• Course description

 
This seminar will explore the domestic and international development of data privacy law. The course will focus on issues of privacy, security and the emerging regulations that establish fair infomration practices for the Internet and global electronic commerce. Particular attention will be given to technologies that can invade as well as protect personal information and the relationship between those technologies and data protection law. The seminar will require Internet-based research and a paper that may be used to satisfy the writing requirement.



• Course Materials

 
Course readings will be made available on this web page and through a class discussion group found at the Virtual Classroom Center which will be demonstrated during the first class session.   Students should also purchase:

            Marc Rotenberg, Privacy Law Source Book (EPIC: 2001).

Students will need access to e-mail and the world wide web to participate in the course.  While e-mail and Internet access are available at the school, it is highly recommended that students obtain an Internet service provider account to assure reliable use throughout the semester.
 

• Class Meetings
 
Class will meet Wednesday in Rm. 310 from 10:00am to 11:50am.


• Class Participation and Preparation

 

All students are expected to prepare in advance for class. In the event that any of the links to course reading become outdated, students should either inform the instructor or must find an alternate path to the same reading.

Because the Internet often faces traffic slowdowns and the servers storing class readings may have occasional problems, students should plan to access course readings well in advance of class.

Student Papers

This course is a writing seminar. Each student is required to complete a substantial research and writing project. Final papers must be at least 25 pages or another single work of equivalent magnitude in an electronic format. Early in the semester students will be asked to make a topic proposal for instructor approval. Students will be required to submit an outline and rough draft for comment during the semester. The deadline for submission of final projects is extended to 12pm, May 8, 2002. Any student wishing to present the final project in electronic form must indicate the format on the topic proposal.

Any student preparing work in satisfaction of the writing requirement must submit the Registrar's notification form to the instructor before Friday, Jan. 12, 2002.
 

• Grading
 
Grades will be based on the writing project and class participation.  Attendance and advance class preparation are mandatory.  Any student who is repeatedly absent from class or regularly unprepared for class will receive a grade penalty and may become ineligible for course credit.  Paper deadlines must be strictly observed. Late submissions may receive a 1/3 to 1 full grade penalty and may preclude writing and/or course credit.
• Office Hours

 

My office is Room 334 and I can also be reached by telephone at ext. 6843. I will regularly be available on Wednesdays both before and after class for office visitsas well as by appointment . In addition, I will hold "virtual office hours" via e-mail, 24 hours/day at < reidenberg@sprynet.com >.



• Course Reading Assignments

 
The seminar readings are grouped around four key themes:  (I) the circulation of personal information on networks and privacy theories;  (II) limitations on the public sector's access to and use of personal information; (II) the regulation of private sector data processing; and (IV) international aspects of cross-border data flows.   Each class session will address topics within these themes and, during the course of the semester, the reading assignments will be assigned through the class discussion group and this web page.

 

PART I:    INFORMATION CIRCULATION AND PRIVACY

The first part of the course will focus on the circulation of personal information on the Internet and theories of data privacy.

Topic 1:  Electronic Traces and Network Trends  (1/9/02)

Joel R. Reidenberg, Resolving Conflicting International Data Privacy Rules in Cyberspace, 52 STANFORD  L. REV. 1315 (2000) (Read pp. 1315-1324)

        Forensic exercises:
                Examine your own data trail:  visit:  http://privacy.net/analyze/      and  visit:  http://www.cnil.fr/uk/traces/uk_traces.htm
                Examine some examples of widely available data:  visit
                            http://www.mmslists.com/consumers_by_ailment_polk.htm
                            http://www.privaseek.com/
                            http://www.techreview.com/articles/nov94/mitchell.html
                            http://www.acxiom.com/productsandservices/brochure/pdfs/CLRC_NWCL.pdf
                            http://www.venturedirect.com/cgi-local/listmgmt-card.pl?list&list0196&brokerage

               Learn about hidden disclosures of personal information:  browse: http://users.rcn.com/rms2000/privacy/
               See privacy protective technologies:
                        The Anonymizer, http://www.anonymizer.com/3.0/index.shtml
                        Crowds http://www.research.att.com/projects/crowds/
                        ProxyMate http://www.lpwa.com/

 Topic 2:  Fair Information Practice Standards (1/16/02)
 
 

Joel R. Reidenberg, Resolving Conflicting International Data Privacy Rules in Cyberspace, 52 STANFORD  L. REV. 1315 (2000) (Read pp. 1325-1351)
         OECD Guidelines  http://www.oecd.org/dsti/sti/it/secur/prod/PRIV-EN.HTM     (skim)
         Council of Europe Convention http://conventions.coe.int/treaty/en/Treaties/Html/108.htm (skim)
         A Framework for Global Electronic Commerce http://www.ecommerce.gov/framewrk.htm (read Privacy section)
         Options for Promoting Privacy, http://www.iitf.nist.gov/ipc/privacy.htm
         Solveig Singleton, Privacy as Censorship http://www.cato.org/pubs/pas/pa-295.html

            Interesting Organizations to browse:
                    Privacy Foundation http://www.privacyfoundation.org

Center for Democracy and Technology http://www.cdt.org
EPIC http://www.epic.org
Junkbusters http://www.junkbusters.com
Privacy Laws & Business Index of Data Privacy Commissions http://www.privacylaws.co.uk/links.htm
Direct Marketing Association http://www.the-dma.org/library/privacy/index.shtml

 

PART II:    PUBLIC SECTOR

 
The second part of the seminar will study the limitations on data gathering and use by he public sector.  This part will be focus heavily on the issues raised in connection with September 11th.

Topic 1:   Base Line (1/23/02)
 

US Dept. of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (Jan. 2001) (read Parts I (A) - I(C) and II)
U.S. v. Scarfo, US Crim. Action No. 00-404 (NHP) (NJ Dec. 26, 2001) (read Background and 4th Amendment discussion. Ignore CIPA)
H. Rep. 105-37: A Citizen's Guide on Using the Freedom of Information Act and the Privacy Act of 1974 to Request Gov't Records , 105th Congress, 1st Session (March 20, 1997)
 Statutes for Reference
    Privacy Act of 1974
    Freedom of Information Act
Topic 2:  Financial Records (1/30/02)
 
U.S. v. Miller, 425 U.S. 435 (1976)
Right to Financial Privacy Act , 12 USC 3401-3422 (skim statute)
Privacilla.org, Bank Secrecy Act
Financial Record Keeping and Reporting of Currency and Foreign Transactions, 31 C.F.R. Part 103 (follow links and skim the Regulations, read Part 103.28).
Declan McCullagh, Know Your (Customer) Rights , Wired (March 30, 1999)

Topic 3:  Telecommunications Records  (2/6/02)

       Katz v. US, 389 U.S. 347 (1967)
       Electronic Communications Privacy Act, 18 U.S.C. 2510 et al (skim)
       United States v.Smith, 155 F.3d 1051, 1055 (9th Cir. 1998), cert. denied, 525 U.S. 1071 (1999) (read through Part II. B)
       Konop v. Hawaiian Airlines, 236 F.3d 1035 (9th Cir., 2001)
       Computer Assistance for Law Enforcement Act of 1994 http://wireless.fcc.gov/csinfo/calea.html
        Echelon Watch, Answers to Frequently Asked Questions (FAQ) about Echelon (Oct. 15, 2001)

Topic 4:  Patriot Act  (2/13/02)

American Bankers' Association, Aiding The Investigators: What the Right To Financial Privacy Act Allows You To Do
Electronic Frontier Foundation, Analysis of the Provisions of The USA PATRIOT Act that Relate to Online Activities , Oct. 31, 2001
Piper & Marbury, Summary and Analysis of Key Sections of the USA PATRIOT Act of 2001 (Oct. 31, 2001)
Hearing on " The Financial War on Terrorism and the Administration's Implementation of the Anti-Money Laundering Provisions of the USA Patriot Act."   before the Senate Committee on Banking, Housing and Urban Affairs, 107th Cong., 2nd Session (Jan. 29, 2002) (skim statements--don't bother printing, read Statement of the Hon. Michael Chertoff )
Electronic Frontier Foundation, USAPA Sunset Provisions Could Leave Congress in the Dark (Dec. 2001)

On-line Reference
    US PATRIOT ACT, Pub. L. No. 107-56, Oct. 26, 2001 http://www.cdt.org/security/usapatriot/011026usa-patriot.pdf

 
***** RESEARCH PAPER OUTLINES DUE  (2/20/02)

 PART III:  PRIVATE SECTOR

The third part of the seminar will examine the treatment of personal information in the private sector.  These readings will explore specific statutory and policy approaches and will include a skills exercise based on real corporate privacy policies.

Topic 1:   Profiling and Secondary Use (2/27/02)

        OECD Guidelines   http://www.oecd.org/dsti/sti/it/secur/prod/PRIV-EN.HTM
            (read sections on "Purpose Limitation")
        Joel R. Reidenberg, Ecommerce and Trans-Atlantic Privacy , 38 HOUSTON L. REV.
            717 (2001)   (read pp. 720-722)
        Fair Credit Reporting Act, 15 U.S.C. §§ 1681-1681u (skim statute, read 15 U.S.C.
            1681b) http://www4.law.cornell.edu/uscode/15/ch41schIII.html
        Trans Union v. FTC,   D.C. Cir. Docket  No. 00-1141
           http://laws.findlaw.com/dc/001141a.html  reh. denied
           http://laws.findlaw.com/dc/001141b.html
        Telecommunications Act of 1996, Section 222
           http://www4.law.cornell.edu/uscode/47/222.html
         US West v. FCC, 182 F.3d 1224 (10th Cir., 1999) cert. denied.
                  Optional resource material:  FCC Regulations
                              http://www.epic.org/privacy/cpni/CPNI_Guidelines_02.26.98.pdf
        Troy Wolverton, Amazon Unit Settles Privacy Lawsuit , C/Net news.com (Apr. 27,
                2001)
 

Topic 2:   Children and Data Collection  (3/6/02)
    Federal Trade Commission Materials on Children's privacy
                Read:  http://www.ftc.gov/bcp/conline/edcams/kidzprivacy/biz.htm
                Browse:  http://www.ftc.gov/bcp/conline/edcams/kidzprivacy/
    Visit:  http://www.kidscom.com/home_flash.html  (click on "Privacy Statement" found in the upper right of page)
     FTC Announces Settlements with Web Sites That Collected Children's Personal Data Without Parental Permission
    COPPA Safe Harbor (browse)
     Resource:  Children's Online Privacy Protection Act of 1998

Topic 3:  Filtering Technologies   (3/13/02)
        Guest Speaker: Lorrie Cranor, AT&T Research
        Lorrie Cranor, P3P Handbook      Chapter 1 (read)  Chapter 10 (recommended)  (the passwords will be distributed on the Discussion Group
          and by email)

Topic 4:  Lawyering Skills Exercise   (3/20/02)
 

**** RESEARCH PAPER DRAFTS DUE (3/22/02)
         SUBMIT NO LATER THAN 12PM
         IN FACULTY SECRETARIAL OFFICE, ROOM 405

 

PART IV:  INTERNATIONAL

 


The last part of the seminar will study the international dimensions of the regulation of the treatment of personal information.  In particular, the readings will focus on the problems that divergences in data privacy rules create for international data flows.

Topic 1:    European Data Protection and Flows (4/3/02)

    Guest Lecture followed by class lunch with Yves Poullet, Dean of the Law School
     at FUNDP, Belgium

            EU Directive 95/46/EC     (skim all, read Arts. 25-26)
            Implementation of EU Directive 95/46/EC
               Reidenberg & Schwartz, Online Services and Data Protection Law: Regulatory Responses (EUR-OP, 1998) (read Part III, pp. 121-153)

Topic 2:  Trans-Atlantic Data Flows (4/10/02)
 

Joel R. Reidenberg, Ecommerce and Trans-Atlantic Privacy , 38 HOUSTON L. REV. 717 (2001)

EU Working Party, Transfers of personal data to third countries : Applying Articles 25 and 26 of the EU data protection directive http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/wp12en.htm
 

Topic 3: Safe Harbor Implementation (4/17/02)

European Commission Staff Working Paper SEC 2002/196 (13 Feb. 2002)
Joel R. Reidenberg, European Commission avoids privacy dispute with the USA , Privacy Laws & Business, pp. 9, 26 (Feb. 2002)
 
SEMINAR CONCLUSION (April 24, 2002)

Papers due in Registrar's Office on 4/25/02 by 5pm or as announced in class on April 24, 2002.



LATE NEWS:  PAPERS MAY BE SUBMITTED TO THE REGISTRAR'S OFFICE THROUGH 12PM, MAY 8, 2002.  NO PAPERS WILL BE ACCEPTED AFTER THE EXTENDED DEADLINE.