Digital Privacy

EU Privacy Law

In March 2006, the European Commission passed the European Data Retention Directive. This directive legally requires all Internet and telephone service providers in the EU to retain records of communication data for up to 2 years. While communication service providers are _not_ allowed to retain records of the _content_ of communications, virtually all other data about the communications is required to be collected and stored, to be turned over to the authorities upon request. The data required to be collected, at each instance of communication, is as follows:

For telephone communications (both mobile and stationary):

• The telephone number, name, and address of registered user(s) of both call or sms initiator and call or sms recipient.
• The date, start time, and end time of the communication.
• Data identifying the type of communication service used (eg. phone call, sms, video message).
• The geographical location of both parties in the entire duration of the communication.
• Data identifying user's communication equipment

For Internet communications (including Internet access, e-mail, and Internet telephony):

• The userID (unique ISP provided ID), telephone number (if dial-up), name and address of registered user of both the internet communication initiator and recipient.
• The date and time of log-in and log-off to Internet access service, IP address, whether dynamic or static, user ID, date and time of the log-in and log-off of e-mail or VoIP service of both parties.
• Data identifying the type of communication service used (eg. site access, Sype, AIM).
• The phone number for dial-up access; the digital subscriber line (DSL) or other end point of the originator of the communication.

U.S. Privacy Law

The History of U.S. Privacy Laws

Legal Decisions:

• In 1782, the Continental Congress passed a law to protect the confidentiality of letters

• In 1811, in Denis v. LeClerc a newspaper editor sought to publish an improperly obtained letter. The court prohibited the publication of the letter because just as the defendant could not produce it to his associates, he could also not publish it in the press, due to the “sacredness” of the “confidential letter.”

• In 1825, Congress enacted another law to protect the confidentiality of letters by criminalizing taking “any letter, postal card, or package out of any post office or any authorized depository for mail matter, or from any letter or mail carrier.”

• In 1877, in Ex Parte Jackson the Supreme Court concluded that the Fourth Amendment protected letters from government inspection without a warrant. The fact that people willingly gave the government their letters for delivery did not waive protection, as the government was expected to keep them confidential. (SSRN)

• In 1890 Samuel Warren and Louis Brandeis termed the phrase "the right to be let alone" in their famous article in the Harvard Law Review titled The Right to Privacy. This was one of the earliest legal articles in the U.S relating to privacy issues.
• In 1891, just a year after the article was published, the “right to be let alone” found its way into constitutional law. The Supreme Court held in Union Pacific Railway Company v. Botsford that a court could not compel a plaintiff in a civil suit to undergo a surgical examination: “As well said by Judge Cooley: ‘The right to one’s person may be said to be a right of complete immunity; to be let alone’ (SSRN)

• In the famous 1902 case of Roberson v. Rochester Folding Box Company the court rejected the right to privacy. An advertisement for Franklin Mills Flour used a drawing of a young woman, Abigail Roberson, without her consent. The picture was a flattering one, but Roberson sued because she was “humiliated” by it and suffered mental distress as a result. The court concluded that there was “no precedent” to recognize Warren and Brandeis’s tort remedies for invasion of privacy, and that such a right was best left to the legislature to enact

• In 1905, the Georgia Supreme Court recognized in the common law a tort remedy for invasions of privacy. The case, Pavesich v. New England Life Insurance Company involved a situation similar to that in Roberson – a man’s image was used in an advertisement without his consent. The court concluded that a “right of privacy in matters purely private is . . . derived from natural law.”

• In 1965, in Griswold v. Connecticut the Court declared that an individual has a right to privacy from the government Griswold v Connecticut.

• In 1967, in Time, Inc. v. Hill the Court faced the question: Is a publication, containing misrepresentations about the subject of its coverage, protected under the First Amendment's freedom of speech guarantees? They concluded yes because "absent a finding of such malicious intent on the part of a publisher, press statements are protected under the First Amendment even if they are otherwise false or inaccurate" .

• In 1968, in Mancusi v. DeForte the Supreme Court addressed whether a union employee had a legitimate expectation of privacy, and therefore Fourth Amendment standing, in the contents of records that he stored in an office that he shared with several other union officials. The Court held that DeForte had standing to object to the search and that the search was unreasonable, noting that it was clear that “if DeForte had occupied a ‘private’ office in the union headquarters, and union records had been seized from a desk or a filing cabinet in that office, he would have had standing" Mancusi v DeForte.

• In 1977, in Zacchini v. Scripps-Howard Broadcasting Co the Supreme Court said that a news station violated the Constitution when it videotaped and aired Zacchini's "human-cannonball" stunt without his permission. The logic of the opinion is that even though the the airing was not meant to be malicious and the event took place in a public setting, because the plaintiff asked for his stunt not to be published without payment the actions of the news station were unlawful .

• In 1975 in Cox Broadcasting v. Cohn the question was whether Georgia's law preventing the disclosure of the names of rape victims was constitutional. The Supreme Court held that despite the right to privacy’s “impressive credentials,” when “true information is disclosed in public court documents open to public inspection, the press cannot be sanctioned for publishing it.” The Court declined to address “the broader question” that would implicate the constitutionality of the tort in all its applications – namely, “whether the State may ever define and protect an area of privacy free from unwanted publicity in the press

• In 1987 in O'Connor ET AL. v. Ortega the Court found that workplace property remains within the control of the employer “even if the employee has placed personal items in [it]" O'Connor ET AL. v. Ortega'

• Subsequent Supreme Court cases reiterated the Cox rule. In Smith v. Daily Mail the Court held: “If a newspaper lawfully obtains truthful information about a matter of public significance then state officials may not constitutionally punish publication of the information, absent a need to further a state interest of the highest order.” In Florida Star v. B.J.F. the Court reiterated the rule in Daily Mail in concluding that the First Amendment prohibited liability when a newspaper published the name of a rape victim obtained from a police report

• SEC vs. Jerry T. Obrien Inc. It is established that when a person communicates information to a third party even on the understanding that the communication is confidential, he cannot object if the third party conveys that information or records thereof to law enforcement authorities . It also disables respondents from arguing that notice of subpoenas issued to third parties is necessary to allow a target to prevent an unconstitutional search or seizure of his papers

Digital Privacy Decisions

• In United States v. Simons, the ruling was that employees do not have a reasonable expectation of privacy when it comes to their work related electronic communicationsUnited States v. Simons

• In United States v. Gourde, 440 F.3d 1065, 1077 (9th Cir. 2006) it was found that "for most people, their computers are their most private spaces" United States v. Gourde

• In 2007, United States v. Zeigler. In this case, an employee had accessed child pornography websites from his workplace computer. His employer noticed his activities, made copies of the hard drive, and gave the FBI the employee's computer. At his criminal trial, Ziegler filed a motion to suppress the evidence because he argued that the government violated his Fourth Amendment rights. The Ninth Circuit allowed the lower court to admit the child pornography evidence. After reviewing relevant Supreme Court opinions on a reasonable expectation of privacy, the Court acknowledged that Ziegler had a reasonable expectation of privacy at his office and on his computer, however, the court found that: "In this context, Ziegler could not reasonably have expected that the computer was his personal property, free from any type of control by his employer. The contents of his hard drive, like the files in Mancusi, 392 U.S. at 369, were work-related items that contained business information and which were provided to, or created by, the employee in the context of the business relationship. Ziegler’s downloading of personal items to the computer did not destroy the employer’s common authority. Ortega, 480 U.S. at 716. Thus...the employer, could consent to a search of the office and the computer that it provided to Ziegler for his work" United States v. Zeigler

• In 2007, State of New Jersey v. Shirley Reid. In the case, prosecutors asserted that Shirley Reid broke into her employer’s computer system and changed its shipping address and password for suppliers. The police discovered her identity after getting a subpoena to the internet provider, Comcast Internet Service. The lower court suppressed information from the internet service provider that linked Reid with the crime. The New Jersey appellate court agreed with this decision. As a result, New Jersey offers greater privacy rights to computer users than most federal courts. Although this case does not directly discuss the Fourth amendment, it illustrates that some states are providing more privacy protection to computer users than the federal courts. It also illustrates that caselaw on privacy in workplace computers is still evolving State of New Jersey v. Shirley Reid

Examples of Problems Not Yet Taken to Court

• In early September 2006, Jason Fortuny, a Seattle-area graphic designer and network administrator, posed as a woman and posted an ad to Craigslist Seattle seeking a casual sexual encounter with area men. On September 4, he posted to the internet all 178 of the responses, complete with photographs and personal contact details, describing this as the Cragslist Experiment and encouraging others to further identify the respondents. Fortuny Incident

U.S. Privacy Laws:

• U.S Privacy Act of 1974 mandated a set of fair information practices, including disclosure of private information only with the an individual’s consent (with exceptions for law enforcement, archiving, and routine uses), and established the right of the subject to know what was recorded about her and to offer corrections. While it originally intended to apply to a broad range of public and private databases to parallel the H.E.W. report, the Act was amended before passage to apply only to government agencies’ records (Zittrain chapter 9)

• Fair Information Practice Principles articulation made by the Federal Trade Commission concerning privacy.

Brief Synopsis of These Laws and Their Relation to Online Privacy/Data Retention

• Americans are skeptical of having the government have their information but OK having business handle it [1].

• In the US, privacy protection is essentially liberty protection, i.e. protection from government [2].

• American privacy law has never fully embraced privacy within relationships; it typically views information exposed to others as no longer private .

Therefore, the modern concept of privacy is based on the people’s right to be free from intrusion into their lives by the government and mass media.... The 19th-century concept of privacy was concerned with people’s over their private space and lives against external forces; its main concern was the relationship between a person and authoritative institutions, such as the state or press. Thus, the modern concept of privacy has set as its main goal freedom from these institutions. Although people may say that they are concerned about internet privacy, they then willingly give up their privacy for consumer convenience and other monetary benefits....The right not to be identified should be the most important concept that privacy consists of on the internet and that, by not being blatantly identified, individuals can protect themselves from the potential risk and threat of not easily identifiable entities of surveillance and their activities..

Generational Differences in Attitudes about Privacy

• At America's inception, George Washington had feared that his letters about the new Constitution were not confidential, “for by passing through the post-office, they should become known to all the world." By the end of the nineteenth century a remarkable transformation in social attitudes and law had taken place. As David Seipp explains, “[n]ineteenth century public opinion regarded the ‘sanctity of the mails’ as absolute in the same way it esteemed the inviolability of the home.” Improved confidentiality procedures in the Post Office and strong legal protections went hand in hand with an emerging attitude that the ideas and sentiments expressed in letters traveling through the postal system should remain inviolate, in language often tinged with overtly religious imagery. Thus, a Louisiana court could refer in 1811 to the law’s respect for “the sacredness of a man’s correspondence.” .

• In 1890, Samuel Warren and Louis Brandeis wrote The Right To Privacy in the Harvard Law Review which advocated the "right to be let alone"

• William Prosner in 1960 wrote Privacy and helped on Restatement (Second of Torts) (http://papers.ssrn.com/sol3/papers.cfm?abstract_id=969495).

o Established American privacy law as four related torts o Minimized the importance of confidentiality in American law - In America, the prevailing belief is that people assume the risk of betrayal when they share secrets with each other (papers.ssrn.com) - As the preceding discussion illustrates, Warren and Brandeis did not write on a nearly blank slate when they crafted their “right to privacy.” Instead of developing and expanding the robust law of confidentiality that already existed, Warren and Brandeis took American privacy law down a different path. Before the Warren and Brandeis article, English and American privacy law were on a similar trajectory, being built out of the same materials and concepts. American judges read English precedent and attempted to situate their rulings within the fabric of the common law. Afterwards, the paths diverged. The next part explores the path Warren and Brandeis charted for American privacy law, and also the path not taken – that of developing the law of confidentiality. England took this alternative path, with some illuminating and fascinating results (SSRN) - Instead of creating a law of privacy, England developed a law of confidentiality, which was explicitly distinguished from privacy. Ironically, both the American law of privacy and the English law of confidentiality emerged from the same source – the Prince Albert case. In this Part, we compare the two divergent paths leading from Prince Albert (SSRN) - In 1902, The Roberson case produced a wave of public criticism. An editorial in the New York Times lambasted the decision.153 Commentary in law reviews largely sided with Roberson and decried the court’s failure to redress her injury,154 although one of the judges who decided the Roberson case took the unusual step of defending the decision in the Columbia Law Review.155 A year later, in 1903, the New York legislature responded to the case by enacting a statute allowing people to sue for invasion of privacy where their “name, portrait, or picture” was used without consent “for purposes of trade (SSRN) - During the 1940s and 50s, many more jurisdictions began recognizing the right to privacy, with the result that by the 1950s, most states had adopted a tort right of privacy in one form or another (SSRN) -William Prosser’s most famous discussion of the topic was a 1960 article entitled Privacy published in the California Law Review.166 In that article, Prosser noted that over 300 privacy cases had been decided since the Warren and Brandeis article, and that to date, there had been little “attempt to inquire what interests we are protecting, and against what conduct…Prosser identified the torts as follows: 1. Intrusion upon the plaintiff’s seclusion or solitude, or into his private affairs. 2. Public disclosure of embarrassing private facts about the plaintiff. 3. Publicity which places the plaintiff in a false light in the public eye. 4. Appropriation, for the defendant’s advantage, of the plaintiff’s name or likeness.169 - In creating this taxonomy of the law of privacy, Prosser had a dramatic effect on the development of privacy law in America (SSRN) First, individuals are willing to trade privacy for convenience or bargain the release of personal information in exchange for relatively small rewards. Second, individuals are seldom willing to adopt privacy protective technologies (http://www.heinz.cmu.edu/~acquisti/papers/acquisti.pdf)

The famous phrase, the right "to be let alone" has a long history. As far back as 1834, the U.S. Supreme Court mentioned that a "defendant asks nothing — wants nothing, but to be let alone until it can be shown that he has violated the rights of another." Wheaton v. Peters, 33 U.S. 591, 634 (1834)… Subsequently, Brandeis used the phrase "the right to be let alone" in his famous dissent in Olmstead v. U.S., 277 U.S. 438, 478 (1928), the first wiretapping case heard by the U.S. Supreme Court. The "right to be let alone" is the most terse definition of the right to privacy, although, through numerous U.S. Supreme Court decisions cited later in this article, this phrase has come to be associated with preventing invasions of the private sphere by the government (http://www.rbs2.com/privacy.htm#anchor222222)

What the Experts Think

Jonathan Zittrain believes U.S. digital privacy law should be in the spirit of Chapman v. United States. In this case, a police search of a rented house for a whiskey still was found to be a violation of the Fourth Amendment rights of the tenant, despite the fact that the landlord had consented to the search. The Court refused to find that the right against intrusion was held only by the absentee owner of the place intruded — rather, it was held by the person who actually lived and kept his effects there. Similarly, the data we store for ourselves in servers that others own ought to be thought of as our own papers and effects in which we have a right to be secure .

Problems

Choosing between providing one’s personal information and giving up the information and services that an individual wants from the network is particularly difficult in the current technological environment because, in many cases, it is not known what will happen to the personal information once it is out on the network.

Disparities between digital privacy laws of the European Union and those of the United States.

'CHARTER OF FUNDAMENTAL RIGHTS OF THE EUROPEAN UNION'

Article 7 Respect for private and family life Everyone has the right to respect for his or her private and family life, home and communications.

Article 8 Protection of personal data 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.[3] [4]

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [5]

Regulation 45/2001 [6]

U.S. Laws

   * United States Code
         o TITLE 17 - COPYRIGHTS
               + CHAPTER 12 - COPYRIGHT PROTECTION AND MANAGEMENT SYSTEMS 

Section 1205. Savings clause

     Nothing in this chapter abrogates, diminishes, or weakens the
   provisions of, nor provides any defense or element of mitigation in
   a criminal prosecution or civil action under, any Federal or State
   law that prevents the violation of the privacy of an individual in
   connection with the individual's use of the Internet. [7]

• o Google’s StreetView means that people are visible just walking on the street (http://www.wired.com/culture/lifestyle/commentary/theluddite/2007/06/luddite_0607), in their house, etc.

o What one thinks is private might actually be public (potential employer checking a facebook account) (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html) o o American business handle consumers private information and sell it to third parties (http://www.iht.com/articles/2005/08/07/news/data.php). o Nevertheless, a number of commentators view the privacy torts as not very successful because it remains difficult for plaintiffs to prevail under many of them.219 And the privacy torts have struggled when addressing emerging privacy problems in the Information Age, such as the collection, use, and disclosure of personal data by businesses (SSRN) While market forces might ensure fair use of data connected to the on-line identity, they do not guarantee optimal use and appropriate protection of the off-line identity (http://www.heinz.cmu.edu/~acquisti/papers/acquisti_eis_refs.pdf)

Solutions

Therefore, policy measures for network privacy should focus on ensuring individual users’ search for anonymity by recognizing the right to be silent about their identities and the right to disguise their identities rather than providing restrictions on easily identifiable external forces and institutions.

• Solutions

- In Canada, privacy protection is focused on individual autonomy through personal control of information. We propose the Canadian model as a conceptual middle ground between the EU and the US, as a basis for future American privacy protection. In the US, we find privacy protection to be primarily motivated by the protection of liberty. In the EU, we find that the protection of privacy is mainly the protection of one’s dignity. In Canada, we find that Canadians occupy the middle ground between the EU and the US, sharing American concerns about “Big Brother” government, while also having deep concerns about private sector abuse of their personal information. As a result, we find Canadians identify privacy with a sense of control that enables them as individuals to set limits upon both the public and the private sector. (http://www.uoltj.ca/articles/vol2.2/2005.2.2.uoltj.Levin.357-395.pdf) What Levin and Nicholson argue ties together European's fight for privacy as dignity and American's fight for privacy as liberty is autonomy - the individual's sense of control. Liberty affords control in the political sphere, not giving up control to one's government. Dignity affords control in the social sphere - not giving up control to others with whom one interacts - neighbors, teachers, businesses, employers, etc.

This seems to be a big goal here, in thinking about where legislation steps in, again in JP's tier concepts. How do we afford individual's control over one's image, one's dignity, etc in this digital age? It seems from this, the Europeans do "got it right" - according to past EU laws precedents, new laws regarding, say, someone posting embarassing photos of me on Flickr would be illegal, as it would invade my privacy by offending my dignity. It would not, however, offend my liberty (and it seems that such liberty arguments are largely moot anyways with the introduction of the Patriot Act, which gives the government incredible access to our private informaiton, and hence our liberty) (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html). According to the authors, the Candaians "got it right". Consider their definition, and then explanation, of privacy:

" ...the right to control access to one’s person and information about one’s self. The right to privacy means that individuals get to decide what and how much information to give up, to whom it is given, and for what uses....A multicultural society does not attempt to impose on its members values, which some elements in it may very well hold dear—such as dignity or liberty—but encourages the development of these values autonomously, within a multicultural framework. Canadians, it seems, perceive their privacy as most importantly protecting this autonomy, and believe that members of society should be free to decide for themselves what is important for them to control."

Should the goal be to give individuals the right to control information about themselves? At the cost of government interference about collecting and posting information? (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html). Authors argue that "Americans want their government to let them interact freely with one another and to not intervene." But this is changing: "As e-mails, modems, and PCs break down the boundaries between work and home, there are progressively fewer private or public spaces for citizens to express themselves autonomously. The Internet has blurred the distinction between the home and the office, as Americans are spending more time at the office and are using company-owned computers and Internet servers to do their work from home. But as technology poses new challenges to geographic concepts of privacy, courts have not been encouraged to think creatively about how to reconstruct zones of individual privacy and free expression."

the bold is where we come in (http://diginatives.blogspot.com/2007/06/dn-specific-takeaways-from-privacy-law.html) - More broadly, since American privacy law often remains focused around individualistic conceptions of privacy, it has not fully embraced protecting confidentiality in relationships. In many other contexts, such as trade secrets and business confidences, American law readily provides remedies against unwarranted breaches of trust.403 But in the domain of privacy, American law has not progressed nearly as far as English law in recognizing and protecting trust in relationships. An increased recognition of a confidentiality-based conception of privacy might also have significant implications in other areas of American privacy law that developed under the influence of Warren and Brandeis. (SSRN)

- Concerns over such power (and its potential abuse) has prompted three types of reactions – the comprehensive legislative response, the constitutional reinterpretation response and the null response. a. Comprehensive Privacy Legislation: Many privacy advocates argue that the comprehensive trail of personal digitized data that are retained requires a similarly comprehensive legislative reaction. While constraining data retention the goal of such legislative action is much broader. Only privacy statutes covering both the private and the public sector and encompassing all stages of the use of personal information - from collection and processing to retention and transferal - are seen as capable of containing and mitigating the danger to our privacy. So-called omnibus data protection is often bolstered with stringent auditing and enforcement procedures. The result is complex legal regimes that private and public sector users of personal information have to comply with 31 In many industrial and post-industrial nations around the world, from Canada31, Argentina32 and Chile33 to Hong Kong34 to Australia35 and New Zealand36 such legislation has been enacted, partially in response to public fears of large scale data collection and retention37; in Europe, the European Union (EU) Data Protection Directive, passed in 1995, obligates all twenty-seven member nations of the EU to pass stringent omnibus privacy laws.38 In nations where such comprehensive data protection regimes are still absent, like the United States, privacy advocates hope that media reports and general citizen unease over the threat to information privacy ultimately produce the ferment for political and legislative action. At the same token, such a response is fraught with two substantial problems: political inertia due to collective action hurdles and potential structural overreach combined with limited actual impact. (http://ksgnotes1.harvard.edu/Research/wpaper.nsf/rwp/RWP07-022/$File/rwp_07_022_mayer-schoenberger.pdf)

Relevant Research and Articles

Useful Void: The Art of Forgetting in the Age of Ubiquitous Computing (Mayer-Schoenberger, 2007)

How Many Ways You're Being Watched, USA Today (2007)

Enjoying Technologies Conveniences But Not Escaping Its Watchful Eyes, Washington Post (2007)

Mediating the public/private boundary at home : children’s use of the internet for privacy and participation (S. Livingstone, 2005)

Your Identity, Open to All (Wired News, 2005)

Why Web 2.0 will end your privacy (Bit Tech, 2006)

Strong privacy laws may explain data security in Europe (Intl. Herald Tribune, 2005)

OnGuardOnline - provides tips from the federal government and the technology industry on Internet fraud, securing your computer, and protecting your personal information.

COPPA - Children's Online Privacy Protection Act

Imagined Communities: Awareness, Information Sharing, and Privacy on the Facebook (Acquisti and Gross, 2006).

Privacy International, A Race to the Bottom: Privacy Ranking of Internet Service Companies June 9, 2007.

U.S. Privacy Articles

Digital Millenium Copyright Act of 1998

Software lets parents monitor kids' calls

A privacy paradox: Social networking in the United States (Barnes, 2006)

Your first girlfriend -- and the other things search engines store about you

European Privacy

Relevant Legislation

EU Data Retention Directive, Article 5,6,10

EU Directive on Privacy and Electronic Communications, Article 4,5,6,9,12

Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms, Article 8,10

Resources and Articles

Digital Civil Rights in Europe

European Data Protection Supervisor

Data Protection

Legislation

French State Council allows tracing P2P users

The European Parliament voted for stronger data protection

Europe votes to restrict police data sharing

Google may use games to analyse net users

Minister of the Interior renews call for legal online PC search option

German government admits it is already conducting online searches

Google hostile to privacy

ICT lobby says Dutch law protects privacy rights in RFID applications

Privacy in US v. Europe: Comparing conceptions and legislation

‘La difference’ is stark in EU, U.S. privacy laws

Internet privacy law: a comparison between the United States and the European Union

Privacy Law in the United States, the EU and Canada: The Allure of the Middle Ground

N. Richards & D. Solove, PRIVACY’S OTHER PATH: RECOVERING THE LAW OF CONFIDENTIALITY (A comparison of English and American privacy law)

Suddenly, the Paranoids Don't Seem So Paranoid Anymore, Wired, June 2007

Strong privacy laws may explain data security in Europe, The New York Times', August 2005