CONFIDENTIALITY AND THE PROBLEM OF THIRD PARTIES: Protecting Reader Privacy in the Age of Intermediaries

We often regulate actors as a proxy for protecting categories of information. Rather than directly protect reading records, for example, we target actors like libraries who are likely to possess them. This approach has proven increasingly untenable in the digital age, where the relevant actors are difficult to identify and constantly shifting. Unanticipated third parties now insert themselves as intermediaries or eavesdroppers in all manner of transactions, even in protected spaces like libraries. Where this happens, actor-defined regimes fail to vindicate their privacy commitments even within the institutions for which they were designed. Libraries provide a clear example of this problem. Private reading historically has been protected through a regime that restricts libraries’ ability to exploit reading records. Yet this regime now fails to protect reading records even in libraries because it does not bind third parties who provide library services digitally. Illustrating the point, Amazon facilitates e-book lending for a number of public and academic libraries. Although Amazon collects detailed reading records from patrons utilizing these services, the library confidentiality regime does not restrict what it can do with the records. These patrons accordingly confront the risks to intellectual privacy the library regime was meant to counter. This Article proposes a content-defined approach whereby confidentiality obligations would attach to particular types of information regardless of which actors possessed it. Such an approach would not only save extant confidentiality regimes from obsolescence, but also provide a vehicle for extending privacy commitments to future data practices that implicated the same types of sensitive records. * Postdoctoral Associate in Law and Thomson Reuters Fellow at the Yale Law School Information Society Project. Yale Law School, J.D. 2010. I would like to thank Ian Ayres and Madhavi Sunder for their advice and encouragement during the early stages of this project, and Colin Agur, Valérie Bélair-Gagnon, Kiel Brennan-Marquez, Brookes Brown, Alan Hurst, Margot Kaminski, David Nimmer, Neil Richards, Christina Parajon Skinner, Andrew Tutt, and Bruce Wessel for sharing valuable insights as the project has evolved. I am also grateful to Mike DiRaimo, Max Mishkin, and their colleagues on the Yale Journal of Law and Technology for their assistance throughout the editing process. Finally, I would like to specially thank Lucas Franklin for sharing his in-depth knowledge of library ethics, privacy policies, and e-book lending. All errors are of course my own. 1 Ard: CONFIDENTIALITY AND THE PROBLEM OF THIRD PARTIES: Protecting Read Published by Yale Law School Legal Scholarship Repository, 2014 CONFIDENTIALITY AND THE PROBLEM OF THIRD PARTIES 2 INTRODUCTION . 3! I. PRIVATE INQUIRY AND THE CHALLENGES OF THE DIGITAL ERA.6! A. Private Reading Advances First Amendment Values.6! B. Institutional Limits to Private Reading.10! C. Digital Intermediaries Threaten Private Reading . 12! 1. The Incentive To Monitor.12! 2. Extra-Institutional Third Parties . 14! 3. Intra-Institutional Third Parties . 16! II. THE LIBRARY CONFIDENTIALITY REGIME.18! A. Library Norms and Ethics in Historical Context . 19! B. Library Privacy Statutes . 25! C. Library Policies and Procedures . 26! III. E-BOOK LENDING ILLUSTRATES THE LIBRARY REGIME’S LIMITS . 28! A. Amazon Uses E-Book Lending Records for Marketing . 30! B. Collecting Reading Records Creates Risks for Intellectual Privacy . 32! C. Library Confidentiality Obligations Do Not Cover Amazon . 37! 1. Library Privacy Laws Do Not Cover Non-Library Actors . 38! 2. Non-Library Actors Do Not Share Libraries’ Ethics and Norms . 39! 3. Library Policies and Practices Cannot Protect Data Collected by Non-Library Actors . 40! D. Libraries Cannot Provide Kindle Books Except Through Amazon . 41! 1. Libraries Lack Bargaining Power in E-Book Licensing.41! 2. Amazon Locks Libraries and Readers into Its Products and Services Using Legal, Technical, and Economic Leverage . 44! IV. THE CONTENT-DEFINED APPROACH TO CONFIDENTIALITY . 46! A. Building a Content-Defined Regime . 47! B. The Institution-Defined Alternative . 48! C. The Limits of Adding New Actors to an Actor-Defined Regime . 50! V. TAILORING CONFIDENTIALITY TO CONTEXT: READER PRIVACY OUTSIDE THE STACKS . 51! A. Establishing a Non-Disclosure Baseline.52! B. Protecting Users from Abuse of Notice and Consent . 54! C. Regulating Data Retention.55! CONCLUSION.57! 2 Yale Journal of Law and Technology, Vol. 16 [2014], Iss. 1, Art. 1 https://digitalcommons.law. yale.edu/yjolt/vol16/iss1/1 16 YALE J.L. & TECH. 1 (2013) 2013-2014