Information Fiduciaries Research Articles

The inclusive data governance models for algorithms – a dream of the already convinced or a realistic way of action?

ABSTRACT The article presents the implications of personal data governance models for algorithmic discrimination. It reflects on the significance of engaging with data subjects to prevent or mitigate discrimination by comparing the effectiveness of the top-down and bottom-up approaches to data governance. The paper goes beyond the option to either decline or agree to terms of service while entering online platforms and argues that bottom-up data governance models of data trusts and information fiduciaries can be more inclusive than the top-down data governance.

A Research on the Theory of Information Fiduciaries and Its Implications for Taiwan

A Research on the Theory of Information Fiduciaries and Its Implications for Taiwan

The case for information fiduciaries: The implementation of a data ethics checklist at Seattle Children's Hospital.

There is little debate about the importance of ethics in health care, and clearly defined rules, regulations, and oaths help ensure patients' trust in the care they receive. However, standards are not as well established for the data professions within health care, even though the responsibility to treat patients in an ethical way extends to the data collected about them. Increasingly, data scientists, analysts, and engineers are becoming fiduciarily responsible for patient safety, treatment, and outcomes, and will require training and tools to meet this responsibility. We developed a data ethics checklist that enables users to consider the possible ethical issues that arise from the development and use of data products. The combination of ethics training for data professionals, a data ethics checklist as part of project management, and a data ethics committee holds potential for providing a framework to initiate dialogues about data ethics and can serve as an ethical touchstone for rapid use within typical analytic workflows, and we recommend the use of this or equivalent tools in deploying new data products in hospitals.

A General Defense of Information Fiduciaries

Countless high-profile abuses of user data by leading technology companies have raised a basic question: should firms that traffic in user data be held legally responsible to their users as “information fiduciaries”? Privacy legislation to impose fiduciary-like duties of care, confidentiality, and loyalty on data collectors enjoys bipartisan support but faces strong opposition from scholars. First, critics argue that the information fiduciary concept flies in the face of fundamental corporate law principles that require firms to prioritize shareholder interests over those of users. Second, it is said that the overwhelming self-interest of digital companies makes fiduciary loyalty impossible as a practical matter from the outset. This essay finds neither objection convincing. The first objection rests on a mischaracterization of corporate law, which in reality would require compliance with user-regarding fiduciary obligations—the opposite of what critics fear. The second objection fails to convince because fiduciary law has proven itself adaptable enough to survive such challenges in other settings, such as in the asset management industry. The second objection nevertheless reveals a need for greater specificity of the fiduciary duties that would be imposed under the information fiduciary model. Even so, neither objection plausibly undermines the model.

A Relational Turn for Data Protection?

While most approaches to and data protection focus on the data, this paper explores an alternative approach that focuses on relationships. This means means looking more closely at how the people who are exposing their and the people that are inviting that disclosure relate to each other. It is concerned with what powerful parties owe to vulnerable parties - not just with their personal information, but with the things they see, the things they can click, and the decisions that are made about them. It’s less about the nature of data and more about the nature of power. And it can make data protection work better. We call this the in law. The relational approach has deep roots in American and English law, and a growing group of scholars in North America are starting to appreciate the virtues of such an approach, whether framed in terms of privacy and trust or information fiduciaries. The clear advantage of a relational approach is that it is acutely sensitive to the power disparities within relationships, such as those between humans and platforms. Relational models of this sort protect against self-dealing and impose duties of loyalty and care to protect against dangerous behavior. Data protection regimes like the American notice and model or the more robust GDPR, by contrast, target imbalances of power within relationships more indirectly by looking to the nature of the data. We think a relational turn for data protection would be superior to the current model. A relational turn would provide a path towards more substantive rules that would limit how people's data could be used against them. It would focus on the real problem that and data protection law should tackle – the power consequences of relationships, making legitimacy of processing a question of fundamental fairness rather than of data hygiene. Substantive data rules would demand more than that data serve a ‘legitimate interest’ of the data processor. They would focus on the power consequences of processing on the data subject, whether we apply some version of the classic fiduciary duties of care, confidentiality, and loyalty, or the trust-promoting duties of honesty, protection, discretion, and loyalty that we have called for in other work. Perhaps equally important, relational duties allow for a decoupling of choice and consent, whereby people would be protected no matter what they choose. It’s time for data protection’s relational turn.

Enhanced Privacy Duties for Dominant Technology Companies

This paper explores two case studies in order to extract the elements of a legislative approach in the United States for stronger privacy regulation for dominant technology companies. The Federal Communication Commission’s now-repealed broadband privacy rules required broadband companies to obtain opt-in consent for data use beyond what was needed for providing broadband service. In an abuse of dominance case, the German Federal Cartel Office required Facebook to get separate affirmative consent from its users for combining third-party and affiliate data with data from its own social network service. Informed by these two cases, this paper outlines a new privacy law for dominant technology companies in the United States. It would establish enhanced privacy duties for dominant technology companies to ensure that the consumer interest in effective data protection is vindicated in a context where consumers are less able to exercise their general privacy rights. It develops several economic factors to test whether a company is dominant in its line of business and covers companies providing search, social media, online retailing and video exchange services. The paper proposes that such dominant technology companies would need to have a legal basis for their data use and describes consent, contractual necessity and legitimate interest as three possible bases. In addition, dominant technology companies would not be allowed to use unreasonably deceptive, abusive or dangerous designs, as described in Woodward Hartzog’s recent work. Furthermore, they would be required to satisfy enhanced duties of information fiduciaries as outlined in Jack Balkin’s work. The law would also impose restrictions on data sharing with service providers and affiliates and hold open the possibility of banning specific data uses. The law would put in the hands of an industry-specialist regulatory agency the authority to take into account the specified factors to determine when a technology company was dominant and so subject to enhanced privacy duties. The specialist agency would also be authorized to write and enforce implementing regulations in connection with the requirements specified in the legislation.

Robotic Collective Memory

The various ways in which robots and AI will affect our future society are at the center of scholarly attention. This essay, conversely, concentrates on their possible impact on humanity’s past, or more accurately, on the ways societies will remember their joint past. We focus on the emerging use of technologies that combine AI, cutting-edge visualization techniques, and social robots, in order to store and communicate recollections of the past in an interactive human-like manner. We explore the use of these technologies by remembrance institutions and their potential impact on collective memory. Taking a close look at the case study of NDT (New Directions in Testimony) — a project that uses ‘virtual witnesses’ to convey memories from the Holocaust and other mass atrocities — we highlight the significant value, and the potential vulnerabilities, of this new mode of memory construction. Against this background, we propose a novel concept of memory fiduciaries that can form the basis for a policy framework for robotic collective memory. Drawing on Jack Balkin’s concept of “information fiduciaries” on the one hand, and on studies of collective memory on the other, we explain the nature of and the justifications for memory fiduciaries. We then demonstrate, in broad strokes, the potential implications of this new conceptualization for various questions pertaining to collective memory constructed by AI and robots. By so doing, this Essay aims to start a conversation on the policies that would allow algorithmic collective memory to fulfill its potential, while minimizing its social costs. On a more general level, it brings to the fore a series of important policy questions pertaining to the intersection of new technologies and inter-generational collective memory.

A matter of trust: Higher education institutions as information fiduciaries in an age of educational data mining and learning analytics

AbstractHigher education institutions are mining and analyzing student data to effect educational, political, and managerial outcomes. Done under the banner of “learning analytics,” this work can—and often does—surface sensitive data and information about, inter alia, a student's demographics, academic performance, offline and online movements, physical fitness, mental wellbeing, and social network. With these data, institutions and third parties are able to describe student life, predict future behaviors, and intervene to address academic or other barriers to student success (however defined). Learning analytics, consequently, raise serious issues concerning student privacy, autonomy, and the appropriate flow of student data. We argue that issues around privacy lead to valid questions about the degree to which students should trust their institution to use learning analytics data and other artifacts (algorithms, predictive scores) with their interests in mind. We argue that higher education institutions are paradigms of information fiduciaries. As such, colleges and universities have a special responsibility to their students. In this article, we use the information fiduciary concept to analyze cases when learning analytics violate an institution's responsibility to its students.

A duty of care to prevent online exploitation of consumers? Digital dominance and special responsibility in EU competition law

Article 102 Treaty on the Functioning of the European Union imposes a special responsibility on undertakings with a dominant position. Digital dominance based on data but also on network effects, platforms, and first user advantage can lead to extreme inequality in bargaining positions with regard to online services, which can result in unfair treatment of competitors, suppliers, and consumers—such as exploitation and discrimination. Online consumers are the focus of this article. In order to tackle competition issues regarding online consumers, I propose interpreting the special responsibility of digitally dominant undertakings as a duty of care in their regard. Digitally dominant undertakings may not just be burdened by but also benefit from this approach, which increases predictability and trust in online markets. It resembles treating online undertakings as information fiduciaries as has been proposed in the USA, but is different because privacy is not the driving concern here and the context is that of antitrust. I look at standards for triggering the duty of care and make proposals for the application of this norm, but both remain to be specified further

A duty of care to prevent online exploitation of consumers? Digital dominance and special responsibility in EU competition law

Abstract Article 102 Treaty on the Functioning of the European Union imposes a special responsibility on undertakings with a dominant position. Digital dominance based on data but also on network effects, platforms, and first user advantage can lead to extreme inequality in bargaining positions with regard to online services, which can result in unfair treatment of competitors, suppliers, and consumers—such as exploitation and discrimination. Online consumers are the focus of this article. In order to tackle competition issues regarding online consumers, I propose interpreting the special responsibility of digitally dominant undertakings as a duty of care in their regard. Digitally dominant undertakings may not just be burdened by but also benefit from this approach, which increases predictability and trust in online markets. It resembles treating online undertakings as information fiduciaries as has been proposed in the USA, but is different because privacy is not the driving concern here and the context is that of antitrust. I look at standards for triggering the duty of care and make proposals for the application of this norm, but both remain to be specified further.

Managing Privacy and Data Sharing Through the Use of Health Care Information Fiduciaries.

Policy and regulation seldom keep up with advances in technology. Although data de-identification is seen as a key to protecting one's data, re-identification is often possible. Whether one's data is to be used for care, research, or commercial purposes, individuals are concerned about the use of their information. The authors propose the concept of an information fiduciary for holders of data, describe how it might be applied in a health care context, and outline considerations to determine whether a holder of health care-related information should be regarded as an information fiduciary.

Old School Goes Online: Exploring Fiduciary Obligations of Care and Loyalty in the Platforms Era

The concept of information fiduciaries has received considerable attention in recent years, as one way to impose greater societal obligations on Web-based entities. This paper seeks to probe the information fiduciaries concept, as a useful entree into a broader discussion of how to bring longstanding legal institutions into the online digital world. This paper has five primary objectives. First, it will describe the information fiduciary (IF) model, as laid out by scholars Jack Balkin and Jonathan Zittrain, and criticized recently by Lina Khan and David Pozen. Second, it will undertake a deeper dive into the basics of the common law of fiduciary obligations, including the twin duties of care and of loyalty. Third, the paper will examine the information fiduciaries concept from the standpoint of traditional common law and modern-day commentary. Fourth, the paper will explore a proposed alternative legal model, the “digital trustmediary” (or DTM), with entrusted entities voluntarily acting under a heightened fiduciary duty of loyalty to their clients. This DTM model will be posited as a viable response to the current Web ecosystem, which is presided over by online platforms extracting and analyzing end user data in the absence of express fiduciary obligations. The paper concludes by suggesting ways to meld together the two different but complementary fiduciary approaches in the context of Web-based entities. Consistent with the author’s prior written work on functional openness, the overarching intention is to breathe productive new life into old school legal doctrines.

Financial Privacy in a Cashless Society

Electronic payments are the touchstone of every financial transaction in today’s economy. Cash is becoming extinct. In a totally cashless society, every transaction requires a third-party intermediary. While these third-party services increase the convenience of transacting amongst one another, they decrease the user’s privacy and autonomy. The design of the payments system requires users to essentially trust these third-parties with the keys to their financial accounts and information to carry out transactions on their behalf. In what seems like peer-to-peer transactions are, in reality, a series of coordinated moves among multiple intermediaries gleaning access and information about the user. The current financial privacy laws in the U.S. fail to provide the user with a means of redress in the event that these intermediaries suffer a data breach. Therefore, as users trust these intermediaries with their valuable financial information, these intermediaries should be labeled as information fiduciaries subject to fiduciary laws that work alongside current financial privacy laws to give users a legal right in the event their privacy is breached because one of the payment intermediaries is breached.

From Individual Control to Social Protection: New Paradigms for Privacy Law in the Age of Predictive Analytics

What comes after the control paradigm? For decades, privacy law has sought to provide individuals with notice and choice and so give them control over their personal data. But what happens when this regulatory paradigm breaks down? Predictive analytics forces us to confront this challenge. Individuals cannot understand how predictive analytics uses their surface data to infer latent, far more sensitive data about them. This prevents individuals from making meaningful choices about whether to share their surface data in the first place. It also creates threats (such as harmful bias, manipulation and procedural unfairness) that go well beyond the privacy interests that the control paradigm seeks to safeguard. In order to protect people in the algorithmic economy, privacy law must shift from a liberalist legal paradigm that focuses on individual control, to one in which public authorities set substantive standards that defend people against algorithmic threats. Leading scholars such as Jack Balkin (information fiduciaries), Helen Nissenbaum (contextual integrity), Danielle Citron (technological due process), Craig Mundie (use-based regulation) and others recognize the need for such a shift and propose ways to achieve it. This article ties these proposals together, views them as attempts to define a new regulatory paradigm for the age of predictive analytics, and evaluates whether each achieves this aim. It then argues that the solution may be hiding in plain sight in the form of the FTC’s Section 5 unfairness authority. It explores whether the FTC could use its unfairness authority to draw substantive lines between data analytics practices that are socially appropriate and fair, and those that are inappropriate and unfair, and examines how the Commission would make such determinations. It argues that this existing authority, which requires no new legislation, provides a comprehensive and politically legitimate way to create much needed societal boundaries around corporate use of predictive analytics. It concludes that the Commission could use its unfairness authority to protect people from the threats that the algorithmic economy creates.

Free Speech in the Algorithmic Society: Big Data, Private Governance, and New School Speech Regulation

We have now moved from the early days of the Internet to the Algorithmic Society. The Algorithmic Society features the use of algorithms, artificial intelligence agents, and Big Data to govern populations. It also features digital infrastructure companies, large multi-national social media platforms, and search engines that sit between traditional nation states and ordinary individuals, and serve as special-purpose governors of speech. The Algorithmic Society presents two central problems for freedom of expression. First, Big Data allows forms of manipulation and control, which private companies will attempt to legitimate and insulate from regulation by invoking free speech principles. Here First Amendment arguments will likely be employed to forestall digital privacy guarantees and prevent consumer protection regulation. Second, privately owned digital infrastructure companies and online platforms govern speech much as nation states once did. Here the First Amendment, as normally construed, is simply inadequate to protect the practical ability to speak. The first part of the essay describes how to regulate online businesses that employ Big Data and decision making consistent with free speech principles. Some of these businesses are toward their end-users; they must exercise duties of good faith and non-manipulation. Other businesses who are not information fiduciaries have a duty not to engage in algorithmic nuisance: they may not externalize the costs of their analysis and use of Big Data onto innocent third parties. The second part of the essay turns to the emerging pluralist model of online speech regulation. This pluralist model contrasts with the traditional dyadic model in which nation states regulated the speech of their citizens. In the pluralist model, territorial governments continue to regulate speech directly. But they also attempt to coerce or co-opt owners of digital infrastructure to regulate the speech of others. This is new speech regulation. Digital infrastructure owners, and especially social media companies, now act as private governors of speech communities, creating and enforcing various rules and norms of the communities they govern. Finally, end users, civil society organizations, hackers, and other private actors repeatedly put pressure on digital infrastructure companies to regulate speech in certain ways and not to regulate it in others. This triangular tug of war -- rather than the traditional dyadic model of states regulating the speech of private parties -- characterizes the practical ability to speak in the society. The essay uses the examples of the right to be forgotten and the problem of fake news to illustrate the emerging pluralist model -- and school speech regulation -- in action. As private governance becomes central to freedom of speech, both end-users and nation states put pressure on private governance. Nation states attempt to co-opt private companies into becoming bureaucracies for the enforcement of hate speech regulation and doctrines like the right to be forgotten. Conversely, end users increasingly demand procedural guarantees, due process, transparency, and equal protection from private online companies. The more that end-users view businesses as governors, or as special-purpose sovereigns, the more end-users will expect -- and demand -- that these companies should conform to the basic obligations of governors towards those they govern. These obligations include procedural fairness in handling complaints and applying sanctions, notice, transparency, reasoned explanations, consistency, and conformity to rule of values -- the law in this case being the publicly stated norms and policies of the company. Digital infrastructure companies, in turn, will find that they must take on social obligations to meet these growing threats and expectations from nation states and end-users alike.

'Alexa, Pick an Amendment': A Comparison of Fourth and First Amendment Protections of Echo Device Data

Amazon echo devices, called “Alexa” after the word used to “wake” the device, are becoming fixtures in every home. Potentially protected data is created when the user speaks to Alexa to purchase an item from Amazon, to search the internet, or to access music and book libraries. Alexa’s responses are also recorded by transcript. This data is stored on Amazon’s servers and can be accessed any time by the Alexa owner via the owner’s Amazon account. On December 4, 2015, a warrant was obtained and later served on Amazon requiring Amazon to turn over an Alexa owner’s data as part of a police investigation after the owner became a murder suspect. Amazon filed a motion to quash, citing First Amendment protections, but ultimately the matter was never adjudicated because the Alexa owner voluntarily turned the data over himself. Questions regarding constitutional protections of Alexa data will surely surface again: Is Alexa data protected under the First Amendment? Is it protected by the Fourth Amendment? Which amendment protects it better? This Article will examine case law to answer these questions. The Article explains how Alexa data is created and stored, compares Fourth Amendment and First Amendment protections of Alexa data, considers weaknesses in constitutional protections, and proposes creating information fiduciaries to enhance the Fourth Amendment protection.

Intermediaries & Private Speech Regulation: A Transatlantic Dialogue - Workshop Report

The Wikimedia/Yale Law School Initiative on Intermediaries and Information (WIII) at Yale Law School has released a comprehensive report synthesizing key insights from intermediary liability and online speech and expression experts in Europe and the United States. The report focuses on the critical but complicated issue of private speech regulation on the internet and the connections between platform liability laws and fundamental rights, including free expression. The report reflects discussions held at “Intermediaries & Private Speech Regulation: A Transatlantic Dialogue,” an invitation-only workshop convened by WIII, featuring leading internet law experts from the United States and Europe. This report highlights insights and questions raised by leading academics and legal practitioners during the event, providing theoretical ideas, practical experiences, and directions for further research on rapidly evolving questions of intermediary liability from a uniquely transatlantic perspective. (Nothing in the report necessarily reflects the individual opinions of participants or their affiliated institutions.) Key takeaways from this report include the following: Europe and the United States must work together to protect online free expression and access On issues of intermediary liability and online speech, the United States and Europe have much more in common than not. Focusing too much on differences between Europe and the United States can lead to unproductive division of resources and intellectual efforts, particularly if the goal is to protect global democratic values of free expression and access. While the development of the early internet may have reflected primarily American values, today’s internet ecosystem is also shaped by the growing influence of the European Union. Future international standards must also include perspectives from other nations and regions, as the internet is global. Collaboration between countries on online speech issues can be helpful and should be encouraged. Regulatory solutions for online speech issues must address the entire internet ecosystem Regulating internet intermediaries is not enough to protect online speech. Regulations must conceptualize and regulate the growing data economy. Some large tech companies are now extremely powerful, with the largest intermediary companies having as much international negotiation power as nation-states. The increasingly disparate power of a few large tech platforms may also lead to a loss of decentralized discourse and increased difficulties for new competitors to enter the market. The law should protect free speech and expression rights against abuses from government as well as from corporations. Policymakers must narrowly tailor regulations to protect online free speech and expression Policymakers should avoid creating overly broad regulations and instead tailor regulations narrowly to best address consumer harms. One way to do this might be to craft regulations that distinguish between types of intermediaries or perhaps between types of harms. Another option for tailoring regulations is to craft regulations tailored toward protecting or managing different types of speech. There may also be alternative or additional models that include either hybrid state-industry regulatory regimes or models that give greater weight to civil society and to individuals. Industry and civil society must work together to combat harmful indirect speech regulation States are using corporate terms of service and content takedown mechanisms as a form of indirect speech regulation. This indirect speech regulation is effectively a form of prior restraint. When states use intermediaries as proxies for speech regulation, this has a negative impact on rights to free speech and free expression. Indirect speech regulation lacks transparency, and there is no accountability or redress for citizens whose speech has been silenced. Practical strategies to fight against this problem include: 1) calling for greater government transparency, through the FOIA process or through NGO audits; 2) working with companies to gather information, for use in academic and policy research; 3) advocating for individuals and groups who have been disproportionately harmed; and 4) other forms of advocacy, including amicus briefs, policy papers, and impact litigation. New laws can create better models for future regulation of online speech By analyzing failures of existing regulations and noting successes, academics and advocates can create better models for future regulations of online speech. Future regulatory models for protecting free expression online can draw from: U.S. legal concepts from media and telecommunications regulations, including the “must carry” obligation and consumer protection law; U.S. First Amendment and property law doctrine; European human rights law regarding freedom of expression; and precedent from both the United States and Europe regarding due process. Other new frameworks that can be useful in shaping future regulation include the information fiduciaries model and the implementation of strong duty of care standards. Regulatory models can also include incentivization of systemic, architectural solutions on the part of companies.

Algo-Rhythms and the Beat of the Legal Drum

The paper focuses on concerns and legal challenges brought on by the use of algorithms. A particular class of algorithms that augment or replace analysis and decision-making by humans, i.e. data analytics and machine learning, is under scrutiny. Taking into account Balkin’s work on “the laws of an algorithmic society”, attention is drawn to obligations of transparency, matters of due process, and accountability. This US-centric analysis on drawbacks and loopholes of current legal systems is complemented with the analysis of norms and principles of the EU data protection law, or “GDPR”. The aim is twofold. On the one hand, the intent is to shed light on some crucial differences between the US and EU law on the regulation of algorithmic operators, both public and private. Whereas, in the USA, scholars debate whether and to what extent new duties and responsibilities of algorithmic operators, e.g. information fiduciaries, have to amend the current framework of self-regulation and light government—as shown by the White House’s Office of Science and Technology Policy report from November 2016—in EU law much of the new duties and responsibilities of algorithmic operators have been passed upon them as data controllers. Whether such approaches will successfully tackle the normative challenges of the algorithmic society is, on the other hand, an open issue that will likely represent the main topic of debate over the next years. Disagreement may concern: (i) the terms framing the legal question in e.g. statistical purposes of the data processing; (ii) how such terms are related to each other in legal reasoning (e.g. a right to explanation as valid law in the EU); and (iii) legal hard cases that will increasingly have to do with the principles that are at stake also but not only in data protection (e.g. informational self-determination). By entrusting such legal hard cases to algorithms, or some sort of smart artificial agent, humans still bear full responsibility for the judgment of what is socially, ethically, and legally “plain” and “hard” in social affairs. The balance between delegation of decisions to algorithms and non-delegation will be the leitmotiv of the algorithmic society. Since the devil is in the detail, the current paper is devoted to some of them.

Fourth Amendment Fiduciaries

Fourth Amendment law is sorely in need of reform. To paraphrase Justice Sotomayor’s concurrence in United States v. Jones, the idea that people have no expectation of privacy in information voluntarily shared with third-parties — the foundation of the widely reviled “third-party doctrine” — makes little sense in the digital age.In truth, however, it is not just the third-party doctrine that needs retooling today. It is the Fourth Amendment’s general approach to the problem of “shared information.” Under existing law, if A shares information with B, A runs the risk of “misplaced trust” — the risk that B will disclose the information to law enforcement. Although the misplaced trust rule makes sense as a default, it comes under strain in cases where A and B have no relationship of trust and the only reason that A shares information with B is to obtain a socially valuable (and practically indispensable) service. In such cases, I argue that the doctrine should treat B as an “information fiduciary” and analyze B’s cooperation with law enforcement — whether voluntary or compelled — as a Fourth Amendment search.The argument develops in three parts. Part I demonstrates that the Court has already identified two settings — if only implicitly — where fiduciary-style protections are necessary to safeguard constitutional privacy: medical care and hotels. When A is a patient and B is a doctor, and, likewise, when A is a guest and B is a hotel manager, the Court has been reluctant to apply the “misplaced trust” rule. Rightly so: the principle is mismatched to the underlying relationship. From there, Part II fleshes out the normative argument. Put simply, we do not “trust” information fiduciaries, in the everyday sense, at all. So it makes little sense — normatively, or even semantically — to speak of trust being “misplaced.” Rather, the information is held for the benefit of the sharing party, and its use should be constrained by implied duties of care and loyalty. Finally, Part III lays the groundwork for determining who are “Fourth Amendment fiduciaries.” The Article concludes by exploring various practical metrics that courts might adopt to answer this question.