Privacy Law Commons^™

My Body, My Choice, My Data: Information Privacy After Dobbs, My Kim Ong

University of San Francisco Law Review

No abstract provided.

Privacy Without The State?, Scott Skinner-Thompson

Publications

No abstract provided.

Distinguishing Privacy Law: A Critique Of Privacy As Social Taxonomy, Maria P. Angel, Ryan Calo

Scholarly Works

What distinguishes violations of privacy from other harms? This has proven a surprisingly difficult question to answer. For over a century, privacy law scholars labored to define the illusive concept of privacy. Then they gave up. Efforts at distinguishing privacy came to be superseded at the turn of the millennium by a new approach: a taxonomy of privacy problems grounded in social recognition. Privacy law became the field that simply studies whatever courts or scholars talk about as related to privacy.

And it worked. Decades into privacy as social taxonomy, the field has expanded to encompass a broad range of …

Against Engagement, Neil Richards, Woodrow Hartzog

Faculty Scholarship

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet

Our goal in this Article is to isolate …

Kafka In The Age Of Ai And The Futility Of Privacy As Control, Daniel Solove, Woodrow Hartzog

Faculty Scholarship

Despite writing more than a century ago, Franz Kafka captured the core problem of digital technologies—how individuals are rendered powerless and vulnerable. Over the past fifty years, and especially in the twenty-first century, privacy laws have been sprouting up around the world. These laws are often based heavily on an Individual Control Model that aims to empower individuals with rights to help them control the collection, use, and disclosure of their data.

In this Article, we argue that although Kafka starkly shows us the plight of the disempowered individual, his work also paradoxically suggests that empowering the individual isn’t the …

Digital Privacy For Reproductive Choice In The Post-Roe Era, Aziz Z. Huq, Rebecca Wexler

Faculty Scholarship

The overruling of Roe v. Wade has unleashed a torrent of regulatory and punitive activity restricting previously lawful reproductive options. But the turn to the expansive criminal law and new schemes of civil liability creates novel concerns, quite distinct from the pre-Roe landscape a half-century ago. Reproductive choice, and its nemesis, turn upon information. For pregnant people, deciding on a choice of medical care entails a search for advice and services. Information is at a pre­mium for them. Meanwhile, efforts to regulate abortion began with clinic closings. But they will quickly extend to civil actions and criminal indictments of patients, …

Extended Privacy For Extended Reality: Xr Technology Has 99 Problems And Privacy Is Several Of Them, Suchismita Pahi, Calli Schroeder

Notre Dame Journal on Emerging Technologies

Americans are rapidly adopting innovative technologies which are pushing the frontiers of reality. But, when they look at how their privacy is protected within the new extended reality (XR), they will find that U.S. privacy laws fall short. The privacy risks inherent in XR are inadequately addressed by current U.S. data privacy laws or courtcreated frameworks that purport to protect the constitutional right to be free from unreasonable searches. Many scholars, including Ryan Calo, Danielle Citron, Sherry Colb, Margaret Hu, Orin Kerr, Kirsten Martin, Paul Ohm, Daniel Solove, Rebecca Wexler, Shoshana Zuboff, and others, have highlighted the gaps in U.S. …

Gone Fishing: Casting A Wide Net Using Geofence Warrants, Ryan Tursi

Washington Law Review

Technology companies across the country receive requests from law enforcement agencies for cell phone location information near the scenes of crimes. These requests rely on the traditional warrant process and are known as geofence warrants, or reverse location search warrants. By obtaining location information, law enforcement can identify potential suspects or persons of interest who were near the scene of a crime when they have no leads. But the use of this investigative technique is controversial, as it threatens to intrude upon the privacy of innocent bystanders who had the misfortune of being nearby when the crime took place. Innocent …

Warranted Exclusion: A Case For A Fourth Amendment Built On The Right To Exclude, Mailyn Fidler

Law Faculty Scholarship

Searches intrude; fundamentally, they infringe on a right to exclude. So that right should form the basis of Fourth Amendment protections. Current Fourth Amendment doctrine-the reasonable expectation of privacy teststruggles with conceptual clarity and predictability. The Supreme Court's recent decision to overturn Roe v. Wade casts further doubt on the reception of other privacy-based approaches with this Court. But the replacement approach that several Justices on the Court favor, what I call the "maximalist" property approach, risks troublingly narrow results. This Article provides a new alternative: Fourth Amendment protection should be anchored in a flexible concept derived from property law-what …

Prescribing Exploitation, Charlotte A. Tschider

Faculty Publications & Other Works

Patients are increasingly reliant temporarily, if not indefinitely, on connected medical devices and wearables, many of which use artificial intelligence (“AI”) infrastructures and physical housing that directly interacts with the human body. The automated systems that drive the infrastructures of medical devices and wearables, especially those using complex AI, often use dynamically inscrutable algorithms that may render discriminatory effects that alter paths of treatment and other aspects of patient welfare.

Previous contributions to the literature, however, have not explored how AI technologies animate exploitation of medical technology users. Although all commercial relationships may exploit users to some degree, some forms …

Sexuality’S Promise For Sexual Privacy, Scott Skinner-Thompson

Publications

No abstract provided.

A Scientific Approach To Tech Accountability, David Choffnes, Woodrow Hartzog, Scott Jordan, Athina Markopoulou, Zubair Shafiq

Faculty Scholarship

The Federal Trade Commission can only do so much to hold tech companies accountable. Enforcement agencies and the people they protect need help. One problem is that the inner workings of large organizations and complex algorithmically driven systems remain obscure and opaque while their privacy representations are voluminous and vague. In this Essay, we propose a scientific approach to tech accountability, where academic researchers can play a larger role in privacy policy. This approach involves surfacing a company’s privacy representations and statements, as well as measuring the actual behavior of their systems with respect to algorithms, user interfaces, and data …

A Concrete Proposal For Data Loyalty, Neil Richards, Woodrow Hartzog, Jordan Francis

Faculty Scholarship

Congress and state legislators are finally experimenting with new privacy frameworks, rights, and duties to move past the thoroughly critiqued “notice and choice” model for data privacy. While many new privacy proposals seek a more fortified version of the fair information practices, some legislators have placed a duty of data loyalty at the heart of their proposed privacy bills. This is important because a duty of data loyalty has the potential to anchor American privacy law in a way analogous to how the European Union approach is grounded in fundamental rights of privacy and data protection.

Unfortunately, there remains some …

Privacy Qui Tam, Peter Ormerod

Notre Dame Law Review

Privacy law keeps getting stronger, but surveillance-based businesses have proven immune to these new legal regimes. The disconnect between privacy law in theory and in practice is a multifaceted problem, and one critical component is enforcement.

Today, most privacy laws are enforced by governmental regulators—the Federal Trade Commission, the nascent California Privacy Protection Agency, and state attorneys general. An enduring impasse for proposed privacy laws is whether to supplement public enforcement by using a private right of action to authorize individuals to enforce the law.

Both of these conventional enforcement schemes have significant shortcomings. Public enforcement has proven inadequate because …

Physiognomic Artificial Intelligence, Luke Stark, Jevan Hutson

Articles

The reanimation of the pseudosciences of physiognomy and phrenology at scale through computer vision and machine learning is a matter of urgent concern. This Article—which contributes to critical data studies, consumer protection law, biometric privacy law, and antidiscrimination law—endeavors to conceptualize and problematize physiognomic artificial intelligence (“AI”) and offer policy recommendations for state and federal lawmakers to forestall its proliferation.

Physiognomic AI, as this Article contends, is the practice of using computer software and related systems to infer or create hierarchies of an individual’s body composition, protected class status, perceived character, capabilities, and future social outcomes based on their physical …

Four Privacy Stories And Two Hard Cases, A Comment On Skinner-Thompson's Privacy At The Margins, Jessica Silbey

Faculty Scholarship

Scott Skinner-Thompson's new book, Privacy at the Margins, is what I would call a "fourth-generation" study of privacy law. Privacy's contours and justifications have been debated over the course of the twentieth century, first to establish it as a matter deserving legal protection (roughly the first half of the twentieth century), ² then to iterate its various common law and constitutional variations (starting in the 1960s), ³ and since the computer and internet revolution of the 1990s, to reevaluate privacy's growing importance but waning presence in the digitally-networked age.⁴ The third-generation of privacy scholarship has been a fast-growing area …

Data Privacy Regulations In The United States, China, And The European Union, Charlsey A. Kelly

Honors College Theses

This paper compares and discusses the different data privacy regulations found in the United States, China, and the European Union. It is no secret that big tech companies like Facebook and Google continuously collect data on their users. The big question is what protections and rights one has as a consumer. The answer to this question differs when you are in different parts of the world. Currently the United States does not have a federal data privacy law, China recently adopted a new data privacy law called the Personal Information Protection Law, and the European Union has a data privacy …

Whither Privacy Protection In The Law Of Nuisance, Cheng Lim Saw, Aaron Yoong

Research Collection Yong Pung How School Of Law

Privacy-related concerns often feature in disputes involving the tort of private nuisance. Despite the growing importance ascribed to the protection of an individual’s privacy in the modern world, English law has tended to shy away from allowing such concerns to influence the thinking behind the more traditional areas of law (like nuisance). This article examines and questions the various notions that underpin this English approach. Using the recent decisions of Giles Duncan Fearn v The Board of Trustees of the Tate Gallery [2019] EWHC 246 (Ch) and Giles Fearn v The Board of Trustees of the Tate Gallery [2020] EWCA …

Sociotechnical Safeguards For Genomic Data Privacy, Ellen W. Clayton, Zhiyu Wan, Et Al.

Vanderbilt Law School Faculty Publications

Recent developments in a variety of sectors, including health care, research and the direct-to-consumer industry, have led to a dramatic increase in the amount of genomic data that are collected, used and shared. This state of affairs raises new and challenging concerns for personal privacy, both legally and technically. This Review appraises existing and emerging threats to genomic data privacy and discusses how well current legal frameworks and technical safeguards mitigate these concerns. It concludes with a discussion of remaining and emerging challenges and illustrates possible solutions that can balance protecting privacy and realizing the benefits that result from the …

Data Property, James Grimmelmann, Christina Mulligan

American University Law Review

In this, the Information Age, people and businesses depend on data. From your family photos to Google’s search index, data has become one of society’s most important resources. But there is a gaping hole in the law’s treatment of data. If someone destroys your car, they have committed the tort of conversion, and the law gives a remedy. But if someone deletes your data, it is far from clear that they have done you a legally actionable wrong. If you are lucky, and the data was stored on your own computer, you may be able to sue them for trespass …

The Anomaly That Is Privacy: Data Privacy Concerns Related To The Rise Of Microchip Implants In Humans, Kendra Lobban

Catholic University Journal of Law and Technology

No abstract provided.

A Proportionality-Based Framework For Government Regulation Of Digital Tracing Apps In Times Of Emergency, Sharon Bassan

Dickinson Law Review (2017-Present)

Times of emergency present an inherent conflict between the public interest and the preservation of individual rights. Such times require granting emergency powers to the government on behalf of the public interest and relaxing safeguards against government actions that infringe rights. The lack of theoretical framework to assess governmental decisions in times of emergency leads to a polarized and politicized discourse about potential policies, and often, to public distrust and lack of compliance.

Such a discourse was evident regarding Digital Tracing Apps (“DTAs”), which are apps installed on cellular phones to alert users that they were exposed to people who …

Property Prohibitions: Why Criminalizing Prostitution Violates Constitutional Guarantees, James J. Bernstein

University of San Francisco Law Review

No abstract provided.

Returning To The Start? Federal Bipa Claims After Transunion V. Ramirez, Michael Goodyear

Articles & Chapters

The Illinois Biometric Information Privacy Act, more commonly known as “BIPA,” was the first statute to protect biometric privacy in the United States when it was passed in 2008. Although Texas and Washington have since passed their own biometric privacy laws, and other states have protected biometric information as part of more general data privacy legislation, BIPA remains the most powerful such law in the country due to being the only biometric privacy law to contain a private right of action. BIPA has also proven to be an important precedent for other states, such as New York, that are currently …

Alexa Hears With Her Little Ears—But Does She Have The Privilege?, Lauren Chlouber Howell

St. Mary's Law Journal

Abstract forthcoming.

Envisioning The Ftc As A Facilitator Of Blockchain Technology Adoption In The Direct-To-Consumer Genetic Testing Industry, Noah Spector

Vanderbilt Journal of Entertainment & Technology Law

Seemingly overnight, the kingpins of the direct-to-consumer genetic testing (DTC-GT) industry shifted their focus from exploring their customers’ DNA to commodifying it. Companies like Ancestry or 23andMe that were once exclusively known as mere sources of “infotainment” now regularly sell consenting customers’ genetic data to pharmaceutical researchers or use it to develop drugs of their own. To gain these customers’ consent, both firms employ a series of long, complex clickwrap contracts that largely fail to apprise their readers of the potential risks of sharing their genetic data. Nor do these agreements provide any form of compensation to those consumers whose …

Send The Word Over There: An Offshore Solution To The Right To Be Forgotten, Jay Kaganoff

Northwestern Journal of International Law & Business

The right to be forgotten is a subject of contention in both the United States and the European Union. In the E.U., the right to be forgotten gives one the right to demand that information—even if published legitimately—be taken down or removed from search engine results. While well-intentioned, this has led to concerns of free press restrictions. In contrast, the right to be forgotten is not recognized in the U.S., although there are scholars who would like to see such a right here. This Note takes the view that introducing a right to be forgotten would be contrary to the …

If You Don't Care, Who Will?, Chad J. Pomeroy

Faculty Articles

As a property law professor, I have lately found myself thinking a lot about privacy rights. Initially, the two topics (property and privacy) perhaps do not seem closely related, but I think they are—or, at least, I think the tie between the two is becoming much more pronounced and important, as modern life becomes ever more techno-centric. specifically, I think that privacy rights are, at this point, essentially an outgrowth of property rights. That is, one's right to privacy is dependent on what we traditionally view as one's property rights. At least, I think this is the current state of …

Privacy Asymmetries: Access To Data In Criminal Defense Investigations, Rebecca Wexler

Faculty Scholarship

This Article introduces the phenomenon of “privacy asymmetries,” which are privacy statutes that permit courts to order disclosures of sensitive information when requested by law enforcement but not when requested by criminal defense counsel. In the U.S. adversarial criminal legal system, defense counsel are the sole actors tasked with investigating evidence of innocence. Law enforcement has no constitutional, statutory, or formal ethical duty to seek out evidence of innocence. Therefore, statutes that selectively suppress defense investigations selectively suppress evidence of innocence. Privacy asymmetries form a recurring, albeit previously unrecognized, pattern in privacy statutes. They likely arise from legislative oversight and …

A New Common Law Of Web Scraping, Benjamin L.W. Sobel

Lewis & Clark Law Review

The Clearview AI facial recognition scandal is a monumental breach of privacy that arrived at a particularly inopportune time. A shadowy company reportedly scraped billions of publicly-available images from social media platforms and compiled them into a facial recognition database that it made available to law enforcement and private industry. To make matters worse, the scandal came to light just months after the Ninth Circuit’s decision in hiQ v. LinkedIn, which held that scraping the public web probably does not violate the Computer Fraud and Abuse Act (CFAA). Before hiQ, the CFAA would have seemed like the surest route to …