A very good discussion of the limited privacy doctrine can be found in the recent privacy article by Lior Strahilevitz (who, incidentally, gets mentioned in the WSJ piece for his "How am I driving?" article). As Lior notes:

The leading California case is the supreme court’s 1999 opinion, Sanders v. ABC. Sanders involved the efforts of Stacy Lescht, an ABC investigative journalist, to expose fraud in the telephone psychic industry. To that end, she obtained employment as a telephone psychic, and used a hidden video camera to record her conversations with coworkers. One of these coworkers, Mark Sanders, sued after part of his conversation with Lescht was broadcast on ABC’s PrimeTime Live program. Lescht argued that because Sanders’ coworkers could overhear her conversations with him, he had no reasonable expectation of privacy in the communication. The court disagreed:

This case squarely raises the question of an expectation of limited privacy . . . [P]rivacy for the purposes of the intrusion tort, is not a binary, all-or-nothing characteristic. There are degrees and nuances to societal recognition of our expectations of privacy: the fact that the privacy one expects in a given setting is not complete or absolute does not render the expectation unreasonable as a matter of law. . . . “The mere fact that a person can be seen by someone does not automatically mean that he or she can legally be forced to be subject to being seen by everyone.”

The court thus held that information can be public vis-à-vis one’s fellow employees, but private vis-à-vis the outside world. Sanders presumably would have suffered little damage if Lescht had played their recorded conversations for fellow employees, but he had a cause of action when she exposed millions of television viewers to the contents of the conversations. Following a jury trial, Sanders was awarded $635,000 for intrusion upon seclusion.46 In other interesting contexts, the California courts generally have adhered to the “expectation of limited privacy” approach laid out in Sanders.

After discussion of several other cases, Lior notes,

These cases suggest that even if a plaintiff reveals information about himself to dozens of people, and even if there are no legal or contractual constraints on those peoples’ ability to disseminate the information further, the information can remain “private” for the purposes of privacy tort law. Such information can remain private regardless of whether the people to whom the information was initially disclosed were the plaintiffs’ intimates (as in Kubach), coworkers (as in Sanders), or strangers (as in Y.G.).

Of course, the existence of the limited privacy doctrine does not guarantee that any particular privacy claim will lie against Ms. Alkon or any other particular cyber-shaming site. Obviously, any action for invasion of privacy will depend on the facts of the particular case. The existence of the limited privacy doctrine, however, does suggest that cyber-shaming advocates should probably be wary of relying on the defense that they are merely repeating facts that were disclosed in a public setting.

(As a side note -- Lior's article advocates the use of a social networks theory of privacy. Under that approach, Ms. Alkon's actions would almost certainly be a violation of Ms. Burgess's privacy.)