Privacy Law Commons^™

National Telecommunications And Information Administration: Comments From Researchers At Boston University And The University Of Chicago, Ran Canetti, Aloni Cohen, Chris Conley, Mark Crovella, Stacey Dogan, Marco Gaboardi, Woodrow Hartzog, Rory Van Loo, Christopher Robertson, Katharine B. Silbaugh

Faculty Scholarship

These comments were composed by an interdisciplinary group of legal, computer science, and data science faculty and researchers at Boston University and the University of Chicago. This group collaborates on research projects that grapple with the legal, policy, and ethical implications of the use of algorithms and digital innovation in general, and more specifically regarding the use of online platforms, machine learning algorithms for classification, prediction, and decision making, and generative AI. Specific areas of expertise include the functionality and impact of recommendation systems; the development of Privacy Enhancing Technologies (PETs) and their relationship to privacy and data security laws; …

Femtechnodystopia, Leah R. Fowler, Michael Ulrich

Faculty Scholarship

Reproductive rights, as we have long understood them, are dead. But at the same time history seems to be moving backward, technology moves relentlessly forward. Femtech products, a category of consumer technology addressing an array of “female” health needs, seem poised to fill gaps created by states and stakeholders eager to limit birth control and abortion access and increase pregnancy surveillance and fetal rights. Period and fertility tracking applications could supplement or replace other contraception. Early digital alerts to missed periods can improve the chances of obtaining a legal abortion in states with ever-shrinking windows of availability or prompt behavioral …

Digital Privacy For Reproductive Choice In The Post-Roe Era, Aziz Z. Huq, Rebecca Wexler

Faculty Scholarship

The overruling of Roe v. Wade has unleashed a torrent of regulatory and punitive activity restricting previously lawful reproductive options. But the turn to the expansive criminal law and new schemes of civil liability creates novel concerns, quite distinct from the pre-Roe landscape a half-century ago. Reproductive choice, and its nemesis, turn upon information. For pregnant people, deciding on a choice of medical care entails a search for advice and services. Information is at a pre­mium for them. Meanwhile, efforts to regulate abortion began with clinic closings. But they will quickly extend to civil actions and criminal indictments of patients, …

Understanding Dark Patterns In Home Iot Devices, Monica Kowalczyk, Johanna Gunawan, David Choffnes, Daniel J. Dubois, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Internet-of-Things (IoT) devices are ubiquitous, but little attention has been paid to how they may incorporate dark patterns despite consumer protections and privacy concerns arising from their unique access to intimate spaces and always-on capabilities. This paper conducts a systematic investigation of dark patterns in 57 popular, diverse smart home devices. We update manual interaction and annotation methods for the IoT context, then analyze dark pattern frequency across device types, manufacturers, and interaction modalities. We find that dark patterns are pervasive in IoT experiences, but manifest in diverse ways across device traits. Speakers, doorbells, and camera devices contain the most …

Black Lives Monitored, Chaz Arnett

Faculty Scholarship

The police killing of George Floyd added fuel to the simmering flames of racial injustice in America following a string of similarly violent executions during a global pandemic that disproportionately ravaged the health and economic security of Black families and communities. The confluence of these painful realities exposed deep vulnerabilities and renewed a reckoning with the long unfulfilled promise of racial equality, inspiring large-scale protests around the country and across the globe. As with prior movements for racial justice, from slavery abolition to the civil rights movement’s demand to end Jim Crow, protests have been met with extreme force, either …

Life, Liberty, And Data Privacy: The Global Cloud, The Criminally Accused, And Executive Versus Judicial Compulsory Process Powers, Rebecca Wexler

Faculty Scholarship

U.S. policymakers’ responses to a wave of global data privacy laws are creating a deep structural unfairness in the criminal legal system. In an era of cloud computing, when data about communications and activities occurring anywhere in the world can be stored on servers located anywhere else, access to such data can make the difference between convictions and acquittals. At the same time, new global data privacy laws risk cutting off cross-border access to digital evidence in criminal investigations. Recognizing the threat to law enforcement interests, U.S. policymakers enacted the CLOUD Act of 2018 to create special procedures for law …

Minding Rights: Mapping Ethical And Legal Foundations Of ‘Neurorights’, Sjors Ligthart, Marcello Ienca, Gerben Meynen, Fruzsina Molnar-Gabor, Roberto Andorno, Christoph Bublitz, Paul Catley, Lisa Claydon, Thomas Douglas, Nita A. Farahany, Joseph J. Fins, Sara Goering, Pim Haselager, Fabrice Jotterand, Andrea Lavazza, Allan Mccay, Abel Wajnerman Paz, Stephen Rainey, Jesper Ryberg, Philipp Kellmeyer

Faculty Scholarship

The rise of neurotechnologies, especially in combination with artificial intelligence (AI)-based methods for brain data analytics, has given rise to concerns around the protection of mental privacy, mental integrity and cognitive liberty – often framed as “neurorights” in ethical, legal, and policy discussions. Several states are now looking at including neurorights into their constitutional legal frameworks, and international institutions and organizations, such as UNESCO and the Council of Europe, are taking an active interest in developing international policy and governance guidelines on this issue. However, in many discussions of neurorights the philosophical assumptions, ethical frames of reference and legal interpretation …

A Scientific Approach To Tech Accountability, David Choffnes, Woodrow Hartzog, Scott Jordan, Athina Markopoulou, Zubair Shafiq

Faculty Scholarship

The Federal Trade Commission can only do so much to hold tech companies accountable. Enforcement agencies and the people they protect need help. One problem is that the inner workings of large organizations and complex algorithmically driven systems remain obscure and opaque while their privacy representations are voluminous and vague. In this Essay, we propose a scientific approach to tech accountability, where academic researchers can play a larger role in privacy policy. This approach involves surfacing a company’s privacy representations and statements, as well as measuring the actual behavior of their systems with respect to algorithms, user interfaces, and data …

A Concrete Proposal For Data Loyalty, Neil Richards, Woodrow Hartzog, Jordan Francis

Faculty Scholarship

Congress and state legislators are finally experimenting with new privacy frameworks, rights, and duties to move past the thoroughly critiqued “notice and choice” model for data privacy. While many new privacy proposals seek a more fortified version of the fair information practices, some legislators have placed a duty of data loyalty at the heart of their proposed privacy bills. This is important because a duty of data loyalty has the potential to anchor American privacy law in a way analogous to how the European Union approach is grounded in fundamental rights of privacy and data protection.

Unfortunately, there remains some …

Content Moderation As Surveillance, Hannah Bloch-Wehba

Faculty Scholarship

Technology platforms are the new governments, and content moderation is the new law, or so goes a common refrain. As platforms increasingly turn toward new, automated mechanisms of enforcing their rules, the apparent power of the private sector seems only to grow. Yet beneath the surface lies a web of complex relationships between public and private authorities that call into question whether platforms truly possess such unilateral power. Law enforcement and police are exerting influence over platform content rules, giving governments a louder voice in supposedly “private” decisions. At the same time, law enforcement avails itself of the affordances of …

Data Privacy In The Time Of Plague, Cason Schmit, Brian N. Larson, Hye-Chung Kum

Faculty Scholarship

Data privacy is a life-or-death matter for public health. Beginning in late fall 2019, two series of events unfolded, one everyone talked about and one hardly anyone noticed: The greatest world-health crisis in at least 100 years, the COVID-19 pandemic; and the development of the Personal Data Protection Act Committee by the Uniform Law Commissioners (ULC) in the United States. By July 2021, each of these stories had reached a turning point. In the developed, Western world, most people who wanted to receive the vaccine against COVID- 19 could do so. Meanwhile, the ULC adopted the Uniform Personal Data Protection …

Four Privacy Stories And Two Hard Cases, A Comment On Skinner-Thompson's Privacy At The Margins, Jessica Silbey

Faculty Scholarship

Scott Skinner-Thompson's new book, Privacy at the Margins, is what I would call a "fourth-generation" study of privacy law. Privacy's contours and justifications have been debated over the course of the twentieth century, first to establish it as a matter deserving legal protection (roughly the first half of the twentieth century), ² then to iterate its various common law and constitutional variations (starting in the 1960s), ³ and since the computer and internet revolution of the 1990s, to reevaluate privacy's growing importance but waning presence in the digitally-networked age.⁴ The third-generation of privacy scholarship has been a fast-growing area …

Should Data Drive Private Law?, Christoph Busch, Catalina Goanta, Katarzyna Kryla-Cudna, Monika Leszczynska, Vanessa Mak

Faculty Scholarship

This special issue tackles the question of whether and how data shapes private law. The development of new technologies enabled the generation, collection and processing of both personal and non-personal data on an unprecedented scale. The implications

of this phenomenon for private law are threefold. One, how does data affect our understanding of technology regulation in private law relationships? Two, how does data affect the way in which private law is applied? Three, what is the role of data in the design of law from a public policy perspective that transcends doctrinal considerations relating to private law?

Anonymous Companies, William J. Moon

Faculty Scholarship

Hardly a day goes by without hearing about nefarious activities facilitated by anonymous “shell” companies. Often described as menaces to the financial system, the creation of business entities with no real operations in sun-drenched offshore jurisdictions offering “zero percent” tax rates remains in vogue among business titans, pop stars, multimillionaires, and royals. The trending headlines and academic accounts, however, have paid insufficient attention to the legal uses of anonymous companies that are both ubiquitous and almost infinite in their variations.

This Article identifies privacy as a functional feature of modern business entities by documenting the hidden virtues of anonymous companies—business …

Verification Dilemmas In Law And The Promise Of Zero-Knowledge Proofs, Kenneth A. Bamberger, Ron Canetti, Shafi Goldwasser, Evan J. Zimmerman

Faculty Scholarship

Individuals who wish to access a website or qualify for a loan are expected to expose personally identifying information, undermining their privacy and security. Firms share proprietary information in dealmaking negotiations which, if the deal fails, may be used by the negotiating partner for a competitive advantage. Regulators are expected to disclose their algorithmic tools to comply with public transparency and oversight requirements, a practice that risks rendering these tools circumventable and ineffective. Litigants might have to reveal trade secrets in court proceedings to prove a claim or defense. Such “verification dilemmas” — costly choices between opportunities that require the …

A World Without Roe: The Constitutional Future Of Unwanted Pregnancy, Julie Suk

Faculty Scholarship

With the demise of Roe v. Wade, the survival of abortion access in America will depend on new legal paths. In the same moment that Dobbs v. Jackson Women’s Health Organization has constrained access to abortion in the United States, other constitutional democracies have moved in the opposite direction, expanding access to safe, legal, and free abortions. They have done so without reasoning from Roe’s vision of the private zone of unwanted pregnancy. The development of abortion law outside the United States provides critical insights that can inform future efforts to vindicate the constitutional rights of women facing unwanted pregnancies. …

Privacy Pretexts, Rory Van Loo

Faculty Scholarship

Data privacy’s ethos lies in protecting the individual from institutions. Increasingly, however, institutions are deploying privacy arguments in ways that harm individuals. Platforms like Amazon, Facebook, and Google wall off information from competitors in the name of privacy. Financial institutions under investigation justify withholding files from the Consumer Financial Protection Bureau by saying they must protect sensitive customer data. In these and other ways, the private sector is exploiting privacy to avoid competition and accountability. This Article highlights the breadth of privacy pretexts and uncovers their moral structure. Like most pretexts, there is an element of truth to the claims. …

Legislating Data Loyalty, Woodrow Hartzog, Neil Richards

Faculty Scholarship

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

The Surprising Virtues Of Data Loyalty, Woodrow Hartzog, Neil M. Richards

Faculty Scholarship

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

A Comparative Study Of Dark Patterns Across Mobile And Web Modalities, Johanna Gunawan, Amogh Pradeep, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Dark patterns are user interface elements that can influence a person's behavior against their intentions or best interests. Prior work identified these patterns in websites and mobile apps, but little is known about how the design of platforms might impact dark pattern manifestations and related human vulnerabilities. In this paper, we conduct a comparative study of mobile application, mobile browser, and web browser versions of 105 popular services to investigate variations in dark patterns across modalities. We perform manual tests, identify dark patterns in each service, and examine how they persist or differ by modality. Our findings show that while …

Data Autonomy, Cesare Fracassi, William Magnuson

Faculty Scholarship

In recent years, “data privacy” has vaulted to the forefront of public attention. Scholars, policymakers, and the media have, nearly in unison, decried the lack of data privacy in the modern world. In response, they have put forth various proposals to remedy the situation, from the imposition of fiduciary obligations on technology platforms to the creation of rights to be forgotten for individuals. All these proposals, however, share one essential assumption: we must raise greater protective barriers around data. As a scholar of corporate finance and a scholar of corporate law, respectively, we find this assumption problematic. Data, after all, …

Dysregulating The Media: Digital Redlining, Privacy Erosion, And The Unintentional Deregulation Of American Media, Jon M. Garon

Faculty Scholarship

Netflix, Amazon, YouTube, and Apple have been joined by Disney+, Twitch, Facebook, and others to supplant the broadcast industry. As the FCC, FTC, and other regulators struggle, a new digital divide has emerged. The current regulatory regime for television is built upon the government’s right to manage over-the-air broadcasting. As content producers shift away from broadcast and cable, much of the government’s regulatory control will end, resulting in new consequences for public policy and new challenges involving privacy, advertising, and antitrust law. Despite the technological change, there are compelling government interests in a healthy media environment. This article explores the …

Charles Reich And The Legal History Of Privacy, Sarah Seo

Faculty Scholarship

Historians’ interest in Reich offers a case study of the relationship between historical and legal studies. What can legal scholars learn from historians, and what can historians learn from legal scholarship? This Essay will explore these two questions by focusing on Igo’s The Known Citizen since she encountered Reich not with the dual citizenship of a legal historian but as an intellectual historian. I will first highlight what legal scholars can learn from historians by summarizing the main arguments in The Known Citizen. Then, I will provide an alternative legal account to Igo’s history of privacy, which may clear …

Privacy Asymmetries: Access To Data In Criminal Defense Investigations, Rebecca Wexler

Faculty Scholarship

This Article introduces the phenomenon of “privacy asymmetries,” which are privacy statutes that permit courts to order disclosures of sensitive information when requested by law enforcement but not when requested by criminal defense counsel. In the U.S. adversarial criminal legal system, defense counsel are the sole actors tasked with investigating evidence of innocence. Law enforcement has no constitutional, statutory, or formal ethical duty to seek out evidence of innocence. Therefore, statutes that selectively suppress defense investigations selectively suppress evidence of innocence. Privacy asymmetries form a recurring, albeit previously unrecognized, pattern in privacy statutes. They likely arise from legislative oversight and …

Stealing (Identity) From The Poor, Sara S. Greene

Faculty Scholarship

The law of data breaches is new, dynamic, and evolving. The number and complexity of breaches increases each year and legal scholars, courts, and policymakers scramble to respond. In 2019, 14.4 million consumers became victims of identity theft, the most problematic consequence of data breaches for consumers. Indeed, one-third of all Americans have experienced identity theft at some point in their lives. Yet despite low-income groups comprising at least thirty percent of all identity theft victims, existing discourse and debate on the regulatory regime governing data breaches and identity theft primarily reflects the experiences and concerns of middle- and high-income …

Privacy As Privilege: The Stored Communications Act And Internet Evidence, Rebecca Wexler

Faculty Scholarship

This Article exposes a profound and growing injustice that major technology companies have propagated through every level of the judiciary under the guise of protecting data privacy. The Supreme Court has repeatedly proclaimed: “In our judicial system, the public has a right to every [person’s] evidence.” Yet, for over a decade, Facebook, GitHub, Google, Instagram, Microsoft, and Twitter have leveraged the Stored Communications Act (SCA) — a key data privacy law for the internet — to bar criminal defendants from subpoenaing the contents of another’s online communications, even when those communications could exonerate the wrongfully accused. Every appellate court to …

"Slack" In The Data Age, Shu-Yi Oei, Diane M. Ring

Faculty Scholarship

This Article examines how increasingly ubiquitous data and information affect the role of “slack” in the law. Slack is the informal latitude to break the law without sanction. Pockets of slack exist for various reasons, including information imperfections, enforcement resource constraints, deliberate nonenforcement of problematic laws, politics, biases, and luck. Slack is important in allowing flexibility and forbearance in the legal system, but it also risks enabling selective and uneven enforcement. Increasingly available data is now upending slack, causing it to contract and exacerbating the risks of unfair enforcement.

This Article delineates the various contexts in which slack arises and …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

The Case Of The Nosy Neighbors, Johanna Gunawan, Woodrow Hartzog

Faculty Scholarship

Inspired by companies like Clearview AI, Nextdoor, and Amazon, this case study asks students to assume the role of a high-ranking ethics-focused employee at a (fictional) neighborhood-focused social media company. It involves challenging ethical questions around how social media services and surveillance tools are built and used, and the complicated relationship between companies, their users, and law enforcement authorities. Students should pay particular attention to the values implicated by certain design decisions, and the competing incentives for corporations that might complicate the picture for ethical decision making.

The Covid-19 Pandemic And The Technology Trust Gap, Johanna Gunawan, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Industry and government tried to use information technologies to respond to the COVID-19 pandemic, but using the internet as a tool for disease surveillance, public health messaging, and testing logistics turned out to be a disappointment. Why weren’t these efforts more effective? This Essay argues that industry and government efforts to leverage technology were doomed to fail because tech platforms have failed over the past few decades to make their tools trustworthy, and lawmakers have done little to hold these companies accountable. People cannot trust the interfaces they interact with, the devices they use, and the systems that power tech …