Privacy Law Commons^™

Interview On The Black Box Society, Lawrence Joseph, Frank A. Pasquale

Faculty Scholarship

Hidden algorithms drive decisions at major Silicon Valley and Wall Street firms. Thanks to automation, those firms can approve credit, rank websites, and make myriad other decisions instantaneously. But what are the costs of their methods? And what exactly are they doing with their digital profiles of us?

Leaks, whistleblowers, and legal disputes have shed new light on corporate surveillance and the automated judgments it enables. Self-serving and reckless behavior is surprisingly common, and easy to hide in code protected by legal and real secrecy. Even after billions of dollars of fines have been levied, underfunded regulators may have only …

Reviving Implied Confidentiality, Woodrow Hartzog

Indiana Law Journal

The law of online relationships has a significant flaw—it regularly fails to account for the possibility of an implied confidence. The established doctrine of implied confidentiality is, without explanation, almost entirely absent from online jurisprudence in environments where it has traditionally been applied offline, such as with sensitive data sets and intimate social interactions.

Courts’ abandonment of implied confidentiality in online environments should have been foreseen. The concept has not been developed enough to be consistently applied in environments such as the Internet that lack obvious physical or contextual cues of confidence. This absence is significant because implied confidentiality could …

Forget Me, Forget Me Not: Reconciling Two Different Paradigms Of The Right To Be Forgotten, Lawrence Siry

Kentucky Law Journal

In May of 2014, the Court of Justice of the European Union handed down its decision in the case of Google Spain SL v. Agencia Española de Protección de Datos. This landmark decision ignited a firestorm of debate over the "right to be forgotten": the right of users to withdraw information about themselves available on the internet. With concerns about the restriction of the freedom of expression on the internet, many commentators have criticized the decision as unworkable and dangerous. Others have recognized continuity in the development of privacy and data protection jurisprudence within the European courts. Meanwhile in …

Failing Expectations: Fourth Amendment Doctrine In The Era Of Total Surveillance, Olivier Sylvain

Faculty Scholarship

Today’s reasonable expectation test and the third-party doctrine have little to nothing to offer by way of privacy protection if users today are at least conflicted about whether transactional noncontent data should be shared with third parties, including law enforcement officials. This uncertainty about how to define public expectation as a descriptive matter has compelled courts to defer to legislatures to find out what public expectation ought to be more as a matter of prudence than doctrine. Courts and others presume that legislatures are far better than courts at defining public expectations about emergent technologies.This Essay argues that the reasonable …

Regulating The Internet Of Things: First Steps Toward Managing Discrimination, Privacy, Security, And Consent, Scott R. Peppet

Publications

The consumer "Internet of Things" is suddenly reality, not science fiction. Electronic sensors are now ubiquitous in our smartphones, cars, homes, electric systems, health-care devices, fitness monitors, and workplaces. These connected, sensor-based devices create new types and unprecedented quantities of detailed, high-quality information about our everyday actions, habits, personalities, and preferences. Much of this undoubtedly increases social welfare. For example, insurers can price automobile coverage more accurately by using sensors to measure exactly how you drive (e.g., Progressive 's Snapshot system), which should theoretically lower the overall cost of insurance. But the Internet of Things raises new and difficult questions …

Reviving Implied Confidentiality, Woodrow Hartzog

Faculty Scholarship

The law of online relationships has a significant flaw-it regularly fails to account for the possibility of an implied confidence. The established doctrine of implied confidentiality is, without explanation, almost entirely absent from online jurisprudence in environments where it has traditionally been applied offline, such as with sensitive data sets and intimate social interactions.

Courts' abandonment of implied confidentiality in online environments should have been foreseen. The concept has not been developed enough to be consistently applied in environments such as the Internet that lack obvious physical or contextual cues of confidence. This absence is significant because implied confidentiality could …

Rethinking Online Privacy In Canada: Commentary On Voltage Pictures V. John And Jane Doe, Ngozi Okidegbe

Faculty Scholarship

This article problematizes the use of the bona fide case standard as the legal standard for a court to order a third party Internet Service Provider ("ISP") to disclose subscriber information to a copyright owner in online piracy cases. It argues that ISP account holders have a reasonable expectation of privacy in their subscriber information. It contends that the current bona fide case standard affords a relatively low threshold of protection for Internet users’ subscriber information. The reason for which the article takes this position is that the bona fide case standard can be met solely by IP address evidence, …

Rape Shield Laws And The Social Media Revolution: Discoverability Of Social Media--It's Not Private, Seth I. Koslow

Touro Law Review

No abstract provided.

Identity Theft On Social Networking Sites: Developing Issues Of Internet Impersonation, Maksim Reznik

Touro Law Review

This Comment focuses on the dangers of social media sites when a person gains access to another's online account through two different methods: (1) stealing the third party's password, or (2) creating a completely fake profile and subsequently impersonating that person.

Privacy, Antitrust, And Power, Frank Pasquale

Faculty Scholarship

When a dominant internet service collects information about its users, the situation is so far from the usual arm’s-length market transaction that neoclassical economic analysis is misleading. “Lack of surveillance” is not a product that individuals have varying preferences for and purchase accordingly. Rather, surveillance is an inevitable concomitant of life online. We need to tame the power that surveillance entails, rather than continuing to pursue illusory, surveillance-free alternatives on the platform level.

To the extent a company creates profiles of individuals and collects data on them, a third party ought to be collecting reports from the company on how …

Geographically Restricted Streaming Content And Evasion Of Geolocation: The Applicability Of The Copyright Anticircumvention Rules, Jerusha Burnett

Michigan Telecommunications & Technology Law Review

A number of methods currently exist or are being developed to determine where Internet users are located geographically when they access a particular webpage. Yet regardless of the precautions taken by website operators to limit the locations from which they allow access, it is likely that users will find ways to gain access to restricted content. Should the evasion of geolocation constitute circumvention of access controls so that § 1201 of the Digital Millennium Copyright Act ("DMCA") applies? Because location data can properly be considered personally identifiable information ("PII"), this Note argues that § 1201 should not apply absent a …

Keep Your Update To Yourself, Neil M. Richards

Scholarship@WashULaw

An essay from Wired Magazine (UK)'s special edition, The Wired World in 2013. The essay makes the argument that frictionless sharing of reading habits should decline in 2013.

Three Paradoxes Of Big Data, Neil M. Richards, Jonathan H. King

Scholarship@WashULaw

Big data is all the rage. Its proponents tout the use of sophisticated analytics to mine large data sets for insight as the solution to many of our society’s problems. These big data evangelists insist that data-driven decision making can now give us better predictions in areas ranging from college admissions to dating to hiring to medicine to national security and crime prevention. But much of the rhetoric of big data contains no meaningful analysis of its potential perils, only the promise. We don’t deny that big data holds substantial potential for the future, and that large dataset analysis has …

Durkheim's Internet: Social And Political Theory In Online Society, Ari Ezra Waldman

Articles & Chapters

While the Internet has changed dramatically since the early 1990s, the legal regime governing the right to privacy online and Internet speech is still steeped in a myth of the Internet user, completely hidden from others, in total control of his online experience, and free to come and go as he pleases. This false image of the “virtual self” has also contributed to an ethos of lawlessness, irresponsibility, and radical individuation online, allowing the evisceration of online privacy and the proliferation of hate and harassment.

I argue that the myth of the online anonym is not only false as a …

Limits Of The Federal Wiretap Act's Ability To Protect Against Wi-Fi Sniffing, Mani Potnuru

Michigan Law Review

Adoption of Wi-Fi wireless technology continues to see explosive growth. However many users still operate their home Wi-Fi networks in unsecured mode or use publicly available unsecured Wi-Fi networks, thus exposing their communications to the dangers of "packet sniffing," a technique used for eavesdropping on a network. Some have argued that communications over unsecured Wi-Fi networks are "readily accessible to the general public" and that such communications are therefore excluded from the broad protections of the Federal Wiretap Act against intentional interception of electronic communications. This Note examines the Federal Wiretap Act and argues that the current Act's treatment of …

Wiretapping The Internet: The Expansion Of The Communications Assistance To Law Enforcement Act To Extend Government Surveillance, Christa M. Hibbard

Federal Communications Law Journal

Criminal use of the Internet to circumvent traditional government phone wiretaps has inspired the Obama Administration to create a proposal to expand the Communications Assistance to Law Enforcement Act ("CALEA"). CALEA was passed in 1994 to regulate telephone and broadband companies to ensure compliance with standards to enable government wiretapping. The proposed amendment of CALEA would allow the government to require all communications service providers to meet technical standards necessary to comply with a wiretap order. The expansion of CALEA would likely widen its scope to social networking sites, instant messaging, gaming consoles that allow conversation among multiple players, and …

Privacy Policies, Terms Of Service, And Ftc Enforcement: Broadening Unfairness Regulation For A New Era, G. S. Hans

Michigan Telecommunications & Technology Law Review

This Note examines website privacy policies in the context of FTC regulation. The relevant portion of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45(a), uses the following language to define the scope of the agency's regulatory authority: "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." Specifically, this Note analyzes the FTC's power to regulate unfair practices (referred to as the FTC's "unfairness power") granted by Section 5, and also discusses the deception prong of Section 5, which allows the agency to …

The Need To Prevent Employers From Accessing Private Social Network Profiles, Brett Novick

University of Michigan Journal of Law Reform Caveat

In March 2012, social network privacy became a conversation topic after news reports of the story of Justin Bassett, a job applicant who withdrew his application in the middle of an interview when the interviewer asked him for the username and password of his private Facebook account. Although the issue has received much attention from the public and media, the Department of Justice (DOJ) has stated that it has no interest in prosecuting employers for asking for social networking account information. Fortunately, legislation that would make it illegal for employers to ask for the username and passwords for social networking …

Workplace Consequences Of Electronic Exhibitionism And Voyeurism, William A. Herbert

Publications and Research

The popularity of email, blogging and social networking raises important issues for employers, employees and labor unions. This article will explore contemporary workplace issues resulting from the related social phenomena of electronic exhibitionism and voyeurism. It will begin with a discussion of the international social phenomenon of individuals electronically distributing their personal thoughts, opinions, and activities to a potential worldwide audience while at the same time retaining a subjective sense of privacy. The temptation toward such exhibitionism has been substantially enhanced by the advent of Web 2.0. The article then turns to the legal implications of electronic voyeurism including employer …

Protecting Anonymous Expression: The Internet's Role In Washington State's Disclosure Laws And The Direct Democracy Process, Karen Cullinane

University of Michigan Journal of Law Reform

This Note proposes that the Washington State Legislature amend its Public Records Act to exempt from public disclosure personal information legally required to be disclosed by signers of referendum petitions. This Note also proposes that the Washington State Legislature designate an electronic system, to be detailed in its election law, by which referendum petitions can be checked for fraud without violating the right to anonymous expression protected by the First Amendment. Part I describes Washington State's referendum process and the path of Doe v. Reed, the case animating the reform presented in this Note. Part II illustrates how the rise …

A Path Toward User Control Of Online Profiling, Tracy A. Steindel

Michigan Telecommunications & Technology Law Review

Online profiling is "the practice of tracking information about consumers' interests by monitoring their movements online." A primary purpose of online profiling is to "deliver advertising tailored to the individual's interests," a practice known as online behavioral advertising (OBA). In order to accomplish this, publishers and advertisers track a individual's online behavior using cookies and other means. Publishers and advertisers aggregate the information, often compile it with information from offline sources, and sort individuals into groups based on characteristics such as age, income, and hobbies. Advertisers can then purchase access to these consumer groups, controlling their selections with such specificity …

Does Law Matter Online - Empirical Evidence On Privacy Law Compliance, Michael Birnhack, Niva Elkin-Koren

Michigan Telecommunications & Technology Law Review

Does law matter in the information environment? What can we learn from the experience of applying a particular legal regime to the online environment? Informational privacy (or to use the European term, data protection) provides an excellent illustration of the challenges faced by regulators who seek to secure user rights and shape online behavior. A comprehensive study of Israeli website compliance with information privacy regulation in 2003 and 2006 provides insights for understanding these challenges. The study examined the information privacy practices of 1360 active websites, determining the extent to which these sites comply with applicable legal requirements related to …

Internet Access Rights: A Brief History And Intellectual Origins, Jonathon Penney

Articles, Book Chapters, & Popular Press

If there is anything we have learned from recent protest movements around the world, and the heavy-handed government efforts to block, censor, suspend, and manipulate Internet connectivity, it is that access to the Internet, and its content, is anything but certain, especially when governments feel threatened. Despite these hard truths, the notion that people have a "right" to Internet access gained high-profile international recognition last year. In a report to the United Nations General Assembly in early 2011, Frank La Rue, the UN Special Rapporteur on Freedom of Expression, held that Internet access should be recognized as a "human right". …

Cohen V. Google, Inc., Eirik Cheverud

NYLS Law Review

No abstract provided.

Privacy 3.0-The Principle Of Proportionality, Andrew B. Serwin

University of Michigan Journal of Law Reform

Individual concern over privacy has existed as long as humans have said or done things they do not wish others to know about. In their groundbreaking law review article The Right to Privacy, Warren and Brandeis posited that the common law should protect an individual's right to privacy under a right formulated as the right to be let alone-Privacy 1.0. As technology advanced and societal values also changed, a belief surfaced that the Warren and Brandeis formulation did not provide sufficient structure for the development of privacy laws. As such, a second theoretical construct of privacy, Privacy 2.0 as …

Coding Privacy, Lilian Edwards

Chicago-Kent Law Review

Lawrence Lessig famously and usefully argues that cyberspace is regulated not just by law but also by norms, markets and architecture or "code." His insightful work might also lead the unwary to conclude, however, that code is inherently anti-privacy, and thus that an increasingly digital world must therefore also be increasingly devoid of privacy. This paper argues briefly that since technology is a neutral tool, code can be designed as much to fight for privacy as against it, and that what matters now is to look at what incentivizes the creation of pro- rather than anti-privacy code in the mainstream …

Anonymity In Cyberspace: What Can We Learn From John Doe?, Lyrissa Lidsky

Faculty Publications

This Article examines the evolution of the law governing libel suits against anonymous “John Doe” defendants based on Internet speech. Between 1999 and 2009, courts crafted new First Amendment doctrines to protect Internet speakers from having their anonymity automatically stripped away upon the filing of a libel action. Courts also adapted existing First Amendment protections for hyperbole, satire and other non-factual speech to protect the distinctive discourse of Internet message boards. Despite these positive developments, the current state of the law is unsatisfactory. Because the scope of protection for anonymous Internet speech varies greatly by jurisdiction, resourceful plaintiffs can make …

Cybercrimes Vs. Cyberliberties, Nadine Strossen

Articles & Chapters

Cybercrimes vs. Cyberliberties, Chapter 8 in Internet Policy and Economics: Challenges and Perspectives 2nd ed. at 110-127 ( W.H. Lehr & L.M. Pupillo, eds. Springer, 2009).

Federal Search Commission? Access, Fairness, And Accountability In The Law Of Search, Oren Bracha, Frank Pasquale

Faculty Scholarship

Should search engines be subject to the types of regulation now applied to personal data collectors, cable networks, or phone books? In this article, we make the case for some regulation of the ability of search engines to manipulate and structure their results. We demonstrate that the First Amendment, properly understood, does not prohibit such regulation. Nor will such interventions inevitably lead to the disclosure of important trade secrets.

After setting forth normative foundations for evaluating search engine manipulation, we explain how neither market discipline nor technological advance is likely to stop it. Though savvy users and personalized search may …

When Mobile Phones Are Rfid-Equipped - Finding E.U.-U.S. Solutions To Protect Consumer Privacy And Facilitate Mobile Commerce, Nancy J. King

Michigan Telecommunications & Technology Law Review

New mobile phones have been designed to include delivery of mobile advertising and other useful location-based services, but have they also been designed to protect consumers' privacy? One of the key enabling technologies for these new types of phones and new mobile services is Radio Frequency Identification (RFID), a wireless communication technology that enables the unique identification of tagged objects. In the case of RFID-enabled mobile phones, the personal nature of the devices makes it very likely that, by locating a phone, businesses will also be able to locate its owner. Consumers are currently testing new RFID-enabled phones around the …