Internet Law Commons^™

Confiding In Con Men: U.S. Privacy Law, The Gdpr, And Information Fiduciaries, Lindsey Barrett

Seattle University Law Review

In scope, ambition, and animating philosophy, U.S. privacy law and Europe’s General Data Protection Regulation are almost diametric opposites. The GDPR’s ambitious individual rights, significant prohibitions, substantive enforcement regime, and broad applicability contrast vividly with a scattershot U.S. regime that generally prioritizes facilitating commerce over protecting individuals, and which has created perverse incentives for industry through anemic enforcement of the few meaningful limitations that do exist. A privacy law that characterizes data collectors as information fiduciaries could coalesce with the commercial focus of U.S. law, while emulating the GDPR’s laudable normative objectives and fortifying U.S. consumer privacy law with a …

Privacy Statements Under The Gdpr, Mike Hintze

Seattle University Law Review

The need to include specific types of information in a privacy statement is a GDPR compliance obligation that does not get as much attention as some other GDPR requirements. Perhaps that is because privacy statements have been much maligned in recent years. They are too long and full of legalese. Nobody reads them. They are part of a notice and consent approach to privacy that puts an unrealistic burden on consumers to make informed choices. But despite these well-known criticisms, the GDPR doubles down on privacy statements. In fact, gauging by the roughly fourfold increase in privacy statement requirements compared …

Artificial Intellegence And Policing: First Questions, Elizabeth E. Joh

Seattle University Law Review

Artificial intelligence is playing an increasingly larger role in all sectors of society, including policing. Many police departments are already using artificial intelligence (AI) to help predict and identify suspicious persons and places.1 Increased computational power and oceans of data have given rise to inferences about violence and threats.2 AI will change policing just as it will healthcare, insurance, commerce, and transportation. But what questions should we ask about AI and policing?

The Struggle To Define Privacy Rights And Liabilities In A Digital World And The Unfortunate Role Of Constitutional Standing, Juan Olano

University of Miami Law Review

Today’s world runs on data. The creation and improvement of technological products and services depend on the exchange of data between people and companies. As people’s lives become more digitized, companies can collect, store, and analyze more data, and in turn, create better technology. But, because consumer data can be very sensitive (think Social Security numbers, GPS location, fingerprint recognition, etc.) this cyclical exchange comes with serious privacy risks; especially in light of more frequent and sophisticated cyberattacks. This creates a face-off between technological growth and privacy rights. While it makes sense that people should be willing to subside some …

The Tortoise And The Hare Of International Data Privacy Law: Can The United States Catch Up To Rising Global Standards?, Matthew Humerick

Catholic University Journal of Law and Technology

Technological developments spur the development of big data on a global scale. The breadth of data companies collect, maintain, process, and transmit affects nearly every country and organization around the world. Inherent to big data are issues of data protection and transfers to third countries. While many jurisdictions emphasize the importance of protecting consumer data, such as the European Union, others, like the United States, do not. To circumvent this issue, the United States and European Union contracted around data privacy standard discrepancies through the Safe Harbor Agreement, which eased cross-border data transfers. However, the Court of Justice of the …

The Industrial Internet Of Things: Risks, Liabilities, And Emerging Legal Issues, Mauricio Paez, Kerianne Tobitsch

NYLS Law Review

No abstract provided.

Borders And Bits, Jennifer Daskal

Scholarly Articles in Law Reviews & Journals

Our personal data is everywhere and anywhere, moving across national borders in ways that defy normal expectations of how things and people travel from Point A to Point B. Yet, whereas data transits the globe without any intrinsic ties to territory, the governments that seek to access or regulate this data operate with territorial-based limits. This Article tackles the inherent tension between how governments and data operate, the jurisdictional conflicts that have emerged, and the power that has been delegated to the multinational corporations that manage our data across borders as a result. It does so through the lens of …

Keynote Address: The Digital Forevermore, Thomas J. Ridge

University of Richmond Law Review

No abstract provided.

Newsroom: Cybersecurity: Obama's Conflicted Legacy 02-17-2017, Peter Margulies

Life of the Law School (1993- )

No abstract provided.

The Inadequate, Invaluable Fair Information Practices, Woodrow Hartzog

Faculty Scholarship

For the past thirty years, the general advice for those seeking to collect, use, and share people’s personal data in a responsible way was relatively straightforward: follow the fair information practices, often called the “FIPs.” These general guidelines were designed to ensure that data processors are accountable for their actions and that data subjects are safe, secure, and endowed with control over their personal information. The FIPs have proven remarkably sturdy against the backdrop of near-constant technological change. Yet in the age of social media, big data, and artificial intelligence, the FIPs have been pushed to their breaking point. We …

The 'Smart' Fourth Amendment, Andrew Ferguson

Scholarly Articles in Law Reviews & Journals

“Smart” devices radiate data, detailing a continuous, intimate, and revealing pattern of daily life. Billions of sensors will soon collect data from smartphones, smart homes, smart cars, medical devices and an evolving assortment of consumer and commercial products. But, what are these data trails to the Fourth Amendment? Does data emanating from devices on or about our bodies, houses, things, and digital effects fall within the Fourth Amendment’s protection of “persons, homes, papers, or effects”? Does interception of this information violate a “reasonable expectation of privacy?”The “Internet of Things” and the growing proliferation of smart devices create new opportunities for …

An Expressive Theory Of Privacy Intrusions, Craig Konnoth

Publications

The harms of privacy intrusions are numerous. They include discrimination, reputational harm, and chilling effects on speech, thought, and behavior. However, scholarship has yet to fully recognize a kind of privacy harm that this article terms "expressive."

Depending on where the search is taking place and who the actors involved are--a teacher in a school, the police on the street, a food inspector in a restaurant--victims and observers might infer different messages from the search. The search marks the importance of certain societal values such as law enforcement or food safety. It can also send messages about certain groups by …

Wearable Fitness Devices: Personal Health Data Privacy In Washington State, Steven Spann

Seattle University Law Review

Private entities are increasingly targeting individuals in the United States and around the world to gather personal data for such purposes as product development, market identification, and insurance risk assessment. While credit card records and online browsing histories have long been the medium through which this data is gathered, in more recent years, wearable fitness devices have added a new dimension to data production and collection. These devices are capable of gathering a significant amount of data regarding a person’s physical and physiological characteristics, thereby exposing these data producers to personal privacy infringement. Washington State lawmakers and citizens must be …

Against Data Exceptionalism, Andrew Keane Woods

Law Faculty Scholarly Articles

One of the great regulatory challenges of the Internet era—indeed, one of today's most pressing privacy questions—is how to define the limits of government access to personal data stored in the cloud. This is particularly true today because the cloud has gone global, raising a number of questions about the proper reach of one state's authority over cloud-based data. The prevailing response to these questions by scholars, practitioners, and major Internet companies like Google and Facebook has been to argue that data is different. Data is “unterritorial,” they argue, and therefore incompatible with existing territorial notions of jurisdiction. This Article …

Can Dna Be Speech?, Jorge R. Roig

Scholarly Works

DNA is generally regarded as the basic building block of life itself. In the most fundamental sense, DNA is nothing more than a chemical compound, albeit a very complex and peculiar one. DNA is an information-carrying molecule. The specific sequence of base pairs contained in a DNA molecule carries with it genetic information, and encodes for the creation of particular proteins. When taken as a whole, the DNA contained in a single human cell is a complete blueprint and instruction manual for the creation of that human being. In this article we discuss myriad current and developing ways in which …

Need For Informed Consent In The Age Of Ubiquitous Human Testing, Caitlyn Kuhs

Loyola of Los Angeles Law Review

No abstract provided.

Data Beyond Borders: Mutual Legal Assistance In The Internet Era, Andrew K. Woods

Law Faculty Scholarly Articles

The global nature of today’s Internet services presents a unique challenge to international law enforcement cooperation. On a daily basis, law enforcement agents in one country seek access to data that is beyond their jurisdictional reach; as one industry analyst put it, there has been, “an internationalization of evidence.” In order to gain lawful access to data that is subject to another state’s jurisdiction, law enforcement agents must request mutual legal assistance (MLA) from the country that can legally compel the data’s disclosure. But the MLA regime has not been updated to manage the enormous rise of requests for MLA. …

Dear Yahoo: A Comment On In Re Yahoo Mail Litigation, Nareen Melkonian

Loyola of Los Angeles Law Review

No abstract provided.

Addressing The Harm Of Total Surveillance: A Reply To Professor Neil Richards, Danielle Keats Citron, David C. Gray

Faculty Scholarship

In his insightful article The Dangers of Surveillance, 126 HARV. L. REV. 1934 (2013), Neil Richards offers a framework for evaluating the implications of government surveillance programs that is centered on protecting "intellectual privacy." Although we share his interest in recognizing and protecting privacy as a condition of personal and intellectual development, we worry in this essay that, as an organizing principle for policy, "intellectual privacy" is too narrow and politically fraught. Drawing on other work, we therefore recommend that judges, legislators, and executives focus instead on limiting the potential of surveillance technologies to effect programs of broad and indiscriminate …

The Digital Accountability And Transparency Act Of 2011 (Data): Using Open Data Principles To Revamp Spending Transparency Legislation, Jillian Raines '12

NYLS Law Review

No abstract provided.

Three Paradoxes Of Big Data, Neil M. Richards, Jonathan H. King

Scholarship@WashULaw

Big data is all the rage. Its proponents tout the use of sophisticated analytics to mine large data sets for insight as the solution to many of our society’s problems. These big data evangelists insist that data-driven decision making can now give us better predictions in areas ranging from college admissions to dating to hiring to medicine to national security and crime prevention. But much of the rhetoric of big data contains no meaningful analysis of its potential perils, only the promise. We don’t deny that big data holds substantial potential for the future, and that large dataset analysis has …

Twilight Of The Idols? Eu Internet Privacy And The Post Enlightenment Paradigm, Mark F. Kightlinger

Law Faculty Scholarly Articles

This Article provides a timely examination of the European Union's approach to information privacy on the internet, an approach that some legal scholars have held up as a model for law reform in the United States. Building on the author's recent piece discussing the U.S. approach to internet privacy, this Article applies to the EU's internet privacy regime a theoretical framework constructed from the writings of philosopher and social theorist Alasdair MacIntyre on the failures of Enlightenment and post-Enlightenment thought. The EU internet privacy regime is shown to reflect and reinforce three key elements of the "post-Enlightenment paradigm," i.e., the …

The Gathering Twilight? Information Privacy On The Internet In The Post-Enlightenment Era, Mark F. Kightlinger

Law Faculty Scholarly Articles

The steady stream of news reports about violations of privacy on the Internet has spawned a growing body of literature discussing the legal protections available for personally identifiable information—i.e., information about identified or identifiable persons—collected via the Internet. This Article takes the discussion of Internet privacy protection in a new and very different direction by reexamining the U.S. Internet privacy regime from the perspective of a broader cultural/historical analysis and critique. The perspective adopted is that of Alasdair MacIntyre's account of the disarray in Enlightenment and post-Enlightenment discourse about morality and human nature and the accompanying disappearance of rational justifications …

Seeking Privacy: Examining A Role For The Fiduciary In Protecting Personal Information, Marcey L. Grigsby

NYLS Law Review

No abstract provided.

Material Vulnerabilities: Data Privacy, Corporate Information Security And Securities Regulation, Andrea M. Matwyshyn

ExpressO

This article undertakes a normative and empirical legal inquiry into the manner information security vulnerabilities are being addressed through law and in the marketplace. Specifically, this article questions the current legislative paradigm for information security regulation by presenting a critique grounded in information security and cryptography theory. Consequently, this article advocates shifting our regulatory approach to a process-based security paradigm that focuses on improving security of our system as a whole. Finally, this article argues that in order to accomplish this shift with least disruption to current legal and economic processes, expanding an existing set of well-functioning legal structures is …

Voice Over Internet Protocol And The Wiretap Act: Is Your Conversation Protected?, Daniel B. Garrie, Matthew J. Armstrong, Donald P. Harris

Seattle University Law Review

10101101: Is this sequence of digits voice or data? To a computer, voice is a sequence of digits and data is a sequence of digits. The law has defined 10101101 to be data, and 10101001 to be voice communications. Courts have constructed a distinction between data, 10101101, and voice, 10101001. However, that distinction is blurred when voice and data are simultaneously transmitted through the same medium. The courts forbid third parties to tap or monitor voice communications, yet permit data packets to be tracked, stored, and sold by third parties with the implied consent of either party engaged in the …

States And Internet Enforcement, Joel R. Reidenberg

Faculty Scholarship

This essay addresses the enforcement of decisions through internet instruments. The starting point is a brief justification of internet enforcement as the obligation of democratic states. Next, the essay argues that the movement to re-engineer the internet infrastructure by public and private actions also facilitates state enforcement of legal and policy decisions. The essay maintains that states will increasingly try to use network intermediaries such as payment systems and Internet Service Providers as enforcement instruments. Finally, and most importantly, the essay focuses on ways that states may harness the power of technological instruments such as worms, filters and packet interceptors …

Privacy Wrongs In Search Of Remedies, Joel R. Reidenberg

Faculty Scholarship

The American legal system has generally rejected legal rights for data privacy and relies instead on market self-regulation and the litigation process to establish norms of appropriate behavior in society. Information privacy is protected only through an amalgam of narrowly targeted rules. The aggregation of these specific rights leaves many significant gaps and fewer clear remedies for violations of fair information practices. With an absence of well-established legal rights, privacy wrongs are currently in search of remedies. This Article first describes privacy rights and wrongs that frame the search for remedies in the United States. It explores public enforcement of, …

Resolving Conflicting International Data Privacy Rules In Cyberspace, Joel R. Reidenberg

Faculty Scholarship

While core principles for the fair treatment of personal information are common to democracies, privacy rights vary considerably across national borders. This article explores the divergences in approach and substance of data privacy between Europe and the United States. It argues that the specific privacy rules adopted in a country have a governance function. The article shows that national differences support two distinct political choices for the roles in democratic society assigned to the state, the market and the individual: either liberal, market-based governance or socially-protective, rights-based governance. These structural divergences make international cooperation imperative for effective data protection in …

Lex Informatica: The Formulation Of Information Policy Rules Through Technology , Joel R. Reidenberg

Faculty Scholarship

Historically, law and government regulation have established default rules for information policy, including constitutional rules on freedom of expression and statutory rights of ownership of information. This Article will show that for network environments and the Information Society, however, law and government regulation are not the only source of rule-making. Technological capabilities and system design choices impose rules on participants. The creation and implementation of information policy are embedded in network designs and standards as well as in system configurations. Even user preferences and technical choices create overarching, local default rules. This Article argues, in essence, that the set of …