Privacy Law Commons^™

Brokering Safety, Chinmayi Sharma, Thomas E. Kadri, Sam Adler

Articles

For victims of abuse, safety means hiding. Not just hiding themselves, but also their contact details, their address, their workplace, their roommates, and any other information that could enable their abuser to target them. Yet today, no number of name changes and relocations can prevent data brokers from sharing a victim's personal information online. Thanks to brokers, abusers can find what they need with a single search, a few clicks, and a few dollars. For many victims, then, the best hope for safety lies in obscurity-that is, making themselves and their information harder to find.

This Article exposes privacy law's …

A Legal Transplant Failure In The Ai Age, Xuan-Thao Nguyen

Articles

Thailand positions itself as the new AI-driven innovation hub in the Southeast Asia region as Big Tech companies invest billions in building new data centers to power the AI transformations in all sectors in Thailand. An integral part of Thailand’s new ambition is the legal transplant of personal data protection law from Europe. The transplant, however, is of form, not substance, as this Article illustrates the failure through in-depth analysis of Thailand’s Personal Data Protection Act and provides evidence of rampant violations and noncompliance by the largest ecommerce conglomerate and SMEs. This Article offers suggestions for Thailand to realign its …

Forget Me Not? Machine Unlearning’S Implications For Privacy Law, Jevan Hutson, Cedric Whitney, Jay T. Conrad

Articles

Generative AI systems are increasingly relied on and are already actively reshaping how we think about privacy and data protection law. Models ingest and process vast amounts of personal and sensitive data, challenging assurances of compliance with legal frameworks like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) with increasing intensity. Machine unlearning is an emerging tool in practitioners’ attempts to address these challenges: the act of selectively removing or suppressing specific data, such as personal data that a data subject requests be deleted, from AI models as means of complying with legal obligations or …

Co-Constructing The Future Of Digital Intimacy, Chris Geeng, Lucy Qin, Allison Mcdonald, Amna Batool, Diana Freed, Oliver L. Haimson, Jevan Hutson, Elissa M. Redmiles, Zahra Stardust, Miranda Wei, Douglas Zytko

Articles

The Internet, artificial intelligence, and other emerging technologies have transformed the way humans can interact with each other and express romance, sex, and other forms of intimacy. Digital intimacy, including online dating, sexual/intimate content sharing, online sex work, and romantic chatbots, has grown ubiquitous. This can both be a source of great joy, such as when connecting remote partners and supporting sexual self-expression, and a source of harms, including but not limited to image-based sexual abuse, deepfakes, location privacy violations, and technology-enabled intimate partner violence. As new technologies continue to transform digital intimacy, this workshop aims to create a sex-positive …

The Privacy Act Of 1974: The American Bill Of Rights On Data And Its Unfinished Business, Dongsheng Zang

Articles

In the midst of the artificial intelligence (“AI”) revolution and the debates around it in 2023, this Article proposes to revisit the history of the Privacy Act of 1974, a federal statute that attempted to revolutionize the notion of privacy in response to automated data processing in the computer age. By recognizing that an individual should have the right to control data about herself, the 1974 Act went beyond the Warren-Brandeis framework of privacy based on tort law—the 1974 Act was essentially an American Bill of Rights on data.

The Article first tracks the conceptual development of this new idea …

The Broader Lessons Of Privacy Law, Salome Viljoen

Articles

This Article explores the trend of privacy—and what kind of techno-social or legal effect ought to count as a “privacy harm”—expanding to encompass a growing set of social factors. This big-tent approach to privacy has several virtues. However, it also comes with a few costs. While others have explored the conceptual and doctrinal tradeoffs that an expansive approach to privacy may entail, this Article focuses on a secondary effect the trend toward expansiveness has had on the relationship between privacy scholarship and legal scholarship more broadly. This Article suggests that the internal expansiveness of privacy means that insights developed within …

Big Data Searches And The Future Of Criminal Procedure, Mary Fan

Articles

This Article proceeds in three parts. Part I illuminates the nostalgic Luddism that influences Fourth Amendment jurisprudence and the challenges posed by evolving technologies to this dominant lens. This Part explains the operation of geofence and keyword warrants and how their power to crack cold cases by unidentified perpetrators both tempt and terrify. The confusion in the courts over the constitutionality of geofence and keyword warrants is emblematic of the larger challenges of the Romantic Luddism in Fourth Amendment originalism that has grown in influence over the decades.

Part II frames and theorizes the concepts of collateral impact and collateral …

Distinguishing Privacy Law: A Critique Of Privacy As Social Taxonomy, María P. Angel, Ryan Calo

Articles

What distinguishes privacy violations from other harms? This has proven a surprisingly difficult question to answer. For over a century, privacy law scholars labored to define the elusive concept of privacy. Then they gave up. Efforts to distinguish privacy were superseded at the turn of the millennium by a new approach: a taxonomy of privacy problems grounded in social recognition. Privacy law became the field that simply studies whatever courts or scholars talk about as related to privacy.

Decades into privacy as social taxonomy, the field has expanded to encompass a broad range of information-based harms—from consumer manipulation to algorithmic …

Valuing Social Data, Amanda Parsons, Salome Viljoen

Articles

Social data production—accumulating, processing, and using large volumes of data about people—is a unique form of value creation that characterizes the digital economy. Social data production also presents critical challenges for the legal regimes that encounter it. This Article provides scholars and policymakers with the tools to comprehend this new form of value creation through two descriptive contributions. First, it presents a theoretical account of social data, a mode of production that is cultivated and exploited for two distinct (albeit related) forms of value: prediction value and exchange value. Second, it creates and defends a taxonomy of three “scripts” that …

America's Next "Stop Model!": Model Deletion, Jevan Hutson, Ben Winters

Articles

This Essay explores the emergence of model deletion- the compelled destruction or dispossession of certain data, algorithms, models, and associated work products created or shaped by illegal means- as a remedy, right, and requirement for harmful applications of Al and ML systems. Part I examines model deletion's emergence as a consumer protection remedy and its conception as a positive right and regulatory requirement. Part II considers the constellation of federal and state actors, such as federal and state enforcement agencies and legislative bodies, who might seek model deletion to address particular Al and ML harms. Part III underscores the need …

Research Access To Social Media Data: Lessons From Clinical Trial Data Sharing, Christopher J. Morten, Gabriel Nicholas, Salomé Vilgoen

Articles

For years, social media companies have sparred with lawmakers over how much independent access to platform data they should provide researchers. Sharing data with researchers allows the public to better understand the risks and harms associated with social media, including areas such as misinformation, child safety, and political polarization. Yet researcher access is controversial. Privacy advocates and companies raise the potential privacy threats of researchers using such data irresponsibly. In addition, social media companies raise concerns over trade secrecy: the data these companies hold and the algorithms powered by that data are secretive sources of competitive advantage. This Article shows …

Safeguarding Taxpayer Data, Michael Hatfield

Articles

The Internal Revenue Service (IRS) collects more information on more individuals than any other government agency. The information is not only financial but personal, potentially including information about health care needs and decisions; the caregivers, disabilities, and foreign birth of children; the educational progress and felony convictions of students; and one’s religious and charitable associations. In acknowledging the vast quantity of information held by the IRS, and the necessity of taxpayers trusting tax administrators with their information, Congress provided greater protection for taxpayer information under the Internal Revenue Code (IRC) than it was provided under the Privacy Act. Congress obligated …

Who Owns Data? Constitutional Division In Cyberspace, Dongsheng Zang

Articles

Privacy emerged as a concern as soon as the internet became commercial. In early 1995, Lawrence Lessig warned that the internet, though giving us extraordinary potential, was “not designed to protect individuals against this extraordinary potential for others to abuse.” The same technology can “destroy the very essence of what now defines individuality.” Lessig urged that “a constitutional balance will have to be drawn between these increasingly important interests in privacy, and the competing interest in collective security.” Lessig envisioned that creating property rights in data would help individuals by giving them control of their data. As utopian as property …

Unprecedented Precedent And Original Originalism: How The Supreme Court’S Decision In Dobbs Threatens Privacy And Free Speech Rights, Leonard Niehoff

Articles

The U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization has drawn considerable attention because of its reversal of Roe v. Wade and its rejection of a woman’s constitutional right to terminate her pregnancy. The Dobbs majority, and some of the concurring opinions, emphasized that the ruling was a narrow one. Nevertheless, there are reasons to think the influence of Dobbs may extend far beyond the specific constitutional issue the case addresses.

This article explains why Dobbs could have significant and unanticipated implications for the law of privacy and the law of free expression. I argue that two …

The Great Regulatory Dodge, Helen Nissenbaum, Katherine Strandburg, Salome Viljoen

Articles

U.S. privacy law is in a renewed moment of regulatory possibility, with both Congress and the states considering sweeping consumer privacy laws. These new proposals to enact “omnibus” privacy protections could be couched as an antidote to the current U.S. privacy regime: a patchwork of sectoral privacy laws stitched atop the background of FTC consumer contract enforcement. However, this Essay maintains that a one-size-fits-all approach cannot successfully capture both privacy’s value and its variability. Yet, it is clearly the case that the present- day sectoral regime in the United States suffers from significant shortcomings. These shortcomings allow behaviors that seem …

Privacy And National Politics: Fingerprint And Dna Litigation In Japan And The United States Compared, Dongsheng Zang

Articles

Drawing cases from two related areas of law-fingerprint and DNA (deoxyribonucleic acid) data-this Article proposes a modified framework, built on the Balkin-Levinson emphasis on national politics: First, national politics understood as partisan rivalry cannot account for what I call doctrinal lock-in in this Article, where I will demonstrate that in different stages of American politics-the Lochner era, the New Deal era, and Civil Rights era-courts across the nation ruled predominantly in favor of public data collectors-state and federal law enforcement in fingerprint cases. From the 1990s, when DNA data became hot targets of law enforcement, the United States Supreme Court …

Physiognomic Artificial Intelligence, Luke Stark, Jevan Hutson

Articles

The reanimation of the pseudosciences of physiognomy and phrenology at scale through computer vision and machine learning is a matter of urgent concern. This Article—which contributes to critical data studies, consumer protection law, biometric privacy law, and antidiscrimination law—endeavors to conceptualize and problematize physiognomic artificial intelligence (“AI”) and offer policy recommendations for state and federal lawmakers to forestall its proliferation.

Physiognomic AI, as this Article contends, is the practice of using computer software and related systems to infer or create hierarchies of an individual’s body composition, protected class status, perceived character, capabilities, and future social outcomes based on their physical …

The Privacy Paradox By Proxy: Considering Predictors Of Sharenting, Niamh Ní Bhroin, Thuy Dinh, Kira Thiel, Elisabeth Staksrud, Kjartan Ólafsson

Articles

Despite being worried that children may compromise their privacy by disclosing too much personal data online, many parents paradoxically share pictures and information about their children themselves, a practice called sharenting. In this article we utilise data from the EU Kids Online survey to investigate this paradox. We examine both how individual charac‐ teristics such as demographics and digital skills, and relational factors, including parental mediation styles, concerns about children’s privacy, and communication between parents and children influence sharenting practices. Counter‐intuitively, our findings show that parents with higher levels of digital skills are more likely to engage in sharenting. Furthermore, …

Why Govern Broken Tools?, Ryan Calo

Articles

In Assessing the Governance of Digital Contact Tracing in Response to COVID-19: Results of a Multi-National Study, Brian Hutler et al. ably compare two approaches to the governance of digital contract tracing (DCT). In this brief essay, I want to examine to what extent governance actually played a meaningful role in the failure of DCT. If DCT failed primarily for other reasons, then the authors’ normative suggestion to pursue “a new governance approach … for designing and implementing DCT technology going forward” may be misplaced.

Self-Control Of Personal Data And The Constitution In East Asia, Dongsheng Zang

Articles

No abstract provided.

The Hidden Harms Of Privacy Penalties, Mary D. Fan

Articles

How to frame privacy penalties to protect our personal information is an important question as demands for legislation and proposals proliferate. The predominant assumption in calls for a comprehensive consumer privacy regime is that regulation and penalties arm the consumer David against Goliath businesses. Missing in the focus on powerful companies is attention to the potential harms of expanding privacy penalties for small-fry individuals and entities, especially from disfavored or marginalized groups. This article is the first to illuminate the regressive risks of privacy penalties, showing how broad privacy penalties can become tools for harassment of small businesses and individuals …

Problematic Interactions Between Ai And Health Privacy, W. Nicholson Price Ii

Articles

Problematic Interactions Between AI and Health Privacy Nicholson Price, University of Michigan Law SchoolFollow Abstract The interaction of artificial intelligence (AI) and health privacy is a two-way street. Both directions are problematic. This Essay makes two main points. First, the advent of artificial intelligence weakens the legal protections for health privacy by rendering deidentification less reliable and by inferring health information from unprotected data sources. Second, the legal rules that protect health privacy nonetheless detrimentally impact the development of AI used in the health system by introducing multiple sources of bias: collection and sharing of data by a small set …

The Right To Benefit From Big Data As A Public Resource, Mary D. Fan

Articles

The information that we reveal from interactions online and with electronic devices has massive value—for both private profit and public benefit, such as improving health, safety, and even commute times. Who owns the lucrative big data that we generate through the everyday necessity of interacting with technology? Calls for legal regulation regarding how companies use our data have spurred laws and proposals framed by the predominant lens of individual privacy and the right to control and delete data about oneself. By focusing on individual control over droplets of personal data, the major consumer privacy regimes overlook the important question of …

Public (Ai)Ccomodations, Jevan Hutson, Deepak George, Aj Kidd, Sulaf Al-Saif, Mandy (Meiyun) Ku, Devin Glaser, Devin Glaser

Articles

This Note discusses the use of Al surveillance in places of public accommodations and its implications for civil rights and antidiscrimination law. Part I documents the extensive Al surveillance employed in areas of public accommodation, where American antidiscrimination laws explicitly provide for elevated protection. Part II uses critical race theory to explore how contemporary antidiscrimination law marries two approaches to antidiscrimination in a way that undercuts its own ability to remedy injustice. Part III reveals how antidiscrimination law fails to address issues implicated by Al surveillance in areas of public accommodations, and Part IV proposes a simple solution: abolish it.

Location Tracking And Digital Data: Can Carpenter Build A Stable Privacy Doctrine?, Evan H. Caminker

Articles

In Carpenter v United States, the Supreme Court struggled to modernize twentieth-century search and seizure precedents for the “Cyber Age.” Twice previously this decade the Court had tweaked Fourth Amendment doctrine to keep pace with advancing technology, requiring a search warrant before the government can either peruse the contents of a cell phone seized incident to arrest or use a GPS tracker to follow a car’s long-term movements.

Shadow Health Records Meet New Data Privacy Laws, W. Nicholson Price Ii, Margot E. Kaminski, Timo Minssen, Kayte Spector-Bagdady

Articles

Large sets of health data can enable innovation and quality measurement but can also create technical challenges and privacy risks. When entities such as health plans and health care providers handle personal health information, they are often subject to data privacy regulation. But amid a flood of new forms of health data, some third parties have figured out ways to avoid some data privacy laws, developing what we call “shadow health records”—collections of health data outside the health system that provide detailed pictures of individual health—that allow both innovative research and commercial targeting despite data privacy rules. Now that space …

Privacy In The Age Of Medical Big Data, W. Nicholson Price Ii, I. Glenn Cohen

Articles

Big data has become the ubiquitous watch word of medical innovation. The rapid development of machine-learning techniques and artificial intelligence in particular has promised to revolutionize medical practice from the allocation of resources to the diagnosis of complex diseases. But with big data comes big risks and challenges, among them significant questions about patient privacy. Here, we outline the legal and ethical challenges big data brings to patient privacy. We discuss, among other topics, how best to conceive of health privacy; the importance of equity, consent, and patient governance in data collection; discrimination in data uses; and how to handle …

Privacy Law's Indeterminacy, Ryan Calo

Articles

American legal realism numbers among the most important theoretical contributions of legal academia to date. Given the movement’s influence, as well as the common centrality of certain key figures, it is surprising that privacy scholarship in the United States has paid next to no attention to the movement. This inattention is unfortunate for several reasons, including that privacy law furnishes rich examples of the indeterminacy thesis—a key concept of American legal realism—and because the interdisciplinary efforts of privacy scholars to explore extra-legal influences on privacy law arguably further the plot of legal realism itself

A Long-Standing Debate: Reflections On Risk And Anxiety: A Theory Of Data Breach Harms By Daniel Solove And Danielle Keats Citron, Ryan Calo

Articles

This jointly-authored Article contributes mightily to our understanding of a critical aspect of privacy: harm. As Professors Solove and Citron carefully evidence, courts are reticent to countenance the harms that flow from a violation of privacy, even as they compensate similar harms in other contexts. Thus while exposing a plaintiff to an environmental or health risk may be compensable, few decisions vindicate victims of a data breach unless or until they experience actual identity theft. Courts have recognized subjective harms such as fear since the night W de S threw his fateful axe at M de S. But courts seldom …

Risk And Resilience In Health Data Infrastructure, W. Nicholson Price Ii

Articles

Today’s health system runs on data. However, for a system that generates and requires so much data, the health care system is surprisingly bad at maintaining, connecting, and using those data. In the easy cases of coordinated care and stationary patients, the system works—sometimes. But when care is fragmented, fragmented data often result. Fragmented data create risks both to individual patients and to the system. For patients, fragmentation creates risks in care based on incomplete or incorrect information, and may also lead to privacy risks from a patched together system. For the system, data fragmentation hinders efforts to improve efficiency …