I recently published a short essay with Professor Danielle Citron critiquing the recent Supreme Court decision, TransUnion v. Ramirez(U.S. June 25, 2021) where the Court held that plaintiffs lacked standing to use FCRA’s private right of action to sue for being falsely labeled as terrorists in their credit reports.
Through the standing doctrine, the U.S. Supreme Court has taken a new step toward severely limiting the effective enforcement of privacy laws. The recent Supreme Court decision, TransUnion v. Ramirez(U.S. June 25, 2021) revisits the issue of standing and privacy harms under the Fair Credit Reporting Act (FCRA) that began with Spokeo v. Robins, 132 S. Ct. 1441 (2012). In TransUnion, a group of plaintiffs sued TransUnion under FCRA for falsely labeling them as potential terrorists in their credit reports. The Court concluded that only some plaintiffs had standing – those whose credit reports were disseminated. Plaintiffs whose credit reports weren’t disseminated lacked a “concrete” injury and accordingly lacked standing – even though Congress explicitly granted them a private right of action to sue for violations like this and even though a jury had found that TransUnion was at fault.
In this essay, Professors Daniel J. Solove and Danielle Keats Citron engage in an extensive critique of the TransUnion case. They contend that existing standing doctrine incorrectly requires concrete harm. For most of U.S. history, standing required only an infringement on rights. Moreover, when assessing harm, the Court has a crabbed and inadequate understanding of privacy harms. Additionally, allowing courts to nullify private rights of action in federal privacy laws is a usurpation of legislative power that upends the compromises and balances that Congress establishes in laws. Private rights of action are essential enforcement mechanisms.
Friday’s U.S. Supreme Court decision, TransUnion v. Ramirez(U.S. June 25, 2021), prompted me to release this cartoon about privacy harms that I created a while ago. In TransUnion, a group of plaintiffs sued TransUnion for falsely labeling them as potential terrorists in their credit reports. The Supreme Court held that only some plaintiffs had standing – those whose credit reports were disseminated. Plaintiffs whose credit reports weren’t disseminated lacked a “concrete” injury and accordingly lacked standing – even though Congress explicitly granted them a private right of action to sue for violations like this and even though a jury had found that TransUnion was at fault.
The TransUnion decision, authored by Justice Kavanaugh for a 5-4 majority, is wrong on so many levels. I wish the Supreme Court had read my recent article draft:
Danielle Keats Citron & Daniel J. Solove Privacy Harms forthcoming in B.U. L. Rev.
More background about the article is at my post here. I will write soon about the case.
The guide wisely avoids trying to rank programs, and it contains a lot of very useful information. But I think that law schools need criteria to evaluate the strength of their programs, so I developed this list below of the key components of what I would consider to be a strong program. I’ve written about this before, but I continue to hone my thinking. Below are my latest thoughts:
The inaugural issue of Privacy and Data Protection in Academia, A Global Guide to Curricula has just been released. This guide has information regarding privacy and data protection programs and courses offered at graduate schools, including law, computer science and business schools around the world. This information was based on a survey.
Some law schools with notable privacy faculty and course offerings are missing, but overall, this is a useful guide. After seeing all the schools that offer some form of curriculum in privacy law, it might be tempting to conclude that this is a success story. It isn’t. Although the field of privacy law has grown dramatically in past two decades, education in law schools about privacy law has significantly lagged behind. Most U.S. law schools lack a course on privacy law. Of those that have courses, many are small seminars, often taught by adjuncts. Of the law schools that do have a privacy course, most often just have one course. Most schools lack a full-time faculty member who focuses substantially on privacy law. Read my article called An Open Letter to Law School Deans about Privacy Law Education in Law Schools to learn more about my thoughts in this area.
It is a shame that the majority of law schools still lack even a course on privacy law. Some have occasional seminars taught by adjuncts.
Below is my law school’s listing in the Guide. Although GW offers a lot comparative to many other schools, I still think we have a long way to go.
At my event, the Privacy Law Salon, we have a wonderful tradition of showing some of the year’s funniest privacy videos after dinner. I thought I’d share some of the videos I have enjoyed the most, plus some new ones I recently found.
In Every time you try and go on a website, British comedian Stevie Martin engages in an absolutely hilarious dialogue with Lola-Rose Maxwell. The pacing of their back-and-forth is perfect.
When you forget your passwordis another brilliant video by Stevie Martin. The comedic timing is impeccable.
I had the great opportunity to interview Mahmood Sher-Jan about new developments in data incident response. Mahmood Sher-Jan, CHPC, is the Founder and CEO of RadarFirst, a company dedicated to applying innovation and software technology to address the growing data privacy and security challenges faced by organizations that maintain regulated personal data. He holds patents in incident management, fraud prevention, and secure identity solutions; Mahmood is the inventor of Radar, an award-winning and industry-leading incident response automation platform.
On May 28, 2021, at 9:30 AM Philippine time (Thursday, May 27 at 8:30 PM Eastern), I will be speaking about “The Myth of the Privacy Paradox” at the Philippines Privacy Week event put on by the Philippines National Privacy Commission (NPC).
My talk will be moderated by Jon Bello, a partner at Medialdea Bello and Suarez Law Offices.