Privacy Law Commons^™

Democratic Legitimacy And Data Governance: Data Privacy Philosophy And Regulatory Preferences In The U.S. Vs Eu, Mia H. Truong

Student Scholar Symposium Abstracts and Posters

The rapid expansion of artificial intelligence and large-scale data collection has intensified tensions between commercial innovation and consumer privacy, raising a fundamental democratic question: do Americans understand their data protections–and does this shape their demand for regulation? The EU and U.S. represent two fundamentally opposed approaches to data privacy regulation: the EU's General Data Protection Regulation (GDPR) treats personal data as a fundamental human right, rooted in post-WWII constitutional protections against state surveillance and authoritarianism, while the U.S. operates through fragmented, sector-specific state laws that treat personal data as a market commodity. This study is the first to empirically investigate …

Mitigating Data Privacy Risks In Political Micro-Targeting Through Gdpr-Compliant Federated Learning: Lessons From The Cambridge Analytica Controversy, Jingfan (Serena) Xiao

Marquette Intellectual Property & Innovation Law Review

Political micro-targeting employs granular data analytics to deliver hyper- personalized political messaging, raising fundamental tensions between electoral strategy, data privacy, and democratic accountability. The Facebook- Cambridge Analytica scandal exposed significant gaps in pre-GDPR data protection laws, highlighting the risks of unchecked algorithmic profiling in shaping voter behavior. However, as micro-targeting evolves under more sophisticated AI-driven systems, a pressing question emerges: should AI- generated political messaging qualify for First Amendment protection? This Article introduces the concept of speech certainty, arguing that speech must be intentional and cognitively understood by the speaker at the moment of articulation to warrant constitutional protection. Under …

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil M. Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Scholarship@WashULaw

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Faculty Scholarship

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

Navigating The Shadows: Evaluating Privacy Protections Against Dark Patterns, Matt Gaulton, Dominique Kelly, Dr. Jacquelyn Burkell

Canadian Journal of Law and Technology

Privacy dark patterns are user interface design strategies that manipulate individuals into disclosing personal information or consenting to data practices they may not fully understand or intend. This paper critically evaluates the effectiveness of Canadian, American, and European privacy frameworks — specifically, the Personal Information Protection and Electronic Documents Act (PIPEDA), the California Consumer Privacy Act (CCPA), and the European Union’s General Data Protection Regulation (GDPR) — in addressing the regulatory challenges posed by privacy dark patterns. We argue that PIPEDA is significantly less equipped to counteract such manipulative practices, particularly in comparison to the GDPR and CCPA, due to …

One Person, Endless Data: Prohibiting Personal Political Viewpoint Data Processing To Combat Voter Suppression, William Eddy

Journal of Civil Rights and Economic Development

(Excerpt)

Polarization in American politics and elections continues to rise, due in no small part to advancing digital marketing technologies co-opted by political actors. In 2016, Cambridge Analytica, a political consulting firm, spearheaded right-wing populist campaigns to political victory in the United States and United Kingdom. The firm reconfigured commercial data processing methods to process personal political viewpoint data (“PPVD”) and perform “psychological manipulation.” While the firm has since dissolved, such practices are still used to manipulate American elections.

The European Union (“EU”), also in 2016, enacted the General Data Protection Regulation (“GDPR”). As a comprehensive data privacy reform, GDPR, …

Home—The Final Frontier: Why Privacy Means Protecting Workers' Rights To Time And Space, Joshua Fairfield, Amanda Reilly

Scholarly Articles

This article critiques the failure of current privacy frameworks to protect workers—especially teleworkers—from the growing encroachment of employer surveillance into their homes. It argues that prevailing privacy regimes, including notice-and-choice models and the GDPR, inadequately address the systemic power asymmetries in the employment relationship, often enabling rather than restricting invasive monitoring. Drawing from labor law traditions, the authors propose a rights-centered framework that views time and space as essential for human dignity and autonomy. They call for a non-negotiable floor of protections, including surveillance-free periods, bans on data commodification, and the establishment of an enforcement inspectorate. By reframing privacy not …

Internet Search Engines’ Privacy Violations And The Lack Of Federal Regulation To Protect Consumers Rights, Elsa M. G. Rodriguez Ogando

Dickinson Law Review (2017-Present)

The United States’ current legal framework regarding internet search engines is disadvantageous to consumers. Federal privacy laws (although not encompassing search engines) grant businesses a strong legal basis in privacy claims and alibies for arbitrary behavior; these laws favor businesses over consumers. Moreover, state privacy laws empower nonspecific agencies to oversee privacy matters and enforce consumers’ rights. Thus, the U.S. privacy legal framework is in need of a new federal law that establishes consumers’ rights, as well as a federal agency dedicated solely to privacy matters. This Article proposes a federal law recommendation based on the standards of the California …

Can Federated Learning Solve Ai’S Data Privacy Problem?: A Legal Analysis, Warren B. Chik, Florian Gamper

Research Collection Yong Pung How School Of Law

Federated learning (FL) is a method of training AI systems on different datasets without sharing data. The promise of FL is to enable AI systems to be trained on data, including personal data, while preserving data privacy and confidentiality, and thus, inter alia, facilitate compliance with data protection legislation. FL has generated a considerable interest amongst the computer science community, yet there is a dearth of legal analysis of FL. This is a problem because the question of whether FL facilitates compliance with data protection legislation is a legal question. This article will fill this lacuna by providing a comprehensive …

The Power Of Procedure: Uncovering The Gap In U.S. Privacy Rights, Bernard Chao, Mandi Abbott

Sturm College of Law: Faculty Scholarship

As Congress faces increasing pressure to adopt comprehensive privacy legislation, this article seeks to contribute to the ongoing discussions by exploring critical procedural deficiencies in U.S. privacy laws and their implications for both domestic privacy rights and international data flows. The article makes several key contributions to the field. First, it uses a comparative law perspective to highlight the lack of robust procedural rights and remedies in U.S. privacy law. Second, while many have questioned whether the Court of Justice for the European Union will strike down the latest US-EU Data Privacy Framework (the primary mechanism for allowing the transatlantic …

Navigating The Nexus: Competition Law, Data Privacy, And Regulatory Challenges In The Digital Economy, Aalaa Tarek El Gohary

Theses and Dissertations

Competition law and data privacy meet at a crucial point in the growing digital economy, making it essential to delve into their intricate relationship. This thesis investigates how competition law and data protection law interact within the digital market. It examines how data protection regulations influence market dynamics and competition, and how competition law affects data processing and individual rights during the digital transformation. By thoroughly exploring key themes, such as historical context, current challenges, and regulatory responses, this research aims to shed light on the changing regulatory landscape and its impact on future frameworks in the digital era. The …

The Data Heist: Protecting Consumers And Their Information Through Opt-In Consent, John A. Hudson

Arkansas Law Review

This Comment will: (1) compare and contrast the data privacy laws in the United States and the European Union; (2) demonstrate the significant risk American consumers are subject to under the United States’ current laws and regulations; and (3) address the protections provided by the European Union’s explicit opt-in consent requirement that would ensure safer conditions for American consumers.

Meta V Bundeskartellamt: A Double-Edged Sword For Consumer Protection, Adrianus Van Heusden, Larisa Munteanu

International Journal on Consumer Law and Practice

Although consumers and data subjects do not always overlap in the European Union, the fields of data protection and consumer law are increasingly intertwined. Within this case note, one of the most impactful and recent decisions of the Court of Justice of the European Union will be analysed. Case C-252/21 will be examined through the lens of consumers using social networks in the digital age, additionally making references to the ‘take it or leave it’ and ‘cash for privacy exchange’ concepts identified by the doctrine in the field. Innovatively, this commentary will present a distinct and atypical opinion related to …

The New Eu-Us Data Protection Framework's Implications For Healthcare, Charlotte A. Tschider, Marcelo Corrales Compagnucci, Timo Minssen

Faculty Publications & Other Works

In July 2023, the United States and the European Union introduced the Data Privacy Framework (DPF), introducing the third generation of cross-border data transfer agreements constituting adequacy with respect to personal data transfers under the General Data Protection Regulation (GDPR) between the European Union (EU) and the US. This framework may be used in cross-border healthcare and research relationships, which are highly desirable and increasingly essential to innovative health technology development and health services deployment. A reliable model meeting EU adequacy requirements could enhance the transfer of patient and research participant data. While the DPF might present a familiar terrain …

Data Controllers As Data Fiduciaries: Theory, Definitions & Burdens Of Proof, Noelle Wilson, Amanda Reid

University of Colorado Law Review

As more U.S. states have begun to pass consumer privacy laws, there are growing calls for federal data privacy regulation to ease the burden of compliance with various, sometimes conflicting, state laws. However, scholars and lawmakers are divided on how best to balance robust privacy protections with privacy laws to which businesses can realistically comply. Two prominent regulatory models have emerged from scholarly debate. The Rights/Obligations Model grants consumers various rights and imposes obligations on businesses. This model has been trending in U.S. states, which have mirrored language from the European Union’s General Data Protection Regulation (GDPR) by imposing different …

The Limitations Of Privacy Rights, Daniel J. Solove

Notre Dame Law Review

Individual privacy rights are often at the heart of information privacy and data protection laws. The most comprehensive set of rights, from the European Union’s General Data Protection Regulation (GDPR), includes the right to access, right to rectification (correction), right to erasure (deletion), right to restriction, right to data portability, right to object, and right to not be subject to automated decisions. Privacy laws around the world include many of these rights in various forms.

In this Article, I contend that although rights are an important component of privacy regulation, rights are often asked to do far more work than …

Recognizing Operators’ Duties To Properly Select And Supervise Ai Agents – A (Better?) Tool For Algorithmic Accountability, Richard Zuroff

Canadian Journal of Law and Technology

In November of 2020, the Privacy Commissioner of Canada proposed creating GDPR-inspired rights for decision subjects and allowing financial penalties for violations of those rights. Shortly afterward, the proposal to create a right to an explanation for algorithmic decisions was incorporated into Bill C-11, the Digital Charter Implementation Act. This commentary proposes that creating duties for operators to properly select and supervise artificial agents would be a complementary, and potentially more effective, accountability mechanism than creating a right to an explanation. These duties would be a natural extension of employers’ duties to properly select and retain human employees. Allowing victims …

Semantics And Sin Tax: Maintaining Autonomy In The Age Of Hyper-Personalization, Stephen Kohn

Mitchell Hamline Law Review

No abstract provided.

The Gdpr And Uk Gdpr And Its Impact On Us Academic Institutions, Leila Halawi, Alpesh Makwana

Publications

This research paper delves into the implications of the General Data Protection Regulation (GDPR) and the United Kingdom (UK) GDPR on academic institutions, shedding light on their significance for organizations and educational establishments handling data from individuals in the European Union (EU) and the UK. Non-compliance with these regulations can lead to substantial penalties. The study focuses specifically on US Higher Education and presents actionable measures that institutions can adopt to enhance compliance, fortify data protection, and safeguard the privacy of individuals.

Incomplete Contracts And Future Data Usage, Jens Frankenreiter, Talia B. Gillis, Dan Svirsky

Scholarship@WashULaw

Most major jurisdictions require websites to provide customers with privacy policies. For consumers, a privacy policy's most important function is to provide them with a description of the online service provider's current privacy practices. We argue that these policies also serve a second, often-overlooked function: they allocate residual data usage rights to online services or consumers, including the power to decide whether a service can modify its privacy practices and use consumer data in novel ways. We further argue that a central feature of the E.U.'s General Data Protection Regulation (GDPR), one of the most comprehensive and far-reaching privacy regulatory …

Regulating Social Media In The Global South, Zahra Takhshid

Sturm College of Law: Faculty Scholarship

In recent years, the disinformation crisis has made regulating social media platforms a necessity. The consequences of disinformation campaigns are not only limited to election interferences or political debates; they have also included fatal consequences. In response, however, scholars in the United States have generally focused on regulating social media companies in the United States, without paying much attention to these companies’ global impact, particularly in the Global South. Lost in the quest to fight disinformation is addressing the social media companies’ neglect of consumer rights in the Global South.

Countries in the Global North, such as the United States, …

Data Privacy, Human Rights, And Algorithmic Opacity, Sylvia Lu

Fellow, Adjunct, Lecturer, and Research Scholar Works

Decades ago, it was difficult to imagine a reality in which artificial intelligence (AI) could penetrate every corner of our lives to monitor our innermost selves for commercial interests. Within just a few decades, the private sector has seen a wild proliferation of AI systems, many of which are more powerful and penetrating than anticipated. In many cases, AI systems have become “the power behind the throne,” tracking user activities and making fateful decisions through predictive analysis of personal information. Despite the growing power of AI, proprietary algorithmic systems can be technically complex, legally claimed as trade secrets, and managerially …

The Gdpr As Privacy Pretext And The Problem Of Co-Opting Privacy, Neil M. Richards

Scholarship@WashULaw

Privacy and data protection law's expansion brings with it opportunities for mischief as privacy rules are used pretextually to serve other ends. This Essay examines the problem of such co-option of privacy using a case study of lawsuits in which defendants seek to use the EU’s General Data Protection Regulation (“GDPR”) to frustrate ordinary civil discovery. In a series of cases, European civil defendants have argued that the GDPR requires them to redact all names from otherwise valid discovery requests for relevant evidence produced under a protective order, thereby turning the GDPR from a rule designed to protect the fundamental …

The Hidden Harms Of Privacy Penalties, Mary D. Fan

Articles

How to frame privacy penalties to protect our personal information is an important question as demands for legislation and proposals proliferate. The predominant assumption in calls for a comprehensive consumer privacy regime is that regulation and penalties arm the consumer David against Goliath businesses. Missing in the focus on powerful companies is attention to the potential harms of expanding privacy penalties for small-fry individuals and entities, especially from disfavored or marginalized groups. This article is the first to illuminate the regressive risks of privacy penalties, showing how broad privacy penalties can become tools for harassment of small businesses and individuals …

Winter Is Here: The Impossibility Of Schrems Ii For U.S.-Based Direct-To-Consumer Companies, Vanessa Zimmer

Northwestern Journal of International Law & Business

In this paper, Vanessa Zimmer exposes the precarious position of Direct-to-Consumer (DTC) companies that are physically located in the United States but still subject to the European General Data Protection Regulation (GDPR) under Article 3(2) because they offer goods or services to European consumers online. Standard Contractual Clauses (SCCs) and supplementary measures have dominated privacy conversions in the year since the European Court of Justice invalidated the EU-U.S. Privacy Shield framework with its Schrems II decision.

However, Zimmer argues that the greater issue for U.S.-based DTC companies is the lack of clarity over what constitutes an international, or restricted, transfer …

Torn Between Institutionalisation & Judicialisation: The Demise Of The Eu-Us Privacy Shield, Elaine Fahey, Fabien Terpan

Indiana Journal of Global Legal Studies

In July 2016, the EU-US (European Union-United States) Privacy Shield came into force, replacing the EU-US Safe Harbour, to address the concerns around data collection and privacy that arose in the case of Schrems v. European Data Commissioner (C-362/14). The Court of Justice of the European Union (CJEU) in its ruling known as Schrems I took a position in defence of privacy in the context of Edward Snowden's revelations on the National Security Agency's (NSA) surveillance programs. This context had already spurred the development of several instruments and enforcement regimes, such as the General Data Protection Regulation (GDPR), adopted in …

Data Privacy Issues In West Virginia And Beyond: A Comprehensive Overview, Jena Martin

Consumer Law Scholarship

This white paper was commissioned by the Center for Consumer Law and Education, a joint initiative launched by West Virginia University and Marshall University to “coordinate the development of consumer law, policy, and education research to support and serve consumers.”

As such, this paper has a dual purpose. First, it provides a comprehensive overview of the many different legal issues that affect data privacy concerns (both nationally and in West Virginia). Second, it documents and discusses the result of a survey and specific focus groups that were undertaken throughout the fall of 2019 into January 2020 where individuals within the …

Outsourcing The Police: How Reliance On The Private Sector For Law Enforcement Threatens Privacy Legislation Around The World, Karl Colbary

Northwestern Journal of International Law & Business

Data privacy is an increasingly important issue in the world today. People are increasingly aware of, and concerned about, their digital footprint. As a result, many jurisdictions around the world—the United States excluded—have enacted legislation with an eye towards giving their citizens greater control over their data. However, the movement to give individuals greater control over how their data is used by tech providers often overlooks the fact that the government is one of the biggest consumers of the data that tech providers collect. Therefore, data privacy regimes that allow the flow of personal information to the government do not …

Send The Word Over There: An Offshore Solution To The Right To Be Forgotten, Jay Kaganoff

Northwestern Journal of International Law & Business

The right to be forgotten is a subject of contention in both the United States and the European Union. In the E.U., the right to be forgotten gives one the right to demand that information—even if published legitimately—be taken down or removed from search engine results. While well-intentioned, this has led to concerns of free press restrictions. In contrast, the right to be forgotten is not recognized in the U.S., although there are scholars who would like to see such a right here. This Note takes the view that introducing a right to be forgotten would be contrary to the …

Catalyzing Privacy Law, Anupam Chander, Margot E. Kaminski, William Mcgeveran

Publications

The United States famously lacks a comprehensive federal data privacy law. In the past year, however, over half the states have proposed broad privacy bills or have established task forces to propose possible privacy legislation. Meanwhile, congressional committees are holding hearings on multiple privacy bills. What is catalyzing this legislative momentum? Some believe that Europe’s General Data Protection Regulation (GDPR), which came into force in 2018, is the driving factor. But with the California Consumer Privacy Act (CCPA) which took effect in January 2020, California has emerged as an alternate contender in the race to set the new standard for …