Privacy Regime Research Articles

Crowdsourcing Privacy Policy Interpretation

Contract disputes frequently call on courts to resolve conflicts arising out of interpretative differences. In these disputes, the party at the bad end of a deal typically contends that the parties meant their contract to have a meaning other than the one that led to the unfavorable result. To this end, the complaining party argues that particular terms are ambiguous, and that the ambiguity should be resolved in a way that yields a more favorable outcome. Whether a contract’s terms are ambiguous is a determination for the court to make. But a battle wages over the appropriate method for making this determination. While some courts confine their analysis to the contract’s four corners (that is, a term will be deemed ambiguous if its meaning cannot be gleaned from the document itself), others consider evidence extrinsic to the document to determine whether terms are reasonably susceptible to more than one meaning. Under either approach, if the court determines that terms are ambiguous, it will resolve ambiguity according to an objective reasonable person standard. But subjective elements influence decision makers in even the most earnest endeavors to decide objectively.In this Note, I propose the novel concept that crowdsourcing can aid courts both in determining whether contract ambiguity exists and in resolving ambiguities objectively. Courts that accept extrinsic evidence as part of their ambiguity analysis could look to how the crowd interprets the agreement: if crowd workers cannot agree on a particular term’s meaning, the court may accept this as evidence that the term is ambiguous. Similarly, crowd agreement on a particular term’s meaning can supply the court with a reasonably objective interpretation of that term. In the Note, I explore this concept through the lens of empirical data from a recent study, Disagreeable Privacy Policies: Mismatches between Meaning and Users’ Understanding. That study asked crowd workers to interpret certain website privacy policies and compared the crowd’s interpretations to privacy policy experts’ interpretations of the same policies. This paper relies on data from that study to exemplify how the concept might apply. To reach this analysis, I first survey the general online contracting landscape. Because the note relies on data derived from analysis of website privacy policies, I specifically examine the extent to which privacy policies can be enforced as legally binding contracts. A finding that privacy policies are rarely enforced as such highlights a flaw in the notice and choice privacy regime that calls its legitimacy into question. I note that even if the crowdsourcing concept would not be adopted by courts, either the concept itself or theoretical questions is raises might prove useful for other adjudicators.

Protecting Privacy with 'Heightened' Notice and Choice

The 2014 White House paper on privacy and Big Data signaled that the Obama administration might recognize that efforts to limit data collection through a notice and choice regime have failed and instead work toward developing a privacy regime that focuses more on the purpose of data collection in an attempt to limit its use post-collection. When it came to proposing legislation, however, the administration retreated from its earlier rhetoric, and in 2015 proposed a privacy "Bill of Rights" that wholly embraced notice and choice, albeit in an enhanced or "heightened" stage for certain kinds of data collection. The first section of this paper discusses the proposed privacy legislation and its inclusion of a heightened notice and choice framework. The second part explains why even "heightened" notice and choice fails to protect legitimate privacy interests online. The third section explores what a regime based on permissible uses of data might look like and includes suggestions on how we might get there.

The Right to be Forgotten: Its Potential Role in a Coherent Privacy Regime

This paper examines the recent Google Spain ruling establishing a right to de-indexing based on existing rights to data protection. This ruling has had a divisive effect on the relations between the EU and the US, but this article argues that we should understand the right to de-indexing in the context of: (i) moves to improve communication with data subjects and support subjects’ autonomy, particularly within the notice and consent regime; (ii) understanding the role of obscurity of information, and undermining the current binary assumption that information is either public or not; and (iii) moves to improve the quality of search engines’ output. If we do this, then the right to be de-indexed (and possibly other types of ‘right to be forgotten’) could become a point of contact between the EU and US privacy regimes, not a point of conflict.

HIPAA Hitech, and the Burden of Compliance: Outsourcing as a Solution for Entities Affected by HIPAA's Widening Reach

The purpose of this white paper is to inform individuals and companies that they may be subject to complex federal patient privacy regimes. Federal laws regarding patient privacy have expanded greatly over the past two decades and the nature of enforcement for patient privacy violations has changed with them. These changes have resulted in an increased level of enforcement, and in significantly larger fines being imposed upon violators by the government agencies tasked with enforcement. Additionally, recent changes in the interpretation of these federal statutes have arguably increased the efficacy of private civil suits dramatically - by utilizing HIPAA as the standard for determining the duty of care owed to patients in negligence cases. The result of these converging factors is that a large number of the entities covered by federal statutes relating to patient privacy are unaware that they are subject to that legal regime. Simultaneously, all entities covered by these federal statutes are faced with an ever more stringent standard of compliance, and even larger civil and criminal penalties in the event of non-compliance. In addition to informing the reader about the expansion of federal patient privacy law and its impact upon businesses entities and attorneys, this paper proposes that one possible solution for entities presently affected by federal patient privacy legislation would be to utilize outsourced compliance solutions. These services would provide covered entities with the ability to maintain the ongoing compliance required by federal law, while potentially reducing the frequently dramatic increases in costs associated with compliance. This paper will first discuss the evolution of patient privacy rights in the United States. It will then discuss the modern patient privacy right framework under federal law - including the scope of the statutes, the evolution of enforcement of patient privacy rights, and how recent changes have made compliance essential for any affected entity. Finally, it will end by highlighting the benefits generally associated with outsourcing and discuss how they might be applied by entities affected by federal patient privacy statutes.

Health Privacy Is Difficult but Not Impossible in a Post-HIPAA Data-Driven World

In the 13 years since their promulgation, the Health Insurance Portability and Accountability Act (HIPAA) rules and their enforcement have shown considerable evolution, as has the context within which they operate. Increasingly, it is the health information circulating outside the HIPAA-protected zone that is concerning: big data based on HIPAA data that have been acquired by public health agencies and then sold; medically inflected data collected from transactions or social media interactions; and the health data curated by patients, such as personal health records or data stored on smartphones. HIPAA does little here, suggesting that the future of health privacy may well be at the state level unless technology or federal legislation can catch up with state-of-the-art privacy regimes, such as the latest proposals from the European Commission.

Australian privacy reforms--an overhauled data protection regime for Australia

On 12 March 2014, substantially revised privacy laws came into effect in Australia following an extensive reform process. The new laws introduce in many respects stricter data protection regulations alongside stronger enforcement powers, and if organizations have not already done so, now is the time for them to review and amend their data protection practices to ensure compliance with the new laws. This article explains and analyses the major changes of relevance to private sector organizations (within and outside of Australia), including a broader interpretation of the extra-territorial application of the laws, a wider definition of ‘personal information’, increased enforcement powers for the regulator, the introduction of a new set of privacy principles, the incorporation of the concept of privacy by design as well as revised rules for cross-border data flows and direct marketing. Significant new credit reporting provisions were also introduced. These are not the subject of this article but they are equally important for organizations to be aware of and address. Overall, the new Australian privacy regime is more aligned with the EU data protection regime and deserves to be viewed as a relatively strong data protection regime. Nonetheless, it is unlikely that the revised laws will receive a positive adequacy determination by the EU Commission in the context of cross-border data transfers unless and until further changes recommended for consideration as part of a second stage of the reform process are accepted and implemented.

Facebook and face recognition: kinda cool, kinda creepy

Facebook has recently been subject to scrutiny by privacy regulators in Europe, as well as by the US Federal Trade Commission, in relation to the introduction of its ‘tag suggest’ feature. This feature uses face recognition technology to create a biometric template of users’ faces, and had been introduced to Facebook users as a default (opt-out) setting. One outcome of the recent scrutiny has been the temporary deactivation of the tag suggest feature. However, there is every indication that Facebook intends to re-introduce the feature in the not too distant future. This article canvasses some of the privacy implications of face recognition technology, particularly as it is used by Facebook, and in the private sector generally. Legal implications of Facebook’s use of biometric templates and the generation and use of biometric information are considered by reference to the Privacy Act 1988 (Cth) as recently amended by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth). In particular, the threshold issue of the application of Australia’s federal information privacy laws to overseas organisations that have no presence in Australia and do not have servers in the country is considered. Definitional issues around the fundamental terms ‘collect’ and ‘receive’, as used in the amended Privacy Act, are also discussed, along with an overview of possible compliance risks for Facebook arising from Australia’s information privacy regime. Finally, the article offers some reflections on the efficacy of Australian information privacy laws in regulating the creation and use of biometric face templates and associated information in the social media context.

Towards biobank privacy regimes in responsible innovation societies: ESBB conference in Granada 2012.

The creation of socially and technically robust biobank privacy regimes presupposes knowledge of and compliance with legal rules, professional standards of the biomedical community, and state-of-the-art data safety and security measures. The strategies in privacy management and data protection presented in this review show a trend that goes beyond searching for compromises or efforts of balancing scientific demands for efficiency and societal demands for effective privacy regimes. They focus on developing synergies that facilitate cooperative use of biomaterials and data and enhance sample search efficiency for researchers on the one hand, and protect rights and interests of donors and citizens on the other hand. Among the issues covered are: a) ethical sensitivities and public perceptions on privacy in biobanking b) tools and procedures that allow maintenance of the rights and dignity of donors, without jeopardizing legitimate information needs of researchers and autonomy of biobanks, and c) a privacy sensitive framework for sharing of data and biomaterials in the research context.

The Singapore Personal Data Protection Act and an assessment of future trends in data privacy reform

In the first part of this paper, I will present and explain the Singapore Personal Data Protection Act (“PDPA”) in the context of legislative developments in the Asian region and against the well-established international baseline privacy standards. In the course of the above evaluation, reference will be made to the national laws and policy on data privacy prior to the enactment of the PDPA as well as current social and market practices in relation to personal data. In the second part of this paper, I will decipher and assess the future trends in data privacy reform and the future development of the privacy regime in Singapore and beyond. In the course of this analysis, international standards, technological trends and recent legal developments in other jurisdictions will be considered.

Predictive Analytics: The Use and Constitutionality of Technology in Combating Homegrown Terrorist Threats

On April 15, 2013 at approximately 2:50 p.m. as runners completed their journey through the Boston Marathon, two explosions occurred, ten to fifteen seconds apart and 550 feet away from each other, killing three and injuring over 170 innocent Americans. As volunteers, runners, bystanders and emergency personnel risked their lives to aid the injured, no one knew if other explosions were imminent. The improvised explosive devices (“IEDs”) were made of pressure cookers containing nails, ball bearings, and other shrapnel, combined with an electronic detonator. The bombs were designed not to kill, but to severely maim innocent bystanders as they watched the race. As the forensics investigation continued, many leads have been generated, and many have been discounted, with disturbing results. State officials reported there were no intelligence assessments revealing credible threats in Boston prior to the attack. On April 18, 2013, the FBI released images of two suspects who were later identified as brothers Tamerlan and Dzhohkar Tsarnev, 26 and 19, respectively. On April 19, 2013, prior to engaging in a firefight and hurling explosive devices against police, resulting in the injury of a Transit police officer, the pair killed a Massachusetts Institute of Technology campus police officer. Tamerlan Tsarnev was shot and killed during the firefight with police and his younger brother was barricaded, and eventually turned himself in after being wounded and barricading himself in a boat in Watertown, Massachusetts. As the terror investigation continues it has been revealed that the brothers were born and raised in Russia and may have had ties to Chechnya where Muslim radicalism has been rampant. According to public photos on the internet documenting the older brother’s training for the Golden Gloves Boxing Competition, the pair fled to Kazakhstan in the 1990s to escape the violence in Chechnya before making their way to the United States as refugees. The photo captions also quote Tamerlan as saying, “I don’t have a single American friend. I don’t understand them.” The pair have been in the United States since 2002 and the younger brother was a second-year medical student in the Boston area. Although it is yet unclear the motivations behind the attack, it has been revealed that the older brother had posted on YouTube, video’s discussing an Islamic prophecy frequently associated with al Qaeda. Additionally, the Russian government allegedly revealed to the FBI concerns that Tamerlan Dzhokar was involved in extremist activities. This led the FBI interviewing Tamerlan, performing a background check, running his name through relevant databases and checking on his communications and overseas travel. However, the FBI missed the threat – there was no chatter, no intelligence revealing the Tamerlan’s intentions.The solution to this incident may, in the future, reside in the use of predictive analytics, which relies on capturing relationships between explanatory and predicted variables from past occurrences and exploiting them to predict future outcomes. An algorithm would data mine through massive amounts of open source data, linking information about a potential suspect from multiple different sources and provide law enforcement with targets to further investigate. Therefore, using a predictive analytical algorithm, combined with open source information, and information from traditional intelligence and law enforcement mechanisms, may allow the security apparatus to predict future outcomes. However, despite the national security implications, such a program would require access to massive amounts of data that would need to be stored. It would also complicate the privacy and legal regime that the law has in currently in place. The purpose of this paper is to discuss the use, legal implications, and challenges of utilizing predictive analytics as a tool to enhance intelligence and law enforcement communities with their efforts to combat homegrown extremism. This paper will not, as other papers on the subject of homegrown extremism, focus solely on the threat of extremism propagated by “Jihadi-Salafi” ideology. Rather, this paper will note that extremism results from ideology, not religion, and therefore a broadening definition of extremism is necessary. In this context, this paper will discuss the use of predictive analytics as a tool in identifying, predicting, analyzing, and possibly preventing homegrown extremism propagated from religious, environmental, right wing, left wing, and other persons, located in the United States.

The retention of personal information online: A call for international regulation of privacy law

New technologies permit online businesses to reduce expenses and increase efficiency by, for example, storing information in “the cloud”, engaging in online tracking and targeted advertising, location and tracking technologies, and biometrics. However, the potential for technology to facilitate long term retention of customers' personal information raises concerns about the competing right of individuals to the privacy of their personal information. Although the European Commission has recently released a proposal for regulation to “provide a data subject with the right to be forgotten and to erasure”, neither the OECD Privacy Guidelines nor the APEC Privacy Framework includes any requirement to delete personal information. While New Zealand includes a “limited retention principle” in the Privacy Act 1993, apart from one limited exception the privacy principles cannot be enforced in court. Taking New Zealand privacy law as an example, this paper examines the issue of retention of customer data, explains why this is a serious problem and argues that although it could be addressed by appropriate amendments to domestic laws, domestic privacy legislation may not be sufficient in an online environment. In the same way as other areas of law, such as the intellectual property regime, have turned to global regulatory standards which reflect the international nature of their subject matter, international privacy regulation should be the next stage for the information privacy regime.

Developing accountability-based solutions for data privacy in the cloud

Contemporary developments in information and communication technologies make “command and control”-based legislation, for example, EU Directive 95/46/EC, a decreasingly credible means of providing appropriate privacy protection for personally identifiable information (PII) across wide areas of commercial activity. Current legislation provides limited transparency and oversight, fails to encourage privacy innovation, and lacks the flexibility to effectively and efficiently regulate new technologies and globalized business practices. There is a growing consensus that regional, and ultimately global, data privacy regimes will have to adopt new regulatory approaches, and that such approaches should incorporate, as a key element, a greater focus on “accountability”. This raises two key questions: what is meant by “accountability”, and how might it translate into practical mechanisms for achieving privacy protection? This article considers these questions in the context of “cloud computing”, examining how procedural and technical solutions can be co-designed to demonstrate accountability in order to resolve jurisdictional privacy and security risks within the cloud.

1995-2012: from a directive to a regulation, the Microsoft perspective

On 25 January 2012, the European Commission unveiled a comprehensive proposal to modernize its 17-year-old data protection regime. Given the vast technological and societal changes that have occurred since Directive 95/46 went into effect, this is a vitally important effort, and the stakes are high. Once finalized, the new Regulation will shape the EU privacy landscape for the next decade and will influence privacy regimes in many parts of the world. The Commission's proposal includes many positive recommendations that should be embraced. Most importantly, the proposal is a ‘Regulation’ that leads to almost complete legal harmonization, rather than a ‘Directive’ giving each EU member state wide latitude to implement the provisions it in its own way as is now the case. If adopted as proposed, the EU would have a harmonized legal environment for data protection in the 27 member states, rather than a patchwork of different laws. Industry should...

An overview of the legal regime for data protection in Cape Verde

The Cape Verdean legislator has created a comprehensive data protection and privacy regime composed of constitutional provisions, a telecommunications law, and a comprehensive Data Protection Act similar to the current European data protection regime, and enshrining many principles of the EU Data Protection and E-Privacy directives. This article outlines the most salient rules and provisions encompassed in this regime and attempts to provide some context as to their effects and applicability. While the Cape Verdean Data Protection Act establishes a notification requirement for data processing operations and transfers of personal data to outside of Cape Verde, the government authority responsible for receiving notifications and issuing authorizations has not yet been created. Nevertheless, until such time as this regulatory body is created, the duty to notify or register may and should still be complied with.

Crisis of Personal Data Protection During the Construction of E-Government: Reaction and Limits of Hong Kong Privacy Laws

The government of Hong Kong has achieved remarkable staged results according to its comprehensive E-government blueprint. At the same time, it is its statutory responsibility to protect privacy and personal data. However, there has been a succession of incidents of unauthorized leakage onto the Internet of personal data held by the agencies of Hong Kong government since 2006. These incidents occurred during the implementation of E-government, and aroused the public’s deep concern of their privacy rights impacted by the Internet and the security of their personal data held by government agencies. This paper studies two typical cases of personal data leakage, one arising during the internal outsourcing process, the other occurring in external online service to citizens. It analyzes how the existing privacy regime addresses privacy intrusion and whether the redress is sufficient, before exploring the defects of the remedy system as well as the ways of improving legal protection of personal data within E-government environment.

Enforcement of U.S. Electronic Discovery Law Against Foreign Companies: Should U.S. Courts Give Effect to the EU Data Protection Directive?

Although the U.S. Supreme Court first considered the conflict between U.S. discovery rules and foreign non-disclosure law in 1958, a clear standard regarding how to enforce U.S. law against foreign domiciled companies has yet to emerge. As a result of the 2006 ammendments to the U.S. Federal Rules of Civil Procedure concerning electronic discovery (“e-discovery”) procedures “[m]ore and more companies with global operations are finding themselves enmeshed in e-discovery that requires a greater understanding of the issues and laws from a global perspective” because “[i]t is challenging to navigate and manage e-discovery when you have parent companies based overseas or U.S.-based companies with foreign subsidiaries.”This paper looks at, in light of the 2006 amendments and the lack of case law regarding the affect of the 2006 amendments, whether the enforcement techniques, as applied to “paper” discovery should be applied to e-discovery and whether there is anything specific to the nature of e-discovery that necessitates a change in the application of the law. Specifically, the paper addresses how the European data privacy regime may affect the application of paper discovery enforcement techniques to e-discovery. The paper suggests that it would be unwise for U.S. courts to afford the European Data Privacy regime significant deference. Instead, the European Data Privacy regime should be treated with skepticism, similarly to how the U.S. courts have viewed “blocking statutes” contained in foreign law. In particular, treating the EU Data Privacy regime with skepticism will help to prevent the creation of perverse incentives for companies to store their data abroad that hope to avoid legitimate discovery production requests under the Federal Rules of Civil Procedure, by raising the transaction costs for such behavior.

Safeguarding donors’ personal rights and biobank autonomy in biobank networks: the CRIP privacy regime

Governance, underlying general ICT (Information and Communication Technology) architecture, and workflow of the Central Research Infrastructure for molecular Pathology (CRIP) are discussed as a model enabling biobank networks to form operational "meta biobanks" whilst respecting the donors' privacy, biobank autonomy and confidentiality, and the researchers' needs for appropriate biospecimens and information, as well as confidentiality. Tailored to these needs, CRIP efficiently accelerates and facilitates research with human biospecimens and data.

Comparing Privacy Regimes: Federal Theory and the Politics of Privacy Regulation in the European Union and the United States

This article draws on federal theory to analyze the dynamics of crafting a privacy regime in the European Union and the United States. Three dimensions of the policy domain are analyzed: how policy was framed, the policy dynamics activated, and the policy instruments used. The main finding is that despite obvious differences in the choice of specific policy instruments, a strikingly similar regulatory dynamic and framing of policy can be detected. Two conclusions are drawn: first, federal theory can reveal novel insights on the politics of regulating privacy, especially in relation to new technologies and counter terrorism measures. Second, applying a comparative research design to EU policy-making can help explain many of its apparent empirical puzzles.

Privacy regime, culture and user practices in the cyber‐marketplace

PurposeThe purpose of this study is to examine the congruence between policy supply and demand in Internet privacy as moderated by culture.Design/methodology/approachThis study consists of the two parts. The first part qualitatively examines policy harmonization efforts among Asian‐Pacific nations. The second part, based on survey findings, quantitatively analyzes differences between the US and Korean college students in regulatory attitudes toward information privacy. The aim, drawing on regime theory as a departure, is to measure the policy genesis and its effectiveness in operation.FindingsThe findings are two‐fold. First, contrary to the expectations, the notions of online privacy rights among the Korean respondents are strongly formed, with the regulatory demands widely shared with the US participants. Second, however, there exists a gap between the beliefs of information privacy rights and daily practices – the duality far more magnified among the Korean respondents.Practical implicationsThe results suggest the incongruence of the consensus between the two levels – of policymakers and of online users of different cultures.Originality/valueWhile most studies focus on internet policy genesis alone, this paper measures the policy effectiveness in its consumption to capture the operation of cultural values in everyday practices. Policy implications and alternatives for developing nations are discussed in the specific context of Asian‐Pacific nations.

The impact of the European privacy regime on location technology development

Location technology allows for the tracking and tracing of individuals. Developments in location technology allow for increasing levels of detail to keep an eye on ones private life. There are concerns that the privacy awareness among citizens and privacy legislation hinders the success and further development of these technologies. This article assesses the extent to which European privacy legislation blocks location technology development. This is accomplished through a detailed analysis of the Dutch legal framework and an overall review of the European legal framework for protecting individual's privacy versus private sector use of location information and public sector use in the intelligence services. The analysis shows that privacy legislation puts users of terminal devices in control of the decision if and when his location information may be used by private sector location-based services providers. Users often seem willing to allow this, judging by the increase in available location-based services. Privacy legislation is not as protective regarding the use for law enforcement and secret intelligence purposes: privacy of mobile device users may be intruded for these purposes. Certainly after 9/11, developments in law are directed at increasing the mandates of law enforcement and intelligence services. Therefore, the location technology industry is likely to prosper from the investments of the public intelligence sector. For both privacy law legislating private sector use of location-based services and legislation for (secret) public sector use, this article shows that the European privacy regime does not endanger further location technology development.