Showing posts with label privacy. Show all posts
Showing posts with label privacy. Show all posts

Thursday, September 5, 2024

In 'Baywatch' case, court ponders discovery rule for models' tort claims over ads posted on Facebook

Models suing an adult entertainment club occasioned the high court of Massachusetts to ponder the problem of social media and the statute of limitations on media torts in a decision Wednesday.

When I heard that the Massachusetts Supreme Judicial Court decided a case about Baywatch, I knew I would want to blog about it.

Alas, I was misled. "Bay Watch" in the instant matter has nothing to do with the The Hoff or 1990s TV.

Plaintiffs allege this ad depicts model Paola Cañas.
From Compl. ex. D.
Still, it's an interesting case. Bay Watch, Inc., is the owner of an adult entertainment club in Stoughton, Massachusetts, Club Alex's. In a lawsuit filed in federal district court in June 2021, six globally recognized models alleged that Club Alex's posted their images, some of them in scant swimwear, to Facebook to promote the club, even though none of the models had any association with the club. The models alleged trademark infringement, misappropriation ("right of publicity"), defamation, and conversion.

The issue in the trial court was the statute of limitations for the state tort claims. Sitting on the generous end of the spectrum, Massachusetts allows three years for media tort claims. But the ads the plaintiffs complained about appeared from 2013 to 2015. The district court accordingly granted summary judgment on the tort claims to the defendant in 2023. But on a plaintiff motion to reconsider at the end of the year, the court agreed to certify the limitations question to the Massachusetts Supreme Judicial Court (SJC).

Alas, not that one (IMDb).

The plaintiffs in the trial court had tried to avail of "the discovery rule," a common law rule that tolls the statute of limitations when it would work an unfairness on a plaintiff who is reasonably not cognizant that she suffered an injury for which there might be a legally responsible actor. 

The discovery rule gets a lot of play in toxic tort cases, in which illness alleged to have resulted from exposure to toxic substances might take years to manifest, and the risk of exposure might not even have been known to the victim at the time. Buttressing his decision with gender-equity-oriented social science, the late Judge Jack Weinstein famously used the discovery rule in the 1990s to give reprieve to plaintiffs suing the makers of DES, a once widely prescribed synthetic estrogen replacement that turned out to be dangerously carcinogenic.

The discovery rule is appealing as a matter of fairness, but applying it can introduce a thorny question of fact. And there are many more thorns when the rule is invoked in a case without the clear delimiters of physical injury.

It's often said, as a default matter, that the limitations period for media torts, such as defamation, runs from the time of publication. Usually that rule works well enough. But in some cases, plaintiffs are able to invoke the discovery rule. If cases are any indication, then defamation occurs in the disruption of business relationships more often than in the pop culture paradigm of media subject versus publisher. A businessperson, for example, might think she lost a contract on the merits of a bid and only later discover that she lost the contract upon the whisper of a false and harmful rumor into the right ear.

Proliferation of media in the internet age has made courts slightly more willing to afford plaintiffs an argument for the discovery rule, because mass media publication in a sea of online content might not rise to an injured's attention as quickly as a story in the town paper in ye olden days. But courts' patience is not without limit. In the online environment, courts have adapted another rule familiar to the conventional interplay of mass media and the discovery rule. As the SJC opined, in part quoting the Massachusetts Appeals Court:

"[W]here an alleged defamatory publication is broadly circulated to the public, and did not involve concealment or confidential communications," the discovery rule will not be applied, and the cause of action will accrue upon publication, as such widespread publication should have been discovered by the plaintiff.

In other words, the limitations period runs upon publication, unless plaintiff can invoke the discovery rule because a reasonable person would not have recognized the harm and arguably causal actor, unless the thing was out there for everyone so the plaintiff should have recognized the harm and arguably causal actor—in which case we come back around to publication again.

If that sounds circular .... Right. The problem with this approach is that if a reasonable person would not have recognized harm, cause, and actor, then, by definition, the plaintiff cannot be expected to have recognized harm, cause, and actor. In tort analysis, the word "should" means "a reasonable person would."

What this approach really allows is for the court to deny the plaintiff the latitude of the discovery rule as a matter of law, and to dismiss, without having to hassle (or Hassel) with the plaintiff's reasonable cognizance as a question of fact suitable for trial. In short, what the court giveth, the court may taketh away.

And that's what happened in the instant case. The federal district court first indicated that it was inclined to dismiss because the ads appeared too long ago. When the plaintiffs tried to invoke the discovery rule, the court was skeptical. These are world famous models with agents whose job it is to scan for unlicensed uses of clients' likenesses, and with lawyers who have sued over misappropriations before. All the same, the court concluded, credibility notwithstanding, these images were out there in the world long enough that the plaintiffs should have found out about them. So no discovery rule.

What seems to have given the court pause on reconsideration is that the images here were posted on social media. A paralegal in the employ of the plaintiffs

attested that there is no software that would allow her to efficiently search for the images in question and that Internet search engines do not search social media posts. As a result, the only available method is this "particularized research of particular establishments." It is this process, presumably, that led the plaintiffs to the defendant's Facebook posts.

But that took time.

The witness had a point. Google seems slow to index social media when it does at all. Many writers have trumpeted "the death of the search engine," as users prefer to seek answers in familiar social media not as polluted as Google search results with commercialization and distortions resulting from digital marketing under the guise of "optimization."

As well, the tech giants seem to have backed off image searching. When reverse image search first came out, I had fun seeing what famous people Google thought I looked like. Now, no matter what image I start with, Google either finds me, or finds nothing, saying, "Results for people are limited. Try searching a larger [image] area." The search tools can't have gotten dumber; that must be a choice. The SJC observed in evidence in the case that Facebook terminated its image search tool in 2021.

You see it, right?

There are now reverse image search apps, by the way, especially for celebrity matches. I'm apparently a dead ringer for UK actress Natalie Dormer (image via Flickr by Gage Skidmore CC BY-SA 2.0, cropped) or the great James Earl Jones (image via Flickr by Phil Davis CC BY-NC-SA 2.0, edited). Eat your heart out, Hollywood. The Celebs app sees me.

The federal district court thus asked the SJC to clarify how the statute of limitations works in a social media world.

In a characteristically methodical opinion for a unanimous court, Justice Scott Kafker stepped through the analysis in 25 pages. The opinion is elaborative, but it adds nothing new. The approach remains: publication, unless discovery rule, unless broad circulation. At greater length in conclusion, here is the court's explanation of the discovery rule in the context of social media:

Claims ... that arise from material posted to social media platforms accrue when a plaintiff knows, or reasonably should know, that he or she has been harmed by the defendant's publication of that material. Given how vast the social media universe is on the Internet, and how access to, and the ability to search for, social media posts may vary from platform to platform and even from post to post, that determination requires consideration of the totality of the circumstances regarding the social media posting, including the extent of its distribution, and the accessibility and searchability of the posting. The application of the discovery rule is therefore a highly fact-specific inquiry, and the determination of whether plaintiffs knew or should have known that they were harmed by a defendant's post on social media must often be left to the finder of fact. If, however, the material posted to social media is widely distributed, and readily accessible and searchable, a judge may determine as a matter of law that the discovery rule cannot be applied.

The record was insufficient, the SJC opined, to determine how the approach should work in the instant case. The plaintiffs had equivocated, the SJC observed, when asked when they first knew about the postings. If they knew before 2018, the court reasoned, then case over. Someone should ask them that.

It is possible for the conventional "whisper" scenario to play out on social media. The SJC cited a California case, Jones v. Reekes (Cal. Ct. App. 2022), in which plaintiff had been blocked from viewing the defendant's postings. Still, the California court concluded that the postings "were otherwise available to the public[,] and the block was easily circumventable;" moreover, the plaintiff was on alert generally to the defendant's derisive commentary. So the plaintiff was precluded from availing of the discovery rule, and the date of publication controlled.

Now I can't unsee it.
Jones was thus not exceptional as a mass media case, and I don't think Bay Watch is either. I suspect the SJC was being deferential to the federal trial court, giving it a chance to make the final call. It seems to me quite clear already that the district court did what the SJC commanded when it first ruled for the defense in 2023. The SJC having confirmed the rule, there seems little more for the district court to do but reenter that judgment.

The result might seem unfair to the assiduously searching plaintiffs, or, more precisely, their agents and lawyers. But the statute of limitations furthers meritorious competing interests, including finality in freedom from legal jeopardy on the part of all publishers.

The case in the SJC is Davalos v. Bay Watch, Inc., No. SJC-13534 (Mass. Sept. 4, 2024) (Kafker, J.) (FindLaw). The case in the federal court is Davalos v. Baywatch, Inc., No. 1:21-cv-11075 (D. Mass. Dec. 15, 2023) (Gorton, Dist. J.) (Court Listener).

UPDATE, Sept. 12: I was saddened to hear of James Earl Jones's passing shortly after I published this post (N.Y. Times, Sept. 9, 2024). All joking of resemblance aside, I was a fan.

Wednesday, March 27, 2024

Free torts textbook ready for academic year 2024-25


TORTZ: A Study of American Tort Law is complete and revised for the coming academic year 2024-25.

The two-volume textbook is posted for free download from SSRN (vol. 1, vol. 2), and available in hardcopy from Lulu.com at cost, about $30 per volume plus shipping.

This final iteration of the book now, for the first time, includes its final three chapters: (16) interference and business torts, (17) government liability and civil rights, and (18) tort alternatives.


TORTZ TABLE OF CONTENTS

Volume 1

Chapter 1: Introduction

A. Welcome
B. The Fundamental Problem
C. Parameters
D. Etymology and Vocabulary
E. “The Pound Progression”
F. Alternatives
G. Review

Chapter 2: Intentional Torts

A. Introduction
B. Assault

1. History
2. The Restatement of Torts
3. Subjective and Objective Testing
4. Modern Rule
5. Transferred Intent
6. Statutory Torts and Harassment

C. Battery

1. Modern Rule
2. The Eggshell Plaintiff
3. Knowledge of a Substantially Certain Result
4. Common Law Evolution and Battered Woman Syndrome

D. False Imprisonment

1. Modern Rule
2. Problems

E. Intentional Infliction of Emotional Distress (IIED)

1. Dynamic Intent
2. Modern Rule
3. The “Heart Balm” Torts

F. Fraud

1. Fraud in Context
2. Modern Rule
3. Pleading Fraud
4. Exercise

G. The “Process” Torts

1. Innate Imprecision
2. Modern Rule
3. Majority Rejection of Malicious Civil Prosecution

H. “Prima Facie Tort”

1. Origin of Intentional Tort
2. Modern Rule

Chapter 3: Defenses to Intentional Torts 

A. Introduction
B. Defenses of Self, Other, and Property
C. The Spring Gun Case
D. Arrest Privilege and Merchant’s Privilege
E. Consent

1. Modern Rule
2. Scope of Consent
3. Medical Malpractice
4. Limits of Consent

F. Consent in Sport, or Recklessness

1. The Problem of Sport
2. Recklessness

Chapter 4: Negligence

A. Introduction
B. Modern Rule
C. Paradigmatic Cases
D. Historical and Theoretical Approaches to Negligence

1. Origin
2. Foreseeability
3. Custom
4. Augmented Standards
5. Economics

a. Introduction
b. “The Hand Formula”
c. Coase Theorem, Normativity, and Transaction Costs

6. Aristotelian Justice
7. Insurance and Loss-Spreading

E. Landowner Negligence, or Premises Liability

1. Theory of Duty and Standards of Breach
2. Common Law Tripartite Approach
3. Variations from the Unitary Approach in the Third Restatement
4. Applying the Framework, and Who Decides

F. Responsibility for Third-Party Conduct

1. Attenuated Causation, or “the Frances T.  Problem”: Negligence Liability in Creating Opportunity for a Criminal or Tortious Actor
2. Vicarious Liability and Attenuated Causation in the Employment Context: Respondeat Superior and “Direct” Negligence Theories

G. Statutory Torts and Negligence Per Se

1. Statutory Torts
2. Negligence Per Se

a. Introduction
b. Threshold Test
c. Three Mile Island

H. Medical Negligence
I. Spoliation of Evidence

1. Introduction
2. Minority Rule
3. Recognition or Non-Recognition of the Tort Approach
4. Majority Approach

J. Beyond Negligence

Chapter 5: Defenses to Negligence

A. Express Assumption of Risk (EAOR)
B. EAOR in Medical Negligence, and the Informed Consent Tort

1. Development of the Doctrine
2. The “Reasonable Patient” Standard
3. Modern Rule of Informed Consent
4. Causation in Informed Consent
5. Experimental Medicine

C. “Implied Assumption of Risk” (IAOR)

1. Everyday Life
2. Twentieth-Century Rule
3. Play and Sport
4. Work

D. Contributory Negligence

1. Twentieth-Century Rule
2. Complete Defense
3. Vitiation by “Last Clear Chance”

E. Comparative Fault
F. IAOR in the Age of Comparative Fault

1. The Demise of “IAOR”
2. Whither “Secondary Reasonable IAOR”?
3. Revisiting Mrs. Pursley at Gulfway General Hospital

G. Statutes of Limitations
H. Imputation of Negligence

Chapter 6: Subjective Standards

A. Introduction
B. Gender

1. The Reasonable Family
2. When Gender Matters

C. Youth

1. When Youth Matters
2. Attractive Nuisance
3. When Youth Doesn’t Matter

D. Mental Limitations

1. General Approach
2. Disputed Policy

Chapter 7: Strict Liability

A. Categorical Approach
B. Non-Natural Use of Land
C. Abnormally Dangerous Activities

1. Defining the Class
2. Modern Industry

D. Product Liability

1. Adoption of Strict Liability
2. Modern Norms
3. “Big Tobacco”
4. Frontiers of Product Liability

Chapter 8: Necessity

A. The Malleable Concept of Necessity
B. Necessity in Tort Law
C. Making Sense of Vincent
D. Necessity, the Liability Theory

Chapter 9: Damages

A. Introduction
B. Vocabulary of Damages
C. Theory of Damages
D. Calculation of Damages
E. Valuation of Intangibles
F. Remittitur
G. Wrongful Death and Survival Claims

1. Historical Common Law
2. Modern Statutory Framework

a. Lord Campbell’s Act and Wrongful Death
b. Survival of Action After Death of a Party

3. Problems of Application

H. “Wrongful Birth” and “Wrongful Life”
I. Punitive Damages

1. Introduction
2. Modern Rule
3. Pinpointing the Standard

J. Rethinking Death Compensation

Volume 2

Chapter 10: Res Ipsa Loquitur

A. Basic Rules of Proof
B. Res Ipsa Loquitur (RIL)

1. Modern Rule
2. Paradigmatic Fact Patterns

Chapter 11: Multiple Liabilities

A. Introduction
B. Alternative Liability
C. Joint and Ancillary Liability
D. Market-Share Liability Theory
E. Indemnification, Contribution, and Apportionment

1. Active-Passive Indemnity
2. Contribution and Apportionment
3. Apportionment and the Effect of Settlement

F. Rules and Evolving Models in Liability and Enforcement
G. Review and Application of Models

Chapter 12: Attenuated Duty and Causation

A. Introduction
B. Negligence Per Se Redux

1. The Problem in Duty
2. The Problem in Causation
3. The Problem in Public Policy

C. Duty Relationships and Causation Timelines

1. Introduction
2. Frances T. Redux, or Intervening Criminal Acts
3. Mental Illness and Tarasoff Liability
4. Dram Shop and Social Host Liability
5. Rescue Doctrine and “the Fire Fighter Rule”

a. Inverse Rules of Duty
b. Application and Limits

6. Palsgraf: The Orbit and the Stream

a. The Classic Case
b. A Deeper Dig

D. Principles of Duty and Causation

1. Duty
2. Causation

a. The Story of Causation
b. Proximate Cause in the Second Restatement
c. Scope of Liability in the Third Restatement
d. Proximate Cause in the Third Restatement, and Holdover Rules
e. A Study of Transition: Doull v. Foster

E. The Outer Bounds of Tort Law

1. Balancing the Fundamental Elements
2. Negligent Infliction of Emotional Distress (NIED)

a. Rule of No Liability
b. Bystanders and Borderline NIED

3. Economic Loss Rule

a. The Injury Requirement
b. Outer Limits of Tort Law
c. Loss in Product Liability and the Single Integrated Product Rule

Chapter 13: Affirmative Duty

A. Social Policy
B. The American Rule
C. Comparative Perspectives
D. Bystander Effect, or “Kitty Genovese Syndrome”

Chapter 14: Nuisance and Property Torts

A. Trespass and Conversion
B. Private Nuisance
C. Public Nuisance and the Distinction Between Private and Public
D. “Super Tort”

Chapter 15: Communication and Media Torts

A. Origin of “Media Torts”
B. Defamation

1. Framework and Rules
2. Defamation of Private Figures

a. Defamation Proof
b. Defamation Defense

3. Anti-SLAPP Defense
4. Section 230 Defense
5. Constitutional Defamation

a. Sea Change: New York Times Co. v. Sullivan
b. Extending Sullivan
c. Reconsidering Sullivan

C. Invasion of Privacy

1. Framework and Rules

a. Disclosure
b. Intrusion
c. False Light
d. Right of Publicity
e. Data Protection

2. Constitutional Privacy and False Light
3. Demonstrative Cases

a. Disclosure and Intrusion
b. Right of Publicity
c. Bollea v. Gawker Media

4. Data Protection, Common Law, and Evolving Recognition of Dignitary Harms

Chapter 16: Interference and Business Torts

A. Business Torts in General

1. Tort Taxonomy
2. The Broad Landscape
3. Civil RICO

B. Wrongful Termination
C. Tortious Interference

Chapter 17: Government Liability and Civil Rights

A. Sovereign Immunity

1. Federal Tort Claims Act (FTCA) and Foreign Sovereign Immunities Act (FSIA)
2. Text and History of the FTCA
3. Discretionary Function Immunity

B. Civil Rights

1. “Constitutional Tort”
2. Core Framework
3. Official Immunities
4. Climate Change

C. Qui Tam
D. Human Rights

1. Alien Tort Statute
2. Anti-Terrorism Laws

Chapter 18: Tort Alternatives

A. Worker Compensation

1. Introduction and History
2. Elements and Causation
3. Efficacy and Reform

B. Ad Hoc Compensation Funds

Monday, March 11, 2024

Book supports legal privilege for undercover reporting

Truth and Transparency, a recent book by Professors Alan K. Chen and Justin Marceau, is a comprehensive and gratifying tour of the history and law of undercover reporting.

Chen and Marceau teach at the Sturm College of Law at Denver University and have especial expertise in constitutional law, and respectively in public interest law and animal law. In their co-authorship, they examine the social phenomenon of undercover reporting that lies at the intersection of journalism, tort law, and the First Amendment—and often animal law, too.

I know Chen best for his work in opposing ag gag laws: statutes designed to stop and punish journalists, activists, and whistleblowers from investigating and revealing wrongful conduct and animal cruelty in the agricultural industry, especially by way of undercover video recording. Chen has worked against ag gag in Idaho, Iowa, Kansas, and Utah. I've been privileged to sign on to some of the amicus briefs he has coordinated.

Chen and Marceau leave no stone unturned. I was intrigued especially to read about the history of undercover reporting in the United States, the evolution of undercover reporting in its treatment in journalism ethics, and the thorough explication of undercover reporting in tort and First Amendment law.

Upton Sinclair's 1905 The Jungle, a novel based on real-life undercover reporting in the meatpacking industry, was my mind's go-to on the early history of the practice. Apropos of the present Women's History Month, however, it was female reporters such as Nellie Bly who carved out a niche for undercover reporting in the popular imagination in the late 19th century and deserve the most credit for pioneering the genre.

Bly, born Elizabeth Jane Cochran, famously had herself committed to a deplorable New York mental institution in 1887 for 10 days before a New York World lawyer secured her release, per prearrangement. Chen and Marceau recount the stories of Bly and other so-called "girl stunt reporters." They trace the history even further, as well, to antebellum abolitionists determined to expose the horrors of slavery.

Chen and Marceau explore a range of treatments of undercover reporting in journalism ethics, including the qualified permissiveness of the 1996 Code of Ethics of the Society of Professional Journalists, preserved in the more recent 2014 iteration. They observe as well the almost complete prohibition on the practice at National Public Radio, where journalists may engage in deception only when necessary to protect themselves in a conflict zone, and secret recordings may be used in only extraordinary circumstances.

A case that naturally arises throughout the book is the ABC News investigation of hygienic practices at Food Lion in the 1990s (at Reporters Committee). This case was contemporary with my university study of journalism, so was front and center in my class on journalism ethics. Whether or when journalists might engage in deception to get the story is a favorite point of discussion in journalism ethics class. The problem stratifies the need for public trust in journalism across the micro layers of people who are the subjects of stories and the macro layers of readers and the public interest. 

A court in Food Lion ultimately held that ABC journalists could be sued for trespass or breach of loyalty, but awarded only nominal damages. The factual problem for the plaintiffs that precluded a more substantial damages award was that notwithstanding the concealment of their motives, the journalists had been given jobs at Food Lion, and they did their jobs. So from a damages perspective, Food Lion got what it paid for. The appellate court, unlike the trial jury, was unwilling to consider the reputational harm flowing from truthful disclosures, if deceptively obtained, as any kind of compensable loss.

The outcome in Food Lion was consistent with the broad propositions of First Amendment law that there is no right to gather the news, which is why the Freedom of Information Act is a statutory rule, not a constitutional one; and that journalists are not exempt from generally applicable expectations of law, such as honoring contracts, obeying police orders—and not trespassing. As Chen and Marceau observe, the outcome exerted a chill in investigative reporting.

However, the Food Lion rule is hardly absolute, Chen and Marceau also aptly observe. The rule of no-right-to-gather-news has never been wholly true. The courts have given media latitude to test the limits, for example disallowing wiretap liability for receiving probably illegally intercepted communications. And technological advances have complicated the picture. A majority of U.S. circuit courts now, in a post-George Floyd world, have held that the First Amendment protects video-recording police in public places. The proposition seems right, but it doesn't square with the news-gathering rule.

The outcome in Food Lion further hints at a deeper problem in tort law that Chen and Marceau explore: the problem of damages in cases of only notional harm. In contemporary doctrine, a trespass with no infliction of physical harm or loss might entitle a plaintiff to an equitable remedy of injunction, but no more than nominal damages in tort law, thus Food Lion. Though with no damages in the offing, there is no deterrence to deceptive trespass, a logic that likely explains the eventual waning of Food Lion's chilling effect. The problem bleeds into the contemporary debate over the nature of damages in personal privacy violations. 

Journalism exceptionalism resonates as well in the problem of trespass and consent. Food Lion suggests that consent to enter property is vitiated by deception as to one's motive. Chen and Marceau explore opposing academic and judicial views on the question.

In a remarkable work of empirical research unto itself, Chen and Marceau's chapter 6 presents compelling data to show overwhelming public support for undercover reporting to expose wrongdoing. Public support seems to transcend political ideology and even whether the perpetrator of deception is a journalist or activist.

Chen and Marceau argue summatively and persuasively for a qualified legal privilege to protect journalistic deception in undercover reporting. Historical, ethical, and legal authorities all point in the same direction. Even the Fourth Circuit in Food Lion hedged its bets, observing that generally applicable employment law as applied in the case had only an "incidental effect" on news-gathering; in other words, news-gathering was outweighed as a consideration, not shut out.

Technological advances and citizen journalism will continue to generate conflict among conventional norms of property and fair dealing, evolving norms of privacy, and public interest in accountability in private and public sectors. Truth and Transparency is an essential manual to navigate in this brave new world.

Thursday, March 7, 2024

UK anti-SLAPP bill takes fire

The United Kingdom has an anti-SLAPP bill on the table, and lawyer Gideon Benaim has cataloged objections.

In broad strokes, the bill follows the usual pattern of anti-SLAPP, looking for free speech and public interests on the part of the defendant, which then burdens the plaintiff with proving probable success on the merits out of the gate.

Benaim published his objections on the INFORRM blog, part 1 and part 2. Some of his objections track those that I articulated in 2021 as to American anti-SLAPP statutes. I lamented the unfairness of expecting a plaintiff to meet an extraordinary proof standard such as actual malice as to falsity without the benefit of discovery. The equivalent UK approach expects a plaintiff to overcome a bare public interest defense without the opportunity to probe the publisher's process or motives.

Benaim also points out, as I have, that anti-SLAPP is as likely to be invoked by the powerful against the weak as vice versa; Goliath media giant against aggrieved individual; or, as happened, President Trump against sexual assault complainant Stormy Daniels.

Benaim is a rarity, a plaintiff's lawyer in media torts. Not that everyday aggrieved individuals will be able to score a place on his client list, which includes JK Rowling, Naomi Campbell, Roman Polanski, and Gordon Ramsay.

At least in the United States, at least, the already daunting odds of prevailing in a media tort case against a publisher with expert defense counsel on retainer causes most would-be plaintiffs not to sue at all, no matter how just their causes. They can't find counsel and certainly can't navigate complex media torts pro se. And that's before anti-SLAPP comes into play, threatening a losing plaintiff with having to pay the attorney fees of the media giant's high-dollar representation.

As I've written before, anti-SLAPP works well when it works well. Statutes just aren't drafted to ensure that that's always the case. It looks like the UK is struggling with the same problem.

Thursday, February 1, 2024

Naming rape suspects may draw criminal charges for journalists under Northern Ireland privacy law

Bernard Goldbach via Flickr CC BY 2.0
In Northern Ireland, it's a crime for a journalist to identify a rape suspect.

The relevant provision of the country's Justice (Sexual Offences and Trafficking Victims) Act 2022. Attorney Fergal McGoldrick of Carson McDowell in Belfast detailed the law for The International Forum for Responsible Media Blog in October 2023, just after the law took effect.

The law applies to a range of sexual offenses including rape. The prohibition expires upon an arrest warrant, criminal charge, or indictment. If prosecution does not expire the prohibition on identification, it remains in force until 25 years after the death of the suspect. The act amended preexisting privacy law to afford comparable anonymity to victims.

I have deep experience with this issue, and it is fraught. Despite my strong preference for transparency in government, especially in policing, the law has merit.

I was a university newspaper editor back in ye olden days of paper and ink. My newspaper reported vigorously on accusations of sexual assault against a student at our university by a student at a nearby university. The accusations and ensuing criminal investigation gripped the campus.

We learned the identity of both suspect and accuser. We reported the former and concealed the latter. Discussing the matter as an editorial board, we were uncomfortable with this disparity. Having the suspect be a member of our own community and the accuser an outsider amplified our sensitivity to a seeming inequity. We did take measures to minimize use of the suspect's name in the reporting.

These were the journalistic norms of our time. Naming the accuser was unthinkable. This was the era of "the blue dot woman," later identified as Patricia Bowman (e.g., Seattle Times). The nation was enthralled by her allegation of rape against American royalty, William Kennedy Smith. In the 1991 televised trial, Bowman, a witness in court, was clumsily concealed by a floating blue dot, the anonymizing technology of the time.

Smith was acquitted. The case was a blockbuster not only for TV news, but for journalism, raising a goldmine of legal and ethical issues around criminal justice reporting and cameras in the courtroom.

There was no anonymity for Smith. I went to a Society of Professional Journalists (SPJ) conference around this time, and the issues were discussed in a huge plenary session in a ballroom. The crowd exuded self-loathing for the trauma journalism itself had piled on Bowman. Objectivity be damned, many speakers beat the drums for the pillorying of the acquitted Smith.

The calculation in journalism ethics with regard to Smith, and thus to my editorial board, was that police accountability, knowing whom is being investigated, charged, or detained, and public security, alerting the public to a possible threat, or eliciting from the public exonerating evidence, all outweighed the risk of reputational harm that reporting might cause to the accused. Moreover, ethicists of the time reasoned, it would be paternalistic to assume that the public doesn't understand the difference between a person accused and a person convicted.

Then, in my campus case, the grand jury refused to indict. Our reporting uncovered evidence that the accusation might have been exaggerated or fabricated.

Our editorial hearts sank. Had we protected the wrong person?

My co-editor and I discussed the case countless times in the years that followed. We agonized. It pains me still today. Thirty years later, I find myself still retracing the problem, second-guessing my choices. It's like a choose-your-own-adventure where you feel like you're making the right choice each time you turn the pages, yet your steps lead you inevitably to doom.

Idealistically committed as we were at that age to freedom-of-information absolutism, we were inclined to the anti-paternalistic argument and reasoned that probably we should have named everyone from the start and let the public sort it out.

In our defense, a prior and more absolutist generation of norms in journalism ethics prevailed at the time. I was there at SPJ in the following years as leading scholars worked out a new set of norms, still around today, that accepts the reality of competing priorities and evinces more flexible guidance, such as, "minimize harm." Absolutism yielded to nuance. Meanwhile, the internet became a part of our lives, and both publication and privacy were revolutionized.

So in our present age, maybe the better rule is the Northern Ireland rule: anonymize both sides from the start. 

I recognize that there is a difference in a free society between an ethical norm, by which persons decide not to publish, and a legal norm, which institutes a prior restraint. I do find the Northern Ireland rule troublesomely draconian. The law would run headlong into the First Amendment in the United States. Certainly, I am not prepared to lend my support to the imprisonment of journalists.

Yet the problem with the leave-it-to-ethics approach is that we no longer live in a world in which mass media equate to responsible journalism. From where we sit in the internet era, immersed in the streaming media of our echo chambers, the SPJ Code of Ethics looks ever more a relic hallowed by a moribund belief system.

In Europe, the sophisticated privacy-protective regime of the General Data Protection Regulation (GDPR) is more supportive than the U.S. First Amendment of the Northern Ireland approach. The UK continues to adhere to the GDPR regime since Brexit. The GDPR reflects the recognition in European law of privacy and data protection as human rights, to be held in balance with the freedoms of speech and press. Precisely this balance was at issue in 2022, in Bloomberg LP v. ZXC, in which the UK Supreme Court concluded that Bloomberg media were obligated to consider a suspect's privacy rights before publishing even an official record naming him in a criminal investigation.

McGoldrick wrote "that since Bloomberg most media organisations have, save in exceptional circumstances, elected not to identify suspects pre-charge, thus affording editors the discretion to identify a suspect, if such identification is in the public interest."

Maybe the world isn't the worse for it.

Monday, January 29, 2024

Consumers turn tables against corporate defense in compelled arbitration of information privacy claims

Image via www.vpnsrus.com by Mike MacKenzie CC BY 2.0
Consumer plaintiffs turned the usual tables on corporate defense in the fall when a federal court in Illinois ordered Samsung Electronics to pay millions of dollars in arbitration fees in a biometric privacy case.

In the underlying arbitration demand, 50,000 users of Samsung mobile devices accuse the company of violating the Illinois Biometric Information Privacy Act (BIPA). BIPA is a tough state privacy law that has made trans-Atlantic waves as it fills the gap of Congress's refusal to regulate the American Wild West of consumer privacy.

Typically of American service providers, Samsung endeavored to protect itself from tort liability through terms and conditions that divert claims from the courts to arbitration. The (private) U.S. Chamber of Commerce champions the strategy. Arbitration is reliably defense-friendly. Rumor has it that arbitrators who don't see cases corporations' way don't have long careers. And companies bask in the secrecy that shields them from public accountability. (Read more.)

Resistance to compelled arbitration has been a rallying cause of consumer advocates and the plaintiff bar. For the most part, resistance has been futile. But consumer plaintiffs appear to have a new strategy. The Chamber is not happy.

In the instant case, consumers alleging BIPA violation were aiming for arbitration. Arbitration rules, endorsed by Samsung's terms, require both sides to pay toward initial filing fees, a sum that adds up when 50,000 claims are in play. The consumers' attorneys fronted their share, but Samsung refused. The company weakly asserted that it was being scammed, because some of the claimants were deceased or not Illinois residents, both BIPA disqualifiers.

Samsung must pay its share of arbitration filing fees for living Illinois residents, the district court answered, at least those living in the court's jurisdiction. Many of those consumer claimants were identified with Samsung's own customer records. A few whom Samsung challenged, the claimants dropped from their number. Even when the court pared the list to consumers in Illinois's federal Northern District, roughly 35,000 were still standing.

"Alas, Samsung was hoist with its own petard," the court wrote, quoting Shakespeare. The court opined:

Samsung was surely thinking about money when it wrote its Terms & Conditions. The company may not have expected so many would seek arbitration against it, but neither should it be allowed to “blanch[] at the cost of the filing fees it agreed to pay in the arbitration clause.” Abernathy v. Doordash, Inc., 438 F.Supp. 3d 1062, 1068 (N.D. Cal. 2020) (describing the company’s refusal to pay fees associated with its own-drafted arbitration clause as “hypocrisy” and “irony upon irony”).

The American Arbitration Association, the entity with which the claimants filed pursuant to Samsung's terms, estimated Samsung's tab at $4.125 million when the number was still 50,000 claims.

Attorneys Gerald L. Maatman, Jr., Rebecca S. Bjork, and Derek Franklin for corporate defense firm DuaneMorris warned:

As corporations who employ large numbers of individuals in their workforces know, agreements to arbitrate claims related to employment-related disputes are common. They serve the important strategic function of minimizing class action litigation risks. But corporate counsel also are aware that increasingly, plaintiffs’ attorneys have come to understand that arbitration agreements can be used to create leverage points for their clients. Mass arbitrations seek to put pressure on respondents to settle claims on behalf of large numbers of people, even though not via the procedural vehicle of filing a class or collective action lawsuit. As a result, corporate counsel should carefully review arbitration agreement language with an eye towards mitigating the risks of mass arbitrations as well as class actions.

Samsung wasted no time appealing to the Seventh Circuit. The case has drawn a spate of amici with dueling briefs from the Chamber and associates, favoring Samsung, and from Public Justice, et al., favoring the consumer claimants.

The district court case is Wallrich v. Samsung Electronics America, Inc. (N.D. Ill. Sept. 12, 2023), opinion by Senior U.S. District Judge Harry D. Leinenweber. The appeal is Wallrich v. Samsung Electronics America, Inc. (7th Cir. filed Sept. 25, 2023).

Wednesday, January 24, 2024

TORTZ volume 2 unpacks duty, causation, damages, introduces nuisance, defamation, privacy

Tortz volume 2 is now available for affordable purchase from Lulu.com and for free PDF download from SSRN.

Tortz volume 2 follows up volume 1 (Lulu, SSRN, The Savory Tort), published in 2023 and pending update this year. I am using Tortz volumes 1 and 2 with students in my American tort law classes in the United States and in Poland this academic year.

The two-volume Tortz textbook represents a survey study of American tort law suitable to American 1L students and foreign law students. In volume 1, the first eight chapters cover the fundamentals of the culpability spectrum from intentional torts to negligence to strict liability.

Volume 2 comprises chapters 9 to 15: (9) damages, (10) res ipsa loquitur, (11) multiple liabilities, (12) attenuated duty and causation, (13) affirmative duty, (14) nuisance and property torts, and (15) communication and media torts. 

Contemporary content in Tortz volume 2 includes exercises in pure several liability; treatment of opioid litigation in public nuisance law; recent criticism of New York Times v. Sullivan in defamation law; and exposure to common law developments in privacy law, such as the extension of fiduciary obligations to protect personal information.

Three final chapters will be added to Tortz volume 2 for a revised edition later in 2024: (16) interference and business torts, (17) government claims and liabilities, “constitutional tort,” and statutory tort, and (18) worker compensation and tort alternatives. Any teacher who would like to have copies of draft materials for these chapters in the spring is welcome to contact me.

Tortz is inspired by the teachings of Professor Marshall Shapo, a mentor to whom I am deeply indebted. Marshall passed away in November 2023.

My thanks to Professor Christopher Robinette, Southwestern Law School, who kindly noted the publication of Tortz volume 2 on TortsProf Blog even before I got to it here.

Tuesday, January 23, 2024

Plaintiff drops privacy suit that stretched to claim against UMass Medical in nationwide data breach

UMass Chan Medical School
Mass. Office of Travel & Tourism via Flickr CC BY-ND 2.0
Until six days ago, the University of Massachusetts Chan Medical School was defending a privacy suit over a data breach, though the plaintiff liability theories looked thin.

There doesn't seem to be any dispute over the fact of the data breach. UMass Chan was just one of hundreds of organizations nationwide implicated in a breach affecting tens of millions. According to electronic security firm Emsisoft (which has a commercial interest in higher numbers), the breach affected more than 2,700 organizations and the data of more than 94 millions persons (last updated Jan. 18, 2024).

The vulnerability for all of these organizations was a file transfer platform called MOVEit, a product of publicly traded, Burlington, Mass.-based Progress Software Corp. UMass Chan used MOVEit to transfer personal information to other state agencies and programs. Hackers obtained and published the data of more than 134,000 persons, including recipients of state supplemental income and elder services.

According to state officials, WBUR reported, the "exposed data varies by person, but in each case includes the person's name and at least one other piece of information like date of birth, mailing address, protected health information like diagnosis and treatment details, Social Security number, and financial account information." The commonwealth notified affected persons and offered free credit monitoring and identity theft protection.

The complaint filed in federal court in September 2023 sought class action certification. The named plaintiff blamed UMass Chan for weak security and delayed notification resulting in a fraudulent attempt to use her debit card. Wednesday last week, the plaintiff voluntarily dismissed without prejudice, meaning the case might not yet be over.

The articulated causes of action, though, were a stretch. That's not to say that the putative plaintiffs suffered no injury. The problem rather is that the law in most states, including Massachusetts, and at the federal level still fails to define data privacy wrongs in a manner on par with the law of Europe and most of the rest of the world.

There was no statutory cause of action in the UMass Chan complaint. The diversity complaint alleged counts of negligence, breach of contract, and unjust enrichment.

Negligence has not been a productive vein for privacy plaintiffs, who lack the usually prerequisite physical injury. Massachusetts cracks open the door more than most other states to negligence actions based on lesser injury claims, such as emotional distress or economic loss. But it's not a wide opening.

Privacy actions in state law meanwhile are problematic because American common law has not yet well established the nature of the plaintiff's loss according to conventional understandings of injury. Indeed, federal courts disagree over when a statutory state privacy action supplies the "injury-in-fact" standing required by the federal Constitution. 

The named plaintiff in the UMass Chan case hastened to emphasize her contractual relationship with UMass Chan as a service provider, in an effort to anchor the negligence claim within a strong relationship of duty to get through the Massachusetts doorway. She described the identity risk of the debit-card incident to establish economic loss at least.

It's not clear that the pleading could have pushed over the hurdles to negligence recovery. I have advocated for the evolution of common law tort to close the gap in recognition of privacy violations in U.S. law, similarly to how UK courts developed the "misuse of private information" tort in common law to complement transposition of EU data protection. The Massachusetts Supreme Judicial Court could do that; certification would be required here in a federal case. But the trend in American data privacy law rather has been for the courts to wait on legislators to move the ball forward.

The other liability theories were a stretch, too. In contract, the plaintiff alleged herself a third-party beneficiary of data sharing agreements between UMass Chan and its state partners. Third parties can claim rights in a contract, but the proof is stringent. Contract law also raises a damages problem. The plaintiff here was not seeking specific performance, and it's not clear that any recovery in contract law would exceed the remediation the commonwealth already offered.

The equitable claim of unjust enrichment theorized essentially that UMass Chan benefited financially by cheaping out on security. That's creative, but a plaintiff in equity usually wants back something she lost to the defendant. A differential in the cost of contract services is speculative, and it's an attenuated causal chain to allege detriment to UMass Chan clients.

Privacy plaintiffs in the United States have seen some success using laws that predate contemporary data breach. But those theories won't work here. Massachusetts once had a leading data regulatory system for its requirements of secure data management. But the law is now well worn and has not kept up with other states, California being the model. Critically, the Massachusetts regs don't provide for private enforcement.

Some plaintiffs have found success with the dated (1986) Computer Fraud and Abuse Act. But a federal CFAA claim would be leveled properly against the hacker. The alleged culpability of UMass Chan is more accident than abuse.

American privacy plaintiffs flailing to state wrongs in litigation unfortunately is common and will continue as long as the United States lacks a comprehensive approach to data protection. I wrote 10 years ago already that American expectations in data privacy had outpaced legal entitlements.

The pivotal factor in whether MOVEit breach victims find any relief is likely to be the state where they and their defendants are located. Perhaps the case will push commonwealth legislators at last to act on a bill such as the proposed Massachusetts Information Privacy and Security Act (see, e.g., Mass. Tech. Leadership Council).

The case is Suarez v. The University of Massachusetts Chan Medical School (D. Mass. filed Sept. 18, 2023).

Wednesday, January 17, 2024

Police reform shines light on disciplinary records

CC0 Pixabay via picryl
A favorable reform to follow the police protest movement of recent years, stemming in particular from the killing of George Floyd, has been transparency around police disciplinary dispositions.

There is room for disagreement over what police reform should look like. I'm of the opinion that it costs society more to have police managing economic and social problems, such as homelessness and mental health, than it would cost to tackle those problems directly with appropriately trained personnel. I wouldn't "defund" police per se, but I would allocate public resources in efficient proportion to the problems they're supposed to remedy. We might not need as much prison infrastructure if we spent smarter on education, job training, and recreation.

Regardless of where one comes down on such questions, there is no down-side to transparency around police discipline. Police unions have cried privacy, a legitimate interest, especially in the early stages of allegation and investigation. But when official disciplinary action results, privacy should yield to accountability. 

Freedom-of-information (FOI) law is well experienced at balancing personnel-record access with personal-privacy exemption. Multistate FOI norms establish the flexible principle that a public official's power and authority presses down on the access side. Because police have state power to deprive persons of liberty and even life, privacy must yield to access more readily than it might for other public employees.

In September 2023, Stateline, citing the National Conference on State Legislatures, reported that "[b]etween May 2020 and April 2023, lawmakers in nearly every state and [D.C.] introduced almost 500 bills addressing police investigations and discipline, including providing access to disciplinary records." Sixty-five enacted bills then included transparency measures in California, Colorado, Delaware, Illinois, Maryland, Massachusetts, and New York.

The Massachusetts effort has come to fruition in online publication of a remarkable data set. Legislation in 2020 created the Massachusetts Peace Officer Standards and Training (POST) Commission. On the POST Commission website, one can download a database of 4,570 law enforcement disciplinary dispositions going back 30 years. There is a form to request correction of errors. The database, at the time of this writing last updated December 22, 2023, can be downloaded in a table by officer last name or by law enforcement agency, or in a CSV file of raw data.

The data are compelling. There are plenty of minor matters that can be taken at face value. For example, one Springfield police officer was ordered to "Retraining" for "Improper firearm usage or storage." I don't see that as impugning the officer, rather as an appropriately modest corrective and a positive for Springfield police. Many dispositions similarly suggest a minor matter and proportional response, for example, "Written Warning or Letter of Counseling" for "conduct unbecoming"/"Neglect of Duty."

Then there are serious matters. The data indicate termination of a police officer after multiple incidents in 2021, including "DRINKING ON DUTY, PRESCRIPTION PILL ABUSE, AND MARIJUANA USE," as well as "POSING IN A HITLER SALUTE." Again, it's a credit to the police department involved that the officer is no longer employed there. Imagine if such disciplinary matters were secreted in the interest of personal privacy, and there were not a terminal disposition.

The future of the POST Commission is to be determined. It's being buffeted by forces in both directions. Apropos of my observation above, transparency is not a cure-all and does not remedy the problem of police being charged with responsibility for social issues beyond the purview of criminal justice.

Lisa Thurau of the Cambridge-based Strategies for Youth told GBH in May 2023 that clarity is still needed around the role and authority of police in interacting with students in schools. Correspondingly, she worried whether the POST Commission, whose membership includes a chaplain and a social worker, is adequately funded to fulfill its broad mandate, which includes police training on deescalation.

Pushing the other way, the POST Commission was sued in 2022, GBH reported, by police unions and associations that alleged, ironically, secret rule-making in violation of state open meetings law. Certainly I agree that the commission should model compliance in rule-making. But I suspect that the union strategy is simply obstruction: strain commission resources and impede accountability however possible. Curious that the political left supports both police unions and police protestors.

WNYC has online a superb 50-state survey of police-disciplinary-record access law, classifying the states as "confidential," "limited," or "public." Massachusetts is among 15 states in the "limited" category. My home state of Rhode Island and my bar jurisdictions of Maryland and D.C. are among the 24 jurisdictions in the "confidential" category.

"Sunshine State" Florida is among 12 states in the "public" category. In a lawsuit by the Tallahassee Police Benevolent Association, the Florida Supreme Court ruled unanimously in November 2023 that Marsy's Law, a privacy law enacted to protect crime victims, does not shield the identity of police officers in misconduct matters. (E.g., Tallahassee Democrat.)

Monday, May 22, 2023

DA cannot shield officer, EMT identities from state FOIA disclosure, court rules in fatal police shooting

A Massachusetts Superior Court in March ordered the district attorney to release investigative records to the family of a man killed by police.

The privacy of public officials in the technology era has strained conventional accountability rationales for transparency. Since the advent of access to public information as a democratic norm, public officials and public figures have decried purported invasions of their privacy. The very notion of privacy in modern tort law, for better and worse, traces its roots to precisely such whinging in the late nineteenth century. Access usually prevailed.

Yet in the technological era, privacy complaints have gained new currency, and some of it is legitimate. Even, or perhaps especially, in the intensely emotional context of high-profile police shootings, interests are amped up on both sides. Of course, victims and families demand understanding and accountability, and they are entitled to it. At the same time, it's harder than ever to be a police officer, and passions that expose public servants and their families to harassment and threats pose a genuine policy problem. 

The two sides collided in Massachusetts over the death of Anthony (Antone) Harden in Fall River in 2021. The 30-year-old was shot twice and killed by police in his bedroom. Police investigators concluded that Harden had used a steak knife to attempt to stab the shooter's partner in the neck and head. A district attorney (DA) investigation in 2022 ruled the homicide justified.

Surveillance video shows officer arriving at Harden's apartment.
With the final report, Bristol County DA Thomas M. Quinn III released hundreds of pages of records, including video, audio, and photographs. But there was much that the DA did not release in response to a freedom-of-information request by Harden's brother, Eric Mack, an attorney. Though the family knew, and the lawsuit revealed publicly, the names of the involved officers by the time of the DA's report, the DA would not disclose their names.

The DA also withheld other records identifying responding personnel, including video interviews with emergency medical technicians. WBUR reported that the EMTs said they did not see the steak knife that police said necessitated lethal force.

Mack sued the DA under the state public records law, and the Superior Court in March granted his request for records on all counts. With regard to the identities of police and EMTs involved, the court wrote:

Upon balancing the rights of the parties, the public's need to access against the privacy rights at issues here, I find that the equities favor disclosure. The public officials here are not acting in the capacity of private citizens but in the course of their duties. Plaintiff has a right to have a full understanding of the facts leading to his brother's death including the identities of the public officials involved to ensure accountability and transparency. The failure to disclose this information would raise questions amongst the public about why this information was being withheld, which would only serve to undermine the integrity of the law enforcement departments involved and those reviewing their conduct. Any right to privacy that a public official might have under these circumstances, which is de minimis under the circumstances presented here, is overwhelmed by the public's right to know.

Before the resolution of the public records case, in January, the Harden family threatened Fall River with a $50m lawsuit for Harden's death, if the records were not released.

The case is Mack v. Office of the District Attorney, No. 2284-CV-00248 (Mass. Super. Ct. Suffolk County Mar. 6, 2023), decided by Justice James Budreau.

Wednesday, May 17, 2023

Mass., EU courts wrestle with requisite harm in defamation, data protection cases

The vexing problem of proof of damages in defamation and privacy has turned up recently in the Massachusetts Court of Appeals and the Court of Justice of the European Union. Meanwhile, the Massachusetts Gaming Commission borrowed European privacy principles for new data security rules.

Tiny turkey. Stéphanie Kilgast via Flickr CC BY-NC-ND 2.0
'Stolen' Turkey Money in Massachusetts

The Appeals Court in April vacated dismissal in a business dispute over turkeys. Nonprofit and business collaborators fell out over spending on variably sized turkeys for a charitable food event. The defendant wrote on social media that the plaintiff "stole" money intended for charitable purposes.

The complaint, which was filed by a Massachusetts lawyer, was messy—narrative in excess, numbering in disarray, and allegations jumbled between liability theories—so it was difficult for the trial court to parse the pleadings. With the aid of oral argument on appeal, the court teased out the defamation count and determined that it had been dismissed for want of pleaded loss.

However, Massachusetts is among jurisdictions that continue to recognize the historical doctrines of libel per se and slander per se. Those doctrines allow some pleadings to proceed without allegation of loss, and for good reason. Reputational harm is exceedingly difficult to prove, even when it seems self-evident. After all, whom should a plaintiff call to testify to prove her damaged reputation, people who now think an awful falsity about her? Witnesses will be less than eager. Even in case of a business plaintiff that suffers economic loss, it can be exceedingly difficult to tie specific losses to specific assertions of falsity.

The historical approach allows a plaintiff to demand presumed damages. That's a messy solution, because the jury is entrusted with broad discretion to assess the damages. On the plaintiff side, perhaps that's OK; we just juries to measure intangible losses all the time, as in the case of general damages for injuries, or pain and suffering. The defense bar and allied tort reformers have rebelled against presumed damages, though, arguing that they afford juries a blank check. That unpredictability makes it difficult for defendants and insurers to assess their liability exposure. Defense-oriented tort reformers have been successful in extinguishing per se defamation actions in many U.S. states.

Massachusetts splits the difference, I think in a healthy way. Per se actions are preserved, but the plaintiff is entitled to nominal damages, plus proved actual losses, but not presumed damages. I mentioned recently that the E. Jean Carroll case has spurred overblown commentary about the potential of defamation law to redress our misinformation problem. The unavailability of per se actions in many states is one reason that defamation is not up to the job. A defamation action for nominal damages helps, though, coming about as close as U.S. jurisdictional doctrine allows to a declaration of truth—which is what defamation plaintiffs usually most want.

Allegation of a crime, such as theft or misappropriation of charitable funds, fits the class of cases that qualify for per se doctrine, whether libel or slander. There is some room debate about whether social media better fits the historical mold of libel or slander, but that's immaterial here. The allegation of "stolen" money fit the bill.

The Appeals Court thus vacated dismissal and remanded the claim for defamation and related statutory tort. The court clerk entered the Memorandum and Order for Judges Mary Thomas Sullivan, Peter Sacks, and Joseph M. Ditkoff in Depena v. Valdez, No. 22-P-659 (Mass. App. Ct. Apr. 28, 2023).

Austrian post box.
High Contrast via Wikimedia Commons CC BY 3.0 DE

Non-Consensual Political Analysis in Austria

The Court of Justice of the European Union (CJEU) also recently tussled with a problem of proof of damages. The court held early in May that a claimant under the EU General Data Protection Regulation (GDPR) must claim harm for a personal data processing violation, but need not meet any threshold of seriousness.

The court's press release summarized the facts in the case:

From 2017, Österreichische Post collected information on the political affinities of the Austrian population. Using an algorithm, it defined "target group addresses" according to socio-demographic criteria. The data thus collected enabled Österreichische Post to establish that a given citizen had a high degree of affinity with a certain Austrian political party. However, that data processed were not communicated to third parties.

The citizen in question, who had not consented to the processing of his personal data, claimed that he felt great upset, a loss of confidence and a feeling of exposure due to the fact that a particular affinity had been established between him and the party in question. It is in the context of compensation for the non-material damage which he claims to have suffered that he is seeking before the Austrian courts payment of the sum of €1,000.

The plaintiff endeavored to quantify his emotional upset, but in the absence of communication of the conclusions about the plaintiff to to any third party, the claim of harm was thin. Emotional suffering resulting from the mere processing of personal data in contravention of one's advance permissions seems minimal. Accordingly, the Austrian courts, following the example of neighboring Germany, were inclined to disallow the plaintiff's action for failure to demonstrate harm.

Harm has been a sticking point in privacy law in the United States, too. Privacy torts are a relatively modern development in common law, and they don't import the per se notion of historical defamation doctrine. Tort law balances culpability with harm to patrol the borders of social contract. Thus, intentional battery is actionable upon mere unwanted touching, while merely accidental infliction of harm requires some degree of significance of injury. Defamation law arguably defies that dynamic, especially in per se doctrine, in part for the reasons I explained above, and in part because, for much of human history, personal integrity has been as essential for survival as physical security.

Not having inherited the paradigm-defying dynamic, privacy law has posed a puzzle. Scholars disagree whether damages in privacy should follow the example of business torts, requiring at least economic loss; the example of emotional distress torts, requiring at some threshold of severity; or defamation per se torts, recognizing some sui generis harm in the disruption of personal integrity. As personal data protection has grown into its own human right independent of privacy, the problem has been amplified, because, exactly as in the Austrian case, a right against the non-consensual processing of data that are personal, but not intimately personal, is even more difficult to generalize and quantify.

The problem is not only a European one. In the United States, courts and scholars have disagreed over when claims in the burgeoning wave of state data protection laws, such as the Illinois Biometric Information Privacy Act, can satisfy the "case or controversy" constitutional requirement of jurisdiction. Failure to see a sui generis harm in privacy violations means, arguably, that there is no "case or controversy" over which courts, particularly federal courts, have competence.

The CJEU balked at Austrian courts' unwillingness to see any wrong upon a claim of only intangible loss. But the court agreed that the plaintiff must demonstrate harm. Hewing to the text of the GDPR, the court reasoned that a plaintiff must show a violation of the regulation, a resulting harm, and a causal connection between the two. Thus, harm is required, but there is no requirement that the harm meet some threshold of seriousness or economic measure.

The CJEU decision was touted in headlines as "clarifying" the law of damages under the GDPR, while the stories beneath the headlines tended to do anything but. Some writers said that the court raised the bar for GDPR claims, and others said the court lowered it. Confusion stems from the fact that the court's decision spawns subsequent many questions. Conventionally, the GDPR leaves the quantum of damages to national courts. So how must a claim of de minimis harm be measured on remand? Are nominal damages sufficient compensation, or must the data protection right be quantified?

Moreover, Sara Khalil, an attorney with Schönherr in Vienna, observed that the court left out a component of tort liability that national courts sometimes require: culpability. Is there a minimal fault standard associated with recovery for mere data processing? Because tort law ties together the elements of harm and fault, at least in some jurisdictions, the one question necessarily begets the other.

RW v. Österreichische Post AG, No. C-154/21 (May 4, 2023), was decided in the First Chamber of the CJEU.

Data Security in Gambling in Massachusetts

Policymakers and courts on both sides of the Atlantic are wrestling with the problems of contemporary personal data protection. And while the gap between the GDPR and patchwork state and federal regulation in the United States has stressed international relations and commerce, it's no wonder that we see convergence in systems trying to solve the same problems.

To wit, the Massachusetts Gaming Commission has employed recognizably European privacy principles in new data security rules. For Israeli law firm Herzog Fox & Neeman, attorneys Ariel Yosefi, Ido Manor, and Kevin David Gampel described the overlap. The commission adopted the regulations for emergency effect in December 2022; final rules were published in April.

The attorneys detailed the requirements of gambling operators:

  • to establish and plainly disclose to players comprehensive data privacy policies, including measures regarding data collection, storage, processing, security, and disclosure, the latter including the specific identities of third-party recipients; 
  • to guarantee player rights including access, correction, objection, withdrawal of consent, portability, and complaint;
  • to eschew purely automated decision-making; and
  • to implement physical, technical, and organization security practices.

The regulations are 205 CMR 138 and 205 CMR 248 (eff. Mar. 9, 2023, publ. Apr. 28, 2023).