Privacy Law Commons^™

Workplace Monitoring Platforms Are Sharing Your Data: An Investigation & Roadmap To Address Data Abuses, Stephanie T. Nguyen, Levi Kaplan, David Choffnes, Alan Mislove, Seth Frotman, Erie Meyer

Center for Law and the Economy

This report investigates the data collection practices of nine widely used workplace monitoring platforms to determine the extent to which they track and analyze employee activity, behavior, or performance during work, including how these platforms transmit worker information and to which third-parties. This report finds that (1) nine out of nine workplace monitoring platforms studied directly shared identifying worker data to third parties, (2) nine out of nine workplace monitoring platforms studied shared information about workers’ online activities with third parties, and (3) three out of nine workplace monitoring platforms studied utilize features to track workers’ precise location. This report …

Cognitive Warfare: Generative Ai, False Realities, And International Humanitarian Law, Gary Corn

Joint PIJIP/TLS Research Paper Series

This paper, written as a draft chapter for the Lieber Institute for Law and Land Warfare's forthcoming book on International Law and Artificial Intelligence in Armed Conflict: The AI-Cyber Interplay, explores the IHL implications of a specific subfield or category of AI—Generative AI (GenAI). This new and rapidly evolving technology does not merely analyze or classify data; it also generates original image, audio, and video content. This synthetic content can be highly deceptive and manipulative, as in the case of so-called “deepfakes.” Combined with other information and communications technologies (ICT) and AI capabilities, GenAI has the potential to drastically transform …

Restricting Data Flows Is A Sign Of Weakness, Nikolas Guggenberger

Seattle University Law Review

There has been a seismic shift in American attitudes toward the free flow of data across borders.  In less than a decade, the United States has transitioned from condemning barriers to digital trade to constructing a digital fortress of its own. It passed legislation requiring TikTok’s parent company to divest its U.S. operations or face a nationwide ban affecting 170 million U.S. users, citing national security concerns about its ties to China and the potential for data surveillance and content manipulation. Upon legal challenge by TikTok on First Amendment grounds, the Supreme Court affirmed the ban’s constitutionality. Recent federal legislation …

Data Rights For Workers, Pauline Kim, Rachel Leavitt

Scholarship@WashULaw

Workers are subject to immense amounts of data collection on the job, and the algorithmic management tools built with that data can produce negative effects, including deskilling jobs, unstable work hours, reduced wages, and dangerous and degrading working conditions. Workers thus have significant interests how their data are collected and used, and yet they have been excluded from nearly all the recently enacted or proposed data protection laws. Their exclusion stems from data protection’s roots in privacy law and theory, which primarily focused on consumers as data subjects. Current data protection laws, even if expanded to cover workers, would provide …

Corporate Law's Duty Of Data Loyalty, Andy Serwin, Neil Richards, Woodrow Hartzog, Ryan Durrie

Faculty Scholarship

Privacy law used to be a relatively tidy field, involving a few interesting but discrete topics like press disclosures of private facts, wiretapping, and the processing of personal data by internet companies. But as the digital revolution continues to disrupt area after area of human activity and software “is eating the world,” the core concerns of privacy law such as “when is it appropriate to process personal data?” have similarly entered field after field. Today, most fields of law, including discrimination law, antitrust, and international law, have found it necessary to reckon with the questions of informational harm and power …

Data As Policy, Janet Freilich, W. Nicholson Price Ii

Faculty Scholarship

A large literature on regulation highlights the many different methods of policy-making: command-and-control rulemaking, informational disclosures, tort liability, taxes, and more. But the literature overlooks a powerful method to achieve policy objectives: data. The state can provide (or suppress) data as a regulatory tool to solve policy problems. For administrations with expansive views of government’s purpose, government-provided data can serve as infrastructure for innovation and push innovation in socially desirable directions; for administrations with deregulatory ambitions, suppressing or choosing not to collect data can reduce regulatory power or serve as a back-door mechanism to subvert statutory or common law rules. …

Are You The Sum Of Your Data? Appropriation Of Digital Persona As Appropriation Of Likeness, Lyrissa Barnett Lidsky

UF Law Faculty Publications

A review of Zahra Takhshid's article, Data as Likeness, 112 Geo. L. J. 1161 (2024).

Data Advantage And Merger Review: Can Entrenchment Theory Reform Antitrust Enforcement?, Shin-Ru Cheng

Seattle University Law Review

A merger involving giant digital companies is likely to dampen competition, as it allows those companies to combine and control data access, enabling them to entrench their dominant positions in relevant markets and extend those positions into related markets. While competition law in many jurisdictions aims to prohibit mergers that may substantially lessen competition or create a monopoly, arguably the review of digital mergers is failing because antitrust agencies lack an effective approach to identify data-generated anticompetitive harms. This Article demonstrates that entrenchment theory, recently reintroduced in the 2023 U.S. Merger Guidelines, would help reform the process of antitrust enforcement. …

"Data Science For Digital Privacy: A Practical Guide For Non-Technical Audiences", Kayla Ahrndt

SPARK Symposium Presentations

As companies increasingly rely on consumer data for personalization and profit, the need for stronger user protections, security measures, and transparency in data practices grows. Legal frameworks must be continuously re-evaluated and updated to ensure accountability, while individuals must be equipped with the knowledge to make informed decisions about their digital presence. However, personal data privacy education remains widely inaccessible due to the technical language and the effort required to navigate complex policies. This project, presented in both zine and blog formats, addresses this gap by providing clear, actionable, and accessible recommendations for data privacy and personal cybersecurity. As an …

The Power Of Procedure: Uncovering The Gap In U.S. Privacy Rights, Bernard Chao, Mandi Abbott

Pepperdine Law Review

As Congress faces increasing pressure to adopt comprehensive privacy legislation, this Article seeks to contribute to the ongoing discussions by exploring critical procedural deficiencies in U.S. privacy laws and their implications for domestic privacy rights and international data flows. This Article makes several key contributions to the field. First, it uses a comparative law perspective to highlight the lack of robust procedural rights and remedies in U.S. privacy law. Second, while many have questioned whether the Court of Jus tice for the European Union will strike down the latest U.S.-EU Data Privacy Framework (the primary mechanism for allowing the transatlantic …

Brokered Violence: Safety For Sale In The Free Marketplace Of Data, Sam Adler, Thomas E. Kadri, Chinmayi Sharma

Popular Media

This article exposes how the unregulated data broker industry fuels violence by selling detailed personal information gathered from public records, social media, and private sources. Drawing on the Minnesota assassinations and other cases, it shows how such data enables stalking, harassment, and targeted attacks. The piece critiques state and federal laws like California’s DELETE Act and New Jersey’s Daniel’s Law for leaving victims to navigate slow, fragmented removal processes. It proposes a centralized victim registry with rapid compliance requirements, shifting responsibility to brokers. Finally, it challenges the industry’s First Amendment defense, urging legal reforms that prioritize public safety over commercial …

“Digital Integrity”: Defending The Judicial Integrity In The Digital Age, Guy Alon, Doron Menashe, Guy Itzhak Sender

Touro Law Review

Recent revelations have shown that the protection of the Fourth Amendment in the digital age is inadequate. Despite well-known exclusionary rules regarding evidence obtained by illegal search and seizure, current trends in the digital age and the law of evidence resulted in courts that tend to include such evidence, and by doing so, create significant risk of both substantive and procedural errors and hence increase the potential for wrongful convictions. To address the matter and try to empower and modernize the protection given by the Fourth Amendment, this article suggests performing a revolution in the law of evidence in the …

Data Injustice In Global Justice, Asaf Lubin, Cherry Tang

Articles by Maurer Faculty

In May 2020, the United Nations Secretary-General unveiled a sweeping “Data Strategy for Action by Everyone, Everywhere,” seeking to unlock the UN’s “full data potential.” The International Criminal Court’s Office of the Prosecutor followed suit, declaring in 2023 its intent to acquire advanced cyber forensic tools so as to hold the “widest range of digital evidence globally.” Across international institutions, data-driven governance has become the norm, with humanitarian agencies and tribunals transforming into “data hubs and information clearinghouses.” This Article critiques the unfettered datafication of global justice by international courts and organizations. These entities have aggressively expanded their data-driven operations …

Taxation Of Information And The Data Revolution, Yariv Brauner

UF Law Faculty Publications

Existing and universal income tax rules are inherently incompatible with an economy in which information-based transactions play a significant role. This Article contends that income taxation is incapable of taxing information effectively. It goes on to argue that this incapability currently necessitates reform, and it offers three viable paths to such reform: consumption taxation, data taxes, and formulary taxation. The Article concludes that formulary taxation is currently the most desirable and plausible path to effective reform, owing to its promise to best stabilize and maintain the legitimacy of the international tax regime.

Redefining The Injury-In-Fact: Treating Personally Identifying Information As Bailed Property, Austin Headrick

Georgia Law Review

There is a long-existing circuit split among federal courts of appeals as to whether an individual has standing under Article III of the United States Constitution when their personally identifying information (PII) is stolen from an entity to which they entrusted it such as a hospital or bank. Federal courts disagree as to whether an individual whose PII has been stolen—without more—has suffered an injury-in-fact, a necessary element of standing. The disagreement between the courts centers on whether the injury-in-fact has already occurred at the time the PII is stolen or whether the injury occurs once the PII has been …

Wearable Ai, Bystander Notice, And The Question Of Privacy Frictions, Zahra Takhshid

Sturm College of Law: Faculty Scholarship

With the rapid advancement of Artificial Intelligence (“AI”) technology and the widespread availability of large language models (“LLMs”), wearable AI devices and designs for new hardware have surged like never before. While wearable AI was traditionally marketed for health and fitness purposes, many of the emerging products are multifunctional. These features can jeopardize the privacy of bystanders in addition to the consumers. Product designers are thus facing a dilemma: ensuring third-party privacy or guaranteeing convenience and a user-friendly design. This Article argues for mandating “privacy frictions” to function as both bystander notice and consent for wearable AI devices with audiovisual …

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Brokered Abuse, Thomas E. Kadri

Scholarly Works

This chapter examines how data brokers, companies that collect, sell, and trade personal information, enable and intensify interpersonal abuse. The article analyzes the data brokerage industry’s role in undermining personal obscurity, the relative safety that comes from being difficult to find or understand, and explores how current laws not only fail to address these harms but can make them worse. The chapter argues that existing privacy regimes, particularly those requiring victims to request data removal from individual brokers, impose psychological burdens and can retraumatize victims.

Data In Business & Society, Tabrez Y. Ebrahim

Lewis & Clark Law Review

Data, it is sometimes said, is the world’s new oil. Unlike the days when information was transmitted in print form, data is transmitted at the touch of a fingertip through the click of a mouse or a push of an icon on a phone app. Algorithms and computing systems have drastically expanded the scope, speed, and volume of access and use of data for consumers. Additionally, businesses, in variety of forms, including business-to-business, business-to-consumer, online, and even brick-and-mortar, have employed data to interact with other businesses and with consumers. Data has drastically expanded in use throughout business and society, and …

Against Engagement, Neil Richards, Woodrow Hartzog

Faculty Scholarship

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet

Our goal in this Article is to isolate …

Safeguarding Taxpayer Data, Michael Hatfield

Articles

The Internal Revenue Service (IRS) collects more information on more individuals than any other government agency. The information is not only financial but personal, potentially including information about health care needs and decisions; the caregivers, disabilities, and foreign birth of children; the educational progress and felony convictions of students; and one’s religious and charitable associations. In acknowledging the vast quantity of information held by the IRS, and the necessity of taxpayers trusting tax administrators with their information, Congress provided greater protection for taxpayer information under the Internal Revenue Code (IRC) than it was provided under the Privacy Act. Congress obligated …

Black Lives Monitored, Chaz Arnett

Faculty Scholarship

The police killing of George Floyd added fuel to the simmering flames of racial injustice in America following a string of similarly violent executions during a global pandemic that disproportionately ravaged the health and economic security of Black families and communities. The confluence of these painful realities exposed deep vulnerabilities and renewed a reckoning with the long unfulfilled promise of racial equality, inspiring large-scale protests around the country and across the globe. As with prior movements for racial justice, from slavery abolition to the civil rights movement’s demand to end Jim Crow, protests have been met with extreme force, either …

Children's Digital Privacy And The Case Against Parental Consent, Zahra Takhshid

Sturm College of Law: Faculty Scholarship

Children’s engagement with the internet has exploded. From education to social media, companies have offered products and services that --far from being mere distractions for children -- have increasingly become necessities. This necessity is most keenly felt in the EdTech world. As companies rely on the verifiable parental consent required by the Children’s Online Privacy Protection Act (“COPPA”) to collect and use minors’ data, reviewing boilerplate waivers of liability and consent forms for children’s online activities have thus become part of parenting. This article argues that under the common law tradition of protecting the best interest of the child, when …

“Statistics Are Human Beings With The Tears Wiped Away”: Utilizing Data To Develop Strategies To Reduce The Number Of Native Americans Who Go Missing, Lori Mcpherson, Sarah Blazucki

Seattle University Law Review

On New Year’s Eve night, 2019, sixteen-year-old Selena Shelley Faye Not Afraid attended a party in Billings, Montana, about fifty miles west of her home in Hardin, Montana, near the Crow Reservation. A junior at the local high school, she was active in her community. The party carried over until the next day, and she caught a ride back toward home with friends in a van the following afternoon. When the van stopped at an interstate rest stop, Selena got out but never made it back to the van. The friends reported her missing to the police and indicated they …

Passcodes, Protection, And Legal Practicality: The Necessity Of A Digital Fifth Amendment, Ethan Swierczewski

Catholic University Journal of Law and Technology

No abstract provided.

Data Property, James Grimmelmann, Christina Mulligan

American University Law Review

In this, the Information Age, people and businesses depend on data. From your family photos to Google’s search index, data has become one of society’s most important resources. But there is a gaping hole in the law’s treatment of data. If someone destroys your car, they have committed the tort of conversion, and the law gives a remedy. But if someone deletes your data, it is far from clear that they have done you a legally actionable wrong. If you are lucky, and the data was stored on your own computer, you may be able to sue them for trespass …

Illusory Privacy, Thomas Haley

Indiana Law Journal

For decades, regulators, consumer advocates, and privacy theorists have grappled with one of privacy’s most important questions: how to protect private information that consumers unwittingly give away with the click of an “I accept” button. Reform efforts remain mired in a morass of text, focusing on the increasing volume and complexity of firms’ terms of service and privacy policies. This Article moves beyond such existing approaches. By analyzing terms of service and privacy policies from hundreds of top websites—which this Article calls “platform terms”—this Article demonstrates that the prevailing “notice and consent” paradigm of privacy regulation cannot provide meaningful protection. …

Legislating Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

The Surprising Virtues Of Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

The New Bailments, Danielle D'Onfro

Scholarship@WashULaw

The rise of cloud computing has dramatically changed how consumers and firms store their belongings. Property that owners once managed directly now exists primarily on infrastructure maintained by intermediaries. Consumers entrust their photos to Apple instead of scrapbooks; businesses put their documents on Amazon’s servers instead of in file cabinets; seemingly everything runs in the cloud. Were these belongings tangible, the relationship between owner and intermediary would be governed by the common-law doctrine of bailment. Bailments are mandatory relationships formed when one party entrusts their property to another. Within this relationship, the bailees owe the bailors a duty of care …