Privacy Law Commons^™

What Is Privacy? That’S The Wrong Question, Woodrow Hartzog

Faculty Scholarship

Privacy has never had a precise meaning. But in the early 1900s, the concept took on new life as a term of art in legal frameworks. The result has been a bit of a mess, as no singular definition has been adequate for all purposes. Daniel Solove, perhaps the most influential privacy scholar of our day, wrote at the turn of the millennium that privacy was “a concept in disarray.”

In this short essay reflecting upon Solove’s impact on the modern study of information privacy, I argue that the chaos and futility of competing conceptualizations of privacy is why Solove’s …

Privacy In Pandemic: Law, Technology, And Public Health In The Covid-19 Crisis, Tiffany Li

Faculty Scholarship

The COVID-19 pandemic has caused millions of deaths and disastrous consequences around the world, with lasting repercussions for every field of law, including privacy and technology. The unique characteristics of this pandemic have precipitated an increase in use of new technologies, including remote communications platforms, healthcare robots, and medical AI. Public and private actors are using new technologies, like heat sensing, and technologically-influenced programs, like contact tracing, alike in response, leading to a rise in government and corporate surveillance in sectors like healthcare, employment, education, and commerce. Advocates have raised the alarm for privacy and civil liberties violations, but the …

A New Compact For Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Intimate life is under constant surveillance. Firms track people’s periods, hot flashes, abortions, sexual assaults, sex toy use, sexual fantasies, and nude photos. Individuals hardly appreciate the extent of the monitoring, and even if they did, little can be done to curtail it. What is big business for firms is a big risk for individuals. The handling of intimate data undermines the values that sexual privacy secures—autonomy, dignity, intimacy, and equality. It can imperil people’s job, housing, insurance, and other crucial opportunities. More often, women and minorities shoulder a disproportionate amount of the burden.

Privacy law is failing us. Our …

Privacy's Constitutional Moment And The Limits Of Data Protection, Woodrow Hartzog, Neil M. Richards

Faculty Scholarship

America’s privacy bill has come due. Since the dawn of the Internet, Congress has repeatedly failed to build a robust identity for American privacy law. But now both California and the European Union have forced Congress’s hand by passing the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). These data protection frameworks, structured around principles for Fair Information Processing called the “FIPs,” have industry and privacy advocates alike clamoring for a “U.S. GDPR.” States seemed poised to blanket the country with FIP-based laws if Congress fails to act. The United States is thus in the midst …

A Third-Party Doctrine For Digital Metadata, H. Brian Holland

Faculty Scholarship

For more than four decades, the third-party doctrine was understood as a bright-line, categorical rule: there is no legitimate privacy interest in any data that is voluntarily disclosed or conveyed to a third party. But this simple rule has dramatic effects in a world of ubiquitous networked computing, mobile technologies, and the commodification of information. The digital devices that facilitate our daily participation in modern society are connected through automated infrastructures that are designed to generate vast quantities of data, nearly all of which is captured, utilized, and stored by third-party service providers. Under a plain reading of the third-party …

Gdpr And The Importance Of Data To Ai Startups, James Bessen, Stephen Michael Impink, Lydia Reichensperger, Robert Seamans

Faculty Scholarship

What is the impact of the European Union’s General Data Protection Regime (“GDPR”) and data regulation on AI startups? How important is data to AI product development? We study these questions using unique survey data of commercial AI startups. AI startups rely on data for their product development. Given the scale and scope of their business models, these startups are particularly susceptible to policy changes impacting data collection, storage and use. We find that training data and frequent model refreshes are particularly important for AI startups that rely on neural nets and ensemble learning algorithms. We also find that firms …

Data And The Social Obligation Norm Of Property: An Essay In Honor Of Professor Gregory S. Alexander, Christopher K. Odinet

Faculty Scholarship

In the age of the Cambridge Analytica/Facebook scandal and sundry other data breaches at Under Armour, Target, and Best Buy, the issue of security and privacy in consumer data has become increasingly important. For much of the modern era, the development of technology has gone relatively unchecked, with the United States having ceded much of the policymaking terrain to Silicon Valley. This has resulted in the unbridled creation of vast amounts of consumer data. Users who engage with tech platforms generate bits and bytes about themselves based on their activities, preferences, and habits. This information — “data” — is then …

Automation In Moderation, Hannah Bloch-Wehba

Faculty Scholarship

This Article assesses recent efforts to encourage online platforms to use automated means to prevent the dissemination of unlawful online content before it is ever seen or distributed. As lawmakers in Europe and around the world closely scrutinize platforms’ “content moderation” practices, automation and artificial intelligence appear increasingly attractive options for ridding the Internet of many kinds of harmful online content, including defamation, copyright infringement, and terrorist speech. Proponents of these initiatives suggest that requiring platforms to screen user content using automation will promote healthier online discourse and will aid efforts to limit Big Tech’s power.

In fact, however, the …

Race, Surveillance, Resistance, Chaz Arnett

Faculty Scholarship

The increasing capability of surveillance technology in the hands of law enforcement is radically changing the power, size, and depth of the surveillance state. More daily activities are being captured and scrutinized, larger quantities of personal and biometric data are being extracted and analyzed, in what is becoming a deeply intensified and pervasive surveillance society. This reality is particularly troubling for Black communities, as they shoulder a disproportionate share of the burden and harm associated with these powerful surveillance measures, at a time when traditional mechanisms for accountability have grown weaker. These harms include the maintenance of legacies of state …

A Genetic Surveillance State: Are We One Buccal Swab Away From A Total Loss Of Genetic Privacy?, Catherine Arcabascio

Faculty Scholarship

No abstract provided.

Reconsidering Confidential Settlements In The #Metoo Era, Minna J. Kotkin

Faculty Scholarship

No abstract provided.

Bipa: The Most Important Biometric Privacy Law In The Us?, Woodrow Hartzog

Faculty Scholarship

In May 2020, Clearview AI abruptly ended all service contracts with all non-law enforcement entities based in Illinois. The reason? It hoped to avoid an injunction and potentially large damages under one of the most important privacy laws in America: the Illinois Biometric Information Privacy Act (BIPA).

Cyber Mobs, Disinformation, And Death Videos: The Internet As It Is (And As It Should Be), Danielle K. Citron

Faculty Scholarship

Fiction and visual representations can alter our understanding of human experiences and struggles. They help us understand human frailties and suffering in a visceral way. Nick Drnaso’s graphic novel Sabrina does that in spades. In Sabrina, a woman is murdered by a misogynist, and a video of her execution is leaked. Conspiracy theorists deem her murder a hoax. A cyber mob smears the woman’s loved ones as crisis actors, posts death threats, and spreads their personal information. The attacks continue until a shooting massacre redirects the cyber mob’s wrath to other mourners. Sabrina captures the breathtaking velocity of disinformation online …

The Internet As A Speech Machine And Other Myths Confounding Section 230 Reform, Danielle K. Citron, Mary Anne Franks

Faculty Scholarship

A robust public debate is currently underway about the responsibility of online platforms. We have long called for this discussion, but only recently has it been seriously taken up by legislators and the public. The debate begins with a basic question: should platforms should be responsible for user-generated content? If so, under what circumstances? What exactly would such responsibility look like? Under consideration is Section 230 of the Communications Decency Act—a provision originally designed to encourage tech companies to clean up “offensive” online content. The public discourse around Section 230, however, is riddled with misconceptions. As an initial matter, many …

Deep Fakes: A Looming Challenge For Privacy, Democracy, And National Security, Robert Chesney, Danielle K. Citron

Faculty Scholarship

Harmful lies are nothing new. But the ability to distort reality has taken an exponential leap forward with “deep fake” technology. This capability makes it possible to create audio and video of real people saying and doing things they never said or did. Machine learning techniques are escalating the technology’s sophistication, making deep fakes ever more realistic and increasingly resistant to detection. Deep-fake technology has characteristics that enable rapid and widespread diffusion, putting it into the hands of both sophisticated and unsophisticated actors. While deep-fake technology will bring with it certain benefits, it also will introduce many harms. The marketplace …

Why Sexual Privacy Matters For Trust, Danielle K. Citron

Faculty Scholarship

Every generation’s intimates have their preferred modes of self-disclosure. Not long ago, intimate partners exchanged love letters and mixed tapes. They spent hours on the phone. Today, they text their innermost thoughts, beliefs, and wishes, sometimes with nude photos attached. They engage in sexually-explicit activity via FaceTime and SnapChat.

Now, as then, the success and integrity of intimate relationships depends upon sexual privacy. Intimate relationships develop as partners grow to trust one another to treat their nakedness, deepest secrets, and sexual desires as they hope rather than as they fear. Handling partners’ personal information with discretion lays the foundation for …

The Missing Regulatory State: Monitoring Businesses In An Age Of Surveillance, Rory Van Loo

Faculty Scholarship

An irony of the information age is that the companies responsible for the most extensive surveillance of individuals in history—large platforms such as Amazon, Facebook, and Google—have themselves remained unusually shielded from being monitored by government regulators. But the legal literature on state information acquisition is dominated by the privacy problems of excess collection from individuals, not businesses. There has been little sustained attention to the problem of insufficient information collection from businesses. This Article articulates the administrative state’s normative framework for monitoring businesses and shows how that framework is increasingly in tension with privacy concerns. One emerging complication is …

Mugshots And The Press-Privacy Dilemma, Amy Gajda

Faculty Scholarship

No abstract provided.

Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Those who wish to control, expose, and damage the identities of individuals routinely do so by invading their privacy. People are secretly recorded in bedrooms and public bathrooms and “up their skirts.” Such images are used to coerce people into sharing nude photographs and filming sex acts under the threat of public disclosure. People’s nude images are posted online without permission. Machine-learning technology is used to create digitally manipulated “deep fake” sex videos that swap people’s faces into pornography.

Each of these abuses is an invasion of sexual privacy—the behaviors, expectations, and choices that manage access to and information about …

The Public Information Fallacy, Woodrow Hartzog

Faculty Scholarship

The concept of privacy in “public” information or acts is a perennial topic for debate. It has given privacy law fits. People struggle to reconcile the notion of protecting information that has been made public with traditional accounts of privacy. As a result, successfully labeling information as public often functions as a permission slip for surveillance and personal data practices. It has also given birth to a significant and persistent misconception — that public information is an established and objective concept.

In this article, I argue that the “no privacy in public” justification is misguided because nobody knows what “public” …

Towards A New California Revised Uniform Fiduciary Access To Digital Assets Act, Michael T. Yu

Faculty Scholarship

California enacted the Revised Uniform Fiduciary Access to Digital Assets Act (the California RUFADAA) to govern the disclosure (or nondisclosure) of digital assets when a California resident dies. Digital assets include not just emails and social media accounts but may also include online files and assets, digital currencies, domain names, and blogs. The California RUFADAA ostensibly governs the disclosure of digital assets only when a California resident dies, and it, therefore, does not govern the scenario when a California resident becomes incapacitated and can no longer handle his or her digital assets. This scenario is likely to become more common …

The Value Of Deviance: Understanding Contextual Privacy, Timothy Casey

Faculty Scholarship

Recent decisions by the Supreme Court in Carpenter v. United States and the Illinois Supreme Court in Rosenbach v. Six Flags Entertainment Corporation signal a shift in the traditional understanding of what exactly is protected by a privacy interest. Carpenter distinguished between a police officer’s observation of a suspect’s location and a perpetual catalogue of a person’s movements obtained through cell site location information (CSLI). The pervasive and vast quantity of information from CSLI exposed a protected privacy interest. In Rosenbach, the Illinois Supreme Court found the unique and personal quality of biometric information meant that consent and disclosure requirements …

Global Platform Governance: Private Power In The Shadow Of The State, Hannah Bloch-Wehba

Faculty Scholarship

Online intermediaries—search engines, social media platforms, even e-commerce businesses—are increasingly required to make critical decisions about free expression, individual privacy, and property rights under domestic law. These requirements arise in contexts that include the right to be forgotten, hate speech, “terrorist” speech, and copyright and intellectual property. At the same time, these disputes about online speech are increasingly borderless. Many laws targeting online speech and privacy are explicitly extraterritorial in scope. Even when not, some courts have ruled that they have jurisdiction to enforce compliance on a global scale. And governments are also demanding that platforms remove content—on a global …

Applying Unoccupied Aircraft Systems To Study Human Behavior In Marine Science And Conservation Programs, Michelle B. Nowlin, Stephen E. Roady, Everette Newton, David W. Johnston

Faculty Scholarship

The declining costs of Unoccupied Aircraft Systems (UAS, aka drones), their ease of use, and their ability to collect high resolution data from a variety of sensors has resulted in an explosion of applications across the globe. Scientists working in the marine environment are increasingly using UAS to study a variety of topics, from counting wildlife populations in remote locations to estimating the effects of storms and sea level rise on shorelines. UAS also provide transformative potential to study the ways in which humans interact with and affect marine and coastal ecosystems, but doing so presents unique ethical and legal …

Protecting Consumers In The Age Of The Internet Of Things, Nicole Smith Futrell

Faculty Scholarship

“Wake up, baby!”

Imagine waking up in the middle of the night to the sound of a stranger speaking to your baby through the baby monitor. For one Texas couple, this horror story became reality when a man hacked their internet-connected monitors to watch and stalk their child. In a similarly horrifying scenario, a hacker stalked Miss Teen USA, Cassidy Wolf, for a year via her webcam. The stalker had 24/7 access to her webcam and also traced the keystrokes on her keyboard to learn her passwords for various web accounts. Subsequently, the hacker used private information he learned about …

Informed Trading And Cybersecurity Breaches, Joshua Mitts, Eric L. Talley

Faculty Scholarship

Cybersecurity has become a significant concern in corporate and commercial settings, and for good reason: a threatened or realized cybersecurity breach can materially affect firm value for capital investors. This paper explores whether market arbitrageurs appear systematically to exploit advance knowledge of such vulnerabilities. We make use of a novel data set tracking cybersecurity breach announcements among public companies to study trading patterns in the derivatives market preceding the announcement of a breach. Using a matched sample of unaffected control firms, we find significant trading abnormalities for hacked targets, measured in terms of both open interest and volume. Our results …

When Data Comes Home: Next Steps In International Taxation’S Information Revolution, Shu-Yi Oei, Diane M. Ring

Faculty Scholarship

Over the last decade, there has been a revolution in cross-border tax information exchange and reporting. While this dramatic shift was the product of multiple forces and events, a fundamental reality is that politics, technology, and law intersected to drive the shift to the point where nation-states will now transmit and receive from each other significant ongoing flows of taxpayer information. States can now expect to accumulate large stashes of data on cross-border income, assets, and activities on a scale and level of comprehensiveness unmatched by previous information exchange regimes.

This article examines the pressing follow-up question of how this …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

The Inconsentability Of Facial Surveillance, Evan Selinger, Woodrow Hartzog

Faculty Scholarship

Governments and companies often use consent to justify the use of facial recognition technologies for surveillance. Many proposals for regulating facial recognition technology incorporate consent rules as a way to protect those faces that are being tagged and tracked. But consent is a broken regulatory mechanism for facial surveillance. The individual risks of facial surveillance are impossibly opaque, and our collective autonomy and obscurity interests aren’t captured or served by individual decisions.

In this article, we argue that facial recognition technologies have a massive and likely fatal consent problem. We reconstruct some of Nancy Kim’s fundamental claims in Consentability: Consent …

Byrd V United States: Unauthorized Drivers Of Rental Cars Have Fourth Amendment Rights? Not As Evident As It Seems, Tracey Maclin

Faculty Scholarship

No discerning student of the Supreme Court would contend that Justice Anthony Kennedy broadly interpreted the Fourth Amendment during his thirty years on the Court. His majority opinions in Maryland v. King, Drayton v. United States and his willingness to join the three key sections of Justice Scalia’s opinion in Hudson v. Maryland, which held that suppression is never a remedy for knock-and-announce violations, are just a few examples of Justice Kennedy’s narrow view of the Fourth Amendment.

In light of his previous votes in search and seizure cases, surprisingly Justice Kennedy, in what would be his final Fourth Amendment …