Privacy Law Commons^™

The Privacy Law Jigsaw: Piecing Together Legal Compliance When Pieces Don’T Fit, Roy Wyman, Wesley Mcculloch

Vanderbilt Journal of Entertainment & Technology Law

Over the past six years the United States has shifted from a relatively stable and laissez-faire privacy regime, anchored by a few, sector-specific federal statutes such as the Health Insurance Portability and Accountability Act, to an increasingly fragmented landscape dominated by numerous state-level consumer privacy laws. While these laws share commonalities, they also vary in important ways. This Article analyzes that patchwork legal regime and its impact on businesses through four points of friction: (i) statutory applicability and thresholds; (ii) notice-and-choice requirements; (iii) individual data-management rights; and (iv) controller–processor contracting obligations. This Article further explores how modern service-delivery models, especially …

De-Identified And Unregulated: How Data Brokers Outpace State Privacy Laws, Hannah Moore

Vanderbilt Journal of Entertainment & Technology Law

State consumer privacy laws, though increasingly important in the absence of a comprehensive federal privacy framework, fail to effectively regulate the practices of data brokers who exploit de-identified data. Laws like the Tennessee Information Protection Act (TIPA) exempt de-identified data from key protections, leaving significant gaps in oversight.

While the Health Insurance Portability and Accountability Act (HIPAA) establishes standards for de-identification, advanced analytics and linkage techniques employed by data brokers render this data increasingly susceptible to re-identification. The Federal Trade Commission (FTC) has taken steps to address these risks, but its limited authority highlights the need for comprehensive solutions.

This …

Data Portability Revisited: Toward The Human-Centric, Ai-Driven Data Ecosystems Of Tomorrow, Mark Fenwick Professor Of International Business Law, Michael Fertik Managing Partner, Paulius Jurcys Senior Lecturer, Timo Minssen Professor Of Law

Vanderbilt Journal of Entertainment & Technology Law

This Article critically examines the contemporary regulatory framework and discourse surrounding data portability in the United States. Using recent regulatory developments in the European Union as an illustration, this Article suggests that although data access and portability are identified as vital issues in multiple policy instruments, in its current iteration, at least, legal conceptions of portability continue to reinforce the interests of service providers and data controller enterprises rather than individual end users. This Article argues that a paradigm shift toward a more human-centric data approach to data governance must occur, under which data would be recognized as fundamental to …

Dangerous Digital Standing: Applying Spokeo And Transunion To Online Privacy Harms, Michael E. Ten Eyck

Vanderbilt Journal of Entertainment & Technology Law

In recent years, the California Invasion of Privacy Act (CIPA) has been used to sue website-holding companies for utilizing chat bots that record online conversations. Such claims have already generated high-profile class actions and multidistrict litigations, with many more expected. Because CIPA violations often occur writ large when websites retain data from their chat boxes, and the statute imposes relatively high damages, there exists an incentive for plaintiffs’ attorneys to seek out aggregated claims, generating time-consuming litigation. Meanwhile, the harms suffered by those bringing suit fall under the category of intangible privacy harms. The US Court of Appeals for the …

Breaking The Fourth's Wall: The Implications Of Remote Education For Students' Fourth Amendment Rights, Sallie Hatfield

Vanderbilt Journal of Entertainment & Technology Law

As the COVID-19 pandemic forced both public K-12 and higher education institutions to transition to exclusively provide remote education, students’ homes and personal lives were exposed to the government like never before. Zoom classes and remote proctoring were suddenly the norm. Students and their families scrambled to create appropriate offices and classroom spaces in their homes, and many awkward and invasive scenarios soon followed. While many may have been harmlessly captured on camera, like classes that witness a student’s family eating lunch in the background or a dog on the couch, even these harmless instances have insidious implications for the …

The Data Trust Solution To Data Sharing Problems, Kimberly A. Houser, John W. Bagby

Vanderbilt Journal of Entertainment & Technology Law

A small number of large companies hold most of the world’s data. Once in the hands of these companies, data subjects have little control over the use and sharing of their data. Additionally, this data is not generally available to small and medium enterprises or organizations who seek to use it for social good. A number of solutions have been proposed to limit Big Tech “power,” including antitrust actions and stricter privacy laws, but these measures are not likely to address both the oversharing and under-sharing of personal data. Although the data trust concept is being actively explored in the …

Influencing “Kidfluencing”: Protecting Children By Limiting The Right To Profit From “Sharenting”, Charlotte Yates

Vanderbilt Journal of Entertainment & Technology Law

Statistics on children’s digital presences are staggering, with an overwhelming majority of children having unique digital identities by age two. The phenomenon of “sharenting” (parents sharing content of their children on social media) can start as early as a sonogram photo or a birth video and evolve into parent-run Instagram and TikTok accounts soon after. Content is often intimate, sometimes embarrassing, and frequently shared without children’s consent. Sharenting poses a myriad of risks to children including identity theft, digital kidnapping, exposure to child predators, emotional trauma, and social isolation. In the face of such significant risks to children’s well-being, one …

Big Brother Is Scanning: The Widespread Implementation Of Alpr Technology In America’S Police Forces, Yash Dattani

Vanderbilt Journal of Entertainment & Technology Law

Automatic License Plate Readers (ALPRs) are an increasingly popular tool in police departments across the United States. At its core, ALPR technology functions in a relatively simple manner. The technology has two major components: the actual scanners, which record license plates, and the databases which collect, compile, and analyze this information for officers to access at the click of a button. Although this technology first came to the United States in 1998 as a form of rudimentary border security, its purpose and capabilities have rapidly grown. Now, in 2022, ALPR has evolved into a frighteningly powerful piece of technology, potentially …

Putting Cano On Ice – A Path Forward For Border Searches Of Electronic Devices, Davis Price Shugrue

Vanderbilt Journal of Entertainment & Technology Law

Across the country, circuit courts disagree over what level of suspicion, if any, is required for border officials to search electronic devices. This leaves law enforcement agencies in the lurch because they must craft nationwide policies that cover jurisdictions with differing rules. The Supreme Court should bring this quandary to an end by holding that no reasonable suspicion or warrant is required for border searches of electronic devices. Many scholars and litigants have called for a reasonable suspicion or warrant requirement in light of Supreme Court decisions like Riley and Carpenter that recognize the privacy concerns raised by searches of …

Envisioning The Ftc As A Facilitator Of Blockchain Technology Adoption In The Direct-To-Consumer Genetic Testing Industry, Noah Spector

Vanderbilt Journal of Entertainment & Technology Law

Seemingly overnight, the kingpins of the direct-to-consumer genetic testing (DTC-GT) industry shifted their focus from exploring their customers’ DNA to commodifying it. Companies like Ancestry or 23andMe that were once exclusively known as mere sources of “infotainment” now regularly sell consenting customers’ genetic data to pharmaceutical researchers or use it to develop drugs of their own. To gain these customers’ consent, both firms employ a series of long, complex clickwrap contracts that largely fail to apprise their readers of the potential risks of sharing their genetic data. Nor do these agreements provide any form of compensation to those consumers whose …

Privacy Beyond Possession: Solving The Access Conundrum In Digital Dollars, Nerenda N. Atako

Vanderbilt Journal of Entertainment & Technology Law

The advent of a retail central bank digital currency (CBDC) could reshape the US payments system. A retail CBDC would be a digital representation of the US dollar in the form of an account or token that is widely accessible to the general public. It would be a third form of US fiat money that is created and issued by the Federal Reserve and complementary to physical cash. CBDC proposals have suggested a myriad of retail CBDC design models with an overwhelming interest in a retail CBDC that either implements a centralized ledger system or some form of a distributed …

Regulating Data Breaches: A Data Superfund Statute, Kyle Mckibbin

Vanderbilt Journal of Entertainment & Technology Law

Collecting and processing large amounts of personal data has become a fundamental feature of the modern economy. Personal data, combined with good data analytics, are valuable to businesses as they can provide highly detailed information about individual preferences and behaviors. This data collection can also be valuable to the consumer as it generates innovative products and digital platforms. The era of big data promises great rewards, but it is not without its costs. Data breaches, or the release of personal data into unwanted hands, are pervasive and increasingly massive in scale. Despite the personal privacy harm caused by data breaches, …

Watching Androids Dream Of Electric Sheep: Immersive Technology, Biometric Psychography, And The Law, Brittan Heller

Vanderbilt Journal of Entertainment & Technology Law

Virtual reality and augmented reality present exceedingly complex privacy issues because of the enhanced user experience and reality-based models. Unlike the issues presented by traditional gaming and social media, immersive technology poses inherent risks, which our legal understanding of biometrics and online harassment is simply not prepared to address. This Article offers five important contributions to this emerging space. It begins by introducing a new area of legal and policy inquiry raised by immersive technology called “biometric psychography.” Second, it explains how immersive technology works to a legal audience and defines concepts that are essential to understanding the risks that …

The Law Of The Tetrapods, Henry T. Greely

Vanderbilt Journal of Entertainment & Technology Law

Should there be such a thing as "Technology Law"? This Article explores that question in two ways. It first looks at four substantive issues that appear across many different areas of technology law: privacy, security, property, and responsibility. It then examines five questions that frequently recur about how to regulate very different new technologies. These questions include which agency should regulate, whether regulation should focus on before or after marketing, what jurisdiction should regulate, how relevant new information will be gained and used, and how-politically-good regulation can be enacted. This Article concludes that it may make sense to develop a …

Commercial Clicks: Advertising Algorithms As Commercial Speech, Kerri A. Thompson

Vanderbilt Journal of Entertainment & Technology Law

Congressional hearings have finally called for the "right regulation" of social media platforms. The First Amendment, however, has shielded internet companies from regulation since the birth of social media. Even if Congress enacts legislation now, internet companies will be able to defend against the "wrong regulation" by claiming the regulation unconstitutionally limits their freedom of speech. This Article uses Facebook's advertising algorithms as a case study of how Congress can properly regulate Facebook by analyzing the advertising algorithms as commercial speech, which receives less protection under First Amendment jurisprudence. In doing so, Congress can protect the strong public interest in …

The States Have Spoken: Allow Expanded Media Coverage Of The Federal Courts, Mitchell T. Galloway

Vanderbilt Journal of Entertainment & Technology Law

Since the advent of film and video recording, society has enjoyed the ability to capture the lights and sounds of moments in history. This innovation left courts to determine what place, if any, such technology should have inside the courtroom. Refusing to constrain the future capacity of this technology, the Supreme Court "punted" on this issue until a time when this technology evolved past its initial disruptive nature. Throughout the past forty-five years, the vast majority of state courts have embraced the potential of cameras in the courtroom and have created policies governing such use. In contrast, the federal judiciary …

Confidences Worth Keeping: Rebalancing Legitimate Interests In Litigants' Private Information In An Era Of Open-Access Courts, Jeffrey W. Sheehan

Vanderbilt Journal of Entertainment & Technology Law

The ideal of the public trial in open court continues to guide decisions about public access to courts and their records, even as cases are increasingly decided "on the papers." This is still the case when those "papers" take the form of electronic documents that can be uploaded, downloaded, copied, and distributed by anyone with an internet connection. A series of opinions from the US Court of Appeals for the Sixth Circuit reinforcing this ideal of public access to court records and unsealing district court filings offers an opening to reconsider core values that must inform our treatment of private …

Keeping It Off The Record: Student Social Media Monitoring And The Need For Updated Student Records Laws, Alice Haston

Vanderbilt Journal of Entertainment & Technology Law

An increasing number of school districts work with private companies to monitor public social media and to notify administrators of alarming student information. Although these services help address challenging school safety issues, the Family Educational Rights and Privacy Act (FERPA) and state law offer little guidance on how districts should store student social media data. This Note encourages states to pass student records laws similar to recent California legislation and urges the Department of Education to clarify the relationship between student social media and education records under FERPA. New state and federal initiatives would help ensure that third parties may …

"I Call Alexa To The Stand": The Privacy Implications Of Anthropomorphizing Virtual Assistants Accompanying Smart-Home Technology, Christopher B. Burkett

Vanderbilt Journal of Entertainment & Technology Law

This Note offers a solution to the unique privacy issues posed by the increasingly humanlike interactions users have with virtual assistants, such as Amazon's Alexa, which accompany smart-home technology. These interactions almost certainly result in the users engaging in the cognitive phenomenon of anthropomorphism--more specifically, an assignment of agency. This is a phenomenon that has heretofore been ignored in the legal context, but both the rapidity of technological advancement and inadequacy of current applicable legal doctrine necessitate its consideration now. Since users view these anthropomorphized virtual assistants as persons rather than machines, the law should treat them as such. To …

Differential Privacy: A Primer For A Non-Technical Audience, Alexandra Wood, Micah Altman, Aaron Bembenek, Mark Bun, Marco Gaboardi, James Honaker, Kobbi Nissim, David R. O'Brien, Thomas Steinke, Salil Vadhan

Vanderbilt Journal of Entertainment & Technology Law

Differential privacy is a formal mathematical framework for quantifying and managing privacy risks. It provides provable privacy protection against a wide range of potential attacks, including those currently unforeseen. Differential privacy is primarily studied in the context of the collection, analysis, and release of aggregate statistics. These range from simple statistical estimations, such as averages, to machine learning. Tools for differentially private analysis are now in early stages of implementation and use across a variety of academic,industry, and government settings. Interest in the concept is growing among potential users of the tools, as well as within legal and policy communities, …

A Free Ride: Data Brokers'rent-Seeking Behavior And The Future Of Data Inequality, Krishnamurty Muralidhar, Laura Palk

Vanderbilt Journal of Entertainment & Technology Law

Historically, researchers obtained data from independent studies and government data. However, as public outcry for privacy regarding the government's maintenance of data has increased, the discretionary release of government data has decreased or become so anonymized that its relevance is limited. Research necessarily requires access to complete and accurate data. As such, researchers are turning to data brokers for the same, and often more, data than they can obtain from the government. Data brokers base their products and services on data gathered from a variety of free public sources and via the government-created Internet. Data brokers then recategorize the existing …

Prescriptions At A Price: America's Opioid Crisis And The Increasing Toll On Drug Record Privacy, Reem Blaik

Vanderbilt Journal of Entertainment & Technology Law

How should the US Constitution govern patient privacy in the face of a public health emergency? Declaring the United States' opioid crisis as a public health emergency may put the already-compromised integrity of drug record privacy at higher risk by virtue of emerging administrative responses, existing Supreme Court precedent, and acquiescent state laws. The White House convened a summit on opioids where the then-US attorney general discussed law enforcement responses to the crisis. Although the Fourth Amendment protects against unreasonable searches and seizures, the Supreme Court's third-party doctrine generally grants state and federal actors access to records released to third …

Corporate Cybersecurity: The International Threat To Private Networks And How Regulations Can Mitigate It, Eric J. Hyla

Vanderbilt Journal of Entertainment & Technology Law

Cyberattacks are occurring at an accelerating pace. Foreign nations are increasingly utilizing hacking as a tool for economic gain, acts of aggression, or international political expression. At risk are US consumers'personal data, private firms' bottom line, and the economies'integrity. In response, federal and state lawmakers have issued a series of disparate, uncoordinated policies seeking to strengthen cybersecurity practices. However, recent events indicate that these policies are less than ideal. This Note suggests that a unified response to cybersecurity is required and calls for the establishment of a single, central federal agency with authority over all cybersecurity regulations. Such an agency …

The Use Of Big Data Analytics By The Irs: Efficient Solutions Or The End Of Privacy As We Know It?, Kimberly A. Houser, Debra Sanders

Vanderbilt Journal of Entertainment & Technology Law

This Article examines the privacy issues resulting from the IRS's big data analytics program as well as the potential violations of federal law. Although historically, the IRS chose tax returns to audit based on internal mathematical mistakes or mismatches with third party reports (such as W-2s), the IRS is now engaging in data mining of public and commercial data pools (including social media) and creating highly detailed profiles of taxpayers upon which to run data analytics. This Article argues that current IRS practices, mostly unknown to the general public are violating fair information practices. This lack of transparency and accountability …

Flagging The Middle Ground Of The Right To Be Forgotten: Combatting Old News With Search Engine Flags, Hannah L. Cook

Vanderbilt Journal of Entertainment & Technology Law

Incomplete and outdated news articles present an increasing problem for individuals who find themselves stigmatized on the basis of truthful but misleading reports. This Article proposes a moderate solution between the European right to be forgotten and the protectionless status quo in the United States. It proposes a flagging system, administered through Federal Trade Commission adjudications, where links to articles whose private harms outweigh their public benefits are flagged in the search results of an individual. This flag will help combat psychological biases that may cause decisionmakers to place an irrational weight on these articles while preserving the ability of …

Where Copyright Meets Privacy In The Big Data Era: Access To And Control Over User Data In Agriculture And The Role Of Copyright, Tesh W. Dagne

Vanderbilt Journal of Entertainment & Technology Law

The application of big data in different sectors of the economy and its transformative value has recently attracted considerable attention. However, this transformation, driven by the application of advanced technologies that utilize big data—such as the Internet of Things (IoT), artificial intelligence (AI), and software systems—raises concerns about access to and control over the user data that results from the uptake in using digital technologies. This Article examines the role different legal regimes have in framing access to and control over various forms of user data from the perspective of technology users in the agriculture sector. This Article then goes …

Just What The Doctor Ordered: Protecting Privacy Without Impeding Development Of Digital Pills, Amelia R. Montgomery

Vanderbilt Journal of Entertainment & Technology Law

Using technology, humans are receiving more and more information about the world around them via the Internet of Things, and the next area of connection will be the inside of the human body. Several forms of "digital pills" that send information from places like the human digestive tract or bloodstream are being developed, with a few already in use. These pills could stand to provide information that could drastically improve the lives of many people, but they also have privacy and data security implications that could put consumers at great risk. This Note analyzes these risks and suggests that short-term …

How Smart Is Too Smart?: How Privacy Concerns Threaten Modern Energy Infrastructure, Megan Mclean

Vanderbilt Journal of Entertainment & Technology Law

Smart meters are integral to the health of our electric grid and are critical to a reliable, affordable, and efficient energy economy. Yet, collection of smart meter data is raising privacy concerns that are inspiring pockets of resistance to smart meter installation around the country. The fact that these data, like many other kinds of personal information, can and often do flow to the government should not prevent their collection and use. It is critical for environmental and energy regulators to have access to this data to maximize the potential of our energy system. On the state level, several legislatures …

The Shaky Ground Of The Right To Be Delisted, Miquel Peguera

Vanderbilt Journal of Entertainment & Technology Law

It has long been discussed whether individuals should have a "right to be forgotten" online to suppress old information that could seriously interfere with their privacy and data protection rights. In the landmark case of Google Spain v. Agencia Espafiola de Proteccion de Datos, the Court of Justice of the European Union (CJEU) addressed the particular question of whether, under EU Data Protection Law, individuals have a right to have links delisted from the list of search results in searches made on the basis of their name. It found that they do have this right--which can be best described as …

Who Is Reading Whom Now: Privacy In Education From Books To Moocs, Jules Polonetsky, Omer Tene

Vanderbilt Journal of Entertainment & Technology Law

This Article is the most comprehensive study to date of the policy issues and privacy concerns arising from the surge of ed tech innovation. It surveys the burgeoning market of ed tech solutions, which range from free Android and iPhone apps to comprehensive learning management systems and digitized curricula delivered via the Internet. It discusses the deployment of big data analytics by education institutions to enhance student performance, evaluate teachers, improve education techniques, customize programs, and better leverage scarce resources to optimize education results.

This Article seeks to untangle ed tech privacy concerns from the broader policy debates surrounding standardization, …