“Senator, We Run Ads”: Advocating for a US Self-Regulatory Response to the EU General Data Protection Regulation

Category: Print Issues

“Senator, We Run Ads”: Advocating for a US Self-Regulatory Response to the EU General Data Protection Regulation

Stephanie Comstock Ondrof

Volume 28

, Issue 2

28 GEO. MASON L. REV. 815 (2021)

Introduction

“In truth, there is only one remedy for the violations of the right to privacy within the reach of the American public, and that is but an imperfect one. It is to be found in attaching social discredit to invasions of it . . . . At present this check can hardly be said to exist. It is to a large extent nullified by the fact that the offence is often pecuniarily profitable.”¹

Orrin Hatch, Senator: “How do you sustain a business model in which users don’t pay for your service?”

Mark Zuckerberg, CEO of Facebook, Inc.: “Senator, we run ads.”

Hatch: “I see. That’s great.”²

Nineteenth century remarks and a twenty-first century exchange on the Senate floor demonstrate that observers have viewed and continue to view US data privacy³ as a trade-off between personal liberty and corporate profit. Prescient for his time, E.L. Godkin, editor-in-chief of the New York Evening Post, announced an “imperfect” remedy⁴ for data privacy violations that remains elusive to this day. Following the 2018 Cambridge Analytica scandal,⁵ the Federal Trade Commission (“FTC”) fined Facebook, Inc. an unprecedented $5 billion—the largest fine issued in the agency’s history.⁶ But agency experts,⁷ politicians,⁸ and the press⁹ remain skeptical that the massive fine—nine percent of Facebook’s 2018 revenue¹⁰—will incentivize Facebook, or any other similarly situated technology company, to adjust a business model built on harvesting, aggregating, and using consumer data.¹¹ And as the recent exchange between Senator Hatch and Mr. Zuckerberg illustrates, Congress may lack the expertise necessary to effectively address data privacy.

Continuing a legacy of privacy protections against private entities,¹² the European Union—following recommendations from the European Data Protection Supervisor,¹³ the European Commission,¹⁴ and the Article 29 Working Party¹⁵—enacted omnibus legislation protecting EU citizens’ fundamental right to personal data privacy.¹⁶ European law protects all personal data that can identify an individual: names, locations, online identifiers, and other factors specific to a person’s “physical, physiological, genetic, mental, economic, cultural or social identity.”¹⁷ This legislation applies to data controllers and processors, both of which include private corporations.¹⁸

The United States has a markedly different approach to personal data protection laws applying to private corporations. With the exception of a handful of industry-specific federal statutes,¹⁹ most data protection regulations applying to corporations originate at the state level.²⁰ And responding to massive data breaches,²¹ state legislatures have begun to craft—and pass—trans-jurisdictional data privacy bills regulating corporate use of personal information.²² These bills²³ set forth broad rights for consumers (e.g., accessing data shared with third parties²⁴ and private causes of action²⁵) and obligations for corporations (e.g., prohibiting discrimination against consumers who exercise rights under the bills²⁶ and restricting the ability to process consumer data²⁷). But despite their similarities, the bills use different definitions²⁸ and assign different penalties,²⁹ generating widespread confusion about compliance and enforcement.³⁰

Inspired in part by the European Union’s General Data Protection Regulation (“GDPR”), state data privacy legislation threatens to both consolidate markets among large firms capable of complying with regulations and impose contradictory standards on technology- and internet-based industries that span jurisdictions and are critical to the US economy.³¹ This Comment proposes a regulatory solution to address personal data privacy concerns within the construct of technology companies’ business practices. The solution contemplates a self-regulatory body that would: (1) promulgate industry standards; (2) differentiate between large and small internet-based businesses; and (3) foster increased transparency surrounding the use of consumer data.

By deferring to businesses, the self-regulatory solution responds to the GDPR without curbing either innovation or economic growth—both of which have since plagued the European Union. Instead, the proposed solution leaves the path forward in the hands of those who are most familiar with the technology and operate within the borderless industry. The solution also leaves enforcement to the FTC—the body tasked with adjudicating violations of existing privacy laws. The solution’s ex ante self-regulatory parameters and ex post federal enforcement mechanism strikes a balance lacking in the two major proposals—comprehensive federal legislation and “patchwork” state legislation—for personal data privacy protections.

The Comment proceeds in four parts. Part I addresses the origins of data privacy laws in the United States: beginning with academic elucidations of a new common law right and extending to congressional legislation across different sectors. Part II then discusses the internet’s impact on consumer data privacy. Beyond its remarkable effect on global business, the internet has also facilitated companies’ greater access to consumer data, often without consumers’ full awareness. Part III presents two different regulatory responses to the internet’s ubiquity and corresponding threat to consumer data privacy: European omnibus legislation and US state-based patchwork legislation. Finally, Part IV articulates an alternative to the omnibus and patchwork responses: self-regulation. It describes models of successful self-regulatory bodies and lays out potential factors a newly formed body of industry-leading companies could consider to serve both consumer and corporate interests.

I. History of and Developments in US Privacy Law

Since the nineteenth century, state common and statutory laws have primarily regulated data privacy³² with the exception of a few federal statutes regulating specific industries.³³ This Part surveys data privacy law’s evolution in the United States by examining its nineteenth century origins, twentieth century developments particular to the Supreme Court’s Fourth Amendment jurisprudence, and contemporary patchwork of federal and state statutes.

A. As Provided by the Common Law

The concept of legally protected data privacy in the United States emerged from the hands of attorney Samuel Warren and then-Judge Louis Brandeis. Responding to the advent and marked increase in the use of commercial photography, Warren and Brandeis published The Right to Privacy in 1890.³⁴ The authors’ work evaluated the common law’s capacity to adapt to social developments—for example, expanding the reach of torts to reputational injuries given society’s increased recognition of emotional harms.³⁵ Just so, Warren and Brandeis urged a new common law right—the right “to be let alone.”³⁶ The authors asserted that this right was essential to preserve an individual’s interest in solitude and privacy.³⁷ And though the authors analogized this interest to the interests recognized in common law torts of trespass and battery, Warren and Brandeis also argued that the right to be let alone had an inviolate personality as a “right[] as against the world.”³⁸

This newly articulated right, while expansive, was not unlimited. Warren and Brandeis set forth six exceptions,³⁹ two of which are particularly relevant to personal data privacy. First, the authors stated that the right to be let alone would not extend to matters in the public interest.⁴⁰ To balance collective and individual interests, disclosures in the public interest would not face liability.⁴¹ For example, the public could scrutinize a political candidate’s private affairs to determine her worthiness for office—the right to be let alone would then not apply.⁴² Second, the authors stated that the right to be let alone would not extend to matters to which the individuals had consented to release.⁴³ For example, opposing counsel could evaluate a defendant’s conversations following his waiver of attorney-client privilege—the right to be let alone would then, again, not apply.⁴⁴

Shortly after Warren and Brandeis’s article, state legislatures and courts began recognizing individuals’ data privacy interests. In 1903, New York passed a privacy statute providing a cause of action in tort for privacy violations.⁴⁵ In 1905, the Georgia Supreme Court recognized a common law tort of privacy invasion, reasoning that a right to privacy is based “in the instincts of nature . . . recognized intuitively.”⁴⁶ Other states affirmatively included the right to privacy in their constitutions.⁴⁷ In 1960, Dean William Prosser surveyed state court privacy decisions after the Warren and Brandeis article.⁴⁸ Dean Prosser divided the cases into four categories: (1) intrusion upon seclusion;⁴⁹ (2) public disclosure of embarrassing, private facts;⁵⁰ (3) publicity placing one in a false light;⁵¹ and (4) appropriation of one’s image or likeness.⁵² The Restatement of Torts adopted Dean Prosser’s typology, recognizing such torts collectively as “invasion of privacy.”⁵³ While many state courts accepted all four privacy torts, they did so at different points and to varying degrees (only North Dakota has yet to recognize any of the four common law privacy torts).⁵⁴

As common law privacy torts became more widely recognized, the duty of protecting and interpreting the “right to be let alone” fell primarily on state legislatures and courts. Yet the federal judiciary separately and concurrently interpreted data privacy interests under the Constitution; as particularly relevant for this Comment, the Supreme Court addressed the constitutionality of emerging technologies—and the threat they imposed to personal data privacy—in the hands of law enforcement.

B. As Against the Government: The Fourth Amendment

The Fourth Amendment to the Constitution—aimed at preventing unreasonable searches and seizures—provides, in pertinent part: “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.”⁵⁵ The Supreme Court has interpreted the objects to which the Fourth Amendment applies in light of the meaning the Founders ascribed to the Amendment at ratification.⁵⁶ Since ratification, however, the scope of the Amendment’s protections has significantly broadened with law enforcement’s use of electronic surveillance.⁵⁷

Beginning in the 1920s, the Court adhered to a trespass-centric view of the Fourth Amendment. In Olmstead v. United States,⁵⁸ the Court held that law enforcement’s tapping of an individual’s phone lines was not a search because the agents did not physically invade the individual’s property.⁵⁹ Yet such interpretations were not without opposition. A strong dissent, penned by then-elevated Justice Brandeis, presciently stated that “[t]he progress of science in furnishing the government with means of espionage is not likely to stop with wire tapping.”⁶⁰ He urged the Court to recognize the Founders’ intent to secure for citizens “the right to be let alone—the most comprehensive of rights . . . every unjustifiable intrusion by the government upon the privacy of the individual, whatever the means employed, must be deemed a violation of the Fourth Amendment.”⁶¹

While the Court adhered to its trespass-based understanding of the Fourth Amendment for the next four decades, the advent of more sophisticated technology altered the understanding. In Katz v. United States,⁶² the Court reconsidered its Fourth Amendment jurisprudence, concluding that its myopic focus on trespass could no longer completely control.⁶³ In Katz, government agents—without a warrant—attached an electronic listening device to a public phone booth.⁶⁴ Though the Court explicitly rejected the proposition that the Constitution provides a right to privacy—maintaining that any such right is left to the states—it held that the Fourth Amendment does protect people and what they seek to keep private.⁶⁵ The Court concluded that the government’s warrantless use of electronic listening devices violated the Fourth Amendment.⁶⁶

The lasting impact of Katz lies within Justice Harlan’s concurrence and its two-pronged “reasonable expectation of privacy”⁶⁷ test, which determines what privacy interests the Fourth Amendment protects. To receive Fourth Amendment protection under Justice Harlan’s test, an individual must (1) manifest a subjective expectation of privacy over the relevant information, and that subjective expectation must (2) be one that society recognizes as reasonable.⁶⁸ As applied to the facts in Katz, Justice Harlan noted that when Katz closed the phonebooth door and paid to place a call, he subjectively manifested his expectation to have a private, undisturbed conversation.⁶⁹ Justice Harlan then determined that society deemed Katz’s expectation reasonable.⁷⁰ Justice Harlan’s concurrence became an additional analytical vehicle—beyond the trespass-centric approach—through which the Court assessed subsequent technology-based “searches” under the Fourth Amendment.⁷¹

A significant limit to the “reasonable expectation of privacy” test—voluntary disclosure—arose from one of Warren and Brandeis’s original limits to the right to be let alone. In Smith v. Maryland,⁷² the Court considered whether attaching a pen register to a phone line was a search under the Fourth Amendment.⁷³ The Court differentiated the capabilities of pen registers in Smith from the capabilities of listening devices in Katz.⁷⁴ Relying on its prior decision in United States v. Miller,⁷⁵ the Court held that individuals do not retain an expectation of privacy in information voluntarily conveyed to telephone companies.⁷⁶ The holdings in Smith and Miller established the “third-party doctrine”: when a sharer willingly provides information to a third party, the sharer loses his or her privacy expectation in that information.⁷⁷

Continued technological development defined many of the cases that the Court subsequently considered under the Fourth Amendment. Information that law enforcement acquires often can and does fall within the third-party doctrine, removing it from Fourth Amendment protection.⁷⁸ Even so, some justices have expressed reservations about the extent to which the third-party doctrine should apply.⁷⁹ For example, in Carpenter v. United States,⁸⁰ the Court outlined factors leading to its conclusion that the warrantless access of cell-site location information was a Fourth Amendment search to which the third-party doctrine did not apply.⁸¹ The Court reasoned that individuals have a reasonable expectation of privacy in location information, noting that the information is “a detailed chronicle of a person’s physical presence compiled every day, every moment, over several years.”⁸²

Tracing the Court’s Fourth Amendment data-privacy-related jurisprudence provides a useful lens apart from state-based privacy torts to consider US data privacy law. And examining the advent of the Court’s Fourth Amendment reasonable expectation of privacy test provides a potential avenue to address the impact of technology on the reasonableness of privacy intrusions.⁸³ Even so, since the Fourth Amendment’s proscriptions run against the government, Congress is the appropriate actor to next consider in the evolution of US data-privacy law.

C. As Against Industries: A Patchy Statutory System

In addition to state common law and Supreme Court Fourth Amendment jurisprudence, Congress has actively legislated within the data privacy field. To secure reasonable protections for citizens and regulated entities, congressional data privacy legislation rests on five Fair Information Practice Principles: (1) notice and awareness; (2) choice and consent; (3) access and participation; (4) integrity and security; and (5) enforcement and redress.⁸⁴ As privacy issues have emerged, Congress has embraced a sectoral approach, promulgating individual statutes or subsections of statutes to proactively address or respond to public concerns.⁸⁵ For example, following the Court’s decision in Olmstead, Congress promulgated section 605 of the Federal Communications Act,⁸⁶ accepting the Court’s invitation to legislate on electronic surveillance.⁸⁷

Two statutes exemplify Congress’s methods of legislating and enforcing data privacy protections in particular industries. The first, the Health Insurance Portability and Accountability Act (“HIPAA”),⁸⁸ was not specifically passed to address data privacy concerns. Instead, because of HIPAA’s relatively narrow subject matter, Congress later delegated the promulgation of a specific data privacy rule to a federal administrative agency. By contrast, the second, the Children’s Online Privacy Protection Act (“COPPA”),⁸⁹ was specifically passed to address ongoing data privacy concerns. Despite the statutes’ differing origins, Congress left enforcement of both to federal agencies.

1. Health Insurance Industry: HIPAA

HIPAA provides minimum requirements for health data privacy in the United States. When Congress initially enacted HIPAA, it sought to streamline the transferability of employees’ healthcare coverage rather than specifically protect data privacy.⁹⁰ To that end, HIPAA established uniform codes to facilitate the information exchanges.⁹¹ In doing so, Congress noted the potential for data privacy concerns to arise.⁹² Instead of directly addressing the issue, Congress passed the act, giving itself two years to either address data privacy concerns or authorize the Department of Health and Human Services (“HHS”) to do so.⁹³

Years later, the HHS promulgated data privacy protections for health information. The agency issued its final version of HIPAA privacy regulations—the Privacy Rule⁹⁴— in December of 2000, and the regulations became effective in 2003.⁹⁵ The Privacy Rule “establishe[d], for the first time, a set of national standards for the protection of certain health information.”⁹⁶ It specifically covers personally identifiable health information.⁹⁷ The Privacy Rule applies to covered entities—namely, health plans, health care clearinghouses, and health care providers.⁹⁸ It protects oral and recorded information about a patient’s past, present, or future ailments.⁹⁹ Covered entities, schools, public health authorities, insurers, and employers can create this information.¹⁰⁰ The information must either identify the subject to whom it refers or create in others a reasonable basis for ascertaining the subject’s identity.¹⁰¹ And the relevant information retains its HIPAA protections as it passes from the hands of covered entities to other entities—covered or non-covered.¹⁰²

As enacted, the Privacy Rule assigned certain responsibilities to covered entities and regulated the use and disclosure of the protected information. For example, under the Privacy Rule, covered entities must adopt written privacy policies and provide accompanying training to employees.¹⁰³ And the Privacy Rule prohibits covered entities from disclosing protected health data without authorization.¹⁰⁴ The person to whom the records refer must authorize the disclosure in writing and indicate the recipients of the information.¹⁰⁵ The authorization must have an expiration date after which the recipient can no longer access the information.¹⁰⁶ Lastly, the Privacy Rule provides individuals with the opportunity to file a complaint alleging HIPAA violations with HHS.¹⁰⁷ In passing these provisions, Congress left a fair amount of enforcement and regulatory control to the states. Under HIPAA, states can craft data privacy laws regulating health information so long as those regulations are “more stringent” than those provided by the federal statute.¹⁰⁸

2. Online Advertising to Children: COPPA

A federal statute intended to protect data privacy, COPPA regulates the type of data online service providers can collect and retain from children.¹⁰⁹ Unlike its motivation for enacting HIPAA, Congress enacted COPPA to address concerns about the effect of increased internet access and internet advertising on children.¹¹⁰ In the years before COPPA, advertisers used “advergames” to present branded and gamified internet communications to children.¹¹¹ In exchange for a child’s personal data, companies offered sweepstakes and free games.¹¹² Psychological data indicated that children of certain ages were less likely to perceive content presented to them as advertisements.¹¹³

COPPA regulations are wide-reaching. The statute applies to “operator[s] of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child.”¹¹⁴ COPPA also applies to third-party sites operating on websites and establishes a strict liability regime on host websites for third-party violations.¹¹⁵ Personal information restricted under COPPA includes street, city, and state location data; email addresses; screen names; and “persistent identifier[s] that can be used to recognize a user over time and across different internet sites or online services.”¹¹⁶ With respect to prohibited methods of data collection, COPPA defines “collection” broadly, stating that it can occur “by any means”; the statute provides two, non-exhaustive examples: first, requesting online information, and second, providing a form that would make identifiable information publicly available.¹¹⁷ Websites subject to COPPA must provide privacy policies indicating the type of information the website collects and the use and disclosure of such information.¹¹⁸

COPPA’s broad language has hindered enforcement and generated confusion among regulated parties. COPPA explicitly indicates that it preempts state law.¹¹⁹ And while individuals are not provided a private cause of action for violations, states can sue for injunctive relief on behalf of their citizens.¹²⁰ Because the statute defines violations as unfair or deceptive practices, the FTC is charged with enforcement.¹²¹ But the FTC has minimal guidance on how to determine whether content is “directed to children.”¹²² One of the FTC’s recent COPPA enforcement actions, brought against Google and YouTube (both owned by Alphabet, Inc.), resulted in a $170 million settlement—the largest since COPPA’s enactment.¹²³ The complaint, filed by the FTC and the New York Attorney General, alleged that YouTube gathered identifiable information from children under thirteen years old without receiving parental consent.¹²⁴ The complaint alleged that some YouTube channels directly targeted children and that the company knew it would reach children.¹²⁵ The complaint further alleged that YouTube generated nearly $50 million in advertising on these child-targeted channels.¹²⁶ Under the terms of the settlement between YouTube, Google, and the FTC, the companies agreed to “create a mechanism” for publishers to indicate when their videos are “directed to children.”¹²⁷ Even after the settlement, widespread confusion about determining whether content was “directed to children” remained.¹²⁸

While these two statutes represent two different approaches to data privacy regulation—indirectly through subsequently enacted rules (HIPAA) and directly (COPPA)—both responded to relatively uniform demands for privacy regulation. With HIPAA, members of Congress recognized that health insurance legislation could jeopardize patients’ privacy. Similarly, with COPPA, members of Congress responded to the research of marketers, psychologists, and parents, all of whom encouraged data privacy protections for children. The parties to whom both regulations apply (healthcare providers and online service providers), the beneficiaries of the regulations (patients and children), and data regulated (health information and information about children) were fairly finite. Both data privacy regulations indicated broad agreement among members of Congress—and US citizens by proxy—that the country needed increased privacy protections in the two fields. By contrast, such broad agreement has yet to materialize within Congress and among US citizens about consumer data privacy.¹²⁹

II. Global Climate Precipitating Regulatory Changes

An understanding of the historical foundations of privacy law and the bodies that promulgate and enforce it provides necessary context to the increasingly technologized global landscape that demands some level of responsive data privacy regulation within the United States. This Part addresses the expansion in internet usage and surveys the efforts of technology companies to develop data-generating and free-to-consumer programs that run on such an architecture. Despite the economic growth that these programs have fostered, they have also contributed to concerns about the use and transfer of data collected. These concerns have culminated in the passage of the GDPR in the European Union and various state-based privacy laws in the United States.

A. The Internet’s Ubiquity and Economy of Information Sharing

Since the inception of the internet,¹³⁰ the world has evolved into a digital ecosystem of interconnectivity. The internet is pervasive: whereas in 2000, fifty-two percent of adults in the United States used the internet, ninety percent do so today.¹³¹ Smartphones capable of accessing the internet have become today’s essential tool; as of February 2019, eighty-one percent of the US population use them.¹³² Indeed, a recent study reveals that eighty-one percent of adults in the United States also go online at least once per day, with twenty-eight percent indicating that they are online “almost constantly.”¹³³

Widespread use of the internet has led to the emergence of the digital economy, “the digital-enabling infrastructure needed for an interconnected computer network.”¹³⁴ A recent United Nations report found that the US economy accounted for sixty-eight percent of the market capitalization value of the seventy largest digital platforms.¹³⁵ This report estimated 2017 e-commerce sales in the United States to be $8.9 billion, forty-six percent of the nation’s 2017 GDP.¹³⁶ And the digital economy has facilitated a borderless ecosystem of goods and services with firms operating across the nation and world.¹³⁷

Technology companies and consumers alike have benefitted from the internet’s ubiquity. Facebook and Google in particular have profited off increased internet use by offering free-to-consumer platforms and social media sites.¹³⁸ As Gigi Sohn, a Georgetown fellow, states, “the user is paying [Facebook and Google] with his or her personal data and receiving ‘free’ online services in return.”¹³⁹ While an estimated seventy-two percent of adults have an account on at least one social media platform,¹⁴⁰ the two most popular sites by percentage of adult users are Google’s YouTube (seventy-three percent) and Facebook (sixty-nine percent).¹⁴¹ Of those who use Facebook, seventy-four percent report that they check the website at least once per day.¹⁴²

Smartphone access to social media sites is facilitated in part by user-focused application programming interfaces (“APIs”).¹⁴³ APIs integrate third-party sites within host applications (“apps”) to create seamless user experiences.¹⁴⁴ On the front end, APIs enable user access to multiple sites.¹⁴⁵ For example, the integration of Amazon’s free Product Advertising API on the Weather Channel app enables users of the app to easily access Amazon sites for products. On the back end, APIs facilitate data sharing.¹⁴⁶ Amazon gains a wider pool of customers and data about those customers. The Weather Channel gains an additional source of revenue from users who buy Amazon products and limited access to Amazon data.¹⁴⁷

Data is a valuable asset crucial to a modern technology company’s financial success. In a May 2014 report, the FTC stated that “Big Data is big business.”¹⁴⁸ Just so, many large companies have business ventures dedicated exclusively to data brokering—the business of “selling information about companies, markets, [and consumers].”¹⁴⁹ Acxiom, a credit reporting agency, reports to have “multi-sourced insight into approximately 700 million consumers worldwide.”¹⁵⁰ Information can be public (from, for example, social media sites or government programs) or private (from, for example, APIs within apps).¹⁵¹ Companies like Acxiom splice and combine data into more than 1,500 demographic, socio-economic, and lifestyle segments.¹⁵² These segments are sold to marketers as audiences to which advertisements can be targeted.¹⁵³

Data sharing and buying has contributed to personalized advertising built on a user’s internet actions compiled in information-tracking cookies. Cookies are files stored on a user’s internet browser and contain data from a user’s visit to a website.¹⁵⁴ In the case of YouTube, the cookie may contain a user’s unique identification number and browsing habits on YouTube—videos the user watched, how long the user spent on a specific page, or subjects of interest to that user.¹⁵⁵ If this cookie is persistent, then each time the same user visits YouTube, the browser adds the user’s subsequent actions to that file.¹⁵⁶ YouTube can place its own first-party cookies on its site, just as other companies can place their own third-party cookies on YouTube; both cookies can access the same information and be used to better understand users’ online behavior.¹⁵⁷ These cookies use site actions to “nudge” users’ behavior, enabling advertisers to offer items that the particular user is statistically likely to be interested in or buy.¹⁵⁸ Given the extent to which companies have used cookies to fuel advertising,¹⁵⁹ consumer preference data contained in these cookies is valuable.

B. Privacy Threats from Online Practices

While some remain confused about how companies profit off free-to-consumer programs,¹⁶⁰ Facebook, Amazon, and Alphabet primarily generate revenue through information collected and funneled into their advertising businesses.¹⁶¹ Alphabet has its own digital marketing platform—Enterprise Advertising and Analytics Solutions (previously known as DoubleClick Marketing)—which serves data-layered advertising placements that target segments of internet users.¹⁶² Alphabet’s Enterprise Advertising and Analytics Solutions and similar tools like Amazon’s Marketing Services and Facebook’s Facebook Analytics are built on algorithms that compile users’ traits and behavior for marketing purposes.¹⁶³ At a minimum, these companies collect IP addresses, cookies, and geolocation information.¹⁶⁴ For Facebook specifically, users voluntarily share additional information like pictures and brand preferences.¹⁶⁵ Google and Amazon, each with extensive digital footprints, can combine data points across services and devices to create a persistent identity graph for each user.¹⁶⁶ These persistent data sets allow the companies to identify a user across platforms, understand that user’s preferences, and craft personalized offers.¹⁶⁷

In 2018, an explosive news story revealed that Facebook allowed researchers from Cambridge Analytica, a political consulting firm, to collect and study fifty million user profiles without the users’ knowledge or permission.¹⁶⁸ Cambridge Analytica then sold this information to political candidates who used the data for campaigning.¹⁶⁹ The public outcry against Facebook was swift and severe. As the news spread, seventy-four percent of surveyed adults in the United States said that they did not know the extent to which Facebook specifically used their interests and information to sell to advertisers.¹⁷⁰ More generally, fifty-one percent of that same group stated that they were not comfortable with Facebook using this information at all.¹⁷¹ As a whole, sixty-two percent believed that it is not possible to go through their days without companies collecting data about them.¹⁷² Concerns about corporations’ data practices and a lack of regulatory accountability invigorated calls for comprehensive data privacy legislation.

III. Two Global Responses to the Current Climate

Internet-enabled technology has transformed the global economy, and threats to personal consumer privacy have emerged as collateral. Yet while technology continues to develop, corresponding regulation has not kept pace.¹⁷³ This Part surveys and contrasts two approaches to data privacy regulation. The first approach, that of the European Union, provides overarching data privacy protection through omnibus legislation. The second approach, that of the United States, provides sectoral data privacy protection through two separate bodies: the FTC and the states.

A. Privacy as an Intrinsic Right: European Omnibus Legislation

The European response to consumer data privacy concerns reflects the value Europeans place on personal privacy. The 1950 European Convention on Human Rights resolved to protect citizens’ private lives and data against both the government and corporations.¹⁷⁴ Such a protection was grounded within the European conception of privacy as a fundamental human right.¹⁷⁵ To Europeans, “privacy” entails an individual’s image, reputation, and name.¹⁷⁶ As Professor James Whitman states, Europeans view privacy “as a value primarily threatened by two forces: the excesses of the free press and the excesses of the free market.”¹⁷⁷ In this sense, then, the European concept of privacy battles against two key guarantees deeply entrenched in US society: free speech and laissez-faire economics.¹⁷⁸

The GDPR reflects this fundamental nature of European privacy rights. Effective May 25, 2018, the GDPR gave EU citizens explicit rights to their personal data, as well as a means to ensure its protection.¹⁷⁹ The legislation is based on six “[p]rinciples relating to processing of personal data”: (1) fairness and transparency; (2) purpose limitation; (3) data minimization; (4) accuracy; (5) storage limitation; and (6) confidentiality.¹⁸⁰ Among the rights granted to EU citizens under the GDPR are the right to object to a company’s use of personal information, know how the data is used, request the information used, and erasure (commonly known as the right to be forgotten).¹⁸¹

The GDPR restricts the activities of data controllers and data processors. Controllers are defined as natural or legal persons that “determine[] the purposes and means of processing the of personal data,” while processors are defined as bodies that “process[] personal data on behalf of” controllers.¹⁸² Controllers need not be based in the European Union to be subject to the regulation.¹⁸³ Indeed, if a company offers goods or services in Europe or uses EU citizens’ data for any purpose, that company falls within the GDPR’s purview.¹⁸⁴ The GDPR covers all data that could objectively identify the individual.¹⁸⁵ And to collect information, corporations need to demonstrate a legitimate interest—one that is not merely marginal.¹⁸⁶ Violations of GDPR can result in fines of up to €20 million or four percent of the offending company’s global annual revenue.¹⁸⁷

To avoid GDPR violations and fines, many US-based companies have geo-targeted their content so that it is not viewable in the European Union.¹⁸⁸ As companies choose to shut down operations rather than face potential compliance costs, there has been a marked decrease in the availability of news and entertainment services in the European Union.¹⁸⁹ As of March 2019, there were 1,129 US-based websites that were unavailable in the European Union simply because the US-based company did not comply with GDPR regulations.¹⁹⁰ And the US-based companies that continued to operate within the European Union spent more than $7 billion to comply with the new regulations.¹⁹¹ On the eve of the GDPR’s enactment, sixty-eight percent of 200 US-based companies surveyed budgeted between $1 million and $10 million for compliance costs.¹⁹²

Significant economic effects have resulted from the GDPR. Within Europe, there has been increased consolidation among technology companies.¹⁹³ Many have attributed this consolidation to the hefty fines facing violators.¹⁹⁴ The advertising industry provides one pertinent illustration of market consolidation at work. Before the GDPR, Google took in fifty percent of EU advertising expenditures.¹⁹⁵ The day after the GDPR went into effect, Google took in ninety-five percent of EU advertising expenditures.¹⁹⁶ Moreover, in the four months following the GDPR, the number of advertising trackers placed on the top 2000 websites visited by Europeans decreased by four percent.¹⁹⁷ A closer look at the players in the advertising-tracking landscape reveals that the number of trackers placed by smaller companies decreased by between eighteen and thirty-one percent.¹⁹⁸ Within the same period, Facebook’s trackers decreased by only seven percent while Google’s trackers increased by nearly one percent.¹⁹⁹ Omnibus legislation has had a disproportionate effect on smaller corporations to the benefit of corporations able to establish compliance infrastructure.

Similarly, a recent study found that in the GDPR’s first year, external funding of European technology companies decreased by $3.38 million per week.²⁰⁰ Decreases were found across the sheer number of deals made (seventeen percent) and the level of investment expended within those deals (thirty-nine percent).²⁰¹ Among new technology companies (defined as having been in the market for zero to three years), the effect is more pronounced—the number of deals decreased nineteen percent.²⁰² Researchers extrapolate the decrease in both deals and investment in new technology companies to between a four to eleven percent reduction in job creation.²⁰³ While the GDPR raised global consciousness about the degree to which consumer data can be protected, it has also acted as a regulatory case study as policymakers across the Atlantic consider and debate the relative merits of regulating technology corporations.

B. Privacy as a Tradeoff: US Statutory and State-Based Regulation

In stark contrast to the European foundations of and approach to data privacy, US citizens do not have a federally recognized right to privacy. What legally cognizable privacy interest US citizens do have is largely limited in scope by the Supreme Court’s interpretation of Fourth Amendment protections.²⁰⁴ And while some states have recognized an individual’s right to privacy,²⁰⁵ that recognition is far from uniform. Relatedly, Congress’s reliance on a sectoral approach to privacy has not resulted in federal data privacy regulation,²⁰⁶ despite some legislators maintaining that such a regulation is a priority, even in the midst of a global pandemic.²⁰⁷ Instead, the US approach to corporate use of consumer data is fractured between ex post FTC adjudications and ex ante state regulation.

1. Ex Post: Adjudication under Section 5 of the FTC Act

The FTC has jurisdiction over violations of privacy policies and subsequent consent decrees under its mandate to prevent unfair or deceptive trade practices.²⁰⁸ And the FTC has engaged in privacy settlements as early as 1951.²⁰⁹ Yet the FTC has conservatively interpreted its statutory authority and has opted to adjudicate individual cases rather than institute rules that prospectively regulate consumer data privacy.²¹⁰ Section 5 of the FTC Act²¹¹ requires a finding of a “clear theory of substantial likelihood of harm to consumers that is not outweighed by any countervailing benefits.”²¹² And given the level of ambiguity inherent in many corporate privacy policies, the FTC retains “a fairly narrow sliver” for enforcement.²¹³

Even as case-by-case adjudications can supply binding precedent for further complaints, the FTC remains hamstringed.²¹⁴ In applying this case-by-case approach, the FTC fined Facebook an unprecedented $5 billion for violating its own privacy policy in the wake of the Cambridge Analytica controversy.²¹⁵ For as much as it is able to fine individual companies, the FTC lacks the power to promulgate general privacy- and data-security-related rules.²¹⁶ And the FTC’s most significant limitation is its lack of financial resources—the agency has an annual budget of $300 million to regulate marketplace competition and protect consumers.²¹⁷ With such a budget, the agency exercises restraint, averaging fifteen to twenty enforcement settlements annually.²¹⁸ As Professors Hoofnagle, Hartzog, and Solove state, “if the FTC is to be a successful regulator of tech platforms, it needs more resources, more tools, a greater shield from political pressure, and a clear Congressional mandate.”²¹⁹ Without such support, the FTC’s regulatory impact on data privacy law remains hindered.

2. Ex Ante: Differing State Legislation

Following the GDPR and building upon FTC adjudication, states have begun crafting their own consumer data privacy legislation. These bills, three of which are discussed below, subject businesses to contradictory regulations and may stifle competition—potentially mirroring the effect of the GDPR on the EU economy.²²⁰

a. California Consumer Privacy Act

Facially similar to the GDPR, the California Consumer Protection Act²²¹ (“CCPA”) was signed into law on June 28, 2018.²²² The CCPA became effective January 1, 2020; it provides residents of California with a number of rights, including the right to: (1) know what personal data is collected and how it is shared; (2) “opt out” of a business’s data sales; and (3) force a business to delete data.²²³ Importantly, the CCPA provides Californians a private cause of action for data breaches from a “business’s violation of the duty to implement and maintain reasonable security procedures,” although not for violations of the Act’s enumerated rights.²²⁴ Damages under the private cause of action can be severe: the CCPA provides the greater of statutory damages between $100 and $750 per consumer, per incident, or actual damages.²²⁵

The CCPA’s broad definition of the types of companies to which its regulations apply extend beyond California’s borders. Businesses are potentially liable under the CCPA if they: (1) have annual revenues of more than $25 million; (2) annually “buy[],” “receive[],” “sell[],” or “share[]” personal information from 50,000 or more California residents, households, or devices; or (3) obtain fifty percent or more of their annual revenue from selling California residents’ personal information.²²⁶ Unlike the GDPR, the CCPA does not require a covered business to provide a basis for their data collection or processing practices.²²⁷ Under the CCPA, the California Attorney General may bring a civil action against a covered business and recover up to $2,500 per violation or $7,500 per intentional violation.²²⁸

Critics of the CCPA argue that legislators did not realize the broad effect that the law, passed just one week after it was drafted,²²⁹ would have on businesses.²³⁰ While the three-pronged definition of a “business” appears to limit the number of covered businesses, a mere 127 daily hits on a website could subject the owner of that website to liability.²³¹ Local news sources—with far less scale than Google and Facebook—would fall into this definition, requiring expensive compliance infrastructures that could drive them out of the market.²³²

In the days before January 1, 2020, companies scrambled to ensure their compliance with the new law,²³³ even though the California Attorney General could not bring enforcement actions until July 1, 2020.²³⁴ A survey of 250 businesses reported that seventy-one percent budgeted hundreds of thousands of dollars on compliance costs while nineteen percent budgeted at least $1 million.²³⁵ Since then, the California Attorney General created a “Frequently Asked Questions” page that is continually updated to reflect the ongoing proposed regulations under the law.²³⁶

In April 2020 alone, more than a dozen civil actions were filed in state and federal court under the CCPA.²³⁷ Now that the California Attorney General may bring enforcement actions, it remains to be seen how the courts will interpret the law and how successful it will be in protecting consumer data privacy interests. Recently, class actions brought under the CCPA look to broaden the law’s private cause of action,²³⁸ alleging that companies can be liable for sharing data with other companies²³⁹ or for failing to provide privacy policies.²⁴⁰

b. Washington Privacy Act

In 2021, Washington state senators proposed a bill entitled the Washington Privacy Act (“WPA”).²⁴¹ The state’s third attempt at a data privacy law, the WPA provides Washington residents with many of the same rights established under the CCPA.²⁴² Under the bill, Washington residents are provided the right to: (1) access categories of information processed about them; (2) correct inaccuracies; (3) request deletion; (4) receive their collected personal information; and (5) opt out of information processing for, among other purposes, targeted advertising and third-party sales.²⁴³

Yet compared to the CCPA, the WPA narrows the threshold of companies that fall under the statute’s purview. The bill applies to companies that either: (1) process personal information of more than 100,000 Washington residents; or (2) derive more than twenty-five percent of their annual revenue from selling personal information and process personal information of more than 25,000 Washington residents.²⁴⁴ Notably, the WPA lacks a revenue threshold.

And again compared to the CCPA, the WPA limits Washington residents’ ability to recover for violations. Unlike the CCPA, the WPA does not provide a private cause of action for Washington residents.²⁴⁵ Only the Washington Attorney General may enforce violations of the WPA and recover up to $7,500 per violation.²⁴⁶ Critics of the WPA argue that the bill—which Amazon and Microsoft support—is “toothless [and] corporate-centric” with “vague language, a laundry list of exemptions and a provision that explicitly prohibits people from holding companies accountable when they violate people’s digital privacy rights.”²⁴⁷ Meanwhile, supporters argue that the bill offers “clear, accessible and enforceable privacy protections”²⁴⁸ and is “one of the strongest globally”²⁴⁹ with a “robust privacy framework.”²⁵⁰

c. New York Privacy Act

In January of 2021, New York state senators reintroduced the previous legislative session’s New York Privacy Act (“NYPA”).²⁵¹ The NYPA is currently in the Committee on Consumer Affairs and Protection as Assembly Bill 680.²⁵² Broader in scope than both the CCPA and WPA, the NYPA does not define the term “business” and lacks a revenue or consumer threshold above which would expose companies to liability.²⁵³ Indeed, upon introducing the bill, State Senator Kevin Thomas stated that he “want[ed] to capture as many businesses as possible.”²⁵⁴ Further unlike the GDPR, CCPA, and WPA, the NYPA contains a “data fiduciary” clause.²⁵⁵ This clause establishes a duty of care that businesses owe to consumers in maintaining the consumers’ data.²⁵⁶ The clause states that businesses “shall act in the best interests of the consumer, without regard to the interests of the entity, controller or data broker.”²⁵⁷ Notably, this standard of care exceeds that owed to corporations’ shareholders.²⁵⁸ Not only will businesses face a higher standard of care, but they will also need to determine, potentially, each consumer’s “best interests.”²⁵⁹

The NYPA also provides broad enforcement mechanisms that may lead to a flood of suits in state courts. The Act provides “any person who has been injured by reason of a violation of this article” with a private cause of action, and the NYPA does not limit the scope of damages.²⁶⁰ While the NYPA defines “consumers” as “New York resident[s],”²⁶¹ it does not define “person,” further expanding the universe of potential plaintiffs. And the NYPA exposes businesses to tremendous liability, noting that “[e]ach provision of this article that was violated counts as a separate violation.”²⁶² Observers have already noted that compliance with the NYPA as currently written “likely would prove impossible.”²⁶³

VI. A Third Response: Self-Regulation

Pending state legislation and FTC actions against companies like Facebook demonstrate the need for uniform regulation of consumer data privacy. Scholars seem to agree that the solution exists in one of two options, either federal legislation or state legislation.²⁶⁴ But neither of the two preferred options fully addresses the values at stake: innovation, free speech and transparency, personal privacy preferences, and state sovereignty.

The first solution—state-based legislation—secures personal consumer data privacy protections at the state level. A key advantage of state-based privacy protections—as opposed to federal protections—lies in the states’ comparatively greater ability to account for localized preferences. But a fifty-state solution is not a long-term solution. Recent scholarship has highlighted the potential unconstitutionality of state-based consumer privacy regimes.²⁶⁵ Legislation in California, Washington, and New York differs in scope and application, subjecting both large and small businesses to conflicting standards.²⁶⁶ Most of these companies transact in multiple—if not all—states.²⁶⁷ While privacy torts, articulated at the state level, provide relief for individual injuries occurring in one location, the same cannot be said for data privacy harms. Faced with the choice between multiple standards, businesses may opt for the strictest, forgoing some state regulations altogether and subjecting their data practices to civil liability. Alternatively, regulations with inconsistent definitions and differing penalties may force large businesses to establish practices fulfilling the lowest common denominator.²⁶⁸ And as further states legislate consumer data privacy, companies may face steep fines, jeopardizing their financial viability. Some corporations may choose to forgo transacting in one state altogether. A corporation’s choice to halt business in one state may lead to consumer frustration and shrink the body of products and services available to the detriment of both consumers and businesses.

The second solution—federal legislation modeled on the GDPR—is also not the answer for multiple reasons. First, the United States lacks an intrinsic or guaranteed right to privacy—the cornerstone of the GDPR—on which federal legislation could be based. Second, a GDPR clone is likely to produce many of the effects that have already hampered the EU economy: increased market consolidation, limited access to sources of news and entertainment, confusion among business practitioners, and barriers to entry for startup corporations.²⁶⁹ Additionally, potential economic costs of GDPR-modeled federal legislation are vast—scholars have estimated resulting compliance costs and market inefficiencies at nearly $122 billion per year in the United States.²⁷⁰ While not catastrophic to the Googles and Facebooks of the country, compliance costs could obliterate startup corporations that generate jobs, contribute to national productivity, and increase innovation.²⁷¹ And third, a federal solution jeopardizes state autonomy in matters highly personal to individuals. State legislation protecting privacy is potentially overinclusive—protecting privacy more than one group desires—or underinclusive—protecting privacy less than another group desires.²⁷²

Assessing the strengths and weaknesses of the two data privacy solutions illustrates many of the desirable goals of future regulation. First, data privacy protections must be a product of robust discussion. Policymakers and legislators at both the state and federal level must collaborate with economists and industry participants. In working with economists, policymakers can examine the effects of the GDPR in Europe, estimate direct and indirect costs of regulation, and pursue cost-benefit analyses of various proposals. Just so, in working with industry participants, policymakers can become educated about the highly technical internet ecosystem and consider any regulation’s impact on future innovation.

Second, data privacy protections must distinguish between large, medium, and small businesses. Research has already suggested that small and medium-sized businesses disproportionally bear the costs of data privacy regulations.²⁷³ And many of the larger corporations which regulators seek to reach have actually benefitted from legislation.²⁷⁴ By tiering protections according to revenue, policymakers can narrow regulations to particular companies’ business practices and curb damaging effects on smaller actors.

Third, data privacy protections must address existing efforts in states to attempt to harmonize contradictory standards. Current state-level data privacy bills and statutes articulate distinct areas of focus, liability standards, data subjects, duties of care, and damages. Some bills provide a private cause of action while others do not. Some bills articulate a revenue threshold for corporations while others do not. Some bills address minors’ online privacy protections while others address entire households’ privacy protections. For any company’s general counsel, navigating the maze of state standards, requirements, duties, and damages presents a daunting task.

And lastly, data privacy protections must consider the level of privacy and transparency US consumers need. Many consumers receive value from the convenience “free” internet-based products offer. For this subset of consumers, then, strong privacy regulations could eliminate much of the value derived from exchanging personal data for services.

While a perfect answer that achieves each of these four goals is undoubtedly difficult, there is a third solution beyond federal and state-based legislation. A self-regulatory body, headed by industry leaders working in tandem with the FTC,²⁷⁵ would most adequately address many of the goals without unduly hindering innovation.²⁷⁶ And technology companies can emulate existing self-regulatory approaches. For example, the Children’s Food & Beverage Advertising Initiative (“CFBAI”), part of the Better Business Bureau, represents nineteen major companies that advertise to children.²⁷⁷ In 2006, these corporations banded together to form a voluntary program marked by annual self-assessments.²⁷⁸ Companies could also emulate the approach of the Distilled Spirits Council of the United States (“DISCUS”). Following the repeal of the Eighteenth Amendment, leading US-based distillers established a voluntary Code of Responsible Practices.²⁷⁹ To set forth a framework for a self-regulatory body on data privacy, both programs’ models are further discussed below.

A. Promulgating Industry Standards

The first goal of the self-regulatory body would be to establish standards for corporations that gather consumer data. The two self-regulatory body examples provide such standards. Member companies of the CFBAI created the Initiative’s Core Principles²⁸⁰ and Uniform Nutrition Criteria,²⁸¹ which regulate advertisements to children under the age of twelve. The Principles and the Criteria demonstrate the companies’ commitment to promoting foods with lower calorie, salt, sugar, and fat contents on children-directed television programs and mobile media.²⁸² The Children’s Advertising Review Unit (“CARU”)—a separate body under the Better Business Bureau—monitors compliance with the voluntary program.²⁸³ Similarly, DISCUS members established limits on content, target audiences, product placements, and locations of advertisements.²⁸⁴ Further, DISCUS has a Code Review Board for consumer complaints and follows a review process.²⁸⁵ The FTC monitors compliance with both self-regulatory approaches.²⁸⁶

In early September 2019, the chief executives of Amazon, AT&T, Comcast, Dell, Ford, IBM, Macy’s, Mastercard, Proctor & Gamble, SAP, Salesforce, Target, Visa, and Walmart (among others), sent an open letter to Congress, asking for “a comprehensive federal consumer data privacy law.”²⁸⁷ Citing the many state-level bills, the companies emphasized a need for uniform data privacy laws to ease consumer confusion and enable continued cross-jurisdictional business.²⁸⁸ In coming together to craft such a letter, these corporations have already begun the process of self-regulation akin to the CFBAI and DISCUS. To build upon this letter’s legacy, corporations small and large could set forth a code of responsible data privacy practices resembling the CFBAI and DISCUS practices and core principles. Many of these corporations have taken significant, industry-leading steps to establish appropriate protections for consumer data privacy.²⁸⁹ A set of core principles governing data privacy could be the corporations’ first steps toward defining sustainable data practices.

B. Differentiating Based on Corporate Scale

An omnibus data privacy law mirrored after the GDPR could produce consolidation at the expense of small companies.²⁹⁰ Seeking to prevent this chilling effect, a self-regulatory body working with the FTC could establish a tiering system that lays out data practices for companies depending on revenue, size, and scale. Within each tier, the self-regulatory body could establish governance boards to promulgate differing regulations. In this sliding scale of requirements, the body could set forth baseline protections for corporations entering the market without jeopardizing innovation and economic growth.

To start, the self-regulatory body can use existing frameworks to differentiate players in the consumer data privacy sphere. One helpful resource is the US Small Business Administration, which has laid out differing definitions of “small business” depending on the firm’s industry, revenue, and employees.²⁹¹ The Administration, like the US Census Bureau, further divides those small businesses according to the type of business²⁹²—from corporation to sole proprietor. To begin the process of differentiating the standards to which differently sized companies must comply, the body can adopt these definitions, protecting smaller businesses from inordinate regulatory burdens.

C. Increasing Transparency on the Use of Consumer Data

Just as voluntary self-regulatory bodies have reaped the benefits of corporate social responsibility and public relations, so also could the technology companies engender consumer trust and political respect through a self-regulatory approach.²⁹³ By working with consumer advocacy groups, the self-regulatory body could draft versions of privacy policies written for the average consumer. Instead of clicking on a box to signify agreement to ambiguous terms, these privacy policies could be minimally intrusive, consistent across the internet, and comprehensible. Like DISCUS and CFBAI, the regulatory body could publish white papers on technological best practices, research how consumers process consent notifications, and obviate the immediate need for federal data privacy legislation.

Conclusion

Tracing the history of privacy protections in the United States demonstrates an absence of a fundamental right to data privacy guaranteed to US citizens at the federal level. While the Supreme Court has articulated privacy interests protected by the Fourth Amendment, Congress has legislated sectoral data privacy protections and state courts and laws provide remedies for tortious interferences with privacy interests. Despite concerns arising from undisclosed data sharing like the recent Cambridge Analytica controversy, Congress has not passed federal legislation that would protect consumer data privacy.

A fundamentally different approach to privacy exists in Europe, where citizens are guaranteed a right to privacy. The GDPR entrenched this right, but it also led to market stagnation and consolidation. Even so, the GDPR increased global consciousness about consumer data privacy and its fragility in the age of digitalization. The pace at which technology develops shows no signs of slowing, and it remains a key aspect of the US economy. With six of the top ten companies by market capitalization based in the United States, a sweeping federal data privacy bill may stifle this economy.²⁹⁴ And the exchange between Senator Hatch and Mr. Zuckerberg²⁹⁵ demonstrates that Congress may lack the necessary expertise. Even worse, however, is the prospect of fifty competing state data privacy laws with differing revenue thresholds and enforcement mechanisms.²⁹⁶

Large companies urge Congress to act, but these companies already have the solutions. In writing to Congress and jointly stating their wishes for broad federal legislation, companies have demonstrated the capacity to band together to ensure—at the very least—continued growth and innovation. While state legislation continues to sputter in committees and Congress debates the proper way forward, technology companies must consider self-regulation mirrored after the alcohol industry’s DISCUS and the food and beverage industry’s CFBAI. Self-regulation establishes an appropriate balance between personal liberty and corporate profit, providing a twenty-first century realization of an “imperfect” nineteenth-century remedy.²⁹⁷

Category: Print Issues

“Senator, We Run Ads”: Advocating for a US Self-Regulatory Response to the EU General Data Protection Regulation

Share this article