Privacy Law Commons^™

Seattle Surveillance Ordinance Memo, Christopher Stevenson

Technology Law and Public Policy Clinic

No abstract provided.

Equitable Recovery For Ashley Madison Hack Victims: The Federal Trade Commission As Executor Of A Narrow Right To Be Forgotten In The United States, Mackenzie Olson

Washington Journal of Law, Technology & Arts

Events following the Ashley Madison data breach exposed the personal information of millions of users. Victims filed class action suits in multiple courts in the United States, seeking various forms of monetary and equitable relief. However, these plaintiffs have been unable to compel the removal of personal information from third-party Internet sites hosting the information previously circulated by hackers. Citizens of the European Union, by contrast, could likely compel the removal of such personal information. Unlike the United States, the European Union recognizes a “right to be forgotten”, which authorizes individuals to demand the removal of their personal information from …

Privacy Harmonization And The Developing World: The Impact Of The Eu's General Data Protection Regulation On Developing Economies, Tiffany Curtiss

Washington Journal of Law, Technology & Arts

Through strengthened third-party obligations for data protection, the European Union’s General Data Protection Regulation will export privacy norms. However, developing economies may want to consider a co-regulatory industry approach to data protection before adopting similar national legislation. The General Data Protection Regulation can be an ideal model for global harmonization of privacy laws, particularly for adoption among industries and willing participants. To benefit from a co-regulatory approach, however, a developing economy would need to invest in education and legal systems in order to capture the benefits of the growing e-commerce market that will undoubtedly be influenced by the General Data …

Anonymization And Risk, Ira S. Rubinstein, Woodrow Hartzog

Washington Law Review

Perfect anonymization of data sets that contain personal information has failed. But the process of protecting data subjects in shared information remains integral to privacy practice and policy. While the deidentification debate has been vigorous and productive, there is no clear direction for policy. As a result, the law has been slow to adapt a holistic approach to protecting data subjects when data sets are released to others. Currently, the law is focused on whether an individual can be identified within a given set. We argue that the best way to move data release policy past the alleged failures of …

Identity Laws And Privacy Protection In A Modern State: The Legal History Concerning Personal Information In Taiwan (1895-2015), Yung-Hua Kuo, Po-Liang Chen

Washington International Law Journal

This article investigates the continuity and transformation of the personal identity and identification legal systems in Taiwan. From 1895 to 2015, Japan and subsequently the Republic of China (ROC) ruled Taiwan and transplanted different legal systems of personal information to Taiwan. This article analyzes how these systems were applied to and impacted Taiwanese society in three periods: the Japanese rule period (1895–1945), the period of strict control by the ROC government (1945–1992), and the rise and evolution of the privacy period (1993–2015). When Taiwan was ruled by the Qing Empire (1683–1895), there was no precise personal information database in Taiwan. …

Regulating Real-World Surveillance, Margot E. Kaminski

Washington Law Review

A number of laws govern information gathering, or surveillance, by private parties in the physical world. But we lack a compelling theory of privacy harm that accounts for the state’s interest in enacting these laws. Without a theory of privacy harm, these laws will be enacted piecemeal. Legislators will have a difficult time justifying the laws to constituents; the laws will not be adequately tailored to legislative interest; and courts will find it challenging to weigh privacy harms against other strong values, such as freedom of expression. This Article identifies the government interest in enacting laws governing surveillance by private …

Washington's Reproductive Privacy Act: An Interpretation And Constitutional Analysis, Ross Tanaka

Washington Law Review

In Roe v. Wade, the Supreme Court declared that the “zone of privacy” inherent in the liberty component of the Due Process Clauses protected a woman’s right to choose when to terminate her pregnancy. Nevertheless, in the years following Roe, the Court held that the right of choice did not include a right to state assistance in obtaining an abortion. After decisions such as Webster v. Reproductive Services and Maher v. Roe, the state may express its preference for childbirth by denying the use of its funds, facilities, and personnel for abortion. Although a majority of the …

Public Records In Private Devices: How Public Employees' Article I, Section 7 Privacy Rights Create A Dilemma For State And Local Government, Philip Paine

Washington Law Review

The Washington Public Records Act (PRA or “the Act”) is a wide-ranging law that heavily weighs in favor of public disclosure of government processes. Initially enacted as a citizen initiative in 1972, the Act has many beneficial uses. For example, it provides insight into a local government’s decision-making process and ensures that citizens have access to their own government. However, the PRA’s potential to be used to invade personal privacy raises significant constitutional concerns. When an employee in possession of a public record invokes the protection of article I, section 7 of the Washington State Constitution, which protects an individual’s …

Sexual Exploitation In The Digital Age: Non-Consensual Pornography And What Washington Can Do To Stop It, Farah Ali, Brian Conley, Heather Lewis, Charlotte Lunday

Technology Law and Public Policy Clinic

No abstract provided.

Taxation And Surveillance: An Agenda, Michael Hatfield

Articles

Among government agencies, the IRS likely has the surest legal claim to the most information about the most Americans: their hobbies, religious affiliations, reading activities, travel, and medical information are all potentially tax relevant. Privacy scholars have studied the arrival of Big Data, the internet-of-things, and the cooperation of private companies with the government in surveillance, but neither privacy nor tax scholars have considered how these technological advances should impact the U.S. tax system. As government agencies and private companies increasingly pursue what has been described as the “growing gush of data,” the use of these technologies in tax administration …

Can Americans Resist Surveillance?, Ryan Calo

Articles

This Essay analyzes the ability of everyday Americans to resist and alter the conditions of government surveillance. Americans appear to have several avenues of resistance or reform. We can vote for privacy-friendly politicians, challenge surveillance in court, adopt encryption or other technologies, and put market pressure on companies not to cooperate with law enforcement.

In practice, however, many of these avenues are limited. Reform-minded officials lack the capacity for real oversight. Litigants lack standing to invoke the Constitution in court. Encryption is not usable and can turn citizens into targets. Citizens can extract promises from companies to push back against …

Private Data, Public Safety: A Bounded Access Model Of Disclosure, Mary D. Fan

Articles

A growing volume of crucial information for protecting public health and safety is controlled by private-sector entities. The data are private in two senses—both proprietary and secluded from scrutiny. Controversies over corporate secrecy, such as sealed settlements that hide deaths due to product defects or nondisclosure of potentially hazardous substances, illustrate how corporate privacy and public safety can conflict.

Courts are conflicted about when to defer to companies’ claims of the right to keep information private when important public interests are implicated by the data that companies refuse to disclose.

This Article proposes allowing what it terms “bounded access” to …

Augmented Reality: Hard Problems Of Law And Policy, Franziska Roesner, Tamara Denning, Bryce Clayton Newell, Tadayoshi Kohno, Ryan Calo

Tech Policy Lab

Augmented reality (AR) technologies are poised to enter the commercial mainstream. Using an interdisciplinary research team, we describe our vision of AR and explore the unique and difficult problems AR presents for law and policy—including around privacy, free speech, discrimination, and safety.

Hands Off Our Fingerprints: State, Local, Andindividual Defiance Of Federal Immigrationenforcement, Christine N. Cimini

Articles

Secure Communities, though little-known outside law-enforcement circles, is one of the most powerful of the federal government’s immigration enforcement programs. Under Secure Communities, fingerprints collected by state and local law enforcement and provided to the Federal Bureau of Investigation for criminal background checks are automatically shared with the Department of Homeland Security, which checks the fingerprints against its immigration database. In the event of a match, an immigration detainer can be issued and an individual held after they would otherwise be entitled to release. Originally designed as a voluntary program in which local governments could choose to participate, the Department …

Communications Privacy For And By Whom?, Ryan Calo

Articles

A response to Professor Orin Kerr's The Next Generation Communications Privacy Act, which makes a series of quiet assumptions, however, that readers may find controversial.

First, the Article reads as though ECPA exists only to protect citizens from public officials. According to its text and to case law, however, ECPA also protects private citizens from one another in ways any new act should revisit.

Second, the Article assumes that society should address communications privacy with a statute, whereas specific experiences with ECPA suggest that the courts may be better suited to address communications privacy—for reasons Professor Kerr himself offers. …

Privacy Harm Exceptionalism, Ryan Calo

Articles

“Exceptionalism” refers to the belief that a person, place, or thing is qualitatively different from others in the same basic category. Thus, some have spoken of America’s exceptionalism as a nation. Early debates about the Internet focused on the prospect that existing laws and institutions would prove inadequate to govern the new medium of cyberspace. Scholars have made similar claims about other areas of law.

The focus of this short essay is the supposed exceptionalism of privacy. Rather than catalogue all the ways that privacy might differ from other concepts or areas of study, I intend to focus on the …

Tor Exit Nodes: Legal And Policy Considerations, Sarah Campbell Eagle, Abigail St. Hilaire, Kelly Sherwood

Technology Law and Public Policy Clinic

Anonymity Networks

The Internet is a constant companion to people the world over and as technology improves it is becoming more accessible every day. With the amount of communication that occurs online, it was only a matter of time before anonymity became an important topic of discussion. Several so-called “anonymity networks” have been developed to facilitate anonymous communication by the citizens of the web. Because the use of these networks is already so widespread, the time is ripe for a discussion of their merits and potential government responses to this phenomenon. An anonymity network “enables users to access the Web …

Obscurity By Design, Woodrow Hartzog, Frederic Stutzman

Washington Law Review

Design-based solutions to confront technological privacy threats are becoming popular with regulators. However, these promising solutions have left the full potential of design untapped. With respect to online communication technologies, design-based solutions for privacy remain incomplete because they have yet to successfully address the trickiest aspect of the Internet—social interaction. This Article posits that privacy-protection strategies such as “Privacy by Design” face unique challenges with regard to social software and social technology due to their interactional nature. This Article proposes that design-based solutions for social technologies benefit from increased attention to user interaction, with a focus on the principles of …

Domestic Drones: Technical And Policy Issues, University Of Washington Technology And Public Policy Clinic

Technology Law and Public Policy Clinic

No abstract provided.

Against Notice Skepticism In Privacy (And Elsewhere), M. Ryan Calo

Articles

What follows is an exploration of innovative new ways to deliver privacy notice. Unlike traditional notice that relies upon text or symbols to convey information, emerging strategies of “visceral” notice leverage a consumer’s very experience of a product or service to warn or inform. A regulation might require that a cell phone camera make a shutter sound so people know their photo is being taken. Or a law could incentivize websites to be more formal (as opposed to casual) wherever they collect personal information, as formality tends to place people on greater guard about what they disclose. The thesis of …

Consumer Subject Review Boards: A Thought Experiment, Ryan Calo

Articles

The adequacy of consumer privacy law in America is a constant topic of debate. The majority position is that United States privacy law is a “patchwork,” that the dominant model of notice and choice has broken down, and that decades of self-regulation have left the fox in charge of the henhouse. A minority position chronicles the sometimes surprising efficacy of our current legal infrastructure.

But the challenges posed by big data to consumer protection feel different. They seem to gesture beyond privacy’s foundations or buzzwords, beyond “fair information practice principles” or “privacy by design.” The challenges of big data may …

Patent Protection Of Medical Records—Focusing On Ethical Issues, Yūsuke Satō, Jiameng Kathy Liu

Washington International Law Journal

The following is a translation of “Patent Protection of Medical Methods—Focusing on Ethical Issues,” an article written by Professor Yūsuke Satō in the June 2007 issue of the Japanese periodical Annual of Industrial Property Law. In Japan, despite the lack of an explicit statutory prohibition, methods of medical treatment have never been patentable. The Japan Patent Office (“JPO”) has rejected patenting medical processes on ethical grounds, interpreting that they do not fulfill the statutory requirement of “industrial applicability” in the main sentence of Article 29, Section 1 of the Patent Act, and courts have been confirming this practice. In light …

The Boundaries Of Privacy Harm, M. Ryan Calo

Articles

Just as a burn is an injury caused by heat, so is privacy harm a unique injury with specific boundaries and characteristics. This Essay describes privacy harm as falling into two related categories. The subjective category of privacy harm is the perception of unwanted observation. This category describes unwelcome mental states—anxiety, embarrassment, fear—that stem from the belief that one is being watched or monitored. Examples of subjective privacy harms include everything from a landlord eavesdropping on his tenants to generalized government surveillance.

The objective category of privacy harm is the unanticipated or coerced use of information concerning a person against …

Location Surveillance By Gps: Balancing An Employer's Business Interest With Employee Privacy, Kendra Rosenberg

Washington Journal of Law, Technology & Arts

Employers are increasingly using GPS tracking devices as business tools to monitor employee movements. Recent judicial decisions have found an employer’s interest in using location surveillance on employer-owned property generally trumps an employee’s privacy interests. However, employers deciding to use GPS should be aware of the potential limitations on tracking an employee based on state constitutional, statutory, and common law rights to privacy. This Article focuses on the permissible scope of an employer’s use of GPS to track employees in the workplace.

Arrested Development: Arizona V. Gant And Article I, Section 7 Of The Washington State Constitution, Jacob R. Brown

Washington Law Review

In Arizona v. Gant, the United States Supreme Court held that the search of a vehicle incident to arrest is permissible in only two situations: (1) when the arrestee is unsecured and within reaching distance of the passenger compartment; or (2) when it is reasonable to believe that evidence relevant to the crime of arrest may be found in the vehicle. Because Gant expressed a standard more protective than that established by the Washington State Supreme Court, Gant induced a state of confusion in Washington, where it has long been maintained that article I, section 7 of the Washington …

People Can Be So Fake: A New Dimension To Privacy And Technology Scholarship, M. Ryan Calo

Articles

This article updates the traditional discussion of privacy and technology, focused since the days of Warren and Brandeis on the capacity of technology to manipulate information. It proposes a novel dimension to the impact of anthropomorphic or social design on privacy.

Technologies designed to imitate people-through voice, animation, and natural language-are increasingly commonplace, showing up in our cars, computers, phones, and homes. A rich literature in communications and psychology suggests that we are hardwired to react to such technology as though a person were actually present.

Social interfaces accordingly capture our attention, improve interactivity, and can free up our hands …

Peeping Hals: Making Sense Of Artificial Intelligence And Privacy, Ryan Calo

Articles

The field of artificial intelligence, broadly defined as the study and practice of designing intelligent agents, is at least six decades into its existence as a formal discipline. Sometimes called “computational” or “synthetic” intelligence, AI borrows from and informs a wide variety of subjects, including philosophy, psychology, linguistics, neuroscience, statistics, economics, and law. Techniques of AI underpin all manner of industrial and consumer applications - from the complex neural nets used in data mining, down to the ‘fuzzy logic’ used by commercial washers and driers.

Insofar as “the issues of AI are directly related to [the] self-image of human beings”, …

Internet User Anonymity, First Amendment Protections And Mobilisa: Changing The Cahill Test, Kristina Ringland

Washington Journal of Law, Technology & Arts

The Arizona Court of Appeals recently developed a new test to determine whether an anonymous Internet poster’s identity should be revealed through a subpoena. While the First Amendment protects anonymous speech, this protection does not extend to defamation and other illegal behavior. Courts have balanced these two competing interests—protection of anonymous speech and revelation of a person’s identity via subpoena—by applying varying tests regarding the disclosure of an anonymous poster’s identity. The Arizona Court of Appeals, in Mobilisa, Inc. v. Doe, recently adopted a three-part test that incorporates elements from two, previously distinct lines of cases. This Article explores …

Are "Better" Security Breach Notification Laws Possible?, Jane K. Winn

Articles

This Article will evaluate the provisions of California's pioneering security breach notification law (SBNL) in light of "better regulation" or "smart regulation" criteria in order to highlight the costs of taking a narrowly focused, piecemeal approach and the benefits of taking a more comprehensive perspective to the problems of identity theft and information security. Just as the basic structure of SBNLs was borrowed from environmental law, this Article will borrow from decades of analysis of the impact of environmental regulation to evaluate the likely impact of SBNLs.

Just as environmental laws can be used to reduce externalities created through the …

De-Identified Data And Third Party Data Mining: The Risk Of Re-Identification Of Personal Information, C. Christine Porter

Washington Journal of Law, Technology & Arts

Recent computer science research demonstrates that anonymized data can sometimes be easily re-identified with particular individuals, despite companies’ attempts to isolate personal information. Netflix and AOL are two examples of companies that released personal data intended to be anonymous but which was reidentified with individual users with the use of very small amounts of auxiliary data. Re-identification of anonymized data may expose companies to increased liability, as the information may no longer be treated as anonymous. In addition, companies may violate their own privacy policies by releasing anonymous information to third parties that can be easily re-identified with individual users. …