Privacy Law Commons^™

Liability For Consumer Information Security Breaches: Deconstructing Ftc Complaints And Settlements, Joel B. Hanson

Washington Journal of Law, Technology & Arts

For several years, hackers taking advantage of security holes in the information system of TJX Companies, Inc. stole sensitive credit and debit card information belonging to at least 45.7 million customers. The TJX breach is one of the largest thefts of consumer information in history and is illustrative of the recent wave of security breaches. Private lawsuits against companies that fail to protect consumer information have typically failed. However, the Federal Trade Commission has taken enforcement action against such companies that fail to implement reasonable security measures to protect customers’ personal information. These complaints have resulted in settlement agreements requiring …

No Harm, No Foul: Limits On Damages Awards For Individuals Subject To A Data Breach, Derek A. Bishop

Washington Journal of Law, Technology & Arts

Recently, TJX, Inc. announced that computer hackers breached several of TJX’s databases containing the driver’s license and credit card numbers of over 47 million customers. Within a month, a class action lawsuit attempting to hold TJX responsible for losing control of this information was filed. In the past, class action lawsuits based on the release of consumer’s personal data have failed because the plaintiffs have not alleged sufficient harms. This article examines legal claims relating to the release of personal data by companies during security breaches. To date, courts have refused to find individuals harmed by the negligent release of …

Data Privacy And Breach Reporting: Compliance With Various State Laws, G. Martin Bingisser

Washington Journal of Law, Technology & Arts

This Article discusses state laws requiring notification of a party whose personal information is held by a business or government agency when the third party’s security is breached and an unauthorized person accesses the personal information. In the wake of the 2005 ChoicePoint data breach, over half of the states passed legislation requiring that companies notify the affected parties after breach of personal information. Most of the state statutes followed the model set forth by California’s Security Breach Notification Act of 2002. However, significant variations exist between the different statutes, which can create compliance problems. This Article specifically illustrates the …

Electronic Health Records: Interoperability Challenges Patients' Right To Privacy, Laura Dunlop

Washington Journal of Law, Technology & Arts

President George W. Bush's administration has outlined initial necessary steps to transform the healthcare delivery system through adoption of interoperable electronic health records ("EHRs") by the year 2014. This Article examines the nation's shift toward the use of EHR technology, which largely facilitates patient care by providing clinicians with the ability to review a more complete medical record at the time of treatment. Current legislation calls for financial support and technical standards. However, lawmakers neglect to fully address the Health Insurance Portability and Accountability Act ("HIPAA") and the need to expand its application and enforcement. In addition, healthcare provider Anti-Kickback …

Follow That Car! Legal Issues Arising From Installation Of Tracking Devices In Leased Consumer Goods And Equipment, Leah Altaras

Washington Journal of Law, Technology & Arts

Recent court cases in Connecticut and California have challenged the commercial use of Global Positioning Systems (GPS) for tracking and gathering data about consumers. Specifically, these cases focused on the terms and disclosures contained in automobile rental contracts relating to the use of GPS to monitor the driving patterns of rental car drivers. In response to concerns about consumer privacy, several states have also enacted legislation that addresses the use of tracking technology in the rental car market. This Article examines recent litigation concerning the use of GPS in rental cars and related legislative efforts. Although recent legislation and litigation …

Hiding Evidence From The Boss: Attorney-Client Privilege And Company Computers, Kelcey Nichols

Washington Journal of Law, Technology & Arts

Recent court decisions in In re Asia Global Crossing, Ltd., People v. Jiang, and Curto v. Medical World Communications have held that attorney-client privilege can protect certain information located on an employer-issued computer from disclosure if the employee had a reasonable expectation of privacy. This Article provides a brief background on attorney-client privilege and explores the factors courts consider when determining whether an employee has this reasonable expectation. These factors include the scope of employer monitoring, the employer-employee agreement pertaining to the computer, the presence of password-protection, the location of the computer, and the relevancy of the evidence …

To Serve And Protect: Do Businesses Have A Legal Duty To Protect Collections Of Personal Information?, Derek A. Bishop

Washington Journal of Law, Technology & Arts

Commercial, governmental, and nonprofit organizations are more frequently reporting instances of data security breaches. This has, in turn, raised fears of identity theft. In some limited instances, companies that maintain large amounts of personal information—such as credit reporting agencies—have been subject to statutory duties to protect that personal information. In some instances, such legislation has also permitted a private cause of action for breach of these duties. Legislatures have expanded these statutes to encompass, at least to a limited degree, all business entities that collect personal information. Recent precedent indicates that courts may follow this trend by declaring security breaches …

Compliance With California Privacy Laws: Federal Law Also Provides Guidance To Businesses Nationwide, Anthony D. Milewski Jr.

Washington Journal of Law, Technology & Arts

Over the past several years, personal information has been lost or stolen as a result of a series of high profile security breaches. In January 2006, the U.S. Federal Trade Commission announced that ChoicePoint will be required to pay $15 million in fines and penalties for a high profile security breach that occurred in 2005. The ChoicePoint breach and similar events have spurred an explosion of state and federal privacy legislation. In particular, the State of California has taken the lead by enacting the strictest disclosure and security procedure requirements in the country. The implications of California’s new laws can …

Lost In Translation? Data Mining, National Security And The Adverse Inference Problem, Anita Ramasastry

Articles

To the extent that we permit data mining programs to proceed, they must provide adequate due process and redress mechanisms that permit individuals to clear their names. A crucial criteria for such a mechanism is to allow access to information that was used to make adverse assessments so that errors may be corrected. While some information may have to be kept secret for national security purposes, a degree of transparency is needed when individuals are trying to protect their right to travel or access government services free from suspicion.

Part II of this essay briefly outlines the government's ability to …

Safe Harbor Agreement—Boon Or Bane?, Sylvia Mercado Kierkegaard

Washington Journal of Law, Technology & Arts

U.S. businesses that handle personal information about individuals living in European Union countries should be aware that, as a general rule, it is unlawful for them to transfer that data out of the European Union to the United States. Exceptions to this general prohibition apply in specified circumstances, that is, where there is consent to the transfer or where there is some assurance that U.S. businesses will comply with the transfers requirements of EU privacy laws when handling that information. These restrictions apply to U.S. businesses that have employees or customers in EU countries, as well as U.S. businesses that …

The Private Sector Amendment To Australia's Privacy Act: A First Step On The Road To Privacy, Alexandra T. Mckay

Washington International Law Journal

Global and national transfers of personal information and data protection laws meant to regulate such transfers will have a significant impact on the growing Internet. Yet vastly different philosophies on how to protect individuals' personal information from theft or misuse by the private sector have led to very different regulatory models throughout the world. In the industrialized world, the European Union's approach, a universally applicable, comprehensive data protection law, occupies one end of the regulatory spectrum, while a self-regulatory scheme like the United States' stakes out the other end. Australia's Private Sector Privacy Act Amendment ("2000 Amendment") lies somewhere in …

Privacy As Contextual Integrity, Helen Nissenbaum

Washington Law Review

The practices of public surveillance, which include the monitoring of individuals in public through a variety of media (e.g., video, data, online), are among the least understood and controversial challenges to privacy in an age of information technologies. The fragmentary nature of privacy policy in the United States reflects not only the oppositional pulls of diverse vested interests, but also the ambivalence of unsettled intuitions on mundane phenomena such as shopper cards, closed-circuit television, and biometrics. This Article, which extends earlier work on the problem of privacy in public, explains why some of the prominent theoretical approaches to privacy, which …

Collateralizing Internet Privacy, Xuan-Thao Nguyen

Articles

Collateralizing privacy is a pervasive conduct committed by many on-line companies. Yet most don't even realize that they are engaging in collateralizing privacy. Worse yet, governmental agencies and consumer groups are not even aware of the violation of on-line consumer privacy by the collateralization of privacy. Professor Nguyen argues that collateralizing privacy occurs under the existing privacy regime and the architecture of article 9 of the Uniform Commercial Code. Professor Nguyen critiques the violation of privacy through collateralization dilemmas and proposes a solution involving modifications of the contents of the financing statement and security agreement in secured transactions where consumer …

Conundrums With Penumbras: The Right To Privacy Encompasses Non-Gamete Providers Who Create Preembryos With The Intent To Become Parents, Lainie M.C. Dillon

Washington Law Review

To date, five state high courts have resolved disputes over frozen preembryos. These disputes arose during divorce proceedings between couples who had previously used assisted reproduction and cryopreserved excess preembryos. In each case, one spouse wished to have the preembryos destroyed, while the other wanted to be able to use or donate them in the future. The parties in these cases invoked the constitutional right to privacy to argue for dispositional control over the preembryos; two of the five cases were resolved by relying on this right. The constitutional right to privacy protects intimate decisions involving procreation, marriage, and family …

Recognizing The Societal Value In Information Privacy, James P. Nehf

Washington Law Review

Much has been written about database privacy in the Internet Age, most of it critical of the way in which the American legal system addresses the issue. In this article, Professor Nehf maintains that one of the fundamental difficulties with the public policy debates is that information privacy is often discussed as a typical consumer problem rather than a problem of more general societal concern. As a result, arguments over appropriate resolutions reduce to a balancing of individual rights against more general societal interests, such as increased efficiency in law enforcement, government operations or commercial enterprise. Although privacy scholars discussed …

Opting In, Outing Out, Or No Options At All: The Fight For Control Of Personal Information, Jeff Sovern

Washington Law Review

Businesses routinely buy and sell personal information about consumers. Many consumers find this objectionable, but relatively few of them opt out of that trade. This Article argues that businesses have both the incentive and the ability to increase consumers' transaction costs in protecting their privacy and that some marketers do in fact inflate those costs. Faced with this and other constraints, many consumers ultimately decide not to protect their privacy. This Article proposes several ways by which consumers' transaction costs can be reduced or eliminated.

No More Messing Around: Substantive Due Process Challenges To State Laws Prohibiting Fornication, Traci Shallbetter Stratton

Washington Law Review

Anglo-American law has historically prohibited fornication, and through the 1960s fornication remained illegal in all but ten states. Few questioned the validity of laws proscribing various forms of private, adult, consensual sexual behavior until the early 1970s. Aside from legislative repeal, substantive due process has been the primary weapon in the fight against state sex laws. Although the U.S. Supreme Court's substantive due process jurisprudence, particularly in the area of personal privacy, has brought the constitutionality of fornication statutes into question, it has not definitively resolved the matter. This Comment argues that laws prohibiting fornication do not violate substantive due …

To Test Or Not To Test: Article I, Section 7 And Random Drug-Testing Of Washington's Public School Student-Athletes, Kristi L. Helgeson

Washington Law Review

In Vernonia School District 47J v. Acton, the U.S. Supreme Court held that the Fourth Amendment to the U.S. Constitution does not protect the privacy interests of the nation's public school student-athletes from mandatory, random urinalysis drug-testing. This Comment argues that article I, section 7 of the Washington State Constitution provides Washington's student-athletes greater protection than the Fourth Amendment and, consequently, proscribes mandatory, random urinalysis drug-testing. It concludes by providing parameters for student-athlete drug-testing programs that will pass state constitutional muster.

The Hidden First Amendment Values Of Privacy, Sean M. Scott

Washington Law Review

The private facts tort protects the privacy of individuals by punishing the publication of private information. The First Amendment protects the press when it publishes information in which the public has a legitimate interest. The right to keep information private and the right to publish information sometimes conflict. The First Amendment is often the victor in these conflicts; courts are concerned that the private facts tort threatens First Amendment values. This Article challenges the argument that punishing a media defendant for publishing truthful information will threaten unduly First Amendment values. The Article argues instead that the private facts tort promotes, …

State V. Young And The New Test For Privacy In Washington, Michael M. Suga

Washington Law Review

In State v. Young, the Washington Supreme Court determined that the warrantless use of an infrared thermal detection device on the home of a suspected marijuana grower was a violation of Article I, Section 7 of the Washington State Constitution. This Note argues that the court's test for determining privacy rights under Article I, Section 7 is flawed in form and fails to achieve those goals set forth by the court. It suggests an alternative test for Article I, Section 7 privacy rights as well as a remedial prerequisite standard of proof in cases involving minimally intrusive surveillance techniques.

Protecting Donar Privacy In Aids Related Blood Bank Litigation—Doe V. Puget Sound Blood Center, 117 Wash. 2d 772, 819 P.2d 370 (1991), Anne Marie Logerfo

Washington Law Review

One controversial issue in blood bank AIDS litigation is whether courts should permit infected plaintiffs to conduct discovery of information about the blood donor who contributed the contaminated blood. Many courts have taken a reasonable middle ground by allowing limited discovery of a blood donor provided that the donor's identity remains confidential. In a recent case, the Washington Supreme Court provided no such limitation on blood donor discovery. This Note argues that the court's decision infringes on the significant privacy interests of the blood donor and violates the public's interest in an adequate blood supply while providing little or no …

When Rape Victims' Rights Meet Privacy Rights: Mandatory Hiv Testing, Striking The Fourth Amendment Balance, Bernadette Pratt Sadler

Washington Law Review

As a result of the growing concern of rape victims about exposure to the AIDS virus, many states have enacted legislation allowing for forced testing of suspected or convicted rapists for the purpose of releasing the results to victims. Because the United States Supreme Court has yet to hear a fourth amendment challenge to any mandatory HIV testing program, the constitutionality of testing is not settled. This Comment analyzes mandatory HIV testing conducted for the purpose of informing the rape victim of her assailant's status and concludes that such testing is a violation of the fourth amendment because it does …

New Federalism And "Occupation Of The Field": Failing To Maintain State Constitutional Protections Within A Preemption Framework—Alverado V. Washington Public Power Supply System, 111 Wash. 2d 424, 759 P.2d 427 (1988), Cert. Denied, 109 S. Ct. 1637 (1989), Daryl R. Hague

Washington Law Review

In Alverado v. Washington Public Power Supply System, the Washington Supreme Court held that nonbinding agency action preempted Washington's constitutional right to privacy in the context of employee drug testing at nuclear power plants. This preemption holding was based on traditional "occupation of the field" standards, which prohibit concurrent state regulation in areas where the federal government exercises plenary power. Because it was based on an "occupation of the field" finding, the court's decision had the practical effect of permitting nonenforceable agency pronouncements to preempt state constitutional guarantees. An exception to traditional "occupation of the field" doctrine is proposed to …

Privacy Regulation Of Computer-Assisted Testing And Instruction, Charles R. Tremper, Mark A. Small

Washington Law Review

Using computers to assist in testing and instruction creates privacy concerns that were absent or less consequential prior to the computer age. Not only does computer-assisted testing and instruction (CATI) threaten to invade privacy insidiously, its use with young schoolchildren poses the additional threat of arresting development of their privacy expectations. In light of the significance of "reasonable expectations of privacy" in constitutional and tort law, as well as privacy's role in resisting totalitarianism, widespread and routine use of CATI may profoundly alter the balance between public and private realms.

Privacy Regulation Of Computer-Assisted Testing And Instruction, Charles R. Tremper, Mark A. Small

Washington Law Review

Using computers to assist in testing and instruction creates privacy concerns that were absent or less consequential prior to the computer age. Not only does computer-assisted testing and instruction (CATI) threaten to invade privacy insidiously, its use with young schoolchildren poses the additional threat of arresting development of their privacy expectations. In light of the significance of "reasonable expectations of privacy" in constitutional and tort law, as well as privacy's role in resisting totalitarianism, widespread and routine use of CATI may profoundly alter the balance between public and private realms.

Are Privacy And Public Disclossure Compatible?: The Privacy Exemption To Washington's Freedom Of Information Act—In Re Rosier, 105 Wn. 2d 606, 717 P.2d 1353 (1986), Matthew Edwards

Washington Law Review

In 1972, Washington State voters passed Initiative 276, the Public Disclosure Act, by a substantial margin. The initiative contained four measures intended to open up government, including one designed to ensure public access to government-held records. This measure, popularly known as Washington's Freedom of Information Act (FOIA), provides a mechanism by which individuals can access information held by the government, subject to only a few exemptions. One such exemption prevents disclosure which is an "unreasonable invasion" of personal privacy. The Washington Supreme Court greatly expanded the scope of this personal privacy exemption in In re Rosier. Prior to this decision, …

The Origin And Development Of Washington's Independent Exclusionary Rule: Constitutional Right And Constitutionally Compelled Remedy, Sanford E. Pitler

Washington Law Review

Underlying any court's analysis of the exclusionary rule are certain basic theoretical elements that determine whether a court takes a unitary or a bifurcated approach to exclusion. To determine what theoretical elements underlie the Washington rule, the court must familiarize itself with the state rule's long history of independent application, which has never been fully explored. The court must also recognize the historical relationship between the state exclusionary rule and certain provisions of the Declaration of Rights. 6 Analysis of the Washington exclusionary rule's development reveals that, at minimum, exclusion is constitutionally compelled as the most effective remedy available to …

Privacy, Abortion, And Judicial Review: Haunted By The Ghost Of Lochner, Helen Garfield

Washington Law Review

This article poses the question whether Lochner can finally be laid to rest without repudiating all applications of substantive due process, particularly protection of privacy and autonomy. The answer to that question requires a closer look at Lochner itself, and then at Griswold, Roe, and a few of the cases in between. The answers suggested by Ely, Perry, Choper, and others will then be discussed. Finally, this article will examine the ideas and ideals of the man who first conceived the common law right of privacy, Justice Louis D. Brandeis.

Thinking Clearly About Privacy, Thomas Huff

Washington Law Review

The purpose of this article is to offer a fresh assessment of the right of privacy. It begins with discussion of the privacy norm, drawing on our ordinary judgments and experiences to clarify and elaborate the interest persons have in privacy. It then reviews some of the Supreme Court's reasoning on privacy, explains the Court's confusions, and proposes a way that we and the Court might think more clearly about these difficult matters.

Privacy And The Press Since Time, Inc. V. Hill, Don R. Pember, Dwight L. Teeter, Jr.

Washington Law Review

In this article, the authors do not propose to discuss the innumerable ways in which one's privacy is invaded or to survey the entire sweep of the law of privacy, but rather attempt to trace briefly its development, with particular emphasis on how the law has affected the mass media since the Supreme Court decided its first privacy case, Time, Inc. v. Hill, in 1967. In so doing, we hope to add somewhat to the understanding of this unsettled area of law.