Self-surveillance privacy

Iowa Law Review

Volumn 97, Issue 3, 2012, Pages 809-847

  Kang, Jerry ^a   Shilton, Katie ^b   Estrin, Deborah ^c,d,e   Burke, Jeff ^a,f   Hansen, Mark ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b UNIVERSITY OF MARYLAND   (United States)

^c Engineering IV   (United States)

^d Department of Computer Science ^*  (United States)

^e Center for Embedded Networked Sensing (CENS)   (United States)

^f REMAP Center for Research in Engineering Media and Performance   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84859056524     PISSN: 00210552     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (132)

1. See GOOGLE ANALYTICS, http://www.google.com/analytics/ (last visited Jan. 16, 2012).
2. As of December 2010, RescueTime advertises two products, Pulse and Empower. The Pulse product is for "employee tracking" by management; in this sense, it is old-school surveillance. By contrast, the Empower product is more for self-analytics in that an individual voluntarily initiates the data collection for self-analysis. But even in this context, the meaning of the data collected turns on "peer" comparisons.
3. See RESCUETIME, http://www.rescuetime.com/ (last visited Jan. 16, 2012).
4. See GARMIN CONNECT, http://connect.garmin. com (last visited Jan. 16, 2012)
5. DAYTUM, http://daytum.com/ (last visited Jan. 16, 2012) (making use of Google charting API);
6. ME-TRICS, http://beta.me-trics.com/ (last visited Jan. 16, 2012) (pulling data from RescueTime and Twitter and others);
7. MYCROCOSM, http://mycro.media.mit.edu/ (last visited Jan. 16, 2012) ("[A] web service that allows you to share snippets of information from the minutiae of daily life in the form of simple statistical graphs.");
8. NIKE+DASHBOARD, http://nikerunning.nike.com/nikeos/p/nikeplus/en-us/ plus#//dashboard (last visited Jan. 16, 2012);
9. YOUR. FLOWINGDATA, http://your.flowingdata.com/ (last visited Jan. 16, 2012) (providing wide-open flexibility over data that can be tracked).
10. See David Pogue, Getting Fit with 2 Bits of Help, N. Y. TIMES (Dec. 17, 2009), http://www.nytimes.com/2009/12/17/technology/personaltech/17pogue.html.
11. See PHILIPS DIRECTLIFE, http://www.directlife.philips.com/ (last visited Jan. 16, 2012).
12. In our definition, self-surveillance data refer only to individual human beings and not to, for example, data about corporations or other fictional legal persons. For an explanation of why we exclude non-human persons, see Jerry Kang, Information Privacy in Cyberspace Transactions, 50 STAN. L. REV. 1193, 1210-11 (1998).
13. See MIHALY CSIKSZENTMIHALYI, FLOW: THE PSYCHOLOGY OF OPTIMAL EXPERIENCE 4 (1990).
14. See, e.g., Christie Napa Scollon et al., Experience Sampling: Promises and Pitfalls, Strengths and Weaknesses, 4 J. HAPPINESS STUD. 5, 5-8 (2003) (describing interval-contingent, eventcontingent, and signal-contingent sampling procedures).
15. See URBAN SENSING, http://urban. cens.ucla.edu/ (last visited Jan. 16, 2012).
16. Participatory Sensing is inspired by, and draws its name from, the broader tradition of participatory research ("PR"). PR is a set of methods that position research subjects as coinvestigators. See Margaret Cargo & Shawna L. Mercer, The Value and Challenges of Participatory Research: Strengthening Its Practice, 29 ANN. REV. PUB. HEALTH 325 (2008). PR traditions develop their research questions with the cooperation of partner communities and engage community members in research design, implementation, analysis, and dissemination. Involvement with every stage of the research process allows participants to target local knowledge and benefit from the results of systematic investigations. PR successes in health and environmental research have improved the ability of marginalized or underserved groups to act on the results of the data they have helped collect and analyze.
17. See, e.g., Carol R. Horowitz et al., Community-Based Participatory Research from the Margin to the Mainstream: Are Researchers Prepared?, 119 CIRCULATION 2633 (2009).
18. See Deborah Estrin & Ida Sim, Open mHealth Architecture: An Engine for Health Care Innovation, 330 SCIENCE 759 (2010);
19. John Hicks et al., AndWellness: An Open Mobile System for Activity and Experience Sampling, WIRELESS HEALTH, Oct. 5-7, 2010, at 34.
20. See Our Projects, URBAN SENSING, http://urban. cens.ucla.edu/projects/ (last visited Jan. 16, 2012). Although we have highlighted self-surveillance examples, other CENS Participatory Sensing projects extend far beyond this scope. Indeed, such research was launched initially to support sensing activities in which people decide what, how, and when to sense not only themselves but features of the world around them to collect and analyze geotagged imagery in support of ecological, public health, and cultural goals. For example, data can be collected as part of an explicit campaign undertaken by many users in collaboration. One such campaign focused on recycling practices on the UCLA campus. Project participants used phone cameras to document and tag incidences of recyclable materials thrown into garbage cans on campus. The incidents were tallied, mapped, and reported to campus facilities to suggest the most urgent places to add new recycling bins.
21. See Garbage Watch, URBAN SENSING, http://urban. cens.ucla.edu/projects/ gabagewatch/ (last visited Jan. 16, 2012). The point here is to make clear that CENS Participatory Sensing projects can easily extend beyond selfsurveillance.
22. This quotation is attributed to organizational theorist Mason Haire by THOMAS J. PETERS & ROBERT H. WATERMAN, JR., IN SEARCH OF EXCELLENCE: LESSONS FROM AMERICA'S BEST-RUN COMPANIES 268 (1982).
23. See, e.g., PROJECT IMPLICIT, http://projectimplicit.org (last visited Jan. 16, 2012) (providing an online example of tests used to measure automatic associations).
24. For recent discussion of implicit bias in the law reviews, see Jerry Kang & Kristin Lane, Seeing Through Colorblindness: Implicit Bias and the Law, 58 UCLA L. REV. 465 (2010).
25. Franklin never completed writing his planned work THE ART OF VIRTUE, but he referred to his practice in his autobiography. See Norman S. Fiering, Benjamin Franklin and the Way to Virtue, 30 AM. Q. 199, 200 (1978).
26. (quoting Pierre Cabanis's statement in ALFRED OWEN ALDRIDGE, FRANKLIN AND HIS FRENCH CONTEMPORARIES 206 (1957)).
27. BENJAMIN FRANKLIN, THE AUTOBIOGRAPHY OF BENJAMIN FRANKLIN 155 (Leonard W. Labaree et al. eds., 2d ed. 1964).
28. See generally Jerry Kang & Dana Cuff, Pervasive Computing: Embedding the Public Sphere, 62 WASH. & LEE L. REV. 93 (2005) (including commentary on transparency discussion). Consider, for example, not Google Analytics but Google Trends, which provides visualizations of the relative frequencies of certain search terms.
29. See GOOGLE TRENDS, http://www.google. com/trends (last visited Jan. 16, 2012).
30. Cf. Arjun Appadurai, Archive and Aspiration, in INFORMATION IS ALIVE: ART AND THEORY ON ARCHIVING AND RETRIEVING DATA 14, 17 (2003);
31. Sue McKemmish, Evidence of Me⋯, 24 ARCHIVES & MANUSCRIPTS 28 (1996).
32. In addition to hackers, one could worry about underpoliced employees with access to servers. See, e.g., Phil Wong, Conversations About the Internet #5: Anonymous Facebook Employee, RUMPUS (Jan. 11, 2010), http://therumpus.net/2010/ 01/conversations-about-the-internet-5-anonymous-facebook-employee/ (explaining how employees casually viewed private user profiles with a master word that was a variant of "Chuck Norris" (internal quotation marks omitted)).
33. This approach has long been standard in the legal and policy literature. ARTHUR R. MILLER, THE ASSAULT ON PRIVACY: COMPUTERS, DATA BANKS, AND DOSSIERS 25 (1971) ("[T]he basic attribute of an effective right of privacy is the individual's ability to control the circulation of information relating to him-a power that often is essential to maintaining social relationships and personal freedom.");
34. ALAN F. WESTIN, PRIVACY AND FREEDOM 7 (1967) ("Privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.");
35. Charles Fried, Privacy, 77 YALE L. J. 475, 482 (1968) ("Privacy is not simply an absence of information about us in the minds of others; rather it is the control we have over information about ourselves.");
36. see also HELEN NISSENBAUM, PRIVACY IN CONTEXT: TECHNOLOGY, POLICY, AND THE INTEGRITY OF SOCIAL LIFE 70-71 (2010).
37. Anita Allen has insightfully explored such weirdness. See, e.g., Anita L. Allen, Commentary, Privacy-as-Data Control: Conceptual, Practical, and Moral Limits of the Paradigm, 32 CONN. L. REV. 861, 867-68 (2000). Allen points out, "You can invade (that is diminish) your own privacy the same way you can diminish your own freedom."
38. The flow conception has affinities with approaches that define privacy in terms of "constraint on access." See, e.g., ANITA L. ALLEN, UNEASY ACCESS: PRIVACY FOR WOMEN IN A FREE SOCIETY 3 (1988) (emphasizing a definition focused on "inaccessibility" of a person to others);
39. Ruth Gavison, Privacy and the Limits of Law, 89 YALE L. J. 421, 428-33 (1980) (arguing that privacy is a condition that is measured in terms of the degree of access others have to use through information, attention, and proximity).
40. Dennis Hirsch argues that personal information is a resource that behaves similarly to environmental resources, such as fisheries. Just as over use of the fishery will cause it to collapse, so will over use of personal data by commercial data miners. See Dennis D. Hirsch, Protecting the Inner Environment: What Privacy Regulation Can Learn from Environmental Law, 41 GA. L. REV. 1, 23-25, 28-30 (2006). This may well be true of self-surveillance data.
41. "Cloud computing is the style of computing in which the users can rent infrastructure, platform or software services from other vendors without requiring the physical access to them." Karthick Ramachandran, Thomas Margoni & Mark Perry, Clarifying Privacy in the Clouds 3 (Feb. 23, 2011) (unpublished manuscript), available at http://papers.ssrn. com/sol3/Delivery. cfm/SSRN-ID1755225-code1383303.pdf?abstractid=1755225&mirid=1. One characterization of cloud computing emphasizes that users simply do not care about the "location" of data or a particular server.
42. See, e.g., Caroline McCarthy, Facebook Beacon Has Poked Its Last, CNET (Sept. 18, 2009, 11:58 PM), http://news.cnet.com/8301-13577-3-10357107-36.html? tag=mncol;txt.
43. It's important to recognize that one of those third parties might be the government, such as in some law-enforcement or national-security project. The state can purchase personal data in the marketplace, subpoena it through legal process, or lean hard on private actors in gray cases to get data. See Jon D. Michaels, All the President's Spies: Private-Public Intelligence Partnerships in the War on Terror, 96 CALIF. L. REV. 901, 917-18, 930 (2008).
44. For a general, skeptical read of how market-based consent operates in cyberspace and information-technology discourse, see Julie E. Cohen, Lochner in Cyberspace: The New Economic Orthodoxy of "Rights Management", 97 MICH. L. REV. 462 (1998).
45. For empirical evidence that individuals rarely read "click-through agreements" or understand them, see Victoria C. Plaut & Robert P. Bartlett III, Blind Consent? A Social Psychological Investigation of Non-Readership of Click-Through Agreements, 36 LAW & HUM. BEHAV. (forthcoming 2012).
46. See, e.g., Paul M. Schwartz, Commentary, Internet Privacy and the State, 32 CONN. L. REV. 815, 822 (2000) (identifying the problem of "bounded rationality").
47. Neil Weinstock Netanel, Cyberspace Self-Governance: A Skeptical View from Liberal Democratic Theory, 88 CALIF. L. REV. 395, 476 (2000).
48. See CASS R. SUNSTEIN, FREE MARKETS AND SOCIAL JUSTICE 29-30 (1997). There may also be more standard forms of collective-action problems as well.
49. see also Dana Cuff, Mark Hansen & Jerry Kang, Urban Sensing: Out of the Woods, COMM. ACM, Mar. 2008, at 24.
50. Given the nonrivalrous nature of information, more than one party can "own" various facts, such as the fact that I bought a red scarf on Tuesday for seventy-nine dollars. I possess that fact in my short-term memory. So does my friend who went shopping with me. So does Victoria's Secret. It is a sort of joint possession. For further discussion of this "entitlement anarchy", see Jerry Kang & Benedikt Buchner, Privacy in Atlantis, 18 HARV. J. L. & TECH. 229, 238-41 (2004).
51. For careful exploration of the relationship between Lockean desert theory and intellectual property, see Seana Valentine Shiffrin, Lockean Arguments for Private Intellectual Property, in NEW ESSAYS IN THE LEGAL AND POLITICAL THEORY OF PROPERTY 138 (Stephen R. Munzer ed., 2001), where the author argues that Lockean analysis provides a prima facie argument against property rights in intellectual property.
52. See, e.g., George J. Stigler, An Introduction to Privacy in Economics and Politics, 9 J. LEGAL STUD. 623, 628-33 (1980) (arguing that the more accurate classifications will increase economic efficiency).
53. See generally Eugene Volokh, Freedom of Speech and Information Privacy: The Troubling Implications of a Right To Stop People from Speaking About You, 52 STAN. L. REV. 1049 (2000).
54. For examples of such ventures, see MyLifeBits, MICROSOFT RESEARCH, http://research. microsoft.com/en-us/projects/mylifebits (last visited Jan. 16, 2012);
55. Total Recall: A Personal Information Management System, USC. EDU, http://bourbon. usc.edu/iml/recall (last visited Jan. 16, 2012).
56. See Martin Dodge & Rob Kitchin, 'Outlines of a World Coming into Existence': Pervasive Computing and the Ethics of Forgetting, 34 ENV'T & PLAN. B: PLAN. & DESIGN 431, 431 (2007) (defining Lifelog as a "unified digital record of the totality of an individual's experiences, captured multimodally through digital sensors and stored permanently as a personal multimedia archive").
57. For science-fiction iterations, see THE FINAL CUT (Lions Gate Entertainment 2004).
58. See Steve Mann, Equiveillance: The Equilibrium Between Sur-veillance and Sous-veillance, ON THE IDENTITY TRAIL, May 2005, available at http://wearcam.org/anonequity.htm. Mann explains, Surveillance is derived from French "sur" (above) and "veiller" (to watch). Typically (though not necessarily) surveillance cameras look down from above, both physically (from high poles) as well as hierarchically (bosses watching employees, citizens watching police, cab drivers photographing passengers, and shopkeepers videotaping shoppers). Likewise Sousveillance, derived from French "sous" (below) and "veiller" (to watch), is the art, science, and technologies of "People Looking at"⋯. [S]ousveillance typically involves small person-centric imaging technologies, whereas surveillance tends to be architecture or enviro-centric (cameras in or on the architecture or environment around us). Sousveillance does not necessarily limit itself to citizens photographing police, shoppers photographing shopkeepers, etc., any more than surveillance limits itself along similar lines. For example, one surveillance camera may be pointed at another, just as one person may sousveill another. Sousveillance therefore expands the range of possibilities, without limitation to the possibility of going both ways in an up-down hierarchy. With the miniaturization of cameras into portable electronic devices, such as camera phones, there has been an increased awareness of sousveillance (more than 30, 000 articles, references, and citations on the word "sousveillance" alone), and we are ready to see a new industry grow around devices that implement sousveillance, together with a new sousveillance services industry.
59. See generally Steve Mann, Jason Nolan & Barry Wellman, Sousveillance: Inventing and Using Wearable Computing Devices for Data Collection in Surveillance Environments, 1 SURVEILLANCE & SOC'Y 331, 332 (2003) (discussing the difference between sousveillance and surveillance).
60. See, e.g., A. Michael Froomkin, The Death of Privacy?, 52 STAN. L. REV. 1461, 1524 (2000) (describing privacy-enhancing technologies as insufficient to meet the evolving challenges presented by developments in personal-data- collection technology);
61. Bert-Jaap Koops & Ronald Leenes, 'Code' and the Slow Erosion of Privacy, 12 MICH. TELECOMM. & TECH. L. REV. 115, 187 (2005) (questioning the efficacy of privacy-enhancing technologies as "[t]hey remain a mainly theoretical solution that has yet to prove [their] effect in practice");
62. Pamela Samuelson, Privacy as Intellectual Property?, 52 STAN. L. REV. 1125, 1126 (2000) (arguing that privacy-enhancing technologies "have thus far done little to make cyberspace more privacyfriendly").
63. For a discussion of "role ideology", see Sung Hui Kim, The Banality of Fraud: Re-Situating the Inside Counsel as Gatekeeper, 74 FORDHAM L. REV. 983, 1012 (2005).
64. For technical details and descriptions, see Min Mun et al., Personal Data Vaults: A Locus of Control for Personal Data Streams, in PROCEEDINGS OF THE 6TH INTERNATIONAL CONFERENCE (2010), available at http://dl.acm.org/citation. cfm?id=1921191&bnc=1.
65. Paul Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA L. REV. 1701, 1744-45 (2010) (proposing for legal discourse the term scrub instead of anonymize or deidentify). Ohm points out that reidentification of "anonymized" data has been shown to be much easier than commonly supposed.
66. Model Rule of Professional Conduct 5.4 prevents nonlawyers from partial ownership of a law firm. It also prevents lawyers from providing multiple services (beyond legal services), such as accounting or healthcare, from the same office. MODEL RULES OF PROF'L CONDUCT R. 5.4 (2005).
67. Some such privileges have been recognized in the context of medical committee reports, affirmative-action studies, and environmental-impact assessments. See, e.g., James F. Flanagan, Rejecting a General Privilege for Self-Critical Analyses, 51 GEO. WASH. L. REV. 551, 552 (1983) (suggesting that protection for self-critical evaluations has been found in only three contexts: peer reviews, affirmative-action studies, and internal corporate investigations);
68. S. Kay McNab, Note, Criticizing the Self-Criticism Privilege, 1987 U. ILL. L. REV. 675, 678-82 (describing doctrinal evolution of self-criticism privilege).
69. We focus on state legislatures because although Federal Rules of Evidence Rule 501 gives the federal courts broad discretion in applying privileges "in the light of reason and experience" within the federal courts, Congress expressly rejected the adoption of any specifically enumerated privileges. CHARLES ALAN WRIGHT & KENNETH W. GRAHAM, JR., FEDERAL PRACTICE AND PROCEDURE: EVIDENCE § 5421, at 587 n. 79 (Supp. 2008);
70. See, e.g., Gail N. Friend et al., The New Rules of Show and Tell: Identifying and Protecting the Peer Review and Medical Committee Privileges, 49 BAYLOR L. REV. 607 (1997) (describing Texas privileges for peer review and medical committees).
71. FED. R. CIV. P. 26 (b) (1) (2010).
72. See, e.g., CAL. CIV. PROC. CODE § 2017.010 (West 2007);
73. COLO. R. CIV. P. 26 (b) (1) (West 2010);
74. KAN. STAT. ANN. § 60-226 (b) (1) (2010);
75. N. Y. C. P. L. R. § 3101 (McKinney 2005);
76. WYO. R. CIV. P. 26 (b) (1) (2011).
77. Ledbetter v. Wal-Mart Stores, Inc., No. 06-cv-01958-WYD-MJW, 2009 WL 1067018 (D. Colo. Apr. 21, 2009);
78. see First Amended Complaint and Jury Demand at 3, 8-9
79. Ledbetter, 2009 WL 1067018.
80. * 1.
81. Stored Communications Act, 18 U. S. C. §§ 2701-2712 (Supp. 2010).
82. Defendant Wal-Mart Stores, Inc.'s Motion To Compel Production of Content of Social Networking Sites at 2
83. Ledbetter, 2009 WL 1067018.
84. Federal Rule of Civil Procedure 34 states that this requirement applies to "any designated documents or electronically stored information-including writings, drawings, graphs, charts, photographs, sound recording, images, and other data or data compilations-stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form." FED. R. CIV. P. 34 (a) (1) (A) (2010).
85. * 2.
86. See FED. R. CIV. P. 26 (b) (3) (also known as "work product").
87. Unlike the topical privileges that protect facts, a confidential- communications privilege applies only to communications. According to Imwinkelried, "communication[s]" include "expressive statements and acts." EDWARD J. IMWINKELRIED, THE NEW WIGMORE: A TREATISE ON EVIDENCE: EVIDENTIARY PRIVILEGES § 6.7.1, at 731 (Richard D. Friedman ed., 2d ed. 2009). A statement or act "is expressive if the speaker or writer subjectively intends the statement to convey meaning to a person such as a hearer or reader⋯. [S]tate of mind must also exist at a particular time⋯. [T]he transfer of a pre-existing document does not qualify the document for protection. "
88. See, e.g., WILLIAM E. WEGNER ET AL., CALIFORNIA PRACTICE GUIDE: CIVIL TRIALS AND EVIDENCE 8E-149 (2010) (internal quotation marks omitted).
89. See JOHN HAGEL III & MARC SINGER, NET WORTH: SHAPING MARKETS WHEN CUSTOMERS MAKE THE RULES 28-29 (1999).
90. See Kenneth C. Laudon, Markets and Privacy, COMM. ACM, Sept. 1996, at 92, 99-101.
91. See Eric Goldman, A Coasean Analysis of Marketing, 2006 WIS. L. REV. 1151, 1202 (internal quotation marks omitted).
92. See Patrick Del Duca, Why Some Civil Law Systems Burden Notice-Filing with a Civil Law Notary "Public Writing" Requirement, 44 UCC L. J. (forthcoming 2011) (manuscript at 5-6). In contrast to notaries in the United States, civil law notaries receive specialized training beyond that of lawyer and generally enjoy higher status and compensation than lawyers.
93. At various moments, we've raised the domain of medical data. One might naturally wonder whether certain medical-privacy laws might apply to the PDV. In particular, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule "protects the privacy of individually identifiable health information. " Health Information Privacy, U. S. DEP'T HEALTH & HUMAN SERVS., http://www.hhs.gov/ocr/privacy/index.html (last visited Jan. 16, 2012).
94. For HIPPA, see 45 C. F. R. §§ 160, 164 (2010). But it applies only to such information held by three types of entities: health plans, healthcare clearinghouses, and certain healthcare providers.
95. Because the PDV stores but does not process data, nor acts as an intermediary between health plans and healthcare providers, it cannot be classified under the rule as a healthcare clearinghouse. Were the PDV system to process raw self-analytic data into a standardized format for the benefit of the user, the HIPAA Privacy Rule would still not apply because the PDV system is receiving the data from the individual and the individual determines where this data is transferred. A system somewhat analogous to the PDV system, and which is also not regulated by HIPAA, is Google Health (http://www.google.com/health), a free service designed by Google to "store [and] manage⋯ all of your health⋯ information in one central [online] place."
96. About Google Health, GOOGLE HEALTH, http://www.google.com/intl/en-US/ health/about/index.html (last visited Nov. 16, 2011) (Google Health has been discontinued as of Jan. 1, 2012). The PDV and Google Health systems are similar to the extent that both may store selfanalytic healthcare information and both serve individuals. However, unlike the PDV system, Google Health's specific purpose is to store all healthcare information, and it does not store non-health related self-analytics. In contrast, the PDV system is designed to store all selfanalytics and exclude non-self-analytic healthcare information.
97. On its site, Google Health states: "Google Health is not regulated by [HIPAA]⋯. because Google does not store data on behalf of health care providers. Instead, our primary relationship is with⋯ the user." Google Health Privacy, GOOGLE HEALTH, http://www.google.com/intl/en-US/health/ about/privacy.html (last visited Jan. 16, 2012).
98. See MOZY. COM, https://mozy.com/home/pricing/ (last visited Jan. 16, 2012).
99. See ANONYMIZER. COM, http://www.anonymizer.com/homeuser (last visited Jan. 16, 2012).
100. See Enrollment, LIFELOCK. COM, https://secure.lifelock.com/enrollment/ (last visited Jan. 16, 2012).
101. ® Frequently Asked Questions, WELLS FARGO, https://wellsfargo.com/help/faqs/wellsfargovsafe (last visited Jan. 20, 2012).
102. MOTLEY FOOL, http://www.fool.com (last visited Jan. 20, 2012). The site's trademarked motto is, "The Motley Fool: To Educate, Amuse & Enrich."
103. PRIVACY RIGHTS CLEARINGHOUSE, http://www.privacyrights.org (last visited Jan. 20, 2012).
104. ELECTRONIC PRIVACY INFO. CTR., http://epic.org (last visited Jan. 20, 2012).
105. ® SERVICE AGREEMENT 2(2008), available at https://www.wellsfargo.com/downloads/pdf/wfonline/vsafe-service- agreement.pdf. Further, there is no evidentiary privilege. The Agreement states: "You understand that we may provide copies of electronic records in your Wells Fargo vSafe Account and our audit logs in response to legal process."
106. See Richard L. Abel, United States: The Contradictions of Professionalism, in 1 LAWYERS IN SOCIETY: THE COMMON LAW WORLD 186, 188 (Richard L. Abel & Philip S. C. Lewis eds., 1988) ("American lawyers pursued the project of market control through their professional organizations, and they justified those institutions by the axiomatic identification of professionalism with self-regulation. But the actual experience of self-regulation has tended to undermine the profession's claim to privileged immunity from external oversight."). But mild deterrence is better than nothing.
107. Protection of Human Subjects, 45 C. F. R. § 46 (2010).
108. See H. Tristram Engelhart, Jr., Basic Ethical Principles in the Conduct of Biomedical and Behavioral Research Involving Human Subjects, in NAT'L COMM'N FOR THE PROT. OF HUMAN SUBJECTS OF BIOMEDICAL & BEHAVIORAL RESEARCH, THE BELMONT REPORT 7-39, 8-5 to-6 (1979) (defining basic principles for research ethics).
109. This is similar to an approach suggested by the Common Data Project, a nonprofit organization developing a cloud service that would allow third parties to query sensitive personal data without revealing that data. THE COMMON DATA PROJECT, WHITE PAPER v. 2 13-31(2011), available at http://www. commondataproject.org/docs/whitepaper.pdf.
110. See RADIA PERLMAN, THE EPHEMERIZER: MAKING DATA DISAPPEAR (Sun Microsystems Labs., Technical Report No. TR-2005-140, 2005), available at labs.oracle.com/techrep/2005/smli-tr-2005-140.pdf.
111. Vanish: Self-Destructing Digital Data, UNIV. OF WASH., http://vanish.cs.washington.edu (last visited Jan. 22, 2012).
112. See RESTATEMENT (SECOND) OF CONTRACTS § 302 (1981). Even without an express designation, in most jurisdictions, intended-beneficiary status might still be found when the circumstances suggest that the party to the contract that extracted the promise (the Guardian) did so for the benefit of the third party (the client).
113. But some jurisdictions, such as New York, resist looking beyond the four corners of the contract. See, e.g., Debary v. Harrah's Operating Co., 465 F. Supp. 2d 250, 263 (S. D. N. Y. 2006)
114. (citing Newman & Schwartz v. Asplundh Tree Expert Co., 102 F.3d 660 (2d Cir. 1996))
115. aff'd sub nom. Catskill Dev., L. L. C. v. Park Place Entm't Corp., 547 F.3d 115 (2d Cir. 2008). To satisfy these jurisdictions and to avoid the uncertainty that inherently accompanies a judicial determination of intended-beneficiary status, explicit identification of the client as an intended beneficiary in the contract itself makes sense.
116. Courts routinely recognize the right of an intended third-party beneficiary of a contract to recover damages for breach. See, e.g., Cnty. of Santa Clara v. Astra USA, Inc., 540 F.3d 1094, 1109 (9th Cir. 2008) (finding that local medical clinics are intended third-party beneficiaries that may recover damages from pharmaceutical companies resulting from the alleged breach of pricing agreements with the federal government)
117. opinion withdrawn and superseded, 588 F.3d 1237 (9th Cir. 2009)
118. rev'd, 131 S. Ct. 1342 (2011) (holding that healthcare facilities cannot sue pharmaceutical manufacturers as third-party beneficiaries to enforce pricing agreements between the federal government and the manufacturers because such suits are incompatible with the statutory scheme);
119. Colavito v. N. Y. Organ Donor Network, Inc., 438 F.3d 214 (2d Cir. 2006) (holding that a prospective kidney donee who sued a donor network and others when a kidney that was donated on the condition that he receive it was implanted in another person was an intended third-party beneficiary)
120. certified question answered, 860 N. E.2d 713 (N. Y. 2006) (holding that the intended donee had no common-law right to an incompatible kidney and, thus, no cause of action for conversion, and that the intended donee also had no right of action under New York's Public Health Law for an incompatible kidney);
121. Vanerian v. Charles L. Pugh Co., 761 N. W.2d 108, 109, 114 (Mich. Ct. App. 2008) (holding that a homeowner was an intended third-party beneficiary of a contract between a subcontractor and a general contractor to install a floor in her home). By contrast, incidental beneficiaries have no legal recourse in the event of a breach.
122. "[Fraud-detection] systems employ some machine learning and statistical analysis algorithms to produce pattern-directed inference systems using models of anomalous or errant transaction behaviors to forewarn of impending threats." Salvatore J. Stolfo et al., Credit Card Fraud Detection Using Meta-Learning: Issues and Initial Results 1 (unpublished manuscript), http://wenke.gtisc.gatech.edu/papers/credit-card-FD.ps (last visited Jan. 22, 2012).
123. For an additional description of fraud-detection systems, see Richard J. Bolton & David J. Hand, Statistical Fraud Detection: A Review, 17 STAT. SCI. 235 (2002).
124. RESTATEMENT (SECOND) OF CONTRACTS §§ 347, 351-52 (1981).
125. See In re Jetblue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299, 326-27 (E. D. N. Y. 2005).
126. RESTATEMENT (SECOND) OF CONTRACTS § 353.
127. Whether violation of contracts guaranteeing privacy allow for damages for emotional distress has seemingly turned on the nature of information that was improperly disclosed. Compare Trikas v. Universal Card Servs. Corp., 351 F. Supp. 2d 37, 46 (E. D. N. Y. 2005) (awarding no damages for improper disclosure of credit report)
128. with Huskey v. Nat'l Broad. Co., 632 F. Supp. 1282, 1293 (N. D. Ill. 1986) (allowing a prisoner to recover damages for defendant's improper national broadcast of images of him incarcerated).
129. If we assume that this is ultimately grounded in the principles of foreseeability of particular harm by the contracting parties enshrined in Hadley v. Baxendale, (1854) 156 Eng. Rep. 145 (Exch. Div. 1854), then the existence of a PDG and the act of stipulating damages itself would seem to alert both parties to the harm and to allow for recovery of damages.
130. See, e.g., EEOC v. First Citizens Bank of Billings, 758 F.2d 397, 403 (9th Cir. 1985) ("Liquidated damages are compensatory, not punitive in nature.");
131. United States v. Am. Motorists Ins. Co., 680 F. Supp. 1569, 1572 (Ct. Int'l Trade 1987) ("True liquidated damages are not penalties. They are compensatory in nature, providing a measure of recovery when it appears at the time a contract is made that damages caused by breach will be difficult or impossible to estimate.").
132. RESTATEMENT (SECOND) OF CONTRACTS § 356.