Misuse Of Private Information Research Articles

Lessons Learned: Surveying the Practicality of Differential Privacy in the Industry

Since its introduction in 2006, differential privacy has emerged as a predominant statistical tool for quantifying data privacy in academic works. Yet despite the plethora of research and open-source utilities that have accompanied its rise, with limited exceptions, differential privacy has failed to achieve widespread adoption in the enterprise domain. Our study aims to shed light on the fundamental causes underlying this academic-industrial utilization gap through detailed interviews of 24 privacy practitioners across 9 major companies. We analyze the results of our survey to provide key findings and suggestions for companies striving to improve privacy protection in their data workflows and highlight the necessary and missing requirements of existing differential privacy tools, with the goal of guiding researchers working towards the broader adoption of differential privacy. Our findings indicate that analysts suffer from lengthy bureaucratic processes for requesting access to sensitive data, yet once granted, only scarcely-enforced privacy policies stand between rogue practitioners and misuse of private information. We thus argue that differential privacy can significantly improve the processes of requesting and conducting data exploration across silos, and conclude that with a few of the improvements suggested herein, the practical use of differential privacy across the enterprise is within striking distance.

The standard of liability in claims for misuse of private information

ABSTRACT This article attempts to identify a standard of liability for use in claims for misuse of private information (MPI). It highlights current uncertainty over this issue following the decision of the Supreme Court in Lloyd v Google LLC. It considers whether the comments of Lord Leggatt in Lloyd are compatible with those made in earlier MPI decisions and argues that the standard applicable remains an open question. In formulating a proposed standard, the article considers issues arising under the Human Rights Act 1998 and is informed by the recommendations of the Australian Law Reform Commission in its review of Australian privacy law. It is suggested that the appropriate standard for the MPI tort ought to be one of ‘quasi-strict’ liability, meaning that liability could, in certain cases, be strict. Whether a defendant would be found to be strictly liable should be determined through the reasonable expectation of privacy test.

Efficient and Secure Certificateless Aggregate Signature-Based Authentication Scheme for Vehicular Ad Hoc Networks

In recent years, IoT has opened new opportunities for the development of various industries to improve people’s lives. Vehicular <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ad hoc</i> network (VANET) uses IoT applications for secure communication among the vehicles and to improve road safety and traffic management. In VANETS, the authentication of the vehicular access control is a crucial security service for both intervehicle and vehicle–roadside unit communications. Another criteria is all the messages should be unaltered in the delivery. Meanwhile, vehicles have to be prevented from the misuse of private information and the attacks on their privacy. Also, limited bandwidth, high mobility and density of vehicles, and scalability are few other challenges in VANETS. A number of research works are focusing on providing the anonymous authentication with preserved privacy and security in VANETS. In this article, we proposed a new certificateless aggregate signature-based authentication scheme for VANETS. Our scheme avoids the complex certificate management problem from public-key infrastructure and key escrow problem from an identity-based framework. Also, aggregate signature aggregates various individual signatures on different messages from different vehicles into a single signature, which in turn results in the reduction of verification time and storage space at the roadside unit. Our scheme can prevent malicious vehicles from disrupting the security features of VANETS. Moreover, our scheme does not use the pairing operation, which is the most expensive operation than others in modern cryptography, thus significantly reduces the computation overhead. Security and performance analysis shows that our scheme is more secure and efficient than current schemes.

RECOGNISING A PRIVACY-INVASION TORT: THE CONCEPTUAL UNITY OF INFORMATIONAL AND INTRUSION CLAIMS

AbstractThis article presents the novel view that “inclusion into seclusion” and “public disclosure of embarrassing facts” (“misuse of private information” (“MOPI”) in the UK), which both the academic commentary and US case law treat as two separate legal actions, occupy the same conceptual space. This claim has important practical ramifications. No further development of the law is required to realise an actionable intrusion tort as part of the UK's MOPI tort. The argument is defended in doctrinal and theoretical terms and by reference to both UK and US law. It is presented in three forms: first, in negative terms, that the orthodox distinction between the two claims (informational privacy and intrusion) is unsustainable; second, in positive terms, that both guard against the same wrong (unwarranted privacy invasion) and the same harm (mental distress), in a way that is distinctive from other privacy actions and legal claims based upon the autonomy value; finally, in pragmatic terms, that MOPI's mature jurisprudence is sufficiently flexible and dynamic to recognise intrusion-only claims using its existing legal framework.

Varieties of Damages for Breach of Privacy

This paper offers a comprehensive account of the law of damages within the action for misuse of private information in English law. The paper interrogates which types of damages are and ought to be available for breach of privacy, and the legal rules and principles governing each form of damages including the approach to quantification. In examining the law of damages the paper considers the nature of the emergent privacy action, arguing that it has shed its equitable origins in breach of confidence and now closely resembles 'vindicatory' actions such as false imprisonment, battery and trespass to land. In turn the remedial approach for breach of privacy increasingly follows that adopted within these torts. The paper first considers compensatory damages, arguing that a 'vindicatory' model ought to characterise the approach to compensatory damages, and is the prevailing approach in English law following the High Court and Court of Appeal's important decisions in Gulati v MGN Ltd. According to this approach, damages are available for the wrongful invasion of privacy in itself, irrespective of the suffering of material loss. In addition consequential losses are recoverable, including distress, recognised psychiatric illness and financial loss. Damages are available as of right and are not to be analogised with awards of 'just satisfaction' made by the European Court of Human Rights. The paper then examines non-compensatory damages. The courts are yet to authoritatively determine the availability of such damages for breach of privacy, and the principles governing their award. The paper argues that exemplary damages ought to be available, but quantum should not be so high as to constitute disproportionate interference with free expression. An account of profits should not be available. But if such remedy were to be recognised it ought to be awarded only exceptionally and the criteria for granting an account should follow the normative concerns that underpin the privacy action. Reasonable fee or user damages are one means of measuring loss in property torts; they are not restitutionary. They ought not to be available for breach of privacy as it would be inapt to treat dignitary interests as if they were interests in tradeable commodities. The novel head of 'vindicatory' damages, recognised in a series of Privy Council appeals, should not be available as they would add nothing to existing remedies. Lastly, the paper considers damages in lieu of an injunction, arguing that these damages compensate for the loss of a legal liberty to enforce primary rights; they are not restitutionary. Such damages ought very rarely to be awarded in the place of an injunction in a case of ongoing, unjustified invasion of privacy.

The need for an intrusion upon seclusion privacy tort within English law

In the United States, New Zealand and the Canadian province of Ontario, recognition has been afforded to privacy torts remedying intrusions upon seclusion or solitude, and the creation of such a tort has also been recommended by the Australian Law Reform Commission. In England and Wales, recognition has so far only been afforded to a privacy tort remedying misuse of private information. This article considers the current prospects for the recognition of an intrusion upon seclusion tort within English law. It will be suggested that there is less necessity for such recognition following the apparent recent confirmation by the decisions in Gulati v MGN and Vidal-Hall v Google that misuse of private information claims may still be brought where there is no ensuing publication of wrongly acquired private information. Given that intrusions commonly result in the acquisition of private information, it will be suggested that many of the privacy interests protected by the intrusion torts in other jurisdictions may now therefore be protected in English law through a claim for misuse of private information.

Do authors and performers have a legal right to pseudonymity?

ABSTRACTAuthors and performers use pseudonyms in order to distance themselves from their works and performances. Pseudonymity protects expressive, creative, privacy and reputational interests. In this article we consider whether authors and performers should have a legal right to exclusive pseudonymity, that is, a right to be identified by their pseudonym to the exclusion of their real name. We argue that authors and performers should have a qualified right to pseudonymity, enforceable through a claim for misuse of private information, but which may be outweighed by other fundamental rights in some circumstances. We also consider the extent to which authors and performers are already protected from unwanted exposure of their identities by the laws of freedom of expression, privacy, moral rights and passing off.

Sharing privately: the effect publication on social media has on expectations of privacy

ABSTRACTUsers of social media wish to share information with their friends. They want to tell them about their thoughts, feelings and, more commonly, what they are having for dinner. Yet, they do not want to tell these things to the whole world. Under the tort of misuse of private information the desire to share privately is something of a paradox. There are two reasons for this: the threshold of when information is deemed to be in the public domain is too low; and, second, the protection afforded to someone who is deliberately seeking publicity is too little. English law is currently incapable of protecting those who share on social media from having their information disseminated further than they intend. There are however options for reform, which include an application of the law of confidence, copyright and, more radically, a fundamental change to the concept of privacy itself.

Filling the IP Gap: Privacy and Tabloidism

This chapter examines how confidential information and trade secrets is used to combat privacy intrusions by tabloid media. It examines the genesis and scope of the English tort of misuse of private information, the extent to which this action overlaps with breach of confidence and the impact of trade secret protection on privacy.

'Privacy and Freedom of the Press from 2004-2015: From Campbell to Leveson'

This chapter documents the developments in the English law of breach of confidence since the seminal Campbell v MGN case in 2004. In particular, we document the growth of the new action of ‘misuse of private information’. We conduct a largely doctrinal analysis of the case law by consolidating the complex, fragmented domain of principles and tests established by the courts. We situate these within the broader concerns around regulation of the UK print press, how this system is changing in light of the Leveson Inquiry, European Court of Human Rights (ECtHR) jurisprudence and the new Royal Charter on Self Regulation of the Press. We also look at the impact of new technologies on regulation of collection and distribution of the news. We briefly consider two examples, namely social media and superinjunctions, and use of drones to collect news.

OUP accepted manuscript

Traditionally, English common law has not recognized a tort of invasion of privacy.1 Instead, English courts have developed (in a line of cases including Campbell v MGN2 and Douglas v Hello! (No. 3)3) a tort of misuse of private information, which is often described as protecting ‘an aspect of privacy’.4 The impetus for this development has been the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), incorporated into UK law by the Human Rights Act 1998 (HRA). The HRA does not directly create a civil cause of action based on privacy. However, it does oblige the courts to act consistently with the rights protected by the ECHR, and therefore to provide meaningful protection for the right to respect for private and family life (Article 8 ECHR), balanced, as appropriate, with the right to freedom of expression (Article 10 ECHR). This protection was initially ‘absorbed’ into the longstanding equitable action for breach of confidence.5 However, it became increasingly clear that breach of confidence and misuse of private information rest on different legal foundations and protect different interests.6 Ultimately, misuse of private information was recognized as a distinct tort.7 The latest case to confirm both this position and the English courts’ approach to the tort is PJS v News Group Newspapers Ltd.8

Vidal-Hall and Risk Management for Privacy Breaches

The recent English Court of Appeal case of Google v. Vidal-Hall raises three issues for many Internet-based businesses: whether they can be sued in tort for misuse of private information, whether browser-generated information is defined as personal data, and whether compensation for emotional distress without accompanying financial loss can be awarded.

Misuse of Private Information in English Law

The protection of information in English law has been a matter of debate for many years. The introduction of the “misuse of private information” tort fueled the intensity of this debate rather than offering a satisfactory solution. This essay will present a brief history of how privacy rights have been protected in this jurisdiction and why privacy is difficult to be defined; how the transmutation from “breach of confidence” to “misuse of private information” occurred and the characteristics of the new tort as well as some critique to its current application. It will also display and dispute the arguments against a standalone privacy tort and it will introduce the latest developments in other common law jurisdictions in order to predict the legislative developments in the UK. Lastly, it will briefly refer to the new technologies, namely the internet, and how it might affect the future course of privacy rights before presenting a personal view on the matter.

A just balance or just imbalance? The role of metaphor in misuse of private information

This article undertakes analysis of misuse of private information (MPI) caselaw informed by deconstruction and wider literary and critical theory. It specifically considers the rhetorical effect of the ‘balance’ metaphor in MPI caselaw. It starts by providing an account of select theorists who explore the subtle but vital role that metaphor, traditionally viewed as a poetic or literary device, plays in non-literary texts. This account highlights the fundamental role of metaphor in legal discourse. Following this discussion, the article investigates the ‘balance’ metaphor in MPI judgments. It identifies and analyses two distinct ways in which the balance metaphor subtly benefits judicial reasoning. First, it creates an impression of certainty by drawing on connotations of the quantifiable and calculable. Second, it fosters the moral appeal of a decision by alluding to notions of justice and equilibrium. In doing so, the balance metaphor marginalises the non-rational, inexpressible aspects of judicial rights balancing.

A landmark at a turning point: Campbell and the use of privacy law to constrain media power

This article argues that the decision in Campbell can be seen as a response to long-term concerns about the abuse of media power. After outlining some of the key developments in debates about privacy law, the article considers the features that distinguish the media as powerful institutions. It will be argued that the focus on media power has shaped the doctrine of misuse of private information, for example in expanding the scope of the tort and focusing on the public interest as the main defence. The decision in Campbell arrived at a moment when the communications environment was about to change dramatically. Since Campbell, the use of social media and the opportunities to share user-generated content has given many people the capacity to bring private facts to a large audience. The article will consider whether the Campbell tort remains applicable in the case of non-powerful publishers and looks at the alternative ways to protect privacy.

The changing face of protection for individual privacy against the press: Leveson, the Royal Charter and tort liability

This article evaluates two significant methods of protecting private information in the UK – via actions under the tort of misuse of private information, and via press regulation. As the Leveson Report has recently found, parts of the press have systematically abused their power, in terms of acquiring and publishing personal information non-consensually. Thus, as the Report found, it appears that the system of press self-regulation has been shown to be ineffective. The article considers the Leveson proposals for an improved system of press regulation and the current proposal of a Royal Charter. It suggests that, ideally, press regulation could work alongside the tort, tending to encourage press restraint, obviate the need for court action, and providing a remedy for those not willing or able, due to lack of resources, to go to court to seek a remedy for privacy invasion. The history of press self-regulation indicates that those results may not be achieved, but it will be argued that the current response to the Leveson Report in the form of a Royal Charter suggests otherwise.

An Exploration of the Efficacy of ‘Privacy’ Rights Protection in 21st Century Britain

The law on privacy has undergone significant changes over the past decade. Traditionally, the right to privacy was limited, but has since been conceived within a tortious right of the misuse of private information. It can be described as developed by the courts in a piecemeal fashion, but has accelerated in recent years, in part due to the Human Rights Act 1998. The relevant Article 8 (right to respect for private and family life) and Article 10 (right to freedom of expression) of the European Convention of Human Rights have been absorbed into English law. These are two of the most important values in a modern democratic society and are essential to individual self-fulfilment. The research aim of this dissertation is to examine the law on privacy in the UK to determine whether it adequately protects an individual’s right to privacy. The hypothesis proposes that the operation of the current law is not satisfactory in protecting an individual against the invasion of their privacy. In particular, whilst the press perform a fundamental role through investigative journalism of significance, there have been direct breaches of informational autonomy and a specific lack of control over acceptable standards in news printing.

Profit-maximizing firm investments in customer information security

When a customer interacts with a firm, extensive personal information often is gathered without the individual's knowledge. Significant risks are associated with handling this kind of information. Providing protection may reduce the risk of the loss and misuse of private information, but it imposes some costs on both the firm and its customers. Nevertheless, customer information security breaches still may occur. They have several distinguishing characteristics: (1) typically it is hard to quantify monetary damages related to them; (2) customer information security breaches may be caused by intentional attacks, as well as through unintentional organizational and customer behaviors; and (3) the frequency of such incidents typically is low, although they can be very costly when they occur. As a result, predictive models and explanatory statistical analysis using historical data have not been effective. We present a profit optimization model for customer information security investments. Our approach is based on value-at-risk methods and operational risk modeling from financial economics. The main results of this work are that we: (1) provide guidance on the trade-offs between risk and return in customer information security investments; (2) define the range of efficient investments in technology-supported risk indemnification for sellers; (3) model how to handle government-dictated levels of investment versus self-regulation of investments in technology; and (4) characterize customer information security investment levels when the firm is able to pass some of its costs on to consumers. We illustrate our theoretical findings with empirical data from the Open Security Foundation, as a means of grounding our analysis and offering the reader intuition for the managerial interpretation of our theory and main results. The results show that we can narrow the decision set for solution providers and policy-makers based on the estimable risks and losses associated with customer information security. We also discuss the application of our approach in practice.

The JK Rowling photo case – Are privacy rights evolving for the online era?

The Court of Appeal's recent decision in the case brought on behalf of JK Rowling's young son has some important implications for the developing law of privacy in the UK ( David Murray (by his litigation friends Neil Murray and Joanne Murray) v Big Pictures Limited [2008] EWCA Civ 446). Most strikingly, the court's approach shows that the scope of potentially private information is broader than previously thought. The claim brought was for breach of confidence, misuse of private information and under the Data Protection Act 1998 (“the DPA”) and resulted from a photograph of JK Rowling's son, taken covertly in a public place, being published in a newspaper. The decision is significant for photographers and newspaper publishers, in particular, because it suggests that more types of information, especially photographs, may be capable of protection as “private”. It does not follow, however, that this development will prejudice freedom of expression: the balance between privacy and press freedom still needs to be struck, with neither taking precedence over the other.

Monetary remedies for breach of confidence in privacy cases

In Campbell v MGN Ltd, the House of Lords endorsed an expansive interpretation of the breach of confidence action to protect privacy interests. The scope and content of this transformed cause of action have already been subject to considerable judicial consideration and academic discussion. This paper focuses on the remedial consequences of privacy breaches. It undertakes an analysis of the principles which govern awards for pecuniary and non-pecuniary loss, the availability of gain-based relief, in particular an account of profits, and exemplary damages.Even in its traditional scope, the monetary remedies for breach of confidence raise complex issues, mainly resulting from the fact that this doctrine draws on multiple jurisdictional sources such as equity, contract and property law. The difficulties of determining the appropriate remedial principles are now compounded by the fact that English law also aims to integrate its obligation to protect the right to privacy under Art 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms 1950 into the conceptual framework of the breach of confidence action.The analysis provided in this paper supports the contention that not only the scope of the cause of action but also important remedial issues are likely to remain in doubt until the wrong of ‘misuse of private information’ is freed from the constraints of the traditional action for breach of confidence. A separate tort would be able to deal more coherently and comprehensively with all wrongs commonly regarded as privacy breaches.