Archive for the ‘Privacy’ Category

The Daily You: A Mandatory Read

posted by Danielle Citron

Over at the Business Insider, Doug Weaver has a terrific review of our guest blogger Joe Turow’s new book The Daily You, demonstrating its practical importance to people in the field like Weaver as well as to policymakers and scholars.Here’s the review:

Listening to the insider discussions and industry reporting about online marketing provides a numbing sense of false comfort.  But every so often, we go outside the bubble and hear civilians talking about what we do.  I’m sure most of us have had someone at a party or family gathering share their ‘creeped out’ moment;  that instance where they finally saw clearly that somehow they were being ‘followed’ online.   Other times, they offer us largely unformed general concerns about online privacy: they don’t really have a sense of what’s going on but they instinctively know they don’t like it.  And once in a great while you’ll hear from someone who’s really done their homework and brings crystal clarity to the issue from the consumer point of view.

That moment came for me when I stumbled on an NPR radio interview with Joseph Turow, author of “The Daily You: How the New Advertising Industry is Defining Your Identity and Your Worth.”  After using up my ten minute commute, I found myself sitting my car in the parking lot of my office for another 30 minutes just listening to this guy.  It was kind of like hearing someone talk about you in a bathroom when they don’t know you’re in one of the stalls.  Except they’re totally getting it right.  Turow, an associate dean at the Annenberg Communication school at Penn, has done a lot of homework.  The book is detailed and rigorous, but also extremely accessible to the curious consumer.  While it’s probably not going to sell millions of copies, I believe it’s going to be a hugely influential and important book for several reasons.

  February 1, 2012 at 5:47 pm   Posted in: Architecture, Articles and Books, Innovation, Political Economy, Privacy, Technology   Print This Post   No Comments

Kennedy and Szoka on U.S. v. Jones

posted by Danielle Citron

Charlie Kennedy and Berin Szoka of TechFreedom have an insightful op-ed in c/net yesterday.  It resonates with some of what my co-blogger Dan Solove said in his post and urges Congress to move on ECPA reform.  Here is the piece:

  January 30, 2012 at 10:37 am   Posted in: Privacy, Privacy (Law Enforcement), Privacy (National Security), Uncategorized   Print This Post   One Comment

The Potentially Profound Implications of United States v. Jones

posted by Daniel Solove

I must respectfully disagree with a recent post by Renee Hutchins on our blog about the recent U.S. Supreme Court case, United States v. Jones.    She concludes:

With full knowledge of this history, the Jones decision should give us pause. It is widely believed that the test the court enunciated nearly a half-century ago better protects the privacy interest of citizens in the face of advancing technology. By reverting to the language of trespass, the court this week took a step back when it could have taken a bold step forward. Moreover, by failing to engage the admittedly “thorny” question of whether the monitoring of the GPS device alone violated Mr. Jones’ constitutional rights, the court missed a momentous opportunity to speak clearly in a brave new world.

Although it is true that the majority opinion is narrow, the concurring opinions indicate five votes for a broader more progressive view of the Fourth Amendment, one which breaks from some of the Court’s antiquated notions of privacy. When I read Jones, I see cause for celebration rather than disappointment.

I have long argued that the Court has failed to understand that aggregated pieces of information can together upend expectations of privacy. See Privacy and Power 1434-35 (2001), The Digital Person 44-47 (2004), Understanding Privacy 117-21 (2008).  I have also critiqued what I call the “secrecy paradigm” where the Court has held that privacy is only invaded by revealing previously concealed information.  See The Digital Person 42-44 (2004), Understanding Privacy 106-12 (2008).  I have argued that privacy can be invaded even by public surveillance.  More recently, in Nothing to Hide 178 (2011), I argued:

The problem with the secrecy paradigm is that we do expect some degree of privacy in public.  We don’t expect total secrecy, but we also don’t expect somebody to be recording everything we do. Most of the time, when we’re out and about, nobody’s paying any special attention to us. We do many private things in public, such as buy medications and hygiene products in drug stores and browse books and magazines in bookstores. We expect a kind of practical obscurity—to be just another face in the crowd.

In Justice Alito’s concurring opinion, he seemingly recognizes both of the concept of aggregation and the fact that the extent of the surveillance matter more than merely whether it occurs in public or private:

Under this approach, relatively short-term monitoring of a person’s movements on public streets accords with expectations of privacy that our society has recognized as reasonable.  But the use of longer term GPS monitoring in investigations of most offenses impinges on expectations of privacy.  For such offenses, society’s expectation has been that law enforcement agents and others would not—and indeed, in the main, simply could not—secretly monitor and catalogue every single movement of an individual’s car for a very long period.

Justice Sotomayor discusses this passage with approval in her concurrence, indicating five votes for this view.  Indeed, she would go even further than Justice Alito.

I see profound implications in Jones for the future direction of the Fourth Amendment and privacy law more generally.  I explain this in detail in a recent essay, United States v. Jones and the Future of Privacy Law: The Potential Far-Reaching Implications of the GPS Surveillance Case, Bloomberg BNA Privacy & Security Law Report (Jan. 30, 2012).  From the essay:

The more contextual and open-ended view of privacy articulated by Justice Alito has five votes on the Court.  This is a sophisticated view of privacy, one that departs from the antiquated notions the Court has often clung to.  If this view works its way through Fourth Amendment law, the implications could be quite profound.  So many of the Court’s rationales under the reasonable expectation of privacy test fail to comprehend how technology changes the dynamic of information gathering, making it ruthlessly efficient and making surveillance pervasive and more penetrating.  We might be seeing the stirrings of a more modern Fourth Amendment jurisprudence, one that no longer seems impervious to technological development.

I continue:

Read the rest of this post »

  January 29, 2012 at 1:18 pm   Posted in: Constitutional Law, Criminal Procedure, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security)   Print This Post   One Comment

Privacy Torts in Canada and the International Convergence of Privacy Law

posted by Daniel Solove

Over at the HL Chronicle of Data Protection, I have a post entitled Privacy Torts in Canada and the International Convergence of Privacy Law. The post discusses a recent privacy tort case from Ontario, Canada that recognizes the Warren and Brandeis’ privacy tort of intrusion upon seclusion.  From the post:

The recognition of the US privacy torts by a Canadian court is further demonstration of a general trend – the convergence of privacy law across countries around the world.  Although profound differences in the law remain between countries, there has also been significant convergence.

Read the rest of the post over at HL Chronicle.

  January 29, 2012 at 12:44 pm   Posted in: International & Comparative Law, Privacy, Tort Law   Print This Post   No Comments

United States v. Jones, A Step Back for Rights

posted by Renee Hutchins

I appreciate the chance to engage with CoOp readers on the United States v. Jones case.  I wrote an Op Ed for the Baltimore Sun, so here’s what I have to say.

I really wanted to love the Supreme Court’s decision Monday in United States v. Jones. As one deeply committed to personal liberty and restrained government, what’s not to love when the nation’s highest court finds the police must obtain a warrant before continuously tracking the citizenry with installed GPS devices?  Unfortunately, the answer is “plenty.”

The Supreme Court in Jones could have categorically denounced intrusive government monitoring in the mold of the Orwellian state. It didn’t. And so, while the result in Jones is being roundly celebrated in many quarters, there remain good reasons for privacy fans to hold our applause.

Acting on suspicions that Antoine Jones was selling drugs, the government attached a GPS device to his car. From that device, police computers received a steady stream of information about the car’s location for 28 days. In all, more than 2,000 pages of location data were transmitted. Some of the data linked Mr. Jones to a house where substantial quantities of drugs and money were found. Mr. Jones was consequently charged with drug trafficking offenses. The trial court held that most of the data gleaned from the GPS device was admissible.

Commendably, the Supreme Court reversed that decision and declared the GPS monitoring of Mr. Jones unconstitutional. In doing so, however, the court refused to answer the long-standing question of constitutional limits on the Orwellian state. The case was an opportunity for the court to announce that round-the-clock surveillance of citizens without a warrant offends Fourth Amendment guarantees. Instead, the court based its analysis upon the narrower observation that the police attached a device to Mr. Jones’ car. The Supreme Court’s reluctance is understandable; the broader questions are complex and not easily resolved. But, now more than ever, advances in technology make pressing the need to confront the questions head on.

  January 29, 2012 at 10:29 am   Posted in: Constitutional Law, Criminal Procedure, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement)   Print This Post   7 Comments

The Demi Moore 911 Call: A Breach of Medical Confidentiality?

posted by Daniel Solove

I’ve written before on the issue of whether 911 calls should be public.  The recent release of the Demi Moore 911 call raises the issues once again.  From CBS News:

The tape of the frantic 911 call from actress Demi Moore’s Beverly Hills home Monday night is out and, reports CBS News national correspondent Lee Cowan, the scene sounds a lot more dire than her publicist had let on.

After Moore was rushed to the hospital, a statement said she ‘d be seeking professional help for exhaustion and her overall health.

“The 911 tape really indicates that this is a much more serious situation than we were first led to believe,” says US Weekly’s Melanie Bromley. “We’ve been told it’s exhaustion that she’s suffering from, but you can tell from the tape that there’s a very desperate situation there. She’s having convulsions and she’s almost losing consciousness. It’s a very scary tape to listen to.”

Why is this public?   Many 911 calls, like the one with Demi Moore, involve requests for medical treatment.  Typically, whenever any doctor, nurse, or healthcare professional learns information about a person, it is stringently protected.  A healthcare provider who breaches medical confidentiality can face ethical charges as well as legal liability for the breach of confidentiality tort.  In addition, there may be HIPAA violations of the healthcare provider is HIPAA-regulated.  911 call centers are not HIPAA-regulated, but the operators are in a special position of trust and are often providing healthcare advice (and calling for healthcare services such as ambulances).  If the call from Demi Moore’s home had been to a hospital or a doctor or any other type of healhcare provider, public disclosure of the call would be forbidden.  Why isn’t a 911 call seen in the same light?

As I pointed out in my earlier post about the issue, I believe the release of 911 call transcripts to the public violates the constitutional right to information privacy.  The cases generally recognize strong privacy rights whenever health information is involved.  States with laws, policies, or practices that infringe upon the constitutional right to information privacy might be liable in a Section 1983 suit.  I have not seen one yet, but it is about time something sparks states to rethink their policies about making the calls public.

The rationale for making the calls public is to provide transparency about the responsiveness of 911 call centers.  But this can be done in other ways without violating the privacy of individuals.  The main use of the Demi Moore call being public is to serve as grist for the media to learn about her problems.  This doesn’t make the 911 system safer or better; it just makes the tabloids sell faster.

  January 28, 2012 at 11:19 pm   Posted in: Privacy, Privacy (Gossip & Shaming), Privacy (Medical)   Print This Post   2 Comments

Updated Privacy Intrusions

posted by Danielle Citron

A classic intrusion on seclusion case, Hamberger v. Eastman, 206 A.2d 239 (N.H. 1964), involved a couple whose landlord placed a recording device in their bedroom to listen to their conversations and sounds.  The couple’s privacy tort claim sought recovery for their mental distress and humiliation after discovering the device.  The husband explained that he could not perform his normal duties as husband and father.  According to the wife, the experience curtailed the couple’s sex life.

A more recent case reminded me of just these sorts of psychic wounds — embarrassment and shame accompanying feelings of exposure and intrusion on sacred activities — and the ways that networked technologies can exacerbate them.  A Louisiana city planner hid a camera inside his workplace’s urinal to photograph and film coworkers (over 50 men worked at the city planning office).  In July 2011, his co-worker discovered the tiny camera, which had been duct taped to the urinal.  The camera’s memory device contained images of several men with their private parts exposed.  (Check out this video reenactment of what happened). The city turned over the employee to the local police who charged him with video voyeurism.  It’s unclear how long the camera recorded the goings on in the urinal or what the city planner did with the photos and videos captured on the device.

Although the camera-in-the-urinal case involved criminal charges and no tort claims have been filed, it involves just the sort of intrusions and harms in classic intrusion case.  One imagines that some of the city planner’s co-workers felt embarrassed that a co-worker might have recorded their bathroom activities.  More to the point, they no doubt worried about what the city planner did and could do with those videos.  Now, there’s no evidence that the city planner posted the pictures and videos online or in other ways distributed them.  But networked technologies change the stakes of recorded intrusions.  With today’s technologies, memory decay has all but disappeared, at least in the United States.  (See Jane Yakowitz’s Forbes commentary on the proposed European Commissions’s right to delete proposals; I will have more to say on those proposals too, and Viktor Mayer-Schonberger’s Delete is an excellent read).  If the city planner posted the videos on a site like Private Voyeur (or anywhere), then the material could remain indexed and searchable far into the future, an “eternal return” of private embarrassing information.  Of course, posting the information online would implicate another privacy tort — the public disclosure of private fact — whose reach, though narrow, would likely include what happened here (pictures of bathroom activity hardly seems newsworthy).  But it’s important to recognize the changing stakes of privacy intrusions and disclosures in our networked environment and perhaps put into context proposals like that of the European Commission.

 

  January 28, 2012 at 9:45 am   Posted in: Privacy, Privacy (Consumer Privacy)   Print This Post   No Comments

The E.U. Data Protection Directive and Robot Chicken

posted by Derek Bambauer

The European Commission released a draft of its revised Data Protection Directive this morning, and Jane Yakowitz has a trenchant critique up at Forbes.com. In addition to the sharp legal analysis, her article has both a Star Wars and Robot Chicken reference, which makes it basically the perfect information law piece…

  January 25, 2012 at 4:32 pm   Posted in: Advertising, Architecture, Civil Rights, Consumer Protection Law, Current Events, Cyber Civil Rights, Cyberlaw, Google and Search Engines, Innovation, Politics, Privacy, Privacy (Consumer Privacy), Social Network Websites, Technology, Web 2.0   Print This Post   No Comments

Why Scalia is Right in Jones: Magic Places and One-Way Ratchets

posted by Derek Bambauer

The Supreme Court handed down its decision in U.S. v. Jones yesterday, and the blogosphere is abuzz about the case. (See Margot Kaminski, Paul Ohm, Howard Wasserman, Tom Goldstein, and the terrifyingly prolific Orin Kerr.) The verdict was a clean sweep – 9-0 for Jones – but the case produced three opinions, including a duel between Justices Antonin Scalia and Samuel Alito. Thus far, most privacy and constitutional law thinkers favor Alito’s position. That’s incorrect: Justice Scalia’s opinion is far more privacy protective. Here’s why: Read the rest of this post »

  January 24, 2012 at 12:05 pm   Posted in: Blogging, Civil Rights, Constitutional Law, Courts, Criminal Law, Criminal Procedure, Current Events, Jurisprudence, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Supreme Court, Technology   Print This Post   9 Comments

Reasonable Expectation of Privacy

posted by Gerard Magliocca

While I’m not a Fourth Amendment expert, that won’t stop me from saying something about Jones.  I think that Justice Sotomayor’s concurring opinion, which calls into question the rule that there is no reasonable expectation of privacy when information is disclosed to a third-party outside of a confidential relationship recognized by the common law (lawyer/client, doctor/patient, etc.), should start a conversation about abolishing this outdated tort concept.

It seems to me that trade secret law provides a better model.  The inquiry there is whether the owner of the information takes reasonable precautions to preserve its secrecy.  Disclosure to a third-party does not automatically end legal protection, and custom is relevant for defining whether the third-party disclosure constitutes a waiver.  Now adopting this standard would probably lead to more intrusion upon seclusion claims, but it is also more realistic in the social media age.  I doubt that I’m the first one to suggest this approach, but I don’t know.

UPDATE:  Some quick research shows that a Note in the Georgetown Law Journal did make this proposal with respect to the Fourth Amendment, though not for tort law.  See Andrew Riggs Dunlap, Fixing the Fourth Amendment With Trade Secret Law, 90 Geo. L. J. 2175 (2002).

  January 24, 2012 at 12:01 pm   Posted in: Privacy, Uncategorized   Print This Post   5 Comments

United States v. Jones: Privacy in Public Space? Piece it all Together and You Get 5.

posted by Priscilla Smith

By Priscilla Smith, Nabiha Syed & Albert Wong, Information Society Project at Yale Law School

There was exciting news from the Supreme Court yesterday.  By a rare 9-0 vote, in United States v. Jones, No. 10-1259, the Court held that the Government should have obtained a warrant before placing a GPS surveillance device on the defendant’s car and monitoring his movements.  This result was not completely unexpected, especially considering the Justices’ interest at oral argument in the Government’s position that GPS surveillance technology could be used without a warrant to track the movements of any car — even the Justices’ own cars — for an unlimited period of time.  The Government argued —  unsuccessfully — that this result was compelled because citizens have no privacy interests in their public movements.

Of particular note, the three opinions in the case and the unusual line-up make for a broader ruling than is apparent at the outset.  The most narrow rule comes from the Court’s opinion written by Justice Scalia and joined by Justices Roberts, Kennedy, Thomas, and — wait for it — Sotomayor, holding that that “the Government’s installation of a GPS device on a target’s vehicle,² and its use of that device to monitor the vehicle’s movements, constitutes a “search.”  Slip op. at 3.  Scalia notes that the Fourth Amendment protects the “right of the people to be secure in their . . . effects,” and it “is beyond dispute that a vehicle is an ‘effect’ as that term is used in the [Fourth] Amendment.”  Id. at 3.  Ergo, he holds the installation done with the intent to “use … th[e] device to monitor the vehicle’s movements” was a search.  Id. at 3.  He describes the action at issue, saying “[t]he Government physically occupied private property for the purpose of obtaining information.”  He holds that since this form of physical trespass and monitoring would have been a search within the meaning of the Fourth Amendment at the time it was adopted, it is a search now.  Hello, original application guy.

On first glance, it seems that Scalia might be returning to old interpretations of the Fourth Amendment that required a physical trespass to have occurred before an action could be considered a search.  But what Scalia is actually doing here is defining the Court’s task, which is “at a minimum, is to decide whether the action in question would have constituted a ‘search’ within the original meaning of the Fourth Amendment,” and because it would have, it is a search now.  Just because in 1967 Katz said that the Fourth Amendment protects more than physical trespass, doesn’t mean that the Fourth Amendment doesn’t protect physical trespass.  See slip op. at 6-7 (noting Katz did not erode the principle that a search occurs where the Government “does engage in physical intrusion of a constitutionally protected area in order to obtain information.”) (emphasis in original).  So Scalia establishes and emphasizes a threshold for determining when a search has occurred — a threshold that is not comprehensive, but sufficient to resolve the issue at hand.

And thus Scalia declines to go further and consider what would happen if, hypothetically, there was no physical trespass.  He does hold open the possibility that “achieving the same result through electronic means [as they achieved here with physical trespass], without an accompanying trespass, is an unconstitutional invasion of privacy.”  Id. at 11.  Simple enough.  Why decide the harder issue with all its accompanying “vexing problems” that would arise in a case involving electronic surveillance without an accompanying trespass?  Scalia argues that there is no reason to “rush forward” to resolve them now.  Slip op. at 12.  Put aside for a minute that he encouraged the Court in United States v. Kyllo, a case holding that the use of heat-seeking technology required a warrant, to adopt rules that “take account of more sophisticated systems that are already in use or in development,” Kyllo, 533 U.S. at 37.

But Scalia has a problem.  As he points out, in its opinion in United States v. Knotts, the Court upheld the use of beeper technology to track a target’s movements, holding there was no invasion of privacy.  He distinguishes Knotts from this case because Knotts did not involve physical trespass. The beeper there was placed inside a container with consent of the then-owner of the container, and only then was the container placed in the driver’s car.  Moreover, Knotts didn’t challenge the installation.  Right.  But the Court didn’t decide there was no search in Knotts based on an absence of a physical trespass; the Court decided the case holding there was no invasion of privacy.  So shouldn’t Scalia explain to us why he holds open the possibility that “achieving the same result through electronic means [as they achieved here with physical trespass], without an accompanying trespass, [like they did in Knotts] is an unconstitutional invasion of privacy?”  Id. at 11.  Saying that GPS is a different technology, as he does in a footnote, is not enough.  Doesn’t he owe us an explanation of why Knotts doesn’t preclude that possibility, as the Government so vehemently argued it did and the Ninth Circuit in a similar case agreed?  See Pineda-Moreno v. United States.

Of course he does — or so says Justice Alito, with Justices Ginsburg, Breyer and Kagan joining.  See Alito’s concurrence, slip op. at 13.  In fact, not only did Alito think the Court should reach the Katz expectation of privacy test, he didn’t buy the physical trespass holding at all, and lists its many flaws.  Justice Alito then evaluates the GPS surveillance here, noting that “devices like the one used in the present case … make long-term monitoring relatively easy and cheap.”  “[T]he best we can do in this case,” reasons Alito, “is to apply existing Fourth Amendment doctrine” and “ask whether the use of GPS tracking in a particular case involved a degree of intrusion that a reasonable person would not have anticipated.”  Alito at 13.  Under this inquiry, “the use of longer term GPS monitoring in investigations of most offenses impinges on expectations of privacy,” because “society’s expectation has been that law enforcement agents and others would not — and indeed, in the main, simply could not — secretly monitor and catalogue every single movement of an individual’s car for a very long period.”  Id.  Now, Justice Alito recognizes the “degree of circularity” inherent in Katz’s expectation of privacy test — i.e., the problem that, if read literally, the test would permit a situation in which the government takes away your privacy so that one no longer has an“expectation” of it — and in so doing, one no longer has a constitutionally protected interest in it.  Hello, 1984.  Unfortunately, though, his concurrence does nothing to address, and instead relies exactly on, that circular part of it — the intrusion you would or would not have anticipated.  The concurrence is also remarkably skimpy in its explication of why exactly the surveillance is “intrusive” — you know, the point that is the actual crux of the case.

The only Justice who doesn’t avoid the issues is Justice Sotomayor.  Although she joins the narrow majority opinion because she buys Scalia’s argument that the physical trespass here suffices to decide the case, she writes separately to make clear that “physical intrusion is now unnecessary to many forms of surveillance,” her slip op. at 2, a statement that Scalia certainly does not deny.

Moreover, and making this a much broader ruling than it appears on first glance, unlike Scalia, Sotomayor explains the distinction between Jones and Knotts.  She agrees with the Alito Four that “’longer term GPS monitoring in investigation of most offenses impinges on expectations of privacy.’”  Sotomayor concurrence at 3, quoting Alito concurrence at 13.  Rather than relying on whether citizens “anticipate” invasions of their privacy, her opinion reflects the concerns of the D.C. Circuit, New York Court of Appeals, and C.J. Kozinski writing in dissent from denial of rehearing en banc in a similar case in the Ninth Circuit, that the information collected by GPS monitoring generates a “comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations.”  Id. at 3.  (In fact, unless we missed something, she appears to be the only one who cites to Chief Judge Kozinski’s dissenting opinion in the Pineda-Moreno case; no one seems to cite the DC Circuit opinion, scared off perhaps by some folks’ misplaced railing against its “mosaic” language).  She further discusses the concerns raised in a brief filed by some of us at the ISP on behalf of a group of privacy scholars that GPS surveillance, as she says, “evades the ordinary checks that constrain abusive law enforcement practices” and is susceptible to abuse, and that awareness of government monitoring chills associational and expressive freedoms.  Id.  She summarizes:

I would also consider the appropriateness of entrusting to the Executive, in the absence of any over­sight from a coordinate branch, a tool so amenable to misuse, especially in light of the Fourth Amendment’s goal to curb arbitrary exercises of police power to and prevent “a too permeating police surveillance,” United States v. Di Re, 332 U. S. 581, 595 (1948).

Finally, Sotomayor suggests a more fundamental change in the jurisprudence to “reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties,” and notes that the rule is “ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks,” Sotomayor at 5, questioning the notion at the heart of the rule that “secrecy [is] a prerequisite to privacy.”

The long and the short of it is that by agreeing with the Alito Four that the use of GPS surveillance technology for a prolonged period violates a reasonable expectation of privacy, Sotomayor’s concurrence means that five justices agree to veer away from the inside/outside distinction relied upon by the Government.  It seems that we may have some privacy interests in our public movements after all.

  January 24, 2012 at 11:39 am   Posted in: Anonymity, Constitutional Law, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Supreme Court, Uncategorized   Print This Post   2 Comments

Jones is a Near-Optimal Result

posted by Paul Ohm

Thanks to Danielle for inviting me to post my thoughts. I’ll try to come up with some new, original thoughts in a later post, but to start, let me offer an abridged version of what I posted yesterday on my home blog, Freedom to Tinker.

I think the Jones court reached the correct result, and I think that the three opinions represent a near-optimal result for those who want the Court to recognize how its present Fourth Amendment jurisprudence does far too little to protect privacy and limit unwarranted government power in light of recent advances in surveillance technology. This might seem counter-intuitive. I predict that many news stories about Jones will pitch it as an epic battle between Scalia’s property-centric and Alito’s privacy-centric approaches to the Fourth Amendment and quote people expressing regret that Justice Alito didn’t instead win the day. I think this would focus on the wrong thing, underplaying how the three opinions–all of them–represent a significant advance for Constitutional privacy, for several reasons:

1. Justice Alito?

Maybe I’m not a savvy court watcher, but I did not see this coming. The fact that Justice Alito wrote such a strong privacy-centric opinion suggests that future Fourth Amendment litigants will see a well-defined path to five votes, especially since it seems like Justice Sotomayor will likely provide the fifth vote in the right future case.

2. Justice Scalia and Thomas showed restraint.

The majority opinion goes out of its way to highlight that its focus on property is not meant to foreclose privacy-based analyses in the future. It uses the words “at bottom” and “at a minimum” to hammer home the idea that it is supplementing Katz not replacing it. Maybe Justice Scalia did this to win Justice Sotomayor’s vote, but even if so, I am heartened that neither Justice Scalia nor Justice Thomas thought it necessary to write a separate concurrence arguing that Katz’s privacy focus should be replaced with a focus only on property rights.

3. Justice Sotomayor does not like the third-party doctrine.

It’s probably best here just to quote from the opinion:

More fundamentally, it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. E.g., Smith, 442 U.S., at 742; United States v. Miller, 425 U.S. 435, 443 (1976). This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers. Perhaps, as JUSTICE ALITO notes, some people may find the “tradeoff” of privacy for convenience “worthwhile,” or come to accept this “dimunition of privacy” as “inevitable,” post, at 10, and perhaps not. I for one doubt that people would accept without complaint the warrantless disclosure to the Government of a list of every Web site they had visited in the last week, or month, or year. But whatever the societal expectations, they can attain constitutionally protected status only if our Fourth Amendment jurisprudence ceases to treat secrecy as a prerequisite for privacy. I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection.

Wow. And Amen. Set your stopwatches: the death watch for the third-party doctrine has finally begun.

4. The wrong case for a privacy overhaul of the Fourth Amendment.

Most importantly, I’ve had misgivings about using Jones as the vehicle for fixing what is broken with the Fourth Amendment. GPS vehicle tracking comes laden with lots of baggage–practical, jurisprudential and atmospheric–that other actively litigated areas of modern surveillance do not. GPS vehicle tracking happens on public streets, meaning it runs into dozens of Supreme Court pronouncements about assumption of risk and voluntarily disclosure. It faces two prior precedents, Karo and Knotts, that need to be distinguished or possibly overturned. It does not suffer (as far as we know) from a long history of use against innocent people, but instead seems mostly used to track fugitives and drug dealers.

For all of these reasons, even the most privacy-minded Justice is likely to recognize caveats and exceptions in crafting a new rule for GPS tracking. Imagine if Justice Sotomayor had signed Justice Alito’s opinion instead of Justice Scalia’s. We would’ve been left with a holding that allowed short-term monitoring but not long-term monitoring, without a precise delineation between the two. We would’ve been left with the possible new caveat that the rules change when the police investigate “extraordinary offenses,” also undefined. These unsatisfying, vague new rules would have had downstream negative effects on lower court opinions analyzing URL or search query monitoring, or cell phone tower monitoring, or packet sniffing.

Better that we have the big “reinventing Katz” debate in a case that isn’t so saddled with the confusions of following cars on public streets. I hope the Supreme Court next faces a surveillance technique born purely on the Internet, one in which “classic trespassory search is not involved.” If the votes hold from Jones, we might end up with what many legal scholars have urged: a retrenchment or reversal of the third-party doctrine; a Fourth Amendment jurisprudence better tailored to the rise of the Internet; and a better Constitutional balance in this country between privacy and security.

  January 24, 2012 at 11:11 am   Posted in: Civil Rights, Constitutional Law, Criminal Procedure, Privacy, Privacy (Law Enforcement)   Print This Post   2 Comments

Welcoming Experts to Discuss the Supreme Court’s Decision in United States v. Jones

posted by Danielle Citron

As my co-blogger Dan Solove noted, the Supreme Court ruled in United States v. Jones, finding the warrantless GPS surveillance of a car unconstitutional.  There’s much to discuss about the majority opinion written by Scalia (with Roberts, Thomas, Kennedy, and Sotomayor), a concurrence written by Sotomayor, and a concurrence by Alito (with Ginsburg, Breyer, and Kagan).  We’re lucky to have experts on board to help us sort it out: Margot E. Kaminski, Executive Director of the Yale Information Society Project and Research Scholar and Lecturer at Yale Law School whose scholarship focuses on civil liberties, privacy, and surveillance, guest blogger Paul Ohm, Associate Professor of Law at the University of Colorado School of Law and former computer programmer and network systems administrator who has authored many important pieces on privacy and surveillance, and Priscilla “Cilla” Smith, Senior Fellow at the Yale Information Society Project who has co-authored “When Machines Are Watching: How Warrantless Use of GPS Surveillance Technology Violates the Fourth Amendment Right Against Unreasonable Searches,” 121 The Yale Law Journal Online 177 (2011) (with Nabiha Syed, David Thaw and Albert Wong).   In a week or so, we will also be hearing from my colleague Renée Hutchins, Associate Professor of Law at the University of Maryland Francis King Carey School of Law, whose article “Tied Up in Knotts?” GPS and the Fourth Amendment, 55 UCLA Law Review 1 (2007) appeared in many district and Court of Appeals decisions wrestling with warrantless GPS tracking on cars.

  January 24, 2012 at 8:26 am   Posted in: Civil Rights, Constitutional Law, Criminal Procedure, Privacy, Privacy (Law Enforcement)   Print This Post   One Comment

United States v. Jones — The Fourth Amendment and GPS Surveillance

posted by Daniel Solove

The U.S. Supreme Court has decided United States v. Jones, concluding that when the government installs a GPS surveillance device on a car, it is a Fourth Amendment search.  The majority uses a property-based rationale and the concurring opinion (Alito, Ginsburg, Breyer, and Kagan) uses a privacy-based rationale.   More thoughts and analysis to come later.

I also want to congratulate my colleague Orin Kerr, who is cited in both the majority opinion and in a concurring opinion for his article, The Fourth Amendment and New Technologies: Constitutional Myths and the Case for Caution, 102 Mich. L. Rev. 801 (2004).  The majority opinion relies heavily on Orin’s theory of the Fourth Amendment and property that he sets forth in the first part of his article.

  January 23, 2012 at 12:04 pm   Posted in: Criminal Procedure, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement)   Print This Post   3 Comments

The Intersection of Privacy and Security: Data Privacy Day Event at GW Law School

posted by Daniel Solove

The National Cyber Security Alliance Presents:

Data Privacy Day 2012

The Intersection of Privacy & Security

Featuring: The Honorable Julie Brill
Commissioner, Federal Trade Commission

 Event Sponsored by:

 

---

The convergence of privacy and security: how do we overcome the conflict that seems to be inherent between the two? Is it a philosophical impossibility or an aspiration to be achieved?

Data security, according to common definition is the “confidentiality, integrity and availability” of data. It is the practice of ensuring that the data being stored is safe from unauthorized access and use, ensuring that the data is reliable and accurate and that is available for use when it is needed. Privacy on the other hand, is the appropriate use of data.

Our panel will consider the implications of how privacy and security are two sides of the same coin and what companies can and should do to ensure privacy and security are protected while allowing innovation to flourish.

---

Agenda

9:00 Registration
9:30 Welcome

• Michael Kaiser
  Executive Director, National Cyber Security Alliance
• Dan Solove
  John Marshall Harlan Research Professor of Law, The George Washington University School of Law
• Paul Schiff Berman
  Dean and Robert Kramer Research Professor of Law, The George Washington University School of Law

9:40 Keynote

The Honorable Julie Brill
Commissioner, Federal Trade Commission

10:10 Panel Discussion

Reflections & Aspirations: The Past, The Present & The Future

Moderator
Christopher Wolf
Founder & Co-Chair, Future of Privacy Forum and Partner, Hogan Lovells US LLP

Panelists

• David Hoffman
  Director of Security Policy and Global Privacy Officer, Intel
• Gerard Lewis
  Vice President, Deputy General Counsel & Chief Privacy Officer, Comcast Cable
• Ari Schwartz
  Senior Internet Policy Advisor, Office of the Secretary, U.S. Department of Commerce

10:50 Panel Discussion

Privacy & Security: Best Practices in Action

Moderator
Christopher Wolf
Co-Chair & Founder, Future of Privacy Forum and Partner, Hogan Lovells US LLP

Panelists

• Rick Buck
  Head of Privacy GSI, eBay
• Erin Egan
  Chief Privacy Officer, Policy, Facebook
• JoAnn C. Stonier
  Global Privacy & Data Protection Officer, MasterCard Worldwide
• Bob Quinn
  Senior Vice President-Federal Regulatory & Chief Privacy Officer, AT&T

 

 

 

 

 

  January 22, 2012 at 1:51 pm   Posted in: Conferences, Privacy   Print This Post   No Comments

BRIGHT IDEAS: Anita Allen’s Unpopular Privacy

posted by Danielle Citron

Lucky for CoOp readers, I had a chance to talk to Professor Anita Allen about her new book Unpopular Privacy, which Oxford University Press recently published.  My co-blogger Dan Solove included Professor Allen’s new book on his must-read privacy books for the year.  And rightly so: the book is insightful, important, and engrossing.  Before I reproduce below my interview with Professor Allen, let me introduce her to you.  She is a true renaissance person, just see her Wikipedia page.  Professor Allen is the Henry R. Silverman Professor of Law and professor of philosophy at the University of Pennsylvania Law School.  She is also a senior fellow in the bioethics department of the University of Pennsylvania School of Medicine, a collaborating faculty member in African studies, and an affiliated faculty member in the women’s studies program.  In 2010, President Barack Obama named Professor Allen to the Presidential Commission for the Study of Bioethical Issues. She is a Hastings CenterFellow.  Her publications are too numerous to list here: suffice it to say that she’s written several books, a casebook, and countless articles in law reviews and philosophy journals.  She also writes for the Daily Beast and other popular media.

Question: You began writing about privacy in the 1980s, long before the Internet and long before many of the federal privacy statutes we take for granted. What has changed? 

 I started writing about privacy when I was a law student at Harvard in the early 1980s and have never stopped. Unpopular Privacy, What Must We Hide (Oxford University Press 2011) is my third book about privacy in addition to a privacy law casebook Privacy Law and Society (West Publishing 2011).  My original impetus was to understand and explore the relationships of power and control among governments, individuals, groups, and families.  In the 1970s and 1980s, the big privacy issues in the newspapers and the courts related to abortion, gay sex, and the right to die.  Surveillance, search and seizure, and database issues were on the table, as they had been since the early 1960s, but they often seemed the special province of criminal lawyers and technocrats.

To use a cliché, it’s a brave new world.   Since my early interest in privacy, times have indeed changed, the role of electronic communications and the pervasiveness of networked technologies in daily life has transformed how personal data flows and how we think about and prioritize our privacy.  Terms like webcam, “text messaging,” “social networking,” and “cloud computing” have entered the lexicon, along with devices like mobile, personal digital assistants, and iPads.

The public is just beginning to grasp ways in which genetics and neuroscience will impact privacy in daily life—I have begun to reflect, write, and speak more about these matters recently, including in connection with my work as a member of President Obama’s Presidential Commission for the Study of Bioethical Issues.

Question: Your book coins the phrase “unpopular privacy.”  In what way is privacy unpopular?  

First let me say that I think of “popular privacy” as the privacy that people in the United States and similar developed nations tend to want, believe they have a right to, and expect government to secure.  For example, typical adults very much want privacy protection for the content of their telephone calls, e-mail, tax filings, health records, academic transcripts, and bank transactions.

I wrote this book because I think we need to think more about “unpopular” privacy. “Unpopular” privacy is the kind that people reject, despise, or are indifferent to.  My book focuses on the moral and political underpinnings of laws that promote, require, and enforce physical and informational privacy that is unpopular with the very people that those laws are supposed to help or control.  (I call such people the beneficiaries and targets of privacy laws.)  “Don’t Ask, Don’t Tell,” for instance, was an unpopular government mandated privacy for military service members.  My book suggests that some types of privacy that should be popular aren’t and asks what, if anything, we should do about it.

Question: If people don’t want privacy or don’t care about it, why should we care?

We should care because privacy is important.  I urge that we think of it as a “foundational” good like freedom and equality.  Privacy is not a purely optional good like cookies and sports cars.  Since the 1960s, when scholars first began to analyze privacy in earnest, philosophers and other theorists have rightly linked the experience of privacy with dignity, autonomy, civility, and intimacy. They have linked it to repose, self-expression, creativity, and reflection. They have tied it to the preservation of unique preferences and distinct traditions.  I agree with moral, legal and political theorists who have argued that privacy is a right.

I go further to join a small group of theorists that includes Jean L. Cohen who have argued that privacy is also potentially a duty; and not only a duty to others, but a duty to one’s self.  I believe we each have a duty to take into account the way in which one’s own personality and life enterprises could be affected by decisions to dispense with foundational goods that are lost when one decides to flaunt, expose, and share rather than to reserve, conceal, and keep.

If people are completely morally and legally free to pick and choose the degrees of privacy they will enter, they are potentially deprived of highly valued states that promote their vital interests, and those of their fellow human beings. For me, this suggests that we need to restrain choice—if not by law, then by ethics and other social norms.  Respect for privacy rights and the ascription of privacy duties must comprise a part of a society’s formative project for shaping citizens. Read the rest of this post »

  January 13, 2012 at 9:24 am   Posted in: Bright Ideas, Feminism and Gender, Privacy, Privacy (Consumer Privacy), Race, Technology, Web 2.0   Print This Post   No Comments

Needed Steps Forward on the Privacy and Civil Liberties Oversight Board

posted by Danielle Citron

Thanks to terrific privacy blogger Melissa Ngo and privacy scholar and change maker Peter Swire, I’ve learned about some exciting developments about the Privacy and Civil Liberties Oversight Board.  One might say: “Privacy and Civil Liberties Oversight Board, what?”  And that ignorance would not be surprising–it’s been dormant for too long, at least until some recent activity.  The 9/11 Commission recommended the creation of a privacy and civil liberties oversight board, which was created in 2004 and placed within the White House.  The original Board members included Carol E. Dinkins, of Texas, Chairwoman; Alan Charles Raul, of the District of Columbia, Vice Chairman; Theodore B. Olson, of Virginia; and Francis X. Taylor, of Maryland. The Chairwoman and Vice Chairman were confirmed by the Senate on February 17, 2006.  In 2008, Congress passed and President Bush signed the “Implementing the 9/11 Commission Recommendations Act of 2007,” which took the Privacy and Civil Liberties Oversight Board out of the White House and established it “as an independent agency within the executive branch.”  One of the Board’s tasks was to review the FBI’s use of national security letters.  Terms for the original board expired in January 2008, but President Bush delayed the nomination of new board members for many months and none were confirmed by the Senate.  That’s pretty much where things stayed–a Privacy and Civil Liberties Oversight Board with no members and no action.

Last year, President Obama nominated the terrific James X. Dempsey, Vice President for Public Policy at the Center for Democracy and Technology, and Elisebeth Collins Cook, who worked in the Justice Department in the Bush administration. In turn, privacy groups, including Melissa Ngo’s Privacy Lives, called for the nomination and confirmation of  experts to the board.   In December 2011, the White House has announced that President Obama has sent more nominations to the oversight board to the Senate: Rachel L. Brand, of Iowa, to be a Member of the Privacy and Civil Liberties Oversight Board for a term expiring January 29, 2017; David Medine, of Maryland, to be Chairman and Member of the Privacy and Civil Liberties Oversight Board for a term expiring January 29, 2018, and Patricia M. Wald, of the District of Columbia, to be a Member of the Privacy and Civil Liberties Oversight Board for a term expiring January 29, 2013.  It’s a terrific group, and hopefully the Senate won’t take its time moving forward.

Without question, this is a crucial step forward.  We need oversight on a host of issues, from airport screening and cyber security to fusion centers.  As my co-blogger Frank Pasquale and I have documented, state run and federally funded fusion centers are in dire need of accountability, network accountability to be precise.  At any one of the existing 72 fusion centers, one might find state law enforcement working alongside DHS, FBI, and DEA agents as well privacy security analysts.  In the case of the Washington Joint Analytical Center, an employee from Boeing is co-located at the fusion center, having access to information from the fusion center and sharing Boeing’s intelligence capabilities.  As a Boeing executive said, the company hopes to “set an example of how private owners of critical infrastructure can get involved in such centers to generate and receive criminal and anti-terrorism intelligence.”  Let’s think through what this means: private sector partners have access to intelligence that certain individuals, possibly job candidates, pose potential “threats.”  We’ve seen from fusion center blunders that ordinary citizens engaging in political speech have been placed on watch lists.  In one case, the Maryland fusion center shared inaccurate and damaging information with the Information Sharing Environment.  It reported to the DEA and NSA and others that 53 activists from Greenpeace and Moms Against the War, including two Catholic nuns and a Democratic candidate for local office, were “terrorists.”  And as we have seen, much to the chagrin of serious Republican contender Ron Paul, the Missouri Information Analysis Center’s 2009 report to highway patrolmen explained that “violent extremists” typically associate with third party candidates, such as Ron Paul and Bob Barr, and that “potential threats” included anti-immigration and anti-tax advocates.  According to the report, violent extremists could be identified through their use of bumper stickers  indicating support for libertarian groups.  In a similar vein, a California fusion center warned local police to expect violence at antiwar protests: “You can make an easy kind of link that, if you have a protest group protesting a war where the cause that’s being fought against is international terrorism, you might have terrorism at that protest.  You can almost argue that a protest against the war is a terrorist act.”  Ever hear about the First Amendment’s freedom of expression and association?  Oversight is in order.

H/T: Peter Swire

Wikimedia Commons Image (NJ fusion center)

  January 12, 2012 at 11:30 am   Posted in: Civil Rights, Constitutional Law, Privacy, Privacy (National Security)   Print This Post   4 Comments

Neil Richards on Why Video Privacy Matters

posted by Danielle Citron

Our guest blogger Neil Richards, a Professor of Law at Washington University School of Law, turns his sights on video privacy in this guest blog post.  It whets our appetite for his forthcoming book on Intellectual Privacy.  So here is Professor Richards’s post:

The House of Representatives recently passed an amendment to a fairly obscure a law known as the Video Privacy Protection Act.  This law protects the privacy of our video rental records.  It ensures that companies who have information about what videos we watch keep them confidential, and it requires them to get meaningful consent from us before they publish them.  The House, at the urging of Netflix and Facebook, has passed an amendment that would allow these companies to share our movie watching habits much more easily.  The Video Privacy Act was passed after the Washington City Paper obtained the video rental records of Supreme Court nominee Robert Bork and published them in order to politically discredit him.  It worked.  The Video Privacy Act rests on the enduring wisdom that what we watch is our own business, regardless of our politics.  It allows us to share films we’ve watched on our own terms and not those of video stores or online video providers.

What’s at stake is something privacy scholars call “intellectual privacy” – the idea that records of our reading habits, movie watching habits, and private conversations deserve special protection from other kinds of personal information.  The films we watch, the books we read, and the web sites we visit are essential to the ways we make sense of the world and make up our minds about political and non-political issues.  Intellectual privacy protects our ability to think for ourselves, without worrying that other people might judge us based on what we read.  It allows us to explore ideas that other people might not approve of, and to figure out our politics, sexuality, and personal values, among other things.  It lets us watch or read whatever we want without fear of embarrassment or being outed.  This is the case whether we’re reading communist or anti-globalization books; or visiting web sites about abortion, gun control, cancer, or coming out as gay; or watching videos of pornography, or documentaries by Michael Moore, or even “The Hangover 2.”

For generations, librarians have understood this.  Libraries were the Internet before computers – they presented the world of reading to us, and let us as patrons read (and watch) freely for ourselves. But librarians understood that intellectual privacy matters.  A good library lets us read freely, but keeps our records confidential in order to safeguard our intellectual privacy.   But we are told by Netflix, Facebook, and other companies that the world has changed.  “Sharing” as they call it is the way of the future.  I disagree.  Sharing can be good, and sharing of what we watch and read is very important.  But the way we share is essential.  Telling our friends “hey – read this – it’s important” or “watch this movie – it’s really moving” is one of the great things that the Internet has made easier.  But sharing has to be done on our terms, not on those that are most profitable for business.  Sharing doesn’t mean a norm of publishing everything we read on the Internet.  It means giving us a conscious choice about when we are sharing our intellectual habits, and when we are not.

Industry groups are fond of saying that good privacy practices require consumer notice and consumer choice.  The current Video Privacy Act is one of the few laws that does give consumers meaningful choice about protecting their sensitive personal information.  Now is not the time to cut back on the VPPA’s protections.  Now is the time to extend its protections to the whole range of intellectual records – the books we buy, our internet search histories, and ISP logs of what we read on the Internet.  As a first step, we should reject this attempt to eviscerate our intellectual privacy.

  January 4, 2012 at 11:42 am   Posted in: Legal Theory, Privacy, Privacy (Consumer Privacy), Web 2.0   Print This Post   No Comments

Secure Identities on the Internet

posted by Frank Pasquale

Katharine Gelber offers a thoughtful review of The Offensive Internet in the Australian Review. (David Levine conducted an interview with the book’s editors, Martha Nussbaum and Saul Levmore, available here.) I contributed an essay to this volume, and I found both the other essays in it and the conference it was based on very illuminating. As Gelber notes,

Anyone who believes the Internet to be exclusively, or even primarily, a site for the democratisation of the media or a mechanism to enhance participation in public discourse needs to read this book. This outstanding collection tackles the dark side of the Internet, its use by ‘cyber mobs’, liars, aggressive misogynists and purveyors of hate to distribute their views largely with impunity, while their targets suffer the consequences of this predominantly unregulated arena for speech. . . .

Read the rest of this post »

  January 2, 2012 at 11:36 am   Posted in: Civil Rights, Culture, Current Events, Privacy, Technology   Print This Post   No Comments

More on the Student Data Grab

posted by Daniel Solove

Here’s another piece critiquing the Education Department’s student data grab.   I am a bit dismayed that this story has barely received coverage from the mainstream media or much general concern by the public.  Many privacy advocacy organizations have been very quiet about it.  I think that these developments are quite troublesome — they are a George W. Bush-esque endeavor, but this time, the reaction is largely ho-hum.  It shouldn’t be.

  December 30, 2011 at 9:19 pm   Posted in: Education, Privacy   Print This Post   No Comments

• « Older Entries