Privacy Law Commons^™

The Trade Origins Of Privacy Law, Anupam Chander

Indiana Law Journal

The desire for trade propelled the growth of data privacy law across the world. Countries with strong privacy laws sought to ensure that their citizens’ privacy would not be compromised when their data traveled to other countries. Even before this vaunted Brussels Effect pushed privacy law across the world through the enticement of trade with the European Union, Brussels had to erect privacy law within the Union itself. And as the Union itself expanded, privacy law was a critical condition for accession.

But this coupling of privacy and trade leaves a puzzle: how did the U.S. avoid a comprehensive privacy …

Coping With Coppa: Exploring Alternatives To The Children's Online Privacy Protection Act, Andrew Parra

Indiana Journal of Law and Social Equality

The Children’s Online Privacy Protection Act of 1998 (COPPA) stands as one of the greatest protectors of children’s privacy for nearly twenty-five years. However, COPPA has struggled to keep pace with technological changes during this time, and the COVID-19 pandemic highlighted the shortcomings of COPPA regulations as children were forced to spend increased amounts of time in digital spaces. As the Federal Trade Commission (FTC) is set to make changes to COPPA, it is necessary to consider what changes would be most beneficial to protect children. This paper will explore the current regulatory framework, its strengths and weaknesses, and then …

Direct To Consumer Or Direct To All: Home Dna Tests And Lack Of Privacy Regulations In The United States, Karen J. Kukla

IP Theory

Although the U.S. has some measures of privacy protection for genetic data, the lack of a comprehensive approach to protecting direct-to-consumer genetic testing results in privacy violations for both consumers and their relatives. This essay explores the critical need for the U.S. government to address these privacy violations and argues that the U.S. should approach the problem and strategize a solution similar to the European Union’s (EU) General Data Protection Regulation (GDPR). Part I identifies current United States law, both federal and state regulations that address DTC-GT and genetic privacy. Part II examines the lack of regulation surrounding current DTC-GT …

Encouraging Public Access To Pharmaceuticals Through Modified Protection Of Clinical Trial Data, Scott M. Nolan Ii

IP Theory

Part I of this Article investigates the development of pharmaceuticals and clinical trial data with a focus on patent and data protection. Part II evaluates the effects of protection and the challenges it poses to widespread public pharmaceutical access. Part III discusses two scholarly approaches to the public access issue that focus on clinical data protection and their associated challenges. In light of these scholarly works, Part IV suggests a new approach to clinical trial data protection that aims to improve public pharmaceutical access while maintaining the incentives to invent for drug developers.

Layered Fiduciaries In The Information Age, Zhaoyi Li

Indiana Law Journal

Technology companies such as Facebook have long been criticized for abusing customers’ personal information and monetizing user data in a manner contrary to customer expectations. Some commentators suggest fiduciary law could be used to restrict how these companies use their customers’ data.1 Under this framework, a new member of the fiduciary family called the “information fiduciary” was born. The concept of an information fiduciary is that a company providing network services to “collect, analyze, use, sell, and distribute personal information” owes customers and end-users a fiduciary duty to use the collected data to promote their interests, thereby assuming fiduciary liability …

Guilty Of Probable Cause: Public Arrest Records And Dignity In The Information Age, Nicholas Thompson

Indiana Journal of Global Legal Studies

The United States is exceptional among Western nations in its treatment of criminal records. Today, an estimated one-third of Americans1 bear the “modern equivalent of branding”: the publicly-accessible criminal record.2 Far from remaining locked in digital limbo, these records serve a variety of purposes, from legitimate law enforcement use to extortion against arrestees seeking to scrub their mugshots from a Google search.3 It would be natural to assume that such records result from an individual’s commission of a crime, for which the individual is duly convicted and then marked with the brand of the state for the transgression. But the …

Big Data, Big Gap: Working Towards A Hipaa Framework That Covers Big Data, Ryan Mueller

Indiana Law Journal

One lasting impact of the Health Insurance Portability and Accountability Act (HIPAA) is the privacy protections it provides for our sensitive health information. In the era of Big Data, however, much of our health information exists outside the traditional doctor-patient dynamic. From wearable technology, to mobile applications, to social media and internet browsing, Big Data organizations collect swaths of data that shed light on sensitive health information. Big Data organizations largely fall outside of HIPAA’s current framework because of the stringent requirements for when the HIPAA protections apply, namely that the data must be held by a covered entity, and …

The Law Of Employee Data: Privacy, Property, Governance, Matthew T. Bodie

Indiana Law Journal

The availability of data related to the employment relationship has ballooned into an unruly mass of performance metrics, personal characteristics, biometric recordings, and creative output. The law governing this collection of information has been awkwardly split between privacy regulations and intellectual property rights, with employees generally losing on both ends. This Article rejects a binary approach that either carves out private spaces ineffectually or renders data into isolated pieces of ownership. Instead, the law should implement a hybrid system that provides workers with continuing input and control without blocking efforts at joint production. In addition, employers should have fiduciary responsibilities …

Illusory Privacy, Thomas Haley

Indiana Law Journal

For decades, regulators, consumer advocates, and privacy theorists have grappled with one of privacy’s most important questions: how to protect private information that consumers unwittingly give away with the click of an “I accept” button. Reform efforts remain mired in a morass of text, focusing on the increasing volume and complexity of firms’ terms of service and privacy policies. This Article moves beyond such existing approaches. By analyzing terms of service and privacy policies from hundreds of top websites—which this Article calls “platform terms”—this Article demonstrates that the prevailing “notice and consent” paradigm of privacy regulation cannot provide meaningful protection. …

The Oslo Accords: A Modern-Day Story Of Occupation Told Through Violations Of The Right To Freedom Of Privacy, Catherine Demetrovich

Indiana Law Journal

The Israeli-Palestinian conflict began in the early 1900s when the disputed land, what is now the West Bank and the Gaza Strip, fell under British rule. After the Six- Day War in 1967, Israel took control of the West Bank, Golan Heights, and the Gaza Strip. Since then, tensions between Israel and Palestine have continued to grow. This Note explores a modern-day occupation question: Israel’s control over Palestine’s information and communication technology (ICT) sector. Along with privacy and human rights violations, Israel’s control is in direct violation of the Oslo Accords— guaranteeing Palestinians limited self-governance in Gaza and the West …

How The World's Largest Economies Regulate Data Privacy: Drawbacks, Benefits, & Proposed Solutions, Alexander J. Pantos

Indiana Journal of Global Legal Studies

National data privacy regimes are quickly gaining traction and ubiquity around the globe. Moving forward, countries will face a range of difficult decisions surrounding how best to engage internationally in cross border data flow, particularly in the context of personal information (PI).

This article takes a bird's-eye view of the current state of data privacy regimes in the world's four highest GDP regions. In part, this article hopes to provide a succinct analysis of these data privacy regimes, with a focus on the balance they strike between granting individuals rights in their data and placing responsibilities on businesses that deal …

Privacy Vs. Transparency: Handling Protected Materials In Agency Rulemaking, Christopher S. Yoo, Kellen Mccoy

Indiana Law Journal

Agencies conducting informal rulemaking proceedings increasingly confront conflicting duties with respect to protected materials included in information submitted in public rulemaking dockets. They must reconcile the broad commitment to openness and transparency reflected in federal law with the duty to protect confidential business information (CBI) and personally identifiable information (PII) against improper disclosure.

This Article presents an analysis of how agencies can best balance these often countervailing considerations. Part I explores the statutory duties to disclose and withhold information submitted in public rulemaking dockets placed on agencies. It also examines judicial decisions and other legal interpretations regarding the proper way …

What's The Harm? Federalism, The Separation Of Powers, And Standing In Data Breach Litigation, Grayson Wells

Indiana Law Journal

This Comment will argue that the Supreme Court should analyze standing in data breach litigation under a standard that is deferential to state statutory and common law. Specifically, federal standing analysis should look to state law when determining whether an injury is concrete such that the injury-in-fact requirement is met. Some argue that allowing more data breach cases to proceed to the merits could lead to an explosion of successful litigation and settlements, burdening the federal courts and causing economic losses for the breached businesses. These concerns may be valid. But if state law provides a remedy to the harm …

The Fourth Amendment At Home, Thomas P. Crocker

Indiana Law Journal

A refuge, a domain of personal privacy, and the seat of familial life, the home holds a special place in Fourth Amendment jurisprudence. Supreme Court opinions are replete with statements affirming the special status of the home. Fourth Amendment text places special emphasis on securing protections for the home in addition to persons, papers, and effects against unwarranted government intrusion. Beyond the Fourth Amendment, the home has a unique place within constitutional structure. The home receives privacy protections in addition to sheltering other constitutional values protected by the Due Process Clause and the First Amendment. For example, under the Due …

Maximizing The Value Of America’S Newest Resource, Low- Altitude Airspace: An Economic Analysis Of Aerial Trespass And Drones, Tyler Watson

Indiana Law Journal

Recognizing that tort law is a unique area of law that was judicially created by rational human beings with an innate sense of economic justice, this Note seeks to apply positive economic theory—derived from ex post analyses of tort cases—to an ex ante analysis to predict how and to what extent the existing and proposed aerial trespass rules will further economic efficiency in the context of drones and airspace rights. Part I will provide (1) an overview of the Federal Aviation Administration’s (FAA) current regulatory framework and the development of the common law aerial trespass doctrine and (2) an overview …

Sharenting And The (Potential) Right To Be Forgotten, Keltie Haley

Indiana Law Journal

Part I of this Note serves as an evaluation of parental use of social media and

further seeks to draw attention to the social and developmental impact parental

oversharing can have on children. Part II examines the tension between parents’

constitutional rights to direct the upbringing of their children, as well as their First

Amendment interest in online expression, and their children’s interest in personal

data security and privacy. Part III provides an overview of the European Union’s

right to be forgotten framework in the sharenting context and considers the

plausibility of implementing such a framework in the United States. …

Zoning For Families, Sara C. Bronin

Indiana Law Journal

Is a group of eight unrelated adults and three children living together and sharing meals, household expenses, and responsibilities—and holding themselves out to the world to have long-term commitments to each other—a family? Not according to most zoning codes—including that of Hartford, Connecticut, where the preceding scenario presented itself a few years ago. Zoning, which is the local regulation of land use, almost always defines family, limiting those who may live in a dwelling unit to those who satisfy the zoning code’s definition. Often times, this definition is drafted in a way that excludes many modern living arrangements and preferences. …

Revenge Porn And The Aclu’S Inconsistent Approach, Elena Lentz

Indiana Journal of Law and Social Equality

No abstract provided.

Boilerplate Indignity, Erik Encarnacion

Indiana Law Journal

Commentators have long tried to sound the alarm about boilerplate contracts, pointing out threats ranging from the loss of privacy rights to the erosion of public law and democratic self-governance. This Article argues that this list of concerns misses something important: that imposing certain boilerplate terms on individuals is incompatible with their dignity. After explaining and defending the conception of dignity presupposed here, this Article shows how boilerplate accountability waivers—like arbitration clauses—prevent people from accessing the distinctive dignity-vindicating role of courts and degrade their status as legal persons. And because governments may legitimately protect dignity interests, proposed reforms like the …

The Federalism Challenges Of Protecting Medical Privacy In Workers' Compensation, Ani B. Satz

Indiana Law Journal

Under current law, injured workers face a Hobson’s choice: They may file for workers’ compensation or maintain their medical privacy. The reason for this is that § 164.512(l) of the Health Insurance Portability and Accountability Act’s Privacy Rule (HPR) is widely misinterpreted by courts and legislatures as a wholesale waiver of privacy protections for injured workers. Section 164.512(l) excludes workers’ compensation from federal privacy protections that may frustrate the efficient administration of workers’ compensation claims. As the history and intent behind the HPR indicate, § 164.512(l) is premised on the assumption that states will protect workers’ privacy by creating and …

Drone Invasion: Unmanned Aerial Vehicles And The Right To Privacy, Rebecca L. Scharf

Indiana Law Journal

Since the birth of the concept of a legally recognized right to privacy in Samuel D. Warren and Louis D. Brandeis’ influential 1890 law review article, “The Right to Privacy,” common law—with the aid of influential scholars—has massaged the concept of privacy torts into actionable claims. But now, one of the most innovative technological advancements in recent years, the unmanned aerial vehicle, or drone, has created difficult challenges for plaintiffs and courts navigating common law privacy tort claims.

This Article explores the challenges of prosecution of the specific privacy tort of intrusion upon seclusion involving nongovernmental use of drone technology. …

Privacy Remedies, Lauren H. Scholz

Indiana Law Journal

When consumers sue companies for privacy-intrusive practices, they are often unsuccessful. Many cases fail in federal court at the motion to dismiss phase because the plaintiff has not shown the privacy infringement has caused her concrete harm. This is a symptom of a broader issue: the failure of courts and commentators to describe the relationship between privacy rights and privacy remedies.

This Article contends that restitution is the normal measure of privacy remedies. Restitution measures relief by economic gain to the defendant. If a plaintiff can show the likely ability to recover in restitution, that should be sufficient to pass …

Younger Generations Are Infected By Continuous Socialization To Accept Diminished Privacy: A Global Analysis Of How The United States' Constitutional Doctrine Is A Main Contributor To Eroded Privacy, Tiffany Kim

Indiana Journal of Global Legal Studies

Since the nineteenth century, privacy concerns have increased with the growth of technology. The invention of instantaneous photography, coupled with the enlarged presence of press, was met with concerns of degraded privacy. Society has formed expectations of privacy, but as time passes, those expectations continue to diminish. Younger generations have been socialized to accept lessened levels of privacy in this digitalized world of mass data and connectivity.

Individual privacy expectations vary globally. The construction of China's government and culture produces a lesser expectation of individual privacy than that of the United States. As outlined in the U.S. Constitution, U.S. citizens …

Data Protection In An Increasingly Globalized World, Nicholas F. Palmieri Iii

Indiana Law Journal

With the rise of the internet in recent decades, it has become increasingly easy for various enterprises—including retailers, advertising agencies, and service providers—to acquire, use, and even share the personal details of their users. Such a trend is unlikely to decrease in the coming years; in fact, internet usage is only likely to increase as more and more people gain access to the internet. In the wakeof recent data breaches, including the now infamous breach of Equifax as well as the scandal involving Facebook and Cambridge Analytica, people are even more aware of the need for (and the risk of …

"You Have The Data"...The Writ Of Habeas Data And Other Data Protection Rights: Is The United States Falling Behind?, Sarah L. Lode

Indiana Law Journal

In Part I of this Note, I will discuss the writ of habeas data that has been developed primarily, but not exclusively, in Latin American countries. I will discuss the intricacies of the writ, how it evolved, and how it is applied today. Using Argentina as an example, I will discuss how the writ would be used by an Argentine citizen to protect her personal data. Part II summarizes the previously employed data protection scheme in the European Union, the Data Protection Directive (“the Directive”), and will also discuss the new EU data protection regulation, the General Data Protection Regulation …

Trust: A Model For Disclosure In Patent Law, Ari Ezra Waldman

Indiana Law Journal

How to draw the line between public and private is a foundational, first-principles question of privacy law, but the answer has implications for intellectual property, as well. This project is one in a series of papers about first-person disclosures of information in the privacy and intellectual property law contexts, and it defines the boundary between public and nonpublic information through the lens of social science —namely, principles of trust.

Patent law’s public use bar confronts the question of whether legal protection should extend to information previously disclosed to a small group of people. I present evidence that shows that current …

The Two Faces Of The Foreign Intelligence Surveillance Court, Emily Berman

Indiana Law Journal

When former National Security Agency contractor Edward Snowden leaked a massive trove of information about secret intelligence-collection programs implemented under the Foreign Intelligence Surveillance Act in the summer of 2013, U.S. surveillance activities were thrust to the forefront of public debate. This debate included the question of whether and how to reform the Foreign Intelligence Surveillance Court (“FISA Court”), the statutorily created secret court that reviews government applications to conduct surveillance in the United States. This discussion, however, has underemphasized a critical feature of the way the FISA Court works. As this Article will show, since the terrorist attacks of …

The Right To Attention, Jasper L. Tran

Indiana Law Journal

What marketing, contracts, and healthcare—specifically informed consent and mandatory ultrasounds—have in common is the right to attention from the information receiver. However, scholarship most often focuses on the communicator’s perspective (e.g., how much information the communicator discloses) or on the information itself, but surprisingly, not much on the receiver’s perspective.

This dearth of scholarship from the information receiver’s perspective is problematic, because the information receiver is often the “little guy” in the conversation. We own and are entitled to our attention because attention is a property right and part of our individual dignity. Yet advertisement companies and scam artists freely …

A Comprehensive Empirical Study Of Data Privacy, Trust, And Consumer Autonomy, Jay P. Kesan, Carol M. Hayes, Masooda N. Bashir

Indiana Law Journal

Modern society is driven by data. Data storage is practically unlimited with today’s technology, and analytical tools make it easy to find patterns and make predictions in a way that is very useful for private businesses and governments. These uses of digital data can raise considerable privacy issues that are of great concern to consumers. In this Article, we present and analyze the results of an extensive survey that we conducted to explore what people know, what people do, and what people want when it comes to privacy online.

Our survey is the first comprehensive examination of the intersection of …

Furtive Encryption: Power, Trusts, And The Constitutional Cost Of Collective Surveillance, Jeffrey L. Vagle

Indiana Law Journal

Recent revelations of heretofore secret U.S. government surveillance programs have sparked national conversations about their constitutionality and the delicate balance between security and civil liberties in a constitutional democracy. Among the revealed policies asserted by the National Security Agency (NSA) is a provision found in the “minimization procedures” required under section 702 of the Foreign Intelligence Surveillance Act of 1978. This provision allows the NSA to collect and keep indefinitely any encrypted information collected from domestic communications—including the communications of U.S. citizens. That is, according to the U.S. government, the mere fact that a U.S. citizen has encrypted her electronic …