Lior Jacob Strahilevitz

A Social Networks Theory of Privacy

What facts are public and what facts are private? It is the fundamental, first-principles question in privacy law, and a necessary element in the two most important privacy torts, public disclosure of private facts and intrusion upon seclusion. Yet the American courts lack a coherent, consistent methodology for determining whether an individual has a reasonable expectation of privacy in a particular fact that he has shared with one or more persons. Some courts hold that when an individual discloses a sensitive fact about himself to a handful of co-workers, friends, relatives, or strangers, this disclosure renders the fact in question sufficiently public to deprive him of a tort cause of action when that fact is subsequently widely disseminated or obtained by a third party using improper means. Other courts hold that an individual can share such a fact with dozens, or even hundreds of people, and still retain a cause of action under privacy tort law. So how much disclosure is enough to transform a private fact into a public fact? This paper argues that insights from the literature on social networks and information dissemination can help provide courts with satisfying answers to these central questions in privacy law. The social networks literature has generated theoretical and empirical insights about the probability that information disclosed to one member of a community will ultimately become known by a large segment of the community. Using these insights, courts can gauge whether the plaintiffs previously private information would have been widely disseminated regardless of the defendants actions in a particular case. If so, the information in question was public, and if not, the tort law ought to deem the information as private. This paper argues that such an approach, which treats the privacy question as an empirical one, is more attractive than any other method of establishing whether the plaintiff had a reasonable expectation of privacy in the information at issue. The literature on social networks and information dissemination has wide applications beyond privacy tort law, but has found its way into little legal scholarship. Legal scholars interested in Fourth Amendment law, trade secrets, patent law, constitutional privacy, defamation, and other fields might find the papers survey of social networks theory useful and provocative.

Reunifying Privacy Law

In the years since Samuel Warren and Louis Brandies proposed a unified theory of invasion of privacy tort liability, American information privacy law became increasingly fragmented and decreasingly coherent. William Prosser’s 1960 article, Privacy, which heavily influenced the Restatement of Torts, endorsed and hastened this trend toward fragmentation, which spread from tort law to the various statutory branches of information privacy law. This paper argues for the reunification of privacy law in two connected ways. First, Prosser’s fragmented privacy tort should be replaced with a unitary tort for invasion of privacy that looks to the private or public nature of the information, the degree to which a defendant’s conduct violates existing social norms, and the social welfare implications of the defendant’s conduct. Second, the reunified common law of torts should become the model for judicial interpretation of various other branches of information privacy law, such as the Freedom of Information Act’s privacy provisions, the Privacy Act, and the constitutional right of information privacy. The paper examines how this reunification project can be accomplished, why it is desirable, and whether it is consistent with the Supreme Court’s methodological guidance in privacy controversies.The final section of the paper argues that the pending United States Supreme Court case of Nelson v. NASA is an ideal vehicle for pushing the law of information privacy back towards its relatively coherent and unified origins. Nelson will be the first Supreme Court case in thirty-three years to confront squarely the question of whether the Constitution protects a right to information privacy apart from the Fourth Amendment context. Because the common law tort cause of action and constitutional action involve similar harms and considerations, it is appropriate to reconcile the presently divergent doctrines, though this could be done in one of two ways. The most sensible approach to reunification is to conclude, as the Sixth Circuit has, that there is no such thing as a constitutional right to information privacy, and that such rights are appropriately vindicated via tort or statutory remedies. An alternative approach would be to recognize the existence of a constitutional right, as most circuit courts have, but to hold that the elements of a constitutional violation mimic those associated with the reunified privacy tort.

Actual Expectations of Privacy, Fourth Amendment Doctrine, And The Mosaic Theory

In the landmark case of United States v. Jones, as many as five Supreme Court justices indicated that tracking the geolocation of a car for a month would be a Fourth Amendment search even though tracking the same car for a day would not be. This duration distinction is based on an influential theory of the Fourth Amendment, dubbed the mosaic theory, which posits that the aggregation of several nonsearches of the same person might amount to a search. Jurists have justified the mosaic theory’s duration-sensitivity by grounding it in their sense of “popular attitudes” regarding privacy expectations. Through an empirical examination of survey responses from three large nationally representative samples totaling over 2800 US citizens, we show that Americans’ actual privacy expectations run directly counter to the mosaic theory. Where the mosaic theory says that tracking duration affects citizens’ expectations of privacy, ordinary Americans overwhelmingly say it does not. Our data also reveal that younger Americans and those Americans holding the most firmly anti-authoritarian views have significantly greater expectations of privacy in geolocation information than their fellow citizens. Americans do say that longer duration surveillance is more intrusive than shorter duration surveillance, but the magnitude of this effect remains small. We explore the implications of these findings for the mosaic theory by considering the role of public opinion data in Fourth Amendment doctrine more generally. We ultimately propose a clarified approach to the classic Katz v. United States “reasonable expectations of privacy” framework that formalizes the role of public opinion by reframing the first prong of Katz to ask whether people in general expect privacy in a given context, and the question of what “society is prepared to recognize as reasonable” in Katz as one for which the perceived intrusiveness of a search is germane. To show how survey data could shed light on current Fourth Amendment controversies, we also provide contemporary data about American citizens’ privacy expectations when faced with various scenarios. The paper presents new data on popular expectations of privacy with regard to police use of stingray devices, cell tower geolocation, email content analysis, hotel guest registry searches, and various sorts of surveillance cameras. * Law Clerk to the Honorable Richard Posner, U.S. Court of Appeals, Seventh Circuit, 2015-2016; JD University of Chicago Law School, 2015; PhD in Psychology, Princeton University, 2010. ** Sidley Austin Professor of Law, University of Chicago. The authors thank Paul Crane, Katerina Linos, and Peter Winn for helpful discussions, Adam Chilton, Adam Feibelman, Jancy Hoeffel, Chris Hoofnagle, Orin Kerr, Richard McAdams, Pamela Metzger, Paul Ohm, Eric Posner, Christopher Slobogin, Geoffrey Stone, and Matt Tokson as well as workshop participants at Tulane Law School and the University of Chicago Law School for constructive comments on earlier drafts, Michelle Hayner and Adam Woffinden for research assistance, plus the Russell J. Parsons and Bernard Sang Faculty Research Funds and the Coase-Sandor Institute for Law & Economics, for generous research support.

Is Privacy Policy Language Irrelevant to Consumers

This article reports the results of two experiments in which large, census-weighted samples of Americans read short excerpts from Facebook’s, Yahoo’s, and Google’s privacy policies, which are at issue in high-stakes privacy class-action lawsuits. Subjects were randomly assigned to read language from either vague policies, some of which had been adjudicated insufficient to notify consumers about the companies’ practices, or explicit policies. Though many experimental subjects read these privacy policy excerpts closely, subjects who saw the explicit policies did not differ from those who saw vague policies in their assessment of whether their assent to the policies would permit the corporate practices at issue. Subjects generally stated that agreement to either vague or explicit language authorized companies to collect or use their personal information, even though consumers regarded these corporate practices as intrusive. These experiments show that courts and laypeople can understand the same privacy policy language quite differently.

Contracting Over Privacy: Introduction

This short essay introduces papers presented at the symposium Contracting over Privacy, which took place at the Coase-Sandor Institute for Law and Economics at the University of Chicago in fall 2015. The essay highlights a quiet legal transformation whereby the entire area of data privacy law has been subsumed by consumer contract law. It offers a research agenda for privacy law based on the contracting-over-privacy paradigm.