Federalization in information privacy law

Yale Law Journal

Volumn 118, Issue 5, 2009, Pages 868-900

  Bellia, Patricia L ^a,b  

^a Department of Law ^*

^b NOTRE DAME LAW SCHOOL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 66849143359     PISSN: 00440094     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (266)

1. See, e.g., Ross Kerber, Court Filing in TJX Breach Doubles Toll, BOSTON GLOBE, Oct. 24, 2007, at A1 (noting discrepancy between TpTs estimate that 45.7 million accounts were affected and banks' estimate that 94 million accounts were affected).
2. See, e.g., 153 CONG. REC. S1628 (daily ed. Feb. 6, 2007) (statement of Sen. Leahy). The various bills include the following: Privacy and Cybercrime Enforcement Act of 2007, H.R. 4175, 110th Cong. (2007);
3. Social Security Account Number Protection Act, S. 1208, 110th Cong. (2007);
4. Personal Data Protection Act of 2007, S. 1202, 110th Cong. (2007);
5. Identity Theft Prevention Act, S. 1178, 110th Cong. (2007);
6. Data Security Act of 2007, H.R. 1685, 110th Cong. (2007);
7. Data Accountability and Trust Act, H.R. 958, 110th Cong. (2007);
8. Personal Data Privacy and Security Act of 2007, S. 495, 110th Cong. (2007);
9. and Notification of Risk to Personal Data Act of 2007, S. 239, 110th Cong. (2007).
10. Paul M. Schwartz, Preemption and Privacy, 118 YALE L.J. 902 (2009).
11. Id. at 940.
12. Id. at 928.
13. Id. at 930.
14. Id. at 904 (noting that companies have advocated creation of "a single federal law for the private sector that would impose uniform standards");
15. id. at 930 (expressing concern about a law that would "block new approaches to information privacy in federal and state sectoral laws").
16. Id. at 916.
17. See id. at 930 (noting the benefits of experimentation).
18. Id. at 904.
19. See, e.g., Richard A. Epstein & Thomas P. Brown, Cybersecurity in the Payment Card Industry, 75 U. CHI. L. REV. 203 (2008) (arguing that regulators should not preempt efforts of private actors to distribute losses arising from payment card fraud).
20. See, e.g., Paul M. Schwartz & Edward J. Janger, Notification of Data Security Breaches, 105 MICH. L. REV. 913, 927-28 (2007) (noting that companies may not take adequate data security precautions because they fail to fully bear the costs of data breaches or precisely calibrate the costs and benefits of investing in data security).
21. See infra notes 101-104 and accompanying text.
22. Schwartz, supra note 3, at 928 (noting that "the case for and against a federal omnibus law proves close").
23. Id. at 930.
24. Id. at 913, 928.
25. Id. at 913.
26. Id. at 928.
27. See infra notes 79-80 and accompanying text.
28. Schwartz, supra note 3, at 923-24.
29. 18 U.S.C. § 2710 (2000).
30. 47 U.S.C. § 551(c) (2000 & Supp. V 2005) (prohibiting cable operators from disclosing "personally identifiable information concerning any subscriber," subject to certain exceptions).
31. See Viacom Int'l Inc. v. YouTube, Inc., No. 07-CV-2103, 2008 WL 2627388, at*5 (S.D.N.Y. July 2, 2008). In this case, Viacom sought to compel YouTube and its parent corporation, Google, to disclose information about the YouTube service, including information from YouTube's "logging" database. That database contained information on how often particular videos were viewed, as well as the unique login IDs of the users who watched them and the Internet protocol (IP) addresses of the users' computers. YouTube and Google claimed that the VPPA barred them from disclosing the information, but the court dismissed the VPPA's applicability. The court may have misread the statute to cover only video tapes.
32. See id. at*5 n.5. The court also characterized the privacy claims as "speculative," in part because the login IDs are pseudonymous and IP addresses, without more information, cannot identify specific users.
33. Id. at*5. The parties later reached an agreement allowing YouTube to mask user information with anonymous but unique codes before disclosing the relevant records to Viacom.
34. See Viacom Int'l Inc. v. YouTube, Inc., No. 07- CV-2103 (S.D.N.Y. July 17, 2008) (stipulation regarding July 1, 2008 opinion and order).
35. Compare, e.g., 18 U.S.C.A. § 2516(1) (2000 & West Supp. 2008) (enumerating specific federal felonies and requiring approval of high-level Justice Department officials for authorization of order intercepting wire communications), with 18 U.S.C. § 2516(3) (2000) (omitting such requirements for authorization of an order intercepting electronic communications).
36. Additionally, see 18 U.S.C. §§ 2515, 2518(10) (2000), which bar the use in evidence of wire communications, but not electronic communications, obtained in violation of the Wiretap Act or an order issued under it.
37. For further discussion, see Patricia L. Bellia, Surveillance Law Through Cyberlaw's Lens, 72 GEO. WASH. L. REV. 1375, 1392-93 (2004).
38. For example, for government officials to acquire electronic communications in transit in connection with a criminal investigation, they must satisfy the Wiretap Act's stringent requirements. See 18 U.S.C. § 2518. They can compel the production of electronic communications from a third-party service provider on a lesser showing.
39. See 18 U.S.C. § 2703 (2000 & Supp. V 2005).
40. For discussion of these different requirements, see Patricia L. Bellia, The Memory Gap in Surveillance Law, 75 U. CHI. L. REV. 137, 153-59 (2007).
41. For an argument that the acquisition of stored communications should be subject to stringent requirements akin to those in the Wiretap Act, see Susan Freiwald, First Principles of Communications Privacy, 2007 STAN. TECH. L. REV. 3, http://stlr.stanford.edu/pdf/freiwald- first-principles.pdf.
42. See, e.g., Patricia L. Bellia, Institutional Design in Communications Surveillance Law (Oct. 1, 2008) (unpublished manuscript, on file with author).
43. 18 U.S.C. § 2518(10)(a) (2000).
44. See id. § 2708 (providing that "[t]he remedies and sanctions described in this chapter," which do not include a suppression remedy, "are the only judicial remedies and sanctions for nonconstitutional violations of this chapter");
45. see also Orin S. Kerr, Lifting the "Fog" of Internet Surveillance: How a Suppression Remedy Would Change Computer Crime Law, 54 HASTINGS L.J. 805 (2003).
46. See infra notes 89-91 and accompanying text.
47. 388 U.S. 41 (1967).
48. 389 U.S. 347 (1967).
49. A few caveats are appropriate. First, I do not claim that all federal and state privacy regulation fits within the three patterns I identify. The patterns I identify are simply useful to illustrate the interplay between state and federal law. Second, I do not contend that we can or should view all portions of any given federal statute as illustrating a single pathway to federalization. Different segments of the same statute may reflect different responses to state law. Third, in categorizing privacy statutes, I seek to describe the effect of congressional action rather than what motivates it. That is, my argument is not intended to demonstrate that we can attribute to Congress as a whole, or to any particular legislator, the motivation to follow a particular privacy path. I do use standard tools of statutory interpretation (including some forms of legislative history) to discern the meaning of particular statutes, but I make no specific claims about congressional motivation.
50. Schwartz, supra note 3, at 917.
51. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193 (1890).
52. See Restatement (Second) of Torts §§ 652B-E (1977);
53. William L. Prosser, Privacy, 48 CAL. L. REV. 383, 389 (1960).
54. See, e.g., Gonzales v. Raich, 545 U.S. 1, 22 (2005) (framing the relevant inquiry as whether Congress has a "rational basis" for concluding that the regulated activities, taken in the aggregate, affect interstate commerce). In many cases, Congress has explicitly linked the scope of particular privacy statutes to interstate commerce.
55. See, e.g., 18 U.S.C. § 2510(1) (2000) (defining "wire communication");
56. id. § 2510(12) (defining "electronic communication");
57. id. § 2710(a)(4) (defining "video tape service provider");
58. U.S.C. § 2000aa(a) (regulating officials' seizure of work product materials held by one who intends to disseminate a publication "in or affecting interstate or foreign commerce"). Even where it does not, Congress can conclude that personal data is itself a subject of interstate commerce.
59. See Reno v. Condon, 528 U.S. 141, 148 (2000) (accepting the claim that "the personal, identifying information that the [Driver's Privacy Protection Act] regulates is a thing in interstate commerce, and that the sale or release of that information in interstate commerce is therefore a proper subject of congressional regulation" (internal quotation marks omitted)). For an unusually candid acknowledgment of the limits of Congress's power to protect privacy using its Commerce Clause powers.
60. see S. REP. NO. 90-1097, at 92 (1968), reprinted in 1968 U.S.C.C.A.N. 2112, 2180, which noted that "the extent of the constitutional power of Congress to prohibit [the interception of oral communications] is less clear than in the case of interception of wire communications."
61. Omnibus Crime Control and Safe Streets Act of 1968, Pub. L. No. 90-351, tit. III, 82 Stat. 197, 211 (codified as amended at 18 U.S.C.A §§ 2510-2522 (West 2000 & Supp. 2008)).
62. 389 U.S. 347 (1967).
63. 388 U.S. 41 (1967).
64. See 18 U.S.C. § 2518 (2000). The Foreign Intelligence Surveillance Act of 1978 (FISA), Pub. L. No. 95-511 (codified as amended at 50 U.S.C.A. §§ 1801-1811 (West 2003 & Supp. 2008)), provides a second example of Congress's attempt to translate the Supreme Court's reasoning into an information privacy statute. In 1972, in United States v. U.S. District Court, 407 U.S. 297 (1972), the Supreme Court held that the Fourth Amendment barred government agents from conducting warrantless electronic surveillance to safeguard national security, at least when the target was a domestic group lacking any connection to a foreign power.
65. Id. at 320. Although the Court found the agents' conduct unconstitutional, the Court acknowledged that Congress could tailor specific statutory requirements to the peculiarities of national security surveillance without violating the Fourth Amendment.
66. Id. at 322-24. Congress never took up the Supreme Court's invitation to create distinct standards for national security surveillance of domestic targets, but it adopted in FISA a special framework for surveillance of foreign powers or agents of foreign powers.
67. 425 U.S. 435 (1976).
68. 12 U.S.C. § 3402.
69. 436 U.S. 547 (1978).
70. 42 U.S.C. § 2000aa.
71. Id.
72. 442 U.S. 735 (1979).
73. Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, §§ 301-302, 100 Stat. 1848, 1868-72 (codified as amended at 18 U.S.C. §§ 3121-3127 (2000 & Supp. V 2005)).
74. There is, of course, much more to some of these statutes: in both the Wiretap Act and the pen register and trap and trace statute, Congress also regulated private parties' access to the information in question. See, e.g., 18 U.S.C. § 2511(1) (2000); 18 U.S.C. § 3121 (2000 & Supp. V 2005). The portions of the statutes restricting official conduct, however, essentially implement or substitute for constitutional requirements.
75. See, e.g., ARIZ. REV. STAT. ANN. 13-3001, -3005 to -3012 (2001 & Supp. 2008);
76. DEL. CODE ANN. tit. 11, 2401-2412 (2007);
77. D.C. CODE ANN. 23-541 to -556 (LexisNexis 2001 & Supp. 2008);
78. FLA. STAT. ANN. 934.02-.10 (West 2006);
79. HAW. REV. STAT. ANN. 803-41 to -49 (LexisNexis 2007);
80. IDAHO CODE ANN. 18-6701 to -6709 (2004);
81. IOWA CODE ANN. 808B.1-.8 (West 2003);
82. KAN. STAT. ANN. 22-2514 to -2518 (2007);
83. LA. REV. STAT. ANN. 15:1301-:1312.1 (West 2005 & Supp. 2008);
84. MD. CODE ANN., CTS. & JUD. PROC. 10-401 to -411 (LexisNexis 2006);
85. MASS. ANN. LAWS ch. 272, § 99 (LexisNexis 2000 & Supp. 2008);
86. MINN. STAT. ANN. 626A.01-.20 (West 2003 & Supp. 2009);
87. MISS. CODE ANN. 41-29-501 to -536 (2005);
88. MO. ANN. STAT. 542.400-.422 (West 2002 & Supp. 2008);
89. NEB. REV. STAT. 86-271 to -295 (2008);
90. NEV. REV. STAT. ANN. 179.410-.515, 200.610-.690 (LexisNexis 2006);
91. N.H. REV. STAT. ANN. 570-Aa to :11 (LexisNexis 2003 & Supp. 2008);
92. N.J. STAT. ANN. 2A:156A-1 to -26 (West 1985 & Supp. 2008);
93. N.D. CENT. CODE 12.1-15-02 to -04 (1997);
94. OHIO REV. CODE ANN. 2933.51-.66 (LexisNexis 2006);
95. OKLA. STAT. ANN. tit. 13, 176.1-.14 (West 2002 & Supp. 2008);
96. OR. REV. STAT. 133.721-.739 (2007);
97. PA. CONS. STAT. 5701-5728 (2000 & Supp. 2008);
98. R.I. GEN. LAWS 12-5.1-1 to -16 (2002);
99. S.C. CODE ANN. §§ 17-30-15 to -145 (Supp. 2007);
100. TENN. CODE ANN. 39-13-601 to -603, 40-6-301 to -310 (2003);
101. TEX. PENAL CODE ANN. § 16.02 (Vernon Supp. 2008);
102. TEX. CODE CRIM. PROC. ANN. art. 18.20 (Vernon Supp. 2008);
103. UTAH CODE ANN. §§ 77-23a-1 to -11 (2008);
104. VA. CODE ANN. §§ 19.2-61 to -70 (2008);
105. W. VA. CODE §§ 62-1D-2 to -16 (2005 & Supp. 2008);
106. WIS. STAT. ANN. §§ 968.27-.33(West 2007);
107. WYO. STAT. ANN. §§ 7-3-701 to -712 (2007).
108. See, e.g., ARIZ. REV. STAT. ANN. § 13-3017;
109. DEL. CODE ANN. tit. 11, §§ 2430-2434;
110. FLA. STAT. ANN. §§ 934.31-.34;
111. HAW. REV. STAT. ANN. §§ 803-44.5 to -44.6;
112. IDAHO CODE ANN. §§ 18-6720 to -6722;
113. IOWA CODE ANN. §§ 808B.10-.12;
114. KAN. STAT. ANN. §§ 22-2525 to -2527;
115. LA. REV. STAT. ANN. §§ 15:1313-11316;
116. MD. CODE ANN., CTS. & JUD. PROC. §§ 10-401 to -05;
117. MINN. STAT. ANN. §§ 626A.35-.37;
118. MONT. CODE ANN. §§ 46-4-402 to -403 (2007);
119. NEB. REV. STAT. §§ 86-298 to -2100 (2008);
120. N.H. REV. STAT. ANN. §§ 570-B:2 to :5;
121. N.Y. CRIM. PROC. LAW §§ 705.00-.35 (McKinney 2008);
122. N.D. CENT. CODE §§ 29-29.3-02 to -05 (1997);
123. OHIO REV. CODE ANN. §§ 2933.76-.77;
124. OKLA. STAT. ANN. tit. 13, §§ 177.1-.5;
125. R.I. GEN. LAWS §§ 12-5.2-1 to -5;
126. S.C. CODE ANN. §§ 17-29-10 to -50 (2003);
127. S.D. CODIFIED LAWS §§ 23A- 35A-22 to -30 (2004);
128. UTAH CODE ANN. §§ 77-23a-13 to -15;
129. VA. CODE ANN. §§ 19.2-70.1 to - 70.2;
130. W. VA. CODE § 62-1D-10;
131. WYO. STAT. ANN. §§ 7-3-801 to -806.
132. For examples of the various approaches taken in the state wiretapping and eavesdropping statutes, see FLA. STAT. ANN. § 934.07;
133. HAW. REV. STAT. ANN. § 803-44;
134. IOWA CODE ANN. § 808B.3;
135. KAN. STAT. ANN. § 22-2515;
136. LA. REV. STAT. ANN. § 15:1308;
137. MD. CODE ANN., CTS. & Jud. Proc. § 10-406;
138. MINN. STAT. ANN. § 626A.05;
139. OKLA. STAT. ANN. tit. 13, § 176.7;
140. OR. REV. STAT. § 133.724;
141. PA. CONS. STAT. § 5708;
142. S.C. CODE ANN. § 17-30-70;
143. UTAH CODE ANN. § 77-23a-8;
144. VA. CODE ANN. § 19.2-66;
145. W. VA. CODE § 62-1D-8 (2005);
146. WIS. STAT. ANN. § 968.28;
147. and WYO. STAT. ANN. § 7-3-705.
148. But see the California Constitution, which does contain an explicit right of privacy. CAL. CONST. art. 1, § 1.
149. See Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, § 101, 100 Stat. 1848, 1848-53.
150. See id. § 201, 100 Stat. at 1860, 1860-73.
151. See, e.g., S. REP. NO. 99-541, at 5 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3559;
152. H.R. REP. NO. 99-647, at 18-19 (1986).
153. Congress passed the initial federal anti-hacking statute in 1984. See Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub. L. No. 98-473, 98 Stat. 2190. As initially enacted, the statute protected only a narrow range of computers. Id. § 2102, 98 Stat. at 2190-91 (covering computers containing national security information, computers containing financial data, and computers operated by or on behalf of the government).
154. Congress considered a major amendment to the federal anti-hacking statute at the same time that it considered ECPA, and the relationship between the statutes was a subject of concern in the hearings on ECPA. Electronic Communication Privacy: Hearing on S. 1667 Before the Subcomm. on Patents, Copyrights and Trademarks of the S. Comm. on the Judiciary, 99th Cong. 94-95 (1987) [hereinafter Senate ECPA Hearing]; Electronic Communications Privacy Act: Hearings on H.R. 3378 Before the Subcomm. on Courts, Civil Liberties, and the Administration of Justice of the H. Comm. on the Judiciary, 99th Cong. 22-23, 90 (1986). ECPA evolved to protect communications in connection with the transmission process rather than general hacking activities. See, e.g., Senate ECPA Hearing, supra, app. 156 & n.*(summarizing changes between versions of ECPA and indicating that ECPA was intended to cover storage of communications in connection with the communications process, so as to eliminate overlap with hacking statutes).
155. Gramm-Leach-Bliley Act, Pub. L. No. 106-102, tit. V, 113 Stat. 1338 (1999) (codified as amended at 15 U.S.C. §§ 6801-09 (2000 & Supp. v 2005)).
156. Video Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195 (codified at 18 U.S.C. § 2710).
157. S. REP. NO. 100-599, at 5 (1988) (noting that a Washington newspaper published a profile of Judge Bork based on the titles of the 146 movies his family rented from a local video store).
158. Driver's Privacy Protection Act of 1994, Pub. L. No. 103-322, § 300,001, 108 Stat. 1796, 2099 (codified as amended at 18 U.S.C. § 2721).
159. See, e.g., 140 CONG. REC. 7924 (1994) (statement of Rep. Moran);
160. CONG. REC. 29,466 (1993) (statement of Sen. Boxer).
161. See, e.g., DEL. CODE ANN. tit. 11, §§ 2421-2427 (2007);
162. FLA. STAT. ANN. § 934.21 (West 2006);
163. HAW. REV. STAT. ANN. §§ 803-47.5 to -47.8 (LexisNexis 2007);
164. MD. CODE ANN., CTS. & JUD. PROC. §§ 10-4A-01 to -08 (LexisNexis 2007);
165. MINN. STAT. ANN. §§ 626A.26-.34 (West 2003);
166. N.J. STAT. ANN. §§ 2A:156A-27 to -34 (West 1985 & Supp. 2008);
167. TEX. PENAL CODE ANN. § 16.04 (Vernon 2003).
168. For statutes tracking the structure of the VPPA, see MINN. STAT. ANN. §§ 325I.01-325I.03 (West 2004);
169. N.Y. GEN. BUS. LAW §§ 671-675 (McKinney 1996);
170. and TENN. CODE ANN. §§ 47-18-2201 to -2205 (2001).
171. See also MASS. GEN. LAWS ANN. ch. 93, § 106 (West 2006) (tying lawfulness of release of certain information to categories in the Federal VPPA). A handful of states considered video rental privacy bills at the same time as Congress and enacted those measures slightly before Congress did. See Act To Add Section 1799.3 to the Civil Code, Relative to Business Records, Sept. 20, 1988, ch. 1050, 1988 Cal. Stat. 3405 (codified at CAL. CIV. CODE ANN. § 1799.3 (West 1998));
172. Act Concerning Video Tape Distributors, May 27, 1988, ch. 631, 1988 Md. Laws 4221 (codified at Md. CODE ANN., CRIM. LAW § 3-907 (LexisNexis 2002));
173. Act Relating to Criminal Offenses -Unlawful Dissemination of Records, May 27, 1988, ch. 94, 1988 R.I. Pub. Laws 255 (codified at R.I. GEN. LAWS § 11-18-32 (2002)).
174. For statutes tracking the structure of the DPPA (albeit with some important differences in coverage discussed below), see ALASKA STAT. § 28.10.505 (2008);
175. ARIZ. REV. STAT. ANN. § 28-455 (Supp. 2008);
176. CONN. GEN. STAT. ANN. § 14.10 (West Supp. 2008);
177. DEL. CODE ANN. tit. 21, § 305 (2005);
178. FLA. STAT. ANN. § 119.0712(2) (West 2008);
179. IND. CODE ANN. § 9-14-3.5-1 to -15 (LexisNexis 2004 & Supp. 2008);
180. MD. CODE ANN., STATE. GOV'T § 10-616(p) (LexisNexis Supp. 2008);
181. MO. ANN. STAT. § 32.091 (West Supp. 2009);
182. MONT. CODE ANN. §§ 61-11-501 to -516 (2007);
183. NEB. REV. STAT. § 60-2901 to -2912 (2004);
184. N.H. REV. STAT. ANN. § 260:14 (LexisNexis Supp. 2008);
185. N.J. STAT. ANN. §§ 39:2-3.3 to -3.7 (West 2002 & Supp. 2008);
186. N.C. GEN. STAT. § 20-43.1 (2007);
187. N.D. CENT. CODE § 39-33-01 to -10 (2008);
188. OHIO REV. CODE ANN. § 4501.27 (LexisNexis 2008);
189. OKLA. STAT. ANN. tit. 4, § 1109 (West 2003);
190. OR. REV. STAT. §§ 802.175-.191 (2007);
191. R.I. GEN. LAWS § 27-49-3.1 (2008);
192. S.D. CODIFIED LAWS § 32-5-143 to -151 (2004);
193. TENN. CODE ANN. §§ 55-15-107 to -25-102 (2004 & Supp. 2007);
194. and TEX. TRANSP. CODE ANN. §§ 730.001-.016 (Vernon 1999 & Supp. 2008).
195. See, e.g., CAL. FIN. CODE §§ 4050-4060 (West 1999 & Supp. 2009).
196. 18 U.S.C. § 2721(b) (2000).
197. Id. § 2721(b)(8).
198. See ALASKA STAT. § 28.10.505(d)(2);
199. CONN. GEN. STAT. § 14.10(f)(2);
200. N.J. STAT. ANN. § 39=2-3.4(c)(3).
201. Compare, e.g., 18 U.S.C. § 2721(b)(n), (12), with N.C. GEN. STAT. § 20-43.1(b) (disallowing disclosures permitted by § 2721(b)(u)), and MONT. CODE ANN. § 61-11-509 (omitting authority to disclose information for bulk distribution), and N.J. STAT. ANN. § 39:2- 3.4(c)(11) (limiting disclosures for marketing).
202. TENN. CODE ANN. § 47-18-2204(b)(1)(B), (C) (2001).
203. Compare 18 U.S.C. § 2710(b)(2), with N.Y. GEN. BUS. LAW § 673 (McKinney 1996 & Supp. 2009).
204. Pub. L. No. 108-187, 117 Stat. 2699 (codified at 15 U.S.C. §§ 7701-7713 (Supp. V 2005)). Although the CAN-SPAM Act is not centrally concerned with the collection, storage, and use of personal information, some commentators treat it as a "privacy" statute because receiving spam is in some sense itself an invasion of privacy or because the statute embodies the fair information practice strategy of allowing consumers to opt out in some circumstances.
205. For a summary of state legislation, see SpamLaws.com, State Laws, http://spamlaws.com/ state/index.shtml (last visited Feb. 10, 2009).
206. See 15 U.S.C. § 7704.
207. Id. § 7707(b)(1).
208. See CAL. CIV. CODE § 1798.29 (West 1998 & Supp. 2009).
209. See National Conference of State Legislatures, State Security Breach Notification Laws, http://www.ncsl.org/programs/lis/cip/priv/breachlaws. htm (last visited Dec. 16, 2008).
210. The FTC has privacy enforcement authority under a number of specific statutes, including protections concerning financial privacy, see 15 U.S.C. § 6805 (2000) (granting the FTC authority to enforce Gramm-Leach-Bliley Act requirements as to financial institutions not subject to the jurisdiction of other federal agencies or state insurance authorities), the privacy of credit information.
211. see 15 U.S.C. § 1681s (2000 & Supp. V 2005), and the privacy of personally identifiable information relating to children.
212. see 15 U.S.C. §§ 6501-6502 (2000). In other cases, however, the FTC has taken an increasingly broad view of its role under section 5 of the Federal Trade Commission Act, which empowers the FTC to investigate "unfair or deceptive acts or practices in or affecting commerce." 15 U.S.C.A. § 45 (West 1997 & Supp. 2008). Beginning in the late 1990s, the FTC filed complaints against various companies' privacy practices on the ground that the companies had violated their own privacy policies- for example, by breaching promises not to share personally identifiable information with third parties.
213. see, e.g., Complaint, FTC v. Toysmart.com LLC, No. 00-11341-RGS, 2003 WL 34016434 (D. Mass. July 21, 2000), available at http://www.ftc.gov/os/2000/07/toysmartcomplaint.htm, or by breaching promises to safeguard customers' information.
214. see, e.g., Complaint at 3, In re Eli Lilly & Co., No. C-4047, 2001 WL 1712505 (Fed. Trade Comm'n May 8, 2002), available at http://www.ftc.gov/os/2002/05/elilillycmp.htm (claiming that Eli Lilly and Co. had represented "that it employs measures and takes steps . . . to maintain and protect the privacy and confidentiality of personal information" but that in fact such representations are false and misleading). The FTC treated breaches of privacy policies as unfair and deceptive trade practices under section 5 of the FTCA More recently, however, the FTC has interpreted section 5 as directly obligating companies to safeguard such information, whether or not the company's privacy policy promises that the company will do so. In a complaint involving the TJx data security breach, for example, the FTC claimed that TJX's failure to employ "reasonable and appropriate security measures to protect personal information caused or is likely to cause substantial injury to consumers that is not offset by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers" - the FTC interpretation of unfairness that Congress codified in 1994.
215. See Complaint at 3, In re The TJX Cos., Inc., No. 072-3055, 2008 WL 903808 (Fed. Trade Comm'n Mar. 27, 2008), available at http://www.ftc.gov/os/caselist/0723055/080327complaint.pdf. Compare id., with Federal Trade Commission Act Amendments of 1994, § 9, Pub. L. No. 103-312, 108 Stat. 1691, 1695 (codified at 15 U.S.C. § 45(n) (2000)). The FTC did not allege that TJX violated its own policies or that it violated any specific FTC rules; rather, the FTC apparently viewed the failure to protect data as an unfair trade practice in and of itself.
216. The FTC's role in enforcing privacy policies is controversial, and many commentators have argued that the FTC has been and will continue to be ineffective as a privacy regulator. See, e.g., Joel R Reidenberg, Privacy Wrongs in Search of Remedies, 54 HASTINGS L.J. 877 (2003);
217. Paul M. Schwartz, Privacy and Democracy in Cyberspace, 52 VAND. L. REV. 1609, 1637-39 (1999). When the FTC first began investigating privacy practices in the late 1990s, some states acted more aggressively under "little FTC Acts" (that is, state statutes paralleling the FTCA). For example, the FTC closed an investigation of Doubleclick without charges.
218. see Letter from Joel Winston, Acting Assoc. Dir., Div. of Fin. Practices, Bureau of Consumer Prot., Federal Trade Comm'n, to Christine Varney, Counsel for DoubleClick Inc. (Jan. 22, 2001), http://www.ftc.gov/os/closings/ staff/doubleclick.pdf, whereas a coalition of state attorneys general prompted DoubleClick to change its privacy policies.
219. see In re DoubleClick: Agreement Between the Attorneys General of the States of Arizona, California, Connecticut, Massachusetts, Michigan, New Jersey, New Mexico, New York, Vermont, and Washington and DoubleClick Inc. (Aug. 26, 2002), http://www.oag.state.ny.us/ media-center/2002/aug/aug26a-02-attach. pdf; Press Release, N.Y. State Att'y Gen., Major Online Advertiser Agrees to Privacy Standards for Online Tracking (Aug. 26, 2002), http://www.oag.state.ny. us/media-center/2002/aug/aug26a-02.html. Despite the fact that state attorneys general have aggressively targeted companies' privacy practices in the past, there is little evidence that states are interpreting their own laws governing unfair and deceptive practices to cover inadequate security standards. Accordingly, one could argue that the FTC's approach does reflect a concerted shift in federal policy. on the other hand, the FTC may be acting in anticipation of aggressive state approaches.
220. Schwartz, supra note 3, at 938 ("one cannot be confident in a given policy result reached by reliance on a federal as opposed to state regulatory process, or vice versa.").
221. For examples of this approach in environmental law scholarship, see Jonathan H. Adler, Jurisdictional Mismatch in Environmental Federalism, 14 N.Y.U. ENVTL. L.J. 130, 134-35 (2005);
222. Richard L. Revesz, The Race to the Bottom and Federal Environmental Regulation: A Response to Critics, 82 MINN. L. REV. 535, 536-38 (1997);
223. and Richard B. Stewart, Pyramids of Sacrifice? Problems of Federalism in Mandating State Implementation of National Environmental Policy, 86 YALE L.J. 1196, 1211-22 (1977).
224. See also C. Boyden Gray, Regulation and Federalism, 1 YALE J. ON REG. 93, 93 (1983) (describing the presumption of decentralization as a "basic precept" of the Reagan Administration's approach to regulation).
225. See Adler, supra note 82, at 134; Revesz, supra note 82, at 536.
226. See Adler, supra note 82, at 134;
227. see also George A. Bermann, Taking Subsidiarity Seriously: Federalism in the European Community and the United States, 94 COLUM. L. REV. 331, 338-39 (1994) (discussing the connection between the presumption of decentralization and subsidiarity).
228. See infra text accompanying notes 89-91.
229. See infra text accompanying notes 93-96.
230. See, e.g., Pope Leo XIII, Rerum Novarum: Encyclical of Pope Leo XIII on Capital and Labor (May 15, 1891), in 2 THE PAPAL ENCYCLICALS 1878-1903, at 241, 250-51 para. 36 (Claudia Carlen ed., 1990);
231. Pope Pius XI, Quadragesimo Anno: Encyclical of Pope Pius XI on Reconstruction of the Social Order (May 15, 1931), in 3 THE PAPAL ENCYCLICALS 1903-1939, supra, at 428 paras. 79-80.
232. See sources cited supra note 87;
233. see also John Finnis, Natural Law and Natural Rights 147 (1980).
234. See, e.g., Michael W. McConnell, Federalism: Evaluating the Founders' Design, 54 U. CHI. L. REV. 1484, 1499 (1987);
235. Deborah Jones Merritt, The Guarantee Clause and State Autonomy: Federalism for a Third Century, 88 COLUM. L. REV. 1, 9 (1988). This argument builds upon Justice Brandeis's observation that a federal system permits states to "try novel social and economic experiments without risk to the rest of the country." New State ice Co. v. Liebmann, 285 U.S. 262, 311 (1932) (Brandeis, J., dissenting).
236. The classic treatment is Charles M. Tiebout, A Pure Theory of Local Expenditures, 64 J. POL. ECON. 416 (1956). For more recent discussions, see, for example, McConnell, supra note 89, at 1498-99;
237. and Barry R. Weingast, The Economic Role of Political Institutions: Market- Preserving Federalism and Economic Development, 11 J.L. ECON. & ORG. 1, 5-6 (1995).
238. 501 U.S. 452, 458 (1991).
239. See Schwartz, supra note 3, at 916-18, 929-30.
240. See, e.g., HENRY N. BUTLER & JONATHAN R MACEY, USING FEDERALISM TO IMPROVE ENVIRONMENTAL POLICY 1-3 (1996);
241. Adler, supra note 82, at 133;
242. Henry N. Buter & Jonathan R. Macey, Externalities and the Matching Principle: The Case for Reallocating Environmental Regulatory Authority, 14 YALE L. & POL'Y REV. 23, 25 (1996);
243. Daniel C. Esty, Revitalizing Environmental Federalism, 95 MICH. L. REV. 570, 587 (1996).
244. See, e.g., Stewart, supra note 82, at 1212 ("Given the mobility of industry and commerce, any individual state or community may rationally decline unilaterally to adopt high environmental standards that entail substantial costs for industry and obstacles to economic development for fear that the resulting environmental gains will be more than offset by movement of capital to other areas with lower standards.").
245. See Esty, supra note 93, at 597-99.
246. The debate over whether competition for mobile industries causes a "race to the bottom" is particularly robust. Compare, e.g., Revesz, supra note 82.
247. and Richard L. Revesz, Rehabilitating Interstate Competition: Rethinking the "Race-to-the-Bottom" Rationale for Federal Environmental Regulation, 67 N.Y.U. L. REV. 1210 (1992), with Kirsten H. Engel, State Environmental Standard-Setting: Is There a "Race" and Is It "to-the-Bottom"?, 48 HASTINGS L.J. 271 (1997), and Esty, supra note 93.
248. and Joshua D. Sarnoff, The Continuing Imperative (but Only from a National Perspective) for Federal Environmental Protection, 7 DUKE ENVTL. L. & POL'Y F. 225 (1997). On the public choice issues, see Richard L. Revesz, Federalism and Environmental Regulation: A Public Choice Analysis, 115 HARV. L. REV. 553 (2001).
249. See Stewart, supra note 82, at 1215.
250. See Air Quality Act of 1967, Pub. L. No. 90-148, § 208, 81 Stat. 485, 499 (codified as amended at 42 U.S.C. § 7543(b)(1) (2000));
251. Motor Vehicle Air Pollution Control Act, Pub. L. No. 89-272, § 202(a), 79 Stat. 992, 992 (1965). The 1965 statute set a regulatory floor for emissions standards; the 1967 statute gave federal standards preemptive effect over states that had not yet adopted standards. More specifically, the preemption provision allowed any state that adopted emission control standards before March 30, 1966, to seek a waiver of preemption and impose more stringent standards. 42 U.S.C. § 7543(b)(1). California was the only state that met this criterion.
252. See, e.g., Motor & Equip. Mfrs. Ass'n v. EPA, 627 F.2d 1095, 1100 n.1 (D.C. Cir. 1979). The 1977 amendments to the Clean Air Act permitted
253. See 42 U.S.C. § 7507.
254. Online Privacy Protection Act of 2003, CAL. BUS. & PROF. CODE §§ 22575-22579 (West 2008).
255. See 42 U.S.C. § 7543(b)(1); supra note 98.
256. Scholars use the term "floor preemption" to refer to the preemption of state regulations weaker than those in the federal statutes: state regulations can exist above the federal floor or not at all. The term "ceiling preemption" would accurately describe a federal statute that set a maximum standard but allowed weaker state regulations. Some scholars use the term ceiling preemption instead to describe a unitary federal standard that displaces all state regulation. See William W. Buzbee, Asymmetrical Regulation: Risk, Preemption, and the Floor/Ceiling Distinction, 82 N.Y.U. L. REV. 1547, 1549-55 (2007) (distinguishing floor, ceiling, and "unitary federal choice" preemption).
257. Such claims (along with claims about state autonomy) underlie scholars' objections to strong preemption but acceptance of federal regulation in a range of contexts. See, e.g., Erwin Chemerinsky, Empowering States: The Need To Limit Federal Preemption, 33 PEPP. L. REV. 69, 74-75 (2005);
258. Robert A. Schapiro, Justice Stevens's Theory of Interactive Federalism, 74 FORDHAM L. REV. 2133, 2135 (2006).
259. of course, floor preemption limits the marketplace for regulation by permitting only one form of experimentation - experimentation "up" from the federal standard. Since a floor preemption provision is most likely to appear in a statute responding to perceived underregulation by states, this limitation is significant: floor preemption allows states to demonstrate that the federal statute, though it responds to underregulation, in fact still underregulates, but it does not allow states to demonstrate the presumptively more likely phenomenon of federal overregulation.
260. See Esty, supra note 93, at 589 (describing nationally specified drinking-water pollution controls as an example of this sort of "internality").
261. 18 U.S.C. § 2710.
262. Id. § 2721.
263. The matching principle may provide a better justification for the Federal VPPA now than it did before, since brick-and-mortar video rental stores no longer dominate the video rental and video sale markets.
264. See, e.g., James P. Nehf, Recognizing the Societal Value in Information Privacy, 78 WASH. L. REV. 1, 62 (2003).
265. See, e.g. , id. at 64.
266. 42 U.S.C. § 2000aa.