This post is part of a post series where we round up some of the interesting news and resources we’re finding.For a PDF version of this post, and for archived issues of previous posts, click here.
We became quite busy after the last update, so we’re a bit backlogged. We are catching up on developments late last year and we have a lot of material. We will release the next issue soon, as there is too much material to fit into this issue.
At first blush, it seems impossible for a person to sue for a HIPAA violation. HIPAA lacks a private cause of action. So do many other privacy and data security laws, such as FERPA, the FTC Act, the Gramm-Leach-Bliley Act, among others. That means that these laws don’t provide people with a way to sue when their rights under these laws are violated. Instead, these laws are enforced by agencies.
“It is a sexual violation. It’s disgusting. The law needs to be changed, and we need to change.” — Jennifer Lawrence on her nude photos being
non-consensually disclosed online
Fairly recently, Jennifer Lawrence’s iCloud account was hacked and her private nude photos were stolen and posted online. She was mortified.
Her case is just one of many, according to Professor Danielle Citron (University of Maryland School of Law), who very recently published a book about online harassment, Hate Crimes in Cyberspace (Harvard University Press 2014).
It is a compelling and provocative book. It is a bold book. And as the recent news stories indicate, it is a book that couldn’t be more timely and more needed. One might think that online harassment is rare. Who would write such mean and vile things? What kind of person would harass Zelda Williams, the daughter of Robin Williams, who was viciously attacked online immediately after her father’s death? Even Caligula would show more humanity.
If there’s a big data breach, the class action lawyers will start nipping like a bunch of hungry crocodiles. Upwards of forty separate lawsuits were filed against Target after its data breach, and one was filed the day after the breach became public knowledge.
The law, however, has thus far been far from kind to plaintiffs in data breaches. Most courts dismiss claims for lack of harm. I have written extensively about harm in a series of posts on this blog, and I have chided courts for failing to recognize harm when they should.