Privacy Law Commons^™

Ethical Hacking By Alana Maurushat, Laura Ellyson

Canadian Journal of Law and Technology

Book Review of Ethical Hacking by Alana Maurushat (Ottawa: University of Ottawa Press, 2019).

Increasing Lapses In Data Security: The Need For A Common Answer To What Constitutes Standing In A Data Breach Context, Aaron Benjamin Edelman

Journal of Law and Policy

As the number of data breaches continues to rise in the United States, so does the amount of data breach litigation. Many potential plaintiffs who suffered as victims of data breaches, however, find themselves in limbo regarding the issue of standing before a court because of a significant split on standing determinations amongst the federal circuit courts. Thus, while victims of data breaches oftentimes have their personal information fall into the hands of nefarious characters who intend to use the information to a victim’s detriment, that may not be enough to provide victims a right to sue in federal court …

Deep Fakes: A Looming Challenge For Privacy, Democracy, And National Security, Robert Chesney, Danielle K. Citron

Faculty Scholarship

Harmful lies are nothing new. But the ability to distort reality has taken an exponential leap forward with “deep fake” technology. This capability makes it possible to create audio and video of real people saying and doing things they never said or did. Machine learning techniques are escalating the technology’s sophistication, making deep fakes ever more realistic and increasingly resistant to detection. Deep-fake technology has characteristics that enable rapid and widespread diffusion, putting it into the hands of both sophisticated and unsophisticated actors. While deep-fake technology will bring with it certain benefits, it also will introduce many harms. The marketplace …

Data Scams, Roger Allan Ford

Law Faculty Scholarship

Targeting platforms like Google and Facebook are usually seen as presenting tradeoffs between utility and privacy. This Article identifies and describes a different, non-privacy cost of targeting platforms: they make it easier for malicious actors to scam others. They do this by making it easier for scammers to reach the most promising victims, hide from law-enforcement authorities and others, and develop better scams. Technology offers potential solutions, since the same data and targeting tools that enable scams could help detect and prevent them, though neither platforms nor law-enforcement officials have both the incentives and expertise needed to develop and deploy …

Accountability Of Google And Other Businesses In Colombia: Personal Data Protection In The Digital Age, Maria P. Angel, Vivian Newman-Pont

Scholarly Works

In this document we analyze the privacy policies of 30 companies with data-driven business models that collect data in Colombia and identify practices that have not been sufficiently contemplated by the personal data protection regime currently applicable in our country. But what has been done in Colombia to guarantee these rights in the digital economy framework? In this document, we explore the degree of preparedness of our legal personal data protection regime and data protection authorities for tackling the risks that the digital era poses to different values and rights, thereby holding accountable the companies with data-driven business models (DDBM). …

Privacidad Digital En Ecuador: El Papel De La Vigilancia, La Jurisprudencia Y Los Derechos Humanos, Giselle Valdez

Independent Study Project (ISP) Collection

Este documento es un estudio de caso sobre la privacidad digital en Ecuador, cómo se protege y cómo se debe mejorar las protecciones. Comienzo presentando la falta de privacidad de la persona en Ecuador, a través de la reciente violación de datos y las tecnologías de vigilancia en todo el país desde China. Luego, para analizar la jurisprudencia y la falta de protección de la privacidad en la ley, hago la transición a un análisis legal de la privacidad de datos en Ecuador a través de la Constitución de 2008. Cuando establezco que falta privacidad digital en Ecuador, demuestro una …

Open Banking: Regulatory Challenges For A New Form Of Financial Intermediation In A Data-Driven World, Nydia Remolina

Centre for AI & Data Governance (2019-2025)

Data has taken immense importance in the last years. Consider the amount of data that is being collected worldwide every day, industries are reshaping their activities into a data-driven business. The digital transformation of all industries, portent of the fourth industrial revolution, is creating a new kind of economy based on the datafication of almost any aspect of human social, political and economic activity as a result of the information generated by the numerous daily routines of digitally connected individuals and technology. The financial services industry is part of this trend. Embracing the digital revolution and creating the right foundations …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

No abstract provided.

Towards Standard Information Privacy, Innovations Of The New General Data Protection Regulation, Ali Alibeigi, Abu Bakar Munir, Md Ershadulkarim, Adeleh Asemi

Library Philosophy and Practice (e-journal)

Protection of personal data in recent decades became more crucial affecting by emergence of the new technologies especially computer, internet, information and communications technology. However, Europeans felt this necessity at time and provided for up-to-date and supportive laws. The General Data Protection Regulation (GDPR) is the latest legislation in EU to protect personal data of individuals based on the recent technological advancements. However, its’ domestic and international output still is debatable. This doctrinal legal study by using descriptive methods, aimed to evaluate the GDPR through analyzing and interpreting its’ provisions by especial focus on its’ innovations. The results show that …

Re-Imagining Resolution Of Online Defamation Disputes, Emily B. Laidlaw

Osgoode Hall Law Journal

If an individual or company is defamed online, they have two options to resolve the dispute, absent a technical solution. They can complain to an intermediary or launch a civil action. Both are deficient for a variety of reasons. Civil litigation is often unsuitable given the nature of online communications (across different platforms, jurisdictions, involving multiple parties, and spread with ease), the length and cost of litigation, and the ineffectiveness of traditional remedies. Intermediary dispute resolution processes can sometimes be effective, but lack industry standards and due process, place intermediaries in pseudo-judicial roles, and depend on the changeable commitments of …

A Repeated Call For Omnibus Federal Cybersecurity Law, Carol Li

Notre Dame Law Review

In Part I, this Note discusses the concerning regularity of high-profile data breaches that have occurred within the United States’ weak and patchwork landscape of cybersecurity law. Part II discusses the challenges companies face when attempting to comply with the current cybersecurity law, and why companies who are deemed compliant are still falling victim to hackers and data breaches. Part III makes a call for federal legislation to replace the current, inadequate, fragmented, and uneven landscape of cybersecurity law. Part IV discusses numerous factors and incentives to consider in creating an omnibus federal cybersecurity law. Finally, Part V offers some …

Comparative Analysis Of The Eu’S Gdpr And Brazil’S Lgpd: Enforcement Challenges With The Lgpd, Abigayle Erickson

Brooklyn Journal of International Law

In the wake of the adoption of the European Union’s General Data Protection Regulation (GDPR) in May 2018, other countries and jurisdictions have contemplated personal data privacy legislation. In August 2018, the former president of Brazil, Michel Temer, signed the country’s comprehensive data privacy regulation, Lei Geral de Proteção de Dados Pessoais (LGPD), into law. Temer, however, vetoed many of the enforcement provisions. Shortly before leaving office, Temer signed an executive order creating a regulatory agency as the bill initially called for, but situated the agency under executive control instead of creating a wholly independent agency. This Note provides a …

The Need For A Shared Responsibility Regime Between State And Non-State Actors To Prevent Human Rights Violations Caused By Cyber-Surveillance Spyware, Anna W. Chan

Brooklyn Journal of International Law

Technology has undoubtedly contributed to the field of human rights. Internet connection and a smartphone has enabled activists to call out political leaders, shine light on human atrocities and organize mass protests through social media platforms. This has resulted in many authoritarian governments spending large amounts of their resources to purchase cyber-surveillance spyware systems from multi-national corporations to closely monitor and track their citizens for any signs of dissidence. Such technology has enabled authoritarian regimes to commit human right violations ranging from invasion of privacy, arbitrary arrest, arbitrary detention, torture and even murder. Despite the uncovering of such questionable transactions …

Marketplace Of Ideas, Privacy, And The Digital Audience, Alexander Tsesis

Notre Dame Law Review

The availability of almost limitless sets of digital information has opened a vast marketplace of ideas. Information service providers like Facebook and Twitter provide users with an array of personal information about products, friends, acquaintances, and strangers. While this data enriches the lives of those who share content on the internet, it comes at the expense of privacy.

Social media companies disseminate news, advertisements, and political messages, while also capitalizing on consumers’ private shopping, surfing, and traveling habits. Companies like Cambridge Analytica, Amazon, and Apple rely on algorithmic programs to mash up and scrape enormous amounts of online and otherwise …

Privacy And Connected Objects, Nicolas Karsenti

Canadian Journal of Law and Technology

Our society perennially seeks to multiply its connectivity in the name of greater efficiency. Over the past few years, several devices that had previously been quite basic have been made ‘‘smarter” in order to facilitate a consumer’s life. A recent study highlights that some of the most common reasons for using ‘‘smart” objects are home automation and remote control. Thus, convenience is driving companies, particularly appliance makers, to connect their devices to the internet in order to make them ‘‘smart”. These range from intelligent thermostats, smart fridges, connected pacemakers, smart watches and personal assistants (PAs) such as Alexa, Siri or …

Law And The “Sharing Economy”: Regulating Online Market Platforms By Derek Mckee, Finn Makela & Teresa Scassa, John D. Gregory

Canadian Journal of Law and Technology

No abstract provided.

Digital Evidence: A Practitioner’S Handbook By Gerald Chan & Susan Magotiaux, Robert J. Currie

Canadian Journal of Law and Technology

No abstract provided.

Where To Prosecute Cybercrimes, Jacob T. Wall

Duke Law & Technology Review

Selecting the appropriate venue for a criminal trial has been a matter of constitutional concern since the founding of the country. The issue is thought to be essential to the fair administration of justice and thus public confidence in the criminal justice system. Constitutionally, crimes must be prosecuted in the states and districts in which they were committed. However, the rise of cybercrime has complicated the venue inquiry: cyberspace, the domain of cybercrime, and physical space have become increasingly decoupled. Consequently, under America’s primary but dated cybercrime law, the ideal location for a trial may not be a constitutionally proper …

Protecting Personal Data: A Model Data Security And Breach Notifications Statute, Michael Bloom

St. John's Law Review

(Excerpt)

This Note argues that current law is inadequate to protect consumers in light of the prevalence and severity of data breaches in recent years, and that a unifying federal legislation combining portions of state law and the DSBNA should be enacted. Part I of this Note analyzes the DSBNA for notification requirements when data breaches occur, the requirements for the implementation of security policies, regulatory mechanisms for monitoring compliance with these requirements, and criminal penalties for failing to comply. Part II summarizes the various state laws that exist for notification of data breaches. Part III proposes a model federal …

Gender Equality And The First Amendment: Foreword, Jeanmarie Fenrich, Benjamin C. Zipursky, Danielle Keats Citron

Fordham Law Review

Gender equality demands equal opportunity to speak and be heard. Yet, in recent years, the clash between equality and free speech in the context of gender has intensified—in the media, the workplace, college campuses, and the political arena, both online and offline. The internet has given rise to novel First Amendment issues that particularly affect women, such as nonconsensual pornography, online harassment, and online privacy. On November 1–2, 2018, the Fordham Law Review brought together scholars and practicing lawyers from around the nation to address many of the pressing challenges facing feminists and free speech advocates today. The Symposium was …

Digital Colonialism: The 21st Century Scramble For Africa Through The Extraction And Control Of User Data And The Limitations Of Data Protection Laws, Danielle Coleman

Michigan Journal of Race and Law

As Western technology companies increasingly rely on user data globally, extensive data protection laws and regulations emerged to ensure ethical use of that data. These same protections, however, do not exist uniformly in the resource-rich, infrastructure-poor African countries, where Western tech seeks to establish its presence. These conditions provide an ideal landscape for digital colonialism.

Digital colonialism refers to a modern-day “Scramble for Africa” where largescale tech companies extract, analyze, and own user data for profit and market influence with nominal benefit to the data source. Under the guise of altruism, large scale tech companies can use their power and …

When Law Frees Us To Speak, Danielle Keats Citron, Jonathon W. Penney

Fordham Law Review

A central aim of online abuse is to silence victims. That effort is as regrettable as it is successful. In the face of cyberharassment and sexualprivacy invasions, women and marginalized groups retreat from online engagement. These documented chilling effects, however, are not inevitable. Beyond its deterrent function, the law has an equally important expressive role. In this Article, we highlight law’s capacity to shape social norms and behavior through education. We focus on a neglected dimension of law’s expressive role: its capacity to empower victims to express their truths and engage with others. Our argument is theoretical and empirical. We …

Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Those who wish to control, expose, and damage the identities of individuals routinely do so by invading their privacy. People are secretly recorded in bedrooms and public bathrooms and “up their skirts.” Such images are used to coerce people into sharing nude photographs and filming sex acts under the threat of public disclosure. People’s nude images are posted online without permission. Machine-learning technology is used to create digitally manipulated “deep fake” sex videos that swap people’s faces into pornography.

Each of these abuses is an invasion of sexual privacy—the behaviors, expectations, and choices that manage access to and information about …

The Gdpr: It Came, We Saw, But Did It Conquer?, Leila Javanshir

Seattle University Law Review

On February 1, 2019, the Seattle University Law Review held its annual symposium at the Seattle University School of Law. Each year, the Law Review hosts its symposium on a topic that is timely and meaningful. This year, privacy and data security professionals from around the globe gathered to discuss the current and future effects of the General Data Protection Regulation (GDPR) that was implemented on May 25, 2018. The articles and essays that follow this Foreword are the product of this year’s symposium.

Regulating The Gdpr: Perspectives From The United Kingdom, Hannah Mccausland

Seattle University Law Review

Hannah McCausland leads the international group at the UK Information Commissioner’s Office (ICO). The ICO’s International Engagement functions as the gateway to other data protection and privacy authorities on international matters. She’s involved in the work of the EU European Data Protection Board advising the commissioner and the deputy commissioner on international positioning of the ICO, and she has played a key role over the past six years in the ICO’s strategy on navigating the EU’s data protection framework. Hannah has also played a major role at the global level and advancing the practical tools that data protection and privacy …

Privacy, Freedom, And Technology—Or “How Did We Get Into This Mess?”, Alex Alben

Seattle University Law Review

Can we live in a free society without personal privacy? The question is worth pondering, not only in light of the ongoing debate about government surveillance of private communications, but also because new technologies continue to erode the boundaries of our personal space. This Article examines our loss of freedom in a variety of disparate contexts, all connected by the thread of erosion of personal privacy. In the scenarios explored here, privacy reducing activities vary from government surveillance, personal stalking conducted by individuals, and profiling by data-driven corporations, to political actors manipulating social media platforms. In each case, new technologies …

Confiding In Con Men: U.S. Privacy Law, The Gdpr, And Information Fiduciaries, Lindsey Barrett

Seattle University Law Review

In scope, ambition, and animating philosophy, U.S. privacy law and Europe’s General Data Protection Regulation are almost diametric opposites. The GDPR’s ambitious individual rights, significant prohibitions, substantive enforcement regime, and broad applicability contrast vividly with a scattershot U.S. regime that generally prioritizes facilitating commerce over protecting individuals, and which has created perverse incentives for industry through anemic enforcement of the few meaningful limitations that do exist. A privacy law that characterizes data collectors as information fiduciaries could coalesce with the commercial focus of U.S. law, while emulating the GDPR’s laudable normative objectives and fortifying U.S. consumer privacy law with a …

General Data Protection Regulation (Gdpr): Prioritizing Resources, Jennifer Dumas

Seattle University Law Review

This Article will discuss and analyze the years of preparation for the GDPR and provide recommendations for dealing with the GDPR forevermore. It will assess whether the preparation and panic were worth it. In other words, was the time, expense, and distraction my peers and I expended and experienced over the past years proportionate to the requirements and impact of the GDPR? Further, was the high level of preparation and panic many legal departments in countless companies undertook and experienced appropriate now that we have had a chance to see the initial impact of the GDPR?

Privacy Statements Under The Gdpr, Mike Hintze

Seattle University Law Review

The need to include specific types of information in a privacy statement is a GDPR compliance obligation that does not get as much attention as some other GDPR requirements. Perhaps that is because privacy statements have been much maligned in recent years. They are too long and full of legalese. Nobody reads them. They are part of a notice and consent approach to privacy that puts an unrealistic burden on consumers to make informed choices. But despite these well-known criticisms, the GDPR doubles down on privacy statements. In fact, gauging by the roughly fourfold increase in privacy statement requirements compared …

Requiem For Cyberspace: The Effect Of The European General Privacy Regulation On The Global Internet, Steven Tapia

Seattle University Law Review

The dream of a perpetual, limitless, non-dimensional space is an idea that has transfixed clergy, philosophers, and poets for ages. Whether it is called “heaven,” “the afterlife,” “nirvana,” or another linguistic stand-in, the dream of a dimension beyond the bounds of time, space, and the laws of nature seems as universal as any concept ever. From its initial development in the 1970s (as a military, academic, and governmental experiment in creating a wholly alternative means of communication capable of surviving catastrophic failures of any parts of the communications conduits) until essentially now, the Internet seemed to be the closest incarnate …