Liability for Data Injuries

References (241)

1. Dec. 20, 2017, 10:40 AM), https://earther.com/the-amazing-earth-science-behind-the-last-jedis-new-min-1821 429894; THE LAST JEDI (Lucasfilm 2017).
2. Michael D. Simpson, All Your Data Are Belong to Us: Consumer Data Breach Rights and Remedies in an Electronic Exchange Economy, 87 U. COLO. L. REV. 669, 674 (2016).
3. Michael L. Rustad & Thomas H. Koenig, The Tort of Negligent Enablement of Cybercrime, 20
4. BERKELEY TECH. L.J. 1553, 1611 (2005) [hereinafter Rustad & Koenig, Cybercrime].
5. Ukraine Power Distributor Plans Cyber Defense System For $20 Million, REUTERS (Feb. 6, 2018, 6:58 AM), https://www.reuters.com/article/us-ukraine-cyber-ukrenergo/ukraine-power-distributor-plans-cyber- defense-system-for-20-million-idUSKBN1FQ1TD.
6. Bruce Schneier, Lessons from the Dyn DDoS Attack, Schneier on Security (Nov. 8, 2016, 6:25 AM), https://www.schneier.com/blog/archives/2016/11/lessons_from_th_5.html.
7. Rick Noack, The Dutch Were a Secret Ally in War Against Russian Hackers, Local Media Reveal, WASH. POST (Jan. 26, 2018), https://www.washingtonpost.com/news/worldviews/wp/2018/01/26/dutch-media- reveal-country-to-be-secret-u-s-ally-in-war-against-russian-hackers/?utm_term=.c20fc2ddda51. Thanks to AIVD, the Dutch intelligence service, the U.S. intelligence community had access to information about the ac- tivities of the Russian hacking group Cozy Bear, which is alleged to have ties to the Russian government. Id.
8. Sarah N. Lynch, U.S. Shuts Down Cyber Crime Ring Launched By Ukrainian, REUTERS (Feb. 7, 2018, 11:15 AM), https://www.reuters.com/article/us-usa-cybercrime/u-s-shuts-down-cyber-crime-ring-launched-by- ukrainian-idUSKBN1FR2M7.
9. Id.
10. Simpson, supra note 3, at 671.
11. Jimmy H. Koo, 2017: The Year of the Data Breach, BLOOMBERG BNA (Dec. 19, 2017), https:// www.bna.com/2017-year-data-b73014473359/.
12. Tony Martin-Vegue, Will the Real "Year of the Data Breach" Please Stand Up?, HACKERNOON (Jan.
13. Thomas Martecchini, Note, A Day in Court for Data Breach Plaintiffs: Preserving Standing Based on Increased Risk of Identity Theft After Clapper v. Amnesty International USA, 114 MICH. L. REV. 1471, 1473 (2016).
14. Rucker, supra note 13. 22. See id.
15. See id.; U.S. CENSUS BUREAU, QUICKFACTS, https://www.census.gov/quickfacts/fact/table/US/PST 045217 (last visited Nov. 2, 2018).
16. Economic Growth, Regulatory Relief, and Consumer Protection Act, Pub. L. No. 115-174, 132 Stat. 1296 (2018). 25. See id.
17. E.g., IDAHO CODE § 28-52-106 (2018) (only requiring credit freezes to be provided at no cost to con- sumers who are victims of identity theft);
18. N.C. GEN. STAT. § 75-63(o) (2017) (prohibiting fees for credit freezes when the request is made electronically).
19. Cooney v. Chi. Pub. Sch., 943 N.E.2d 23, 27 (Ill. App. Ct. 2010).
20. Hard Drive Containing Personal Hospital Records Sold Online, NEWS12 N.J. (Dec. 19, 2017), http:// newjersey.news12.com/story/37103529/hard-drive-containing-personal-hospital-records-sold-online. 41. Id. 42. Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co., 115 A.3d 458, 459 (Conn. 2015).
21. Id.
22. In re Science Applications Int'l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 19 (D.D.C. 2014).
23. Id. 46. Riedy & Hanus, supra note 28, at 13.
24. NAT'L RESEARCH COUNCIL OF THE NAT'L ACADS., TECH., POLICY, LAW, AND ETHICS REGARDING U.S. ACQUISITION AND USE OF CYBERATTACK CAPABILITIES 41 (William A. Owens et al. eds., 2009).
25. Colin J.A. Oldberg, Note, Organizational Doxing: Disaster on the Doorstep, 15 COLO. TECH. L.J. 181, 183 (2016).
26. See Lauren E. Willis, Why Not Privacy by Default?, 29 BERKELEY TECH. L.J. 61, 66-67 (2014).
27. See Paul M. Schwartz, Property, Privacy, And Personal Data, 117 HARV. L. REV. 2055, 2100 (2004).
28. Meredith, supra note 67.
29. Id.
30. Issie Lapowsky, Cambridge Analytica Could Have Also Accessed Private Facebook Messages, WIRED (Apr. 10, 2018), https://www.wired.com/story/cambridge-analytica-private-facebook-messages/.
31. Id.; Meredith, supra note 67.
32. See Meredith, supra note 67. 81. See id.
33. Id.; Lapowsky, supra note 78.
34. See Meredith, supra note 67.
35. Bloomberg Gov't, Transcript of Mark Zuckerberg's Senate Hearing, WASH. POST (Apr. 10, 2018), https://www.washingtonpost.com/news/the-switch/wp/2018/04/10/transcript-of-mark-zuckerbergs-senate-hear- ing/?utm_term=.a39f8b2eb57e.
36. Id.
37. Privacy Act of 1974, 5 U.S.C. § 552a(e)(10) (2018).
38. Gramm-Leach-Bliley Act, 15 U.S.C. § 6801(b)(2) (2018).
39. See generally Malcolm M. MacIntyre, The Rationale of Last Clear Chance, 53 HARV. L. REV. 1225 (1940).
40. Patricia Cave, Giving Consumers a Leg to Stand On: Finding Plaintiffs a Legislative Solution to the Barrier from Federal Courts in Data Security Breach Suits, 62 CATH. U. L. Rev. 765, 789 (2013);
41. Romanosky, Hoffman & Acquisti, supra note 30, at 100; Evan M. Wooten, The State of Data Breach Litigation and Enforce- ment: Before the 2013 Mega Breaches and Beyond, 24 J. ANTITRUST & UNFAIR COMPETITION L. SEC. ST. B. CAL. 229, 239 (2015).
42. Cave, supra note 113, at 787; Simpson, supra note 3, at 691-92; Wooten, supra note 113, at 239. 115. Martecchini, supra note 20, at 1494-95.
43. In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 996 F. Supp. 2d 942, 1013-14
44. S.D. Cal. 2014); In re LinkedIn User Privacy Litig., 932 F. Supp. 2d 1089, 1092-95 (N.D. Cal. 2013); see also Wooten, supra note 113, at 243-44.
45. Johnson, supra note 141, at 29.
46. Rabin, Data, supra note 129, at 323. 161. Id. at 324-26.
47. Cave, supra note 113, at 778.
48. Pinson, supra note 142, at 48.
49. Rabin, Data, supra note 129, at 328.
50. See Ludington, supra note 62, at 171; Oldberg, supra note 48, at 199. Product liability law itself, though, may not be a good fit. See Danielle Keats Citron, Reservoirs of Danger: The Evolution of Public and Private Law at the Dawn of the Information Age, 80 S. CAL. L. REV. 241, 243 (2007);
51. Rustad & Koenig, Cyber- crime, supra note 4, at 1580.
52. See Rustad & Koenig, Cybercrime, supra note 4, at 1575. 190. Id. at 694.
53. Rustad & Koenig, Tort Monster, supra note 100, at 41. 192. Id. at 43.
54. Palsgraf v. Long Island R.R. Co., 162 N.E. 99, 99 (N.Y. 1928).
55. Id. at 100 ("One who jostles one's neighbor in a crowd does not invade the rights of others standing at the outer fringe when the unintended contact casts a bomb upon the ground.").
56. See, e.g., McDonald, supra note 170, at 385 (citing W. Jonathan Cardi, The Hidden Legacy of Palsgraf: Modern Duty Law in Microcosm, 91 B.U. L. REV. 1873, 1884 (2011)) ("Forseeability is 'often cited as the most important factor in duty,' and the use of foreseeability in deciding matters of negligence is 'nearly ubiquitous.'").
57. Rustad & Koenig, Tort Monster, supra note 100, at 41.
58. Pinson, supra note 142, at 49.
59. McDonald, supra note 170, at 376.
60. Pinson, supra note 142, at 49.
61. Rustad & Koenig, Tort Monster, supra note 100, at 45.
62. Fox & Stein, supra note 27, at 988.
63. McDonald, supra note 170, at 367.
64. Rustad & Koenig, Cybercrime, supra note 4, at 1587.
65. Rustad & Koenig, Tort Monster, supra note 100, at 45.
66. See Kline v. 1500 Mass. Ave. Apartment Corp., 439 F.2d 477, 487 (D.C. Cir. 1970);
67. Johnson, supra note 141, at 23; Rustad & Koenig, Cybercrime, supra note 4, at 1608.
68. See supra note 68 and accompanying text.
69. Rustad & Koenig, Tort Monster, supra note 100, at 97-98.
70. Id. at 104 ("Immunity is breeding irresponsibility because websites have no incentive or duty to protect their visitors and the general public."). This aspect of the CDA was amended slightly in 2018 to remove immunity for websites that knowingly assist, facilitate, or support sex trafficking. Pub. L. 115-164, H.R. 1865 (2018);
71. Emily Stewart, The Next Big Battle Over Internet Freedom Is Here, VOX (Apr. 23, 2018, 12:20 PM), https://www. vox.com/policy-and-politics/2018/4/23/17237640/fosta-sesta-section-230-internet-freedom.
72. Rustad & Koenig, Tort Monster, supra note 100, at 42; McDonald, supra note 170, at 369.
73. Rabin, Enabling Torts, supra note 182, at 444.
74. Rustad & Koenig, Cybercrime, supra note 4, at 1581. 239. Id. at 1581-82.
75. Rabin, Data, supra note 129, at 331. 241. 439 F.2d 477, 488 (D.C. Cir. 1970);
76. Rustad & Koenig, Cybercrime, supra note 4, at 1584. 242. 18 U.S.C. § 1839(3)(A) (2018);
77. Rowe, supra note 1, at 8.
78. Rowe, supra note 1, at 3.
79. Johnson, supra note 141, at 22.
80. E.g., CAL. CIVIL CODE § 1798.29(a) (West 2017).
81. E.g., id. § 1798.29(e).
82. E.g., 815 ILL. COMP. STAT. 530/20 (2006) ("A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.").
83. Johnson, supra note 141, at 22.
84. Cooney v. Chi. Pub. Schs., 943 N.E.2d 23, 28 (Ill. App. Ct. 2010).
85. Rustad & Koenig, Tort Monster, supra note 100, at 101-02; see also Waers, supra note 88, at 51 (discussing a data breach of medical records where the data was not misused).
86. Johnson, supra note 141, at 26.
87. Sara Malm, Two Suicides Are Linked to Ashley Madison Leak, DAILYMAIL (Aug. 24, 2015, 9:59 AM), http://www.dailymail.co.uk/news/article-3208907/The-Ashley-Madison-suicide-Texas-police-chief-takes-life- just-days-email-leaked-cheating-website-hack.html.
88. Oldberg, supra note 48, at 186.
89. Id.
90. See Riedy & Hanus, supra note 28, at 10 ("The term 'information security' comprises three interrelated components: confidentiality, integrity, and availability of data.").
91. Ludington, supra note 62, at 146.
92. Kenneth Einar Himma, Privacy Versus Security: Why Privacy Is Not an Absolute Value or Right, 44
93. SAN DIEGO L. REV. 857, 891-92 (2007).
94. Stephen M. Griffin, Reconstructing Rawls's [sic] Theory of Justice: Developing a Public Values Phi- losophy of the Constitution, 62 N.Y.U. L. REV. 715, 734 (1987).
95. Id.
96. ROBERT MEYER & HOWARD KUNREUTHER, THE OSTRICH PARADOX: WHY WE UNDER PREPARE FOR DISASTERS 12 (2017).
97. Motorcycles (2016), INS. INST. FOR HIGHWAY SAFETY AND THE HIGHWAY LOSS DATA INST. (Dec. 2017), http://www.iihs.org/iihs/topics/t/motorcycles/fatalityfacts/motorcycles. 285. Goldberg, supra note 137, at 819. 286. Id. at 824.
98. Rustad & Koenig, Cybercrime, supra note 4, at 1603.
99. JOHN LOCKE, TWO TREATISES OF GOVERNMENT 129 (Edward J. Harpham ed., Univ. Press of Kan. 1992) (1960) ("God gave the world to men in common for their use. Men own themselves, and by extension they own their own labor. They create property by mixing their own labor, which is unconditionally their property, with unowned common resources, thereby creating something new, which becomes their property as well (ST: no. 27).").
100. James Madison, Property, THE FOUNDERS' CONSTITUTION (1792), http://press-pubs.uchicago. edu/founders/documents/v1ch16s23.html.
101. Id. Of course, Madison's theories of property are inherently flawed, as he supported chattel slavery, making this quote very suspect in hindsight. 291. Solove & Citron, supra note 27, at 747.
102. Adam Benforado, The Body of the Mind: Embodied Cognition, Law, and Justice, 54 ST. LOUIS U. L.J. 1185, 1205 (2010).
103. Goldberg, supra note 137, at 809.
104. Fox & Stein, supra note 27, at 991; Solove & Citron, supra note 27, at 767 (noting that emotional distress claims are criticized as being too easy to fake).
105. Amanda C. Pustilnik, Pain as Fact and Heuristic: How Pain Neuroimaging Illuminates Moral Dimen- sions of Law, 97 CORNELL L. REV. 801, 803 (2012). Pustilnik also observes that because of the way that the brain processes nociception transmissions, "without consciousness, there is no pain." Id. at 808.
106. Govind Persad, Law, Science, and the Injured Mind, 67 ALA. L. REV. 1179, 1181 (2016).
107. Id. at 1183. 298. Id. at 1184-85.
108. Mary Emily O'Hara, Kurt Eichenwald Case: Texas Grand Jury Says a GIF Is a 'Deadly Weapon', NBC NEWS (Mar. 21, 2017, 2:38 PM), https://www.nbcnews.com/news/us-news/kurt-eichenwald-case-texas- grand-jury-says-gif-deadly-weapon-n736316.
109. Joshua Rhett Miller, Vet Accused of Sending Reporter Seizure-Causing Tweet Catches Small Break, N.Y. POST (Nov. 28, 2017, 12:58 PM), https://nypost.com/2017/11/28/vet-accused-of-sending-reporter-seizure- causing-tweet-catches-small-break/.
110. O'Hara, supra note 299.
111. Id. 303. Persad, supra note 296, at 1192. 304. 938 F.2d 1033, 1034 (9th Cir. 1991).
112. Id. 306. Id. at 1036. 307. O'Hara, supra note 299.
113. Jon D. Elhai & Brian J. Hall, Anxiety About Internet Hacking: Results from a Community Sample, 54
114. COMPUTERS IN HUM. BEHAV. 180, 183 (2016) (reporting results of a survey measuring self-reported anxiety levels about various data breach related topics and finding "data breach" anxiety to have greater severity than resting anxiety);
115. Sushma Sanga & Ali Eydgahi, Factors Affecting Identity Theft Anxiety Level in College Students (Am. Soc. for Engineering Educ. 2017, Paper No. 19812), https://www.asee.org/public/conferences/78/pa- pers/19812/view (studying the factors influencing the anxiety caused by fear of identity theft among students in Michigan).
116. See generally Karen Reilly & Gráinne Kirwan, Online Identity Theft, An Investigation of the Differ- ences Between Victims and Non-victims with Regard to Anxiety, Precautions and Uses of the Internet, in CYBERPSYCHOLOGY AND NEW MEDIA: A THEMATIC READER ACCOUNT (Andrew Power & Gráinne Kirwan ed., 2014) (studying the after-effects of being a victim of online identity theft and showing victims of online identity theft experience higher levels of anxiety compared to nonvictims);
117. Jon D. Elhai et al., Cross-cultural and Gender Associations with Anxiety about Electronic Data Hacking, 70 COMPUTERS IN HUM. BEHAV. 161 (2017) (studying the impact of data hacking on clinical anxiety and worry among American and Korean men and women);
118. Tracy Sharp et al., Exploring the Psychological and Somatic Impact of Identity Theft, 49 J. OF FORENSIC SCI. 1 (2004) (showing an increase in maladaptive psychological and somatic symptoms post-victimization among victims of identity theft).
119. Solove & Citron, supra note 27, at 753.
120. See generally Miller, supra note 300; O'Hara, supra note 299. 323. O'Hara, supra note 299.
121. See Chen & Potenza, supra, note 16.
122. Oldberg, supra note 48, at 204.
123. Id.
124. Ludington, supra note 62, at 147.
125. Rustad & Koenig, Cybercrime, supra note 4, at 1603; Solove & Citron, supra note 27, at 747.
126. Cave, supra note 113, at 769; Johnson, supra note 141, at 29; Martecchini, supra note 20, at 1491-92;
127. Rabin, Data, supra note 129, at 333-34;
128. Solove & Citron, supra note 27, at 761-62.
129. Rabin, Data, supra note 129, at 333-34; Fox & Stein, supra note 27, at 985. 331. Solove & Citron, supra note 27, at 774. 332. Id. at 772.
130. Rabin, Data, supra note 129, at 334.
131. 254 F. App'x 664, 665 (9th Cir. 2007); see also Martecchini, supra note 20, at 1491-92; Pinson, supra note 142, at 46-47 (discussing the district court decision in Stollenwerk). 335. 580 F. Supp. 2d 273, 281 (S.D.N.Y. 2008).
132. Id. at 282; see also Martecchini, supra note 20, at 1493.
133. Solove & Citron, supra note 27, at 754. 338. Id. at 755.
134. Richards & Solove, supra note 145, at 1922.
135. E.g., Martecchini, supra note 20, at 1475. 341. Id. at 1491.
136. Solove & Citron, supra note 27, at 739.
137. Cave, supra note 113, at 770-71; Martecchini, supra note 20, at 1475-76.
138. Clapper v. Amnesty Int'l, 568 U.S. 398, 409 (2013); Cave, supra note 113, at 772, 787.
139. Martecchini, supra note 20, at 1475.
140. Martecchini, supra note 20, at 1480.
141. Wooten, supra note 113, at 233-34.
142. E.g., In re Science Applications Int'l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14 (D.D.C. 2014).
143. See Wikimedia Found. v. Nat'l Sec. Agency, 857 F.3d 193, 210 (4th Cir. 2017) ("Because details about the collection process remain classified, Wikimedia can't precisely describe the technical means that the NSA employs.");
144. Solove & Citron, supra note 27, at 740 n.19. 354. Cave, supra note 113, at 774. 355. 848 F.3d 262 (4th Cir. 2017).
145. See generally Peters v. St. Joseph Serv. Corp., 74 F. Supp. 3d 847 (S.D. Tex. 2015); In re SAIC, 45 F. Supp. 3d 14 (D.D.C. 2014). 360. 672 F.3d 64, 69 (1st Cir. 2012).
146. Katz, 672 F.3d at 80 (citing Anderson v. Hannaford Bros., 659 F.3d 151, 164-65 (1st Cir. 2011)).
147. Id.
148. Reilly v. Ceridian Corp., 664 F.3d 38, 46 (3d Cir. 2011) (finding no standing in case where claims alleged violations of the New Jersey Identity Theft Protection Act and the New Jersey Consumer Fraud Act);
149. Complaint at 10, Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011) (No. 2:10-cv-05142), 2010 WL 11199509. 365. 663 F. App'x 384, 388 (6th Cir. 2016).
150. Galaria, 663 F. App'x at 386. 370. Id. at 387.
151. In re SuperValu Inc., 870 F.3d at 767; Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963, 965 (7th Cir. 2016).
152. Galaria¸ 663 F. App'x at 391; See Lewert, 819 F.3d at 966-67; In re SuperValu Inc., 870 F.3d at 769, 774. 374. Lewert, 819 F.3d at 967; Remijas, 794 F.3d at 694 ("In addition to the alleged future injuries, the plaintiffs assert that they have already lost time and money protecting themselves against future identity theft and fraudulent charges.").
153. E.g., Martecchini, supra note 20, at 1483-86 (noting different interpretations by courts).
154. Caudle v. Towers, Perrin, Forster & Crosby, Inc., 580 F. Supp. 2d 273, 282 (S.D.N.Y. 2008);
155. Cave, supra note 113, at 769; Martecchini, supra note 20, at 1491.
156. Wooten, supra note 113, at 240.
157. Martecchini, supra note 20, at 1493.
158. Solove & Citron, supra note 27, at 743.
159. Id. (quoting In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 272-74 (3d Cir. 2016)).
160. Solove & Citron, supra note 27, at 750.
161. Cave, supra note 113, at 785-86; Johnson, supra note 141, at 26; Martecchini, supra note 20, at 1491;
162. Rustad & Koenig, Cybercrime, supra note 4, at 1580; Simpson, supra note 3, at 686; Wooten, supra note 113, at 232. 393. 273 P.3d 106, 110 (Or. 2012).
163. Id.
164. William L. Prosser, Privacy, 48 CALIF. L. REV. 383, 385 (1960); see also Ludington, supra note 62, at 162-63 (noting the decline of the public disclosure of private facts tort due to its conflict with the First Amend- ment when communications when there is a public interest in that information being known);
165. Richards & Solove, supra note 145, at 1892. Prosser also expressed concern that the false light and disclosure of private facts torts involved an examination of reputation, overlapping with defamation law. Prosser, supra, at 398. 406. Richards & Solove, supra note 145, at 1902.
166. Time Inc. v. Hill, 385 U.S. 374 (1967).
167. Richards & Solove, supra note 145, at 1923.
168. Id. (arguing that database cases raise fewer First Amendment issues than tort actions about emotional injuries caused by actions of the press).
169. Rabin, Data, supra note 129, at 317.
170. Taylor Hatmaker, Facebook's Latest Privacy Debacle Stirs Up More Regulatory Interest from Law- makers, TECHCRUNCH (Mar. 17, 2018, 8:40 PM), https://techcrunch.com/2018/03/17/facebook-cambridge-ana- lytica-regulation-klobuchar-warner/.
171. F.S.C. Northrop, Law, Language and Morals, 71 YALE L.J. 1017, 1023-24 (1962).
172. S.E. 68, 70 (Ga. 1905);
173. Jonathan Kahn, Biotechnology and the Legal Constitution of the Self: Man- aging Identity in Science, the Market, and Society, 51 HASTINGS L.J. 909, 915 (2000).
174. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193, 193 (1890).
175. Oldberg, supra note 48, at 197-98.
176. Gasser, supra note 144, at 62.
177. E.g., Pavesich, 50 S.E. at 69 (concerning an advertisement with customer testimonial next to plaintiff's likeness, where statement was not made by plaintiff and plaintiff had not consented to the use of his image).
178. Brian Feldman, Facebook Reaches Settlement in Sponsored Stories Lawsuit, ATLANTIC (Aug. 27, 2013), https://www.theatlantic.com/technology/archive/2013/08/facebook-reaches-settlement-sponsored-sto- ries/311753/.
179. Prosser, supra note 405.
180. Oldberg, supra note 48, at 198.
181. Prosser, supra note 405, at 389.
182. Danielle Keates Citron, Mainstreaming Privacy Torts, 98 CALIF. L. REV. 1805, 1807 (2010);
183. Richards & Solove, supra note 145, at 1887.
184. Richards & Solove, supra note 145, at 1890.
185. Prosser, supra note 405, at 422.
186. Ludington, supra note 62, at 159.
187. Richards & Solove, supra note 145, at 1889.
188. Wooten, supra note 113, at 231-32. It should be noted, however, that the Fourth Circuit recently found that the exposure of patient files was a publication for purposes of insurance coverage for a data breach. See Travelers Indem. Co. of Am. v. Portal Healthcare Sol., LLC, 644 F. App'x 245, 247-48 (4th Cir. 2016).
189. Ludington, supra note 62, at 160. 432. Id. at 166.
190. Oldberg, supra note 48, at 203.
191. Meghan Boone, The Autonomy Hierarchy, 22 TEX. J. ON C.L. & C.R. 1, 15 (2016) (discussing the ways that courts treat spiritual autonomy and physical autonomy). 435. Id. at 16.
192. Ludington, supra note 62, at 147.
193. ALAN F. WESTIN, PRIVACY AND FREEDOM 7 (1970).
194. Gasser, supra note 144, at 63. 439. Id. at 67.
195. Cadwalladr & Graham-Harrison, supra note 68.
196. Sara Salinas, Facebook Stock Slides After FTC Launches Probe of Data Scandal, CNBC (Mar. 26, 2018), https://www.cnbc.com/2018/03/26/ftc-confirms-facebook-data-breach-investigation.html. 444. Gasser, supra note 144, at 64.
197. Id.
198. Id.; Ludington, supra note 62, at 184.
199. Ludington, supra note 62, at 185. 448. 793 P.2d 479, 496 (Cal. 1990).
200. Id. at 497 (Arabian, J., concurring) (emphasis in original).
201. Id. at 508-09 (Mosk, J., dissenting);
202. Kahn, supra note 416, at 933-34. 455. 71 P.3d 296, 311 (Cal. 2003).
203. Id. at 325-26 (Mosk, J., dissenting).
204. 159 F. Supp. 3d 1101 (N.D. Cal. 2016).
205. Id. at 1107.
206. Id.
207. See, e.g., Self Driving, XKCD, https://xkcd.com/1897/ (last visited Nov. 2, 2018).
208. Kahn, supra note 416, at 916.
209. Kahn, supra note 416, at 935, 938 ("Granting legal recognition to the constitutive elements of identity is a logical corollary of recognizing its outward manifestations in names or images."). 465. Id. at 951.
210. Id. at 910 (arguing that ensuring informed consent does not protect personal identity).
211. Richards & Solove, supra note 145, at 1919. 468. Id. at 1918.
212. Ludington, supra note 62, at 161.
213. Prosser, supra note 405, at 389. 471. 9 N.W. 146, 146 (Mich. 1881).
214. Id. at 165-66. It should be noted that Prosser's conclusion in Privacy lacked some internal consistency. Prosser wrote that "by the use of a single word supplied by Warren and Brandeis, the courts have created an independent basis of liability, which is a complex of four distinct and only loosely related torts . . . ." Prosser, supra note 405, at 422. The 1881 case of De May v. Roberts, however, explicitly referred to the plaintiff's "legal right to the privacy of her apartment." 9 N.W. 146, 149 (1881). The court could not have been referring to a constitutional right of privacy, because neither Dr. De May nor Mr. Scattergood were government actors. Prosser does not address how this dignitary harm fits into his proprietary model. 476. Cadwalladr & Graham-Harrison, supra note 68.
215. Kahn, supra note 416, at 915.
216. Id. at 917; Ludington, supra note 62, at 167.
217. Kahn, supra note 416, at 914. 480. Id. at 950.
218. Richards & Solove, supra note 145, at 1916.
219. Solove & Citron, supra note 27, at 768-69.
220. Kahn, supra note 416, at 922.
221. Ludington, supra note 62, at 162.
222. Richards & Solove, supra note 145, at 1919.
223. Id. 491. Fox & Stein, supra note 27, at 990-91; Goldberg, supra note 137, at 820-21.
224. Solove & Citron, supra note 27, at 29.
225. Rustad & Koenig, Tort Monster, supra note 100, at 57 (quoting MARSHAL S. SHAPO, THE DUTY TO ACT: TORT LAW, POWER AND PUBLIC POLICY xiii (1977)).
226. Rustad & Koenig, Tort Monster, supra note 100, at 62.
227. Rustad & Koenig, Cybercrime, supra note 4, at 1583.
228. Johnson, supra note 141, at 22.
229. Id. at 29-30 (noting also that "a damages cap should not apply to cases involving egregious conduct").
230. Ludington, supra note 62, at 186.
231. Riedy & Hanus, supra note 28, at 37.
232. Rabin, Data, supra note 129, at 335.
233. Andrew S. Pollis, Busting Up the Pretrial Industry, 85 FORDHAM L. REV. 2097, 2099-2100 (2017).
234. Rabin, Enabling Torts, supra note 182, at 450; Broin, TOBACCO ON TRIAL, http://www.tobaccoon trial.org/?page_id=592 (last visited Nov. 2, 2018).
235. Riedy & Hanus, supra note 28, at 38.
236. Maya Kosoff, Zuckerberg Hits Users With the Hard Truth: You Agreed to This, VANITY FAIR (Mar. 26, 2018, 11:01 AM), https://www.vanityfair.com/news/2018/03/zuckerberg-hits-users-with-the-hard-truth-you- agreed-to-this.
237. See Exec. Order, supra note 133; NIST, supra note 133.
238. Rabin, Data, supra note 129, at 315.
239. Riedy & Hanus, supra note 28, at 23.
240. Rabin, Enabling Torts, supra note 182, at 450; Broin, supra note 504.
241. U.S. GOV'T ACCOUNTABILITY OFFICE, Federal Fees, Fines, and Penalties 10, (Dec. 1, 2016), https://www.gao.gov/assets/690/681352.pdf.