Privacy Law Commons^™

Privacy In Public, Joel R. Reidenberg

Faculty Scholarship

As government and private companies rapidly expand the infrastructure of surveillance from cameras on every street corner to facial recognition for photographs on social media sites, privacy doctrines built on seclusion are at odds with technological advances. This essay addresses a key conceptual problem in US privacy law identified by Justice Sotomayor in U.S. v. Jones and by Justice Scalia in Kyllo v. U.S.; namely that technological capabilities undermine the meaning of the third-party doctrine and the 4th Amendment's ‘reasonable expectation of privacy’ standard. The essay argues that the conceptual problem derives from the evolution of three stages of development …

The Data Surveillance State In Europe And The United States, Joel R. Reidenberg

Faculty Scholarship

No abstract provided.

Failing Expectations: Fourth Amendment Doctrine In The Era Of Total Surveillance, Olivier Sylvain

Faculty Scholarship

Today’s reasonable expectation test and the third-party doctrine have little to nothing to offer by way of privacy protection if users today are at least conflicted about whether transactional noncontent data should be shared with third parties, including law enforcement officials. This uncertainty about how to define public expectation as a descriptive matter has compelled courts to defer to legislatures to find out what public expectation ought to be more as a matter of prudence than doctrine. Courts and others presume that legislatures are far better than courts at defining public expectations about emergent technologies.This Essay argues that the reasonable …

Redefining Genomic Privacy: Trust And Empowerment, Yaniv Erlich, James B. Williams, David Glazer, Kenneth Yocum, Nita A. Farahany, Maynard Olson, Arvind Narayanan, Lincoln D. Stein, Jan A. Witkowski, Robert C. Kain

Faculty Scholarship

Fulfilling the promise of the genetic revolution requires the analysis of large datasets containing information from thousands to millions of participants. However, sharing human genomic data requires protecting subjects from potential harm. Current models rely on de-identification techniques in which privacy versus data utility becomes a zero-sum game. Instead, we propose the use of trust-enabling techniques to create a solution in which researchers and participants both win. To do so we introduce three principles that facilitate trust in genetic research and outline one possible framework built upon those principles. Our hope is that such trust-centric frameworks provide a sustainable solution …

Rethinking Privacy, William H. Simon

Faculty Scholarship

Anxiety about surveillance and data mining has led many to embrace implausibly expansive and rigid conceptions of privacy. The premises of some current privacy arguments do not fit well with the broader political commitments of those who make them. In particular, liberals seem to have lost touch with the reservations about privacy expressed in the social criticism of some decades ago. They seem unable to imagine that preoccupation with privacy might amount to a “pursuit of loneliness” or how “eyes on the street” might have reassuring connotations. Without denying the importance of the effort to define and secure privacy values, …

Reviving Implied Confidentiality, Woodrow Hartzog

Faculty Scholarship

The law of online relationships has a significant flaw-it regularly fails to account for the possibility of an implied confidence. The established doctrine of implied confidentiality is, without explanation, almost entirely absent from online jurisprudence in environments where it has traditionally been applied offline, such as with sensitive data sets and intimate social interactions.

Courts' abandonment of implied confidentiality in online environments should have been foreseen. The concept has not been developed enough to be consistently applied in environments such as the Internet that lack obvious physical or contextual cues of confidence. This absence is significant because implied confidentiality could …

The Ftc And The New Common Law Of Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

One of the great ironies about information privacy law is that the primary regulation of privacy in the United States has barely been studied in a scholarly way. Since the late 1990s, the Federal Trade Commission (FTC) has been enforcing companies’ privacy policies through its authority to police unfair and deceptive trade practices. Despite over fifteen years of FTC enforcement, there is no meaningful body of judicial decisions to show for it. The cases have nearly all resulted in settlement agreements. Nevertheless, companies look to these agreements to guide their privacy practices. Thus, in practice, FTC privacy jurisprudence has become …

The Ftc And Privacy And Security Duties For The Cloud, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Third-party data service providers, especially providers of cloud computing services, present unique and difficult privacy and data security challenges. While many companies that directly collect data from consumers are bound by the promises they make to individuals in their privacy policies, cloud service providers are usually not a part of this arrangement. It is not entirely clear what, if any, obligations cloud service providers have to protect the data of individuals with whom they have no contractual relationship. This problem is especially acute because many institutions sharing personal data with cloud service providers fail to include significant privacy and security …

The Value Of Modest Privacy Protections In A Hyper Social World, Woodrow Hartzog

Faculty Scholarship

Two of the greatest modem challenges to protecting personal information are determining how to protect information that is already known by many and how to create an adequate remedy for privacy harms that are opaque, remote, or cumulative. Both of these challenges are front and center for those who seek to protect socially shared information. Social media and wearable communication technologies like Google Glass present vexing questions about whether information that is known by many can ever be "private," what the privacy harm might be from this information's misuse, and how to remedy such harms in balance with competing values …

Rethinking Online Privacy In Canada: Commentary On Voltage Pictures V. John And Jane Doe, Ngozi Okidegbe

Faculty Scholarship

This article problematizes the use of the bona fide case standard as the legal standard for a court to order a third party Internet Service Provider ("ISP") to disclose subscriber information to a copyright owner in online piracy cases. It argues that ISP account holders have a reasonable expectation of privacy in their subscriber information. It contends that the current bona fide case standard affords a relatively low threshold of protection for Internet users’ subscriber information. The reason for which the article takes this position is that the bona fide case standard can be met solely by IP address evidence, …

The Right To Quantitative Privacy, David Gray, Danielle K. Citron

Faculty Scholarship

We are at the cusp of a historic shift in our conceptions of the Fourth Amendment driven by dramatic advances in surveillance technology. Governments and their private sector agents continue to invest billions of dollars in massive data-mining projects, advanced analytics, fusion centers, and aerial drones, all without serious consideration of the constitutional issues that these technologies raise. In United States v. Jones, the Supreme Court signaled an end to its silent acquiescence in this expanding surveillance state. In that case, five justices signed concurring opinions defending a revolutionary proposition: that citizens have Fourth Amendment interests in substantial quantities of …

Fighting Cyber-Crime After United States V. Jones, David Gray, Danielle K. Citron, Liz Clark Rinehart

Faculty Scholarship

In a landmark non-decision last term, five Justices of the United States Supreme Court would have held that citizens possess a Fourth Amendment right to expect that certain quantities of information about them will remain private, even if they have no such expectations with respect to any of the information or data constituting that whole. This quantitative approach to evaluating and protecting Fourth Amendment rights is certainly novel and raises serious conceptual, doctrinal, and practical challenges. In other works, we have met these challenges by engaging in a careful analysis of this “mosaic theory” and by proposing that courts focus …

A Shattered Looking Glass: The Pitfalls And Potential Of The Mosaic Theory Of Fourth Amendment Privacy, David Gray, Danielle K. Citron

Faculty Scholarship

On January 23, 2012, the Supreme Court issued a landmark non-decision in United States v. Jones. In that case, officers used a GPS-enabled device to track a suspect’s public movements for four weeks, amassing a considerable amount of data in the process. Although ultimately resolved on narrow grounds, five Justices joined concurring opinions in Jones expressing sympathy for some version of the “mosaic theory” of Fourth Amendment privacy. This theory holds that we maintain reasonable expectations of privacy in certain quantities of information even if we do not have such expectations in the constituent parts. This Article examines and explores …

Addressing The Harm Of Total Surveillance: A Reply To Professor Neil Richards, Danielle Keats Citron, David C. Gray

Faculty Scholarship

In his insightful article The Dangers of Surveillance, 126 HARV. L. REV. 1934 (2013), Neil Richards offers a framework for evaluating the implications of government surveillance programs that is centered on protecting "intellectual privacy." Although we share his interest in recognizing and protecting privacy as a condition of personal and intellectual development, we worry in this essay that, as an organizing principle for policy, "intellectual privacy" is too narrow and politically fraught. Drawing on other work, we therefore recommend that judges, legislators, and executives focus instead on limiting the potential of surveillance technologies to effect programs of broad and indiscriminate …

A Shattered Looking Glass: The Pitfalls And Potential Of The Mosaic Theory Of Fourth Amendment Privacy, David C. Gray, Danielle Keats Citron

Faculty Scholarship

On January 23, 2012, the Supreme Court issued a landmark non-decision in United States v. Jones. In that case, officers used a GPS-enabled device to track a suspect’s public movements for four weeks, amassing a considerable amount of data in the process. Although ultimately resolved on narrow grounds, five Justices joined concurring opinions in Jones expressing sympathy for some version of the “mosaic theory” of Fourth Amendment privacy. This theory holds that we maintain reasonable expectations of privacy in certain quantities of information even if we do not have such expectations in the constituent parts. This Article examines and …

Privacy, Antitrust, And Power, Frank Pasquale

Faculty Scholarship

When a dominant internet service collects information about its users, the situation is so far from the usual arm’s-length market transaction that neoclassical economic analysis is misleading. “Lack of surveillance” is not a product that individuals have varying preferences for and purchase accordingly. Rather, surveillance is an inevitable concomitant of life online. We need to tame the power that surveillance entails, rather than continuing to pursue illusory, surveillance-free alternatives on the platform level.

To the extent a company creates profiles of individuals and collects data on them, a third party ought to be collecting reports from the company on how …

The Future Of Hipaa In The Cloud, Frank Pasquale, Tara Adams Ragone

Faculty Scholarship

This white paper examines how cloud computing generates new privacy challenges for both healthcare providers and patients, and how American health privacy laws may be interpreted or amended to address these challenges. Given the current implementation of Meaningful Use rules for health information technology and the Omnibus HIPAA Rule in health care generally, the stage is now set for a distinctive law of “health information” to emerge. HIPAA has come of age of late, with more aggressive enforcement efforts targeting wayward healthcare providers and entities. Nevertheless, more needs to be done to assure that health privacy and all the values …

The Right To Quantitative Privacy, David C. Gray, Danielle Keats Citron

Faculty Scholarship

We are at the cusp of a historic shift in our conceptions of the Fourth Amendment driven by dramatic advances in surveillance technology. Governments and their private sector agents continue to invest billions of dollars in massive data-mining projects, advanced analytics, fusion centers, and aerial drones, all without serious consideration of the constitutional issues that these technologies raise. In United States v. Jones, the Supreme Court signaled an end to its silent acquiescence in this expanding surveillance state. In that case, five justices signed concurring opinions defending a revolutionary proposition: that citizens have Fourth Amendment interests in substantial quantities of …

From Lord Coke To Internet Privacy: The Past, Present, And Future Of Electronic Contracting, Juliet M. Moringiello, William L. Reynolds

Faculty Scholarship

Contract law is applied countless times every day, in every manner of transaction large or small. Rarely are those transactions reflected in an agreement produced by a lawyer; quite the contrary, almost all contracts are concluded by persons with no legal training and often by persons who do not have a great deal of education. In recent years, moreover, technological advances have provided novel methods of creating contracts. Those facts present practitioners of contract law with an interesting conundrum: The law must be sensible and stable if parties are to have confidence in the security of their arrangements; but contract …

Global Governance In The Information Age: The Terrorist Finance Tracking Program, Hannah Bloch-Wehba

Faculty Scholarship

Europe has long been deemed "more protective" of privacy than the United States. In the context of transatlantic cooperation in the war on terrorism, divergences in privacy law and policy have become ever more apparent. As has always been the case, the same technologies that pose new and vital privacy issues with regard to personal information and private data are those that are important sources for government actors, including law enforcement and intelligence agencies. Despite the increasing reliance by national agencies on information flowing from other nations, regulation of information transfer, processing and sharing has been achieved largely outside of …

The Attorney-Client Privilege – Selective Compulsion, Selective Waiver And Selective Disclosure: Is Bank Regulation Exceptional?, Bruce A. Green

Faculty Scholarship

This essay examines three ways in which bank regulation has spawned significant exceptions to the ordinary judicial and administrative understanding of the attorney-client privilege. First, federal banking agencies assert that they have the legal authority selectively to compel banks and other financial institutions they supervise to disclose attorney-client privileged information. Second, when banks disclose privileged material to bank regulators, even if voluntarily, banks retain the privilege with respect to third parties pursuant to specific federal statutory authority. Third, under agency policy, once bank regulators obtain privileged information from a bank, whether through compulsion or voluntarily, the regulators reserve the right …

Biometric Id Cybersurveillance, Margaret Hu

Faculty Scholarship

The implementation of a universal digitalized biometric ID system risks normalizing and integrating mass cybersurveillance into the daily lives of ordinary citizens. ID documents such as driver’s licenses in some states and all U.S. passports are now implanted with radio frequency identification (RFID) technology. In recent proposals, Congress has considered implementing a digitalized biometric identification card—such as a biometric-based, “high-tech” Social Security Card—which may eventually lead to the development of a universal multimodal biometric database (e.g., the collection of the digital photos, fingerprints, iris scans, and/or DNA of all citizens and noncitizens). Such “hightech” IDs, once merged with GPS-RFID tracking …

Fighting Cybercrime After United States V. Jones, David C. Gray, Danielle Keats Citron, Liz Clark Rinehart

Faculty Scholarship

In a landmark non-decision last term, five Justices of the United States Supreme Court would have held that citizens possess a Fourth Amendment right to expect that certain quantities of information about them will remain private, even if they have no such expectations with respect to any of the information or data constituting that whole. This quantitative approach to evaluating and protecting Fourth Amendment rights is certainly novel and raises serious conceptual, doctrinal, and practical challenges. In other works, we have met these challenges by engaging in a careful analysis of this “mosaic theory” and by proposing that courts focus …

The Case For Online Obscurity, Woodrow Hartzog, Frederic Stutzman

Faculty Scholarship

On the Internet, obscure information has a minimal risk of being discovered or understood by unintended recipients. Empirical research demonstrates that Internet users rely on obscurity perhaps more than anything else to protect their privacy. Yet, online obscurity has been largely ignored by courts and lawmakers. In this Article, we argue that obscurity is a critical component of online privacy, but it has not been embraced by courts and lawmakers because it has never been adequately defined or conceptualized. This lack of definition has resulted in the concept of online obscurity being too insubstantial to serve as a helpful guide …

The Fight To Frame Privacy, Woodrow Hartzog

Faculty Scholarship

The resolution of a debate often hinges on how the problem being debated is presented. In psychology and related disciplines, this method of issue presentation is known as framing. Framing theory holds that even small changes in the presentation of an issue or event can produce significant changes of opinion. Framing has become increasingly important in discussions about privacy and security. In his new book, "Nothing to Hide: The False Tradeoff Between Privacy and Security," Daniel Solove argues that if we continue to view privacy and security as diametrically opposed to each other, privacy will always lose. Solove argues that …

Social Data, Woodrow Hartzog

Faculty Scholarship

As online social media grow, it is increasingly important to distinguish between the different threats to privacy that arise from the conversion of our social interactions into data. One well-recognized threat is from the robust concentrations of electronic information aggregated into colossal databases. Yet much of this same information is also consumed socially and dispersed through a user interface to hundreds, if not thousands, of peer users.

In order to distinguish relationally shared information from the threat of the electronic database, this essay identifies the massive amounts of personal information shared via the user interface of social technologies as “social …

Obscurity By Design, Woodrow Hartzog, Frederic D. Stutzman

Faculty Scholarship

Design-based solutions to confront technological privacy threats are becoming popular with regulators. However, these promising solutions have left the full potential of design untapped. With respect to online communication technologies, design-based solutions for privacy remain incomplete because they have yet to successfully address the trickiest aspect of the Internet — social interaction. This Article posits that privacy-protection strategies such as “Privacy by Design” face unique challenges with regard to social software and social technology due to their interactional nature.

This Article proposes that design-based solutions for social technologies benefit from increased attention to user interaction, with a focus on the …

Addressing The Harm Of Total Surveillance: A Reply To Professor Neil Richards, Danielle K. Citron, David Gray

Faculty Scholarship

In his insightful article, "The Dangers of Surveillance," 126 Harvard Law Review 1934 (2013), Neil Richards offers a framework for evaluating the implications of government surveillance programs that is centered on protecting "intellectual privacy." Although we share his interest in recognizing and protecting privacy as a condition of personal and intellectual development, we worry in this essay that, as an organizing principle for policy, "intellectual privacy" is too narrow and politically fraught. Drawing on other work; we, therefore, recommend that judges, legislators, and executives focus, instead, on limiting the potential of surveillance technologies to effect programs of broad and indiscriminate …

The Justices And News Judgment: The Supreme Court As News Editor, Amy Gajda

Faculty Scholarship

No abstract provided.

Quasi-Property: Like, But Not Quite Property, Shyamkrishna Balganesh

Faculty Scholarship

Quasi-property interests refer to situations in which the law seeks to simulate the idea of exclusion, normally associated with property rights, through a relational liability regime, by focusing on the nature and circumstances of the interaction in question, which is thought to merit a highly circumscribed form of exclusion. In this Article, I unpack the analytical and normative bases of quasi-property interests, examine the primary triggering events that cause courts to invoke the category, and respond to potential objections to the recognition of quasi-property as an independent category of interests in the law.