Data Privacy

Online
Essay
Digital Authoritarianism
Danielle Keats Citron
Danielle Keats Citron is a Jefferson Scholars Foundation Schenck Distinguished Professor in Law, University of Virginia School of Law; Vice President, Cyber Civil Rights Initiative; 2019 MacArthur Fellow.

Special thanks to Mario Barnes, Courtney Douglas, Paul Gowder, Deborah Turkheimer, to the audience at Northwestern Law’s Julian Rosenthal Lecture, and to Miranda Coombe, Sam Hallam, Caroline Kassir, and Danielle O’Connell for superb editing. Adeleine Lee and Alex Wilfert provided excellent research assistance. The authors contributed equally to this essay.

Ari Ezra Waldman
Ari Ezra Waldman is a Professor of Law and, by courtesy, Professor of Sociology, University of California, Irvine School of Law; Member and Compliance Officer, Board of Directors, Cyber Civil Rights Initiative.

Antidemocratic forces rely on intimidation tactics to silence criticism and opposition. Today’s intimidation playbook follows a two-step pattern. We surface these tactics so their costs to public discourse and civic engagement can be fully understood. We show how the misappropriation of the concept of online abuse has parallels in other efforts at conceptual diversion that dampen democratic guarantees. Democracy’s survival requires creative solutions. Politicians and government workers must be able to operate free from intimidation. Journalists and researchers must be able to freely investigate governmental overreach and foreign malign influence campaigns that threaten the democratic process. Surfacing the two-step strategy is a critical start to combating it.

Print
Comment
Volume 92.4
Identifiable to Whom? Clarifying Biometric Privacy Rights in Illinois and Beyond
Hana Ferrero
B.A. 2021, University of Notre Dame; J.D. Candidate 2026, The University of Chicago Law School.

I would like to thank Jack Brake, Anne Marie Hawley, and Jonah Klausner for their thoughtful edits and Jake Holland for his indispensable advice all throughout the drafting process.

Illinois’s Biometric Information Privacy Act (BIPA) is the country’s most powerful law governing biometric data—data generated from an individual’s biological characteristics, like fingerprints and voiceprints. Over the past decade, BIPA garnered a reputation as an exceptionally plaintiff-friendly statute. But from 2023–2024, the Illinois legislature, Illinois Supreme Court, and Ninth Circuit Court of Appeals all sided with BIPA defendants for the first time. Most significantly, in Zellmer v. Meta Platforms, Inc., the Ninth Circuit dismissed the plaintiff’s BIPA claim because the face scan collected by the defendant could not be used to identify him.

It is unclear whether these developments represent a trend or an exception to BIPA’s plaintiff-friendliness. Which path is charted will largely turn on how courts interpret Zellmer: While Zellmer established that a biometric identifier must be able to identify an individual, lower courts have construed its holding narrowly to require that the entity collecting biometric data must itself be capable of identifying, rather than it being sufficient for any entity to do so. Reading BIPA this narrowly would significantly weaken the statute’s protections.

After detailing how employer and consumer cases catalyzed this recent defendant-friendly shift, this Comment proposes a two-step framework to determine whether a biometric identifier is able to identify, falling under BIPA’s reach. Given BIPA’s broad influence, where courts ultimately land on this question will be crucial to the protection of biometric data nationwide."

Print
Comment
Volume 92.4
Injury Equity: The Rise of Future Stakes Settlements
Margaret Schaack
B.S. 2018, Georgetown University; J.D. Candidate 2026, The University of Chicago Law School.

I would like to thank Professor Anup Malani, Professor Jared Mayer, and the editors and staff of the University of Chicago Law Review for their thoughtful input and careful review.

The latest development in class action litigation is the “future stakes settlement.” Under this novel mechanism, unveiled in the settlement proposal to end a privacy law class action lawsuit against the startup Clearview AI, a defendant grants a privately traded equity stake to the class in exchange for a release of all claims.

Future stakes settlements, though similar to existing mechanisms in class action and bankruptcy law, offer distinct benefits and costs. Through a future stakes settlement, the class may recover against a cashless defendant and receive a larger payout than would be possible through a traditional cash damages fund. But this recovery is uncertain, as the value of a future stake can fluctuate. Furthermore, by transforming injured parties into shareholders, future stakes settlements pose serious moral quandaries.

Existing guidance for settlement agreements under Federal Rule of Civil Procedure 23(e) is insufficient to handle the high degree of risk associated with future stakes settlements. This Comment recommends additional standards that courts should apply when evaluating these settlements. Through these additions, courts can prevent defendant gamesmanship, ensure future stakes settlements are fair to the class, and fulfill the dual purposes of compensation and regulation in class actions.

Online
Essay
Federal Grand Juries’ Supremacy Over Foreign Data Privacy Laws
Alexander C. Meade
Alexander C. Meade is a Member of The University of Chicago Law Review and a J.D. Candidate in the University of Chicago Law School Class of 2022. He received his B.A. from the University of Pennsylvania in 2016.

He would like to thank Meghan Holloway, Matthew D. Reade, Nathan T. Tschepik, and Chloe M. Zagrodzky for their invaluable feedback.

Data privacy has been at the forefront of recent foreign-policy conversations.