Source: https://www.cdt.org/planted_press/jerry-berman-and-deirdre-mulligan-1999-nova-law-review-privacy-digital-age-work-progre?issue=77&quicktabs_4=1
Timestamp: 2014-03-11 04:11:00
Document Index: 618824550

Matched Legal Cases: ['§ 6501', '§ 1401', '§ 6501', '§ 552', '§ 1232', '§ 3401', '§ 2510', '§ 2710', '§ 6101', '§ 2721', '§ 222', '§ 3401', '§ 103', '§ 2703', '§ 2570', '§ 2510', '§ 1001', '§ 2703', '§ 1701', '§ 101', '§ 1708', '§ 2510', '§ 207', '§ 2510', '§ 552']

Jerry Berman and Deirdre Mulligan, 1999 Nova Law Review: Privacy in the Digital Age: Work in Progress | Center for Democracy & Technology
C.	Encourage Technologies that Limit the Collection of Personally Identifiable Data Law is only one tool for protecting privacy. In this global, decentralized medium, we must promote applications of technology that limit the collection of transactional information that can be tied to individuals.[ 64 ] Some tools developed to protect privacy by limiting the disclosure, or cloaking it, of information likely to reveal identity, or decoupling this identity information from the individual's actions and communications, exploit the decentralized and open nature of the Internet.[ 65 ] For example, Crowds provides anonymity to individuals surfing the Web by mingling their requests for access to Web sites with those of others.[ 66 ] By routing Web site access requests in a series of unpredictable paths, the identity of the requester is hidden. Similarly, Onion Routing uses the decentralized nature of the Internet coupled with public key encryption to provide privacy protections for Internet communications.[ 67 ] Communications are passed through a series of routers before reaching the recip-ient. Resembling an onion, the message is encircled in a series of lay-ers. Each router is able to peel one layer of the onion enabling it to learn the next stop in the messages path. Passing messages in this fashion protects an individual's identity by obfuscating the originator and recipient of the message from points in the network. These technical advances, if adopted by users, can provide protections for privacy.
E. Create a Privacy Protection Entity to Provide Expertise and Institutional Memory, a Forum for Privacy Research, and a Source of Policy Recommendations on Privacy Issues The work outlined above, and the state of privacy today, all weigh in favor of creating a privacy entity within the federal government. The existing approach has hindered the development of sound policy and failed to keep pace with changes in technology. The United States needs an independent voice empowered with the scope, expertise, and authority to guide public policy. Such an entity has important roles to play on both domestic and international fronts. It would serve as the forum for collaboration with other governments, the public interest community, and the business community.
F.	We Must Question Our Tendency to Rely on Government as the Central and Sometimes Sole Protector of Privacy In the decentralized and global environment of the Internet, the law's impact will be limited. In an area such as privacy, where the government's actions have often been detrimental rather than supportive, we must ask if other options--such as technology may provide stronger protection. We must encourage the development and implementation of technologies that support privacy. They are critically important on the Internet and other global medium. Strong encryption is the backbone of technological protections for privacy. Today technical tools are available to send anonymous e-mail, browse the World Wide Web anonymously, and purchase goods with the anonymity of cash.
6. 15 U.S.C.A. § 6501 (1998).
7. The United States Congress' first effort to regulate speech on the Internet, the Communications Decency Act of 1996, Pub. L. No. 104­104, 110 Stat. 133 (codified as amended 47 U.S.C. 230 (1997)) [hereinafter "CDA"], was held to violate the First Amendment by the Supreme Court. Reno v. ACLU, 521 U.S. 844 (1997). Congress' second attempt, the Child Online Protection Act (Pub. L. No. 105-277, § 1401­06, 112 Stat. 2681 (1998)) (codified at 65 U.S.C.A. § 6501 (1998)) [hereinafter "CDA II"], is currently the subject of a legal challenge. On February 1, 1999, a federal district court issued a preliminary injunction prohibiting the government from enforcing CDA II until the court is able to issue a decision on its merits. ACLU v. Reno II, E.D. Pa. Case No. 98-5591, Preliminary Injunction Order (February 1, 1999). In contrast, the Clinton Administration's November report on Electronic Commerce advocates the voluntary use of filtering and blocking tools as the appropriate means of addressing concerns with children's access to inappropriate information on the internet. See generally U.S. Gov't Working Group, on Electronic Comm., First Annual Report (1998). The report also states that the Administration did not support CDA II. See generally id.
9. In October 1995, the European Union ("EU") adopted the Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data. 1995 J.O. (L28) 31. The Directive seeks to establish a common ground of privacy protection for personal data within the community and to ensure that the privacy of EU citizens was protected during "cross-border data flows,"‹transfers of data to non-EU countries. OECD guidelines on the Protection of Privacy and Transborder Flows of Personal Data http://www.oecd.org/dsti/sti/ii/secur/prod/PRIV_EN.HTM [hereinafter OECD Guidelines]. Member States must comply with the Directive through the implementation of national provisions. Id. In February 1998, the OECD held a conference on Data Protection in International Networks. OECD Workshop on "Privacy Protection in a Global Networked Society" (February 1998) http://www.oecd.org//dsti/sti/it/secur/prod/reg985final.pdf. The Workshop provided an overview of various efforts to ensuring privacy protection. See United Nations Human Rights Website http://www.unhchr.ch/html/menu3/b71.htm.
11. This discussion focuses primarily on information privacy. Information privacy incorporates two components‹at times distinct and at times inextricable‹"the right to be let alone" first articulated by Justice Louis Brandeis over a century ago in his dissent in Olmstead v. United States, 277 U.S. 438, 478 (1928) (Brandeis, J., dissenting), and the right to control information about oneself, even after divulging it to others, as discussed by Professor Alan F. Westin in Privacy and Freedom. See generally ALAN F. WESTIN, PRIVACY AND FREEDOM (Atheneum 1967). While there is no definitive case finding a constitutional right for information privacy, the Supreme Court acknowledged that such a privacy right exists in Whalen v. Roe, 429 U.S. 589, 605 (1977) (upholding a state statute that required doctors to disclose information on individuals taking certain highly addictive prescription drugs for inclusion on a state database). "The information . . . is made available only to a small number of public health officials with a legitimate interest in the information . . . . Broad dissemination by state officials of such information, however, would clearly implicate constitutionally protected privacy rights . . . ." Id. at 606. The lack of strong constitutional privacy protection has placed added emphasis on federal and state statutory protections. See, e.g., The Privacy Act of 1974, 5 U.S.C. § 552a; Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g; The Right to Financial Privacy Act of 1978, 12 U.S.C. § 3401; The Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2510 (1995); The Communications Assistance and Law Enforcement Act of 1994, Pub. L. No. 103-414, 108 Stat 4279 (1994) (providing heightened protections for transactional data); The Cable Communications Act of 1984, Pub. L. No. 98-549, 98 Stat. 2779 (1984) (codified as amended in scattered sections of 47 U.S.C.); The Video Privacy Protection Act of 1988, 18 U.S.C. § 2710 (1994); Consumer Credit Reporting Reform Act of 1996, 15 U.S.C. 1681-s2 (1997); Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994 , 15 U.S.C. §§ 6101­6108; Driver's Privacy Protection Act of 1994, 18 USC § 2721 (1994); Privacy of Customer Information (The Customer Proprietary Network Information Rules of the Telecommunications Reform Act of 1996), 47 U.S.C. § 222 (c), (d) (1996). While statutory privacy protections for personal information have been crafted on a sector by sector basis, many are based on a common set of principles set forth in the CODE OF FAIR INFORMATION PRINCIPLES, which was developed by the Department of Health Education and Welfare in 1973. See generally DEPARTMENT OF HEALTH EDUCATION & WELFARE, CODE OF FAIR INFORMATION PRINCIPLES (1973), in SECRETARY'S ADVISORY COMMITTEE REPORT ON AUTOMATED PERSONAL DATA SYSTEMS, Records, Computers and the Rights of Citizens, U.S. DEPT. OF HEALTH, EDUC. & WELFARE, July 1973.
12. The phrase "expectations of privacy" is used here with intent. Despite case law suggesting that the legal protections afforded to our expectations of privacy are limited by the technical and social possibilities for surveillance, the authors believe that, as a society, we do share some basic expectations of privacy. Privacy legislation enacted by Congress in response to some of the Court's decisions lends some credence to this notion. The "reasonable expectation" test was articulated in the seminal privacy case, United States v. Katz, 389 U.S. 347, 360 (1967) (Harlan, J., concurring), in which the Supreme Court ruled that the Fourth Amendment protects "people, not places" from unwarranted searches and seizures. Id. at 351. Thereby reversing United States v. Olmstead, 277 U.S. 438 (1928), which held that the Fourth Amendment covered only physical places, and thus the warrant requirement did not apply to police wiretaps. Id. at 361 (Harlan, J., concurring). Although hailed as a landmark privacy decision, the Katz test has been applied in later cases to undermine privacy interests. In Katz's progeny, the Court has applied the "reasonable expectation" test as a relative standard informed by the technological and social realities of the day. As technology has advanced, and as societal demands for sensitive personal information have increased, the Court has increasingly circumscribed the "zones" one may justifiably consider private. See California v. Greenwood, 486 U.S. 35, 40­41 (1988) (quoting United States v. Reicherter, 647 F.2d 397, 399 (3d Cir. 1981) (holding that people have no reasonable expectation of privacy in garbage once it is removed from the home and placed on the curb for pick-up, because garbage is placed "'in an area particularly suited for public inspection and . . . for the express purpose of having strangers take it'")); California v. Ciraolo, 476 U.S. 207, 214­15 (1986) (holding that the use of a fixed-wing aircraft to observe marijuana on defendant's property from 1,000 feet did not violate his protected "zone of privacy" because the defendant's subjective expectation of privacy was not one "that society is prepared to honor . . . [i]n an age where private and commercial flight in the public airways is routine."). The Court's application of this standard has proved particularly troublesome in the information privacy context. The Court has continually held that individuals have no privacy interest in information divulged to the private sector, even though modern society leaves citizens no option but to disclose to others, e.g., disclosure as a condition of participation in society and technology accumulating transactional data. See Smith v. Maryland, 442 U.S. 735, 745­46 (1979) (holding that individuals have no privacy interest in the numbers dialed from their homes); United States v. Miller, 425 U.S. 435, 442­43 (1976) (holding that individuals have no reasonable expectation of privacy in personal financial records maintained by the bank). However, both Smith and Miller were later "overturned" by Congress through the enactment of statutes that created legally enforceable expectations of privacy. See, e.g., 12 U.S.C. § 3401 (1994). 13. See The Center for Democracy and Technology's Snoop Demonstration at http://snoop.cdt.org/ for an example of the information that can be easily captured by sites on the World Wide Web. 14. "Cookies" is a browser feature that assists Web site operators in tracking a user's activities. It was initially designed to address the "static state" problem of the World Wide Web, the fact that Web sites don't know whether a user is a first time or repeat visitor. See Joan E. Rigdon, Internet Users Say They'd Rather Not Share Their 'Cookies,' WALL ST. J., Feb. 14, 1996, at B6.
20. In October of 1994, also commonly known as the "Digital Telephony" legislation, Congress enacted the Communications Assistance and Law Enforcement Act of 1994, providing heightened protections for transactional data. Pub. L. No. 103­414, 108 Stat 4279 (1994) (codified in scattered sections of 18 U.S.C. and 47 U.S.C.) [hereinafter "CALEA"]. The statute requires telecommunications carriers to ensure that their systems contain sufficient capability and capacity to permit law enforcement to conduct electronic surveillance. Although law enforcement officials must still obtain a search warrant in order to conduct a wiretap, the statute granted law enforcement new authority to influence the design of telecommunications networks. § 103(a), 108 Stat. at 4280.
28. Law enforcement is eager to access the vast data available about individuals' financial transactions. Under a new set of proposed regulations, United States banks must monitor their customers and alert federal officials to "suspicious" behavior. The proposed regulations were filed with the Federal Register on December 7, 1998 by the Federal Deposit Insurance Corporation, the Federal Reserve, Department of the Treasury's Office of Comptroller of the Currency, and Office of Thrift Supervision. See Minimum Security Devices and Procedures and Bank Secrecy Act Compliance, 63 Fed. Reg. 67,529­67,536 (Dec. 7, 1998) (to be codified at 12 C.F.R. pt. 326). The regulations require banks to review every customer's "normal and expected transactions" and tip off the IRS and federal law enforcement agencies if the behavior is unusual. Id. Under the so-called "Know Your Customer" rules the Federal Reserve, the Office of Thrift Supervision, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation have published identical requirements. Id. Today, if a bank detects any "suspicious activity," they must file a five-page report including your name, address, Social Security number, driver license or passport number, date of birth, and information about the transaction. Id. Under the new regulations they will also have to determine the "source of a customer's funds"‹such as payroll deposits‹and authorize federal agents to inspect "all information and documentation" of accounts upon request. Id. The information all goes into the Suspicious Activity Reporting System, a mammoth searchable database jointly administered by the IRS and FinCEN, around since April 1996. Over a dozen agencies including the FBI, IRS, Secret Service, bank regulators, and state law enforcement share access to this data. Declan McCullagh, Banking With Big Brother, Wired News http://www.wired.com/news/print_version/politics/story/16749.html?wnpg=all.
43. The recordkeeper would have Fourth Amendment protections. Whether the patient's privacy is protected at all would largely depend upon state law, which is scattered and inconsistent. Until a federal law protecting individual's privacy in health information is crafted to protect data regardless of where it is stored or whose control it is under, privacy is in danger. 44. 18 U.S.C. § 2703(b) (1994).
46. 18 U.S.C. §§ 2570­2711 (1994). 47. Fed. R. Civ. P. 45(b)(1).
59. 18 U.S.C. §§ 2510­2711 (1994).
60. Communications Assistance for Law Enforcement Act of 1994, Pub. L. No. 103-414, 108 Stat. 4279 (1994) (codified at 47 U.S.C. § 1001 and scattered sections of 18 U.S.C. and 47 U.S.C.).
61. 18 U.S.C. § 2703(b)(2)(A)­(B), (c)(1)(B), (d) (1994).
62. The Government Paperwork Elimination Act, Pub. L. No. 105­277, §§ 1701­1710, 112 Stat. 2681, 2681­749 (1998) (codified at 44 U.S.C.A. § 101 (1998)).
63. § 1708, 112 Stat. at 2681­750. 64. For a thoughtful discussion of the privacy protection possible through technologies that limit data collection, see THE NETHERLANDS AND INFORMATION AND PRIVACY COMMISSIONER, I, II Privacy-Enhancement Technologies: The Path to Anonymity (Ontario, Canada Aug. 1995) [herinafter NETHERLANDS]. In his paper, "Privacy-Enhancing Technolo-gies: Typology, Critique, Vision," Herbert Burkert suggests that Privacy-Enhancing Tech-nologies ("PETs") can be differentiated into four categories: subject-oriented; object-oriented; action-oriented; and, system-oriented. Burkert's approach provides a heuristic method useful for thinking broadly about the role of PETs. Herbert Burkert, Privacy-Enhancing Technologies: Typology, Critique, Vision, in TECHNOLOGY AND PRIVACY: THE NEW LANDSCAPE, 125­142 (Philip E. Agre & Marc Rotenberg, eds. MIT Press 1997).
71. Id. The decoupling of accounting and identity are facilitated by front-end debiting. The user produces a digital document containing both her identity and a pseudonym. She sends it to her bank with only the identity readable. The bank verifies the document, deducts the appropriate amount from her account, and sends it back to the user as a document of fixed value with a stamp indicating its authenticity. The user then gives the digital document to a merchant obscuring her identity and revealing her pseudonym. The merchant can read the value and the stamp on the document indicating its authenticity. When presented to the bank the merchant's account will be credited. See NETHERLANDS, supra note 64, at 40­42.
75. For an overview, see Joseph Reagle & Lorrie Faith Cranor, The Platform for Privacy Preferences, Comm., at 48­55. 76. The Electronic Communications Privacy Act of 1986 (ECPA), which updated the 1968 Wiretap Act, was the result of a collaborative public interest/private sector effort. 18 U.S.C. §§ 2510­2711 (1994). Industry feared that without legal protection against eavesdropping and interception, consumers would be reluctant to use emerging electronic media, such as cellular phones and e-mail, to communicate. The resulting law extended legal protection akin to that provided First Class mail, and was developed and supported by a diverse coalition of business, civil liberties, and consumer advocates who understood that consumers would be unwilling to fully embrace electronic mail and other new technologies without strong privacy protections. Similarly, the 1995 amendments to ECPA crafted privacy protections for transactional information that was content-like in its ability to reveal facts about a person's life. In these instances, developing and enacting a legislative privacy regime was viewed by the business community as a necessary component of creating and supporting a flourishing market for their products. The nexus between privacy protection and business necessity resulted in a diverse public interest/industry coalition supporting increased protections for transactional data. Communications Assistance and Law Enforcement Act of 1994, Pub. L. No. 103­414, § 207, 108 Stat. 4279 (codified at 18 U.S.C. §§ 2510‹2711 (1994)). There is dispute over whether other sections of CALEA solve or create privacy problems.
Other privacy legislation supported by the public and private sectors The Cable Communications Privacy Act of 1986 and the Video Privacy Protection Act of 1988 reflect a similar coalescing of interests. Enacted within a couple of years of each other, both laws resulted from the affected industry's realization that a lack of assurance that viewing preferences were protected from prying eyes, would have a chilling effect on consumers' viewing and renting habits. The revelation in a Washington, DC, weekly paper, that a reporter,‹or anyone for that matter‹could walk in off the street and discover Supreme Court nominee Judge Bork's taste in movies provided privacy advocates with the perfect story to gain Congress's attention. Privacy advocates arrived on the Hill with Erols, the Video Software Dealer's Association, the Direct Marketing Association, and others who realized that the viability of their businesses depended on consumer trust and confidence that video rental lists were safeguarded by strong legal restrictions on government and private sector access. In other instances, industry has been moved to support privacy legislation in the wake of public revelations of bad practices or a particularly compelling horror story. The Fair Credit Reporting Act of 1970 ("FCRA") was initially drafted and supported by the credit reporting industry in response to congressional hearings which revealed widespread misuse of credit information and an alarming rate of inaccuracies in credit reports. An enraged Congress, with the support of privacy and consumer organizations, indicated a commitment to passing a law regulating the use of consumer credit information. Realizing that legislation was inevitable, the industry set about crafting a policy that they could support. The Driver's Privacy Protection Act of 1994 was largely triggered by the murder of actress Rebecca Shaffer and eventually garnered the support of the majority of the affected industries. Through information in her driver license file at the department of motor vehicles, Shaffer's stalker was able to learn her whereabouts. 77. The Privacy Act of 1974, 5 U.S.C. § 552a (1973).
-- Read the full text of in Nova Law Review Issues -> Free ExpressionOnline Child SafetyIntermediary Liability and Section 230Internet NeutralityInternational Free ExpressionMore Issues in Free Expression -> Consumer PrivacyBehavioral AdvertisingSpywareLocationIdentity ManagementBaseline Privacy LawData Security/BreachMore Issues in Consumer Privacy -> Health PrivacyPrivacy FrameworkConsentDe-Identified DataHIPAAPrivacy Enforcement Personal Health RecordsHITECH/ARRA ImplementationState Privacy Protections -> Security & SurveillanceECPAPATRIOT ActCybersecurityTerrorism Information SharingFISA and NSA Warrantless SnoopingCALEA and Tech MandatesLocation PrivacyGovernment IdentityMore Issues in Security & Surveillance -> Digital Copyright3 Strikes / Graduated ResponseSecondary LiabilityFiltering/Watermarking/DRMInternational CopyrightMore Issues in Digital Copyright -> Internet Openness & StandardsInternet GovernanceTechnical StandardsInternet Neutrality -> InternationalGlobal Internet FreedomJurisdictionInternet GovernanceInternational Copyright -> Open GovernmentCongressional Research ServiceFederal Digital IdentityThe Freedom of Information ActThe Privacy ActAccess to Government InformationPrivacy and Open Government Most ReadMost Emailed