDR; this has effects on privacy policies of companies providing services in across multiple countries & continents. While these regulations share many attributes, their differing requirements can make things difficult for companies regarding said policies. Automation could be a potential solution to both analyze and compare regulations from different nations & international organizations, analyze and monitor privacy policy adherence to said regulations.

Schrems's Slippery Slope: Strengthening Governance Mechanisms To Rehabilitate Eu-U.S. Cross-Border Data Transfers After Schrems Ii, Edward W. Mclaughlin

Fordham Law Review

In July 2020, the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield Framework, the central data governance mechanism that once governed cross-border data transfers from the European Union (EU) to the United States. For the second time in five years, Europe’s top court invalidated the primary method of cross-border data transfers. Both times the CJEU found that the United States’s surveillance laws were, and remain, overbroad and fail to provide EU citizens with protections that are essentially equivalent to those guaranteed under the EU’s General Data Protection Regulation (GDPR) in light of the Charter of Fundamental …

A Comparative Study Of Dark Patterns Across Mobile And Web Modalities, Johanna Gunawan, Amogh Pradeep, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Dark patterns are user interface elements that can influence a person's behavior against their intentions or best interests. Prior work identified these patterns in websites and mobile apps, but little is known about how the design of platforms might impact dark pattern manifestations and related human vulnerabilities. In this paper, we conduct a comparative study of mobile application, mobile browser, and web browser versions of 105 popular services to investigate variations in dark patterns across modalities. We perform manual tests, identify dark patterns in each service, and examine how they persist or differ by modality. Our findings show that while …

Personal Data Privacy And Protective Federal Legislation: An Exploration Of Constituent Position On The Need For Legislation To Control Data Reliant Organizations Collecting And Monetizing Internet-Obtained Personal Data, Giovanni De Meo

Dissertations

In the past twenty years, the business of online personal data collection has grown at the same rapid pace as the internet itself, fostering a multibillion-dollar personal data collection and commercialization industry. Unlike many other large industries, there has been no major federal legislation enacted to monitor or control the activities of organizations dealing in this flourishing industry. The combination of these factors together with the lack of prior research encouraged this research designed to understand how much voters know about this topic and whether there is interest in seeing legislation enacted to protect individual personal data privacy.

To address …

Private Lives At Home And Public Lives In Court: Protecting The Privacy Of Federal Judges' Home Addresses, Hannah Elias Sbaity

Journal of Intellectual Property Law

Targeted murders of federal judges and their families at their private homes date back to May 29, 1979. Most recently, in July 2020, Judge Esther Salas’s only son, Daniel, was murdered and her husband near-fatally shot at their home. Individuals wishing to inflict such harm or death at federal judges’ homes have been able to do so because of federal judges’ publicly available home addresses. Because personally identifying information (PII) is defined differently from statute to statute, home addresses largely remain public information in most states and can be found in real estate records, data broker websites, social media platforms, …

A Deep Dive Into Technical Encryption Concepts To Better Understand Cybersecurity & Data Privacy Legal & Policy Issues, Anthony Volini

Journal of Intellectual Property Law

Lawyers wishing to exercise a meaningful degree of leadership at the intersection of technology and the law could benefit greatly from a deep understanding of the use and application of encryption, considering it arises in so many legal scenarios. For example, in FTC v. Wyndham1 the defendant failed to implement nearly every conceivable cybersecurity control, including lack of encryption for stored data, resulting in multiple data breaches and a consequent FTC enforcement action for unfair and deceptive practices. Other examples of legal issues requiring use of encryption and other technology concepts include compliance with security requirements of GLBA & HIPAA, …