Overview

EU Privacy Law

In March 2006, the European Commission passed the European Data Retention Directive. This directive legally requires all Internet and telephone service providers in the EU to retain records of communication data for up to 2 years. While communication service providers are _not_ allowed to retain records of the _content_ of communications, virtually all other data about the communications is required to be collected and stored, to be turned over to the authorities upon request. The data required to be collected, at each instance of communication, is as follows:

For telephone communications (both mobile and stationary):

The telephone number, name, and address of registered user(s) of both call or sms initiator and call or sms recipient.
The date, start time, and end time of the communication.
Data identifying the type of communication service used (eg. phone call, sms, video message).
The geographical location of both parties in the entire duration of the communication.
Data identifying user's communication equipment

For Internet communications (including Internet access, e-mail, and Internet telephony):

The userID (unique ISP provided ID), telephone number (if dial-up), name and address of registered user of both the internet communication initiator and recipient.
The date and time of log-in and log-off to Internet access service, IP address, whether dynamic or static, user ID, date and time of the log-in and log-off of e-mail or VoIP service of both parties.
Data identifying the type of communication service used (eg. site access, Sype, AIM).
The phone number for dial-up access; the digital subscriber line (DSL) or other end point of the originator of the communication.

U.S. Privacy Law

The History of U.S. Privacy Laws

Legal Decisions:

In 1782, the Continental Congress passed a law to protect the confidentiality of letters ^[1]

In 1811, in Denis v. LeClerc a newspaper editor sought to publish an improperly obtained letter. The court prohibited the publication of the letter because just as the defendant could not produce it to his associates, he could also not publish it in the press, due to the âsacrednessâ of the âconfidential letter.â ^[2]

In 1825, Congress enacted another law to protect the confidentiality of letters by criminalizing taking âany letter, postal card, or package out of any post office or any authorized depository for mail matter, or from any letter or mail carrier.â ^[3]

In 1877, in Ex Parte Jackson the Supreme Court concluded that the Fourth Amendment protected letters from government inspection without a warrant. The fact that people willingly gave the government their letters for delivery did not waive protection, as the government was expected to keep them confidential. (SSRN)

In 1890 Samuel Warren and Louis Brandeis termed the phrase "the right to be let alone" in their famous article in the Harvard Law Review titled The Right to Privacy. This was one of the earliest legal articles in the U.S relating to privacy issues.
- In 1891, just a year after the article was published, the âright to be let aloneâ found its way into constitutional law. The Supreme Court held in Union Pacific Railway Company v. Botsford that a court could not compel a plaintiff in a civil suit to undergo a surgical examination: âAs well said by Judge Cooley: âThe right to oneâs person may be said to be a right of complete immunity; to be let aloneâ (SSRN)

In the famous 1902 case of Roberson v. Rochester Folding Box Company the court rejected the right to privacy. An advertisement for Franklin Mills Flour used a drawing of a young woman, Abigail Roberson, without her consent. The picture was a flattering one, but Roberson sued because she was âhumiliatedâ by it and suffered mental distress as a result. The court concluded that there was âno precedentâ to recognize Warren and Brandeisâs tort remedies for invasion of privacy, and that such a right was best left to the legislature to enact ^[4]

In 1905, the Georgia Supreme Court recognized in the common law a tort remedy for invasions of privacy. The case, Pavesich v. New England Life Insurance Company involved a situation similar to that in Roberson â a manâs image was used in an advertisement without his consent. The court concluded that a âright of privacy in matters purely private is . . . derived from natural law.â ^[5]

In 1965, in Griswold v. Connecticut the Court declared that an individual has a right to privacy from the government Griswold v Connecticut.

In 1967, in Time, Inc. v. Hill the Court faced the question: Is a publication, containing misrepresentations about the subject of its coverage, protected under the First Amendment's freedom of speech guarantees? They concluded yes because "absent a finding of such malicious intent on the part of a publisher, press statements are protected under the First Amendment even if they are otherwise false or inaccurate" ^[6].

In 1968, in Mancusi v. DeForte the Supreme Court addressed whether a union employee had a legitimate expectation of privacy, and therefore Fourth Amendment standing, in the contents of records that he stored in an office that he shared with several other union officials. The Court held that DeForte had standing to object to the search and that the search was unreasonable, noting that it was clear that âif DeForte had occupied a âprivateâ office in the union headquarters, and union records had been seized from a desk or a filing cabinet in that office, he would have had standing" Mancusi v DeForte.

In 1975 in Cox Broadcasting v. Cohn the question was whether Georgia's law preventing the disclosure of the names of rape victims was constitutional. The Supreme Court held that despite the right to privacyâs âimpressive credentials,â when âtrue information is disclosed in public court documents open to public inspection, the press cannot be sanctioned for publishing it.â The Court declined to address âthe broader questionâ that would implicate the constitutionality of the tort in all its applications â namely, âwhether the State may ever define and protect an area of privacy free from unwanted publicity in the press ^[7]

In 1977, in Zacchini v. Scripps-Howard Broadcasting Co the Supreme Court said that a news station violated the Constitution when it videotaped and aired Zacchini's "human-cannonball" stunt without his permission. The logic of the opinion is that even though the the airing was not meant to be malicious and the event took place in a public setting, because the plaintiff asked for his stunt not to be published without payment the actions of the news station were unlawful ^[8].

In 1987 in O'Connor ET AL. v. Ortega the Court found that workplace property remains within the control of the employer âeven if the employee has placed personal items in [it]" O'Connor ET AL. v. Ortega'

Subsequent Supreme Court cases reiterated the Cox rule. In Smith v. Daily Mail the Court held: âIf a newspaper lawfully obtains truthful information about a matter of public significance then state officials may not constitutionally punish publication of the information, absent a need to further a state interest of the highest order.â In Florida Star v. B.J.F. the Court reiterated the rule in Daily Mail in concluding that the First Amendment prohibited liability when a newspaper published the name of a rape victim obtained from a police report ^[9]

SEC vs. Jerry T. Obrien Inc. It is established that when a person communicates information to a third party even on the understanding that the communication is confidential, he cannot object if the third party conveys that information or records thereof to law enforcement authorities ^[10]. It also disables respondents from arguing that notice of subpoenas issued to third parties is necessary to allow a target to prevent an unconstitutional search or seizure of his papers

Digital Privacy Decisions

In United States v. Simons, the ruling was that employees do not have a reasonable expectation of privacy when it comes to their work related electronic communicationsUnited States v. Simons

In United States v. Gourde, 440 F.3d 1065, 1077 (9th Cir. 2006) it was found that "for most people, their computers are their most private spaces" United States v. Gourde

In 2007, United States v. Zeigler. In this case, an employee had accessed child pornography websites from his workplace computer. His employer noticed his activities, made copies of the hard drive, and gave the FBI the employee's computer. At his criminal trial, Ziegler filed a motion to suppress the evidence because he argued that the government violated his Fourth Amendment rights. The Ninth Circuit allowed the lower court to admit the child pornography evidence. After reviewing relevant Supreme Court opinions on a reasonable expectation of privacy, the Court acknowledged that Ziegler had a reasonable expectation of privacy at his office and on his computer, however, the court found that: "In this context, Ziegler could not reasonably have expected that the computer was his personal property, free from any type of control by his employer. The contents of his hard drive, like the files in Mancusi, 392 U.S. at 369, were work-related items that contained business information and which were provided to, or created by, the employee in the context of the business relationship. Zieglerâs downloading of personal items to the computer did not destroy the employerâs common authority. Ortega, 480 U.S. at 716. Thus...the employer, could consent to a search of the office and the computer that it provided to Ziegler for his work" United States v. Zeigler

In 2007, State of New Jersey v. Shirley Reid. In the case, prosecutors asserted that Shirley Reid broke into her employerâs computer system and changed its shipping address and password for suppliers. The police discovered her identity after getting a subpoena to the internet provider, Comcast Internet Service. The lower court suppressed information from the internet service provider that linked Reid with the crime. The New Jersey appellate court agreed with this decision. As a result, New Jersey offers greater privacy rights to computer users than most federal courts. Although this case does not directly discuss the Fourth amendment, it illustrates that some states are providing more privacy protection to computer users than the federal courts. It also illustrates that caselaw on privacy in workplace computers is still evolving State of New Jersey v. Shirley Reid

Examples of Problems Not Yet Taken to Court

In early September 2006, Jason Fortuny, a Seattle-area graphic designer and network administrator, posed as a woman and posted an ad to Craigslist Seattle seeking a casual sexual encounter with area men. On September 4, he posted to the internet all 178 of the responses, complete with photographs and personal contact details, describing this as the Cragslist Experiment and encouraging others to further identify the respondents. Fortuny Incident

U.S. Privacy Laws:

U.S Privacy Act of 1974 mandated a set of fair information practices, including disclosure of private information only with the an individualâs consent (with exceptions for law enforcement, archiving, and routine uses), and established the right of the subject to know what was recorded about her and to offer corrections. While it originally intended to apply to a broad range of public and private databases to parallel the H.E.W. report, the Act was amended before passage to apply only to government agenciesâ records (Zittrain chapter 9)

Fair Information Practice Principles articulation made by the Federal Trade Commission concerning privacy.

Brief Synopsis of These Laws and Their Relation to Online Privacy/Data Retention

Americans are skeptical of having the government have their information but OK having business handle it [1]. That is, in the US privacy protection is essentially liberty protection, i.e. protection from government [2]. Moreover, American privacy law has never fully embraced privacy within relationships; it typically views information exposed to others as no longer private ^[11].

Generational Differences in Attitudes about Privacy

At America's inception, George Washington had feared that his letters about the new Constitution were not confidential, âfor by passing through the post-office, they should become known to all the world." By the end of the nineteenth century a remarkable transformation in social attitudes and law had taken place. As David Seipp explains, â[n]ineteenth century public opinion regarded the âsanctity of the mailsâ as absolute in the same way it esteemed the inviolability of the home.â Improved confidentiality procedures in the Post Office and strong legal protections went hand in hand with an emerging attitude that the ideas and sentiments expressed in letters traveling through the postal system should remain inviolate, in language often tinged with overtly religious imagery. Thus, a Louisiana court could refer in 1811 to the lawâs respect for âthe sacredness of a manâs correspondence.â ^[12].

In 1890, Samuel Warren and Louis Brandeis wrote The Right To Privacy in the Harvard Law Review which advocated the "right to be let alone"

William Prosner in 1960 wrote Privacy and helped on Restatement (Second of Torts) (http://papers.ssrn.com/sol3/papers.cfm?abstract_id=969495).
- Established American privacy law as four related torts
- Minimized the importance of confidentiality in American law

In America, the prevailing belief is that people assume the risk of betrayal when they share secrets with each other (papers.ssrn.com)

During the 1940s and 50s, many more jurisdictions began recognizing the right to privacy, with the result that by the 1950s, most states had adopted a tort right of privacy in one form or another (SSRN)

William Prosserâs most famous discussion of the topic was a 1960 article entitled Privacy published in the California Law Review. In that article, Prosser noted that over 300 privacy cases had been decided since the Warren and Brandeis article, and that to date, there had been little âattempt to inquire what interests we are protecting, and against what conduct." Prosser identified the torts as follows:

Intrusion upon the plaintiffâs seclusion or solitude, or into his private affairs.
Public disclosure of embarrassing private facts about the plaintiff.
Publicity which places the plaintiff in a false light in the public eye.
Appropriation, for the defendantâs advantage, of the plaintiffâs name or likeness.169

In creating this taxonomy of the law of privacy, Prosser had a dramatic effect on the development of privacy law in America (SSRN). First, individuals are willing to trade privacy for convenience or bargain the release of personal information in exchange for relatively small rewards. Second, individuals are seldom willing to adopt privacy protective technologies (http://www.heinz.cmu.edu/~acquisti/papers/acquisti.pdf).

Origins of Divergence of U.S. and European Privacy Laws

Warren and Brandeis did not write on a nearly blank slate when they crafted their âright to privacy.â Instead of developing and expanding the robust law of confidentiality that already existed, Warren and Brandeis took American privacy law down a different path. (SSRN)
- Before the Warren and Brandeis article, English and American privacy law were on a similar trajectory, being built out of the same materials and concepts. American judges read English precedent and attempted to situate their rulings within the fabric of the common law. Afterwards, the paths diverged. The path Warren and Brandeis charted for American privacy law was not that of developing the law of confidentiality. (SSRN)
- Instead of creating a law of privacy, however, England developed a law of confidentiality, which was explicitly distinguished from privacy. Ironically, both the American law of privacy and the English law of confidentiality emerged from the same source â the Prince Albert case.(SSRN)

^[13]

What the Experts Think

Jonathan Zittrain believes U.S. digital privacy law should be in the spirit of Chapman v. United States. In this case, a police search of a rented house for a whiskey still was found to be a violation of the Fourth Amendment rights of the tenant, despite the fact that the landlord had consented to the search. The Court refused to find that the right against intrusion was held only by the absentee owner of the place intruded â rather, it was held by the person who actually lived and kept his effects there.
Jisuk Woo believes that the right not to be identified should be the most important concept that privacy consists of on the internet. By not being identified, he hopes that individuals can protect themselves from the potential risk and threat of surveillance of their activities. He believes that the modern concept of privacy has set as its main goal freedom from the government, and although citizens may be concerned about internet privacy, they willingly give up their privacy for consumer convenience and other monetary benefits. Therefore, policy measures for network privacy should focus on ensuring individual usersâ search for anonymity by recognizing the right to be silent about their identities and the right to disguise their identities rather than providing restrictions on easily identifiable external forces and institutions.^[14].
Avner Levin and Mary Jo Nicholson write that in Canada, privacy protection is focused on individual autonomy through personal control of information. Therefore, they propose the Canadian model as a conceptual middle ground between the EU and the US, as a basis for future American privacy protection. They find U.S. privacy protection to be primarily motivated by the protection of liberty; In the EU, the protection of privacy is mainly the protection of oneâs dignity. Canadians occupy the middle ground between the EU and the US, sharing American concerns about âBig Brotherâ government, while also having deep concerns about private sector abuse of their personal information. As a result, they find that Canadians identify privacy with a sense of control that enables them as individuals to set limits upon both the public and the private sector. (http://www.uoltj.ca/articles/vol2.2/2005.2.2.uoltj.Levin.357-395.pdf)

Problems

Choosing between providing oneâs personal information and giving up the information and services that an individual wants from the network is particularly difficult in the current technological environment because, in many cases, it is not known what will happen to the personal information once it is out on the network. ^[15]

Googleâs StreetView means that people are visible just walking on the street (http://www.wired.com/culture/lifestyle/commentary/theluddite/2007/06/luddite_0607), in their house, etc.

What one thinks is private might actually be public (potential employer checking a facebook account) (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html)

American business handle consumers private information and sell it to third parties (http://www.iht.com/articles/2005/08/07/news/data.php).

While market forces might ensure fair use of data connected to the on-line identity, they do not guarantee optimal use and appropriate protection of the off-line identity (http://www.heinz.cmu.edu/~acquisti/papers/acquisti_eis_refs.pdf)

Solutions

Be more like Canadian law
- Levin and Nicholson's solution ties together Europe's fight for privacy as dignity and American's fight for privacy as liberty. Liberty affords control in the political sphere, not giving up control to one's government. Dignity affords control in the social sphere - not giving up control to others with whom one interacts - neighbors, teachers, businesses, employers, etc.
  - Their proposed solution is the Canadian model which protects dignity and liberty.

Questions a Solution Should Answer:

How do we afford individual's control over one's image, one's dignity, etc in this digital age?
- According to past EU laws precedents, new laws regarding, say, someone posting embarassing photos of me on Flickr would be illegal, as it would invade my privacy by offending my dignity. It would not, however, offend my liberty (and it seems that such liberty arguments are largely moot anyways with the introduction of the Patriot Act, which gives the government incredible access to our private information, and hence our liberty) (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html).

According to the authors, the Candaians "got it right". Consider their definition, and then explanation, of privacy:

" ...the right to control access to oneâs person and information about oneâs self. The right to privacy means that individuals get to decide what and how much information to give up, to whom it is given, and for what uses....A multicultural society does not attempt to impose on its members values, which some elements in it may very well hold dearâsuch as dignity or libertyâbut encourages the development of these values autonomously, within a multicultural framework. Canadians, it seems, perceive their privacy as most importantly protecting this autonomy, and believe that members of society should be free to decide for themselves what is important for them to control."

Should the goal be to give individuals the right to control information about themselves? At the cost of government interference about collecting and posting information? (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html). Authors argue that "Americans want their government to let them interact freely with one another and to not intervene." But this is changing: "As e-mails, modems, and PCs break down the boundaries between work and home, there are progressively fewer private or public spaces for citizens to express themselves autonomously. The Internet has blurred the distinction between the home and the office, as Americans are spending more time at the office and are using company-owned computers and Internet servers to do their work from home. But as technology poses new challenges to geographic concepts of privacy, courts have not been encouraged to think creatively about how to reconstruct zones of individual privacy and free expression."

the bold is where we come in (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html) - More broadly, since American privacy law often remains focused around individualistic conceptions of privacy, it has not fully embraced protecting confidentiality in relationships. In many other contexts, such as trade secrets and business confidences, American law readily provides remedies against unwarranted breaches of trust.403 But in the domain of privacy, American law has not progressed nearly as far as English law in recognizing and protecting trust in relationships. An increased recognition of a confidentiality-based conception of privacy might also have significant implications in other areas of American privacy law that developed under the influence of Warren and Brandeis. (SSRN)

- Concerns over such power (and its potential abuse) has prompted three types of reactions â the comprehensive legislative response, the constitutional reinterpretation response and the null response. a. Comprehensive Privacy Legislation: Many privacy advocates argue that the comprehensive trail of personal digitized data that are retained requires a similarly comprehensive legislative reaction. While constraining data retention the goal of such legislative action is much broader. Only privacy statutes covering both the private and the public sector and encompassing all stages of the use of personal information - from collection and processing to retention and transferal - are seen as capable of containing and mitigating the danger to our privacy. So-called omnibus data protection is often bolstered with stringent auditing and enforcement procedures. The result is complex legal regimes that private and public sector users of personal information have to comply with 31 In many industrial and post-industrial nations around the world, from Canada31, Argentina32 and Chile33 to Hong Kong34 to Australia35 and New Zealand36 such legislation has been enacted, partially in response to public fears of large scale data collection and retention37; in Europe, the European Union (EU) Data Protection Directive, passed in 1995, obligates all twenty-seven member nations of the EU to pass stringent omnibus privacy laws.38 In nations where such comprehensive data protection regimes are still absent, like the United States, privacy advocates hope that media reports and general citizen unease over the threat to information privacy ultimately produce the ferment for political and legislative action. At the same token, such a response is fraught with two substantial problems: political inertia due to collective action hurdles and potential structural overreach combined with limited actual impact. (http://ksgnotes1.harvard.edu/Research/wpaper.nsf/rwp/RWP07-022/$File/rwp_07_022_mayer-schoenberger.pdf)