Information privacy in the cloud

University of Pennsylvania Law Review

Volumn 161, Issue 6, 2013, Pages 1623-1662

  Schwartz, Paul M ^a,b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b Berkeley Center for Law Business and the Economy   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84878824956     PISSN: 00419907     EISSN: 19428537     Source Type: Journal    
DOI: None     Document Type: Article

References (97)

1. WHITE HOUSE, CONSUMER DATA PRIVACY IN A NETWORKED WORLD: A FRAMEWORK FOR PROTECTING PRIVACY AND PROMOTING INNOVATION IN THE GLOBAL DIGITAL ECONOMY 6 (Feb. 2012), http://www.whitehouse.gov/sites/default/files/privacy-final.pdf.
2. See Working Party on the Prot. of Individuals with Regard to the Processing of Data, Opinion 2/99 on the Adequacy of the "International Safe Harbor Principles" Issued by the US Department of Commerce on 19th April 1999, at 2, (EC) No. 5047/99, WP 19 (May 3, 1999), available at http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/1999/wp19en.pdf ("reiterat[ing] its view that the patchwork of narrowly focused sectoral laws and self-regulatory rules presently existent in the United States cannot be relied upon to provide adequate protection in all cases for personal data transferred from the European Union").
3. Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), COM (2012) 11 final (Jan. 25, 2012) [hereinafter Proposed Data Protection Regulation], available at http://ec.europa.eu/justice/data-protection/document/ review2012/com-2012-11-en.pdf.
4. See PAUL M. SCHWARTZ, THE PRIVACY PROJECTS, MANAGING GLOBAL DATA PRIVACY: CROSS-BORDER INFORMATION FLOWS IN A NETWORKED ENVIRONMENT 13-15 (2009), available at http://theprivacyprojects.org/wp-content/uploads/2009/08/The- Privacy-Projects-Paul-Schwartz-Global-Data-Flows-20093.pdf. I conducted the study on behalf of The Privacy Projects, an independent nonprofit organization centered on enhancement of privacy through research and education. Id. at 3, 71. In this Article, I have also drawn on research regarding developments in cloud computing subsequent to this study.
5. See generally R.H. Coase, The Nature of the Firm, 4 ECONOMICA 386 (1937)
6. reprinted in THE NATURE OF THE FIRM: ORIGINS, EVOLUTION, AND DEVELOPMENT 18 (Oliver E. Williamson & Sidney G. Winter eds., 1993).
7. On the "make or buy" decision and how Coase views it as turning on the relative cost of the use of the market versus the cost of using the firm's managerial organization, see Harold Demsetz, Coase, Ronald Harry, in 1 THE NEW PALGRAVE DICTIONARY OF ECONOMICS AND THE LAW 267 (Peter Newman ed., 1998).
8. ANTHONY T. VELTE ET AL., CLOUD COMPUTING: A PRACTICAL APPROACH 3-4 & fig.1-1 (2010).
9. PETER MELL & TIMOTHY GRANCE, NAT'L INST. of STANDARDS & TECH., U.S. DEP'T OF COMMERCE, SPECIAL PUB. 800-145, THE NIST DEFINITION OF CLOUD COMPUTING 2 (2011), available at http://csrc.nist.gov/publications/nistpubs/800- 145/SP800-145.pdf.
10. Data Memo from John B. Horrigan, Assoc. Dir., Pew Internet & Am. Life Project, Regarding Use of Cloud Computing Applications and Services 1 (Sept. 2008), http://www.pewinternet.org/~/media/Files/Reports/2008/PIP-Cloud.Memo.pdf. pdf.
11. See JANNA QUITNEY ANDERSON & LEE RAINIE, PEW RESEARCH CTR., THE FUTURE OF CLOUD COMPUTING 8 (2010), http://www.pewinternet.org/~/media/Files/ Reports/2010/PIP-Future-of-the-Internet-cloud-computing.pdf (reporting survey results finding that a majority of respondents expect most people to be working predominantly on the cloud by 2020).
12. See Shane O'Neill, Forrester: Public Cloud Growth to Surge, Especially SaaS, CIO (Apr. 26, 2011), http://www.cio.com/article/680673/Forrester-Public- Cloud-Growth-to-Surge-Especially-SaaS.
13. Press Release, Experton Group, Cloud Computing Startet in Deutschland Durch - Ausgaben und Investitionen in 2010 Bereits über Eine Milliarde Euro 1 [Cloud Computing Starts Again in Germany - Spending and Investments in 2010 Already over One Billion Euros] (Oct. 6, 2010), http://www.experton-group.de/ fileadmin/experton/press/2010/pm-2010-10-06-Cloud.pdf.
14. Tom Cheney, Cartoon, THE NEW YORKER, Oct. 8, 2012, at 54.
15. COMMISSION NATIONALE DE L'INFORMATIQUE ET DES LIBERTES, 10E RAPPORT D'ACTIVITE [NATIONAL COMMISSION ON INFORMATICS AND LIBERTIES, 10TH ACTIVITY REPORT] 32 (1989).
16. Reports of the National Commission are available online back through 1999, see Rapports d'activité, COMMISSION NATIONALE DE L'INFORMATIQUE ET DES LIBERTES, http://www.cnil.fr/en-savoir-plus/rapports-dactivite/accessible/ non (last visited Apr. 10, 2013), but older reports (including the 1989 report) may be obtained by contacting the site's administrators at http://www.cnil.fr/ pied-de-page/contactez-nous/contact-webmestre.
17. Id. at 32 ("récépissé"). For a discussion, see Paul M. Schwartz, European Data Protection Law and Restrictions on International Data Flows, 80 IOWA L. REV. 471, 491-92 (1995).
18. For an overview of the relatively limited transborder exchanges in the 1980s, see REINHARD ELLGER, DER DATENSCHUTZ IM GRENZÜBERSCHREITENDEN DATENVERKEHR: EINE RECHTSVERGLEICHENDE UND KOLLISIONSRECHTLICHE UNTERSUCHUNG [DATA PRIVACY IN CROSS-BORDER DATA TRAFFIC: A COMPARATIVE AND CONFLICTS OF LA W ANALYSIS] § 3, at 108-29 (1990).
19. Article 29 Data Prot. Working Party, Opinion 05/2012 on Cloud Computing 17, (EC) No. 01037/12, WP 196 (July 1, 2012), available at http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinion-recommendation/files/ 2012/wp196-en.pdf.
20. See THOMAS H. DAVENPORT & JEANNE G. HARRIS, COMPETING ON ANALYTICS 7 (2007) (describing analytics as "the extensive use of data, statistical and quantitative analysis, explanatory and predictive models, and fact-based management to drive decisions and actions").
21. For a discussion of the rise of analytics, see Paul M. Schwartz, Privacy, Ethics, and Analytics, IEEE SECURITY & PRIVACY, May/June 2011, at 66, 66-69.
22. INST. of MED. of THE NAT'LACADS., BEYON D THE HIPAA PRIVACY RULE: ENHANCING PRIVACY, IMPROVING HEALTH THROUGH RESEARCH 112 (Sharyl J. Nass et al. eds., 2009).
23. Id. at 113. For example, through analysis of the records of a cohort of 9000 breast cancer patients, scientists were able to identify the HER-2 oncogene. Scientists then developed a targeted therapy, Herceptin, that is effective for women with HER-2 breast cancer. Id. at 114. In another major research effort, started in 2003, "the National Institutes of Health, the Food and Drug Administration, the drug and medical-imaging industries, universities and nonprofit groups joined in ⋯ a collaborative effort to find the biological markers that show the progression of Alzheimer's disease in the human brain." Gina Kolata, Rare Sharing of Data Led to Results on Alzheimer's, N.Y. TIMES, Aug. 13, 2010, at A1. The key element of the project was the commitment of participants to share all the data from it with the public. The New York Times observed, "The key to the Alzheimer's project was an agreement as ambitious as its goal: ⋯ to share all the data, making every single finding public immediately, available to anyone with a computer anywhere in the world." Id.
24. Peter Jaret, Mining Electronic Records for Revealing Health Data, N.Y. TIMES, Jan. 15, 2013, at D1.
25. See David C. Kaelber et al., Patient Characteristics Associated with Venous Thromboembolic Events: A Cohort Study Using Pooled Electronic Health Record Data, 19 J. AM. MED. INFORMATICS ASS'N 965 (2012).
26. Id. at 972; see Bradley A. Malin et al., Biomedical Data Privacy: Problems, Perspectives, and Recent Advances, 20 J. AM. MED. INFORMATICS ASS'N 2, 5 (2013) ("[N]ew computing infrastructures and high-throughput technologies are creating new challenges to privacy that the biomedical community will need to handle in the not too distant future.").
27. See, e.g., ARBEITSKREISE TECHNIK UND MEDIEN DER KONFERENZ DER DATENSCHUTZBEAUFTRAGTEN DES BUNDES UND DER LÄNDER, ORIENTIERUNGSHILFE - CLOUD COMPUTING [WORKING GRPS. of THE TECH. AND MEDIA CONF. of DATA PROT. COMMR'S OF THE FED. & STATE GOV'TS, GUIDANCE - CLOUD COMPUTING] 4 (ver. 1.0, Sept. 26, 2011);
28. Rama Ramaswami & Dian Schaffhauser, What Is the Cloud?, CAMPUSTECHNOLOGY (Oct. 31, 2011), http://campustechnology.com/articles/2011/10/ 31/what-is-the-cloud.aspx.
29. INTEL, SECURITY IN THE CLOUD: INTEL XEON PROCESSOR E5-4600/2600/2400/1600 (2012), available at http://www.intel.com/content/dam/doc/solution-brief/cloud- computing-security-in-the-cloud-brief.pdf.
30. See Salesforce Product Overview, SALESFORCE, http://www.salesforce.com/ products (last visited Apr. 10, 2013).
31. On the rise of Salesforce, see the account of its founder, MARC R. BENIOFF & CARLYE ADLER, BEHIND THE CLOUD: THE UNTOLD STORY OF HOW SALESFORCE.COM WENT FROM IDEA TO BILLION-DOLLAR COMPANY - AND REVOLUTIONIZED AN INDUSTRY (2009).
32. See generally LEE BADGER ET AL., NAT'L INST. of STANDARDS & TECH., U.S. DEP'T OF COMMERCE, SPECIAL PUB. NO. 800-146, CLOUD COMPUTING SYNOPSIS AND RECOMMENDATIONS §§ 6.2-3 (2012), available at http://www.nist.gov/ customcf/get-pdf.cfm?pub-id=911075.
33. See id. at 214-16. This service can also permit "dynamic scaling" to permit immediate access to more resources as well as a "pay-as-you-go" approach to pricing. Id. at 220. Technically, such immediate response to greater demand poses a range of interesting challenges for computer scientists. Luis M. Vaquero et al., Dynamically Scaling Applications in the Cloud, COMPUTER COMM. REV., Jan. 2011, at 45, 48-49.
34. Amazon Elastic Compute Cloud (Amazon EC2), AMAZON WEB SERVICES, http://aws.amazon.com/ec2 (last visited Apr. 10, 2013).
35. Demsetz characterizes "firm-like coordination" as consisting of "[s]pecialization, continuity of association, and reliance on direction" as opposed to "self-sufficiency and spot markets" for activities outside of the enterprise. Harold Demsetz, The Theory of the Firm Revisited, in THE NATURE OF THE FIRM, supra note 6, at 159, 171.
36. DANIEL J. SOLOVE & PAUL M. SCHWARTZ, INFORMATION PRIVACY LAW 1110 (4th ed. 2011).
37. See Paul M. Schwartz, Preemption and Privacy, 118 YALE L.J. 902, 908-16 (2009).
38. See, e.g., 20 U.S.C. § 1232g (2006) (providing for family educational and privacy rights); 18 U.S.C. § 2710 (creating a civil action to redress the "[w]rongful disclosure of video tape rental or sale records"); Privacy of Individually Identifiable Health Information, 45 C.F.R. pt. 164, subpt. E (2012).
39. See U.S. DEP'T OF HEALTH, EDUC. & WELFARE, RECORDS, COMPUTERS, AND THE RIGHTS OF CITIZENS 50 (1973) (proposing a regulation to define "fair information practice").
40. On the historical role of the Department of Health, Education & Welfare's report, see DAVID H. FLAHERTY, PROTECTING PRIVACY IN SURVEILLANCE SOCIETIES 306 (1989).
41. Paul M. Schwartz, Privacy and Democracy in Cyberspace, 52 Vand. L. REV. 1609, 1614 (1999). The precise content of the resulting obligations will often differ based on the context of data processing, the nature of the information collected, and the specific legislative, regulatory, and organizational environment in which the rules are formulated.
42. See Graham Greenleaf, The Influence of European Data Privacy Standards Outside Europe: Implications for Globalization of Convention 108, 2 INT'L DATA PRIVACY L. 68, 72-79 (2012) (charting the influence of the EU Directive of 1995 on data protection laws across the world).
43. FTC, PROTECTING CONSUMER PRIVACY IN AN ERA OF RAPID CHANGE: A PROPOSED FRAMEWORK FOR BUSINESSES AND POLICYMAKERS, at iii (2010). For a description and critique of this model, see id. at 19-21 ("[C]onsumers face a substantial burden in reading and understanding privacy policies and exercising the limited choices offered to them."); and Schwartz, supra note 62, at 1621-35 ("[M]ost people are unable to control, and are often in ignorance of, the complex processes by which their personal data are created, combined, and sold.").
44. For a description of the EU model of FIPs, see CHRISTOPHER KUNER, EUROPEAN DATA PROTECTION LAW ch. 2 (2d ed. 2007).
45. While there is no such formal legal requirement, an increasing number of leading U.S. companies have sophisticated privacy management programs, including a Chief Privacy Officer. See Kenneth A. Bamberger & Deirdre K. Mulligan, Privacy on the Books and on the Ground, 63 STAN. L. REV. 247, 261-63 (2011). These processes are not the formal equivalent, however, of EU-style FIPs.
46. Such a proposal was included, however, in an early draft of the bill that later became the Privacy Act of 1974. See S. 3418, 93d Cong. § 201(a)(6) (1974), reprinted in S. COMM. ON GOV'T OPS. & HOUSE COMM. ON GOV'T OPS., SUBCOMM. ON GOV'T INFO. & INDIVIDUAL RIGHTS, 94TH CONG., LEGISLATIVE HISTORY OF THE PRIVACY ACT OF 1974, at 14 (Comm. Print 1976). On outsourcing to India and privacy concerns, see SOLOVE & SCHWARTZ, supra note 55, at 1161-63.
47. Federal environmental law even sometimes grants one state a special regulatory power; this phenomenon permits one state to serve as a "superregulator." Ann E. Carlson, Iterative Federalism and Climate Change, 103 NW. U. L. REV. 1097, 1107-14 (2009) (explaining California's role as a "superregulator" for mobile source emissions).
48. CAL. CIV. CODE § 1798.81.5(b) (West 2009).
49. See, e.g., TEX. BUS. & COM. CODE ANN. § 72.004 (West 2009);
50. WASH. REV. CODE ANN. § 19.215.020 (West 2007);
51. see also DANIEL J. SOLOVE & PAUL M. SCHWARTZ, PRIVACY LAW FUNDAMENTALS 182-83 (2d ed. 2013) (reviewing state data disposal statutes).
52. On the differing EU and U.S. approaches to data protection, and for an argument that EU officials are operating at a higher speed in modernizing their laws, see Natasha Singer, An American Quilt of Privacy Laws, Incomplete, N.Y. TIMES, Mar. 31, 2013, at BU1.
53. See CAL. CIV. CODE § 1798.29(a).
54. Antonis Patrikios, Application of the Law, in EUROPEAN PRIVACY: LAW AND PRACTICE FOR DATA PROTECTION PROFESSIONALS 65, 67 (Eduardo Ustaran ed., 2012).
55. For an official list of all the national legislation enacted by EU member states to conform with the 1995 Data Protection Directive, see National Execution Measures, EUR-LEX, http://eurlex.europa.eu/LexUriServ/LexUriServ.do? uri=CELEX:71995L0046:EN:NOT (last visited Apr. 10, 2013).
56. Regarding the drawn-out process of the enactment and amendment of national data protection law to conform with the Directive, and the remaining differences between the national laws, see Spiros Simitis, Einleitung: Geschichte - Ziele - Prinzipien, in NOMOS KOMMENTAR: BUNDESDATENSCHUTZGESETZ [NOMOS COMMENTARY: FEDERAL DATA PROTECTION ACT] 169-70 (Spiros Simitis ed., 7th ed. 2011). Thus, even after harmonization, differences can remain in the laws of member states. For the purposes of this Article, however, it will be enough to concentrate on the Directive's approach.
57. See Christopher Kuner, The European Commission's Proposed Data Protection Regulation: A Copernican Revolution in European Data Protection Law, 11 PRIVACY & SECURITY L. REP. 215, 216 (2012).
58. Article 29 Data Prot. Working Party, Opinion 1/2010 on the Concepts of "Controller" and "Processor," WP 169, (Feb. 16, 2010), at 4 (emphasis omitted), available at http://ec.europa.eu/justice/policies/privacy/ docs/wpdocs/2010/wp169-en.pdf.
59. See W. Kuan Hon et al., Who Is Responsible for 'Personal Data' in Cloud Computing? - The Cloud of Unknowing, Part 2, 2 INT'L DATA PRIVACY L. 3 (2012).
60. In this regard, the Article 29 Working Party is less than helpful in its analysis, which simply finds that "there may be situations in which a provider of cloud services may be considered either as a joint controller or as a controller in their own right depending on concrete circumstances." Article 29 Data Prot. Working Party, supra note 21, at 8. For some advice from an international privacy lawyer on how a service provider can remain in the role of a data processor and keep its customer in the role of the controller, see Lothar Determann, Data Privacy in the Cloud - Myths and Facts, PRIVACY L. & BUS. INT'L REP., Feb. 2013, at 17, 20 (Myth 10).
61. Joel R. Reidenberg, Technology and Internet Jurisdiction, 153 U. PA. L. REV. 1951, 1953 (2005).
62. Article 29 Data Prot. Working Party, Working Document, Privacy on the Internet - An Integrated EU Approach to On-line Data Protection 28, WP 37 (Nov. 21, 2000), available at http://ec.europa.eu/justice/policies/privacy/docs/ wpdocs/2000/wp37en.pdf.
63. See, e.g., Kuner, supra note 85, at 215, 217; Katerina Linos, How Can International Organizations Shape National Welfare States?, 40 COMP. POL. STUD. 547, 562 (2007).
64. Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions: A Comprehensive Approach on Personal Data Protection in the European Union, at 5, COM (2010) 609 final (Oct. 4, 2010).
65. Proposed Data Protection Regulation, supra note 4, art. 3(2), at 41. An amendment to the Proposed Data Protection Regulation from the EU Parliament would further broaden both requirements. It makes clear that jurisdiction applies even if the "offering of goods and services" is free of charge. It further alters the wording of the language regarding monitoring of behavior to "the monitoring of such data subjects." This proposed amendment is intended to extend the regulation to not only "the monitoring of the behaviour of Union residents by data controllers outside of the Union, such as through internet tracking, but all collection and processing of personal data about Union residents." Draft Report on the Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individual with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation) (COM(2012)0011 - C7-0025/2012 - 2012/0011(COD)), No. PR\922387EN.doc, amend. 83, at 63/215 (Jan Philipp Albrecht rptr., Dec. 17, 2012), available at http://www.europarl.europa.eu/meetdocs/ 2009-2014/documents/libe/pr/922/922387/922387en.pdf; see also id. amend. 82, at 63/215.
66. Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), art. 57(2)(a), at 78, version 56 (Nov. 29, 2011) [hereinafter Interservice Draft], available at http://statewatch.org/news/2011/dec/eu-com-draft-dp-reg-inter- service-consultation.pdf.
67. Council Directive 95/46, supra note 2, art. 2(a), at 38. EU data protection law treats "identifiied" and "identifiable" as equivalent. Paul M. Schwartz & Daniel J. Solove, The PII Problem: Privacy and a New Concept of Personally Identifiable Information, 86 N.Y.U. L. REV. 1814, 1874 (2011).
68. Ulrich Dammann, Weitere Begriffsbestimmungen, in NOMOS KOMMENTAR: BUNDES-DATENSCHUTZGESETZ, supra note 84, § 3, marginal no. 22.
69. Jennifer Valentino-Devries & Jeremy Singer-Vine, They Know What You're Shopping For, WALL ST. J., Dec. 8-9, 2012, at C1.
70. Loi 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, JOURNAL OFFICIEL DE LA REPUBLIQUE FRANÇAISE [J.O.] [OFFICIAL GAZETTE OF FRANCE], Jan. 7, 1978, p. 227.
71. Samuel J. Palmisano, The Globally Integrated Enterprise, FOREIGN AFF., May/June 2006, at 127, 129.
72. See John G. Spooner & Michael Kanellos, IBM Sells PC Group to Lenovo, CNET (Dec. 8, 2004), http://news.cnet.com/ibm-sells-pc-group-to-lenovo/2100- 1042-3-5482284.html (quoting Palmisano's description of the sale as an opportunity in the "rapidly changing information technology industry");
73. Steven Musil, Lenovo Completes Buy of IBM's PC Business, CNET (May 1, 2005), http://news.cnet.com/2100-1042-3-5691487.html.
74. IBM, IBM, LINKEDIN, http://www.linkedin.com/company/ibm (last visited Apr. 10, 2013).
75. Bridget van Kralingen, IBM's Transformation - From Survival to Success, FORBES.COM (July 7, 2010), http://www.forbes.com/2010/07/07/ibm-transformation- lessons-leadership-managing-change.html.
76. Robert Plant, To Cloud, or Not to Cloud, WALL ST. J., Apr. 25, 2011, at R9.
77. See Cade Metz, Intel Confirms Decline of Server Giants HP, Dell, and IBM, WIRED (Sept. 12, 2012), http://www.wired.com/wiredenterprise/2012/09/29853.
78. Case C-101/01, Inre Lindqvist, 2003 E.C.R. I-12992, available at http://curia.europa.eu/juris/showPdf.jsf?text=&docid=48382&pageIndex= 0&doclang=EN.
79. See, e.g., Joined Cases C-585/08 & C-144/09, Pammer v. Reederei Karl Schlüter GmbH & Co. KG, 2010 E.C.R. I-12520, I-12584, para. 29, I-12589, para. 47 (determining whether the operation of a website could be considered activity "directed to" a member state).
80. The opinion is available online in the original German at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:62008CJ0585:DE:PDF, as well as in English, at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri= CELEX:62008CJ0585:EN:HTML.
81. For a discussion of these concepts in the context of analytics, see Paul M. Schwartz, Data Protection Law and the Ethical Use of Analytics, 10 PRIVACY & SECURITY L. REP. 70 (2011).
82. See, e.g., MICHAEL BARRETT & DAN LEVY, PAYPAL, A PRACTICAL APPROACH TO MANAGING PHISHING § 4.1 (2008), available at https://www.paypal-media. com/assets/pdf/fact-sheet/a-practical-approach-to-managing-phishing-april-2008. pdf (suggesting that servers should reject "unsafe browsers" that do not block phishing sites).
83. Id. at 1880. On the importance of enforcement interests, see Schwartz, supra note 62, at 1677-79. For a discussion of the historical background of and variations in FIPs, see Paul M. Schwartz, The EU-U.S. Privacy Collision: A Turn to Institutions and Procedures, 126 HARV. L. REV. 1966, 1969-79 (2013).
84. See Google's New Privacy Policy: Incomplete Information and Uncontrolled Combination of Data Across Services, COMMISSION NATIONALE DE L'INFORMATIQUE ET DES LIBERTES (Oct. 16, 2012), http://www.cnil.fr/english/news-and-events/news/ article/googles-new-privacy-policy-incomplete-information-and-uncontrolled- combination-of-data-across-ser (criticizing Google's new privacy policy as providing "insufficient information" and control to users).
85. Letter from Article 29 Data Protection Working Party to Mr. Page 2 (Oct. 16, 2012), available at http://www.cnil.fr/fileadmin/documents/en/20121016- letter-google-article-29-FINAL.pdf.
86. For Google's privacy policy, see Policy & Principles: Privacy Policy, GOOGLE, http://www.google.fr/intl/en/policies/privacy (last modified July 27, 2012).
87. For a criticism of Google's single privacy policy and its consolidation of the information it collects, see Pamela Jones Harbour, OpEd., The Emperor of All Identities, N.Y. TIMES, Dec. 19, 2012, at A35.
88. Letter from Peter Fleischer, Global Privacy Counsel, Google, to Isabelle Falque-Pierrotin, Présidente, Commission Nationale de l'Informatique et des Libertés 2 (Apr. 5, 2012), available at http://assets.sbnation.com/ assets/1045093/20120405-CNIL.pdf.
89. News: Google Privacy Policy: Six European Data Protection Authorities to Launch Coordinated and Simultaneous Enforcement Actions, COMMISSION NATIONALE DE L'INFORMATIQUE ET DES LIBERTES (Apr. 2, 2013), http://www.cnil.fr/english/news- and-events/news/article/google-privacy-policy-six-european-data-protection- authorities-to-launch-coordinated-and-simultaneo.
90. Eric Pfanner, Google Faces More Inquiries in Europe Over Privacy Policy, N.Y. TIMES, Apr. 3, 2013, at B4.
91. Claire Cain Miller, Google Tries a Correction for "Fat Fingers," N.Y. TIMES, Dec. 17, 2012, at B7; see also Harbour, supra note 174 (expressing "concern[] about Google's dominant role in data collection").
92. On the weaknesses of reliance on such take-it-or-leave-it terms, see generally MARGARET JANE RADIN, BOILERPLATE: THE FINE PRINT, VANISHING RIGHTS, AND THE RULE OF LAW (2013).
93. Ian Ayres, Default Rules for Incomplete Contracts, in 1 THE NEW PALGRAVE DICTIONARY OF ECONOMICS AND THE LAW 585, 585 (Peter Newman ed., 1998).
94. For a discussion of rules and standards in the context of voting technology, see Paul M. Schwartz, Voting Technology and Democracy, 77 N.Y.U. L. REV. 625, 655-67 (2002).
95. DAVID BRADSHAW ET AL., INT'L DATA CORP. (IDC), QUANTITATIVE ESTIMATES OF THE DEMAND FOR CLOUD COMPUTING IN EUROPE AND THE LIKELY BARRIERS TO UPTAKE 65 (July 13, 2012), available at http://ec.europa.eu/information-society/ activities/cloudcomputing/docs/quantitative-estimates.pdf.
96. See, e.g., FED. FIN. INSTS. EXAMINATION COUNCIL, OUTSOURCED CLOUD COMPUTING 3-4 (2012), available at http://ithandbook.ffiec.gov/media/153119/06- 28-12-external-cloud-computing-public-statement.pdf;
97. Modifications to the HIPAA Privacy Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act, 78 Fed. Reg. 5566 (Jan. 25, 2013) (to be codified at 45 C.F.R. pts. 160, 164).