Privacy Law Commons^™

The Internet Of Heirlooms And Disposable Things, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

The Internet of Things (“IoT”) is here, and we seem to be going all in. We are trying to put a microchip in nearly every object that is not nailed down and even a few that are. Soon, your cars, toasters, toys, and even your underwear will be wired up to make your lives better. The general thought seems to be that “Internet connectivity makes good objects great.” While the IoT might be incredibly useful, we should proceed carefully. Objects are not necessarily better simply because they are connected to the Internet. Often, the Internet can make objects worse and …

Taking Trust Seriously In Privacy Law, Neil Richards, Woodrow Hartzog

Faculty Scholarship

Trust is beautiful. The willingness to accept vulnerability to the actions of others is the essential ingredient for friendship, commerce, transportation, and virtually every other activity that involves other people. It allows us to build things, and it allows us to grow. Trust is everywhere, but particularly at the core of the information relationships that have come to characterize our modern, digital lives. Relationships between people and their ISPs, social networks, and hired professionals are typically understood in terms of privacy. But the way we have talked about privacy has a pessimism problem – privacy is conceptualized in negative terms, …

Facebook’S Emotional Contagion Study And The Ethical Problem Of Co-Opted Identity In Mediated Environments Where Users Lack Control, Evan Selinger, Woodrow Hartzog

Faculty Scholarship

We argue a main but underappreciated reason why the Facebook emotional contagion experiment is ethically problematic is that it co-opted user data in a way that violated identity-based norms and exploited the vulnerability of those disclosing on social media who are unable to control how personal information is presented in this technologically mediated environment.

Anonymization And Risk, Ira S. Rubinstein, Woodrow Hartzog

Faculty Scholarship

Perfect anonymization of data sets that contain personal information has failed. But the process of protecting data subjects in shared information remains integral to privacy practice and policy. While the deidentification debate has been vigorous and productive, there is no clear direction for policy. As a result, the law has been slow to adapt a holistic approach to protecting data subjects when data sets are released to others. Currently, the law is focused on whether an individual can be identified within a given set. We argue that the best way to move data release policy past the alleged failures of …

Spying Inc., Danielle K. Citron

Faculty Scholarship

The latest spying craze is the “stalking app.” Once installed on someone’s cell phone, the stalking app can provide continuous access to the phone owner’s calls, texts, snapchats, photos, calendar updates, and movements. Stalking apps destroy the privacy and confidentiality of cell phone activities. Domestic abusers and stalkers frequently turn to stalking apps because they are undetectable even to sophisticated phone owners. Business is booming for stalking app providers, even though their entire enterprise is arguably illegal. Federal and state wiretapping laws ban the manufacture, sale, or advertisement of devices knowing their design makes them primarily useful for the surreptitious …

Surveillance As Loss Of Obscurity, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

Everyone seems concerned about government surveillance, yet we have a hard time agreeing when and why it is a problem and what we should do about it. When is surveillance in public unjustified? Does metadata raise privacy concerns? Should encrypted devices have a backdoor for law enforcement officials? Despite increased attention, surveillance jurisprudence and theory still struggle for coherence. A common thread for modern surveillance problems has been difficult to find.

In this article we argue that the concept of ‘obscurity,’ which deals with the transaction costs involved in finding or understanding information, is the key to understanding and uniting …

The Scope And Potential Of Ftc Data Protection, Woodrow Hartzog, Daniel J. Solove

Faculty Scholarship

For more than fifteen years, the FTC has regulated privacy and data security through its authority to police deceptive and unfair trade practices as well as through powers conferred by specific statutes and international agreements. Recently, the FTC’s powers for data protection have been challenged by Wyndham Worldwide Corp. and LabMD. These recent cases raise a fundamental issue, and one that has surprisingly not been well explored: How broad are the FTC’s privacy and data security regulatory powers? How broad should they be?

In this Article, we address the issue of the scope of FTC authority in the areas of …

Unfair And Deceptive Robots, Woodrow Hartzog

Faculty Scholarship

Robots, like household helpers, personal digital assistants, automated cars, and personal drones are or will soon be available to consumers. These robots raise common consumer protection issues, such as fraud, privacy, data security, and risks to health, physical safety and finances. Robots also raise new consumer protection issues, or at least call into question how existing consumer protection regimes might be applied to such emerging technologies. Yet it is unclear which legal regimes should govern these robots and what consumer protection rules for robots should look like.

The thesis of the Article is that the FTC’s grant of authority and …

Promoting Innovation While Preventing Discrimination: Policy Goals For The Scored Society, Frank Pasquale, Danielle K. Citron

Faculty Scholarship

There are several normative theories of jurisprudence supporting our critique of the scored society, which complement the social theory and political economy presented in our 2014 article on that topic in the Washington Law Review. This response to Professor Tal Zarsky clarifies our antidiscrimination argument while showing that is only one of many bases for the critique of scoring practices. The concerns raised by Big Data may exceed the capacity of extant legal doctrines. Addressing the potential injustice may require the hard work of legal reform.

Deconstructing The Relationship Between Privacy And Security [Viewpoint], Gregory Conti, Lisa A. Shay, Woodrow Hartzog

Faculty Scholarship

From a government or law-enforcement perspective, one common model of privacy and security postulates that security and privacy are opposite ends of a single continuum. While this model has appealing properties, it is overly simplistic. The relationship between privacy and security is not a binary operation in which one can be traded for the other until a balance is found. One fallacy common in privacy and security discourse is that trade-offs are effective or even necessary. Consider the remarks of New York Police Department Commissioner Ray Kelly shortly after the Boston Marathon bombing, “I'm a major proponent of cameras. I …

Criminalizing Revenge Porn, Danielle K. Citron, Mary Anne Franks

Faculty Scholarship

Violations of sexual privacy, notably the non-consensual publication of sexually graphic images in violation of someone's trust, deserve criminal punishment. They deny subjects' ability to decide if and when they are sexually exposed to the public and undermine trust needed for intimate relationships. Then too they produce grave emotional and dignitary harms, exact steep financial costs, and increase the risks of physical assault. A narrowly and carefully crafted criminal statute can comport with the First Amendment. The criminalization of revenge porn is necessary to protect against devastating privacy invasions that chill self-expression and ruin lives.

Metadata: Piecing Together A Privacy Solution, Chris Conley

Faculty Scholarship

Imagine the government is constantly monitoring you — keeping track of every person you call or email, every place you go, everything you buy, and more — all without getting a warrant. And when you challenge them, they claim you have no right to expect this kind of information to be private. Besides, they’re not actually listening to what you say or reading what you write, so what’s the big deal anyhow?

Unfortunately, this scenario is more real than imaginary. Government agencies ranging from the NSA to local police departments have taken advantage of weak or uncertain legal protections for …

Reviving Implied Confidentiality, Woodrow Hartzog

Faculty Scholarship

The law of online relationships has a significant flaw-it regularly fails to account for the possibility of an implied confidence. The established doctrine of implied confidentiality is, without explanation, almost entirely absent from online jurisprudence in environments where it has traditionally been applied offline, such as with sensitive data sets and intimate social interactions.

Courts' abandonment of implied confidentiality in online environments should have been foreseen. The concept has not been developed enough to be consistently applied in environments such as the Internet that lack obvious physical or contextual cues of confidence. This absence is significant because implied confidentiality could …

The Ftc And The New Common Law Of Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

One of the great ironies about information privacy law is that the primary regulation of privacy in the United States has barely been studied in a scholarly way. Since the late 1990s, the Federal Trade Commission (FTC) has been enforcing companies’ privacy policies through its authority to police unfair and deceptive trade practices. Despite over fifteen years of FTC enforcement, there is no meaningful body of judicial decisions to show for it. The cases have nearly all resulted in settlement agreements. Nevertheless, companies look to these agreements to guide their privacy practices. Thus, in practice, FTC privacy jurisprudence has become …

The Ftc And Privacy And Security Duties For The Cloud, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Third-party data service providers, especially providers of cloud computing services, present unique and difficult privacy and data security challenges. While many companies that directly collect data from consumers are bound by the promises they make to individuals in their privacy policies, cloud service providers are usually not a part of this arrangement. It is not entirely clear what, if any, obligations cloud service providers have to protect the data of individuals with whom they have no contractual relationship. This problem is especially acute because many institutions sharing personal data with cloud service providers fail to include significant privacy and security …

The Value Of Modest Privacy Protections In A Hyper Social World, Woodrow Hartzog

Faculty Scholarship

Two of the greatest modem challenges to protecting personal information are determining how to protect information that is already known by many and how to create an adequate remedy for privacy harms that are opaque, remote, or cumulative. Both of these challenges are front and center for those who seek to protect socially shared information. Social media and wearable communication technologies like Google Glass present vexing questions about whether information that is known by many can ever be "private," what the privacy harm might be from this information's misuse, and how to remedy such harms in balance with competing values …

Rethinking Online Privacy In Canada: Commentary On Voltage Pictures V. John And Jane Doe, Ngozi Okidegbe

Faculty Scholarship

This article problematizes the use of the bona fide case standard as the legal standard for a court to order a third party Internet Service Provider ("ISP") to disclose subscriber information to a copyright owner in online piracy cases. It argues that ISP account holders have a reasonable expectation of privacy in their subscriber information. It contends that the current bona fide case standard affords a relatively low threshold of protection for Internet users’ subscriber information. The reason for which the article takes this position is that the bona fide case standard can be met solely by IP address evidence, …

The Right To Quantitative Privacy, David Gray, Danielle K. Citron

Faculty Scholarship

We are at the cusp of a historic shift in our conceptions of the Fourth Amendment driven by dramatic advances in surveillance technology. Governments and their private sector agents continue to invest billions of dollars in massive data-mining projects, advanced analytics, fusion centers, and aerial drones, all without serious consideration of the constitutional issues that these technologies raise. In United States v. Jones, the Supreme Court signaled an end to its silent acquiescence in this expanding surveillance state. In that case, five justices signed concurring opinions defending a revolutionary proposition: that citizens have Fourth Amendment interests in substantial quantities of …

Fighting Cyber-Crime After United States V. Jones, David Gray, Danielle K. Citron, Liz Clark Rinehart

Faculty Scholarship

In a landmark non-decision last term, five Justices of the United States Supreme Court would have held that citizens possess a Fourth Amendment right to expect that certain quantities of information about them will remain private, even if they have no such expectations with respect to any of the information or data constituting that whole. This quantitative approach to evaluating and protecting Fourth Amendment rights is certainly novel and raises serious conceptual, doctrinal, and practical challenges. In other works, we have met these challenges by engaging in a careful analysis of this “mosaic theory” and by proposing that courts focus …

A Shattered Looking Glass: The Pitfalls And Potential Of The Mosaic Theory Of Fourth Amendment Privacy, David Gray, Danielle K. Citron

Faculty Scholarship

On January 23, 2012, the Supreme Court issued a landmark non-decision in United States v. Jones. In that case, officers used a GPS-enabled device to track a suspect’s public movements for four weeks, amassing a considerable amount of data in the process. Although ultimately resolved on narrow grounds, five Justices joined concurring opinions in Jones expressing sympathy for some version of the “mosaic theory” of Fourth Amendment privacy. This theory holds that we maintain reasonable expectations of privacy in certain quantities of information even if we do not have such expectations in the constituent parts. This Article examines and explores …

The Case For Online Obscurity, Woodrow Hartzog, Frederic Stutzman

Faculty Scholarship

On the Internet, obscure information has a minimal risk of being discovered or understood by unintended recipients. Empirical research demonstrates that Internet users rely on obscurity perhaps more than anything else to protect their privacy. Yet, online obscurity has been largely ignored by courts and lawmakers. In this Article, we argue that obscurity is a critical component of online privacy, but it has not been embraced by courts and lawmakers because it has never been adequately defined or conceptualized. This lack of definition has resulted in the concept of online obscurity being too insubstantial to serve as a helpful guide …

The Fight To Frame Privacy, Woodrow Hartzog

Faculty Scholarship

The resolution of a debate often hinges on how the problem being debated is presented. In psychology and related disciplines, this method of issue presentation is known as framing. Framing theory holds that even small changes in the presentation of an issue or event can produce significant changes of opinion. Framing has become increasingly important in discussions about privacy and security. In his new book, "Nothing to Hide: The False Tradeoff Between Privacy and Security," Daniel Solove argues that if we continue to view privacy and security as diametrically opposed to each other, privacy will always lose. Solove argues that …

Social Data, Woodrow Hartzog

Faculty Scholarship

As online social media grow, it is increasingly important to distinguish between the different threats to privacy that arise from the conversion of our social interactions into data. One well-recognized threat is from the robust concentrations of electronic information aggregated into colossal databases. Yet much of this same information is also consumed socially and dispersed through a user interface to hundreds, if not thousands, of peer users.

In order to distinguish relationally shared information from the threat of the electronic database, this essay identifies the massive amounts of personal information shared via the user interface of social technologies as “social …

Obscurity By Design, Woodrow Hartzog, Frederic D. Stutzman

Faculty Scholarship

Design-based solutions to confront technological privacy threats are becoming popular with regulators. However, these promising solutions have left the full potential of design untapped. With respect to online communication technologies, design-based solutions for privacy remain incomplete because they have yet to successfully address the trickiest aspect of the Internet — social interaction. This Article posits that privacy-protection strategies such as “Privacy by Design” face unique challenges with regard to social software and social technology due to their interactional nature.

This Article proposes that design-based solutions for social technologies benefit from increased attention to user interaction, with a focus on the …

Addressing The Harm Of Total Surveillance: A Reply To Professor Neil Richards, Danielle K. Citron, David Gray

Faculty Scholarship

In his insightful article, "The Dangers of Surveillance," 126 Harvard Law Review 1934 (2013), Neil Richards offers a framework for evaluating the implications of government surveillance programs that is centered on protecting "intellectual privacy." Although we share his interest in recognizing and protecting privacy as a condition of personal and intellectual development, we worry in this essay that, as an organizing principle for policy, "intellectual privacy" is too narrow and politically fraught. Drawing on other work; we, therefore, recommend that judges, legislators, and executives focus, instead, on limiting the potential of surveillance technologies to effect programs of broad and indiscriminate …

Trademark Dilution And Corporate Personhood, Stacey Dogan

Shorter Faculty Works

It’s become almost passé to decry our federal trademark dilution laws. The laws – first passed in 1995 and amended in 2006 – protect “famous trademarks” against uses that are likely to dilute their distinctiveness, without regard to any confusion among consumers or competition between the parties. Early critics warned that passage of the anti-dilution statute marked a turning point in trademark law: by giving famous trademark holders rights against even non-confusing uses of their marks, the law created “property”-like rights in trademarks. The initial commentary on the statute focused mainly on the costs associated with this increasingly absolutist approach …

Fiduciary Law In The Twenty-First Century, Tamar Frankel

Faculty Scholarship

How does one embrace the riches of the knowledge presented in this Conference? This Conference’s participants have presented the fiduciary relationship from so many points of view: interdisciplinary perspectives, current issues, and particular fascinating narrower topics. Does this event suggest that critics are correct, and that fiduciary law as a category is incoherent?1 Arguably, fiduciary relationships and the rules that govern them are too varied. Yet I maintain that the variety presented in this Conference leads to the opposite conclusion, and that the papers in this Conference provide support for my claim: that fiduciary law should be viewed and understood …

The Cambridge Companion To European Union Private Law, Daniela Caruso

Shorter Faculty Works

Well into its teens by now, the private law of the European Union has its own companion. The very appearance of a publication of this sort is indeed a coming-of-age moment for a discipline whose existence was hard to fathom until the 1980s. Member states’ judges and lawyers have come full circle, from resisting European Union private law as an intrusion into a quintessentially national sphere, to embracing it as a natural consequence of market integration. The question is no longer whether or not to approximate the private laws of the member states. The question is how to do it. …

Network Accountability For The Domestic Intelligence Apparatus, Danielle K. Citron, Frank Pasquale

Faculty Scholarship

A new domestic intelligence network has made vast amounts of data available to federal and state agencies and law enforcement officials. The network is anchored by “fusion centers,” novel sites of intergovernmental collaboration that generate and share intelligence and information. Several fusion centers have generated controversy for engaging in extraordinary measures that place citizens on watch lists, invade citizens’ privacy, and chill free expression. In addition to eroding civil liberties, fusion center overreach has resulted in wasted resources without concomitant gains in security.

While many scholars have assumed that this network represents a trade-off between security and civil liberties, our …

Privacy Rights And Public Families, Khiara Bridges

Faculty Scholarship

This Article is based on eighteen months of anthropological fieldwork conducted among poor, pregnant women receiving prenatal care provided by the Prenatal Care Assistance Program (“PCAP”) at a large public hospital in New York City. The Prenatal Care Assistance Program (“PCAP”) is a special program within the New York State Medicaid program that provides comprehensive prenatal care services to otherwise uninsured or underinsured women. This Article attempts to accomplish two goals. The first goal is to argue that PCAP’s compelled consultations – with social workers, health educators, nutritionists, and financial officers – function as a gross and substantial intrusion by …