Court: UK hospital's mishandling of corpse after suspicious death violated human rights convention

St. James's Hospital is among those managed by the Leeds group

(image by CommsLTHT 2020 CC BY-SA 4.0).

From the eastern shore of the pond comes an unusual spin on the tort of mishandling a corpse.

The usual mishandling case invokes the longstanding common law exception to the rule against recovery in negligence for emotional distress in the absence of physical injury to person or property.  There was more at stake in this case, as The Guardian explained:

The family of a woman whom they suspect was killed has won a lawsuit against a health trust that allowed her body to decompose to the point that experts were unable to rule out third-party involvement in the death ....

The court ruled that the Leeds, England, hospital violated Article 8 of the European Convention of Human Rights, on the right to respect for private and family life.

The case is Brennan v. Leeds Teaching Hospitals NHS Trust, per High Court Judge Andrew Saffman.  I cannot locate the opinion online.  Besides The Guardian, there is more coverage at the Yorkshire Evening Post and Wharfedale Observer.  Hat tip to Professor Steve Hedley's Private Law Theory.  See also Professor Eugene Volokh's compelling 2019 missive on "the tort of loss of sepulcher."

Court: Employer has no free speech right to republish worker healthcare data that state provides conditionally

Confidential (Nick Youngson Alpha Stock Images CC BY-SA 3.0)

An employer has no First Amendment right to republish the identity of workers who relied on publicly subsidized healthcare when the state provides the names conditionally, for restricted use, the Massachusetts Appeals Court held yesterday.

A state program imposed assessments on employers whose employees relied on publicly subsidized healthcare.  The state offered to tell the employer which employees triggered assessment, so that the employer could review, and if appropriate challenge, the assessment. But the names came with strings attached: employers were required to promise that they will use the names in the administrative process only and not republish them.

Emerald Home Care, Inc., challenged the assessment program and conditional disclosures as violative of procedural due process and the First Amendment.

Affirming the Superior Court, the Appeals Court rejected both arguments.  As to due process, the state provided employers ample notice and opportunity to be heard in resisting the assessments.  As to the First Amendment, the state may attach conditions to access to confidential information.

In the First Amendment analysis, the court cited two U.S. Supreme Court oldies but goodies: LAPD v. United Reporting (1999) and Seattle Times v. Rhinehart (1984).  In LAPD, the Court allowed a statute to condition access to criminal histories on non-commercial use.  In Seattle Times, the Court allowed a protective order on discovery disclosures in a defamation-and-privacy case in which a newspaper was the defendant.

Justice Desmond

The Appeals Court applied intermediate scrutiny, drawn from Seattle Times.  The court reasoned that confidentiality in healthcare insurance information is an important state interest, and the restrictions on disclosure were closely tailored to the purpose of maintaining confidentiality while allowing the employer limited access for the purpose of administrative review.

The case is not remarkable for its holding, but it marks an ongoing tension between U.S. and foreign law over free speech, privacy, and data protection.  In the United States, the First Amendment often is a wrench in the works of government efforts to regulate information downstream from its disclosure to a third party.  Legal systems elsewhere in the world are more comfortable with the notion that a person's privacy rights may tag along with information in its downstream transfer from hand to hand, outweighing the free speech right to republish.

I noted some years ago that in some areas of U.S. law, including freedom of information (FOI), or access to information, we can see examples of American privacy expectations that accord with, not diverge from, European norms.  Downstream control by contract has been a key advancement in making some jurisdictions willing to furnish court records to information brokers.  Binding a broker to adjust records later as a condition of receipt helps to solve problems such as expungement, the American judiciary's equivalent to the right to be forgotten.

The case is Emerald Home Care, Inc. v. Department of Unemployment Assistance, No. AC 20-P-188 (Mass. App. Ct. Feb. 2, 2021).  Justice Kenneth V. Desmond Jr. authored the opinion for a unanimous panel that also comprised Chief Justice Green and Justice Lemire.

'Right to repair' of Mass. Question 1 would close loophole, aid consumers; industry opposition misleads

Teen mechanic in Philippines, 2014
(Rojessa Tiamson-Saceda, USAID, via Pixnio CC0)

Massachusetts has a right-to-repair initiative (Question 1) on the ballot this Election Day.

Voter information explains: "Under the proposed law, manufacturers would not be allowed to require authorization before owners or repair facilities could access mechanical data stored in a motor vehicle’s on-board diagnostic system, except through an authorization process standardized across all makes and models and administered by an entity unaffiliated with the manufacturer."

Passing this initiative should be a no-brainer.  The provision is in fact only an update to an existing law that voters approved in 2012.  Extending the right to repair to "telematic" data, the new law would close a right-to-repair loophole, through which carmakers can shield vehicle data against access by transmitting data out from the vehicle to a proprietary server.  The only source of controversy here should be how we let corporations continuously try to exploit law and technology to evade accountability to consumers and line their pockets with monopolistic product strategies.

The initiative is opposed by the "Coalition for Safe and Secure Data."  The organization's tack is that if you vote yes on Question 1, you'll facilitate domestic violence, because vehicle information can be misused by violent ne'er-do-wells.  The threat is a repulsive red herring, especially considering that telematic data about consumers already are being relocated without subject sign-off.  The Coalition for Safe and Secure Data is not the sheep of consumer privacy advocacy it pretends to be, but a wolf of a trade group, funded to the tune of $25m by the motor vehicle industry to shut down Question 1, according to Commonwealth Magazine.

Canadian privacy advocate deploys anti-SLAPP law in suit by electronic exam proctoring company

John Oliver's Big Coal SLAPP nemesis, Bob Murray, retires

Pixabay by Aksa2011

An IT specialist at a Canadian university is defending a lawsuit against a U.S. tech company over its allegations of copyright infringement and his allegations of infringement of student privacy.

Proctorio is an Arizona-based company offering online testing to academic institutions.  It's similar to ExamSoft, which is used by my law school, the Massachusetts Bar, and other academic and licensing organizations.

Needless to say, businesses in the mold of Proctorio and ExamSoft have taken off since the pandemic.  But these businesses are not without their problems, and their widespread use has brought unwanted scrutiny to their terms of service.

For example, the Electronic Frontier Foundation raised a red flag over ExamSoft in anticipation of its adoption to administer the California bar exam.  Examsoft's terms of service afford the company overbroad reach into the computers of users and, worse, collection of biometric data from studying their faces on screen.  My students have raised legitimate concerns about ExamSoft, and I will not be administering a "closed-book" final exam because I share those concerns.

UBC (GoToVan CC BY 2.0)

Related privacy worries motivated University of British Columbia learning technology specialist Ian Linkletter, MLIS, to tweet out the URLs of unlisted Proctorio instructional videos located at YouTube, meaning to make his case that the company is excessively intrusive of student privacy.  In response, the company sued Linkletter in British Columbia for copyright infringement and breach of confidence.

Now Linkletter has filed for dismissal under British Columbia's anti-SLAPP law.  Linkletter told the Vancouver Sun that fighting the lawsuit for just "more than a month has cost him and his wife tens out thousands of dollars."  Read more in Linkletter's public statement of October 16.

B.C.'s anti-SLAPP law was enacted unanimously by lawmakers in March 2019.  Oddly enough, B.C. lawmakers passed one of Canada's first anti-SLAPP laws in 2001, but quickly repealed it over doubts about its efficacy.  I wrote recently about the dark side of anti-SLAPP laws.  Never have I denied that they are sometimes deployed consistently with their laudable aims; rather, my concerns derive from their ready abuse when deployed against meritorious defamation and privacy causes.   

The case is Proctorio, Inc. v. Linkletter, Vancouver Reg. No. S-208730 (filed B.C. Sup. Ct. Sept. 20, 2020) (civil claim).

Bye, bye, Bob

[UPDATE, Oct. 27, 2020. To be clear, I wrote that sub-headline before this happened: "Coal giant Robert Murray passes away just days after announcing retirement" (Stephanie Grindley, WBOY, Oct. 25, 2020).]

In other, if distantly related, anti-SLAPP news, Bob Murray is resigning and retiring as board chairman of American Consolidated Natural Resource Holdings Inc., successor of Big Coal's Murray Energy.  It was a tangle with Murray that turned HBO comedian John Oliver into an anti-SLAPP champion.  And, I admit again, HBO's use of anti-SLAPP law was textbook and laudable after Murray brought a groundless suit against the network.

While I disagree with Oliver over anti-SLAPP, he's one of my favorite comedians and social activists, and definitely was the mic-drop-best live act I've ever seen.  Here are his key Murray Energy treatments from Last Week Tonight.

The first, June 18, 2017, drew Murray's lawsuit.

The second, November 10, 2019, followed up with a paean to anti-SLAPP, wrapping up with a musical tribute to Murray.

U.S. White Paper on 'Schrems II': Emperor still clothed

A new U.S. white paper on data protection means favorably to supplement the record on U.S. surveillance practices that, in part, fueled the European Court of Justice (ECJ) decision in "Schrems II," in July, rejecting the adequacy of the Privacy Shield Framework to secure EU-to-US data transfers.

From the U.S. Department of Commerce, Department of Justice, and Office of the Director of National Intelligence, the white paper suggests that the ECJ ruling was interim in nature, pending investigation of U.S. national security practices to better understand whether they comport with EU General Data Protection Regulation norms, such as data minimization, which means collecting only data necessary to the legitimate purpose at hand.  The paper states:

A wide range of information about privacy protections in current U.S. law and practice relating to government access to data for national security purposes is publicly available.  The United States government has prepared this White Paper to provide a detailed discussion of that information, focusing in particular on the issues that appear to have concerned the ECJ in Schrems II, for consideration by companies transferring personal data from the EU to the United States. The White Paper provides an up-to-date and contextualized discussion of this complex area of U.S. law and practice, as well as citations to source documents providing additional relevant information. It also provides some initial observations concerning the relevance of this area of U.S. law and practice that may bear on many companies’ analyses. The White Paper is not intended to provide companies guidance about EU law or what positions to take before European courts or regulators. 

Armed with this additional information, then, the message to the private sector seems to be, Keep Calm and Carry On, using the very same "standard contractual clauses" (SCCs) that the ECJ invalidated.  Yet if the information featured in the white paper has been publicly available, why assume that the ECJ was ill informed?  (Read more about SCC revisions under way, and their likely shortcomings, at IAPP.)

Unfortunately for the U.S. position, the ECJ opinion was not, to my reading, in any way temporary, or malleable, pending further development of the record.  The white paper comes off as another installment in the now quarter-century-old U.S. policy that the emperor is fully clothed.

I hope this white paper is only a stop-gap.  As I said in a Boston Bar CLE recently, no privacy bill now pending in Congress will bridge the divide between the continents on the subject of U.S. security surveillance.  A political negotiation, which might involve some give from the American side at least in transparency, seems now to be our only way forward.

The white paper is Information on U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II (Sept. 2020).

Boston Bar panel surveys landscape of privacy law, data protection policy, class action litigation

Attorneys Melanie Conroy, Marjan Hajibandeh, and Matthew M.K. Stein

We had great fun yesterday, as lawyer fun goes, talking about privacy law in the United States, from the impact of the Privacy Shield collapse to the latest litigation under California's groundbreaking consumer privacy protection law.  I was privileged to appear in a Boston Bar Association program on privacy class action litigation, led by attorney Melanie A. Conroy, CIPP/US, of Pierce Atwood LLP, alongside practicing-attorney panelists Matthew M.K. Stein, of Manatt, Phelps & Phillips, LLP, and Marjan Hajibandeh of CarGurus, Inc. 

Our topical reach was a breathless sprint across a dramatic landscape.  We opened with our respective thoughts on developments in privacy law, Conroy observing that the fast-paced field has undergone seismic shifts again and again in recent years, from the implementation of the California Consumer Privacy Act (CCPA) to the $18m Equifax data breach settlement in Massachusetts.

I spoke to the impact of the European Court of Justice decision ("Schrems II" (ECJ July 16, 2020)) invalidating the U.S.-EU Privacy Shield as a motivator for U.S. reform.  Besides the significance of the case in Europe and our foreign relations, the decision signals that a quarter century after adoption of the first European Data Protection Directive, Europe's patience with American recalcitrance has finally run out.

Julie Brill (MS CC) and William Kovacic

Former Federal Trade Commissioner Julie Brill told the Senate Commerce Committee this week that in two years, 65% of the world will be living under data protection laws, most of them modeled after the EU General Data Protection Regulation (GDPR).  As former Federal Trade Commission (FTC) Chairman William Kovacic put it, if we don't pass legislation in the United States, "we will get a national privacy policy: the GDPR."  As I tweeted this week, hearing testimony drove the usually cool and collected Senator Maria Cantwell (D-Wash.) to exclaim, "My God, this is clear, we need a strong privacy law." And Americans are ready; Brill said that nine out of ten Americans now believe that privacy is a human right.

Sen. Cantwell

Our panel ran down the latest developments in class action privacy litigation, loosely divided on the fronts of biometric data class actions, mostly arising under Illinois's pioneering Biometric Information Privacy Act; CCPA-related class actions in California; and data breach litigation.  I ran down cases in the latter vein and talked some about the present circuit split over Article III standing.  Federal courts have divided over whether "theft alone" can constitute concrete injury for constitutionally minimal standing, or plaintiffs must show some subsequent misuse of their data.  This issue is not limited to the data breach area, but has implications across a wide range of statutory enforcement systems, including the Fair Credit Reporting Act.

For my part, I predict that our dawning, if belated, understanding of the monetary value of personally identifiable information (PII) will lead us to the inevitable conclusion that theft alone suffices.  This is evidenced, for example, in Hogan v. NBCUniversal (D.R.I. filed Aug. 27, 2020), over the sale of Golf Channel subscriber identities, which subsequently were associated with other PII and resold.  Though for the time being, my favored conclusion is arguably not the inclination evidenced in the U.S. Supreme Court in Spokeo, Inc. v. Robins, in 2016.  Senator Dick Blumenthal (D.-Conn.) mentioned this week, apropos of current events, that Justice Ginbsburg, joined by Justice Sotomayor, dissented in Spokeo on just this point.

The late Justice Ginsburg; Sen. Blumenthal

Our next panel focus was developments in the First Circuit and Massachusetts.  In Massachusetts Superior Court in Boston, data breach litigation, filed in May 2019, against Massachusetts General Hospital, Brigham & Women's Hospital, and the Dana-Farber Cancer Institute, over online patient-service communications occurring outside secure portals, raises the very question of concrete harm, which may be resolved differently at the state level than under the federal Constitution.  Meanwhile in federal court, the same issue in data breach litigation, filed in March 2020, in Hartigan v. Macy's, highlights the lack of First Circuit precedent on the question since Spokeo, while citing strong pre-Spokeo indications that the First Circuit would favor the misuse-required position.

In parting observations, I offered that we have a long road ahead.  Of all the bills pending in Congress (see EPIC's excellent April report), only some propose a private cause of action and none attacks the problem of government surveillance, both purported prerequisites to European restoration of authorized trans-Atlantic data flow.  Within the U.S Congress, there appears to be bipartisan support for some kind of nationwide privacy legislation.  But the questions of private or FTC enforcement, and whether preemption would mean a legislative floor or ceiling remain sticking points that could derail the process.

Boston Bar webinar will probe privacy law latest

Coming soon, the Boston Bar Association will host a webinar on data privacy class action litigation (and related privacy stuff too).  I'm trying to get up to speed on all of the latest developments so that I will not disappoint moderator Melanie A. Conroy, attorney and CIPP/US, of Pierce Atwood LLP, who graciously if foolhardily invited me to participate.  For The National Law Review in April, Conroy wrote the authoritative rundown on the Mount Ida student class action, which treatment inspired me to write about the case for The Savory Tort.

My task is daunting; a lot happened while I was in Africa early in the year and out of the office over the summer.  Our subject matter includes the new regulations under the California Consumer Privacy Act, burgeoning lawsuits under the Illinois Biometric Information Privacy Act, and the shock waves just now hitting the United States from the "Schrems II" decision in the European Court of Justice.  (Brush-with-greatness note: Max Schrems has been in my car.  Long story.)  That's just to get the ball rolling.

Co-panelists are Matthew M.K. Stein, of Manatt, Phelps & Phillips, LLP, and Marjan Hajibandeh, of CarGurus, Inc.  Here are the program details from the BBA:

BBA Webinar: Roundtable on Recent Developments in Data Privacy Class Action Litigation
Thursday, September 24, 2020, 10:00 to 11:00 a.m.
This webinar will explore the growing prevalence of data privacy class actions through recent developments in data privacy legislation, expanded private rights of action, biometric privacy claims, consumer data suits, post-breach and cybersecurity litigation, and the increasingly complex landscape of rulings by federal courts of appeals. The presenters will discuss national trends and developments within the First Circuit and in Massachusetts. The discussion will look ahead to areas to watch and trends that may shape the development of data privacy class actions in the coming months and years.

The program is free for BBA members and $100 for non-members. Registration at least two hours before the program-start is essential to receive the Zoom link.

Research for educational opportunity, accountability requires transparency, need not forgo student privacy

When I had the privilege of working on transparency issues in the Arkansas General Assembly in the 20-aughts, two legislators and I promoted a bill that would have required public state universities to disclose data on their use of affirmative action in admissions.

One legislator, an African-American woman, reacted with manifest hostility, as if we sought outright to deprive persons of color of access to education.  I wish she would have engaged with us rather than fighting the bill behind closed doors.  It probably would have surprised her to learn that I was motivated specifically by an accusation leveled by an African-American advocacy group.  The group alleged, inter alia, that higher ed was using affirmative action to boost enrollment profiles, for PR and accreditation purposes, but then failing to support those enrolled students' success on state campuses.

I didn't know, and to this day don't know, whether the group's accusations held up as more than anecdotes.  As a transparency and accountability advocate and public educator myself, charged with the responsibility of faculty governance, I wanted to know the truth.  And there arose the problem: It was impossible to do the research, because the universities claimed, even in response to internal queries, that student privacy required nearly every datum about admissions to be held secret.  There was no way to know what students benefited from affirmative action, nor to match those data up with how those students fared.

The access bill ultimately failed, and, to my view, the reason for that failure only made the transparency case stronger.  We were not undone by objection based on equality of opportunity.  We were undone because our bill, which broadly defined affirmative action, would have required disclosure of legacy admissions: that is, when a university admits an applicant because the applicant is related to an alumna or alumnus, especially one who's a donor.  That kind of admissions preference is known to contribute to systemic discrimination against persons of color, not to mention aggravation of our alarming rise in America of socioeconomic disparity.

State Capitol, Little Rock, Arkansas

The hostility of the aforementioned African-American legislator was a warm smile compared with the outrage that poured forth from a white, male legislator, who happened also to be affiliated with Arkansas State University (ASU).  In a legislative hearing, he challenged my assertion that the universities would not happily cooperate with my research.  They would, he alleged, no legislation needed.  He persuaded his committee colleagues to no-pass the bill with a promise: After the legislative session, I should contact him personally for help procuring the data, and he would see to it that the disclosures happened.

The bill died.  After the session, I contacted our zealous ASU opponent, that he might make good on his promise.  He ignored my query and never responded.

My work on that bill fueled an ongoing interest in the interaction of access and privacy in education, especially the interaction of the federal Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and state freedom of information acts (FOIAs) (e.g., in 2018).  In that vein, my Arkansas colleague Professor Robert Steinbuch and I have just published, Ongoing Challenges in Researching Affirmative Action in Legal Education: Maximizing Public Welfare Through Transparency, 26:1 Texas Hispanic Journal of Law & Policy 57 (2020).  Here is the abstract:

The public good often depends on social science research that employs personal data. Volumes of scientific breakthroughs based on data accumulated through access to public information demonstrate the importance and feasibility of enabling research in the public interest while still respecting data privacy. For decades, reliable and routine technical methods have ensured protection for personal privacy by de-identifying personal data. Social science research into legal education and admission to the bar is presently a matter of urgent public interest and importance, requiring solid empirical analysis of anonymized personal data that government authorities possess. Social science research into the effects of affirmative action represents standard, indeed commonplace, research practice furthering the public interest, while employing established methods that minimize the risk to privacy. Yet, when seeking information regarding admissions standards and success metrics, researchers have faced remarkable headwinds from government officials. In this article, we continue to discuss a topic to which we have devoted significant professional energy: the proper balance of privacy, transparency, and accountability in researching legal education.

Our research grew out of an amicus representation in 2018, alongside Professor Eugene Volokh at UCLA Law.

I'm not here naming the ASU-affiliated legislator only because, these many years later, I don't remember his name.  I have no hesitation in calling him out if someone can remind me.

Pertinently, the data in question are still held secret, in Arkansas and many states.  So my colleagues in FOIA research, including Professor Steinbuch, still would welcome that legislator's help.  It's shameful that this fight for transparency and accountability is still under way all these years later.  It's one thing to adopt a policy position and have reasoned disagreement over it.  It's another thing entirely, and anathema to democracy, to insist on a policy position while willfully concealing evidence of its efficacy.

Anti-SLAPP slaps justice, but Richard Simmons survives dismissal in privacy suit over tracking device

Sensational Simmons in 2011
(Angela George CC BY-SA 3.0)

Updated Oct. 17, 2023, to correct broken links.

In telephone consultation with an attorney-colleague just the other day, I had occasion to climb onto my soapbox and preach my anti-anti-SLAPP gospel.  I'm not sure when he hung up, but I kept preaching, because it's about the message, not the audience.

Then Richard Simmons popped up in my newsfeed.  More on that in a minute.

'Anti-SLAPP'

Anti-SLAPP is a mostly statutory court procedure meant to diffuse "strategic lawsuits against public participation," that is, essentially, to dispose quickly of lawsuits that are meant principally to harass a defendant who is participating in public life in a way protected by the First Amendment, namely, speaking or petitioning.

The prototype case is a land developer who sues environmental protestors for a tort such as interference with contract.  An anti-SLAPP statute allows the protestor-defendant to obtain a quick dismissal, because the plaintiff knows the protestor is not a business competitor, and the plaintiff's true aim is harassment via tort litigation.  Anti-SLAPP may be useful if, say, and I'm just spitballing here, you're a sexual assault complainant suing a politician with a habit of counterclaiming for defamation.  But the far more common use of anti-SLAPP motions is when a mass-media defendant is sued for, well, anything.

The communications bar loves anti-SLAPP.  And what's not to love?  What anti-SLAPP statutes demand varies widely across the states.  A defendant's anti-SLAPP motion might require only that the plaintiff re-submit the complaint under oath, or more aggressive statutes demand that the court hold a prompt hearing and dismiss the complaint if the plaintiff cannot show probability of success on the merits, a stringent pretrial standard reserved usually for preliminary injunctions.  Whatever the statute requires, the universal takeaway is that the blocking motion is good for the defense, providing another way to slow down litigation and require more money, time, and exertion by the plaintiff—who, let's not forget, usually is a victim of injury, even if the injury has not yet been adjudicated to be the fault of the defendant.

My problems with anti-SLAPP are legion, not the least of which is that the communications defense bar hardly needs a new defense at its disposal.  We already have the most overprotective-of-free-speech tort system in the world.   Without diving deep today, it will suffice to say that my opposition to anti-SLAPP fits neatly into my broader position that the famous civil rights-era innovation in First Amendment law embodied in New York Times v. Sullivan (U.S. 1964) should rather be described as an infamous and pivotal turn down a wrong and dangerous road, which is why courts around the world have widely rejected the case's central holding.  My position makes me about the most despised person at any communications defense bar conference, so I mostly skip the social events, after I've redeemed my free drink tickets.

Along Came Richard Simmons

When I talk about the abusive deployment of anti-SLAPP, I'm usually talking about the plaintiff's inability to prove Sullivan "actual malice," which, as a subjective standard, requires evidence of the defendant's state of mind.  In an especially wicked cruelty, a typical anti-SLAPP motion requires the plaintiff to show likelihood of success in proving defendant's actual-malicious state of mind before the plaintiff is allowed to use litigation discovery to collect evidence—all of which remains in the defendant's possession.

Bastion of the First Amendment
(2015 image by Mike Mozart CC BY 2.0)

So the rules of the game in First Amendment defamation are first rigged against the plaintiff, and then, when the plaintiff dares to complain anyway, we punish the audacity.  Rubbing salt into the wound, anti-SLAPP laws may also then require the plaintiff to pay the corporate media defendant's legal fees, a bankrupting prospect for the everyday-Joe plaintiff who might have been victimized by the careless reporting of a profits-churning transnational news company.

What I don't usually talk about is the kind of thing that apparently happened lately to Richard Simmons.  The once-and-future fitness guru—don't miss Dan Taberski's podcast Missing Richard Simmons (e1), which, however "morally suspect," might be my favorite podcast ever—alleged in a California invasion-of-privacy lawsuit that celebrity gossip rag In Touch Weekly hired someone to put a tracking device on Simmons's car.  As media, do, and maybe now you to start to see the problem, In Touch Weekly asked for dismissal under California's powerful anti-SLAPP statute, putting to the test Simmons's audacious challenge to the shining gold standard of American journalism.

Fortunately in this case, a trial judge, and this week a California court of appeal, held that news-gathering through trespass, or intrusion, is not what anti-SLAPP is made to protect.  Correspondingly, there is no First Amendment defense to the tort of invasion of privacy by intrusion.  So Simmons's case may resist anti-SLAPP dismissal.

Also fortunately, Richard Simmons has the financial resources and determination to fight a strong invasion-of-privacy case all the way through an appeal before even beginning pretrial discovery.  This isn't his first rodeo.  Richard Simmons is a survivor.

Someone needs to give Richard Simmons a law degree, and one day I won't feel so alone at the comm bar cocktail party.

The case is Simmons v. Bauer Media Group USA, LLC, No. B296220 (Cal. Ct. App. 2d App. Dist. 4 Div. May 21, 2020).  Parent-company Bauer Media Group, by the way, owned the gossip magazines that lost to Rebel Wilson in her landmark Australian defamation case.

Now move those buns.

Recent commentaries ponder privacy in license plates, history of animal identity

Two blog entries tangentially related to areas of interest of mine crossed my desk this week.

CC TV (Adrian Pingstone CC0)

Privacy law.  For The Volokh Conspiracy at Reason, UC Berkeley Professor Orin Kerr wrote about the Massachusetts Supreme Judicial Court decision in Commonwealth v. McCarthy, No. SJC-12750, on April 16.  The Court considered the implications of automatic license plate readers under the Fourth Amendment, concluding that there are constitutional consequences, if not resulting in a violation of the defendant's rights in the instant drug case.  Kerr considers the case relative to the Supreme Court's 2018 cell-tower-location decision, Carpenter v. United States, and against the background of his own work on mosaic theory in privacy law (he's not a fan).  In a purely civil context, mosaic theory, born in the national security arena, has long been a key underpinning of personal privacy rights in their encroachment on the freedom of information, an accelerating conflict in the information age.  The commentary is "Automated License Plate Readers, the Mosaic Theory, and the Fourth Amendment: The Massachusetts Supreme Judicial Court Weighs In" (Apr. 22, 2020).

Peacock plumage (Jatin Sindhu CC BY-SA 4.0)

Animal law.  Evolution of animals at law was the subject of an Earth Day commentary for Legal History Miscellany by history Professor Krista Kesselring at Dalhousie University in Nova Scotia.  She traced the historical change in cultural and common law regard for animals from aesthetic adornment, to property of utility, to something, perhaps, at last, with intrinsic value.  The commentary is "Can You Steal a Peacock? Animals in Early Modern Law" (Apr. 22, 2020).  U.S. courts have evidenced a dawning recognition of animals as more than mere personal property, even in a civil context, moving beyond welcome developments in criminal anti-cruelty statutes.  The nascent trend is evident and needed especially in the area of tort damages, in which the valuation of a pet as an item of property fails profoundly to account for real and rational emotional suffering upon loss.  See furthermore the recent: Richard L. Cupp, Jr., Considering the Private Animal and Damages (SSRN last rev. Apr. 2, 2020).  HT @ Private Law Theory.

First Circuit dismisses Mount Ida student class action, incidentally limits emerging data protection theory

Holbrook Hall, Mount Ida College, Newton, Mass. John Phelan CC BY 3.0

An angle in a recent First Circuit decision deserves a mention in U.S. data protection circles.  I hadn't been aware of this angle of the case, so hat tip to attorney Melanie A. Conroy at Pierce Atwood in Boston for analyzing the case carefully in the The National Law Review.

The First Circuit affirmed dismissal in the ugly and unfortunate matter of Mount Ida College students' class action against the school after its abrupt closure and sale to the University of Massachusetts system.  Conroy's rundown on the case is thorough.  I want only to highlight one important point: the court refused to recognize, in Massachusetts law, a fiduciary duty owed by university to student.

The decision comports with multistate norms, but is nonetheless important in limiting an emerging doctrine of data protection in U.S. common law tort.  State courts that have recognized something like a data protection right in civil cases have used fiduciary duty to bootstrap their way there.

American common law invasion of privacy is too stringent to get the job done, that is, to articulate a data protection right, for various reasons.  One reason is its incorporation of what Professor Daniel Solove termed "the secrecy paradigm": information must be kept secret to remain secret.  Thus, I cannot complain when my bank tells someone about my financial transactions, because I already let my bank know about them.  My resort must be to banking privacy law, by statute.  And there arises the second problem for privacy plaintiffs: statutes are too stringent to get the job done.  I might be unhappy if my employer divulges information about my psychiatric condition to my insurer, but neither one of them is a healthcare provider covered by the federal patient privacy law ("HIPAA"), which does not (directly) provide for a cause of action anyway.

In 2018, the Connecticut Supreme Court bridged the common law gap from statutory insufficiency to actionable privacy claim by relying on the physician-patient duty of confidentiality.  In short, the court held, HIPAA + duty of confidentiality = protectible common law interest.  The court thereby allowed a woman to sue her ObGyn provider upon an allegation of breached confidentiality.  That duty of confidentiality is a form of fiduciary duty.  So a theory emerged of how U.S. common law might stumble its way to recognition of what the rest of the world, especially Europe, calls "data protection."

There are a lot of ways for us to start catching up with the rest of the world in recognizing people's right to personal data integrity; this is just one.  And it remains.  But it is limited by the scope of duties that might stand in for that second piece of the equation.  The Mount Ida case shows correctly that it will be harder for a plaintiff to get there against a business defendant that is not a professional, and the data held are financial information tangential to the nature of the relationship, here, educational.

The First Circuit aptly instructed Mount Ida students that if they wanted better protection for their personal information in state law, their remedy was with the state legislature.  The same can be said for Americans, data protection, and our torpid Congress.

The case is Squeri v. Mount Ida College, No. 19-1624 (1st Cir. Mar. 25, 2020).  U.S. Circuit Judge Lynch wrote for the panel, which also included Stahl and Kayatta, JJ.

Boston Globe wins access to booking photos, incident reports involving arrests of police officers

In the Massachusetts Supreme Judicial Court on March 12, the Boston Globe won access to booking photographs and incidents reports related to arrests of police officers under the state open records law.

The case arose from the denial of multiple public record requests, including two following State Police arrests of local law enforcement officers for operating motor vehicles while under the influence in 2012 and 2014.  State police resisted disclosure, claiming the records were not public as part of the state's "criminal record offender information" (CORI) database, which is exempt from disclosure by statute.

The exemption of criminal record information systems is the rule rather than the exception in the United States, in theory, to protect personal privacy.  Sometimes persons are never charged, or even arrested, or are exonerated prior to court proceedings, and public policy disfavors sullying reputation by association with police action.  On the opposite end of the criminal justice process, there is concern that even a person who is convicted of a crime will never escape the reputational impact of police involvement, especially in the age of an internet that never forgets.  Critics of non-disclosure policy claim that secrecy undermines accountability, which is especially important for law enforcement; and treats the public paternalistically, as if people cannot understand the relative significance of different stages of involvement with the police and criminal justice system, including the significance of having done one's time.  This tension of competing policy aims, especially as it plays out in the electronic age, and especially as it relates to visual media, implicates "practical obscurity," a conundrum that has dogged access policy for more than four decades and also marks a flashpoint in the trans-Atlantic privacy debate.

Examining the open records law, even as amended by the Massachusetts legislature while appeal was pending, aiming to bolster the state's position on the privacy-access seesaw, the Supreme Judicial Court ruled the records not shielded by the CORI statute's exemption for criminal record information. Employing the rule of narrow construction of access exemptions, the court concluded, "[W]e cannot read exemption (a) so broadly as to shield all investigatory materials created by police from disclosure. We therefore conclude that the booking photographs and incident reports sought here are not absolutely exempt from disclosure as public records under exemption (a) 'by necessary implication' of the CORI act."

Moreover, though police had not argued the point, the court ruled the records not exempt as an unwarranted invasion of personal privacy, at least in the particular context of police as arrestees.  The privacy exemption calls for a balance.  The court explained, "On the privacy side of the scale, we generally 'have looked to three factors to assess the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources'" (citations omitted).  Also, "privacy factors include the risk of adverse collateral consequences to the individual that might arise from the disclosure of this criminal justice information. 'On the other side of the scale, we have said that the public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner'" (citation omitted).

When police are themselves accused of crimes, the balance that might otherwise favor the ordinary citizen swings in favor of public accountability, the court reasoned. "There is a substantial public interest in the disclosure of police incident reports regarding alleged offenses by police officers and public officials that do not result in arraignment. And disclosure of the booking photographs will eliminate confusion as to the identity of those arrested where they may have common names that may be shared by others."

The court's conclusions accord with norms in state access law in the United States.  Though criminal information systems on the whole usually are exempt from disclosure, individual incident reports related to arrest usually are not—notwithstanding the fact that an exempt criminal record database may comprise records that are not exempt individually.  (Booking photos, or mug shots, also, traditionally have not been exempt from disclosure as a class of record, though that has been changing in recent years, because of a cottage industry in privacy invasion, and even extortion, that's cropped up online.)  Personal privacy exemptions are sometimes held to protect personal identity ad hoc, within police records as a class, and incident reports without resulting arrest may be exempt from disclosure.  But personal privacy exemptions typically implicate a balance, and courts tend to favor access when public officials are under scrutiny, especially when law enforcement officers are suspected of violating the law.

The case is Boston Globe Media Partners, LLC v. Department of Criminal Justice Information Services, No. SJC-12690 (Mar. 12, 2020) (Justia, Suffolk Law).  Chief Justice Gants wrote the opinion for a unanimous court.

Anti-SLAPP is not all it's cracked up to be

John Oliver this week on Last Week revisited the defamation lawsuit he drew against HBO from Bob Murray and Murray Energy.  The piece brings viewers up to speed on the feud.

Murray just dropped the suit, which was on appeal of dismissal to the West Virginia Supreme Court.  That led Oliver to do this effective segment on the problem of strategic lawsuits against public participation (SLAPPs).  Oliver called on the 20 states without anti-SLAPP statutes to adopt them, lest nationwide speakers remain subject to lawsuit in lowest-common-denominator, plaintiff-friendly locales.

I'm a big John Oliver fan—next-level, best standup I've ever seen, not to mention having redefined social commentary through comedy—and a free speech and journalism advocate.  That said, I am on record in opposition to anti-SLAPP laws, and I remain so.  The laws are an ill fit to resolve the underlying problem of excessive transaction costs in litigation and work an unfairness against legitimate causes of action.  Our First Amendment law radically weights defamation tort law against plaintiffs like nowhere else in the world, admittedly prophylactically dismissing claims by genuinely injured plaintiffs.  Defendants don't need another weapon in their arsenal.

Oliver is right that there are plenty of cases in which litigation is abused in an effort to suppress free speech.  But anti-SLAPP laws sweep within their ambit nearly every defamation and privacy case.  Defamation plaintiffs who have been genuinely injured and have no SLAPP motivation whatsoever also must respond to anti-SLAPP motions and are likely to suffer dismissal and pain of attorneys' fees—not because their suits lack merits, but because they lack access to discovery to get their hands on real, existing evidence of malice, discovery that our civil litigation system routinely affords to tort plaintiffs in the interests of justice.

The essential concept of anti-SLAPP law is said to have originated in Colorado as a means to protect environmentalists from retaliatory litigation by developers.  If you want to see evidence of my doubts about the efficacy of anti-SLAPP legislation, look no farther than a decision by the Supreme Judicial Court of Massachusetts just today, in which, literally, a property developer is the anti-SLAPP claimant in an epic litigation that has generated enormous transaction costs over anti-SLAPP procedure without ever reaching the merits of the case.

Anti-SLAPP laws look good on paper.  But they indiscriminately undermine tort law.  The effect of denying compensation to genuinely injured plaintiffs will be the effect of a failed tort system: unfairness, increased abuse by bad actors, and, ultimately, injured persons taking the law into their own hands.  Media advocates wonder why Generation Z, et seq., are hostile toward free speech.  Be careful what you wish for.

Radiolab ponders journalists who would undo what they wrought

Radiolab tackled the "right to be forgotten," U.S. style, back in August, and I missed it.  Hat tip at On the Media, which just revived the excellent segment.  Here is the summary and audio.

In an online world, that story about you lives forever. The tipsy photograph of you at the college football game? It’s up there. That news article about the political rally you were marching at? It’s up there. A DUI? That’s there, too. But what if ... it wasn’t.

In Cleveland, Ohio, a group of journalists are trying out an experiment that has the potential to turn things upside down: they are unpublishing content they’ve already published. Photographs, names, entire articles. Every month or so, they get together to decide what content stays, and what content goes. On today’s episode, reporter Molly Webster goes inside the room where the decisions are being made, listening case-by-case as editors decide who, or what, gets to be deleted. It’s a story about time and memory; mistakes and second chances; and society as we know it.

This episode was reported by Molly Webster, and produced by Molly Webster and Bethel Habte.

EU court rules for Google, narrows French 'right to be forgotten' order to Europe

In the latest battle of the feud between Google and the French data protection authority (CNIL), the Court of Justice of the European Union ruled that the CNIL's "right to be forgotten" order should be limited to internet users in Europe.  However, the court did not rule out the possibility of a worldwide order if the facts warrant.

The court wrote:

[T]he right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality....  Furthermore, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world. 

While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679 [GDPR], struck a balance between that right and that freedom so far as the Union is concerned ... it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.

"Proportionality" is a core principle of EU human rights law when regulation collides with individual rights, or, as here, state power is implicated to favor one individual's rights over those of others.  The same principle also constrains supra-national authority over member states.

The case arose from a CNIL fine of Google.  The French authority had ordered Google to de-list search results to protect certain individuals' privacy under the "right to be forgotten," or "right to erasure," when those individuals were searched by name.  "De-listing" or "de-referencing" search results is the front line of right-to-erasure court challenges today, though the specter of erasure orders that reach content providers directly looms on the horizon.

Google complied with the CNIL order only for European domains, such as "google.fr" for France, and not across Google domains worldwide.  Google employs geo-blocking to prevent European users from subverting de-listing simply by searching at "google.com" (United States) or "google.com.br" (Brazil).  Determined users still can beat geo-blocking with sly technocraft, so CNIL was dissatisfied with the efficacy of Google's solution.  Undoubtedly, a dispute will arise yet in which the CNIL or another European data protection authority tests its might with a more persuasive case for global de-listing.

The case is Google, LLC v. Commission Nationale de L’informatique et des Libertés (CNIL), No. C-507/17 (E.C.J.), Sept. 24, 2019.  Several free speech and digital rights NGOs intervened on behalf of Google, including Article 19, the Internet Freedom Foundation, the Reporters Committee for Freedom of the Press, and the Wikimedia Foundation, as well as Microsoft Corp.  The case arose initially under the 1995 EU Data Protection Directive, but carries over to the new regime of the General Data Protection Regulation (GDPR).

Teachable torts: Court succinctly dismisses 'outing' case collateral to terrorism prosecution

Attendees dance during the Lesbian, Gay, Bisexual, and Transgender mixer
hosted by Joint Task Force Guantanamo Equal Opportunity Leaders for JTF
Troopers and Naval Station Guantanamo Bay Residents to honor LGBT
Pride Month in 2018. Photo by JTF GTMO PAO Trooper.

A short decision upon compelling facts in a civil case collateral to the criminal prosecution of Khalid Sheikh Mohammed, accused of being a September 11 architect, offers a worthwhile exercise in the study of tort law.

Semmerling, a lawyer on the defense team of Guantánamo-held Mohammed, accused the head of the defense team of outing Semmerling to Mohammed as gay.  The revelation of Semmerling's sexual orientation resulted in his removal from the team, because Mohammed would not work with a gay (or Jewish) lawyer.

Typical outing cases present some interesting problems in privacy law for several reasons.  First, they emphasize the distinction between the disclosure privacy tort and the defamation tort, because the revelation in an outing case is true.  First Amendment absolutism challenges the disclosure tort for its threat of liability upon a truthful statement, though there is little doubt that the disclosure tort would survive a direct Supreme Court challenge today.

Second, a plaintiff's homosexual (or other non-heterosexual) identity is rarely an absolute secret, disclosed to no one, but more often—and healthily—a personal datum that the plaintiff has disclosed with thought and care to different persons—parents, friends, public—at different times.  But "the secrecy paradigm" that dominates American privacy law disallows tort recovery unless intimate information remains intimately safeguarded.  (This is a critical point of difference between U.S. and European privacy law.)

Third, outing cases are complicated as a matter of social policy, for fear that a liability award might validate the view that homosexual orientation should be a source of shame, so either a truth properly kept secret (privacy tort), or a falsehood injuriously uttered (defamation tort).

This case is not typical—Semmerling's sexual orientation was only a secret to Mohammed—but its unusual facts, assuming the allegations as true for sake of argument on the motion to dismiss, left Semmerling with only less prospect of a tort remedy than usual.

Invoking the common law litigation privilege, the U.S. District Court, per Judge Robert W. Gettleman, rejected claims against the defense team leader herself. The absolute privilege ensures that an attorney has unfettered discretion in communicating with a client on matters pertaining to litigation.  The court also dismissed claims of negligence and intentional infliction of emotional distress (IIED) against the United States as defense counsel's employer.

Tim Jon Semmerling is a Chicago criminal-
defense attorney. In addition to his private
practice, he has worked pro bono for the
Center for Justice in Capital Cases at DePaul
University.

The negligence and IIED claims against the United States did survive dismissal under the Federal Tort Claims Act.  The FTCA on its terms disallows libel and slander claims against the United States, and the court opined that even a defamation claim disguised as IIED (or general negligence) would not survive that disallowance.  For the very fact that Semmerling complained about a truthful disclosure, his claim cannot be equated with libel or slander, and so was not a disguised defamation claim.

On tort law merits, though, Semmerling failed to state a claim, the court ruled.  He tried to predicate negligence on the defendant's one-time assurance to him that she would allow him to work on the case without disclosing his sexual orientation to Mohammed.  That was not basis enough, the court opined, to establish a duty of the United States to Semmerling for the purpose of proving negligence. The court did not wade in more deeply, but I expect that the duty requirement was especially elevated given Semmerling's lack of physical injury.

As to IIED, Semmerling sufficiently pleaded neither intent nor outrageousness.  Semmerling found out about the dislcosure only by way of hearsay and only some time after being fired.  So, the court reasoned, evidence was lacking that the disclosure was calculated to cause him emotional distress.  Also the disclosure was at worst "offensive," the court opined, and not "utterly intolerable in a civilized community," as Illinois law requires.

I wonder whether the facts would have supported a tortious interference claim; alas, that cause is expressly disallowed by the FTCA.

The case is Semmerling v. Bormann, No. 18-CV-6640 (N.D. Ill. Sept. 11, 2019).  HT@ ABA Journal.

[NOTE, Sept. 25, 2019: A generous colleague brought to my attention that the complaint in the case also pleaded defamation.  The claim failed on the litigation privilege as against lead counsel and was precluded by the FTCA as against the United States.  I ought to have marked the point that Semmerling was unable to claim disclosure in part because he guarded no intimately held secret.  The defamation claim was grounded in the allegation that lead counsel falsely suggested to the client a particular sexual interest in him.  That's an intriguing hypothetical when one considers the consequent analyses on the merits, including "capable of defamatory meaning."]

EU frets over Privacy Shield adequacy, and NGO insists, emperor still naked

The Commission of the European Union is reviewing the U.S.-EU Privacy Shield framework for conformity with the General Data Protection Regulation (GDPR), and NGO AccessNow is again demanding an inadequacy finding.

A lot is at stake.  For the uninitiated, European regulators have a dramatically different take on the protection of personal information than the free-wheeling free marketeers of the United States.  I've written some about the problem here and elsewhere (e.g., here and here), arguing that the American people are not so far from European privacy norms, but it's our law that lags behind the democratic will.  For my money, the definitive macro analysis of why American and European approaches to privacy have differed is James Q. Whitman's.  Anyway, the GDPR does not allow the export from Europe of information to countries that do not comport with its privacy protections, and that creates a monumental problem for the trans-Atlantic flow of not only information, but commerce.

The problem is not new and existed under the GDPR's predecessor law, the 1995 Data Protection Directive (DPD).  A number of mechanisms were devised to work around the problem, and they were approved by European regulators under the umbrella of "the Safe Harbor agreement."  But it's widely understood, at least on the European side, that Safe Harbor was something of a sham: No one with a straight face could argue that U.S. law was comparable to the DPD.  Safe Harbor in practice comprised mostly industry standards, voluntarily adopted and barely enforced by U.S. regulators.  There's also an important piece of this problem in the vein of national security, government spying, and personal information; I'm not even getting into that.

Privacy Shield is stronger than Safe Harbor, but the GDPR is a lot stronger than the DPD.  There have been remarkable advancements in privacy law in some states, notably California, in the EU direction.  And quite a number of court challenges have followed, winding their way through the process, some derived from objections in the commercial sphere, some the civil rights sphere: you've probably heard of "the right to be forgotten."  But our patchwork state laboratories hardly sum reassurance to Europe.  So in the absence of a comprehensive peace offering at the federal level, the debate over the EU's adequacy determination regarding Privacy Shield pretty much boils down to whether or not we're going to admit that the emperor is naked.

AccessNow, a global NGO and sponsor of RightsCon, has consistently called for honesty about the emperor's sorry state.  A recent memo calls on the Commission to rule Privacy Shield inadequate, and AccessNow has invited republication of a new infographic in support of its position.  I hereby oblige. It's past time we get serious about protecting personal information in the United States and stop commercial exploitation of human identity upon industry's abusive invocations of civil rights such as the freedom of speech and freedom to contract.

[UPDATE, 23 Oct. 2019, at 13:53 U.S. EDT: Privacy Shield still good, per EC report issued today.]