Privacy Law Commons^™

Democratic Legitimacy And Data Governance: Data Privacy Philosophy And Regulatory Preferences In The U.S. Vs Eu, Mia H. Truong

Student Scholar Symposium Abstracts and Posters

The rapid expansion of artificial intelligence and large-scale data collection has intensified tensions between commercial innovation and consumer privacy, raising a fundamental democratic question: do Americans understand their data protections–and does this shape their demand for regulation? The EU and U.S. represent two fundamentally opposed approaches to data privacy regulation: the EU's General Data Protection Regulation (GDPR) treats personal data as a fundamental human right, rooted in post-WWII constitutional protections against state surveillance and authoritarianism, while the U.S. operates through fragmented, sector-specific state laws that treat personal data as a market commodity. This study is the first to empirically investigate …

Confidentiality Of Ai Conversations: Protecting Self-Represented Litigants Who Use Chatgpt For Legal Advice, Anoo D. Vyas

Duke Law & Technology Review

When a layperson uses ChatGPT to obtain feedback on a legal matter, attorney-client privilege may not apply, as ChatGPT is not a lawyer, much less a human. Further, while lawyers are entitled to protection for their opinion work-product, it is not clear whether self-represented litigants are entitled to the same protection. Additionally, the broader duty of confidentiality binds only attorneys, not AI systems like ChatGPT. The public increasingly uses AI tools such as ChatGPT. If a layperson employs ChatGPT for legal advice, particularly in a civil matter, such communications may be discoverable and potentially admissible. This presents an access to …

Cognitive Warfare: Generative Ai, False Realities, And International Humanitarian Law, Gary Corn

Joint PIJIP/TLS Research Paper Series

This paper, written as a draft chapter for the Lieber Institute for Law and Land Warfare's forthcoming book on International Law and Artificial Intelligence in Armed Conflict: The AI-Cyber Interplay, explores the IHL implications of a specific subfield or category of AI—Generative AI (GenAI). This new and rapidly evolving technology does not merely analyze or classify data; it also generates original image, audio, and video content. This synthetic content can be highly deceptive and manipulative, as in the case of so-called “deepfakes.” Combined with other information and communications technologies (ICT) and AI capabilities, GenAI has the potential to drastically transform …

Social Media’S Death Toll: Who Should Be Held Liable?, Sara Fradi

Seattle Journal of Technology, Environmental, & Innovation Law

No abstract provided.

The Privacy Law Jigsaw: Piecing Together Legal Compliance When Pieces Don’T Fit, Roy Wyman, Wesley Mcculloch

Vanderbilt Journal of Entertainment & Technology Law

Over the past six years the United States has shifted from a relatively stable and laissez-faire privacy regime, anchored by a few, sector-specific federal statutes such as the Health Insurance Portability and Accountability Act, to an increasingly fragmented landscape dominated by numerous state-level consumer privacy laws. While these laws share commonalities, they also vary in important ways. This Article analyzes that patchwork legal regime and its impact on businesses through four points of friction: (i) statutory applicability and thresholds; (ii) notice-and-choice requirements; (iii) individual data-management rights; and (iv) controller–processor contracting obligations. This Article further explores how modern service-delivery models, especially …

The Stored Communications Act At 40: Re-Examining Ecs And Rcs In The Age Of Ai, Shanzay Pervaiz

Joint PIJIP/TLS Research Paper Series

Shanzay Pervaiz, Senior Legal Researcher, examines the Stored Communications Act (SCA) almost forty years after its enactment, focusing on how its core definitions of “electronic communication service” (ECS) and “remote computing service” (RCS) play a central role in regulating domestic and global government access to data. The definitions still shape key U.S. authorities such as FISA Section 702, the CLOUD Act, and international instruments governing law enforcement access to data, including the Budapest Convention and the United Nations Convention on Cybercrime. The paper also looks at the legislative history of the SCA, how U.S. courts define ECS and RCS, and …

Democratizing Health Data: A Legal Framework For Privacy-Preserving, Government-Led Ai Collaboration, Nicole Nigri

Cybaris®

No abstract provided.

Against Ai Half Measures, Woodrow Hartzog, Neil Richards, Ryan Durrie, Jordan Francis

Faculty Scholarship

So far, U.S. consumer protection policy for artificial intelligence (AI) accountability has largely consisted of industry-led approaches such as encouraging transparency, mitigating bias, promoting principles of ethics, and empowering people. These approaches are vital, but they are only half measures. To bring AI within the rule of law, lawmakers must start drawing substantive lines.

In this Article, we identify four AI regulatory approaches to consumer, data, and democratic harms as half measures. First, transparency does not produce accountability on its own. Second, while mitigating bias in AI systems is critical, even unbiased systems are a threat to the vulnerable. Third, …

Data As Policy, Janet Freilich, W. Nicholson Price Ii

Faculty Scholarship

A large literature on regulation highlights the many different methods of policy-making: command-and-control rulemaking, informational disclosures, tort liability, taxes, and more. But the literature overlooks a powerful method to achieve policy objectives: data. The state can provide (or suppress) data as a regulatory tool to solve policy problems. For administrations with expansive views of government’s purpose, government-provided data can serve as infrastructure for innovation and push innovation in socially desirable directions; for administrations with deregulatory ambitions, suppressing or choosing not to collect data can reduce regulatory power or serve as a back-door mechanism to subvert statutory or common law rules. …

Can Ai, As Such, Invade Your Privacy? An Experimental Study Of The Social Element Of Surveillance, Aileen Nielsen

Indiana Law Journal

The increasing use of AI rather than human surveillance puts pressure on two long-used cultural and (sometimes) legal distinctions: as between human and machine observers and as between content and metadata. Machines do more and more watching through advancing technology, rendering AI a plausible replacement for humans in surveillance tasks. Further, machines can commit to surveil only certain forms of information in a way that humans cannot, rendering the distinction between content and metadata increasingly relevant too for crafting privacy law and policy. Yet despite the increasing importance of these distinctions, their legal importance remains in four key domains of …

Data Portability Revisited: Toward The Human-Centric, Ai-Driven Data Ecosystems Of Tomorrow, Mark Fenwick Professor Of International Business Law, Michael Fertik Managing Partner, Paulius Jurcys Senior Lecturer, Timo Minssen Professor Of Law

Vanderbilt Journal of Entertainment & Technology Law

This Article critically examines the contemporary regulatory framework and discourse surrounding data portability in the United States. Using recent regulatory developments in the European Union as an illustration, this Article suggests that although data access and portability are identified as vital issues in multiple policy instruments, in its current iteration, at least, legal conceptions of portability continue to reinforce the interests of service providers and data controller enterprises rather than individual end users. This Article argues that a paradigm shift toward a more human-centric data approach to data governance must occur, under which data would be recognized as fundamental to …

Deepfakes And Shallow Laws: Regulating Distorted Narratives In The Political Cyberspace, Shimona Mohan, Sarthak Wadhwa

Indian Journal of Law and Technology

With a sizable section of the global population witnessing electoral churn, protests, and resistance movements in the past couple of years, this is clearly a watershed moment for modern democracies vis-à-vis technological advancements. Electoral canvassing in these democracies has expanded its footprint in the digital space, be it through social media or navigating the general contours of anonymity, engagement, and misinformation that govern our online worlds. In this context, the advent of deepfakes in the recent past, and the exponential evolution of the technology both for outreach and disruption, has invited acute regulatory attention and intervention. However, traditional policy design …

The Perils And Promises Of Artificial Intelligence In Criminal Sentencing, Tasnimul Hassan Md

Indian Journal of Law and Technology

The proliferation of technology has resulted in an increased reliance of individuals on technological devices. The world is progressively being automated using Artificial Intelligence (AI) systems that are implemented to achieve specific objectives. Automation is now an important part of people’s lives, and it could heavily change the criminal justice system. This article looks at the use of AI in criminal sentencing in India, arguing that AI-based sentencing can reduce sentencing disparity, either if it is subject to a human element or it is fed with ample data that no case-fact is left out. The paper argues that since AI …

The Ai Doppelgänger Dilemma: Cloned Voices In The Music Industry, Elizabeth Shields

Seattle University Law Review Online

With the rise of generative artificial intelligence (AI), there has been an influx of “voice clones”—deep-learning algorithms that create synthetic speech to realistically mimic human voices. Celebrities and, in particular, music artists, have been subjected to the proliferation of AI voice clones on social media platforms like TikTok and streaming platforms such as Spotify. Despite music utilizing AI voice clones having amassed much popularity, this technology can be harmful and highly invasive to musicians whose livelihoods often depend on their distinct voices. While legal scholars have attempted to articulate various rights that could protect a person’s voice, individuals are largely …

The Second Life Of Information, Thomas D. Haley

UF Law Faculty Publications

Information permeates every aspect of modern life. It is the price we pay for access to online services and the form in which we embody creative works. Law and policymaking tend to focus on first-order uses and transactions; information for access serves as the paradigmatic example. But information enjoys a robust second life—one that constitutes the true value and power that drives firms’ decisionmaking—as assets. Once aggregated and assetized, the power and risk associated with information increases exponentially.

To explore the implications of information’s second life, this Article introduces the concept of “untethered information.” Assetization depends on severing the connections …

Impacted Stakeholder Participation In Ai And Data Governance, Margot Kaminski, Gianclaudio Malgieri

Publications

Privacy law has long centered on the individual. But we observe a meaningful shift toward group harm and rights. There is growing recognition that data-driven practices, including the development and use of artificial intelligence (AI) systems, affect not just atomized individuals but also their neighborhoods and communities, including and especially situationally vulnerable and historically marginalized groups.

This Article explores a recent shift in both data privacy law and the newly developing law of AI: a turn towards stakeholder participation in the governance of AI and data systems, specifically by impacted groups often though not always representing historically marginalized communities. In …

Artificial Intelligence And Music Mash-Ups: Monetizing An Opt-In Closed Universe Database To Preserve Royalties And Credit For Composer And Sound Recording Rights Holders, Michael M. Epstein

Marquette Law Review

This Article charts the development of an opt-in database of music publishing and sound recording catalogues that would allow music industry stakeholders to profit from those who use artificial intelligence to generate new creative content from existing intellectual property. The database would be a portal to content that rights holders would consent to include in a library made available to the public. The database could be advertiser-supported, allowing for no-cost access by the public, or users could pay for a blanket license or per- search fee. Proceeds from the database would be distributed to rights holders based on the content …

Ai Ethics, Law, And Policy, Pauline Kim, Ryan Durrie

Scholarship@WashULaw

AI technologies promise many benefits, but they can also have significant negative impacts on human health, safety, well-being, and fundamental rights. This chapter explores the different governance tools that have been considered for guiding developments in AI in socially beneficial ways, examining the relevance of ethics, law, and policy. Each of these approaches offer tools to address these concerns; however, each has limitations, and none provides a complete solution in itself. Statements of ethical principles can articulate high-level values and goals to guide behavior but are usually quite vague and difficult to operationalize. They also lack any enforcement mechanism. In …

Artificial Intelligence And The Hipaa Privacy Rule: A Primer, Stacey A. Tovino

Faculty Articles

No abstract provided.

The Great Scrape: The Clash Between Scraping And Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Artificial intelligence (AI) systems depend on massive quantities of data, often gathered by “scraping”—the automated extraction of large amounts of data from the internet. A great deal of scraped data contains people’s personal information. This personal data provides the grist for AI tools such as facial recognition, deep fakes, and generative AI. Although scraping enables web searching, archiving of records, and meaningful scientific research, scraping for AI can also be objectionable and even harmful to individuals and society.

Organizations are scraping at an escalating pace and scale, even though many privacy laws are seemingly incongruous with the practice. In this …

Information Accountability Foundation Names Two Maurer Faculty To Leadership Positions, James Owsley Boyd

Keep Up With the Latest News from the Law School (blog)

he Information Accountability Foundation (IAF) has appointed two Indiana University Maurer School of Law faculty to lead the organization.

Fred H. Cate, a distinguished professor and C. Ben Dutton Professor of Law, was named the nonprofit think tank’s new executive director, while Stan Crosley, an adjunct faculty member and 1994 graduate of the Law School, was appointed chief policy strategist.

Founded in 2013, the IAF works with global regulators and industry executives to promote organizational accountability, data stewardship, and data ethics. Its mission is to help regulators and responsible companies better understand the challenges around Artificial Intelligence and data governance …

Can Federated Learning Solve Ai’S Data Privacy Problem?: A Legal Analysis, Warren B. Chik, Florian Gamper

Research Collection Yong Pung How School Of Law

Federated learning (FL) is a method of training AI systems on different datasets without sharing data. The promise of FL is to enable AI systems to be trained on data, including personal data, while preserving data privacy and confidentiality, and thus, inter alia, facilitate compliance with data protection legislation. FL has generated a considerable interest amongst the computer science community, yet there is a dearth of legal analysis of FL. This is a problem because the question of whether FL facilitates compliance with data protection legislation is a legal question. This article will fill this lacuna by providing a comprehensive …

Regulating Algorithmic Harms, Sylvia Lu

Law & Economics Working Papers

In recent years, the rapid expansion of artificial intelligence (AI) innovations has led to a rise in algorithmic harms—harms emerging from AI operations that pose significant threats to civil rights and democratic values in today’s technological landscape. A facial recognition system for improving criminal detection wrongly collected sensitive personal data and flagged racial minorities as shoplifters. A risk-prediction algorithm adopted to identify patients denied medical treatment to Black individuals with poor health conditions. A social media algorithm intended to boost social engagement exacerbated addictive behavior and mental illness in teenagers. These harms are becoming increasingly ubiquitous yet often manifest in …

Understanding The Line Between Art And Abuse: How Generative Ai Changes The Landscape Of Child Sexual Abuse Materials, Amy Trivison

Catholic University Journal of Law and Technology

No abstract provided.

Ai, New Technologies, And Corporate Governance: Three Phenomena, Martin Petrin

Seattle University Law Review

Artificial intelligence (AI) and other new technologies are increasingly influencing the operations, business models, and structures of companies. This Article focuses on three emerging phenomena that impact significant aspects of corporate governance and regulation: (1) perforation and blurring of firm boundaries through the ubiquitous use of externally provided AI services; (2) businesses engaging in strategic access and leveraging of critical resources held by third parties without owning them; and (3) the unusual hybrid role of online platforms between market facilitators and markets themselves. The Article explores how these phenomena challenge traditional views of firms as separate units, with technology leading …

Satellites Crash, Laws Clash: A Legal Framework For The Imminent Space Debris Catastrophe, Michael Conklin

Catholic University Journal of Law and Technology

No abstract provided.

Constructing Ai Speech, Margot E. Kaminski, Meg Leta Jones

Publications

Artificial Intelligence (AI) systems such as ChatGPT can now produce convincingly human speech, at scale. It is tempting to ask whether such AI-generated content “disrupts” the law. That, we claim, is the wrong question. It characterizes the law as inherently reactive, rather than proactive, and fails to reveal how what may look like “disruption” in one area of the law is business as usual in another. We challenge the prevailing notion that technology inherently disrupts law, proposing instead that law and technology co-construct each other in a dynamic interplay reflective of societal priorities and political power. This Essay instead deploys …

Individualized Ideological Enclosures: The Generative Ai Crisis And How Consumers Can Reclaim Their Feeds, Sydney Rose

Catholic University Journal of Law and Technology

No abstract provided.

Kafka In The Age Of Ai And The Futility Of Privacy As Control, Daniel Solove, Woodrow Hartzog

Faculty Scholarship

Despite writing more than a century ago, Franz Kafka captured the core problem of digital technologies—how individuals are rendered powerless and vulnerable. Over the past fifty years, and especially in the twenty-first century, privacy laws have been sprouting up around the world. These laws are often based heavily on an Individual Control Model that aims to empower individuals with rights to help them control the collection, use, and disclosure of their data.

In this Article, we argue that although Kafka starkly shows us the plight of the disempowered individual, his work also paradoxically suggests that empowering the individual isn’t the …

Two Ai Truths And A Lie, Woodrow Hartzog

Faculty Scholarship

Industry will take everything it can in developing Artificial Intelligence (AI) systems. We will get used to it. This will be done for our benefit. Two of these things are true and one of them is a lie. It is critical that lawmakers identify them correctly. In this Essay, I argue that no matter how AI systems develop, if lawmakers do not address the dynamics of dangerous extraction, harmful normalization, and adversarial self-dealing, then AI systems will likely be used to do more harm than good.

Given these inevitabilities, lawmakers will need to change their usual approach to regulating technology. …