Privacy

privacy is elusive

• Under what thing are you working

  • Law, ethics, policy, etc

  • Privacy varies from context to context 

• Ex: privacy is gone

  • We don’t really have a choice anymore

  • Lots of tracking in public, less in other places

good and bad privacy

• Good

  • Protects PII

  • Protects against biases

  • Prevents defamation 

• Bad 

  • Prevents public from having valuable info 

  • Harder to assess risk

Privacy can also break entire services

Westing, Allen, Cohen would agree privacy is good 

Posner has economic POV 

privacy as a right

Privacy as a right – Warren and Brandeis were first to talk about privacy as a right 

• Draw from common law

• Privacy right to be let alone– original def of privacy 

  • Evolved to be less that these days

  • Ex: in public, people take pictures, people will be in the background sort of thing 

    • Less privacy than private settings. Consent varies

    • Consent can be a sign, not a signature sometimes

      • Ex: website privacy policy you don’t click, you are (at least often) assumed to agree

Right to be forgotten

Right to be forgotten

• 2014

• Google spain case in EU

• Court decided– right to be forgotten in EU

• Google had to determine how to deal with things people filed to be forgotten and how to do it practically 

• Google had to take down certain info 

There is implication that a lot of those don’t carry to US if say, judgment is gotten in Canada 

some business concerns

• Will work with in privacy project

• These days companies anticipate privacy breaches as when not if

  • Even companies with “privacy is a fundamental right” sorts of companies 

    • That may be false ads by apple

    • Apple refused to open apple device for police in suspected terrorist situation 

    • EU– privacy is a fundamental right– apple stole the tag line 

    • US– privacy varies a lot more– ex: health data, banking, student, all different sorts of privacy laws

• Culture of privacy to meet legal standards, compliance, customer trust 

  • Culture built in to prevent employees from breaching consumer privacy 

  • Company can do all they want but it just takes one employee sort of thing

westin

• Privacy a lot about personal autonomy in democratic society 

• Back then, easier to be individually autonomous, private person. A lot harder now 

• Compelled in some ways to engage in society or risk loss of not engaging like that 

• Should not think of privacy as companies watching so have no privacy 

  • Yeah, sure, true ish 

  • More complicated than that though

  • Consent to value received to obligations to the service or device or whatever

  • Need to worry about how society is evolving 

IAPP

IAPP– international association of privacy professionals

They have a glossary of terms 

They have a ton of other resources too 

CIA– confidentiality, integrity, availability

 key pillars of cyber security 

Confidentiality– SSNs v Trade secrets

Integrity– the info stored is not changed by a bad actor to no longer be the same or no longer be accurate

Availability– someone using a bot tries to access website and put 1 million requests through to crash the site – attack on availability 

Access control

 also part of cyber– controls who is allowed to access a resource

Authorization

 what you are allowed to do with your account

privacy v sec

Privacy is about the right 

How to protect privacy may be about the tech (in part)

Privacy law focuses on types of info to protect– cyber can cover other things like IP 

How to protect privacy with less tech

• Shredding docs

• Redacting

• Preventing disclosure 

• Mind what can be inferred from public data 

Privacy should be forward looking, tech keeps changing 

GDPR

 in EU – some states have laws that are similar – and may apply to EU citizens in the US 

privacy protects

• Name

• Birthdate

• Address

• Email

• Phone number

• Credit card or bank details

• Information on health and activities

Security can look like

• Firewalls 

• Network limitations

• Security software

• User authentication

• Internal security measures

Security can also cover more than just private info 

Privacy by design (PbD)

Can be used to argue reasonable privacy measures take – not law, but can use

• Proactive not reactive, preventative no remedial

  • Don’t create something and then build privacy in

  • Build privacy in from the start 

    • Don’t kill the innovation, but don’t let people be blind

    • Have solutions, not just problems when and where you can 

    • Ultimately outline risks and let client make choice 

• Privacy as the default

  • Don’t collect data you don’t need or don’t use 

  • Use the data for the purpose stated

• Privacy embedded into design

• Full functionality – positive- sum, not zero-sum

  • Legit reasons for some data, can get that 

• End-to-end security– lifecycle protection

  • Weakest link

    • Put all the privacy measures, but consumer is super insecure, some of it is on them

    • Do you have to warn them

• Visibility and transparency

  • Privacy policy and the like

• Respect for user privacy 

  • Ex: choices, respect those 

  • Mind that sometimes you can’t turn off all the data collection

  • Business and law/consumer wants

Differential privacy 

• Before-and-after approach 

• Noise will be instituted into the data 

  • Makes data a little errored 

  • Data value not lost

  • %s will be off, small errors, but still usable and more private 

Does helpful things, but not necessarily doing everything 

Regulatory approaches 

• Privacy self-management

  • provides people with various rights to help them exercise greater control over their personal data

  • Some rights include

    • Access to personal data

    • To correct errors in personal data

    • To request information about data collection and transfer 

  • Only some things can be deleted, there are legit uses by data holders 

• Governance and documentation

  • the law mandates certain requirements for governance.

  • Can include

    • Appointing chief privacy officer or data protection officer

    • Training workforce

    • Etc

• Use regulation 

  • Regulated uses of data

    • Ex: regulation of use of health data under HIPAA

Calo- privacy harm

Boundaries of privacy harm– Calo

• Privacy harm is a unique injury with specific boundaries and characteristics 

• Two related categories

  • Subjective– perception of unwanted observation

    • Comes from unwelcome mental states– ex: anxiety, fear.

    • Ex: landlord eavesdropping on tenants

  • Objective– unanticipated or coerced use of information concerning a person against that person 

    • Ex: ID theft

Four types of privacy torts– Prosser

• Intrusion upon solitude

• Public disclosure of private facts

• Appropriation of another’s name or  image

• Publishing info that puts a person in a false light 

family privacy

• People live with all sorts of tech now, that could enable a lot of invasion 

  • Ex: someone has a device with an always on mic, their family who lives with them doesn’t. What do 

• Still distinction between private and public

  • More privacy at home than outside

    • Though potential for intrusion at home is high these days

Federal Communications Commission v. Pacifica Foundation (1978)

the Court upheld a Federal Communications Commission ban on indecent speech on the radio, because radio broadcasts invade the privacy of the home, it is difficult to avoid them, and children have access to them.

Cohen v. California (1971)

Court held that the privacy concerns of individuals in a public place were outweighed by the First Amendment’s protection of speech, even when the speech included profanity in a political statement written on a man’s jacket.

Association gets privacy 

government-compelled disclosure of an individual’s affiliations can expose that individual to harm in the form of threats, harassment, or economic reprisals.

This potential exposure may dissuade individuals from joining together out of fear and not wanting to be associated 

No absolute right of privacy of associations

Katz v US

Privacy harm

• Listening to/recording private convos 

Holding: Feds couldn’t listen without a warrant 

Warrants and privacy

• 4th – reasonable search and seizures – warrant does that 

• Also, crimes are not protected generally 

US v. White

Privacy

• Private convo in various locations 

Holding: would have been fine if just written down, so no reasonable expectation of privacy, don’t need a warrant.

• Reasonable expectation of privacy is like, THE thing

  • Here, no reasonable expectation of privacy, talking to another person, giving up the info

  • You don’t know what they’ll do with what you tell them

• Assumed the risk

  • Telling someone else assumes the risk, sucks for you guy 

Riley v. California

Privacy

• Phone like filing cabinets, not a wallet. Lots more info

Holding: need a warrant 

• Super invasive

• Also, nothing to do with officer safety 

• Privacy act 1974 

• Establishes fair info practices code 

  • FIP– fair info practices 

  • Some industries and such have taken FIP to apply 

• Governs collection, maintenance, dissemination, use of info held by agencies 

  • Can still waive some of the rights, but not all 

    • Ex: can’t waive requirement that data is held in safe way 

  • Gov will likely still use data for whatever they got it for, can limit sharing of it at least sometimes 

• Common question: what is privacy expected of gov v private company 

  • Ex: is it minimum needed to do thing? Inherently skeptical? Other? 

• More info gov has to provide about systems than private companies have to provide to consumers 

• Must be record of individual kept in system of fed gov– data covered by privacy act of 1974 

Keith' s case

Emphasizes warrant and different threats 

Need warrant for electronic surveillance in domestic security 

Reasoning: 

• Katz

• Foreign v domestic threat

The Keith Case can be read as creating a three-part framework for electronic surveillance. 

a. Ordinary criminal law enforcement requires a warrant (the holding of Katz), and is regulated under what is now the ECPA. 

b. Domestic intelligence gathering requires prior judicial approval (the holding of Keith), but Congress could create a legislative framework other than the ECPA to regulate it. 

c. Foreign intelligence gathering, including intelligence gathering overseas and intelligence gathering in the United States of agents of a foreign power, was left unaddressed in Keith. 

FISA

Foreign Intelligence Surveillance ACT (FISA) 

As currently written, it allows for electronic monitoring of foreign powers and agents of foreign powers who are operating in the United States so long as a significant purpose of the monitoring is to gather foreign intelligence information. 

In re Sealed Case

Holding

Even without taking into account the President's inherent constitutional authority to conduct warrantless foreign intelligence surveillance, we think the procedures and government showings required under FISA, if they do not meet the minimum Fourth Amendment warrant standards, certainly come close. We, therefore, believe firmly, applying the balancing test drawn from Keith, that FISA as amended is constitutional because the surveillances it authorizes are reasonable 

Reasoning 

The main purpose of ordinary criminal law is twofold: to punish the wrongdoer and to deter other persons in society from embarking on the same course. The government's concern with respect to foreign intelligence crimes, on the other hand, is overwhelmingly to stop or frustrate the immediate criminal activity. As we discussed in the first section of this opinion, the criminal process is often used as part of an integrated effort to counter the malign efforts of a foreign power. Punishment of the terrorist or espionage agent is really a secondary objective; indeed, punishment of a terrorist is often a moot point.

When a FISA warrant is submitted, it must include a description of the procedures used to limit the acquisition and retention of information concerning U.S. persons consistent with the need to obtain and retain foreign intelligence information. Further, information concerning U.S. persons shall not be disseminated in an identifiable manner without the person’s consent unless the person’s identity is needed to understand the foreign intelligence information or assess its importance. 

Consumer privacy

• FTC

  • Started with reg of marketing 

• Got into privacy after enough data breache

some fed privacy laws

• E-government act– procedure for electronic records

• FOIA– the exemptions and exclusions 

• Trade secrets act– trade secrets 

• Paperwork reduction act– reduce answering unnecessary, duplicative, burdensome gov surveys

• There are others, but those are some of the big ones at large

Take it down act

• New law

• Criminal law

• Deep fake revenge porn from au 

• Need reasonable expectation of privacy sort of thing– summary in book 

• Modeled after digital millennium copyright act 

Ring case

• Ftc site has the complaint and all 

• Too many people had access to customer data 

  • Failure to have reasonable access controls 

• Hackers got into user accounts in part due to lack of access control 

• FTC settled– ring ahd to pay out to customers impacted 

• Note: that wasn’t a PRA, that was agency action. Not all privacy is agency, not all is PRA, not all get much $ 

In re facebook– tracking litigation 

• Facebook was collecting browsing data from users without consent

  • Still getting info even when users were logged out 

• Privacy policy “your privacy is very important” 

• Here, privacy promise was in statement of rights and responsibilities and drew from data use policy, and held center

General motors 

• Company took driver data from car to use and sell 

• Nope

Mobilewalla case

• Selling location data 

• Banned from misrep of data use and collection

• Also from using, transferring, selling, disclosing data from sensitive locations (ex: clinics)

Zellmer v. Meta

• Under the Illinois Biometrics Information Privacy Act (BIPA), a private entity can “collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information” only if it: • Informs the subject or her representative in writing of the collection or storage of her biometric identifier or information; • Informs the subject or her representative in writing of “the specific purpose and length of term” for their use; and • Receives written authorization to do so from the subject or her representative 

• See book for elements 

• Guy said IL law was violated by how facebook treated uploaded photos when he didn’t consent to facebook 

• No standing for this guy 

• Duty not to specific people, public generally 

HIPAA

• Diffs between privacy and security 

• Sep of privacy and security 

• First, who does it apply to

  • See summary linked in slides from cdc 

  • Reasonable? Base things, don’t have to do what everyone else does entirely, but probably good to 

Financial privacy

• Ftc summary in slides 

• GLBA

• Also fair credit reporting act 

Kids

• FTC – see link on slide, 

• Coppa is law name 

• Kids under 13 online 

Epic games case

• They tricked kids into spending money and made it hard to get a refund

• Ftc went after them 

CA– CCPA (CA consumer privacy act)

• Influenced by GDPR

• Lots of “or” of who applies to– only need to hit one for CCPA to apply 

• See website for things 

  • Ex: gross annual revenue 

• See CCPA website for details on some things

NH law

• See link in canvas 

CO

• One of the earlier state laws 

• Similar rights– see link 

• More specific than CA as to who the law applies to

CA v. Sephora 

• Sephora let 3rd party trackers on the site to target ads and such 

• Did not honor do not sell info/opt out requests 

• Sephora got ordered to comply with the CPPA 

  • Also fined 

  • Not a PRA, CA AG brought the case here 

American Honda Motor Co

• Honda had to pay fine 

• Had to modify methods for CCPA requests 

• Hire some guy to design a UX designer

CA delete act

• In book 

• Not comprehensive, focus on data brokers

Dark patterns

• CCPA is not opt out by default, choose to do so 

• See book for more info 

• Basically knowingly confusing users and making it harder for users to do what they are trying to

GDPR

• When processing data of EU citizens is when applies

  • From anywhere in the world 

• It is an EU reg, not a directive. Because reg, applies automatically to all EU states

  • Makes it enforceable

  • Different entities enforce in different member states 

• GDPR is a long law, very detailed 

  • Notable things 

    • Art 5 principles

    • Art 6 lawfulness of processing cases 

• Directive– member states have to enact through law 

• Data privacy framework

  • Allows US to process EU data 

UK

• Bexit

• Took GDPR

• Call it UK GDPR 

• EU GDPR decisions are influential on UK 

Canada

• PIPEDA law

  • Applies to private sector orgs that are not federally regulated 

  • Only in certain provinces/territories  

Australia

• The privacy act 

• Regs how gov and certain businesses handle personal info

India 

• GDPR like in part 

• Has exemptions 

• Breach reporting requirements 

• Etc

• See site 

• Enforcement is a problem in india

  • Risks of bribes and such 

  • Enforcement outside court has changed the game a bit 

• Intrusion upon seclusion

• Intentional tort

• Physical or electronic surveillance upon solitude or seclusion of another 

• Reasonable expectation of privacy 

  • To pursue an intrusion on seclusion claim in most states, a plaintiff must establish several things.

    • The defendant, without authorization, intentionally invaded the plaintiff’s private matters.

      • There can be implied auth 

      • Private matters? What are those 

    • The invasion is offensive to a reasonable person.

      • Who is reasonable person? Aggregate normal person kinda. Some people say is judge 

    • The matter that the defendant intruded upon is a private one.

    • The intrusion caused the plaintiff mental anguish or suffering.

  • Reasonable expectation of privacy hard these days 

    • Rapid development of tech and tech in public makes it harder these days

    • Public space v private hom

Howard v aspen way

Adopts restatement for wyoming 

• The Restatement (Second) of Torts generally defines liability for an invasion of privacy as follows: (1) One who invades the right of privacy of another is subject to liability for the resulting harm to the interests of the other. (2) The right of privacy is invaded by (a) unreasonable intrusion upon the seclusion of another, as stated in § 652B; or (b) appropriation of the other's name or likeness, as stated in § 652C; or (c) unreasonable publicity given to the other's private life, as stated in § 652D; or (d) publicity that unreasonably places the other in a false light before the public, as stated in § 652E. 

Safari club v. Rudolph

Court

• Can still have expectation of privacy in restaurant 

  • Ex: lowering voice, minding who is around, etc

• Reasonable privacy is very very fact specific 

• common law invasion of privacy, which requires “(1) intrusion into a private place, conversation[,] or matter, (2) in a manner highly offensive to a reasonable person.” 

• As to the first element, “the defendant must have ‘penetrated some zone of physical or sensory privacy . . . or obtained unwanted access to data’ by electronic or other covert means, in violation of the law or social norms.” “The second common law element essentially involves a ‘policy’ determination as to whether the alleged intrusion is ‘highly offensive’ under the particular circumstances.” “Relevant factors include the degree and setting of the intrusion, and the intruder’s motives and objectives.”

Public disclosure of privacy facts

If intrusion upon seclusion is about inappropriately gathering information (or at least butting into things), public disclosure of private facts is about inappropriately sharing information. These torts are obviously complementary—it will often be the case that information is both inappropriately gathered and also inappropriately disclosed. But they are still distinct. One can intrude upon seclusion without disclosing and disclose without intruding upon seclusion. 

Finley v. Kelly

• Jealous ex was rejected, ex started messaging all sorts of people 

• She didn’t disclose to everyone, just family and friends, so was it public or not 

• Public disclosure does not have to be to entire world, can be a smaller group 

In re facebook, consumer privacy user profile

• Notable elements

  • Consent

  • Expectation of privacy 

• Public disclosure of private facts. For this tort to give rise to liability, the following must occur: (i) the defendant must disclose a private fact about the plaintiff; (ii) the private fact must not be a matter of public concern; (iii) the disclosure must be to the public; and (iv) the disclosure must be offensive and objectionable to a reasonable person 

• Class notes

  • Facebook saying of online no privacy does not hold water

    • Very fact specific 

  • Privacy is not all or nothing 

    • Sometimes people give up all privacy when a service gives enough value

  • Court wants more depth on what is expected and what is being given up 

  • Also minding privacy interests 

  • Legal fiction– assume people read the privacy policy and apply it as such 

ROP

• Control is central to this 

  • Agency over identity 

• Court cares when someone makes money off it 

• NIL

  • name/image/likeness

• Some states provide statutory ROP

“publicity placing person in false light.

Restatement (Second) of Torts (§ 652E), One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for invasion of his privacy, if A. the false light in which the other was places would be highly offensive to a reasonable person, and B. the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed. 

Lower standard, as to falsity of matter

• Published, not to entire world 

• Different level of intent– knowledge or reckless

• Puts person in false light 

• Offense– reasonable person 

• Element a and b are two different people

• Knowledge – person making statement, not a super high bar 

defamation

Under the Restatement (Second) of Torts § 558, to create liability for defamation there must be: 1. a false and defamatory statement concerning another; 2. an unprivileged publication to a third party; 3. fault amounting at least to negligence on the part of the publisher; and 4. [Harm or per se injury] 

Defenses

• Truth

Eramo v. Rolling stone

• Things of note

  • Public figure? Higher standard for defamation claim 

  • If Eramo was a public official or limitedpurpose public figure at the time of publication, as part of her defamation case, she must prove by clear and convincing evidence that defendants acted with actual malice. New York Times Co. v. Sullivan (1964); Gertz v. Robert Welch (1974). 

  • A limited-purpose public figure is one who “voluntarily injects himself or is drawn into a particular public controversy and thereby becomes a public figure for a limited range of issues.” Importantly, these individuals are subject to the actual malice standard for two reasons: (1) because of “their ability to resort to the ‘self-help’ remedy of rebuttal” as these individuals “usually enjoy significantly greater access [to the media] than private individuals”; and (2) because they have “voluntarily exposed themselves to increased risk of injury from defamatory falsehood.” 

  • To determine whether a plaintiff is a private person or a limited-purpose public figure in relation to a particular public controversy, defendants must prove the following: “(1) the plaintiff had access to channels of effective communication; (2) the plaintiff voluntarily assumed a role of special prominence in the public controversy; (3) the plaintiff sought to influence the resolution or outcome of the controversy; (4) the controversy existed prior to the publication of the defamatory statement; and (5) the plaintiff retained public-figure status at the time of the alleged defamation.” 

230

Section 230 bar to liability for platforms

• Defamation on a platform not responsibility of platform

• Don’t have to go through all content to check for defamation 

In short, Section 230 allows websites like X, Facebook, and Yelp to function the way they do even though some people will inevitably post defamatory content on them. The websites themselves are not liable for the bad acts of those who post there.

• Pamela Samuelson

• Is privacy IP – like a new kind, not TS or anything 

• PETs– privacy enhancing technologies 

  • There are a ton of them

• A way of thinking of privacy when kinda compelled to give info for something 

• Companies are getting more involved in self-regulating 

• Richardson chp

• Mainly looks at IP and where privacy intersects 

• IP used to innovate? Privacy may expand with that growth of IP

• Need to determine extent to which things change 

• Different kinds of IP are different though, so gets complicated

  • Ex: creative commons 

    • Can license, but little enforcement on it