privacy

Adding Insult to Injury: How Article III Standing Minimizes Privacy Harms to Victims and Undermines Legislative Authority

mdecrow@maine.edu Paper , , , , ,

Adding Insult to Injury: How Article III Standing Minimizes Privacy Harms to Victims and Undermines Legislative Authority

By Kristin Hebert, Nicole Onderdonk, Mark A. Sayre, and Deirdre Sullivan

ABSTRACT

            Victims of data breaches and other privacy harms have frequently encountered significant challenges when attempting to pursue relief in the federal courts. Under Article III standing doctrine, plaintiffs must be able to show a concrete and imminent risk of injury. This standard has proved especially challenging to victims of privacy harms, for whom the harm may be more difficult to define or may not yet have occurred (for example, in the case of a data breach where the stolen data has not yet been used). The Supreme Court’s recent decision in TransUnion appears on its fact to erect an even higher barrier for victims of privacy harms to seek relief. In this article, the authors provide a background on Article III standing doctrine and its applicability to cases involving privacy harms. Next, the recent TransUnion decision is discussed in detail, along with an overview of the evidence that TransUnion has failed to resolve the ongoing circuit splits in this area. Finally, the authors propose a test from the Second Circuit as a standard that may be able to resolve the ongoing split and support increased access to the courts for the victims of privacy harms.

 

Continue Reading

 

Implications of New School Surveillance Methods on Student Data Privacy, National Security, Electronic Surveillance, and the Fourth Amendment

mdecrow@maine.edu Article , , , , , , , ,

Implications of New School Surveillance Methods on Student Data Privacy, National Security, Electronic Surveillance, and the Fourth Amendment

By Amanda Peskin, University of Maryland, Francis King Carey School of Law, Class of 2024

Abstract

Since the Covid-19 pandemic, schools have escalated their use of educational technology to improve students’ in-school and at-home learning. Although educational technology has many educational benefits for students, it has serious implications for students’ data privacy rights. Not only does using technology for educational practices allow schools to surveil their students, but it also avails students to data collection by the educational technology companies. This paper discusses the legal background of surveilling and monitoring student activity, provides the implications surveillance has on technology, equity, and self-expression, and offers several policy-based improvements to better protect students’ data privacy.

Continue reading →

“You Have the Right to Remain Silent(?)”: An Analysis of Courts’ Inconsistent Treatment of the Various Means to Unlock Phones in Relation to the Right Against Self-Incrimination

mdecrow@maine.edu Article , , , ,

“You Have the Right to Remain Silent(?)”: An Analysis of Courts’ Inconsistent Treatment of the Various Means to Unlock Phones in Relation to the Right Against Self-Incrimination

By Thomas E. DeMarco, University of Maryland Francis King Carey School of Law, Class of 2023[*]

Riley and Carpenter are the most recent examples of the Supreme Court confronting new challenges technology presents to its existing doctrines surrounding privacy issues. But while the majority of decisions focus on Fourth Amendment concerns regarding questions of unreasonable searches, far less attention has been given to Fifth Amendment concerns. Specifically, how does the Fifth Amendment’s protections against self-incrimination translate to a suspect’s right to refuse to unlock their device for law enforcement to search and collect evidence from? Additionally, how do courts distinguish between various forms of unlocking devices, from passcodes to facial scans?

Continue reading →

Digitizing the Fourth Amendment: Privacy in the Age of Big Data Policing

mdecrow@maine.edu Article, Uncategorized , , , ,

Written by Charles E. Volkwein

ABSTRACT

Today’s availability of massive data sets, inexpensive data storage, and sophisticated analytical software has transformed the capabilities of law enforcement and created new forms of “Big Data Policing.” While Big Data Policing may improve the administration of public safety, these methods endanger constitutional protections against warrantless searches and seizures. This Article explores the Fourth Amendment consequences of Big Data Policing in three parts. First, it provides an overview of Fourth Amendment jurisprudence and its evolution in light of new policing technologies. Next, the Article reviews the concept of “Big Data” and examines three forms of Big Data Policing: Predictive Policing Technology (PPT); data collected by third-parties and purchased by law enforcement; and geofence warrants. Finally, the Article concludes with proposed solutions to rebalance the protections afforded by the Fourth Amendment against these new forms of policing.

Continue reading →

Say “Bonjour” to New Blanket Privacy Regulations?

mdecrow@maine.edu Article , , , , , , , , ,

The FTC Considers Tightening the Leash on the Commercial Data Free-for-All and Loose Data Security Practices in an Effort to Advance Toward a Framework More Akin to the GDPR

By Hannah Grace Babinski, class of 2024

On August 11, 2022, the Federal Trade Commission (FTC) issued an Advance Notice of Proposed Rulemaking (ANPR) concerning possible rulemaking surrounding “commercial surveillance” and “lax data security practices”[1] and established a public forum date of September 8, 2022.[2] The FTC’s specific objective for issuing this ANPR is to obtain public input concerning “whether [the FTC] should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive.”[3]

Continue reading →

Revenge Porn: The Result of a Lack of Privacy in an Internet-Based Society

mdecrow@maine.edu Comment , , , , , , , , ,

Comment

By Shelbie Marie Mora, Class of 2023

I. Introduction

 Nonconsensual pornography, also referred to as revenge porn, is “the distribution of sexual or pornographic images of individuals without their consent.”[1] Forty-six U.S. states, the District of Columbia, and the U.S. territory of Puerto Rico have adopted revenge porn laws. However, there is no federal law in place that prohibits revenge porn. Several countries around the world have chosen to adopt revenge porn statutes to protect individuals’ privacy rights and prevent emotional and financial harm. Revenge porn is primarily a large issue for women given that they are overwhelmingly the target of it.[2] Major ramifications can amount to victims who have had their intimate images posted online without their consent.

In this paper, I will discuss the rise of revenge porn websites, examine Texas and Vermont’s revenge porn statutes, review case law for each state, and analyze the detriments that the holdings pose to victims of revenge porn. I will next examine Australia, Puerto Rico, and Canada’s revenge porn laws and the penalties imposed for offenders. Lastly, I will assess a failed proposed federal revenge porn law in the United States, discuss where the U.S. falls short on federal legislation, and propose remedies to help protect the privacy of individuals. The United States falls short in revenge porn legislation and must pass a federal law to promote and protect the privacy of Americans and deter this crime.

Continue reading →

Life’s Not Fair. Is Life Insurance?

mdecrow@maine.edu Article, Uncategorized , , , , , , ,

The rapid adoption of artificial intelligence techniques by life insurers poses increased risks of discrimination, and yet, regulators are responding with a potentially unworkable state-by-state patchwork of regulations. Could professional standards provide a faster mechanism for a nationally uniform solution?

By Mark A. Sayre, Class of 2024

Introduction

Among the broad categories of insurance offered in the United States, individual life insurance is unique in a few key respects that make it an attractive candidate for the adoption of artificial intelligence (AI).[1] First, individual life insurance is a voluntary product, meaning that individuals are not required by law to purchase it in any scenario.[2] As a result, in order to attract policyholders, life insurers must convince customers not only to choose their company over other companies but also convince customers to choose their product over other products that might compete for a share of discretionary income (such as the newest gadget or a family vacation). Life insurers can, and do, argue that these competitive pressures provide natural constraints on the industry’s use of practices that the public might view as burdensome, unfair or unethical and that such constraints reduce the need for heavy-handed regulation.[3]

Continue reading →

Disclosure of Teen’s Facebook Messages Should be a Red Flag for Us All

mdecrow@maine.edu Blog , , , , , , , , , , , , , ,

Blog

By Will Simpson, Class of 2025

Amidst the fallout of the Supreme Court’s decision on June 24, 2022, to overturn the cornerstone abortion case of 1973, Roe v. Wade, a privacy issue has surfaced: the extent to which digital data can be used against us to prosecute novel forms of criminalized behaviors. To make matters worse, tech giants such as Facebook and Google—who collect and largely control this data—are legally obligated to assist governments with this invasive practice.

Why should we care? While the Fourth Amendment helps protect Americans against unreasonable searches and seizures by the government, private companies are not restricted from archiving our digital data. As a result, the details of our online lives are preserved for potential access by government warrants. Continue reading →

Protecting Critical Infrastructure From Cyberattack: Current Issues and Potential Solutions

mdecrow@maine.edu Article , , , ,

Written by G. Andrew Ouellette, Class of 2022 

I. Introduction

On February 5, 2021, hackers gained unauthorized access to the control systems of a water treatment facility in Oldsmar, Florida.[1]  The Oldsmar facility, located about fifteen miles from Tampa, which hosted the Super Bowl the day before, provides water for businesses and over 15,000 residents.[2]  Once inside the computer system, the hackers were able to locate the software function controlling the levels of sodium hydroxide, commonly known as lye, that is added to the water. They proceeded to raise the levels of sodium hydroxide by more than 110 times the standard level, a level that could potentially be fatal to humans if ingested.[3]  Luckily, this crisis was averted thanks to the watchful eye of a plant operator who was able to return the levels to normal before any of the changes could take effect.[4]

Though no casualties were suffered as a result of the Oldsmar attack, the incident highlights a significant and growing threat to national security, a threat that the United States is increasingly unprepared to defend against. This is just one example in a long string of cyberattacks on infrastructure in recent years. According to the FBI, cyberattacks resulted in over $3.5 billion in financial losses reported in 2019 alone,[5] and experts estimate that this could reach $10.5 trillion globally by the year 2025.[6]  Generally, when people think of cyberattacks, they think of data breaches and theft of personal information due to the numerous cases affecting high-profile companies in recent years.[7]  However, more serious cyber threats exist, namely cyberattacks that target our nation’s critical infrastructure. Critical infrastructure (CI) is becoming an increasingly attractive target for terrorists and hackers due to both the strategic importance of CI and the “numerous vulnerabilities found within these assets and systems.”[8]  Experts have noted that “as industries become more digitally connected, we will continue to see more states and criminals target these sites for the impact they have on society.”[9]  A recent report distributed to the Senate Select Committee on Intelligence noted that China, Iran, and Russia all have the ability to launch disruptive cyberattacks on the U.S.’s critical infrastructure, including gas pipelines and electrical grids.[10]  Additionally, former Director of National Intelligence Dan Coats has warned that “Moscow is mapping our critical infrastructure with the long-term goal of being able to cause substantial damage.”[11]

While the concept of the federal government playing a significant role in protecting CI from attack is not a new one, the increasing interconnectivity of CI to the internet has brought a host of new challenges. Prior to the cyber-era, “the government’s role in protecting infrastructures was relatively justifiable and straightforward, as risks both originated and materialized in the kinetic realm.”[12]  However, risks have multiplied due to an increasing dependence on the internet, as well as the internet itself being classified as CI.[13]  The Covid-19 pandemic has only increased vulnerability with thousands of employees connecting to systems remotely, often with inadequate protection in place.

Rapid development, increasing complexity, and argument over the appropriate approach have led to a lag in policy addressing security regulations in the area. The United States, along with other countries, has so far been hesitant to impose strict regulations, instead opting for a “voluntary participation” based approach.[14] Not only have recent attacks and an increased reliance on remote connectivity laid bare the shortcomings of the current approach to protecting CI, but they have shown that it is time for the adoption of stricter regulation to protect against far more serious attacks.

This paper seeks to highlight some of the issues arising out of the current policy approach to protecting CI from cyberattack and propose recommendations in several key areas. Section II will begin by presenting an overview of relevant background information, including how critical infrastructure is categorized, the current landscape of the CI sectors, as well as current vulnerabilities to cyberattack. Next, Section III will briefly cover the policy history of CI protection in the United States with a focus on major developments to highlight how this policy has evolved as well as recent developments in this area. Section IV will explore the current policy approach as well as some of the significant benefits and drawbacks in key areas.

Section V will conclude by building on the topics discussed in the previous sections and present several proposals, including strengthening incentives for companies to build and maintain robust cybersecurity, furthering public-private information sharing, as well as creating a standardized federal cybersecurity requirement for CI sectors.

Continue reading →

Ongoing Threat to Children’s Data in the American Education System

mdecrow@maine.edu Article , ,

Written by Julie Libby, Class of 2022 

Introduction

Privacy regulations have been strengthening worldwide in recent years, but regulations continue to fall short regarding children’s data in K-12 education, specifically in the United States. Under current federal law, children’s privacy receives only face-level protections by not requiring protective measures to defend the mass collection of this class of vulnerable and valuable data. Future student privacy regulations are possible by creating a reliable structure to minimize threats experienced by students nationwide through evaluating leading federal and state laws, perceived inadequacies in recommended minimums, and developing trends at the state level. In the end, Congress bears the responsibility to enact mandatory minimum protections that effectively assume that even if a breach occurs, it was not due to the lack of sufficient protection.

Continue reading →