Privacy Law Commons^™

Data In Distress: Effectuating State Data Privacy Laws During Bankruptcy, Cameron Love

Emory Law Journal

In 2000, an online toy retailer, Toysmart.com, attempted to liquidate consumer data to pay creditors in its bankruptcy case. The attempted sale drew objections from the Federal Trade Commission and forty-seven state attorneys general. Five years later, Congress attempted to resolve privacy concerns in bankruptcy, amending the Bankruptcy Code to provide clear procedures for the liquidation of “personally identifiable information.” Recently, scholars have criticized these amendments, characterizing them as “limited,” “outdated,” and “privacy theater.” This Comment adds to these criticisms, arguing the amendments’ failure to mandate consideration of relevant nonbankruptcy law puts these permissive sales procedures on a collision course …

Justice David Hackett Souter And The Right To Privacy, Scott P. Johnson

Mitchell Hamline Law Review

No abstract provided.

The Trade Origins Of Privacy Law, Anupam Chander

Georgetown Law Faculty Publications and Other Works

The desire for trade propelled the growth of data privacy law across the world. Countries with strong privacy laws sought to ensure that their citizens’ privacy would not be compromised when their data traveled to other countries. Even before this vaunted Brussels Effect pushed privacy law across the world through the enticement of trade with the European Union, Brussels had to erect privacy law within the Union itself. And as the Union itself expanded, privacy law was a critical condition for accession.

But this coupling of privacy and trade leaves a puzzle: how did the U.S. avoid a comprehensive privacy …

Constructing Ai Speech, Margot E. Kaminski, Meg Leta Jones

Publications

Artificial Intelligence (AI) systems such as ChatGPT can now produce convincingly human speech, at scale. It is tempting to ask whether such AI-generated content “disrupts” the law. That, we claim, is the wrong question. It characterizes the law as inherently reactive, rather than proactive, and fails to reveal how what may look like “disruption” in one area of the law is business as usual in another. We challenge the prevailing notion that technology inherently disrupts law, proposing instead that law and technology co-construct each other in a dynamic interplay reflective of societal priorities and political power. This Essay instead deploys …

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Measuring Compliance With The California Consumer Privacy Act Over Space And Time, Jens Frankenreiter, Van Tran, Aarushi Mehrotra, Marshini Chetty, Nick Feamster, Lior Strahilevitz

Scholarship@WashULaw

The widespread sharing of consumers personal information with third parties raises significant privacy concerns. The California Consumer Privacy Act (CCPA) mandates that online businesses offer consumers the option to opt out of the sale and sharing of personal information. Our study automatically tracks the presence of the opt-out link longitudinally across multiple states after the California Privacy Rights Act (CPRA) went into effect. We categorize websites based on whether they are subject to CCPA and investigate cases of potential non-compliance. We find a number of websites that implement the opt-out link early and across all examined states but also find …

Valuing Social Data, Amanda Parsons, Salome Viljoen

Articles

Social data production—accumulating, processing, and using large volumes of data about people—is a unique form of value creation that characterizes the digital economy. Social data production also presents critical challenges for the legal regimes that encounter it. This Article provides scholars and policymakers with the tools to comprehend this new form of value creation through two descriptive contributions. First, it presents a theoretical account of social data, a mode of production that is cultivated and exploited for two distinct (albeit related) forms of value: prediction value and exchange value. Second, it creates and defends a taxonomy of three “scripts” that …

Brokered Abuse, Thomas E. Kadri

Scholarly Works

This chapter examines how data brokers, companies that collect, sell, and trade personal information, enable and intensify interpersonal abuse. The article analyzes the data brokerage industry’s role in undermining personal obscurity, the relative safety that comes from being difficult to find or understand, and explores how current laws not only fail to address these harms but can make them worse. The chapter argues that existing privacy regimes, particularly those requiring victims to request data removal from individual brokers, impose psychological burdens and can retraumatize victims.

Distinguishing Privacy Law: A Critique Of Privacy As Social Taxonomy, Maria P. Angel, Ryan Calo

Scholarly Works

What distinguishes violations of privacy from other harms? This has proven a surprisingly difficult question to answer. For over a century, privacy law scholars labored to define the illusive concept of privacy. Then they gave up. Efforts at distinguishing privacy came to be superseded at the turn of the millennium by a new approach: a taxonomy of privacy problems grounded in social recognition. Privacy law became the field that simply studies whatever courts or scholars talk about as related to privacy.

And it worked. Decades into privacy as social taxonomy, the field has expanded to encompass a broad range of …

Research Access To Social Media Data: Lessons From Clinical Trial Data Sharing, Christopher J. Morten, Gabriel Nicholas, Salomé Vilgoen

Articles

For years, social media companies have sparred with lawmakers over how much independent access to platform data they should provide researchers. Sharing data with researchers allows the public to better understand the risks and harms associated with social media, including areas such as misinformation, child safety, and political polarization. Yet researcher access is controversial. Privacy advocates and companies raise the potential privacy threats of researchers using such data irresponsibly. In addition, social media companies raise concerns over trade secrecy: the data these companies hold and the algorithms powered by that data are secretive sources of competitive advantage. This Article shows …

Privacy Nicks: How The Law Normalizes Surveillance, Woodrow N. Hartzog, Evan Selinger, Johanna Gunawan

Faculty Scholarship

Privacy law is failing to protect individuals from being watched and exposed, despite stronger surveillance and data protection rules. The problem is that our rules look to social norms to set thresholds for privacy violations, but people can get used to being observed. In this article, we argue that by ignoring de minimis privacy encroachments, the law is complicit in normalizing surveillance. Privacy law helps acclimate people to being watched by ignoring smaller, more frequent, and more mundane privacy diminutions. We call these reductions “privacy nicks,” like the proverbial “thousand cuts” that lead to death.
/="/">
/="/">Privacy nicks come …

Against Engagement, Neil Richards, Woodrow Hartzog

Faculty Scholarship

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet

Our goal in this Article is to isolate …

Kafka In The Age Of Ai And The Futility Of Privacy As Control, Daniel Solove, Woodrow Hartzog

Faculty Scholarship

Despite writing more than a century ago, Franz Kafka captured the core problem of digital technologies—how individuals are rendered powerless and vulnerable. Over the past fifty years, and especially in the twenty-first century, privacy laws have been sprouting up around the world. These laws are often based heavily on an Individual Control Model that aims to empower individuals with rights to help them control the collection, use, and disclosure of their data.

In this Article, we argue that although Kafka starkly shows us the plight of the disempowered individual, his work also paradoxically suggests that empowering the individual isn’t the …

Two Ai Truths And A Lie, Woodrow Hartzog

Faculty Scholarship

Industry will take everything it can in developing Artificial Intelligence (AI) systems. We will get used to it. This will be done for our benefit. Two of these things are true and one of them is a lie. It is critical that lawmakers identify them correctly. In this Essay, I argue that no matter how AI systems develop, if lawmakers do not address the dynamics of dangerous extraction, harmful normalization, and adversarial self-dealing, then AI systems will likely be used to do more harm than good.

Given these inevitabilities, lawmakers will need to change their usual approach to regulating technology. …

Fintech Lending In India: Taking Stock Of Implications For Privacy And Autonomy, Vidushi Marda, Amber Sinha

Indian Journal of Law and Technology

In the last five years, the Fintech sector has thrived in India, with Machine Learning (ML) driven credit scoring based on alternative data, emerging as a growing segment. The credit scoring industry in India needs to be viewed in light of a careful examination of rights, inclusion, appropriate safeguards and discrimination, currently missing from the discourse and practices. In this paper, we explain how ML-based credit scoring works, and the regulatory and commercial factors that have enabled and impeded its growth in India. Through legal and technological analysis, richened by insights from qualitative interviews with entrepreneurs and practitioners, we provide …

Our Changing Reality: The Metaverse And The Importance Of Privacy Regulations In The United States, Anushkay Raza

Global Business Law Review

This Note discusses the legal and pressing digital challenges that arise in connection with the growing use of virtual reality, and more specifically, the metaverse. As this digital realm becomes more integrated into our daily lives, the United States should look towards creating a federal privacy law that protects fundamental individual privacy rights. This Note argues that congress should emulate the European Union's privacy regulations, and further, balances the potential consequences and benefits of adapting European regulations within the United Sates. Finally, this Note provides drafting considerations of future lawyers who will not only be dealing with the rise of …

Breaking The Fourth's Wall: The Implications Of Remote Education For Students' Fourth Amendment Rights, Sallie Hatfield

Vanderbilt Journal of Entertainment & Technology Law

As the COVID-19 pandemic forced both public K-12 and higher education institutions to transition to exclusively provide remote education, students’ homes and personal lives were exposed to the government like never before. Zoom classes and remote proctoring were suddenly the norm. Students and their families scrambled to create appropriate offices and classroom spaces in their homes, and many awkward and invasive scenarios soon followed. While many may have been harmlessly captured on camera, like classes that witness a student’s family eating lunch in the background or a dog on the couch, even these harmless instances have insidious implications for the …

Privacy And National Politics: Fingerprint And Dna Litigation In Japan And The United States Compared, Dongsheng Zang

Pace Law Review

No abstract provided.

Direct To Consumer Or Direct To All: Home Dna Tests And Lack Of Privacy Regulations In The United States, Karen J. Kukla

IP Theory

Although the U.S. has some measures of privacy protection for genetic data, the lack of a comprehensive approach to protecting direct-to-consumer genetic testing results in privacy violations for both consumers and their relatives. This essay explores the critical need for the U.S. government to address these privacy violations and argues that the U.S. should approach the problem and strategize a solution similar to the European Union’s (EU) General Data Protection Regulation (GDPR). Part I identifies current United States law, both federal and state regulations that address DTC-GT and genetic privacy. Part II examines the lack of regulation surrounding current DTC-GT …

Unavoidability In U.S. Privacy Law, Laura M. Moy

Georgetown Law Faculty Publications and Other Works

Why is U.S. privacy law structured the way it is, with a series of sectoral laws rather than a cross-sectoral law or laws? Why does U.S. privacy law protect information shared in certain contexts—such as information shared with an attorney, a healthcare provider, or a financial provider—rather than particular types of information? One possibility is that sectoral laws apply to contexts in which people typically share highly “sensitive” information containing intimate secrets or with the potential to harm them financially or psychologically.

But this Article argues that there is something else at play—that in fact, an under-discussed and underappreciated factor …

Continuous Reproductive Surveillance, Michael Ulrich, Leah R. Fowler

Faculty Scholarship

The Dobbs opinion emphasizes that the state’s interest in the fetus extends to “all stages of development.” This essay briefly explores whether state legislators, agencies, and courts could use the “all stages of development” language to expand reproductive surveillance by using novel developments in consumer health technologies to augment those efforts.

Keep Your Fingerprints To Yourself: New York Needs A Biometric Privacy Law, Brendan Mcnerney

St. John's Law Review

(Excerpt)

Imagine walking into a store, picking something up, and just walking out. No longer is this shoplifting, it is legal. In 2016, Amazon introduced their “Just Walk Out” technology in Seattle. “Just Walk Out” uses cameras located throughout the store to monitor shoppers, document what they pick up, and automatically charge that shoppers’ Amazon account when they leave the store. Recently, Amazon started selling “Just Walk Out” technology to other retailers. Since then, retailers have become increasingly interested in collecting and using customers’ “biometric identifiers and information.” Generally, “biometrics” is used to refer to “measurable human biological and behavioral …

A Trusted Framework For Cross-Border Data Flows, Alex Joel

Joint PIJIP/TLS Research Paper Series

The German Marshall Fund of the United States (GMF), in cooperation with the Tech, Law and Security Program (TLS) of the American University Washington College of Law, and with support from Microsoft, convened a Global Taskforce to Promote Trusted Sharing of Data comprising experts from civil society, academia, and industry to submit proposals for harmonizing approaches to global data use and sharing. Former US Ambassador to the Organisation for Economic Co-operation and Development (OECD) and GMF Distinguished Fellow Karen Kornbluh and Microsoft Chief Privacy Officer and Corporate Vice President Julie Brill co-chaired the taskforce; TLS Senior Project Director Alex Joel …

Safeguarding Taxpayer Data, Michael Hatfield

Articles

The Internal Revenue Service (IRS) collects more information on more individuals than any other government agency. The information is not only financial but personal, potentially including information about health care needs and decisions; the caregivers, disabilities, and foreign birth of children; the educational progress and felony convictions of students; and one’s religious and charitable associations. In acknowledging the vast quantity of information held by the IRS, and the necessity of taxpayers trusting tax administrators with their information, Congress provided greater protection for taxpayer information under the Internal Revenue Code (IRC) than it was provided under the Privacy Act. Congress obligated …

Encouraging Public Access To Pharmaceuticals Through Modified Protection Of Clinical Trial Data, Scott M. Nolan Ii

IP Theory

Part I of this Article investigates the development of pharmaceuticals and clinical trial data with a focus on patent and data protection. Part II evaluates the effects of protection and the challenges it poses to widespread public pharmaceutical access. Part III discusses two scholarly approaches to the public access issue that focus on clinical data protection and their associated challenges. In light of these scholarly works, Part IV suggests a new approach to clinical trial data protection that aims to improve public pharmaceutical access while maintaining the incentives to invent for drug developers.

Administrative Regulation Of Programmatic Policing: Why "Leaders Of A Beautiful Struggle" Is Both Right And Wrong, Christopher Slobogin

Vanderbilt Law School Faculty Publications

In Leaders of a Beautiful Struggle v. Baltimore Police Department, the Fourth Circuit Court of Appeals held that Aerial Investigation Research (AIR), Baltimore's aerial surveillance program, violated the Fourth Amendment because it was not authorized by a warrant. AIR was constitutionaly problematic, but not for the reason given by the Fourth Circuit. AIR, like many other technologically-enhanced policing programs that rely on closed-circuit television (CCTV), automated license plate readers and the like, involves the collection and retention of information about huge numbers ofpeople. Because individualized suspicion does not exist with respect to any of these people's information, an individual-specific warrant …

The United States Should Take A Page Out Of Canadian Law When It Comes To Privacy, Genetic And Otherwise, Ashley Rahaim

University of Miami Inter-American Law Review

Genetic information is intimate and telling data warranting privacy in public and private realms. The privacy protections offered in the United States and Canada vastly differ when it comes to genetic privacy. Search and seizure law mirrors the privacy gap in the countries, as well as their treatment of DNA database information.

This note explores the foreshadowing of the creation of genetic privacy laws and their varying levels of protection based on the way private information was treated by state actors through search and seizure caselaw, the creation of legal precedent, and the treatment of intimate personal data in the …

National Telecommunications And Information Administration: Comments From Researchers At Boston University And The University Of Chicago, Ran Canetti, Aloni Cohen, Chris Conley, Mark Crovella, Stacey Dogan, Marco Gaboardi, Woodrow Hartzog, Rory Van Loo, Christopher Robertson, Katharine B. Silbaugh

Faculty Scholarship

These comments were composed by an interdisciplinary group of legal, computer science, and data science faculty and researchers at Boston University and the University of Chicago. This group collaborates on research projects that grapple with the legal, policy, and ethical implications of the use of algorithms and digital innovation in general, and more specifically regarding the use of online platforms, machine learning algorithms for classification, prediction, and decision making, and generative AI. Specific areas of expertise include the functionality and impact of recommendation systems; the development of Privacy Enhancing Technologies (PETs) and their relationship to privacy and data security laws; …

Femtechnodystopia, Leah R. Fowler, Michael Ulrich

Faculty Scholarship

Reproductive rights, as we have long understood them, are dead. But at the same time history seems to be moving backward, technology moves relentlessly forward. Femtech products, a category of consumer technology addressing an array of “female” health needs, seem poised to fill gaps created by states and stakeholders eager to limit birth control and abortion access and increase pregnancy surveillance and fetal rights. Period and fertility tracking applications could supplement or replace other contraception. Early digital alerts to missed periods can improve the chances of obtaining a legal abortion in states with ever-shrinking windows of availability or prompt behavioral …

Asking For It: Gendered Dimensions Of Surveillance Capitalism, Jessica Rizzo

Emancipations: A Journal of Critical Social Analysis

Advertising and privacy were once seen as mutually antagonistic. In the 1950s and 1960s, Americans went to court to fight for their right to be free from the invasion of privacy presented by unwanted advertising, but a strange realignment took place in the 1970s. Radical feminists were among those who were extremely concerned about the collection and computerization of personal data—they worried about private enterprise getting a hold of that data and using it to target women—but liberal feminists went in a different direction, making friends with advertising because they saw it as strategically valuable.

Liberal feminists argued that in …