Preemption and Privacy

Yale Law Journal

Volumn 118, Issue 5, 2009, Pages 902-947

  Schwartz, Paul M ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 66749171195     PISSN: 00440094     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (227)

1. SeeAnne Broache, Gates Urges Federal Data Privacy Law,CNET News, Mar. 8, 2007, http://www.news.com/2100-1014-3-6165395.html; Grant Gross, Microsoft's Bill Gates Wants New Privacy Law,CIO, Mar. 7, 2007, http://www.cio.com/article/29936/ Microsoft-s-Bill-Gates-Wants-New-Privacy-Law. The Microsoft support for a federal privacy law did not begin, however, in 2007, but 2005. A white paper by Brad Smith, Microsoft's General Counsel, provides the most detailed explanation of the company's position. SeeBrad Smith, Senior Vice President, Gen. Counsel, Microsoft Corp., Protecting Consumers and the Marketplace: The Need for Federal Privacy Legislation (Nov. 2005), http://www.microsoft.com/presspass/download/features/2005/ PrivacyLegislationCallWP.doc [hereinafter Microsoft White Paper].
2. SeeRiva Richmond, Business Group Calls for Privacy Law,WALL ST. J., June 21, 2006, at B2; Erika Morphy, Tech Giants Form Consumer Privacy Rights Forum,TECH NEWS WORLD , June 21, 2006, http://www.technewsworld.com/ story/51272.html.
3. Morphy, supranote 2.
4. See infratext accompanying notes 34-39.
5. See infratext accompanying notes 79-86 for a discussion of the Fair Credit Reporting Act in the context of its amendment by the Fair and Accurate Credit Transactions Act.
6. The Microsoft White Paper indicates the importance of preemption from the perspective of a leading industry participant in this debate. SeeMicrosoft White Paper, supranote 1, at 4-5. On the presence of numerous veto points for federal legislation in the United States, see ABRAHAM L. NEWMAN , PROTECTORS OF PRIVACY 60 (2008).
7. See infratext accompanying notes 166-167 for a discussion of defensive preemption.
8. 15 U.S.C. §§ 1681-1681X (Supp. V 2005).
9. Samuel D. Warren&Louis D. Brandeis, The Right to Privacy,4 HARV . L. REV . 193 (1890).
10. For a detailed overview of the privacy tort and its development, see DANIEL J. SOLOVE &PAUL M. SCHWARTZ , INFORMATION PRIVACY LAW 77-231 (3d ed. 2009).
11. 582 N.W.2d 231 (Minn. 1998).
12. Robert C. Post, The Social Foundations of Privacy: Community and Self in the Common Law Tort,77 CAL . L. REV . 957 (1989).
13. See id.at 1010.
14. Id.at 1009. Daniel Solove also has developed proposals to revitalize the tort right of privacy for the information age. SeeDANIEL J. SOLOVE , THE FUTURE OF REPUTATION 113-24 (2007).
15. Paul M. Schwartz, Beyond Lessig's Code for Internet Privacy: Cyberspace Filters, Privacy-Control, and Fair Information Practices,2000 WIS . L. REV . 743, 779-81 [hereinafter Schwartz, Lessig's Code]
16. seePaul M. Schwartz, Privacy and Democracy in Cyberspace,52 VAND . L. REV . 1609, 1614 (1999) (fair information practices "are the building blocks of modern information privacy law").
17. The expression of FlPs in different laws, regulations, and proposals varies in details, sometimes crucially. For my own attempts to summarize these standards, see Schwartz, Lessig's Code, supranote 15, at 779-80;
18. and Paul M. Schwartz&William M. Treanor, Review Essay, The New Privacy,101 MICH . L. REV . 2163, 2181 (2003).
19. For a masterful account of these developments, see Spiros Simitis, Einleitung [Introduction], inNOMOS KOMMENTAR ZUM BUNDESDATENSCHUTZGESETZ [COMMENTARY ON THE FEDERAL PRIVACY LAW ] 61, 62-63 (Spiros Simitis ed., 6th ed. 2006).
20. Gesetz zum Schutz vor Mifibrauch personenbezogener Daten bei der Datenverarbeitung (Bundesdatenschutzgesetz) [Federal Data Protection Act], Jan. 27, 1977, BGBl. I at 201, Jan. 14, 2003, BGBl. I at 66, last amended by Gesetz, Aug. 22, 2006, BGBl. I at 1970.
21. Council Directive 95/46, 1995 O.J. (L 281) 31 [hereinafter Data Protection Directive]. For background on the Directive, see Paul M. Schwartz, European Data Protection Law and Restrictions on International Data Flows,80 IOWA L. REV . 471, 480-83 (1995).
22. Data Protection Directive, supranote 19, recital 69, at 37.
23. Recital 23 of the Directive leaves the choice of regulatory instruments open to the EU member state. It states, "Whereas Member States are empowered to ensure the implementation of the protection of individuals both by means of a general law on the protection of individuals as regards the processing of personal data and by sectorial laws such as those relating, for example, to statistical institutes." Id.recital 23, at 33. This language probably is best read as permitting a combination of omnibus and sectoral laws by member states.
24. Ulrich Dammann, inEG-DATENSCHUTZRICHTLINIE : KOMMENTAR [COMMENTARY ON EUROPEAN COMMUNITY DATA PROTECTION DIRECTIVE ] 133 (Ulrich Dammann&Spiros Simitis eds., 1997).
25. Id.
26. Data Protection Directive, supranote 19, art. 32, at 49.
27. SeeCOMM'N OF THE EUROPEAN CMTYS ., FIRST REPORT ON THE IMPLEMENTATION OF THE DATA PROTECTION DIRECTIVE (95/46/EC), at 3 n.1 (2003), available athttp://eur- lex.europa.eu/LexUriServ/LexUriServ.do? uri=CELEX:52003DC0265:EN:NOT.
28. "In so far as other legal provisions of the federal government are applicable to personal data ... such provisions shall take precedence over the provisions of this Act." Gesetz zum Schutz vor Mifibrauch personenbezogener Daten bei der Datenverarbeitung (Bundesdatenschutzgesetz) [Federal Data Protection Act], Jan. 27, 1977, BGBl. I at 201, last amended by Gesetz, Aug. 22, 2006, BGBl. I at 1046, § 1(3).
29. Privacy Act of 1974, 5 U.S.C. § 552a (2000).
30. Regarding the important limitations of the Privacy Act to only "federal agencies" and its narrow definition of "record," See PAUL M. SCHWARTZ &JOEL R. REIDENBERG , DATA PRIVACY LAW 92 n.4 (1996);
31. and U.S. DEP'T OF JUSTICE , PRIVACY ACT OVERVIEW , MAY 2004 EDITION : DEFINITIONS (2004), available athttp://www.usdoj.gov/oip/ 1974definitions.htm.
32. S. 3418, 93d Cong. § 201(a) (1974).
33. Id.§ 201(a)(1).
34. Id.§ 201(a)(4).
35. Id.§ 201(a)(5).
36. Data Protection Directive, supranote 19, art. 25(1), at 45; seeSchwartz, supranote 19, at 483-88.
37. 18 U.S.C. § 2710 (2000).
38. Id.§ 2710(a)(4).
39. Id.
40. Id.§ 2710(b)(2)(E).
41. Id.§ 2710(b)(2)(D)(ii).
42. Id.
43. STAFF OF S. COMM. ON GOV'T OPERATIONS&H. COMM. ON GOV'T OPERATIONS, 94TH CONG., LEGISLATIVE HISTORY OF THE PRIVACY ACT OF 1974, S. 3418 (PUBLIC LAW 93-579): SOURCE BOOK ON PRIVACY 172 (Comm. Print 1976) [hereinafter PRIVACY SOURCEBOOK]. The Senate Committee on Government Operations in its report on the bill observed that it was persuaded to "delay a decision on total application by considerations of time and investigative resources for developing a full hearing record and for drafting the needed complex legislative solution for information abuses in the private sector, beyond those presently covered by the Fair Credit Reporting Act and its pending amendments." Id.As Priscilla Regan in her account of this period writes, "A major argument for removing the private sector from the purview of the 1974 legislation was that there was little concrete evidence of abuses in private sector personal information practices." PRISCILLA REGAN, LEGISLATING PRIVACY 78 (1995).
44. REGAN, supranote 40, at 78.
45. For a discussion of the origins of this phrase, see Cedric M. Smith, Origin and Uses ofPrimum Non Nocere-Above All, Do No Harm!,45 J. CLINICAL PHARMACOLOGY 371 (2005).
46. SeeCass R. SUNSTEIN, LAWS OF FEAR: BEYOND THE PRECAUTIONARY PRINCIPLE 23-25 (2005).
47. Simitis, supranote 17, at 68.
48. Id.
49. NEWMAN, supranote 6, at 60-69.
50. Id.at 62. The impact was muted because in France, "[b]anks did not need to exchange intense amounts of information because they had relatively large, national customer pools and access to a wide range of information about those customers." Id.
51. Id.at 63-64.
52. 14. tATIGKEITSBERICHT DES BUNDESBEAUFTRAGTEN FUR DEN DATENSCHUTZ GEMAFI ABS. 1 dES BUNDESDATENSCHUTZGESETZES [REPORT OF THE COMMISSIONER FOR DATA PROTECTION IN ACCORDANCE WITH ABS. 1 OF THE FEDERAL DATA PROTECTION ACt] 12 (1993).
53. For a discussion of the influence of the European pressure on Margaret Thatcher's Tory government and how it led to the U.K. data protection law, see COLIN J. BENNETT, REGULATING PRIVACY 91 (1992).
54. NEWMAN, supranote 6, at 75. For an early discussion of the important role of the data protection commissioners in the EU, see Schwartz, supranote 19, at 492-95.
55. NEWMAN, supranote 6, at 3, 97-98.
56. James Whitman provides the richest argument for the influences of cultural differences in the differing approaches to information privacy in Europe and the United States. James Q Whitman, The Two Western Cultures of Privacy: Dignity Versus Liberty,113 YALE L.J. 1151, 1163 (2004). For an interpretation of differences in EU and U.S. information privacy law that stresses the influence of historically contingent events, see NEWMAN, supranote 6, at 52-54. For a discussion that stresses both historically contingent factors and cultural ones in shaping European privacy law, see Francesca Bignami, European Versus American Liberty: A Comparative Privacy Analysis of Antiterrorism Data Mining,48 B.C. L. REV. 609, 684-88 (2007).
57. Right to Financial Privacy Act of 1978, 12 U.S.C. §§ 3401-3422 (2000);
58. Fair Credit Reporting Act of 1970, 15 U.S.C. §§ 1681a-1681x; Wiretap Act, 18 U.S.C. §§ 2510-2522;
59. Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g.
60. PRIVACY PROTECTION STUDY COMM'N, PERSONAL PRIVACY IN AN INFORMATION SOCIETY 491 (1977).
61. Cal. Civ. Code §§ 1798.29, 1798.82 (West Supp. 2009);
62. see alsoPaul M. Schwartz&Edward J. Janger, Notification of Data Security Breaches,105 MICH. L. REV. 913, 915 (2007).
63. Nat'l Conference of State Legislatures, State Security Breach Notification Laws, http://www.ncsl.org/programs/lis/cip/priv/breachlaws.htm (last visited Feb. 9, 2009).
64. For the Connecticut bill, see H.B. 5765, Gen. Assem., Feb. Sess. (Conn. 2008). In New York, there have been bills introduced in the Senate and House. SeeAssem. B. 9275, 2007 Leg., 230th Sess. (N.Y. 2007); S. 6441, 2007 Leg., 230th Sess. (N.Y. 2007).
65. National Conference of State Legislatures, Financial Privacy, http://www.ncsl.org/ programs/lis/privacy/financeprivacy.htm (last visited Feb. 9, 2009).
66. Consumer Union, State Security Freeze Laws, http://www.consumersunion. org/ campaigns/learn-more/003484indiv.html (last visited Dec. 1, 2008). For an example of a state law requirement requiring the disclosure of transaction information to a victim of ID theft, see CAL. PENAL CODE § 530.8 (West Supp. 2009).
67. The applicable states are Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, and Vermont. COLO. REV. STAT. §§ 12-14.3-104 to -105 (2008);
68. Ga. Code. Ann. § 10-1- 393(29)(C) (2000);
69. Me. Rev. Stat. Ann. tit. 10, §§ 1315-1316 (1997&Supp. 2008); Md. Code Ann., Com. Law §§ 14-1206 to -1209 (LexisNexis 2005);
70. Mass. Ann. Laws ch. 93, §§ 58-59 (LexisNexis 2006&Supp. 2008);
71. N.J. STAT. ANN. §§ 56:11-34 to -37 (West 2001&Supp. 2008);
72. Vt. Stat. Ann. tit. 9, § 2480(b)-(c) (2006). Federal law permits these states to continue to determine how many free credit reports each year that their residents can receive. 15 U.S.C. § 1681t(b)(4) (Supp. v 2005). The result of these federal and state laws is that residents of these states each year can receive one free credit report under federal law and one free credit report under state law, or, in the case of the Georgia statute, two free reports.
73. MALCOLM M. FEELEy& EDWARD RUBIN, FEDERALISM: POLITICAL IDENTITY AND TRAGIC COMPROMISE 26 (2008).
74. New State ice Co. v. Liebmann, 285 U.S. 262, 311 (1932) (Brandeis, J., dissenting) ("it is one of the happy incidents of the federal system that a single courageous state may, if its citizens choose, serve as a laboratory; and try novel social and economic experiments without risk to the rest of the country.").
75. Schwartz&Janger, supranote 56, at 960-70.
76. Patricia L. Bellia, Federalization in Information Privacy Law,118 YALE L.J. 868 (2009).
77. Id.at 882.
78. For different critical perspectives, see CHRISTOPHER SLOBOGIN, PRIVACY AT RISK 181 (2007); Susan Freiwald, Uncertain Privacy: Communication Attributes After the Digital Telephony Act,69 S. CAL. L. REV. 949 (1996);
79. Paul M. Schwartz, Reviving Telecommunications Surveillance Law,75 U. CHI. L. REV. 287 (2008);
80. and Daniel J. Solove, Reconstructing Electronic Surveillance Law,72 GEO. WASH. L. REV. 1264, 1292-98 (2004). Although not a critic in general of federal surveillance law, Orin Kerr has expressed strong criticisms of one branch of this law, the Stored Communications Act. Orin S. Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It,72 GEO. WASH. L. REV. 1208, 1233-43 (2004).
81. As a single example, classic statutory assumptions in the Foreign intelligence Surveillance Act regarding the location of the subject of surveillance have been undercut by modern telecommunications surveillance. SeeOrin S. Kerr, Updating the Foreign Intelligence Surveillance Act,75 U. CHI. L. REV. 225 (2008).
82. Schwartz, supranote 67, at 287.
83. 18 U.S.C. § 2710 (2000).
84. Id.§ 2710(f).
85. SeeCal. Civ. Code § 1799.3 (Deering 2005);
86. Conn. Gen. Stat. § 53-450 (2007);
87. Del. Code Ann. tit. 11, § 925 (2008);
88. IOWA CODE § 727.11 (2003);
89. La. Rev. Stat. Ann. § 37:1748 (2007);
90. Md. Code Ann., Crim. Law § 3-907 (LexisNexis 2002);
91. Mass. Gen. Laws ch. 93, § 106 (2006);
92. Mich. Comp. Laws Ann. §§ 445.1711-.1715 (West 2002);
93. Minn. Stat. Ann. § 325I.02-.03 (West 2004);
94. N.H. REV. STAT. ANN. § 351-Aa (2008); N.Y. GEN. BUS. LAW §§ 670-675 (McKinney 1996);
95. R.I. GEN. LAWS § 11-18-32 (2002);
96. Tenn. Code Ann. §§ 47-18-2201 to -2205 (2002).
97. 18 U.S.C. § 2511(2).
98. SeePeople v. Conklin, 522 P.2d 1049, 1057 (Cal. 1974).
99. S. REP. No. 1097, at 98 (1968), reprinted in1968 U.S.C.C.A.N. 2112, 2187.
100. Reporters Committee for Freedom of the Press, Can We Tape?, http://www.rcfp.org/ taping/index.html (last visited Dec. 1, 2008).
101. 15 U.S.C. § 6807.
102. For an analysis, see Edward J. Janger&Paul M. Schwartz, The Gramm-Leach-Bliley Act, Information Privacy, and the Limits of Default Rules,86 MINN. L. REV. 1219, 1241-46, 1257-59 (2002).
103. 15 U.S.C. §§ 1681-1681x (Supp. V 2005).
104. Id.§§ 1681g(a), 1681j(a).
105. Id.§ 1681c(g). For these cases, see Grabein v. 1-800-Flowers.com, Inc., No. 07-22235-CIV, 2008 U.S. Dist. LEXIS 11757 (S.D. Fla. Jan. 29, 2008); Vasquez-Torres v. Stubhub, Inc., No. CV 07-1328, 2007 U.S. Dist. LEXIS 63719 (C.D. Cal. July 2, 2007).
106. 15 U.S.C. § 1681c(g)(1).
107. Id.§ 1681w(a)(1).
108. Id.§ 1681m(e). A Red Flag is a pattern, or activity that might indicate identity theft, and the law and applicable guidelines require covered companies that have consumer information to implement identity theft programs to respond to Red Flags. Id.
109. See, e.g., id.§§ 1681h(e), 1681t(b).
110. For example, FACTA reversed one aspect of California's Senate Bill 1 (S.B. 1), which required customers to be permitted to "opt-out," or indicate their refusal to information sharing before an organization could share such personal information with their affiliates. Id.§ 1681a(d)(1). For case law finding that FACTA's preemption voids some but not all of S.B. 1's affiliate sharing provisions, see American Bankers Ass'n v. Lockyer,541 F.3d 1214 (9th Cir. 2008).
111. 15 U.S.C. §§ 1681c-1,1681t(b)(5) (Supp. V 2005).
112. Microsoft White Paper, supranote 1, at 4.
113. CompareWatters v. Wachovia Bank, N.A., 127 S. Ct. 1559 (2007) (noting that under the National Bank Act, a national bank's mortgage business, including its operating subsidiaries in the states, is subject exclusively to regulation by the Federal Office of the Comptroller of the Currency), with id.at 1573 (Stevens, J., dissenting) (noting an "absence of relevant statutory authority" permitting "the laws of a sovereign State" to "yield to federal power" in the regulation of the business activities of mortgage brokers and lenders).
114. SeeReno v. Condon, 528 U.S. 141 (2000). in Reno,the Supreme Court held in a unanimous decision that Congress had power to regulate the conditions under which states and private parties could use, share, and sell drivers' motor vehicle registration information. Id.The Supreme Court has considerable leeway to decide that personal information itself is a subject of interstate commerce, and to find that even intrastate information markets can have an impact on interstate commerce. SeeGonzales v. Raich, 545 U.S. 1, 26 (2005).
115. ITHIEL DE SOLA POOL, TECHNOLOGIES OF FREEDOM 27 (1983).
116. 18 U.S.C. § 2710(a)(4) (2000).
117. 15 U.S.C. §§ 6501-6506. The two enforcement actions in question were settled in 2006 and 2008 respectively. United States v. Xanga.com, Inc., No. 06 Civ. 6853 (S.D.N.Y. filed Sept. 12, 2006), available athttp://www.ftc.gov/os/caselist/0623073/xangaconsentdecree -image.pdf; United States v. Industrious Kid, Inc., No. 08-0639 (N.D. Cal. filed Jan. 30, 2008), available athttp://www.ftc.gov/os/caselist/0723082/080730cons.pdf.
118. 15 U.S.C. § 6502(b)(1)(A).
119. See generallySOLOVE& SCHWARTZ, supranote 10, at 803 (describing FTC enforcement actions pursuant to COPPA).
120. There has been a dramatic increase in the marketing of food products, frequently unhealthy ones, to children on just such digital platforms. JEFF CHESTER& KATHRYN MONTGOMERY, INTERACTIVE FOOD& BEVERAGE MARKETING: TARGETING CHILDREN AND YOUTH IN THE DIGITAL AGE 13-18 (2007). At the same time, there also has been an increase in the ability of advertisers to track consumers on the internet and elsewhere and collect personal information about them. JEFF CHESTER, DIGITAL DESTINY 128-38 (2007).
121. CPNI consists of personal customer information relating to the "quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier." 47 U.S.C. § 222(h)(1)(A). As the D.C. Circuit explains, CPNI "encompasses customers' particular calling plans and special features, the pricing and terms of their contracts for those services, and details about who they call and when." Nat'l Cable&Telecomms. Ass'n v. FCC, No. 070312, 2009 WL 348811, at *1 (D.C. Cir. Feb. 13, 2009). The D.C. Circuit has upheld the FCC's requirement that carriers obtain opt-in consent from a customer before sharing personal information with a carrier's joint venture partner or independent contractor in order to market communication-related services to that customer. Id.at *7.
122. Microsoft White Paper, supranote 1, at 5.
123. Data Protection Directive, supranote 19, art. 25(1), at 46.
124. See supratext accompanying note 29.
125. WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA, OPINION 1/99 at 2 (1999), http://ec.europa.eu/justice-home/fsj/privacy/docs/wpdocs/1999/wp15en.pdf [hereinafter WORKING PARTY].
126. Data Protection Directive, supranote 19, art. 30, at 48.
127. WORKING PARTY, supranote 101, at 2.
128. SOLOVE& SCHWARTZ, supranote 10, at 1079-80.
129. As a specific example of this phenomenon, the European Commission in 2003 formally found Argentina to have adequate data protection. Its decision was influenced by Argentina's omnibus law. SeePress Release, European Union, Data Protection: Commission Recognises That Argentina Provides Adequate Protection for Personal Data (July 2, 2003), http://europa.eu/rapid/ pressReleasesAction.do?reference=IP/03/932.
130. Data Protection Directive, supranote 19, art. 28, at 47.
131. The EU Data Protection Supervisor was created in 2000. Regulation 45/2001, art. 41, 2001 O.J. (L 8/1) 1. For the home page of the European Data Protection Supervisor, see European Data Protection Supervisor, http://www.edps.europa.eu/EDPSWEB/edps/site/ mySite/pid/15 (last visited Feb. 9, 2009).
132. For a listing of these agencies, see European Commission, National Data Protection Commissioners, http://ec.europa.eu/justice-home/fsj/privacy/ nationalcomm/index-en.htm (last visited Feb. 9, 2009).
133. NEWMAN, supranote 6, at 155; seeSchwartz, supranote 19, at 494 (arguing that the lack of an information privacy agency in the United States "handicaps its participation" in important international debates).
134. Robert Gellman, A Better Way To Approach Privacy Policy in the United States: Establish a Non-Regulatory Privacy Protection Board,54 HASTINGS L.J. 1183, 1187 (2003).
135. See supratext accompanying note 95.
136. Cynthia L. Estlund, The Ossification of American Labor Law,102 COLUM. L. REV. 1527, 1574 (2002) (offering an especially perceptive account of the way that labor law preemption doctrine has come "untethered from its statutory moorings").
137. See generallyNewman, supranote 6, at 60 (discussing "several institutional veto points" in the federal legislative system, which makes it easy to block legislation).
138. Privacy in the Commercial World II: Hearing Before the Subcomm. on Commerce, Trade, and Consumer Protection of the H. Comm. on Energy and Commerce,109th Cong. 12-13 (2006) (statement of Meg Whitman, President and CEO, eBay Inc.) [hereinafter Whitman Statement at Commercial Privacy Hearing].
139. SeeRichard A. Epstein&Michael S. Greve, Introduction: Preemption in Context, inFEDERAL PREEMPTION: STATES' POWERS, NATIONAL INTERESTS 1, 1-5 (Richard A. Epstein&Michael S. Greve eds., 2007).
140. SeePac. Gas&Elec. Co. v. State Energy Res. Conservation&Dev. Comm'n, 461 U.S. 190, 212-13 (1983); Hines v. Davidowitz, 312 U.S. 52, 67-68 (1941).
141. Martha Derthick, Federalism, inUNDERSTANDING AMERICA: THE ANATOMY OF AN EXCEPTIONAL NATION 121, 140 (Peter H. Schuck&James Q. Wilson eds., 2008).
142. The general German terms for this area of regulation are Sozialordnung("social order"), or Sozialwesen(" social welfare"). For examples of the data protection issues in this area, see the recent report of the Berlin Data Protection Commissioner. BERLINER BEAUFTRAGTER, BERICHT DES BERLINER BEAUFTRAGTEN FUR DATENSCHUTZ UND INFORMATIONSFREIHEIT [REPORT OF THE BERLIN COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION] 123-56 (2007).
143. Spiros Simitis, Zweck und Andwendungsbereich des Gesetzes [Goal and Scope of the Statute], inNOMOS KOMMENTAR ZUM BUNDESDATENSCHUTZGESETZ [COMMENTARY ON THE FEDERAL PRIVACY LAW], supranote 17, at 156 (commenting on Section 1 of the BDSG).
144. Personal Information Protection and Electronic Documents Act, 2000 S.C., ch. 5 § 26(2)(b) (Can.); seeSTEPHANIE PERRIN ET AL., THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT: AN ANNOTATED GUIDE 119 (2001).
145. PRIVACY COMM'R OF CANADA, REPORT TO PARLIAMENT CONCERNING SUBSTANTIALLY SIMILAR PROVINCIAL LEGISLATION 2 (2002).
146. Id.
147. See infratext accompanying notes 135-136.
148. SeeBellia, supranote 65, at 875.
149. See supranote 112 and accompanying text.
150. SeeFEELEY&RUBIN, supranote 62.
151. Id.at 28.
152. Contra Costa County, Cal., Ordinance 2002-30 (Sept. 24, 2002); San Mateo County, Cal., Ordinance 04126 (Aug. 6, 2002).
153. For a selection of cases and a sense of the heavy influence of privacy torts as articulated in the Restatement (Second) of Torts,see SOLOVE&SCHWARTZ, supranote 10, at 30-140.
154. NAAG PRIVACY SUBCOMMITTEE REPORT: PRIVACY PRINCIPLES AND BACKGROUND, available athttp://web.archive.org/web/20041216174950/http://www.naag.org/naag/ resolutions/subrep ort.php (last visited Feb. 23, 2009).
155. For one illustration, contrast the quick reaction in vermont in 1992 to certain credit reporting mistakes in the state the year before, and the slower reaction in Washington, D.C., which ultimately led in 1996 to certain amendments to the Fair Credit Reporting Act. SeeMichael Epshteyn, Note, The Fair and Accurate Credit Transactions Act of 2003: Will Preemption of State Credit Reporting Laws Harm Consumers?,93 Geo. L.J. 1143, 1162-63 (2005).
156. SeeMichael W. McConnell, Federalism: Evaluating the Founders' Design,54 U. CHI. L. REV. 1484, 1498 (1987) (book review) ("Lower levels of government are more likely to depart from established consensus simply because they are smaller and more numerous.").
157. Id.
158. PERRIN ET AL, supranote 120, at 2-11.
159. See supratext accompanying note 120.
160. Personal Information Protection and Electronic Documents Act: Process for the Determination of "Substantially Similar" Provincial Legislation by the Governor in Council, C. Gaz., pt. I, at 3618-22 (Sept. 22, 2001) (Can.);
161. PRIVACY COMM'R OF CANADA, supranote 121, at 1-2.
162. BARBARA MCISAAC, RICK SHIELDS& KRIS KLEIN, THE LAW OF PRIVACY IN CANADA 4-27 (rev. ed. 2006);
163. STANDING COMM. ON ACCESS TO INFO., PRIVACY AND ETHICS, STATUTORY REVIEW OF PIPEDA 3 (2007) [hereinafter STANDING COMM. REPORT].
164. MCISSAC ET AL., supranote 137, at 4-27 to 4-28.
165. Personal Information Protection and Electronic Documents Act, 2000 S.C., ch. 5 § 29 (Can.).
166. STANDING COMM. REPORT, supranote 137.
167. Id.at 1.
168. Id.at 47-51.
169. Id.at 1.
170. Ann E. Carlson, Iterative Federalism and Climate Change,103 NW. U. L. REV. (forthcoming June 2009) (manuscript at 12, on file with author).
171. Jody Freeman&Daniel A. Farber, Modular Environmental Regulation,54 DUKE L.J. 795 (2005).
172. Bellia, supranote 65, at 881-86.
173. Judge Bork did not think that the Constitution contained a right to privacy. The confirmation hearings did not, however, turn on whether Congress had a right to legislate in this area. See Video and Library Privacy Protection Act of 1988: Joint Hearing on H.R. 4947 and S. 2361 Before the Subcomm. on Courts, Civil Liberties and the Administration of Justice of the H. Comm. on the Judiciary and the Subcomm. on Technology and the Law of the S. Comm. on the Judiciary,100th Cong. 133-34 (1988) (statement of Sen. Alan K. Simpson) [hereinafter Video Privacy Hearings]("As Judge Bork so articulately pointed out during his hearings, the Congress of the United States does have the power to legislate privacy rights if it wishes.");
174. id.at 67 (statement of Janlori Goldman, Staff Attorney, Am. Civil Liberties Union) ("[T]he majority of Senators who voted against his confirmation cited their concern about the Judge's limited view of the Constitutional right to privacy.").
175. Id.at 31 (statement of Sen. Patrick Leahy).
176. 18 U.S.C. § 2710(f) (2000).
177. For such a brief reference, see S. REP. No. 100-599, at 15 (1988), reprinted in1988 U.S.C.C.A.N. 4342-1, 4342-12.
178. See id.at 8, reprinted in1988 U.S.C.C.A.N. 4342-1, 4342-8 (noting that the Subcommittee "was unable to resolve questions regarding the application" of a provision on disclosure of "library borrower records"). For the discussion of the protection of library records at the hearing, see Video Privacy Hearings, supranote 147, at 34-53.
179. See Video Privacy Hearings, supranote 147, at 87-114 (statement of Richard A. Barton, Senior Vice President, Direct Mktg. Assoc.).
180. 18 U.S.C. § 2710(b)(2)(D)(i)-(ii);
181. seeS. Rep. No. 100-599, supranote 150, at 13-14.
182. See Video Privacy Hearings, supranote 147, at 88-89 (statement of Richard A. Barton, Senior Vice President, Direct Mktg. Assoc.).
183. Id.at 125.
184. Indeed, preemption was not even on the radar of the nation's then-largest video retailer, Erol's, which had some multi-state operations. A representative of Erol's testified before Congress strongly in favor of the Video Privacy Protection Act and did not raise the preemption issue. Id.at 76-86 (statement of Vans Stevenson, Dir. of Pub. Relations, Erol's,inc.).
185. SeeEpshteyn, supranote 131, at 1154-55 (describing the rise of identity theft after the enactment of the original Fair Credit Reporting Act); Gail Hillebrand, After the FACTA: State Power To Prevent Identity Theft,17 LOY. CONSUMER L. REV. 53, 56-57 (2004) (discussing the use of "risk-based" pricing to determine the "nuances and gradations in price and terms" of consumer credit).
186. 15 U.S.C. § 1681c-1(a) (Supp. V 2005).
187. Id.§ 1681c-1(e).
188. See supratext accompanying note 84.
189. 15 U.S.C. § 1681c(g).
190. Id.§ 1681m(h).
191. Id.§§ 168rj(a), 1681g(a);
192. seeHillebrand, supranote 157, at 65-66.
193. Lynn A. Baker&Ernest A. Young, Federalism and the Double Standard of Judicial Review,51 DUKE L.J. 75, 151-52 (2001).
194. Even though Baker and Young favor state lawmaking, they also concede that "increased diversity [in legislation] among the states is not always a good thing." Id.at 155.
195. E. Donald Elliott, Bruce A. Ackerman&John C. Millian, Toward a Theory of Statutory Evolution: The Federalization of Environmental Law,1 J.L. ECON.&Org. 313 (1985).
196. J.R. DeShazo&Jody Freeman, Timing and Form of Federal Regulation: The Case of Climate Change,155 U. PA. L. REV. 1499, 1500 (2007).
197. See id.at 1530.
198. California Office of Information Security and Privacy Protection, 2008 Privacy Legislation Enacted, http://www.oispp.ca.gov/consumer-privacy/privacy- leg/leg.asp (last visited Dec. 1, 2008).
199. Id.
200. Adam Clymer, North Dakota Tightens Law on Bank Data and Privacy,N.Y. TIMES, June 13, 2002, at A28; Jennifer 8. Lee, California Law Provides More Financial Privacy,N.Y. TIMES, Aug. 28, 2008, at A24.
201. REGAN, supranote 40, at 202-09.
202. COLIN J. BENNETT, THE PRIVACY ADVOCATES 59 (2008).
203. Id.
204. Id.
205. ZYGMUNT J.B. PLATER ET AL., ENVIRONMENTAL LAW&POLICY 296 (3d ed. 2004).
206. See, e.g.,Kirsten H. Engel, State Environmental Standard-Setting: Is There a "Race" and Is It "to the Bottom"?,48 HASTINGS L.J. 271 (1997); Richard L. Revesz, The Race to the Bottom and Federal Environmental Regulation: A Response to Critics,82 MINN. L. REV. 535 (1997);
207. Richard L. Revesz, Rehabilitating Interstate Competition: Rethinking the "Race-to-the-Bottom" Rationale for Federal Environmental Regulation,67 N.Y.U. L. REV. 1210, 1211-12 (1992).
208. Mass. Gen. Laws ch. 93H, § 3 (2007).
209. Compare id.("The notice to be provided to the resident shall not include the nature of the breach or unauthorized acquisition or use or the number of residents of the commonwealth affected by said breach or unauthorized access or use."), withN.Y. GEN. BUS. LAW § 899-aa) (McKinney 2005) ("[N]otice shall include... a description of the categories of information that were, or are reasonably believed to have been, acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so acquired.").
210. See, e.g.,Schwartz&Janger, supranote 56, at 942-43.
211. For a table with a detailed comparison of different state security breach notification laws, see id.at 972-84.
212. 15 U.S.C. § 1681a(d) (2000&Supp. V 2005).
213. See supratext accompanying note 121.
214. Personal Information Protection and Electronic Documents Act: Process for the Determination of "Substantially Similar" Provincial Legislation by the Governor in Council, C. Gaz., pt. I, at 3621-22 (Sept. 22, 2001) (Can.).
215. William W. Buzbee, Asymmetrical Regulation: Risk, Preemption, and the Floor/Ceiling Distinction,82 N.Y.U. L. REV. 1547, 1602 (2007).
216. 15 U.S.C. § 1681t.
217. Id.§ 1681c-1. The preemption narrowed to "the conduct required" is codified at 15 U.S.C. § 1681t(b)(5).
218. Roderick M. Hills, Jr., Against Preemption: How Federalism Can Improve the National Legislative Process: Cyberspace Filters, Privacy Controls, and Fair Information Practices,82 N.Y.U. L. REV. 1, 4 (2007).
219. SeeSchwartz, Lessig's Code, supranote 15, 781-86.
220. A range of other issues also arise in any division and sharing of power, including the question of choice of judicial fora for hearing claims.
221. Whitman Statement at Commercial Privacy Hearing, supranote 114, at 13, 37.
222. 15 U.S.C. § 45(a)(1). For a discussion of the FTC's enforcement powers under its enabling act and its use in the context of children's online privacy, see SOLOVE&SCHWARTZ, supranote 10, at 777-82, 803.
223. Regarding this trend in areas other than information privacy law, see Buzbee, supranote 185, at 1552-55.
224. 42 U.S.C. §§ 7507, 7543(e).
225. Carlson, supranote 144 (manuscript at 1).
226. U.S.C. § 1681t(b)(1)(F).
227. EVAN HENDRICKS, CREDIT SCORES& CREDIT REPORTS 307-08 (2d ed. 2005). For a skeptical view of the industry's assessment of the cost of letting the preemption of these provisions lapse, noting the historic absence of a single nationwide market for credit reporting, see Epshteyn, supranote 131, at 1161.