Privacy Law Commons^™

Data Breach Notification Laws And The Quantum Decryption Problem, Phillip Harmon

Washington and Lee Law Review

In the United States, state data breach notification laws protect citizens by forcing businesses to notify those citizens when their personal information has been compromised. These laws almost universally include an exception for encrypted personal data. Modern encryption methods make encrypted data largely useless, and the notification laws aim to encourage good encryption practices.

This Note challenges the wisdom of laws that place blind faith in the continued infallibility of encryption. For decades, Shor’s algorithm has promised polynomial-time factoring once a sufficiently powerful quantum computer can be built. Competing laboratories around the world steadily continue to march toward this end. …

Comment: The Necessary Evolution Of State Data Breach Notification Laws: Keeping Pace With New Cyber Threats, Quantum Decryption, And The Rapid Expansion Of Technology, Beth Burgin Waller, Elaine Mccafferty

Washington and Lee Law Review

The legal framework that was built almost two decades ago now struggles to keep pace with the rapid expansion of technology, including quantum computing and artificial intelligence, and an ever-evolving cyber threat landscape. In 2002, California passed the first data breach notification law, with all fifty states following suit to require notice of unauthorized access to and acquisition of an individual’s personal information.1 These data breach notification laws, originally designed to capture one-off unauthorized views of data in a computerized database, were not built to address PowerShell scripts by cyber terrorists run across thousands of servers, leaving automated accessed data …

“I Bet You Don’T Get What We Get”: An Intersectional Analysis Of Technology-Facilitated Violence Experienced By Racialized Women Anti- Violence Online Activists In Canada, Nasreen Rajani

Canadian Journal of Law and Technology

Despite growing attention to violence that women face in online settings, a relatively small proportion of academic work centres on the experiences and perspectives of racialized women in Canada. Informed by an intersectional framework, I draw on semi-structured interviews with nine women across Canada, all of whom are involved in anti-violence online activism, about their experiences of technology-facilitated violence (TFV). Their experiences revealed less prominent narratives, including instances of TFV beyond instances of intimate partner violence (IPV) and beyond sources of anonymous trolling by supposed white men, such as violence perpetrated by peers, white women, and racialized men. In this …

Intimate Images And Authors’ Rights: Non- Consensual Disclosure And The Copyright Disconnect, Meghan Sali

Canadian Journal of Law and Technology

This article responds to a brand of legal realpolitik that says using property law to respond to the non-consensual distribution of intimate images (NCDII) is appropriate and even necessary, because its remedial frameworks are well developed and provide the relief that is often most sought after by targets of an assault: the immediate removal of photos from online platforms. While some targets are not considered the ‘‘authors’’ of their intimate images, most of the images that are the subject of NCDII are selfies, taken by the target themselves. In these cases, that person rightfully owns the copyright in those images …

On The Internet, Nobody Knows You Are A Dog: Contested Authorship Of Digital Evidence In Cases Of Gender-Based Violence, Suzie Dunn, Moira Aikenhead

Canadian Journal of Law and Technology

We examine various aspects of digital evidence at GBV trials, drawing on relevant Canadian criminal case law. First, we describe some of the unique challenges related to electronic documents generally with respect to determining authorship. Second, we review some of the historical and ongoing practices within the criminal justice system that rely on harmful gendered myths about GBV and note the potential for these myths to emerge in relation to digital evidence. Third, we discuss the duty of investigating police officers to gather the necessary available digital evidence to demonstrate authorship and note potential gaps in current investigatory practices that …

Responding To Deficiencies In The Architecture Of Privacy: Co-Regulation As The Path Forward For Data Protection On Social Networking Sites, Laurent Cre ́Peau

Canadian Journal of Law and Technology

Social Networking Sites like Facebook, Twitter and the like are a ubiquitous part of contemporary culture. Yet, as exemplified on numerous occasions, most recently in the Cambridge Analytica scandal that shook Facebook in 2018, these sites pose major concerns for personal data protection. Whereas self-regulation has characterized the general regulatory mindset since the early days of the Internet, it is no longer viable given the threat social media poses to user privacy. This article notes the deficiencies of self-regulatory models of privacy and contends jurisdictions like Canada should ensure they have strong data protection regulations to adequately protect the public. …

Artificial Intelligence In Canadian Healthcare: Will The Law Protect Us From Algorithmic Bias Resulting In Discrimination?, Bradley Henderson, Colleen M. Flood, Teresa Scassa

Canadian Journal of Law and Technology

In this article, we canvas why AI may perpetuate or exacerbate extant discrimination through a review of the training, development, and implementation of healthcare-related AI applications and set out policy options to militate against such discrimination. The article is divided into eight short parts including this introduction. Part II focuses on explaining AI, some of its basic functions and processes, and its relevance to healthcare. In Part III, we define and explain the difference and relationship between algorithmic bias and data bias, both of which can result in discrimination in healthcare settings, and provide some prominent examples of healthcare-related AI …

The Anomaly That Is Privacy: Data Privacy Concerns Related To The Rise Of Microchip Implants In Humans, Kendra Lobban

Catholic University Journal of Law and Technology

No abstract provided.

Defrosting The Chill: How Facial Recognition Technology Threatens Free Speech, Kirsten E. Roy

Roger Williams University Law Review

No abstract provided.

A Proportionality-Based Framework For Government Regulation Of Digital Tracing Apps In Times Of Emergency, Sharon Bassan

Dickinson Law Review (2017-Present)

Times of emergency present an inherent conflict between the public interest and the preservation of individual rights. Such times require granting emergency powers to the government on behalf of the public interest and relaxing safeguards against government actions that infringe rights. The lack of theoretical framework to assess governmental decisions in times of emergency leads to a polarized and politicized discourse about potential policies, and often, to public distrust and lack of compliance.

Such a discourse was evident regarding Digital Tracing Apps (“DTAs”), which are apps installed on cellular phones to alert users that they were exposed to people who …

Face The Facts, Or Is The Face A Fact?: Biometric Privacy In Publicly Available Data, Daniel Levin

Fordham Intellectual Property, Media and Entertainment Law Journal

Recent advances in biometric technologies have caused a stir among the privacy community. Specifically, facial recognition technologies facilitated through data scraping practices have called into question the basic precepts we had around exercising biometric privacy. Yet, in spite of emerging case law on the permissibility of data scraping, comparatively little attention has been given to the privacy implications endemic to such practices.

On the one hand, privacy proponents espouse the view that manipulating publicly available data from, for example, our social media profiles, derogates from users’ expectations around the kind of data they share with platforms (and the obligations such …

Failed Analogies: Justice Thomas’S Concurrence In Biden V. Knight First Amendment Institute, Sarah S. Seo

Fordham Intellectual Property, Media and Entertainment Law Journal

Twenty-six years ago, twenty-six words created the internet. Section 230 of the Communications Decency Act is a short, yet powerful, provision that notably protects social media platforms, among other interactive computer services, from liability for content created by third-party users. At the time of its enactment, Section 230 aimed to encourage the robust growth of the then-nascent internet while protecting it from government regulation. More recently, however, it has been wielded by Big Tech companies like Twitter and Facebook to prevent any liability for real-world harms that stem from virtual interactions conducted over their platforms.

Although the Supreme Court has …

Patching The Data Security Blanket: How A Stronger, Collaborative Ftc Is The Answer Right Under Our Nose, Jose A. Gonzalez Lopez

Marquette Intellectual Property & Innovation Law Review

None

Escaping Circularity: The Fourth Amendment And Property Law, João Marinotti

Articles by Maurer Faculty

The Supreme Court’s “reasonable expectation of privacy” test under the Fourth Amendment has often been criticized as circular, and hence subjective and unpredictable. The Court is presumed to base its decisions on society’s expectations of privacy, while society’s expectations of privacy are themselves presumed to be based on the Court’s judgements. As a solution to this problem, property law has been repeatedly propounded as an allegedly independent, autonomous area of law from which the Supreme Court can glean reasonable expectations of privacy without falling back into tautological reasoning.

Such an approach presupposes that property law is not itself circular. If …

Property Prohibitions: Why Criminalizing Prostitution Violates Constitutional Guarantees, James J. Bernstein

University of San Francisco Law Review

No abstract provided.

The Reasonable Intelligence Agency, Asaf Lubin

Articles by Maurer Faculty

Article 57(2) of the First Additional Protocol to the Geneva Conventions requires parties to an armed conflict to “do everything feasible to verify” their objects of attack and take “all precautions” to minimize civilian casualties and unintentional damage to civilian property. This obligation has been interpreted in international law to require state parties to set up an “effective intelligence gathering system” that would properly identify targets using all technical means at the disposal of the combating forces.

But existing law has failed to define what “effective intelligence” looks like. Quite the opposite. Modern history is filled with examples of intelligence …

Tiktok, Wechat, And National Security: Toward A U.S. Data Privacy Framework, Robert L. Rembert

Oklahoma Law Review

No abstract provided.

Table Of Contents, Seattle University Law Review

Seattle University Law Review

Table of Contents

Comments Of The Cordell Institute On The Prevalence Of Commercial Surveillance And Data Security Practices That Harm Consumers, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

These comments are a response to the Federal Trade Commission's 2022 advance notice of proposed rulemaking (“ANPR”) requesting public comment on the prevalence of commercial surveillance and data security practices that harm consumers (Commercial Surveillance ANPR, R111004).

In an increasingly digitized world, data collection, processing, and transfer have become integral to market interactions. Our personal and commercial experiences are now mediated by powerful, information-intensive firms who hold the power to shape what consumers see, how they interact, which options are available to them, and how they make decisions. That power imbalance exposes consumers and leaves them all vulnerable. We all …

Why Govern Broken Tools?, Ryan Calo

Articles

In Assessing the Governance of Digital Contact Tracing in Response to COVID-19: Results of a Multi-National Study, Brian Hutler et al. ably compare two approaches to the governance of digital contract tracing (DCT). In this brief essay, I want to examine to what extent governance actually played a meaningful role in the failure of DCT. If DCT failed primarily for other reasons, then the authors’ normative suggestion to pursue “a new governance approach … for designing and implementing DCT technology going forward” may be misplaced.