“Exceptionalism” refers to the belief that a person, place, or thing is qualitatively different from others in the same basic category. Thus, some have spoken of America’s exceptionalism as a nation. Early debates about the Internet focused on the prospect that existing laws and institutions would prove inadequate to govern the new medium of cyberspace. Scholars have made similar claims about other areas of law.
The focus of this short essay is the supposed exceptionalism of privacy. Rather than catalogue all the ways that privacy might differ from other concepts or areas of study, I intend to focus on the narrow but important issue of harm. I will argue that courts and some scholars require a showing of harm in privacy out of proportion with other areas of law. Many also assume, counterintuitively, that the information industry somehow differs from virtually every other industry in generating no real externalities

Calo, Ryan

English

UW Law Digital Commons (University of Washington)

University of Washington School of LawUW Law Digital CommonsArticles Faculty Publications2014Privacy Harm ExceptionalismRyan CaloUniversity of Washington School of LawFollow this and additional works at: https://digitalcommons.law.uw.edu/faculty-articlesPart of the Privacy Law CommonsThis Article is brought to you for free and open access by the Faculty Publications at UW Law Digital Commons. It has been accepted for inclusion inArticles by an authorized administrator of UW Law Digital Commons. For more information, please contact cnyberg@uw.edu.Recommended CitationRyan Calo, Privacy Harm Exceptionalism, 12 Colo. Tech. L. J. 361 (2014), https://digitalcommons.law.uw.edu/faculty-articles/24   361 PRIVACY HARM EXCEPTIONALISM  RYAN CALO “Exceptionalism” refers to the belief that a person, place, or thing is qualitatively different from others in the same basic category. Thus, some have spoken of America’s exceptionalism as a nation.1 Early debates about the Internet focused on the prospect that existing laws and institutions would prove inadequate to govern the new medium of cyberspace. Scholars have made similar claims about other areas of law. The focus of this short essay is the supposed exceptionalism of privacy. Rather than catalogue all the ways that privacy might differ from other concepts or areas of study, I intend to focus on the narrow but important issue of harm. I will argue that courts and some scholars require a showing of harm in privacy out of proportion with other areas of law. Many also assume, counterintuitively, that the information industry somehow differs from virtually every other industry in generating no real externalities. I. Harm is a prerequisite to recovery in many contexts. For a plaintiff to recover in tort, for instance, she must almost always show damage of some kind. Many statutes require injury as an element.2 For the Federal Trade Commission to bring an action under its authority to protect consumers from unfair practice, the practice at issue must “cause or [be] likely to cause substantial injury to consumers.”3 But harm presents an especially acute challenge in the context of privacy. Courts generally demand that privacy plaintiffs show not just harm, but concrete, fundamental, or “special” harm before they can recover.4 Take the case of Doe v. Chao, in which the Supreme Court  1.  See SEYMOUR MARTIN LIPSET, AMERICAN EXCEPTIONALISM: A DOUBLE-EDGED SWORD 18 (W. W. Norton & Co. 1996) (citing ALEXIS DE TOCQUEVILLE, DEMOCRACY IN AMERICA 51 (Knopf 1948) (referring to America as “qualitatively” different from other nations)).  2.  E.g., Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 (2008). 3.  15 U.S.C. § 45(n) (2006).  4.  See Doe I v. Individuals, 561 F. Supp. 2d 249, 257 (D. Conn. 2008) (requiring privacy harm to be “special” in order to proceed anonymously); see also Privacy Act of 1974, 5 U.S.C. § 552a(g)(4)(a) (2010); 5 U.S.C. § 552a(g)(1)(d); Doe v. Chao, 540 U.S. 614 (2003); Fed.   362 COLO. TECH. L.J. [Vol. 12.2  confronted the question of whether the Privacy Act of 1974 requires a plaintiff to show “actual damages” before recovery.5 The Court held that the plaintiffs, whose social security numbers the government had sent to various unauthorized parties, had to show that the technical violation of the Act actually harmed them.6 They were not able to do so and the Court dismissed the case. This was a strange way to read the plain text. Where, as stipulated in Chao, the United States violates the relevant provisions of the statute, the Privacy Act says that “the United States shall be liable to the individual in an amount equal to the sum of actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000.”7 The natural way to read this language is that anyone whose data is released in contravention of the Act receives up to the actual damages that resulted, but at least $1,000. In fairness, the Privacy Act also requires that the government’s failure to comply with the Act must occur “in such a way as to have an adverse effect on an individual” to qualify for civil remedy.8 Maybe the social security numbers in Chao had no such effect. But Chao was not the last word on harm in the context of the Privacy Act. In 2012, the Supreme Court decided Federal Aviation Administration v. Cooper.9 At issue was whether a licensed pilot named Stanmore Cooper could sue the Social Security Administration for disclosing his human immunodeficiency virus (HIV) status to the Federal Aviation Administration in contravention of the Privacy Act. The consequence was “adverse,” to put too mildly: Cooper lost his job and was charged criminally. Nevertheless, and while acknowledging that the term “actual damages” “is sometimes understood to include non-pecuniary harm,” the Cooper Court adopted “an interpretation of ‘actual damages’ limited to pecuniary or economic harm.”10 Let me summarize the state of the law around the Privacy Act: A person who was abjectly humiliated by the widespread release of highly personal information by the government would be entitled to no  Aviation Admin. v. Cooper, 132 S. Ct. 1441, 1441 (2012). 5.  Doe, 540 U.S. at 614. 6.  Id. 7.  5 U.S.C. § 552a(g)(4)(a). 8.  5 U.S.C. § 552a(g)(1)(d).  9.  Cooper, 132 S. Ct. at 1441. 10.  Id. at 1453. In Vernon v. City of Los Angeles, the Ninth Circuit dismissed a similar claim in which the plaintiff, a police officer, lamented an “investigation” into whether his religious views affected his policing duties. The court held that the plaintiff lacked standing because any perceived harm did not amount to a “substantial” injury. 27 F.3d 1385, 1388-89, 1395 (9th Cir. 1994), cert. denied 513 U.S. 1000 (1994).  2014] PRIVACY HARM 363  compensation under Chao or Cooper. Whereas a person who suffered one dollar in damages due to a minor violation would recover a thousand dollars.11 A high threshold for privacy harm is not limited to the Supreme Court, or to courts in general. Legal scholars pose equally difficult challenges to their colleagues. A variety of scholars have made progress in theorizing and measuring privacy harm, lending the concept a structure and depth that meets or exceeds that of other subjective harms.12 But it never seems enough, as demonstrated by critiques ranging far across the ideological spectrum. Thus, for instance, libertarian Adam Thierer equates the search for privacy harm with the “quixotic” quest for harm to happiness.13 He concludes that without a showing of harm regulators should tread very lightly when it comes to information. Whereas feminist legal theorist Ann Bartow demands of Daniel Solove that his case for privacy harm furnish nothing short of “dead bodies” to establish the significance of the field.14 II. The (impossibly) high bar that some jurists and scholars expect privacy harm to overcome is suspicious for a few reasons. First, privacy is only one of a wide variety of contexts in which the harm is in some sense “ethereal.”15 The tort of assault—where the harm is the emotion of fear—dates back six and a half centuries.16 Today a wide variety of torts, from loss of consortium to intentional infliction of emotional distress, compensate emotional harm.17 Obviously there are line-drawing problems: courts worry about fraud, idiosyncrasy, and the lack of a limiting principle. That is why the tort of assault requires imminence. But this concern is at least analytically distinct from the question of whether the category of harm the plaintiff experienced is compensable.  11.  Can you think of a hypothetical, meanwhile, where a violation of the Privacy Act would result in concrete pecuniary harm of this variety? Recall that Mr. Cooper himself lost his pilots’ license and therefore his entire livelihood.  12.  E.g., M. Ryan Calo, The Boundaries of Privacy Harm, 86 IND. L.J. 1131 (2011); Danielle Keats Citron, Reservoirs of Danger: The Evolution of Public and Private Law at the Dawn of the Information Age, 80 S. CAL. L. REV. 241 (2007); Paul Ohm, Branding Privacy, 97 MINN. L. REV. 907 (2013). 13.  Adam Thierer, The Pursuit of Privacy in a World Where Information Control is Failing, 36 HARV. J.L. & PUB. POL’Y 409, 414–17 (2013). 14.  Ann Bartow, A Feeling of Unease About Privacy Law, 155 U. PA. L. REV. 52, 52 (2007). 15.  Nancy Levit, Ethereal Torts, 61 GEO. WASH. L. REV. 136, 139 (1992). 16.  I de S et Ux. v. W de S, Y.B. 22 Edw. 3, fol. 99, pl. 60 (1348). How the harm of unhappiness is any less quixotic than the harm of fear eludes me.  17.  See Levit, supra note 15, at 140–58 (discussing examples).   364 COLO. TECH. L.J. [Vol. 12.2  Second, privacy harm exceptionalists disregard an option available to courts and regulators that care about privacy: they could simply assume harm upon a showing of violation. Because policymakers do assume harm sometimes. For instance, no showing of actual harm is necessary for the Federal Trade Commission to pursue a deceptive practice. We have decided that deceiving consumers is harmful in its own right. Moreover, some statutes set minimum damages precisely in order to sidestep the necessity of calculating the effect of a violation.18 I would argue that is exactly what Congress was up to with the Privacy Act, notwithstanding the Court’s interpretive calisthenics to the contrary. There is, finally, an even more basic and intuitive point to be made. In the history of the world, there has never been a multi-billion dollar industry that has not generated negative externalities: energy, finance, transportation, food, drugs, the list goes on. Every single one of them has imposed costs in the form of pollution, instability, physical injury, or side effects. No major human activity is without a downside. And yet, for some reason, quite a lot of people seem to hold the implicit belief that the online advertising or data broker industries are exceptional, rather than assume that the side-effect merely takes some time fully to materialize. Now that would be exceptional. III. The common law created four causes of action, the Congress wrote a statute, the FTC created a separate division, all for a reason. Yes, we should proceed cautiously in regulating information; I have argued so in the past.19 We need to be creative, as no single set of rules is likely to resolve the problems that information privacy generates. I am also wary of sweeping statements, like those famous words of Samuel Warren and Louis Brandeis, that emotional and spiritual harm is somehow a higher priority than broken bones or ruined property.20 But the wise and proper reaction to the ongoing illusiveness of privacy harm is not to require victims or scholars to move theoretical or evidentiary mountains before they see recovery (and with it deterrence). Rather, the appropriate reaction is to roll up one’s sleeves and figure out the nature of this harm as we’ve done with some many others.   18.  See, e.g., 17 U.S.C. § 504(c)(1)–(2) (2010) (providing for minimum damages of $200 or $750 for copyright infringement depending on the awareness of the infringer).  19.  M. Ryan Calo, Against Notice Skepticism in Privacy (And Elsewhere), 87 NOTRE DAME L. REV. 1027 (2012). 20.  Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193 (1890). 

Privacy Harm Exceptionalism

https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?article=1023&context=faculty-articles

Privacy Harm Exceptionalism

Abstract

Similar works

Full text

Available Versions

UW Law Digital Commons (University of Washington)