Privacy laws of the United States

Privacy International 2007 privacy ranking
green: Protections and safeguards
red: Endemic surveillance societies

The privacy laws of the United States deal with several different legal concepts. One is the invasion of privacy, a tort based in common law allowing an aggrieved party to bring a lawsuit against an individual who unlawfully intrudes into his or her private affairs, discloses his or her private information, publicizes him or her in a false light, or appropriates his or her name for personal gain.^[1] Public figures have less privacy, and this is an evolving area of law as it relates to the media.

The essence of the law derives from a right to privacy, defined broadly as "the right to be let alone." It usually excludes personal matters or activities which may reasonably be of public interest, like those of celebrities or participants in newsworthy events. Invasion of the right to privacy can be the basis for a lawsuit for damages against the person or entity violating the right. These include the Fourth Amendment right to be free of unwarranted search or seizure, the First Amendment right to free assembly, and the Fourteenth Amendment due process right, recognized by the Supreme Court as protecting a general right to privacy within family, marriage, motherhood, procreation, and child rearing.^[2]

Right to privacy

Early years

The early years in the development of privacy rights began with English common law which protected "only the physical interference of life and property". Its development of tort remedies is "one of the most significant chapters in the history of privacy law".^[3] Those rights expanded to include a "recognition of man's spiritual nature, of his feelings and his intellect." Eventually, the scope of those rights broadened even further to include a basic "right to be let alone," and the former definition of "property" would then comprise "every form of possession – intangible, as well as tangible." By the late 19th century, interest in privacy grew as a result of the growth of print media, especially newspapers.^[3]

Between 1850 and 1890, U.S. newspaper circulation grew by 1,000 percent—from 100 papers with 800,000 readers to 900 papers with more than 8 million readers.^[3] In addition, newspaper journalism became more sensationalistic, and was termed yellow journalism. The growth of industrialism led to rapid advances in technology, including the handheld camera, as opposed to earlier studio cameras, which were much heavier and larger. In 1884, Eastman Kodak company introduced their Kodak Brownie, and it became a mass market camera by 1901, cheap enough for the general public. This allowed people and journalists to take candid snapshots in public places for the first time.

Samuel D. Warren and Louis D. Brandeis, young partners in a new law firm, feared that this new small camera technology would be used by the "sensationalistic press." Seeing this becoming a likely challenge to individual privacy rights, they wrote the "pathbreaking"^[3] Harvard Law Review article in 1890, "The Right to Privacy".^[4] According to legal scholar Roscoe Pound, the article did "nothing less than add a chapter to our law",^[5] and in 1966 legal textbook author, Harry Kalven, hailed it as the "most influential law review article of all".^[3] As recently as 2001, in the Supreme Court case of Kyllo v. United States, 533 U.S. 27 (2001), the article was cited by a majority of justices, both those concurring and those dissenting.^[3]

Brandeis and Warren article

The development of the doctrine regarding the tort of "invasion of privacy" was largely spurred by the Warren and Brandeis article, "The Right to Privacy". In it, they explain why they wrote the article in its introduction: "Political, social, and economic changes entail the recognition of new rights, and the common law, in its eternal youth, grows to meet the demands of society".^[4] More specifically, they also shift their focus on newspapers:

The press is overstepping in every direction the obvious bounds of propriety and of decency. Gossip is no longer the resource of the idle and of the vicious, but has become a trade, which is pursued with industry as well as effrontery. To satisfy a prurient taste the details of sexual relations are spread broadcast in the columns of the daily papers....The intensity and complexity of life, attendant upon advancing civilization, have rendered necessary some retreat from the world, and man, under the refining influence of culture, has become more sensitive to publicity, so that solitude and privacy have become more essential to the individual; but modern enterprise and invention have, through invasions upon his privacy, subjected him to mental pain and distress, far greater than could be inflicted by mere bodily injury."^[4]

They then clarify their goals: "It is our purpose to consider whether the existing law affords a principle which can properly be invoked to protect the privacy of the individual; and, if it does, what the nature and extent of such protection is".^[4]

Warren and Brandeis write that privacy rights should protect both businesses and private individuals. They describe rights in trade secrets and unpublished literary materials, regardless whether those rights are invaded intentionally or unintentionally, and without regard to any value they may have. For private individuals, they try to define how to protect "thoughts, sentiments, and emotions, expressed through the medium of writing or of the arts". They describe such things as personal diaries and letters needing protection, and how that should be done: "Thus, the courts, in searching for some principle upon which the publication of private letters could be enjoined, naturally came upon the ideas of a breach of confidence, and of an implied contract". They also define this as a breach of trust, where a person has trusted that another will not publish their personal writings, photographs, or artwork, without their permission, including any "facts relating to his private life, which he has seen fit to keep private". And recognizing that technological advances will become more relevant, they write: "Now that modern devices afford abundant opportunities for the perpetration of such wrongs without any participation by the injured party, the protection granted by the law must be placed upon a broader foundation".^[4]

Modern tort law

In the United States today, "invasion of privacy" is a commonly used cause of action in legal pleadings. Modern tort law includes four categories of invasion of privacy:^[6]

• Intrusion of solitude: physical or electronic intrusion into one's private quarters
• Public disclosure of private facts: the dissemination of truthful private information which a reasonable person would find objectionable
• False light: the publication of facts which place a person in a false light, even though the facts themselves may not be defamatory
• Appropriation: the unauthorized use of a person's name or likeness to obtain some benefits

Intrusion of solitude and seclusion

Intrusion of solitude occurs where one person intrudes upon the private affairs of another. In a famous case from 1944, author Marjorie Kinnan Rawlings was sued by Zelma Cason, who was portrayed as a character in Rawlings' acclaimed memoir, Cross Creek.^[7] The Florida Supreme Court held that a cause of action for invasion of privacy was supported by the facts of the case, but in a later proceeding found that there were no actual damages.

Intrusion upon seclusion occurs when a perpetrator intentionally intrudes, physically, electronically, or otherwise, upon the private space, solitude, or seclusion of a person, or the private affairs or concerns of a person, by use of the perpetrator's physical senses or by electronic device or devices to oversee or overhear the person's private affairs, or by some other form of investigation, examination, or observation intrude upon a person's private matters if the intrusion would be highly offensive to a reasonable person. Hacking into someone else's computer is a type of intrusion upon privacy,^[8] as is secretly viewing or recording private information by still or video camera.^[9] In determining whether intrusion has occurred, one of three main considerations may be involved: expectation of privacy; whether there was an intrusion, invitation, or exceedance of invitation; or deception, misrepresentation, or fraud to gain admission. Intrusion is “an information-gathering, not a publication, tort…legal wrong occurs at the time of the intrusion. No publication is necessary”.^[10]

Restrictions against the invasion of privacy encompasses journalists as well:

“The First Amendment has never been construed to accord newsmen immunity from torts or crimes committed during the course of newsgathering. The First Amendment is not a license to trespass, to steal, or to intrude by electronic means into the precincts of another’s home or office”.^[10][11]

Public disclosure

Public disclosure of private facts arises where one person reveals information which is not of public concern, and the release of which would offend a reasonable person.^[12] "Unlike libel or slander, truth is not a defense for invasion of privacy."^[8] Disclosure of private facts includes publishing or widespread dissemination of little-known, private facts that are non-newsworthy, not part of public records, public proceedings, not of public interest, and would be offensive to a reasonable person if made public.^[10]

False light

False light is a legal term that refers to a tort concerning privacy that is similar to the tort of defamation. For example, the privacy laws in the United States include a non-public person's right to privacy from publicity which puts them in a false light to the public; which is balanced against the First Amendment right of free speech.

False light laws are "intended primarily to protect the plaintiff's mental or emotional well-being".^[13] If a publication of information is false, then a tort of defamation might have occurred. If that communication is not technically false but is still misleading then a tort of false light might have occurred.^[13]

The specific elements of the Tort of false light vary considerably even among those jurisdictions which do recognize this tort. Generally, these elements consist of the following:

• A publication by the defendant about the plaintiff;
• Made with actual malice (very similar to that type required by New York Times v. Sullivan in defamation cases);
• Places the plaintiff in a false light; and
• Highly offensive (i.e., embarrassing to reasonable persons)^[13]

Thus in general, the doctrine of false light holds:

One who gives publicity to a matter concerning another before the public in a false light is subject to liability to the other for invasion of privacy, if (a) the false light in which the other was placed would be highly offensive to a reasonable person, and (b) the actor had knowledge of or acted in a reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.^[14]

For this wrong, money damages may be recovered from the first person by the other.

At first glance, this may appear to be similar to defamation (libel and slander), but the basis for the harm is different, and the remedy is different in two respects. First, unlike libel and slander, no showing of actual harm or damage to the plaintiff is usually required in false light cases, and the court will determine the amount of damages. Second, being a violation of a Constitutional right of privacy, there may be no applicable statute of limitations in some jurisdictions specifying a time limit within which period a claim must be filed.

Consequently, although it is infrequently invoked, in some cases false light may be a more attractive cause of action for plaintiffs than libel or slander, because the burden of proof may be less onerous.

What does "publicity" mean? A newspaper of general circulation (or comparable breadth) or as few as 3–5 people who know the person harmed? Neither defamation nor false light has ever required everyone in society be informed by a harmful act, but the scope of "publicity" is variable. In some jurisdictions, publicity "means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge."^[15]

Moreover, the standards of behavior governing employees of government institutions subject to a state or national Administrative Procedure Act (as in the United States) are often more demanding than those governing employees of private or business institutions like newspapers. A person acting in an official capacity for a government agency may find that their statements are not indemnified by the principle of agency, leaving them personally liable for any damages.

Example: If someone's reputation was portrayed in a false light during a personnel performance evaluation in a government agency or public university, one might be wronged if only a small number initially learned of it, or if adverse recommendations were made to only a few superiors (by a peer committee to department chair, dean, dean's advisory committee, provost, president, etc.). Settled cases suggest false light may not be effective in private school personnel cases,^[16] but they may be distinguishable from cases arising in public institutions.

Appropriation of name or likeness

Although privacy is often a common-law tort, most states have enacted statutes that prohibit the use of a person’s name or image if used without consent for the commercial benefit of another person.

Appropriation of name or likeness occurs when a person uses the name or likeness of another person for personal gain or commercial advantage. Action for misappropriation of right of publicity protects a person against loss caused by appropriation of personal likeness for commercial exploitation. A person's exclusive rights to control his or her name and likeness to prevent others from exploiting without permission is protected in similar manner to a trademark action with the person's likeness, rather than the trademark, being the subject of the protection.^[8] Appropriation is the oldest recognized form of invasion of privacy involving the use of an individual’s name, likeness, or identity without consent for purposes such as ads, fictional works, or products.^[10]

"The same action – appropriation —can violate either an individual’s right of privacy or right of publicity. Conceptually, however, the two rights differ".^[10]

Constitutional basis for right to privacy

Federal

Although the word "privacy" is actually never used in the text of the United States Constitution,^[17] there are Constitutional limits to the government's intrusion into individuals' right to privacy. This is true even when pursuing a public purpose such as exercising police powers or passing legislation. The Constitution, however, only protects against state actors. Invasions of privacy by individuals can only be remedied under previous court decisions.

The Fourth Amendment to the Constitution of the United States ensures that "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized".

The First Amendment protects the right to free assembly, broadening privacy rights. The Ninth Amendment declares that the fact that a right is not explicitly mentioned in the Constitution does not mean that the government can infringe on that right. The Supreme Court recognized the Fourteenth Amendment as providing a substantive due process right to privacy. This was first recognized by several Supreme Court Justices in Griswold v. Connecticut, a 1965 decision protecting a married couple's rights to contraception. It was recognized again in 1973 Roe v. Wade, which invoked the right to privacy to protect a woman's right to an abortion, and in the 2003 with Lawrence v. Texas, which invoked the right to privacy regarding the sexual practices of same-sex couples.

Alaska

On August 22nd, 1972 the Alaska Right of Privacy Amendment, Amendment 3, was approved with 86% of the vote in support of the legislatively referred constitutional amendment.^[18] Article I, Section 22 of Alaska's constitution states, "The right of the people to privacy is recognized and shall not be infringed. The legislature shall implement this section."^[19]

California

Article 1, §1 of the California Constitution articulates privacy as an inalienable right.

CA SB 1386 expands on privacy law and guarantees that if a company exposes a Californian's sensitive information this exposure must be reported to the citizen. This law has inspired many states to come up with similar measures.^[20]

California's "Shine the Light" law (SB 27, CA Civil Code § 1798.83), operative on January 1, 2005, outlines specific rules regarding how and when a business must disclose use of a customer's personal information and imposes civil damages for violation of the law.

California's Reader Privacy Act was passed into law in 2011.^[21] The law prohibits a commercial provider of a book service, as defined, from disclosing, or being compelled to disclose, any personal information relating to a user of the book service, subject to certain exceptions. The bill would require a provider to disclose personal information of a user only if a court order has been issued, as specified, and certain other conditions have been satisfied. The bill would impose civil penalties on a provider of a book service for knowingly disclosing a user's personal information to a government entity in violation of these provisions. This law is applicable to electronic books in addition to print books.^[22]

Florida

Article I, §23 of the Florida Constitution states that "Every natural person has the right to be let alone and free from governmental intrusion into the person’s private life except as otherwise provided herein. This section shall not be construed to limit the public’s right of access to public records and meetings as provided by law."^[23]

Montana

Article 2, §10 of the Montana Constitution states that "The right of individual privacy is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest".^[24]

Washington

• Law enforcement are required to obtain a warrant before using IMSI-catcher technology.^[25]
• Private individual's text messages are protected from warrantless searches.^[26]

Privacy of health related information

A special case of keeping information private is the protection of health records (e.g., discharge summary of a patient). During provision of healthcare, this information has to be passed from one provider to another and must be protected. Similarly, there are provisions for how health care data can be used in research. De-identification of health records prior their research use is typically used to minimize risk of disclosure.

Proposed laws

The following laws effecting privacy were proposed and are pending consideration before the U.S. House or Senate or were proposed, but not enacted:

• S. 2588 Cybersecurity Information Sharing Act (CISA), pending, introduced in the U.S. Senate on July 10, 2014.^[27]
• H.R. 3523, H.R. 624 Cyber Intelligence Sharing and Protection Act (CISPA), pending, introduced in and passed by the U.S. House in 2012, reintroduced in and passed by the U.S. House in 2013, pending before the U.S. Senate.^[28]
• H.R. 3674 Precise Act, reported by committee April 18, 2012 by Representative Dan Lungren (R-CA), but not enacted.^[29] The bill changed as "Lungren dropped many of the critical infrastructure and DHS provisions" due to the house.^[30]
• H.R. 4257 Federal Information Security Amendment Act of 2012, reported by committee April 18, 2012^[31] by Representative Darrell Issa (R-CA), but not enacted.
• S. 2151 Secure IT, introduced by Senator John McCain (R-AZ) on March 1, 2012, but was not enacted.^[32]
• S. 2105 Cybersecurity Act, reported by committee on February 15, 2012. Sponsored by Senator Joseph Lieberman (I-CT).^[33] Failing to gain enough support for passage, the bill, entitled "Cybersecurity Act of 2012" (S. 3414), was reintroduced on July 19, 2012 in a revised form which omitted federal imposition of security standards on IP providers, as well as including stronger privacy and civil liberties protections. The revised bill was not enacted.^[34]

See also

• Communications Assistance for Law Enforcement Act (CALEA)
• HTLINGUAL, a CIA project to intercept mail destined for the Soviet Union and China that operated from 1952 until 1973.
• Mass surveillance in the United States
• NSA call database (MAINWAY), a database maintained by the U.S. National Security Agency (NSA) containing metadata for hundreds of billions of telephone calls made through the four largest telephone carriers in the United States: AT&T, SBC, BellSouth (all three now called AT&T), and Verizon.
• PRISM, a clandestine mass electronic surveillance data mining program operated by the United States National Security Agency (NSA) since 2007.
• U.S. Government databases
• Ninth Amendment to the United States Constitution
• Tenth Amendment to the United States Constitution
• Compilation of State and Federal Privacy Laws 2016 published by Privacy Journal
• The Law of Privacy Explained published by Privacy Journal

Footnotes

Further reading

• Samantha Barbas, Laws of Image: Privacy and Publicity in America. Stanford, CA: Stanford University Press, 2015.

External links

• Invasion of Privacy, Annotation 19 - First Amendment, U.S. Constitution, from FindLaw online legal information.
• "Invasion of Privacy and the Media: The Right 'To Be Let Alone' ", by John A. Bussian and Paul J. Levine, in the Reporters Handbook from The Florida Bar, updated August 2004.
• "The Right to Privacy", by Warren and Brandeis, in the Harvard Law Review (Vol. IV, No. 5), December 15, 1890.
• Privacy Rights Clearinghouse, a consumer education and privacy rights advocacy organization.
• "Privacy", in the Stanford Encyclopedia of Philosophy, revised August 9, 2013.
• Privacy Journal, a monthly privacy newsletter in the United States that publishes the Compilation of State and Federal Privacy Laws, an annual collection of U.S. and Canadian federal, state, and provincial privacy laws.