Privacy Law Commons^™

When Law Frees Us To Speak, Danielle Keats Citron, Jonathon W. Penney

Fordham Law Review

A central aim of online abuse is to silence victims. That effort is as regrettable as it is successful. In the face of cyberharassment and sexualprivacy invasions, women and marginalized groups retreat from online engagement. These documented chilling effects, however, are not inevitable. Beyond its deterrent function, the law has an equally important expressive role. In this Article, we highlight law’s capacity to shape social norms and behavior through education. We focus on a neglected dimension of law’s expressive role: its capacity to empower victims to express their truths and engage with others. Our argument is theoretical and empirical. We …

Keep Your Friends Close And Your Medical Records Closer: Defining The Extent To Which A Constitutional Right To Informational Privacy Protects Medical Records, Lauren Newman

Journal of Law and Health

The following Article discusses the extent to which the constitutional right to informational privacy protects medical data from improper acquisition or dissemination by state agents. Part I provides background on Whalen v. Roe, the Supreme Court case that has been understood to establish the right to informational privacy. Part I also discusses the variations across the circuit courts as to what medical information is afforded protection by the right. Part II analyzes the well-established approaches adopted by the Second and Third Circuits as they present opposing interpretations of Whalen, one wholly protecting medical information and the other protecting …

Clear As Mud: Constitutional Concerns With Clear Affirmative Consent, C. Ashley Saferight

Cleveland State Law Review

Rape and sexual assault laws and policies have shifted significantly in recent years, including the introduction of affirmative consent. Unfortunately, both proponents and critics tend to confuse the issues and falsely equate affirmative consent as a substantive social standard versus a procedural standard for adjudication and punishment. Although affirmative consent generally does not represent a significant change in consent law in the United States, statutes and policies requiring a further requirement that affirmative consent be clear and unambiguous (“clear affirmative consent”) are problematic and raise constitutional concerns. When clear affirmative consent policies are used as an adjudicative standard, they increase …

American Courts And The Sex Blind Spot: Legitimacy And Representation, Michele Goodwin, Mariah Lindsay

Fordham Law Review

We argue the legacy of explicit sex bias and discrimination with relation to political rights and social status begins within government, hewn from state and federal lawmaking. As such, male lawmakers and judges conscribed a woman’s role to her home and defined the scope of her independence in the local community and broader society. Politically and legally, women were legal appendages to men—objects of male power (visà-vis their husbands and fathers). In law, women’s roles included sexual chattel to their spouses, care of the home, and producing offspring. Accordingly, women were essential in the home, as law would have it, …

Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Those who wish to control, expose, and damage the identities of individuals routinely do so by invading their privacy. People are secretly recorded in bedrooms and public bathrooms and “up their skirts.” Such images are used to coerce people into sharing nude photographs and filming sex acts under the threat of public disclosure. People’s nude images are posted online without permission. Machine-learning technology is used to create digitally manipulated “deep fake” sex videos that swap people’s faces into pornography.

Each of these abuses is an invasion of sexual privacy—the behaviors, expectations, and choices that manage access to and information about …

The Gdpr: It Came, We Saw, But Did It Conquer?, Leila Javanshir

Seattle University Law Review

On February 1, 2019, the Seattle University Law Review held its annual symposium at the Seattle University School of Law. Each year, the Law Review hosts its symposium on a topic that is timely and meaningful. This year, privacy and data security professionals from around the globe gathered to discuss the current and future effects of the General Data Protection Regulation (GDPR) that was implemented on May 25, 2018. The articles and essays that follow this Foreword are the product of this year’s symposium.

Regulating The Gdpr: Perspectives From The United Kingdom, Hannah Mccausland

Seattle University Law Review

Hannah McCausland leads the international group at the UK Information Commissioner’s Office (ICO). The ICO’s International Engagement functions as the gateway to other data protection and privacy authorities on international matters. She’s involved in the work of the EU European Data Protection Board advising the commissioner and the deputy commissioner on international positioning of the ICO, and she has played a key role over the past six years in the ICO’s strategy on navigating the EU’s data protection framework. Hannah has also played a major role at the global level and advancing the practical tools that data protection and privacy …

Privacy, Freedom, And Technology—Or “How Did We Get Into This Mess?”, Alex Alben

Seattle University Law Review

Can we live in a free society without personal privacy? The question is worth pondering, not only in light of the ongoing debate about government surveillance of private communications, but also because new technologies continue to erode the boundaries of our personal space. This Article examines our loss of freedom in a variety of disparate contexts, all connected by the thread of erosion of personal privacy. In the scenarios explored here, privacy reducing activities vary from government surveillance, personal stalking conducted by individuals, and profiling by data-driven corporations, to political actors manipulating social media platforms. In each case, new technologies …

Confiding In Con Men: U.S. Privacy Law, The Gdpr, And Information Fiduciaries, Lindsey Barrett

Seattle University Law Review

In scope, ambition, and animating philosophy, U.S. privacy law and Europe’s General Data Protection Regulation are almost diametric opposites. The GDPR’s ambitious individual rights, significant prohibitions, substantive enforcement regime, and broad applicability contrast vividly with a scattershot U.S. regime that generally prioritizes facilitating commerce over protecting individuals, and which has created perverse incentives for industry through anemic enforcement of the few meaningful limitations that do exist. A privacy law that characterizes data collectors as information fiduciaries could coalesce with the commercial focus of U.S. law, while emulating the GDPR’s laudable normative objectives and fortifying U.S. consumer privacy law with a …

General Data Protection Regulation (Gdpr): Prioritizing Resources, Jennifer Dumas

Seattle University Law Review

This Article will discuss and analyze the years of preparation for the GDPR and provide recommendations for dealing with the GDPR forevermore. It will assess whether the preparation and panic were worth it. In other words, was the time, expense, and distraction my peers and I expended and experienced over the past years proportionate to the requirements and impact of the GDPR? Further, was the high level of preparation and panic many legal departments in countless companies undertook and experienced appropriate now that we have had a chance to see the initial impact of the GDPR?

Privacy Statements Under The Gdpr, Mike Hintze

Seattle University Law Review

The need to include specific types of information in a privacy statement is a GDPR compliance obligation that does not get as much attention as some other GDPR requirements. Perhaps that is because privacy statements have been much maligned in recent years. They are too long and full of legalese. Nobody reads them. They are part of a notice and consent approach to privacy that puts an unrealistic burden on consumers to make informed choices. But despite these well-known criticisms, the GDPR doubles down on privacy statements. In fact, gauging by the roughly fourfold increase in privacy statement requirements compared …

Requiem For Cyberspace: The Effect Of The European General Privacy Regulation On The Global Internet, Steven Tapia

Seattle University Law Review

The dream of a perpetual, limitless, non-dimensional space is an idea that has transfixed clergy, philosophers, and poets for ages. Whether it is called “heaven,” “the afterlife,” “nirvana,” or another linguistic stand-in, the dream of a dimension beyond the bounds of time, space, and the laws of nature seems as universal as any concept ever. From its initial development in the 1970s (as a military, academic, and governmental experiment in creating a wholly alternative means of communication capable of surviving catastrophic failures of any parts of the communications conduits) until essentially now, the Internet seemed to be the closest incarnate …

Footprints: Privacy For Enterprises, Processors, And Custodians…Oh My!, Blair Witzel, Carrie Mount

Seattle University Law Review

Americans’ interest in privacy—as evidenced by increasing news coverage, online searches, and new legislation—has grown over the past decade. After the European Union enacted the General Data Protection Regulation (GDPR), technologists and legal professionals have focused on primary collectors of data—known under various legal regimes as the “controller” or “custodian.” Thanks to advances in computing, many of these data collectors offload the processing of data to third parties providing data-related cloud services like Amazon, Microsoft, and Google. In addition to the data they have already collected about the data subjects themselves, these companies now “hold” that data on behalf of …

Gdpr Compliance—It Takes A Village, Susy Mendoza

Seattle University Law Review

When the General Data Protection Regulation (GDPR) came into effect in May of 2018, many legal departments were confronted with the gravity of just how they were going to comply with such a wide-reaching law. If you have international customers (both direct to consumer or business to business), it is not hard to convince your general counsel that compliance with the GDPR is a must. You may even be able to get the chief technical officer (CTO) or chief operating officer (COO) onboard just by mentioning the steep fines—two to four percent of worldwide gross revenue. But how does the …

Alexa, Amazon Assistant Or Government Informant?, Julia R. Shackleton Esq.

University of Miami Business Law Review

Alexa, are you listening to me? Technology has become an integral part of one’s everyday life with voice-controlled devices pervading our most intimate interactions and spaces within the home. The answers to our questions are now at our fingertips with the simple roll of the tongue “Alexa,” your very own personal intelligence assistant. This futuristic household tool can perform tasks that range from answering simple voice commands to ordering any online shopping. However, the advent of voice technology presents a myriad of problems. Concerns arise as these new devices live in the privacy of our homes while quietly listening for …

No Means No: An Argument For The Expansion Of Rape Shield Laws To Cases Of Nonconsensual Pornography, Austin Vining

William & Mary Journal of Race, Gender, and Social Justice

This Article considers the impact of a hypothetical nonconsensual pornography victim’s previous sexual history on potential legal remedies, both criminal and civil. Due to jury bias and the difficulty in proving standard elements of many claims, the research shows that such a victim would likely be unsuccessful in court. This Article then turns to two legal concepts from related fields—the incremental harm doctrine and rape shield laws—and considers what effect their application would have on the hypothetical victim’s case. Ultimately, the author presents an argument for the logical expansion of rape shield laws to cases of nonconsensual pornography.

Science And Privacy: Data Protection Laws And Their Impact On Research, Mike Hintze

Washington Journal of Law, Technology & Arts

While privacy laws differ in their scope, focus, and approach, they all involve restrictions on the collection, use, sharing, or retention of information about people. In general, privacy laws reflect a societal consensus that privacy violations can lead to a wide range of financial, reputational, dignitary, and other harms, and that excessive collection and harmful uses of personal information should therefore be constrained. These laws require organizations to comply with a number of obligations concerning personal information. In practice, these requirements can lead organizations to refrain from collecting certain data, only use data with the consent of the individual, or …

Data Re-Use And The Problem Of Group Identity, Leslie Francis, John G. Francis

Utah Law Faculty Scholarship

Reusing existing data sets of health information for public health or medical research has much to recommend it. Much data repurposing in medical or public health research or practice involves information that has been stripped of individual identifiers but some does not. In some cases, there may have been consent to the reuse but in other cases consent may be absent and people may be entirely unaware of how the data about them are being used. Data sets are also being combined and may contain information with very different sources, consent histories, and individual identifiers. Much of the ethical and …

Privacy Remedies, Lauren H. Scholz

Indiana Law Journal

When consumers sue companies for privacy-intrusive practices, they are often unsuccessful. Many cases fail in federal court at the motion to dismiss phase because the plaintiff has not shown the privacy infringement has caused her concrete harm. This is a symptom of a broader issue: the failure of courts and commentators to describe the relationship between privacy rights and privacy remedies.

This Article contends that restitution is the normal measure of privacy remedies. Restitution measures relief by economic gain to the defendant. If a plaintiff can show the likely ability to recover in restitution, that should be sufficient to pass …

Deception, Professional Speech, And Cpcs: On Becerra, Abortion, And The First Amendment, Mark Strasser

Buffalo Law Review

In National Institute of Family & Life Advocates v. Becerra, the United States Supreme Court struck down a California law requiring crisis pregnancy centers to post certain signs.1 The Court implied that the case involved a relatively straightforward example of governmental overreaching, with the government allegedly attempting to commandeer private entities and force them to convey the government’s message.2 Yet, the Court omitted important background information when discussing the state’s implicated interests,3 and the Court’s analyses and rationales may have important First Amendment implications. While the Court may have reached the right result, its analyses bode poorly for a reasoned …

Rights On Publicity As Remarkably Insignificant, R. George Wright

Cleveland State Law Review

This Article introduces the right of publicity through a brief consideration of high-profile cases involving, respectively, Paris Hilton, human cannonball Hugo Zacchini, and the famous actress Olivia de Havilland. With this background understanding, the Article considers the supposed risks to freedom of speech posed by recognizing rights of publicity in a private party. From there, the Article addresses the nagging concern that the publicity rights cases promote a harmful "celebrification" of culture. Finally, the Article considers whether allowing for meaningful damage recoveries in publicity rights cases appropriately compensates victims in ways promoting the broad public interest.

Animal Healthcare Robots: The Case For Privacy Regulation, Sulaf Al-Saif

Washington Journal of Law, Technology & Arts

Animal healthcare robots are a form of healthcare or wellness devices that possess the appearance of animals or pets and that collect data on the user. The appearance, use, and nature of data collected by these robots illustrate two types of devices for which privacy regulation falls short: Internet of Things (“IoT”) devices and healthcare devices. This paper surveys the animal healthcare robots currently in the market, details the special privacy concerns associated with such robots, examines the current state of potentially relevant privacy laws, and makes recommendations for privacy regulation in the future.

Achieving The Goals Of The Value-Based Purchasing Program: Defining A Standard For External Data Use, Svetlana Makoviy

Student Award Winning Papers

In our society, artificial intelligence technology has permeated through every aspect of human life. By the end of 2019, more than 60 million Americans will use some kind of smartwatch, whether a Fitbit or an Apple Watch as a part of their daily routine. Further, over 58% of people currently use a healthcare-related mobile application, such as MyFitnessPal or Nike+ Running. Health and fitness application usage increased by over 330% in the last three years. Unsurprisingly, healthcare-related data is one of the fastest growing and financially valuable data pools in the country, if not worldwide. The volume of data generated …

Cashless Societies And The Rise Of The Independent Cryptocurrencies: How Governments Can Use Privacy Laws To Compete With Independent Cryptocurrencies, Matla Garcia Chavolla

Pace International Law Review

Many individuals (including governments) envision living in a future world where physical currency is a thing of the past. Many countries have made great strides in their efforts to go cashless. At the same time, there is increasing awareness among citizens of the decreasing amount of privacy in their lives. The potential hazards cashless societies pose to financial privacy may incentivize citizens to hold some of their money in independent cryptocurrencies. This article argues that in order for governments in cashless societies to keep firm control over their money supply, they should enact stronger privacy law protections for its citizens …

Bytes Bite: Why Corporate Data Breaches Should Give Standing To Affected Individuals, Caden Hayes

Washington and Lee Journal of Civil Rights and Social Justice

High-profile data hacks are not uncommon. In fact, according to the Privacy Rights Clearinghouse, there have been at least 7,961 data breaches, exposing over 10,000,000,000 accounts in total, since 2005. These shocking numbers are not particularly surprising when taking into account the value of information stolen. For example, cell phone numbers, as exposed in a Yahoo! hack, are worth $10 a piece on the black market, meaning the hackers stood to make $30,000,000,000 from that one hack. That dollar amount does not even consider copies the hackers could make and later resell. Yet while these hackers make astronomical payoffs, the …

Law School News: A Spring Break That Teaches - And Gives Back 03/11/2019, Edward Fitzpatrick

Life of the Law School (1993- )

No abstract provided.

Protecting Users Of Social Media, Margaret Ryznar

Notre Dame Law Review Reflection

Social media platforms started as a fun way to connect with friends and family. Since then, they have become a science fiction nightmare due to their capacity to gather and misuse the data on their users.

It is not irrational for social media providers to seek to capitalize on their data when they provide the platforms for free. Indeed, their business model is to sell data to third parties for marketing and other purposes. Yet, users should be able to expect that their data is not used to hurt them or is not sent to disreputable companies. Indeed, fewer people …

Striking A Balance: Privacy And National Security In Section 702 U.S. Person Queries, Brittany Adams

Washington Law Review

The transformation of U.S. foreign intelligence in recent years has led to increasing privacy concerns. The Foreign Intelligence Surveillance Act of 1978 (FISA) traditionally regulated foreign intelligence surveillance by authorizing warrant-based searches of U.S. and non-U.S. persons. Individualized court orders under traditional FISA were intended to protect U.S. persons and limit the scope of intelligence collection. In a post-9/11 world, however, the intelligence community cited concerns regarding the speed and efficiency of collection under traditional methods. The intelligence and law enforcement communities recognized the “wall” preventing information sharing between the communities as a central failure leading to the 9/11 attacks. …

The Public Information Fallacy, Woodrow Hartzog

Faculty Scholarship

The concept of privacy in “public” information or acts is a perennial topic for debate. It has given privacy law fits. People struggle to reconcile the notion of protecting information that has been made public with traditional accounts of privacy. As a result, successfully labeling information as public often functions as a permission slip for surveillance and personal data practices. It has also given birth to a significant and persistent misconception — that public information is an established and objective concept.

In this article, I argue that the “no privacy in public” justification is misguided because nobody knows what “public” …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

No abstract provided.