Privacy Law Commons^™

Data Property, James Grimmelmann, Christina Mulligan

American University Law Review

In this, the Information Age, people and businesses depend on data. From your family photos to Google’s search index, data has become one of society’s most important resources. But there is a gaping hole in the law’s treatment of data. If someone destroys your car, they have committed the tort of conversion, and the law gives a remedy. But if someone deletes your data, it is far from clear that they have done you a legally actionable wrong. If you are lucky, and the data was stored on your own computer, you may be able to sue them for trespass …

Not So Private, Stacey A. Tovino

Faculty Articles

Federal and state laws have long attempted to strike a balance between protecting patient privacy and health information confidentiality on the one hand and supporting important uses and disclosures of health information on the other. To this end, many health laws restrict the use and disclosure of identifiable health data but support the use and disclosure of de-identified data. The goal of health data de-identification is to prevent or minimize informational injuries to identifiable data subjects while allowing the production of aggregate statistics that can be used for biomedical and behavioral research, public health initiatives, informed health care decision making, …

The Crimes Of Digital Capitalism, Aitor Jiménez, J.C. Oleson

Mitchell Hamline Law Review

No abstract provided.

The Anomaly That Is Privacy: Data Privacy Concerns Related To The Rise Of Microchip Implants In Humans, Kendra Lobban

Catholic University Journal of Law and Technology

No abstract provided.

Data Transfers After Schrems Ii: The Eu-Us Disagreements Over Data Privacy And National Security, Monika Zalnieriute

Vanderbilt Journal of Transnational Law

In the long-awaited Schrems II decision, the Court of Justice of the European Union (CJEU) took a radical, although not an unexpected, step in invalidating the Privacy Shield Agreement, which facilitated data transfers between the European Union and the United States. Schrems II illuminates long-lasting international disagreements between the EU and the United States over data protection, national security, and the fundamental differences between the public and private approaches to the protection of human rights in the data-driven economy and modern state. This Article approaches the decision via an interdisciplinary lens of international law and international relations and situates it …

Privacy Pretexts, Rory Van Loo

Faculty Scholarship

Data privacy’s ethos lies in protecting the individual from institutions. Increasingly, however, institutions are deploying privacy arguments in ways that harm individuals. Platforms like Amazon, Facebook, and Google wall off information from competitors in the name of privacy. Financial institutions under investigation justify withholding files from the Consumer Financial Protection Bureau by saying they must protect sensitive customer data. In these and other ways, the private sector is exploiting privacy to avoid competition and accountability. This Article highlights the breadth of privacy pretexts and uncovers their moral structure. Like most pretexts, there is an element of truth to the claims. …

Uncertain Terms, Leah R. Fowler, Jim Hawkins, Jessica L. Roberts

Notre Dame Law Review

Health apps collect massive amounts of sensitive consumer data, including information about users’ reproductive lives, mental health, and genetics. As a result, consumers in this industry may shop for privacy terms when they select a product. Yet our research reveals that many digital health tech companies reserve the right to unilaterally amend their terms of service and their privacy policies. This ability to make one-sided changes undermines the market for privacy, leaving users vulnerable. Unfortunately, the current law generally tolerates unilateral amendments, despite fairness and efficiency concerns. We therefore propose legislative, regulatory, and judicial solutions to better protect consumers of …

Note: Facial Recognition Technology And The Constitution, Mark Simonitis

Notre Dame Journal on Emerging Technologies

Over the past several years, we have seen an increase in the adoption and use of facial recognition technology (FRT). Both private corporations and government organizations have increasingly used this technology over the past several years, and law enforcement agencies have been just as eager to utilize FRT in their operations. The potential uses for this technology in a law enforcement capacity are numerous. For example, FRT could be used to identify criminals whose faces were caught on surveillance footage, or it could be used to help identify citizens during border crossings. However, it is easy to imagine how an …

Data Privacy Issues In West Virginia And Beyond: A Comprehensive Overview, Jena Martin

Consumer Law Scholarship

This white paper was commissioned by the Center for Consumer Law and Education, a joint initiative launched by West Virginia University and Marshall University to “coordinate the development of consumer law, policy, and education research to support and serve consumers.”

As such, this paper has a dual purpose. First, it provides a comprehensive overview of the many different legal issues that affect data privacy concerns (both nationally and in West Virginia). Second, it documents and discusses the result of a survey and specific focus groups that were undertaken throughout the fall of 2019 into January 2020 where individuals within the …

Outsourcing The Police: How Reliance On The Private Sector For Law Enforcement Threatens Privacy Legislation Around The World, Karl Colbary

Northwestern Journal of International Law & Business

Data privacy is an increasingly important issue in the world today. People are increasingly aware of, and concerned about, their digital footprint. As a result, many jurisdictions around the world—the United States excluded—have enacted legislation with an eye towards giving their citizens greater control over their data. However, the movement to give individuals greater control over how their data is used by tech providers often overlooks the fact that the government is one of the biggest consumers of the data that tech providers collect. Therefore, data privacy regimes that allow the flow of personal information to the government do not …

Privacy Losses As Wrongful Gains, Bernard Chao

Sturm College of Law: Faculty Scholarship

Perhaps nowhere has the pace of technology placed more pressure on the law than in the area of data privacy. Huge data breaches fill our headlines. Companies often violate their own privacy policies by selling customer data, or by using the information in ways that fall outside their policy. Yet, even when there is indisputable misconduct, the law generally does not hold these companies accountable. That is because traditional legal claims are poorly suited for handling privacy losses.

Contract claims fail when privacy policies are not considered contractual obligations. Misrepresentation claims cannot succeed when customers never read and rely on …

Piercing The Veil: Reconciling Fisa And The State Secrets Privilege In The Schrems Ii Era, Chris Baumohl

American University Law Review

Twenty years after 9/11 and the beginning of the “War on Terror,” access to judicial redress arising out of national security programs remains mired in a labyrinth of procedural hurdles, including the state secrets privilege. Nearly seventy years after the Supreme Court first enunciated the modern state secrets privilege, courts still struggle to articulate a practicable standard that appropriately balances the government’s need to protect its secrets and plaintiffs’ need to vindicate their constitutional rights. This issue is particularly acute in surveillance litigation, where broad construction of the privilege precludes plaintiffs from establishing standing. However, as the Ninth Circuit found …

Developing A Measure Of Social, Ethical, And Legal Content For Intelligent Cognitive Assistants, Clovia Hamilton, William Swart, Gerald M. Stokes

Technology & Society Faculty Publications

We address the issue of consumer privacy against the backdrop of the national priority of maintaining global leadership in artificial intelligence, the ongoing research in Artificial Cognitive Assistants, and the explosive growth in the development and application of Voice Activated Personal Assistants (VAPAs) such as Alexa and Siri, spurred on by the needs and opportunities arising out of the COVID-19 global pandemic. We first review the growth and associated legal issues of the of VAPAs in private homes, banks, healthcare, and education. We then summarize the policy guidelines for the development of VAPAs. Then, we classify these into five major …

Privacy As Privilege: The Stored Communications Act And Internet Evidence, Rebecca Wexler

Faculty Scholarship

This Article exposes a profound and growing injustice that major technology companies have propagated through every level of the judiciary under the guise of protecting data privacy. The Supreme Court has repeatedly proclaimed: “In our judicial system, the public has a right to every [person’s] evidence.” Yet, for over a decade, Facebook, GitHub, Google, Instagram, Microsoft, and Twitter have leveraged the Stored Communications Act (SCA) — a key data privacy law for the internet — to bar criminal defendants from subpoenaing the contents of another’s online communications, even when those communications could exonerate the wrongfully accused. Every appellate court to …

Forging A Path Towards Meaningful Digital Privacy: Data Monetization And The Ccpa, Rebecca Harris

Loyola of Los Angeles Law Review

The California Consumer Privacy Act (CCPA) was passed in response to a number of newsworthy data breaches with widespread impacts, and which revealed how little digital privacy consumers actually have. Despite the large market for consumer data, individual consumers generally do not earn money when their personal data are sold. Further, consumers have very little control over who collects their data, what information is collected, and with whom it is shared. To place control back in the hands of the consumer, affirmative consent should be required to collect and sell consumer’s data, and consumers should have the ability to sell …

U.S.-U.K. Executive Agreement: Case Study Of Incidental Collection Of Data Under The Cloud Act, Eddie B. Kim

Washington Journal of Law, Technology & Arts

In March 2018, Congress passed the Clarifying Lawful Overseas Use of Data Act, also known as the CLOUD Act, in order to expedite the process of cross-border data transfers for the purposes of criminal investigations. The U.S. government entered into its first Executive Agreement, the main tool to achieve the goals of the statute, with the United Kingdom in October 2019. While the CLOUD Act requires the U.S. Attorney General to consider whether the foreign government counterpart has a certain level of robust data privacy laws, the relevant laws of the United Kingdom have generally been questioned numerous times for …

Regulating Personal Data Usage In Covid-19 Control Conditions, Mark Findlay, Nydia Remolina

Centre for AI & Data Governance (2019-2025)

As the COVID-19 health pandemic ebbs and flows world-wide, governments and private companies across the globe are utilising AI-assisted surveillance, reporting, mapping and tracing technologies with the intention of slowing the spread of the virus. These technologies have capacity to amass and share personal data for community control and citizen safety motivations that empower state agencies and inveigle citizen co-operation which could only be imagined outside times of real and present personal danger. While not cavilling with the short-term necessity for these technologies and the data they control, process and share in the health regulation mission (provided that the technology …

What Consumers Don’T Know They’Re Giving Away (Data And Privacy Concerns), Bayleigh Reeves

Marketing Undergraduate Honors Theses

The modern world leverages technology and information captured by it in ways the inventors of these technologies likely never imagined. Phones and other devices are gathering information about consumers in the background when they do not even realize it. Pew Research Center found that about 77% of Americans own a smartphone and 88% use the internet. This mass access to technology and information tracking raises many privacy concerns. Basic demographic information is being tracked as well as more in-depth information like shopping tendencies, financial information, and information about known associates. While most of this data is being used for marketing …

Untangling The Privacy Law Web: Why The California Consumer Privacy Act Furthers The Need For Federal Preemptive Legislation, Jordan Yallen

Loyola of Los Angeles Law Review

No abstract provided.

Ethics, Ai, Mass Data And Pandemic Challenges: Responsible Data Use And Infrastructure Application For Surveillance And Pre-Emptive Tracing Post-Crisis, Mark Findlay, Jia Yuan Loke, Nydia Remolina Leon, Yum Yin, Benjamin (Tan Renyan) Tham

Research Collection Yong Pung How School Of Law

As the COVID-19 health pandemic rages governments and private companies across the globe are utilising AI-assisted surveillance, reporting, mapping and tracing technologies with the intention of slowing the spread of the virus. These technologies have the capacity to amass personal data and share for community control and citizen safety motivations that empower state agencies and inveigle citizen co-operation which could only be imagined outside such times of real and present danger. While not cavilling with the short-term necessity for these technologies and the data they control, process and share in the health regulation mission, this paper argues that this infrastructure …

An Analysis On Biometric Privacy Data Regulation: A Pivot Towards Legislation Which Supports The Individual Consumer's Privacy Rights In Spite Of Corporate Protections, Carla Llaneza

St. Thomas Law Review

This Comment will address the different ways in which biometric data has become an integral part of everyday American life, whether it be through the use of facial recognition for national security or the use of fingerprinting to access an individual’s smartphone. Part II will further discuss how biometric data privacy legislation, specifically as set out in the Biometric Illinois Privacy Act (“BIPA”), has become prominent and will analyze its effects on the legal rights of consumers to bring suit against private entities. Part III will discuss the present solutions available to consumers who fall victim to companies who distribute …

Assumed Compliance, Stacey A. Tovino

Faculty Articles

No abstract provided.

Data Imperialism: The Gdpr's Disastrous Impact On Africa's E-Commerce Markets, Cara Mannion

Vanderbilt Journal of Transnational Law

The European Union (EU) recently passed the General Data Protection Regulation--a sweeping regulatory framework that sets a new global standard for the collection, storage, and use of personal data. To ensure far-reaching compliance with the GDPR, the EU has adopted a strict take-it-or-leave-it approach--countries that wish to engage with digital users in the EU must either comply with the GDPR's expansive data obligations or risk losing access to the world's largest trading block.

This presents significant obstacles for several African nations. Notably, no African country currently has domestic laws that comply with the GDPR. Even if they did, several African …

Comparative Analysis Of Data Breach Laws: Comprehension, Interpretation, And External Sources Of Legislative Text, Carol M. Hayes

Lewis & Clark Law Review

Data breach laws in the United States have evolved in waves during the last couple of decades. There are a few federal laws that address aspects of data security and the aftermath of data breaches, but these laws tend to be narrow or sector-specific. This Article instead focuses on state legislative responses. As of 2018, all 50 states have a data breach law that at least addresses notifications. In this Article, the author presents the results of an empirical examination of the language used in these statutes. Examining the statutes side by side highlights the subtle choices of various state …

Accountability Of Google And Other Businesses In Colombia: Personal Data Protection In The Digital Age, Maria P. Angel, Vivian Newman-Pont

Scholarly Works

In this document we analyze the privacy policies of 30 companies with data-driven business models that collect data in Colombia and identify practices that have not been sufficiently contemplated by the personal data protection regime currently applicable in our country. But what has been done in Colombia to guarantee these rights in the digital economy framework? In this document, we explore the degree of preparedness of our legal personal data protection regime and data protection authorities for tackling the risks that the digital era poses to different values and rights, thereby holding accountable the companies with data-driven business models (DDBM). …

It's Nothing Personal: Why Existing State Laws On Point-Of-Sale Consumer Data Collection Should Be Replaced With A Federal Standard, Kate Mirino

St. John's Law Review

(Excerpt)

Accordingly, this Note proposes a contemporary-minded federal solution to preempt and standardize the various, outmoded state approaches in this field. Part I engages in a historical overview of the development of information privacy law in the United States. Part II provides a summary and comparison of the existing state rules at play. Part III discusses the negative consequences—both to consumers and to businesses—of inconsistent regulation in this area, and explains why a federal solution is necessary. Part IV outlines the parameters of the federal regulation proposed by this Note.

Open Banking: Regulatory Challenges For A New Form Of Financial Intermediation In A Data-Driven World, Nydia Remolina

Centre for AI & Data Governance (2019-2025)

Data has taken immense importance in the last years. Consider the amount of data that is being collected worldwide every day, industries are reshaping their activities into a data-driven business. The digital transformation of all industries, portent of the fourth industrial revolution, is creating a new kind of economy based on the datafication of almost any aspect of human social, political and economic activity as a result of the information generated by the numerous daily routines of digitally connected individuals and technology. The financial services industry is part of this trend. Embracing the digital revolution and creating the right foundations …

Mind Your Businesses: Why Georgia Companies Should Worry About European Privacy Law, Emily E. Seaton

Georgia Journal of International & Comparative Law

No abstract provided.

Protecting Personal Data: A Model Data Security And Breach Notifications Statute, Michael Bloom

St. John's Law Review

(Excerpt)

This Note argues that current law is inadequate to protect consumers in light of the prevalence and severity of data breaches in recent years, and that a unifying federal legislation combining portions of state law and the DSBNA should be enacted. Part I of this Note analyzes the DSBNA for notification requirements when data breaches occur, the requirements for the implementation of security policies, regulatory mechanisms for monitoring compliance with these requirements, and criminal penalties for failing to comply. Part II summarizes the various state laws that exist for notification of data breaches. Part III proposes a model federal …

Forensic Border Searches After Carpenter Require Probable Cause And A Warrant, Christopher I. Pryby

Michigan Law Review

Under the border search doctrine, courts have upheld the federal government's practice of searching people and their possessions upon entry into or exit from the United States, without any requirement of suspicion, as reasonable under the Fourth Amendment. Since the advent of electronic devices with large storage capacities, courts have grappled with whether this definition of reasonableness continues to apply. So far, courts have consistently characterized “nonforensic” border inspections of electronic devices (for example, paging through photos on a phone) as “routine” searches that, like inspecting luggage brought across international lines, require no suspicion. But there is a circuit split …