SDO 528 Module 7 Lecture 2: Legal Frameworks in Data Privacy and Tort Law: Comprehensive Case Studies

General Tort Principles and Product Liability

• Products Liability Claims: To prevail on such a claim, a plaintiff must demonstrate two critical components:
  • A specific defect in the product.
  • That the defect was the direct cause of his or her injury.
• Negligence Claims: A plaintiff must satisfy four distinct elements to establish a cause of action for negligence:
  • Duty: The existence of a legal duty requiring the defendant to conform to a specific standard of care.
  • Breach: A failure by the defendant to meet or adhere to that standard of care.
  • Causal Connection: A definitive link between the conduct of the defendant and the resulting injury.
  • Actual Damages: The presence of real injury or monetary damage.
• Res Ipsa Loquitur: This doctrine, which translates to "the thing speaks for itself," applies to both negligence and products liability claims. It allows for the inference of negligence based on the fact that the injury occurred, where such an injury would typically not happen without a negligent act.
• Legal Defenses: Specific defenses are relevant in these modules, such into account statutory protections like $\text{Section } 230$.

Data Privacy in the Employment Context: Dittmann v. University of Pittsburgh Medical Center ($2018$)

• Case Background:
  • Employees of the University of Pittsburgh Medical Center (UPMC) filed a lawsuit against their employer following a significant data breach.
  • Hackers stole personal information belonging to the employees, which was subsequently used to file fraudulent tax returns, leading to actual financial damages.
  • Cause of Action: The claim was grounded in negligence, alleging that the employer owed a duty of care to protect the sensitive information it required for employment.
• The Legal Issue: Does an employer have a legal duty to exercise reasonable care to safeguard employees' sensitive personal information stored on its computer systems?
• Defense Arguments (UPMC):
  • Lack of Physical Injury: UPMC argued it owed no duty because there were no physical injuries (e.g., broken bones), which are traditional hallmarks of negligence claims.
  • Economic Loss Doctrine: The defendant argued this doctrine precludes recovery when negligence results only in purely economic losses.
• Economic Loss Doctrine Definition: This doctrine prohibits parties from recovering in tort for the negligence of others when the resulting damages are purely economic. The theory is that a remedy should instead be sought under contract law.
• The General Duty of Care (Pennsylvania Supreme Court): One owes a duty to others to avoid careless acts that could foreseeably harm or injure others. The court maintains that an entity is generally under a duty to exercise the care of a reasonable man to protect others against unreasonable risks of harm arising from an act.
• Third-Party Criminality: UPMC argued they should not be liable because the injury was caused by a third-party (the hacker). The court rejected this, stating that a duty of care is not extinguished by third-party criminality if the actor realized, or should have realized, the likelihood that their conduct (failing to safeguard info) created a situation that a third party might exploit.
• Court Ruling:
  • The court found that the applicability of the economic loss doctrine depends on the source of the duty.
  • Because the employees claimed a common law duty separate from any contractual obligations, the negligence claim was allowed to proceed.
  • The court affirmed that an entity, such as an employer, has a duty to keep certain information confidential.

Metadata and System Errors

• The following error was identified in the source material for Chapter $2$:
  • Code: $AccessDenied$
  • Message: Access Denied
  • RequestId: $H0P55V44J14ERPRR$
  • HostId: $xkyTzF2h6giu1WaIVBZybZo6c+8VO1IEf32UNSvu7+NlFKR+BWhahU+3RlRX4VM4kuMTZc5vXG63GvWbtdmzSIjgoq72/RL6$

Consumer Data and Privacy Torts: Dwyer v. American Express ($1995$)

• Subject Matter: A fundamental Illinois appellate case involving American Express (Amex) cardholders suing over the company's practice of renting consumer spending habit data to third-party advertisers.
• Amex Practice: Amex compiled data on cardholder spending patterns and rented this information to advertisers. This allowed advertisers to target specific groups, such as high-spenders on luxury items like jewelry or air travel.
• Invasion of Privacy (Intrusion upon Seclusion): The cardholders alleged an intrusion upon their seclusion. The $4$ elements required for this tort in Illinois are:
  1. An unauthorized intrusion into the plaintiff's seclusion.
  2. An intrusion that would be offensive to a reasonable person.
  3. The matter intruded upon must be private.
  4. The intrusion must cause anguish or suffering.
• Court Decision: The court ruled that the first element was not met. There was no "unauthorized intrusion" because Amex was using its own internal data.
• Legal Reasoning: Cardholders voluntarily and necessarily provide their spending information to the credit card company by using the card. Compiling and renting out information that was voluntarily given does not constitute an entry into the cardholder's property or private life.
• Connection to Third-Party Doctrine: This logic mirrors the "third-party doctrine" in constitutional law, which posits that individuals have no reasonable expectation of privacy for information they voluntarily convey to a third party.

Defamation vs. False Light: Godbehere v. Phoenix Newspapers ($1989$)

• Parties: Public officials (Sheriff's deputies and civilian employees of the Maricopa County Sheriff's Office) sued Phoenix Newspapers (publishers of the $Phoenix$ $Gazette$ and $Arizona$ $Republic$).
• Allegations: The newspapers published articles accusing the officials of illegal activities, including:
  • Staging narcotics arrests to generate publicity.
  • Illegally arresting citizens and committing police brutality.
  • Misusing public funds and resources.
  • General incompetence.
• Causes of Action: Libel (defamation) and Invasion of Privacy (False Light).
• Legal Conflict over Standards:
  • Plaintiffs' Goal: They wanted a lower standard for the "false light" tort to make it easier to meet and impose liability.
  • Defendants' Goal: The newspapers argued for the higher standard of Intentional Infliction of Emotional Distress (IIED). This requires proving "extreme or outrageous" conduct, which is a very difficult bar for a plaintiff to clear.
• Distinguishing Defamation and Privacy Torts:
  • Defamation (Libel/Slander): Specifically designed to redress reputational harms. The publication must be false, and truth serves as an absolute defense.
  • Privacy Torts (False Light): Designed to protect mental and emotional interests rather than reputation. A cause of action can arise from untrue publications or true information that creates a false implication about an individual.
• Arizona Supreme Court Ruling:
  • The court formally recognized the tort of false light in Arizona and adopted a lower, traditional standard rather than the IIED standard.
  • The Public Official Exception: The court established a significant carve-out: A public official cannot sue for false light invasion of privacy if the publication relates to the performance of his or her public life or duties.
  • Democratic Rationale: In a democratic republic, the governed must be informed about the actions of their governors. Freedom of the press serves as a check on government corruption and undue influence, necessitating the protection of information regarding a public official's professional conduct, even if it paints them in a false light.