Legal Studies Commons^™

Data Rights For Workers, Pauline Kim, Rachel Leavitt

Scholarship@WashULaw

Workers are subject to immense amounts of data collection on the job, and the algorithmic management tools built with that data can produce negative effects, including deskilling jobs, unstable work hours, reduced wages, and dangerous and degrading working conditions. Workers thus have significant interests how their data are collected and used, and yet they have been excluded from nearly all the recently enacted or proposed data protection laws. Their exclusion stems from data protection’s roots in privacy law and theory, which primarily focused on consumers as data subjects. Current data protection laws, even if expanded to cover workers, would provide …

Ai Ethics, Law, And Policy, Pauline Kim, Ryan Durrie

Scholarship@WashULaw

AI technologies promise many benefits, but they can also have significant negative impacts on human health, safety, well-being, and fundamental rights. This chapter explores the different governance tools that have been considered for guiding developments in AI in socially beneficial ways, examining the relevance of ethics, law, and policy. Each of these approaches offer tools to address these concerns; however, each has limitations, and none provides a complete solution in itself. Statements of ethical principles can articulate high-level values and goals to guide behavior but are usually quite vague and difficult to operationalize. They also lack any enforcement mechanism. In …

The Role Of Investigative Genetic Genealogy In The Field Of Criminal Justice, Chloe Haas

Honors Projects

Investigative genetic genealogy is an investigative method used by law enforcement to solve crimes. It involves the uploading of DNA found at a crime scene to genealogy databases to narrow down the suspect pool. The research question for this study is: Is law enforcement’s use of investigative genetic genealogy ethical? I conducted ten interviews with individuals who had a background in the Criminal Justice field, the legal field, the forensics field, and the field of genealogy to see their opinions on this topic. A majority of the participants in this study stated that they believe that law enforcement should be …

Book Review: Tracers In The Dark: The Global Hunt For The Crime Lords Of Cryptocurrency, Marion Jones

International Journal of Cybersecurity Intelligence & Cybercrime

Doubleday released Andy Greenberg’s Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency in November 2022. Through vivid case studies of global criminal investigations, the book dispels myths about the anonymizing power of cryptocurrency. The book details how the ability to identify cryptocurrency users and payment methods successfully brought down several large criminal empires, while also highlighting the continuous cat-and-mouse game between law enforcement officials and criminal actors using cryptocurrency. The book is an excellent resource for law enforcement officials, academics, and general cybersecurity practitioners interested in cryptocurrency-related criminal activities and law enforcement techniques.

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Measuring Compliance With The California Consumer Privacy Act Over Space And Time, Jens Frankenreiter, Van Tran, Aarushi Mehrotra, Marshini Chetty, Nick Feamster, Lior Strahilevitz

Scholarship@WashULaw

The widespread sharing of consumers personal information with third parties raises significant privacy concerns. The California Consumer Privacy Act (CCPA) mandates that online businesses offer consumers the option to opt out of the sale and sharing of personal information. Our study automatically tracks the presence of the opt-out link longitudinally across multiple states after the California Privacy Rights Act (CPRA) went into effect. We categorize websites based on whether they are subject to CCPA and investigate cases of potential non-compliance. We find a number of websites that implement the opt-out link early and across all examined states but also find …

Reflections On “Personal Responsibility” After Covid And Dobbs: Doubling Down On Privacy, Susan Frelich Appleton, Laura A. Rosenbury

Scholarship@WashULaw

This essay uses lenses of gender, race, marriage, and work to trace understandings of “personal responsibility” in laws, policies, and conversations about public support in the United States over three time periods: (I) the pre-COVID era, from the beginning of the American “welfare state” through the start of the Trump administration; (II) the pandemic years; and (III) the present post-pandemic period. We sought to explore the possibility that COVID and the assistance programs it inspired might have reshaped the notion of personal responsibility and unsettled assumptions about privacy and dependency. In fact, a mixed picture emerges. On the one hand, …

A Concrete Proposal For Data Loyalty, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

Congress and state legislators are finally experimenting with new privacy frameworks, rights, and duties to move past the thoroughly critiqued “notice and choice” model for data privacy. While many new privacy proposals seek a more fortified version of the fair information practices, some legislators have placed a duty of data loyalty at the heart of their proposed privacy bills. This is important because a duty of data loyalty has the potential to anchor American privacy law in a way analogous to how the European Union approach is grounded in fundamental rights of privacy and data protection.

Unfortunately, there remains some …

Incomplete Contracts And Future Data Usage, Jens Frankenreiter, Talia B. Gillis, Dan Svirsky

Scholarship@WashULaw

Most major jurisdictions require websites to provide customers with privacy policies. For consumers, a privacy policy's most important function is to provide them with a description of the online service provider's current privacy practices. We argue that these policies also serve a second, often-overlooked function: they allocate residual data usage rights to online services or consumers, including the power to decide whether a service can modify its privacy practices and use consumer data in novel ways. We further argue that a central feature of the E.U.'s General Data Protection Regulation (GDPR), one of the most comprehensive and far-reaching privacy regulatory …

What You See You Perceive: Public Opinions Of Potential Negative Consequences And Support For Officer Body-Worn Cameras, Jordyn Marian Sanders

UNLV Theses, Dissertations, Professional Papers, and Capstones

Officer-body worn cameras (BWCs) are used in policing to provide visuals from the perspective of the officer during interactions with the community. BWCs are often promoted for the ability to improve the relationship between the community and police by providing accurate and transparent accounts of the interactions. Millions of dollars have been spent to distribute BWCs to police departments across the Unites States, with an estimated 80% of departments implementing the devices through various policies and procedures (White & Malm, 2020). Most studies on BWCs have provided empirical evidence showing the potential benefits of the devices in policing (Lum et …

Comments Of The Cordell Institute On The Prevalence Of Commercial Surveillance And Data Security Practices That Harm Consumers, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

These comments are a response to the Federal Trade Commission's 2022 advance notice of proposed rulemaking (“ANPR”) requesting public comment on the prevalence of commercial surveillance and data security practices that harm consumers (Commercial Surveillance ANPR, R111004).

In an increasingly digitized world, data collection, processing, and transfer have become integral to market interactions. Our personal and commercial experiences are now mediated by powerful, information-intensive firms who hold the power to shape what consumers see, how they interact, which options are available to them, and how they make decisions. That power imbalance exposes consumers and leaves them all vulnerable. We all …

The Surprising Virtues Of Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

The New Bailments, Danielle D'Onfro

Scholarship@WashULaw

The rise of cloud computing has dramatically changed how consumers and firms store their belongings. Property that owners once managed directly now exists primarily on infrastructure maintained by intermediaries. Consumers entrust their photos to Apple instead of scrapbooks; businesses put their documents on Amazon’s servers instead of in file cabinets; seemingly everything runs in the cloud. Were these belongings tangible, the relationship between owner and intermediary would be governed by the common-law doctrine of bailment. Bailments are mandatory relationships formed when one party entrusts their property to another. Within this relationship, the bailees owe the bailors a duty of care …

Legislating Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

Digitizing And Disclosing Personal Data: The Proliferation Of State Criminal Records On The Internet, Sarah E. Lageson, Elizabeth H. Webster, Juan R. Sandoval

Criminal Justice & Criminology: Faculty Publications & Other Works

Digitization and the release of public records on the Internet have expanded the reach and uses of criminal record data in the United States. This study analyzes the types and volume of personally identifiable data released on the Internet via two hundred public governmental websites for law enforcement, criminal courts, corrections, and criminal record repositories in each state. We find that public disclosures often include information valuable to the personal data economy, including the full name, birthdate, home address, and physical characteristics of arrestees, detainees, and defendants. Using administrative data, we also estimate the volume of data disclosed online. Our …

Constitutional Pandemic Surveillance, Matthew B. Kugler, Mariana Oliver

Journal of Criminal Law and Criminology

How do people view governmental pandemic surveillance? And how can their views inform courts considering the constitutionality of digital monitoring programs aimed at containing the spread of a highly contagious diseases? We measure the perceived intrusiveness of pandemic surveillance through two nationally representative surveys of Americans. Our results show that even at the height of a pandemic people find surveillance for public health to be more intrusive than surveillance for traditional law enforcement purposes. To account for these strong privacy concerns, we propose safeguards that we believe would make cell phone location tracking and other similar digital monitoring regimes constitutionally …

Artificial Intelligence And The Challenges Of Workplace Discrimination And Privacy, Pauline Kim, Matthew T. Bodie

Scholarship@WashULaw

Employers are increasingly relying on artificially intelligent (AI) systems to recruit, select, and manage their workforces, raising fears that these systems may subject workers to discriminatory, invasive, or otherwise unfair treatment. This article reviews those concerns and provides an overview of how current laws may apply, focusing on two particular problems: discrimination on the basis of protected characteristics like race, sex, or disability, and the invasion of workers’ privacy engendered by workplace AI systems. It discusses the ways in which relying on AI to make personnel decisions can produce discriminatory outcomes and how current law might apply. It then explores …

Ai And Inequality, Pauline Kim

Scholarship@WashULaw

This Chapter examines the social consequences of artificial intelligence (AI) when it is used to make predictions about people in contexts like employment, housing and criminal law enforcement. Observers have noted the potential for erroneous or arbitrary decisions about individuals; however, the growing use of predictive AI also threatens broader social harms. In particular, these technologies risk increasing inequality by reproducing or exacerbating the marginalization of historically disadvantaged groups, and by reinforcing power hierarchies that contribute to economic inequality. Using the employment context as the primary example, this Chapter explains how AI-powered tools that are used to recruit, hire and …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

Welcome To Cordell Perspectives, Neil M. Richards, Jonathan W. Heusel

Scholarship@WashULaw

The world around us is changing. Let’s talk about it together. Introducing a series of articles and opinions by the world’s leading experts concerning COVID-19 as it relates to precision medicine and data privacy: Welcome to Cordell Perspectives.

A Relational Turn For Data Protection?, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

While most approaches to privacy and data protection focus on the data, this paper explores an alternative approach that focuses on relationships. This means looking more closely at how the people who are exposing their information and the people that are inviting that disclosure relate to each other. It is concerned with what powerful parties owe to vulnerable parties–not just with their personal information, but with the things they see, the things they can click, and the decisions that are made about them. It’s less about the nature of data and more about the nature of power. And it can …

Privacy's Constitutional Moment And The Limits Of Data Protection, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

America’s privacy bill has come due. Since the dawn of the Internet, Congress has repeatedly failed to build a robust identity for American privacy law. But now both California and the European Union have forced Congress’s hand by passing the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). These data protection frameworks, structured around principles for Fair Information Processing called the “FIPs,” have industry and privacy advocates alike clamoring for a “U.S. GDPR.” States seemed poised to blanket the country with FIP-based laws if Congress fails to act. The United States is thus in the midst …

The Invalidation Of The Eu-Us Privacy Shield And The Future Of Transatlantic Data Flows: Testimony Of Professor Neil Richards Before The United States Senate, Neil M. Richards

Scholarship@WashULaw

This is the prepared testimony and statement for the records, including responses to questions for the record of Professor Neil Richards before the United States Senate Commerce Committee on December 9, 2020. The testimony explains that while Congress has failed to pass a comprehensive privacy bill despite many opportunities, the judgment of the European Court of Justice in Data Protection Commissioner v. Facebook, (commonly known as “Schrems 2”) represents a real opportunity for it to do just that in the near future. The testimony argues first that Congress should not just pass a comprehensive privacy bill, but one that gets …

Catching Killers With Consumer Genetic Information, Angela Hackstadt

University Libraries Faculty Scholarship

In April 2018, Joseph James D'Angelo was arrested as a suspect in the Golden State Killer case. DNA evidence collected at a 1980 crime scene finally shed light on the murderer's identity in early 2018 when investigators turned to GEDMatch, a service that allows users to upload and share DNA data obtained from consumer genetic tests. Consumer genetic testing, DNA collection, and familial DNA searching all raise ethical and privacy concerns. If investigators are using genetic genealogy to solve cold cases, where does that leave consumers?

Data Mining And The Challenges Of Protecting Employee Privacy Under U.S. Law, Pauline Kim

Scholarship@WashULaw

Concerns about employee privacy have intensified with the introduction of data mining tools in the workplace. Employers can now readily access detailed data about workers’ online behavior or social media activities, purchase background information from data brokers, and collect additional data from workplace surveillance tools. When data mining techniques are applied to this wealth of data, it is possible to infer additional information about employees beyond the information that is collected directly. As a consequence, these tools can alter the meaning and significance of personal information depending upon what other information it is aggregated with and how the larger dataset …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

Criminal Employment Law, Benjamin Levin

Scholarship@WashULaw

This Article diagnoses a phenomenon, “criminal employment law,” which exists at the nexus of employment law and the criminal justice system. Courts and legislatures discourage employers from hiring workers with criminal records and encourage employers to discipline workers for non-work-related criminal misconduct. In analyzing this phenomenon, my goals are threefold: (1) to examine how criminal employment law works; (2) to hypothesize why criminal employment law has proliferated; and (3) to assess what is wrong with criminal employment law. This Article examines the ways in which the laws that govern the workplace create incentives for employers not to hire individuals with …

Four Principles For Digital Expression (You Won't Believe #3!), Neil M. Richards, Danielle Keats Citron

Scholarship@WashULaw

At the dawn of the Internet’s emergence, the Supreme Court rhapsodized about its potential as a tool for free expression and political liberation. In ACLU v. Reno (1997), the Supreme Court adopted a bold vision of Internet expression to strike down a federal law–the Communications Decency Act–that restricted digital expression to forms that were merely “decent.” Far more than the printing press, the Court explained, the mid-90s Internet enabled anyone to become a town crier. Communication no longer required the permission of powerful entities. With a network connection, the powerless had as much luck reaching a mass audience as the …

Breaking Into The Vault: Privacy, Security And Forensic Analysis Of Android Vault Applications, Xiaolu Zhang, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we share the first account for the forensic analysis, security and privacy of Android vault applications. Vaults are designed to be privacy enhancing as they allow users to hide personal data but may also be misused to hide incriminating files. Our work has already helped law enforcement in the state of Connecticut to reconstruct 66 incriminating images and 18 videos in a single criminal case. We present case studies and results from analyzing 18 Android vault applications (accounting for nearly 220 million downloads from the Google Play store) by reverse engineering them and examining the forensic artifacts …

Privacy's Trust Gap: A Review, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

It can be easy to get depressed about the state of privacy these days. In an age of networked digital information, many of us feel disempowered by the various governments, companies, and criminals trying to peer into our lives to collect our digital data trails. When so much is in flux, the way we think about an issue matters a great deal. Yet while new technologies abound, our ideas and thinking — as well as our laws — have lagged in grappling with the new problems raised by the digital revolution. In their important new book, Obfuscation: A User’s Guide …