Privacy laws of the United States deal with several different legal concepts. One is the invasion of privacy, a tort based in common law allowing an aggrieved party to bring a lawsuit against an individual who unlawfully intrudes into their private affairs, discloses their private information, publicizes them in a false light, or appropriates their name for personal gain.[1]
The essence of the law derives from a right to privacy, defined broadly as "the right to be let alone". It usually excludes personal matters or activities which may reasonably be of public interest, like those of celebrities or participants in newsworthy events. Invasion of the right to privacy can be the basis for a lawsuit for damages against the person or entity violating the right. These include the Fourth Amendment right to be free of unwarranted search or seizure, the First Amendment right to free assembly, and the Fourteenth Amendment due process right, recognized by the Supreme Court of the United States as protecting a general right to privacy within family, marriage, motherhood, procreation, and child rearing.[2] [3]
Attempts to improve consumer privacy protections in the U.S. in the wake of the 2017 Equifax data breach, which affected 145.5 million U.S. consumers, failed to pass in Congress.[4]
The early years in the development of privacy rights began with English common law, protecting "only the physical interference of life and property".[5] The Castle doctrine analogizes a person's home to their castle – a site that is private and should not be accessible without permission of the owner. The development of tort remedies by the common law is "one of the most significant chapters in the history of privacy law".[6] Those rights expanded to include a "recognition of man's spiritual nature, of his feelings and his intellect." Eventually, the scope of those rights broadened even further to include a basic "right to be let alone," and the former definition of "property" would then comprise "every form of possession – intangible, as well as tangible." By the late 19th century, interest in privacy grew as a result of the growth of print media, especially newspapers.[6]
Between 1850 and 1890, U.S. newspaper circulation grew by 1,000 percentfrom 100 papers with 800,000 readers to 900 papers with more than 8 million readers.[6] In addition, newspaper journalism became more sensationalized, and was termed yellow journalism. The growth of industrialism led to rapid advances in technology, including the handheld camera, as opposed to earlier studio cameras, which were much heavier and larger. In 1884, Eastman Kodak company introduced their Kodak Brownie, and it became a mass market camera by 1901, cheap enough for the general public. This allowed people and journalists to take candid snapshots in public places for the first time.
Privacy was dealt with at the state level. For example, Pavesich v. New England Life Insurance Company (in 1905) was one of the first specific endorsements of the right to privacy as derived from natural law in US law. Judith Wagner DeCew stated, "Pavesich was the first case to recognize privacy as a right in tort law by invoking natural law, common law, and constitutional values."[7]
Samuel D. Warren and Louis D. Brandeis, partners in a new law firm, feared that this new small camera technology would be used by the "sensationalistic press." Seeing this becoming a likely challenge to individual privacy rights, they wrote the "pathbreaking"[6] Harvard Law Review article in 1890, "The Right to Privacy".[8] According to legal scholar Roscoe Pound, the article did "nothing less than add a chapter to our law",[9] and in 1966 legal textbook author, Harry Kalven, hailed it as the "most influential law review article of all".[6] In the Supreme Court case of Kyllo v. United States, 533 U.S. 27 (2001), the article was cited by a majority of justices, both those concurring and those dissenting.[6]
The development of the doctrine regarding the tort of "invasion of privacy" was largely spurred by the Warren and Brandeis article, "The Right to Privacy". In it, they explain why they wrote the article in its introduction: "Political, social, and economic changes entail the recognition of new rights, and the common law, in its eternal youth, grows to meet the demands of society".[8] More specifically, they also shift their focus on newspapers:
The press is overstepping in every direction the obvious bounds of propriety and of decency. Gossip is no longer the resource of the idle and of the vicious, but has become a trade, which is pursued with industry as well as effrontery. To satisfy a prurient taste the details of sexual relations are spread broadcast in the columns of the daily papers. ... The intensity and complexity of life, attendant upon advancing civilization, have rendered necessary some retreat from the world, and man, under the refining influence of culture, has become more sensitive to publicity, so that solitude and privacy have become more essential to the individual; but modern enterprise and invention have, through invasions upon his privacy, subjected him to mental pain and distress, far greater than could be inflicted by mere bodily injury.[8]
They then clarify their goals: "It is our purpose to consider whether the existing law affords a principle which can properly be invoked to protect the privacy of the individual; and, if it does, what the nature and extent of such protection is".[8]
Warren and Brandeis write that privacy rights should protect both businesses and private individuals. They describe rights in trade secrets and unpublished literary materials, regardless whether those rights are invaded intentionally or unintentionally, and without regard to any value they may have. For private individuals, they try to define how to protect "thoughts, sentiments, and emotions, expressed through the medium of writing or of the arts". They describe such things as personal diaries and letters needing protection, and how that should be done: "Thus, the courts, in searching for some principle upon which the publication of private letters could be enjoined, naturally came upon the ideas of a breach of confidence, and of an implied contract". They also define this as a breach of trust, where a person has trusted that another will not publish their personal writings, photographs, or artwork, without their permission, including any "facts relating to his private life, which he has seen fit to keep private". And recognizing that technological advances will become more relevant, they write: "Now that modern devices afford abundant opportunities for the perpetration of such wrongs without any participation by the injured party, the protection granted by the law must be placed upon a broader foundation".[8]
There have been many laws related to privacy and data protection in recent years that have been enforced as a result of the rapid technological advancements. However, critics and scholars have argued that these guidelines are usually focused on legal factors, rather than technical details, which make it difficult for engineers and developers to ensure that new designs meet the guidelines stated in privacy laws.[10]
In the United States,"invasion of privacy" is a commonly used cause of action in legal pleadings. Modern tort law, as first categorized by William Prosser, includes four categories of invasion of privacy:[11]
See main article: Expectation of privacy (United States) and Intrusion on seclusion.
See also: Third Amendment to the United States Constitution, Fourth Amendment to the United States Constitution and Cohen v. Cowles Media Co..
Intrusion of solitude occurs where one person intrudes upon the private affairs of another. In a famous case from 1944, author Marjorie Kinnan Rawlings was sued by Zelma Cason, who was portrayed as a character in Rawlings' acclaimed memoir, Cross Creek.[12] The Florida Supreme Court held that a cause of action for invasion of privacy was supported by the facts of the case, but in a later proceeding found that there were no actual damages.
Intrusion upon seclusion occurs when a perpetrator intentionally intrudes, physically, electronically, or otherwise, upon the private space, solitude, or seclusion of a person, or the private affairs or concerns of a person, by use of the perpetrator's physical senses or by electronic device or devices to oversee or overhear the person's private affairs, or by some other form of investigation, examination, or observation intrude upon a person's private matters if the intrusion would be highly offensive to a reasonable person. Hacking into someone else's computer is a type of intrusion upon privacy,[13] as is secretly viewing or recording private information by still or video camera.[14] In determining whether intrusion has occurred, one of three main considerations may be involved: expectation of privacy; whether there was an intrusion, invitation, or exceedance of invitation; or deception, misrepresentation, or fraud to gain admission. Intrusion is "an information-gathering, not a publication, tort ... legal wrong occurs at the time of the intrusion. No publication is necessary".[15]
Restrictions against the invasion of privacy encompasses journalists as well:
The First Amendment has never been construed to accord newsmen immunity from torts or crimes committed during the course of newsgathering. The First Amendment is not a license to trespass, to steal, or to intrude by electronic means into the precincts of another's home or office.[15] [16]
See main article: Breach of confidence and Privilege (evidence).
See also: Attorney–client privilege, Bank secrecy, Breach of confidence in English law, Confessional privilege (United States), Copyright Clause, Financial privacy laws in the United States, Misuse of private information, Non-disclosure agreement, Physician–patient privilege, Priest–penitent privilege, Reporter's privilege, Shield laws in the United States, Source protection, Spousal privilege, Trade secret and United States patent law.
Public disclosure of private facts arises where one person reveals information which is not of public concern, and the release of which would offend a reasonable person.[17] "Unlike libel or slander, truth is not a defense for invasion of privacy."[13] Disclosure of private facts includes publishing or widespread dissemination of little-known, private facts that are non-newsworthy, not part of public records, public proceedings, not of public interest, and would be offensive to a reasonable person if made public.[15]
See main article: False light. False light is a legal term that refers to a tort concerning privacy that is similar to the tort of defamation. For example, the privacy laws in the United States include a non-public person's right to privacy from publicity which creates an untrue or misleading impression about them. A non-public person's right to privacy from publicity is balanced against the First Amendment right of free speech.
False light laws are "intended primarily to protect the plaintiff's mental or emotional well-being".[18] If a publication of information is false, then a tort of defamation might have occurred. If that communication is not technically false but is still misleading, then a tort of false light might have occurred.[18]
The specific elements of the Tort of false light vary considerably even among those jurisdictions which do recognize this tort. Generally, these elements consist of the following:
Thus in general, the doctrine of false light holds:
One who gives publicity to a matter concerning another before the public in a false light is subject to liability to the other for invasion of privacy, if (a) the false light in which the other was placed would be highly offensive to a reasonable person, and (b) the actor had knowledge of or acted in a reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.[19]
For this wrong, money damages may be recovered from the first person by the other.
At first glance, this may appear to be similar to defamation (libel and slander), but the basis for the harm is different, and the remedy is different in two respects. First, unlike libel and slander, no showing of actual harm or damage to the plaintiff is usually required in false light cases, and the court will determine the amount of damages. Second, being a violation of a Constitutional right of privacy, there may be no applicable statute of limitations in some jurisdictions specifying a time limit within which period a claim must be filed.
Consequently, although it is infrequently invoked, in some cases false light may be a more attractive cause of action for plaintiffs than libel or slander, because the burden of proof may be less onerous.
What does "publicity" mean? A newspaper of general circulation (or comparable breadth) or as few as 3–5 people who know the person harmed? Neither defamation nor false light has ever required everyone in society be informed by a harmful act, but the scope of "publicity" is variable. In some jurisdictions, publicity "means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge."[20]
Moreover, the standards of behavior governing employees of government institutions subject to a state or national Administrative Procedure Act (as in the United States) are often more demanding than those governing employees of private or business institutions like newspapers. A person acting in an official capacity for a government agency may find that their statements are not indemnified by the principle of agency, leaving them personally liable for any damages.
Example: If someone's reputation was portrayed in a false light during a personnel performance evaluation in a government agency or public university, one might be wronged if only a small number initially learned of it, or if adverse recommendations were made to only a few superiors (by a peer committee to department chair, dean, dean's advisory committee, provost, president, etc.). Settled cases suggest false light may not be effective in private school personnel cases,[21] but they may be distinguishable from cases arising in public institutions.
Although privacy is often a common-law tort, most states have enacted statutes that prohibit the use of a person's name or image if used without consent for the commercial benefit of another person.[22]
Appropriation of name or likeness occurs when a person uses the name or likeness of another person for personal gain or commercial advantage. Action for misappropriation of right of publicity protects a person against loss caused by appropriation of personal likeness for commercial exploitation. A person's exclusive rights to control their name and likeness to prevent others from exploiting without permission is protected in similar manner to a trademark action with the person's likeness, rather than the trademark, being the subject of the protection.[13]
Appropriation is the oldest recognized form of invasion of privacy involving the use of an individual's name, likeness, or identity without consent for purposes such as ads, fictional works, or products.[15]
The Fair Credit Reporting Act became effective on April 25, 1971 and implemented limitations on the information that could be collected, stored, and utilized by agencies such as credit bureaus, tenant screenings, and health agencies. The law also defined the rights granted to individuals in regards to their financial information including the right to obtain a credit score; the right to know what information is in your financial file; the right to know when your information is being accessed and used; and the right to dispute any inaccurate or incorrect information.[23]
The Video Privacy Protection Act of 1988 (VPPA) was signed into law by President Ronald Reagan to preserve the privacy of people's information collected when they rented, purchased, or delivered audio visual materials, and specifically videotapes.[24] The law arose out of the Bork tapes controversy surrounding the Washington City Paper's publication of a list of films rented by Robert Bork, a politician who was running for a spot on the United States Supreme Court at the time.[25] The law prohibits the disclosure of personal information collected by video tape service providers unless it falls under certain exceptions.[26] The VPPA became a focus of attention in the legal industry once again around 2022. Its revival came as part of a larger trend in consumer class actions filed based on privacy law violations, both through new laws like the California Consumer Privacy Act and older laws like the VPPA and wiretapping statutes.
Signed in law on August 21, 1996, Health Insurance Portability and Accountability Act (HIPAA) is a piece of legislation passed in the United States that limits the amount and types of information that can be collected and stored by healthcare providers. This includes limits on how that information can be obtained, stored, and released.[27] HIPAA also developed data confidentiality requirements that are a part of "The Privacy Rule."[28]
The Gramm-Leach-Bliley Act (GLA) is a federal law that was signed into effect on November 12, 1999. This act placed increased limits and requirements for data collection by financial institutions, as well as limited how that information could be collected and stored. It focused on requiring financial institutions to take specific measure to increase the safety and confidentiality of the information being collected. In addition to this, the law also put limitations on what type of data could be collected by financial institutions and how they could use that information. The act strives to protect NPI, or nonpublic personal information, which is any information that is collected regarding an individual's finances that is not otherwise publicly available.
The Children's Online Privacy Protection Act (COPPA), passed on April 21, 2000, is a federal law in the United States that puts severe restrictions on what data companies can collect, share, or sell about children who are under the age of 13.[29] A core provision under COPPA is that a website operator must "obtain verifiable parental consent before any collection, use, or disclosure of personal information from children."[30]
See also: Penumbra (law) and Privacy and the US government. Although the word "privacy" is actually never used in the text of the United States Constitution,[31] there are Constitutional limits to the government's intrusion into individuals' right to privacy. This is true even when pursuing a public purpose such as exercising police powers or passing legislation. The Constitution, however, only protects against state actors. Invasions of privacy by individuals can only be remedied under previous court decisions.
The First Amendment protects the right to free assembly, broadening privacy rights. The Fourth Amendment to the Constitution of the United States ensures that "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." The Fourth Amendment was the Framers' attempt to protect each citizen's spiritual and intellectual integrity. A government that violates the Fourth Amendment in order to use evidence against a citizen is also violating the Fifth Amendment.[32] The Ninth Amendment declares that "The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people."
On August 22, 1972 the Alaska Right of Privacy Amendment, Amendment 3, was approved with 86% of the vote in support of the legislatively referred constitutional amendment.[33] Article I, Section 22 of Alaska's constitution states, "The right of the people to privacy is recognized and shall not be infringed. The legislature shall implement this section."[34]
See also: California Consumer Privacy Act and California Privacy Rights Act. The California Constitution articulates privacy as an inalienable right.
CA SB 1386 expands on privacy law and guarantees that if a company exposes a Californian's sensitive information this exposure must be reported to the citizen. This law has inspired many states to come up with similar measures.[35]
California's "Shine the Light" law (SB 27, CA Civil Code § 1798.83), operative on January 1, 2005, outlines specific rules regarding how and when a business must disclose use of a customer's personal information and imposes civil damages for violation of the law.
California's Reader Privacy Act was passed into law in 2011. The law prohibits a commercial provider of a book service, as defined, from disclosing, or being compelled to disclose, any personal information relating to a user of the book service, subject to certain exceptions. The bill would require a provider to disclose personal information of a user only if a court order has been issued, as specified, and certain other conditions have been satisfied. The bill would impose civil penalties on a provider of a book service for knowingly disclosing a user's personal information to a government entity in violation of these provisions. This law is applicable to electronic books in addition to print books.[36]
The California Privacy Rights Act created the California Privacy Protection Agency, the first data protection agency in the United States.[37] [38]
Article I, §23 of the Florida Constitution states that "Every natural person has the right to be let alone and free from governmental intrusion into the person's private life except as otherwise provided herein. This section shall not be construed to limit the public's right of access to public records and meetings as provided by law."[39]
Article 2, §10 of the Montana Constitution states that "The right of individual privacy is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest".[40]
Article 1, §7 of the Washington Constitution states that "No person shall be disturbed in his private affairs, or his home invaded, without authority of law".[41]
See main article: State privacy laws of the United States. The right to privacy is protected also by more than 600 laws in the states and by a dozen federal laws, like those protecting health and student information, also limiting electronic surveillance.[44]
As of 2022 however, only five states had data privacy laws.[45]
Several of the US federal privacy laws have substantial "opt-out" requirements, requiring that the individual specifically opt-out of commercial dissemination of personally identifiable information (PII). In some cases, an entity wishing to "share" (disseminate) information is required to provide a notice, such as a GLBA notice or a HIPAA notice, requiring individuals to specifically opt-out.[46] These "opt-out" requests may be executed either by use of forms provided by the entity collecting the data, with or without separate written requests.
See main article: Health Information Technology for Economic and Clinical Health Act. The Health Information Technology for Economic and Clinical Health Act (HITECH Act) is an important piece of legislation in the United States that relates to the privacy of health-related information. Enacted as part of the American Recovery and Reinvestment Act of 2009, the HITECH Act addresses the privacy and security concerns associated with the electronic transmission of health information.