Privacy Law Commons^™

The Gdpr: It Came, We Saw, But Did It Conquer?, Leila Javanshir

Seattle University Law Review

On February 1, 2019, the Seattle University Law Review held its annual symposium at the Seattle University School of Law. Each year, the Law Review hosts its symposium on a topic that is timely and meaningful. This year, privacy and data security professionals from around the globe gathered to discuss the current and future effects of the General Data Protection Regulation (GDPR) that was implemented on May 25, 2018. The articles and essays that follow this Foreword are the product of this year’s symposium.

Regulating The Gdpr: Perspectives From The United Kingdom, Hannah Mccausland

Seattle University Law Review

Hannah McCausland leads the international group at the UK Information Commissioner’s Office (ICO). The ICO’s International Engagement functions as the gateway to other data protection and privacy authorities on international matters. She’s involved in the work of the EU European Data Protection Board advising the commissioner and the deputy commissioner on international positioning of the ICO, and she has played a key role over the past six years in the ICO’s strategy on navigating the EU’s data protection framework. Hannah has also played a major role at the global level and advancing the practical tools that data protection and privacy …

Privacy, Freedom, And Technology—Or “How Did We Get Into This Mess?”, Alex Alben

Seattle University Law Review

Can we live in a free society without personal privacy? The question is worth pondering, not only in light of the ongoing debate about government surveillance of private communications, but also because new technologies continue to erode the boundaries of our personal space. This Article examines our loss of freedom in a variety of disparate contexts, all connected by the thread of erosion of personal privacy. In the scenarios explored here, privacy reducing activities vary from government surveillance, personal stalking conducted by individuals, and profiling by data-driven corporations, to political actors manipulating social media platforms. In each case, new technologies …

Confiding In Con Men: U.S. Privacy Law, The Gdpr, And Information Fiduciaries, Lindsey Barrett

Seattle University Law Review

In scope, ambition, and animating philosophy, U.S. privacy law and Europe’s General Data Protection Regulation are almost diametric opposites. The GDPR’s ambitious individual rights, significant prohibitions, substantive enforcement regime, and broad applicability contrast vividly with a scattershot U.S. regime that generally prioritizes facilitating commerce over protecting individuals, and which has created perverse incentives for industry through anemic enforcement of the few meaningful limitations that do exist. A privacy law that characterizes data collectors as information fiduciaries could coalesce with the commercial focus of U.S. law, while emulating the GDPR’s laudable normative objectives and fortifying U.S. consumer privacy law with a …

General Data Protection Regulation (Gdpr): Prioritizing Resources, Jennifer Dumas

Seattle University Law Review

This Article will discuss and analyze the years of preparation for the GDPR and provide recommendations for dealing with the GDPR forevermore. It will assess whether the preparation and panic were worth it. In other words, was the time, expense, and distraction my peers and I expended and experienced over the past years proportionate to the requirements and impact of the GDPR? Further, was the high level of preparation and panic many legal departments in countless companies undertook and experienced appropriate now that we have had a chance to see the initial impact of the GDPR?

Privacy Statements Under The Gdpr, Mike Hintze

Seattle University Law Review

The need to include specific types of information in a privacy statement is a GDPR compliance obligation that does not get as much attention as some other GDPR requirements. Perhaps that is because privacy statements have been much maligned in recent years. They are too long and full of legalese. Nobody reads them. They are part of a notice and consent approach to privacy that puts an unrealistic burden on consumers to make informed choices. But despite these well-known criticisms, the GDPR doubles down on privacy statements. In fact, gauging by the roughly fourfold increase in privacy statement requirements compared …

Requiem For Cyberspace: The Effect Of The European General Privacy Regulation On The Global Internet, Steven Tapia

Seattle University Law Review

The dream of a perpetual, limitless, non-dimensional space is an idea that has transfixed clergy, philosophers, and poets for ages. Whether it is called “heaven,” “the afterlife,” “nirvana,” or another linguistic stand-in, the dream of a dimension beyond the bounds of time, space, and the laws of nature seems as universal as any concept ever. From its initial development in the 1970s (as a military, academic, and governmental experiment in creating a wholly alternative means of communication capable of surviving catastrophic failures of any parts of the communications conduits) until essentially now, the Internet seemed to be the closest incarnate …

Footprints: Privacy For Enterprises, Processors, And Custodians…Oh My!, Blair Witzel, Carrie Mount

Seattle University Law Review

Americans’ interest in privacy—as evidenced by increasing news coverage, online searches, and new legislation—has grown over the past decade. After the European Union enacted the General Data Protection Regulation (GDPR), technologists and legal professionals have focused on primary collectors of data—known under various legal regimes as the “controller” or “custodian.” Thanks to advances in computing, many of these data collectors offload the processing of data to third parties providing data-related cloud services like Amazon, Microsoft, and Google. In addition to the data they have already collected about the data subjects themselves, these companies now “hold” that data on behalf of …

Gdpr Compliance—It Takes A Village, Susy Mendoza

Seattle University Law Review

When the General Data Protection Regulation (GDPR) came into effect in May of 2018, many legal departments were confronted with the gravity of just how they were going to comply with such a wide-reaching law. If you have international customers (both direct to consumer or business to business), it is not hard to convince your general counsel that compliance with the GDPR is a must. You may even be able to get the chief technical officer (CTO) or chief operating officer (COO) onboard just by mentioning the steep fines—two to four percent of worldwide gross revenue. But how does the …

Alexa, Amazon Assistant Or Government Informant?, Julia R. Shackleton Esq.

University of Miami Business Law Review

Alexa, are you listening to me? Technology has become an integral part of one’s everyday life with voice-controlled devices pervading our most intimate interactions and spaces within the home. The answers to our questions are now at our fingertips with the simple roll of the tongue “Alexa,” your very own personal intelligence assistant. This futuristic household tool can perform tasks that range from answering simple voice commands to ordering any online shopping. However, the advent of voice technology presents a myriad of problems. Concerns arise as these new devices live in the privacy of our homes while quietly listening for …

No Means No: An Argument For The Expansion Of Rape Shield Laws To Cases Of Nonconsensual Pornography, Austin Vining

William & Mary Journal of Race, Gender, and Social Justice

This Article considers the impact of a hypothetical nonconsensual pornography victim’s previous sexual history on potential legal remedies, both criminal and civil. Due to jury bias and the difficulty in proving standard elements of many claims, the research shows that such a victim would likely be unsuccessful in court. This Article then turns to two legal concepts from related fields—the incremental harm doctrine and rape shield laws—and considers what effect their application would have on the hypothetical victim’s case. Ultimately, the author presents an argument for the logical expansion of rape shield laws to cases of nonconsensual pornography.

Science And Privacy: Data Protection Laws And Their Impact On Research, Mike Hintze

Washington Journal of Law, Technology & Arts

While privacy laws differ in their scope, focus, and approach, they all involve restrictions on the collection, use, sharing, or retention of information about people. In general, privacy laws reflect a societal consensus that privacy violations can lead to a wide range of financial, reputational, dignitary, and other harms, and that excessive collection and harmful uses of personal information should therefore be constrained. These laws require organizations to comply with a number of obligations concerning personal information. In practice, these requirements can lead organizations to refrain from collecting certain data, only use data with the consent of the individual, or …

Data Re-Use And The Problem Of Group Identity, Leslie Francis, John G. Francis

Utah Law Faculty Scholarship

Reusing existing data sets of health information for public health or medical research has much to recommend it. Much data repurposing in medical or public health research or practice involves information that has been stripped of individual identifiers but some does not. In some cases, there may have been consent to the reuse but in other cases consent may be absent and people may be entirely unaware of how the data about them are being used. Data sets are also being combined and may contain information with very different sources, consent histories, and individual identifiers. Much of the ethical and …

Privacy Remedies, Lauren H. Scholz

Indiana Law Journal

When consumers sue companies for privacy-intrusive practices, they are often unsuccessful. Many cases fail in federal court at the motion to dismiss phase because the plaintiff has not shown the privacy infringement has caused her concrete harm. This is a symptom of a broader issue: the failure of courts and commentators to describe the relationship between privacy rights and privacy remedies.

This Article contends that restitution is the normal measure of privacy remedies. Restitution measures relief by economic gain to the defendant. If a plaintiff can show the likely ability to recover in restitution, that should be sufficient to pass …

Deception, Professional Speech, And Cpcs: On Becerra, Abortion, And The First Amendment, Mark Strasser

Buffalo Law Review

In National Institute of Family & Life Advocates v. Becerra, the United States Supreme Court struck down a California law requiring crisis pregnancy centers to post certain signs.1 The Court implied that the case involved a relatively straightforward example of governmental overreaching, with the government allegedly attempting to commandeer private entities and force them to convey the government’s message.2 Yet, the Court omitted important background information when discussing the state’s implicated interests,3 and the Court’s analyses and rationales may have important First Amendment implications. While the Court may have reached the right result, its analyses bode poorly for a reasoned …

Rights On Publicity As Remarkably Insignificant, R. George Wright

Cleveland State Law Review

This Article introduces the right of publicity through a brief consideration of high-profile cases involving, respectively, Paris Hilton, human cannonball Hugo Zacchini, and the famous actress Olivia de Havilland. With this background understanding, the Article considers the supposed risks to freedom of speech posed by recognizing rights of publicity in a private party. From there, the Article addresses the nagging concern that the publicity rights cases promote a harmful "celebrification" of culture. Finally, the Article considers whether allowing for meaningful damage recoveries in publicity rights cases appropriately compensates victims in ways promoting the broad public interest.

Animal Healthcare Robots: The Case For Privacy Regulation, Sulaf Al-Saif

Washington Journal of Law, Technology & Arts

Animal healthcare robots are a form of healthcare or wellness devices that possess the appearance of animals or pets and that collect data on the user. The appearance, use, and nature of data collected by these robots illustrate two types of devices for which privacy regulation falls short: Internet of Things (“IoT”) devices and healthcare devices. This paper surveys the animal healthcare robots currently in the market, details the special privacy concerns associated with such robots, examines the current state of potentially relevant privacy laws, and makes recommendations for privacy regulation in the future.

Achieving The Goals Of The Value-Based Purchasing Program: Defining A Standard For External Data Use, Svetlana Makoviy

Student Award Winning Papers

In our society, artificial intelligence technology has permeated through every aspect of human life. By the end of 2019, more than 60 million Americans will use some kind of smartwatch, whether a Fitbit or an Apple Watch as a part of their daily routine. Further, over 58% of people currently use a healthcare-related mobile application, such as MyFitnessPal or Nike+ Running. Health and fitness application usage increased by over 330% in the last three years. Unsurprisingly, healthcare-related data is one of the fastest growing and financially valuable data pools in the country, if not worldwide. The volume of data generated …

Cashless Societies And The Rise Of The Independent Cryptocurrencies: How Governments Can Use Privacy Laws To Compete With Independent Cryptocurrencies, Matla Garcia Chavolla

Pace International Law Review

Many individuals (including governments) envision living in a future world where physical currency is a thing of the past. Many countries have made great strides in their efforts to go cashless. At the same time, there is increasing awareness among citizens of the decreasing amount of privacy in their lives. The potential hazards cashless societies pose to financial privacy may incentivize citizens to hold some of their money in independent cryptocurrencies. This article argues that in order for governments in cashless societies to keep firm control over their money supply, they should enact stronger privacy law protections for its citizens …

Bytes Bite: Why Corporate Data Breaches Should Give Standing To Affected Individuals, Caden Hayes

Washington and Lee Journal of Civil Rights and Social Justice

High-profile data hacks are not uncommon. In fact, according to the Privacy Rights Clearinghouse, there have been at least 7,961 data breaches, exposing over 10,000,000,000 accounts in total, since 2005. These shocking numbers are not particularly surprising when taking into account the value of information stolen. For example, cell phone numbers, as exposed in a Yahoo! hack, are worth $10 a piece on the black market, meaning the hackers stood to make $30,000,000,000 from that one hack. That dollar amount does not even consider copies the hackers could make and later resell. Yet while these hackers make astronomical payoffs, the …

Law School News: A Spring Break That Teaches - And Gives Back 03/11/2019, Edward Fitzpatrick

Life of the Law School (1993- )

No abstract provided.

Protecting Users Of Social Media, Margaret Ryznar

Notre Dame Law Review Reflection

Social media platforms started as a fun way to connect with friends and family. Since then, they have become a science fiction nightmare due to their capacity to gather and misuse the data on their users.

It is not irrational for social media providers to seek to capitalize on their data when they provide the platforms for free. Indeed, their business model is to sell data to third parties for marketing and other purposes. Yet, users should be able to expect that their data is not used to hurt them or is not sent to disreputable companies. Indeed, fewer people …

Striking A Balance: Privacy And National Security In Section 702 U.S. Person Queries, Brittany Adams

Washington Law Review

The transformation of U.S. foreign intelligence in recent years has led to increasing privacy concerns. The Foreign Intelligence Surveillance Act of 1978 (FISA) traditionally regulated foreign intelligence surveillance by authorizing warrant-based searches of U.S. and non-U.S. persons. Individualized court orders under traditional FISA were intended to protect U.S. persons and limit the scope of intelligence collection. In a post-9/11 world, however, the intelligence community cited concerns regarding the speed and efficiency of collection under traditional methods. The intelligence and law enforcement communities recognized the “wall” preventing information sharing between the communities as a central failure leading to the 9/11 attacks. …

The Public Information Fallacy, Woodrow Hartzog

Faculty Scholarship

The concept of privacy in “public” information or acts is a perennial topic for debate. It has given privacy law fits. People struggle to reconcile the notion of protecting information that has been made public with traditional accounts of privacy. As a result, successfully labeling information as public often functions as a permission slip for surveillance and personal data practices. It has also given birth to a significant and persistent misconception — that public information is an established and objective concept.

In this article, I argue that the “no privacy in public” justification is misguided because nobody knows what “public” …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

No abstract provided.

Younger Generations Are Infected By Continuous Socialization To Accept Diminished Privacy: A Global Analysis Of How The United States' Constitutional Doctrine Is A Main Contributor To Eroded Privacy, Tiffany Kim

Indiana Journal of Global Legal Studies

Since the nineteenth century, privacy concerns have increased with the growth of technology. The invention of instantaneous photography, coupled with the enlarged presence of press, was met with concerns of degraded privacy. Society has formed expectations of privacy, but as time passes, those expectations continue to diminish. Younger generations have been socialized to accept lessened levels of privacy in this digitalized world of mass data and connectivity.

Individual privacy expectations vary globally. The construction of China's government and culture produces a lesser expectation of individual privacy than that of the United States. As outlined in the U.S. Constitution, U.S. citizens …

Biometric Identification In India Versus The Right To Privacy: Core Constitutional Features, Defining Citizens’ Interests, And The Implications Of Biometric Identification In The United States, Madison Julia Levine

University of Miami Law Review

In 2009, the Indian government introduced a widespread biometric identification system called Aadhaar—a national scheme that issues Indian citizens and residents a unique identification number while collecting and storing their most personal biometric and demographic information. As the Aadhaar system was implemented and promoted in India, widespread concerns grew regarding the storage and protection of such private information. How can Indian citizens enforce and protect their privacy rights? In 2017, the Indian Supreme Court attempted to address this issue by holding that an individual’s right to privacy is an inherent part of the right to life and personal liberty and …

The Privacy Hierarchy: A Comparative Analysis Of The Intimate Privacy Protection Act Vs. The Geolocational Privacy And Surveillance Act, Katherine A. Mitchell

University of Miami Law Review

The advent of the technological boom brought the world smartphones, social media, and Siri. These novel benefits, however, were accompanied by unchartered invasions of privacy. Congress has embarked on the seemingly endless path of protecting its constituents through civil and criminal legislation aimed at combatting such invasions. Two recent examples include the Intimate Privacy Protection Act (“IPPA”) and the Geolocational Privacy and Surveillance Act (“GPS Act”). Nonetheless, the IPPA, which was proposed to criminalize the dissemination of nonconsensual pornography, has garnered much less support—and much more criticism—than its geolocational counterpart.

This Note discusses the striking similarities of both bills, both …

Breaches Within Breaches: The Crossroads Of Erisa Fiduciary Responsibilities And Data Security, Gregg Moran

University of Miami Law Review

Although the drafters of the Employee Retirement Income Security Act of 1974 (“ERISA”) likely could not have anticipated the data security issues of the twenty-first century, ERISA’s duty of prudence almost certainly requires employee benefit plan fiduciaries to protect sensitive participant data in at least some manner. This Article suggests the Department of Labor should issue a regulation clarifying fiduciaries’ data security obligations. Given that fiduciaries are in the best positions to recognize their plans’ individual security needs and capabilities, the regulation should not attempt to micromanage fiduciaries’ substantive data security policies; rather, it should focus on the procedures by …

Rethinking Social Media: An Expert Panel Discussion, Howard M. Squadron Program In Law, Media And Society, Bonavero Institute Of Human Rights, Cardozo Law Moot Court Honor Society

2018–2019 Flyers

This expert panel discussion, moderated by Professor Monroe Price, explored the evolving challenges and regulatory efforts related to social media. Held on Thursday, January 31st, from 6–8pm in the Moot Court Room at Cardozo School of Law, the event addressed pressing issues such as child pornography, cyberstalking, hate speech, terrorist content, and the impact of social media on U.S. elections. Panelists included Robyn Caplan (Data and Society), Jessa Lingel (University of Pennsylvania), and Cardozo Professor Felix Wu, whose work focuses on freedom of expression and cybersecurity. Presented by the Howard M. Squadron Program in Law, Media and Society in partnership …