Law and Tech Research feed - Mulligan http://law.berkeley.edu 11:12:55 -0400 09:00:00 -0400 New Governance, Chief Privacy Officers, and the Corporate Management of Information Privacy in the United States: An Initial Inquiry http://www.law.berkeley.edu/12072.htm http://www.law.berkeley.edu/12072.htm Wed, 21 Sep 2011 09:00:00 -0400 Privacy in the Smart Grid: An Information Flow Analysis
The two-way communication channel also supports remote control of appliances to manage load. The ability to remotely control in-home electricity use through controlling devices within the home raises new security and privacy issues.

The Smart Grid is developing rapidly. Smart Grid systems are generating, collecting, and processing information that is far more voluminous and revealing than traditional meter data. Decisions about how best to address the emerging privacy issues – whether through technical design, best practices, or regulation – lag behind development of the system infrastructure.

This report documents the Smart Grid information flows and considers the laws and agencies that protect, or could protect, privacy in this new technological landscape. Legal sources of privacy protection are highly varied, ranging from state public utilities commissions to the Federal Trade Commission. The extent and level of privacy protection depends critically upon the route information takes from source to destination. Though state utilities regulators have traditionally played a strong role in protecting customer privacy, like other regulators, their jurisdiction is limited. Changes in the architecture of the energy grid that create new data flows and empower new players to handle data threaten to render some privacy provisions obsolete and others ineffective. Given the proliferation of data, industry players, and usage models, new laws and privacy-protecting technical designs are necessary to afford privacy, comparable to that enjoyed today, to users of tomorrow’s energy network. Considering privacy upfront, rather than after technologies are deployed, will help build privacy protections into the Smart Grid while supporting other energy policy goals. ]]> http://www.law.berkeley.edu/11196.htm http://www.law.berkeley.edu/11196.htm Thu, 21 Apr 2011 09:00:00 -0400 Catalyzing Privacy: New Governance, Information Practices, and the Business Organization http://www.law.berkeley.edu/10060.htm http://www.law.berkeley.edu/10060.htm Tue, 02 Nov 2010 09:00:00 -0400 Privacy on the Books and on the Ground This Article presents findings from the first study of corporate privacy management in fifteen years, involving qualitative interviews with Chief Privacy Officers identified by their peers as industry leaders. Spurred by these findings, we present a descriptive account of privacy “on the ground” that upends the terms of the prevailing policy debate. This alternative account identifies elements neglected by the traditional story — the emergence of the Federal Trade Commission as a privacy regulator, the increasing influence of privacy advocates, market and media pressures for privacy-protection, and the rise of privacy professionals — and traces the ways in which these players supplemented a privacy debate largely focused on processes (such as notice and consent mechanisms) with a growing emphasis on substance: preventing violations of consumers’ expectations of privacy.

This “grounded” account should inform privacy reforms. While widespread efforts to expand consent mechanisms to empower individuals to control their personal information may offer some promise, those efforts should not proceed in a way that eclipses robust substantive definitions of privacy and the protections they are beginning to produce, or that constrains the regulatory flexibility that permits their evolution. This would destroy important tools for limiting corporate over-reaching, curbing consumer manipulation, and protecting shared expectations about the personal sphere on the Internet, and in the marketplace.

]]> http://www.law.berkeley.edu/10061.htm http://www.law.berkeley.edu/10061.htm Mon, 18 Oct 2010 09:00:00 -0400 The Magnificence of the Disaster: Reconstructing the Sony BMG Rootkit Incident The Article first addresses the market-based rationales that likely influenced Sony BMG's deployment of these DRM systems and reveals that even the most charitable interpretation of Sony BMG's internal strategizing demonstrates a failure to adequately value security and privacy. After taking stock of the then-existing technological environment that both encouraged and enabled the distribution of these protection measures, the Article examines law, the third vector of influence on Sony BMG's decision to release flawed protection measures into the wild, and argues that existing doctrine in the fields of contract, intellectual property, and consumer protection law fails to adequately counter the technological and market forces that allowed a self-interested actor to inflict these harms on the public.

The Article concludes with two recommendations aimed at reducing the likelihood of companies deploying protection measures with known security vulnerabilities in the consumer marketplace. First, Congress should alter the Digital Millennium Copyright Act (DMCA) by creating permanent exemptions from its anti-circumvention and antitrafficking provisions that enable security research and the dissemination of tools to remove harmful protection measures. Second, the Federal Trade Commission should leverage insights from the field of human computer interaction security (HCI-Sec) to develop a stronger framework for user control over the security and privacy aspects of computers.

]]> http://www.law.berkeley.edu/10138.htm http://www.law.berkeley.edu/10138.htm Fri, 15 Oct 2010 09:00:00 -0400 Privacy Issues of the W3C Geolocation API http://www.law.berkeley.edu/10062.htm http://www.law.berkeley.edu/10062.htm Wed, 24 Feb 2010 09:00:00 -0400 Inferring Personal Information from Demand-Response Systems http://www.law.berkeley.edu/10063.htm http://www.law.berkeley.edu/10063.htm Tue, 02 Feb 2010 09:00:00 -0400 Transactional Confidentiality in Sensor Networks http://www.law.berkeley.edu/10064.htm http://www.law.berkeley.edu/10064.htm Tue, 05 Aug 2008 09:00:00 -0400 Privacy Decisionmaking in Administrative Agencies Congress has recognized this problem. In the E-Government Act of 2002, it required administrative agencies to conduct privacy impact assessments (PIAs) when developing or procuring technology systems that handle personal information. Despite this new requirement, however, agency adherence to privacy mandates is highly inconsistent.

In this paper, we ask why. We first explore why both process requirements and traditional means of political oversight are often weak tools for ensuring that policy reflects privacy commitments. We then consider what factors might, by contrast, promote agency consideration of privacy concerns.

Specifically, we compare decisions by two federal agencies - the Department of State and the Department of Homeland Security - to use RFID technology, which allows a wireless-access data chip to be attached to or inserted into a product, animal, or person. These two cases suggest the importance of internal agency structure, culture, and personnel, as well as alternative forms of external oversight, interest group engagement, and professional expertise, as important mechanisms for ensuring bureaucratic accountability to the secondary privacy mandate imposed by Congress.

The analysis speaks to debates in both public administration and privacy protection. It implicates disputes over the efficacy of external controls on bureaucracy, and the less-developed literature on opening the black box of administrative decisionmaking. It further offers insight into pre-conditions necessary to advance privacy commitments in the face of social and bureaucratic pressure to manage risk by collecting information about individuals. Finally, it offers specific proposals for policy reform intended to promote agency accountability to privacy goals.

]]> http://www.law.berkeley.edu/10137.htm http://www.law.berkeley.edu/10137.htm Thu, 13 Mar 2008 09:00:00 -0400 Taking the 'Long View' on the Fourth Amendment: Stored Records and the Sanctity of the Home http://www.law.berkeley.edu/10139.htm http://www.law.berkeley.edu/10139.htm Thu, 28 Feb 2008 09:00:00 -0400