Privacy Law Commons^™

Leveling Up To A Reasonable Woman's Expectation Of Privacy, Victoria Schwartz

University of Colorado Law Review

Various privacy law doctrines involve a reasonable expectation of privacy or similar analyses that take into account social privacy norms. For the most part, however, neither courts nor scholars have explicitly grappled with whether courts descriptively do or normatively should consider gender in deciding what constitutes a reasonable expectation of privacy. This is despite the fact that, in various scenarios, a reasonable woman’s expectation of privacy might vary from a man’s in light of different lived experiences, biological differences, and existing societal gendered privacy norms.

This Article addresses how courts do and should take into account a reasonable woman’s expectation …

Making Privacy Injuries Concrete, Peter Ormerod

Washington and Lee Law Review

In recent years, the U.S. Supreme Court has repeatedly said that the doctrine of Article III standing deprives the federal courts of jurisdiction over some lawsuits involving intangible injuries. The lower federal courts are carrying out the Supreme Court’s instructions, and privacy injuries have borne the brunt of the Court’s directive. This Article identifies two incoherencies in the Court’s recent intangible injury decisions and builds on the work of privacy scholars to fashion a solution.

The first incoherency is a line-drawing problem: the Court has never explained why some intangible injuries create an Article III injury in fact while others …

Data Breach Notification Laws And The Quantum Decryption Problem, Phillip Harmon

Washington and Lee Law Review

In the United States, state data breach notification laws protect citizens by forcing businesses to notify those citizens when their personal information has been compromised. These laws almost universally include an exception for encrypted personal data. Modern encryption methods make encrypted data largely useless, and the notification laws aim to encourage good encryption practices.

This Note challenges the wisdom of laws that place blind faith in the continued infallibility of encryption. For decades, Shor’s algorithm has promised polynomial-time factoring once a sufficiently powerful quantum computer can be built. Competing laboratories around the world steadily continue to march toward this end. …

Comment: The Necessary Evolution Of State Data Breach Notification Laws: Keeping Pace With New Cyber Threats, Quantum Decryption, And The Rapid Expansion Of Technology, Beth Burgin Waller, Elaine Mccafferty

Washington and Lee Law Review

The legal framework that was built almost two decades ago now struggles to keep pace with the rapid expansion of technology, including quantum computing and artificial intelligence, and an ever-evolving cyber threat landscape. In 2002, California passed the first data breach notification law, with all fifty states following suit to require notice of unauthorized access to and acquisition of an individual’s personal information.1 These data breach notification laws, originally designed to capture one-off unauthorized views of data in a computerized database, were not built to address PowerShell scripts by cyber terrorists run across thousands of servers, leaving automated accessed data …

The Anomaly That Is Privacy: Data Privacy Concerns Related To The Rise Of Microchip Implants In Humans, Kendra Lobban

Catholic University Journal of Law and Technology

No abstract provided.

Defrosting The Chill: How Facial Recognition Technology Threatens Free Speech, Kirsten E. Roy

Roger Williams University Law Review

No abstract provided.

A Zebra's Trust: How Rare Disease Communities' Participation In Data Trusts' Governance Builds Trust And Drives Research, Samantha C. Smith

Vanderbilt Journal of Transnational Law

Data sharing plays an increasingly prominent role in society, but it remains a necessary component of rare disease research. Because rare diseases are--as the name indicates-- rare, researchers have only a small number of patients from whom to collect data, and the expense of cross-border data sharing to increase research data is significant. Nevertheless, the rise of artificial intelligence and precision medicine increases the need for usable rare disease data. Current legislation and regulations aimed at addressing rare diseases fall short in addressing these data sharing needs for rare disease research. While the European Union (EU) has invested in rare …

Verification Dilemmas In Law And The Promise Of Zero-Knowledge Proofs, Kenneth A. Bamberger, Ron Canetti, Shafi Goldwasser, Evan J. Zimmerman

Faculty Scholarship

Individuals who wish to access a website or qualify for a loan are expected to expose personally identifying information, undermining their privacy and security. Firms share proprietary information in dealmaking negotiations which, if the deal fails, may be used by the negotiating partner for a competitive advantage. Regulators are expected to disclose their algorithmic tools to comply with public transparency and oversight requirements, a practice that risks rendering these tools circumventable and ineffective. Litigants might have to reveal trade secrets in court proceedings to prove a claim or defense. Such “verification dilemmas” — costly choices between opportunities that require the …

A Proportionality-Based Framework For Government Regulation Of Digital Tracing Apps In Times Of Emergency, Sharon Bassan

Dickinson Law Review (2017-Present)

Times of emergency present an inherent conflict between the public interest and the preservation of individual rights. Such times require granting emergency powers to the government on behalf of the public interest and relaxing safeguards against government actions that infringe rights. The lack of theoretical framework to assess governmental decisions in times of emergency leads to a polarized and politicized discourse about potential policies, and often, to public distrust and lack of compliance.

Such a discourse was evident regarding Digital Tracing Apps (“DTAs”), which are apps installed on cellular phones to alert users that they were exposed to people who …

Accidental Wiretaps: The Implications Of False Positives By Always-Listening Devices For Privacy Law & Policy, Lindsey Barrett, Ilaria Liccardi

Oklahoma Law Review

No abstract provided.

Tiktok, Wechat, And National Security: Toward A U.S. Data Privacy Framework, Robert L. Rembert

Oklahoma Law Review

No abstract provided.

Bringing Down Big Data: A Call For Federal Data Privacy Legislation, Madeline M. Cook

Oklahoma Law Review

No abstract provided.

Face The Facts, Or Is The Face A Fact?: Biometric Privacy In Publicly Available Data, Daniel Levin

Fordham Intellectual Property, Media and Entertainment Law Journal

Recent advances in biometric technologies have caused a stir among the privacy community. Specifically, facial recognition technologies facilitated through data scraping practices have called into question the basic precepts we had around exercising biometric privacy. Yet, in spite of emerging case law on the permissibility of data scraping, comparatively little attention has been given to the privacy implications endemic to such practices.

On the one hand, privacy proponents espouse the view that manipulating publicly available data from, for example, our social media profiles, derogates from users’ expectations around the kind of data they share with platforms (and the obligations such …

Failed Analogies: Justice Thomas’S Concurrence In Biden V. Knight First Amendment Institute, Sarah S. Seo

Fordham Intellectual Property, Media and Entertainment Law Journal

Twenty-six years ago, twenty-six words created the internet. Section 230 of the Communications Decency Act is a short, yet powerful, provision that notably protects social media platforms, among other interactive computer services, from liability for content created by third-party users. At the time of its enactment, Section 230 aimed to encourage the robust growth of the then-nascent internet while protecting it from government regulation. More recently, however, it has been wielded by Big Tech companies like Twitter and Facebook to prevent any liability for real-world harms that stem from virtual interactions conducted over their platforms.

Although the Supreme Court has …

Patching The Data Security Blanket: How A Stronger, Collaborative Ftc Is The Answer Right Under Our Nose, Jose A. Gonzalez Lopez

Marquette Intellectual Property & Innovation Law Review

None

Property Prohibitions: Why Criminalizing Prostitution Violates Constitutional Guarantees, James J. Bernstein

University of San Francisco Law Review

No abstract provided.

The Reasonable Intelligence Agency, Asaf Lubin

Articles by Maurer Faculty

Article 57(2) of the First Additional Protocol to the Geneva Conventions requires parties to an armed conflict to “do everything feasible to verify” their objects of attack and take “all precautions” to minimize civilian casualties and unintentional damage to civilian property. This obligation has been interpreted in international law to require state parties to set up an “effective intelligence gathering system” that would properly identify targets using all technical means at the disposal of the combating forces.

But existing law has failed to define what “effective intelligence” looks like. Quite the opposite. Modern history is filled with examples of intelligence …

“I Bet You Don’T Get What We Get”: An Intersectional Analysis Of Technology-Facilitated Violence Experienced By Racialized Women Anti- Violence Online Activists In Canada, Nasreen Rajani

Canadian Journal of Law and Technology

Despite growing attention to violence that women face in online settings, a relatively small proportion of academic work centres on the experiences and perspectives of racialized women in Canada. Informed by an intersectional framework, I draw on semi-structured interviews with nine women across Canada, all of whom are involved in anti-violence online activism, about their experiences of technology-facilitated violence (TFV). Their experiences revealed less prominent narratives, including instances of TFV beyond instances of intimate partner violence (IPV) and beyond sources of anonymous trolling by supposed white men, such as violence perpetrated by peers, white women, and racialized men. In this …

Intimate Images And Authors’ Rights: Non- Consensual Disclosure And The Copyright Disconnect, Meghan Sali

Canadian Journal of Law and Technology

This article responds to a brand of legal realpolitik that says using property law to respond to the non-consensual distribution of intimate images (NCDII) is appropriate and even necessary, because its remedial frameworks are well developed and provide the relief that is often most sought after by targets of an assault: the immediate removal of photos from online platforms. While some targets are not considered the ‘‘authors’’ of their intimate images, most of the images that are the subject of NCDII are selfies, taken by the target themselves. In these cases, that person rightfully owns the copyright in those images …

On The Internet, Nobody Knows You Are A Dog: Contested Authorship Of Digital Evidence In Cases Of Gender-Based Violence, Suzie Dunn, Moira Aikenhead

Canadian Journal of Law and Technology

We examine various aspects of digital evidence at GBV trials, drawing on relevant Canadian criminal case law. First, we describe some of the unique challenges related to electronic documents generally with respect to determining authorship. Second, we review some of the historical and ongoing practices within the criminal justice system that rely on harmful gendered myths about GBV and note the potential for these myths to emerge in relation to digital evidence. Third, we discuss the duty of investigating police officers to gather the necessary available digital evidence to demonstrate authorship and note potential gaps in current investigatory practices that …

Responding To Deficiencies In The Architecture Of Privacy: Co-Regulation As The Path Forward For Data Protection On Social Networking Sites, Laurent Cre ́Peau

Canadian Journal of Law and Technology

Social Networking Sites like Facebook, Twitter and the like are a ubiquitous part of contemporary culture. Yet, as exemplified on numerous occasions, most recently in the Cambridge Analytica scandal that shook Facebook in 2018, these sites pose major concerns for personal data protection. Whereas self-regulation has characterized the general regulatory mindset since the early days of the Internet, it is no longer viable given the threat social media poses to user privacy. This article notes the deficiencies of self-regulatory models of privacy and contends jurisdictions like Canada should ensure they have strong data protection regulations to adequately protect the public. …

Artificial Intelligence In Canadian Healthcare: Will The Law Protect Us From Algorithmic Bias Resulting In Discrimination?, Bradley Henderson, Colleen M. Flood, Teresa Scassa

Canadian Journal of Law and Technology

In this article, we canvas why AI may perpetuate or exacerbate extant discrimination through a review of the training, development, and implementation of healthcare-related AI applications and set out policy options to militate against such discrimination. The article is divided into eight short parts including this introduction. Part II focuses on explaining AI, some of its basic functions and processes, and its relevance to healthcare. In Part III, we define and explain the difference and relationship between algorithmic bias and data bias, both of which can result in discrimination in healthcare settings, and provide some prominent examples of healthcare-related AI …

Delineating The Legal Framework For Data Protection: A Fundamental Rights Approach Or Data Propertization?, Efe Lawrence Ogbeide

Canadian Journal of Law and Technology

The Charter of Fundamental Rights of the European Union, like other key legal instruments around the globe, grants citizens the right to privacy in Article 7. The Charter, however, further provides for the right to data protection in Article 8. Simply put, the implication of Article 8 of the Charter is that the right to data protection is a fundamental right. The central question in this article is whether data protection indeed qualifies to be categorized as a fundamental right. If not, what other approach(es) to data protection may be implemented?

From Nyan Cat To Nfts: Determining How Canada’S Cultural Property Export And Import Act Applies To Digital Works, Mitchel Fleming

Canadian Journal of Law and Technology

One of Canada’s principal pieces of legislation enacted to protect its cultural patrimony is not well equipped to deal with the rise of digital content creation. Digital works, particularly NFTs, pose a unique challenge to the established regime. This paper seeks to understand how these artistic developments fit within the current legislative framework and whether legislative action is needed to bring these revolutionary mediums within the scope of the Cultural Property Export and Import Act. Ultimately, the author concludes that while digital works may be captured by the Act under specific circumstances, the protectionist policies of the past are …

Officially Obsolete? A Critical Examination Of The Canadian Official Marks Regime And Its Waning Relevancy In Trademark Law, Maddison Tebbutt

Canadian Journal of Law and Technology

When the Trademark Act (‘‘TMA”) came about in 1985, a unique aspect of Canadian trademark law was created: the official marks regime under section 9(1)(n). The official marks regime is available to public authorities and universities as a means of sidestepping the lengthy and expensive process of trademark registration and providing special protection for official marks. Once public authorities and universities obtain an official mark through this system, they are entitled to an expansive monopoly that allows them to use their mark for commercial use, while simultaneously keeping the official mark out of the public domain. Moreover, while …

Returning To The Start? Federal Bipa Claims After Transunion V. Ramirez, Michael Goodyear

Articles & Chapters

The Illinois Biometric Information Privacy Act, more commonly known as “BIPA,” was the first statute to protect biometric privacy in the United States when it was passed in 2008. Although Texas and Washington have since passed their own biometric privacy laws, and other states have protected biometric information as part of more general data privacy legislation, BIPA remains the most powerful such law in the country due to being the only biometric privacy law to contain a private right of action. BIPA has also proven to be an important precedent for other states, such as New York, that are currently …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

Table of Contents

Legislating Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

The Gdpr As Privacy Pretext And The Problem Of Co-Opting Privacy, Neil M. Richards

Scholarship@WashULaw

Privacy and data protection law's expansion brings with it opportunities for mischief as privacy rules are used pretextually to serve other ends. This Essay examines the problem of such co-option of privacy using a case study of lawsuits in which defendants seek to use the EU’s General Data Protection Regulation (“GDPR”) to frustrate ordinary civil discovery. In a series of cases, European civil defendants have argued that the GDPR requires them to redact all names from otherwise valid discovery requests for relevant evidence produced under a protective order, thereby turning the GDPR from a rule designed to protect the fundamental …

Comments Of The Cordell Institute On The Prevalence Of Commercial Surveillance And Data Security Practices That Harm Consumers, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

These comments are a response to the Federal Trade Commission's 2022 advance notice of proposed rulemaking (“ANPR”) requesting public comment on the prevalence of commercial surveillance and data security practices that harm consumers (Commercial Surveillance ANPR, R111004).

In an increasingly digitized world, data collection, processing, and transfer have become integral to market interactions. Our personal and commercial experiences are now mediated by powerful, information-intensive firms who hold the power to shape what consumers see, how they interact, which options are available to them, and how they make decisions. That power imbalance exposes consumers and leaves them all vulnerable. We all …