5 Va. J.L. & Tech. 8 (2000), at http://www.vjolt.net
1522-1687 / © 2000 Virginia Journal of Law and Technology Association

VIRGINIA JOURNAL of LAW and TECHNOLOGY

UNIVERSITY OF VIRGINIA

FALL 2000

5 VA. J.L. & TECH. 8

 

Personalization, Privacy, and the First Amendment:

A Look at the Law and Policy Behind Electronic Databases

 

By Jennifer Bresnahan[1]

 

 

I.    Introduction

II.   Current Practices in Database Marketing

III.  Companies’ Right in Commercial Databases

A.  The Broad Right to Collect and Use Data

B.  Commercial Speech

C.  Are Databases Commercial Speech?

D.  Database Applications and the First Amendment

IV.  The Right to Privacy

V.   Statutory Attempts to Protect Privacy        

A.  American Attitudes toward Regulation

B.  Central Hudson Test

VI.  Private Right of Action: The Privacy Tort

VII. Conclusion

 

 

I.  Introduction

 

“If you give me your medical history, I can give you more life.  If you tell me what books you read, I can guarantee you, you will never read the wrong book. …[I]f you tell me what plane you’re booked on, I can guarantee you won’t show up two hours early to the airport…If I promise to call you if your daughter checks in the emergency room at midnight, you might give me your daughter’s Social Security number.”[2]

 

1.      Personalization is the latest darling of the business world.[3]  Companies are directing considerable energy and resources to the goal of knowing and serving customers on an individual basis.  By pooling the data they collect with that of other companies and the United States government, companies can create highly-detailed “personality profiles” on individual consumers that they store in computer databases for use in marketing and advertising.[4]  Ironically, the more sophisticated these database personalization programs become, the more uncomfortable they make many consumers.  Individuals can scarcely make a move these days without it being scrutinized and recorded by watchful companies.  To many privacy advocates, the use of personality profiles for direct marketing invades consumers’ privacy rights. Yet, companies compiling and using the databases also have rights.  One such right is the First Amendment’s Protection of commercial speech.

 

2.      This paper explores companies’ First Amendment claims associated with electronic databases and direct marketing.  The topic is particularly timely because the Supreme Court may soon hear several cases that could give it an opportunity to clarify aspects of the database conflict.[5]  Part II of the paper details what companies are currently doing by way of targeted database marketing on the Internet and in traditional retail spheres.  Part III looks at the Constitutional right of companies to use an individual’s personal data for marketing purposes.  Part IV examines the conflicting claim of a right to informational privacy.  Part V examines the validity of legislative efforts to protect consumer privacy by regulating uses of data.  Part VI looks at private sources of relief for consumers.

 

II.  Current Practices in Database Marketing

 

3.      As consumers go through their everyday lives, they shed little bits of information about their preferences, purchases, and histories that, unbeknownst to many, are reassembled by powerful corporate computers.[6]  Everything an individual does—every trip to the store, telephone call made, prescription filled, travel arrangements booked, website visited, or financial service requested—yields data.[7]  Companies go through the pains of collecting this data for one reason alone: knowledge pays.  The more a company knows about its target customer base, the better it can retain existing customers, convince them to buy goods or services they do not already have, or target promising new customers.[8]   Database marketers can focus their solicitations to the people most likely to respond favorably, thereby cutting costs and increasing returns.[9]  In addition, the ability to pinpoint and reach specific individuals can foster increased customer loyalty and retention.[10]

 

4.      When companies pool their data with that of other companies and the government, the resulting personality profiles become all the richer, and often yield new opportunities for profit.  For example, large-size clothing stores, health clubs, and diet food companies often exchange their data in the hopes of mining new sources of customer.[11]  CVS and Giant Food give patient prescription records to a direct mail and pharmaceutical company, which tracks customers who fail to refill their prescriptions and sends a reminder letter.[12]  Companies even make money from renting or selling their databases outright.  Over ten thousand lists of data about individuals are available for rent.[13]  The annual market for mailing lists alone, before factoring in sales attributable to their use, is approximately $3 billion.[14]

 

5.      As sophisticated as traditional database marketing techniques have become, they pale in comparison to the ease and effectiveness of data collection and marketing over the Internet.  Companies can collect a great deal of information by requiring visitors on their site to register, making goods available for electronic commerce, or by sponsoring contests and surveys.[15]    They do not even have to do the data entry because visitors key in all the information themselves.   In addition, websites can automatically capture data that visitors are not even aware is being collected.  If the company utilizes a “cookie”[16] or tracks the user’s “clickstream,”[17] it can learn a visitor’s email address, type of computer, what information the user accesses on the Internet, and how long he or she stays on any one site.[18]  If the user is using products made by Microsoft Corporation and Intel Corporation, unique identifying serial numbers contained in the products allow third parties to track individual computer users.[19] 

 

6.      Like their traditional non-electronic counterparts, online merchants benefit from the data they collect because it helps them target their solicitations, which leads to lower overhead, and, some say, lower prices for consumers.[20]  They can use the data they collect about their visitors to glean general patterns about where visitors gravitate, or to learn more about the particular preferences of individual consumers.[21]  The unique characteristics of the Internet make it ideal for one-to-one marketing.  At websites where online merchants collect data about their visitors, no two people need see the same display of information and advertisements.[22]  The company will utilize technology to customize its site according to what it knows about the visitor.[23]  Companies can also send personalized, interactive email messages, urging individuals to reconsider a product they lingered over during their last visit to a website.[24]

 

7.      Entirely new business models are emerging to capitalize on companies’ interest in learning more intimate details about consumers, and on consumers’ desire for personalization.  For example, when online retail stores are popular, it is often not because of what they sell, but because of the personalization services surrounding their goods.  Amazon.com, the online purveyor of books, music, and other products, provides an excellent example.[25]  In addition to selling its wares, Amazon.com offers personal recommendations, based on books the viewer or people like the viewer have purchased in the past.[26]  The company also makes its data available to the public, revealing patterns among different groups of customers to satisfy other customers’ curiosity or intellectual edification.[27] 

 

8.      Beyond offering personalization services to augment product offerings, many Internet entrepreneurs have realized that they can make a lot of money bypassing the consumer retail aspect of the business model altogether.  They are creating companies premised upon the single goal of collecting, repackaging, and selling data about consumers to other companies.[28]  Indeed, some enthusiasts suggest that the real-time information contained in databases has become the new currency.[29]  In the coming years, this emphasis on information will take personalization to new extremes.  Companies like MicroStrategy will transform the world to a place where individuals can be instantly alerted when certain events occur, including a traffic jam on their route to work, the availability of a better mortgage rate, a crime committed in their neighborhood, or the firing of the CEO of a company in which the person has stock.[30]  This is the world toward which database owners are striving.  Underlying their efforts and predictions for the future is their fundamental assumption that they have a right to the data they collect and use about individual consumers.  Is this assumption constitutionally valid?

 

III.  Companies’ Rights in Commercial Databases

 

A.  The Broad Right to Collect and Use Data about Individual Citizens

 

9.      The question of whether companies have a right to collect and use personal information about individuals’ buying habits and preferences must be considered in the context of the United States’ larger cultural heritage.  The Founding Fathers and authors of the United States Constitution viewed freedom to receive and disseminate ideas as nothing less than a bulwark against the tyranny from which they had so recently fled.[31]  This faith in free expression is embodied in the First Amendment.[32]  Although the traditional ambit of First Amendment protection was political speech,[33] over the years the United States Supreme Court has made it clear that the rights contained in the First Amendment also extend to cruder forms of information.[34]  Collections of raw facts contained in databases may not at first glance seem the stuff of Constitutional freedoms and democratic revolutions.  Yet, the Constitution does stoop to protect mere facts about the government and its citizens, and to guarantee that these facts may be freely disseminated by both.[35]

 

10.  In Whalen, the Supreme Court explicitly recognized that the government has a right to collect and use data about individual citizens.[36]  At issue was a New York statute that required physicians to disclose information about patients who obtained narcotics with both legal and illegal markets.[37]  The information was compiled into a centralized computer database maintained by the state.  A group of patients who needed such drugs for medical purposes challenged the statute on the grounds that the database violated their privacy.[38]  The Supreme Court held that a state has a vital interest in controlling the distribution of dangerous drugs.[39]  Even if the database was not strictly necessary for controlling that distribution, the database was not unconstitutional.[40]  States have broad latitude to experiment with possible solutions for matters of local concern.[41]  The instant experiment did not invade any constitutional right just because of the remote possibility that even with adequate security measures there might be an unwarranted disclosure.[42]

 

11.  Assuming such safeguards, the government has a right to collect and use data that can trump an individual’s right to privacy.[43]  Private parties have no guarantee of access to this information,[44] but the government has broad discretion regarding to whom it can disclose the data.[45]  The government can even sell its data to private commercial entities.[46]  The private sector is often the happy beneficiary of government’s prerogative to freely disseminate data.[47]

 

B.  Commercial Speech

 

12.  The government has a right to collect, use, and distribute data to the private sector.  But does the private sector itself have a right to collect and use its own data about private citizens? Precedent surrounding database cases would suggest that it does, and that the right emanates from the First Amendment’s protection of commercial speech.[48]  In Virginia Board of Pharmacy v. Virginia Citizens Consumer Council, Inc., the United State Supreme Court unequivocally stated that commercial speech deserves protection under the First Amendment.[49]  In this case, a Virginia statute prohibited pharmacists from advertising prescription drug prices out of fear that the practice would harm the profession and cause the important relationship between pharmacist and consumer to weaken.[50]  The Court held that the state’s fears, while feasible, did not justify its suppression of the pharmacists’ truthful, lawful speech, nor keeping the public in ignorance.[51]  Virginia would be better served by granting consumers access to the information, but developing laws to regulate the professionalism of pharmacists.[52]  The Court offered a four-part rationale for extending the protection of the First Amendment to commercial speech.  First, protecting commercial speech protects the economic interest of the speaker.[53]  Second, such speech should be protected because it serves consumers’ interests in the free flow of commercial information.[54]  Third, society in general has an interest in the free flow of commercial information because of its particular content.[55]  Finally, society has a vital interest in the free flow of commercial information because a free enterprise system cannot work unless consumers can make informed buying decisions.[56]  In sum, commercial speech protection is warranted because peoples’ economic decisions are just as important to the functioning of a free enterprise economy as their political decisions are to the functioning of a free representative democracy.[57]

 

13.  The Virginia State Board of Pharmacy court extended First Amendment protection to commercial speech, but it was not willing to grant it the same status of protection as that granted to other forms of speech.[58]    Further, the government’s interest in preventing commercial harm is legitimate and could outweigh a company’s interest in free speech.[59]  Consequently, some government regulation of commercial speech is permissible that would not be tolerated with other forms of speech.[60]

 

C.  Are Databases Commercial Speech?

 

14.  The conventional definition of commercial speech is “speech that proposes merely a commercial transaction.”[61]  In Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, the Supreme Court employed broader terms, defining commercial speech as an “expression related solely to the economic interests of the speaker and its audience.”[62]  Beyond these basic definitions, the Supreme Court has purposefully declined to create a universal meaning to guide litigation in this area.[63]  Not surprisingly, therefore, the specific question of whether databases fit into the scope of commercial speech has never been firmly resolved.  One could certainly argue that the Court’s early definitions leave no room for databases.  Data by itself is not intuitively speech.  The act of collecting data is not expressive, and it does not propose a commercial transaction.[64]  If anything, consumers request a commercial transaction, as with electronic commerce-enabled websites.[65] 

 

15.  The inquiry does not end there, however.  Speech that proposes merely a commercial transaction “does not constitute the universe of commercial speech.”[66]  In Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., the Supreme Court expressly declined to decide whether credit reports, one particular form of databases, qualified as commercial speech.[67]  However, a plurality of the Justices noted that credit reports and commercial speech share many of the same characteristics.[68]  Both are solely motivated by the desire for profit, which is a force less likely to be deterred than other types of speech.[69] 

 

16.  Database marketers, for their part, argue that the activities they conduct surrounding their databases are not commercial speech, but traditional speech.[70]  As such, it would deserve the full protection of the First Amendment against suppression by the government or private actors.  Circuit courts assigned with the task of deciding whether data reports constitute commercial speech have come out on both sides of the issue.[71]  The Supreme Court will soon have an opportunity to make its intentions in this area known because it has granted certiorari to one case involving databases,[72] and could potentially have an opportunity to hear another that is directly on point and currently working its way through the judicial system.[73] 

 

17.  In the first case, United Reporting (a private publishing company) received lists of recently arrested individuals from the Los Angeles Police Department pursuant to California Government Code § 6254, which required state and local law enforcement agencies to make such information public.[74]  United Publishing turned around and sold the lists to attorneys, insurance companies, religious counselors, and other parties, who would use the information to solicit business.[75]  In 1996, however, California amended the Code to prohibit the release of arrest information to people who intended to use it for commercial purposes.[76]  United Reporting challenged this law as a violation of its right to free speech.[77]  Specifically, United Reporting argued that because the activity engaged in was not commercial speech, but noncommercial speech, the statute is subject to strict scrutiny under the United States and California Constitutions.[78]  According to United Reporting, it never proposed a commercial transaction, it simply provides its clients with the raw material they need to propose their own commercial transactions with the recently arrested individuals.[79]  The Appeals Court disagreed, finding that United Reporting did propose a commercial transaction, and thus participates in commercial speech.[80]  Nevertheless, even under the reduced level of scrutiny afforded to commercial speech, California’s law violated the company’s rights under the First Amendment.[81]

 

18.  The second case that the Supreme Court could hear, if the Federal Communications Commission is successful in its appeal, is U.S. West, Inc.  v. Federal Communications Commission.[82]  U.S. West challenged a FCC regulation prohibiting it from using personal data for marketing purposes unless the company received express permission from the customers.[83]  Specifically, the regulation sought to protect Consumer Proprietary network Information (CPNI) from undue disclosure by allowing the company to only use CPNI data from customers who “opt-in” to the program in advance.[84]  The government argued that its regulations did not infringe U.S. West’s right of commercial speech because it only banned the use of one type of data—CPNI.[85]  Further, it did not prevent U.S. West or other telecommunications companies from otherwise communicating with customers or limit what the companies could say to them.[86]  U.S. West took the position that the regulation curtailed its internal business communication, which is not commercial speech, but traditional speech.[87]   The regulation, U.S. West argued, must be held up to the more stringent level of First Amendment scrutiny, although this type of speech is generally afforded less protection than noncommercial speech.[88] 

 

19.  The Tenth Circuit rejected both the government and U.S. West’s arguments.[89]   It held that U.S. West’s targeted speech falls solidly within the definition of commercial speech because the purpose behind the CPNI is to encourage customers to purchase more or different telecommunications services.[90]  The company’s internal communications about the data were also commercial speech because they were conducted for the sole purpose of facilitating marketing of telecommunications services to individual customers.[91]  In sum, “the speech [is] integral to and inseparable from the ultimate commercial solicitation.  Therefore, the speech is properly categorized as commercial speech.”[92]

 

20.  Until the U.S. Supreme Court has a chance to tighten its definitions regarding First Amendment protection of commercial database use, the most competent way to predict its inclinations may be to examine database use in light of the four rationales for the protection of commercial speech, enumerated in Virginia State Board of Pharmacy.[93]  If the characteristics of databases fit these notions of commercial speech, it would seem more likely to be protected.  As discussed above, the first rationale for protecting commercial speech is to protect the economic interest of the speaker.[94]   There can be no doubt that this interest is served by calling commercial databases a form of free speech.[95]  Database marketing enables companies to refine their marketing techniques to get better returns at lower costs.[96]  Direct marketing enables companies to realize billions of dollars in sales of goods and services.[97] 

 

21.  The second purpose behind commercial speech protection is to ensure that consumers have access to information about new products and prices.[98]  Critics argue that databases in fact are a disservice to consumers because they enable companies with sophisticated marketing programs to entice consumers to buy products they do not need or even want.[99]  The stronger argument, however, is that databases do serve the interests of individual consumers.  The commercial speech doctrine is premised upon the idea that individuals fare better when armed with information than when kept in ignorance by paternalistic governmental policies.[100]  The more information people have at their disposal about a wide range of products, the better able they are to decide what they need and how much they should pay for it.[101]  Databases simply help companies get their message out to the right people at a fraction of the cost of blanket advertisements.[102]  Consumers have a strong interest in ensuring that merchants continue to have access to data about their pasts.  For example, if companies did not have access to reliable data about individuals’ credit worthiness, consumers would have to wait much longer for their purchases to be approved,[103] or shoulder the burden of a premium for the company’s financial risk in dealing with an unknown quantity.[104]

 

22.  The third Virginia State Board of Pharmacy rationale for protecting commercial speech is that society in general has an interest in the free flow of commercial information because of its content.[105]  The content in personality profiles does not constitute content in which society has an interest.[106]  Yet, that fact does not necessarily mean that databases fail to satisfy the entire Virginia State Board of Pharmacy test.  First, the third prong requirement of a public interest in the content is ancillary to the other three, so its inapplicability to data arguably should not exclude data from being protected as commercial speech.[107]  Second, while the personality profile data does not meet the third criterion, the uses to which it is put do.  That is, data about consumers is utilized to improve the system of transmitting content that does matter to society—namely, availability of goods and their prices.[108]  The data underlying personality profiles is the raw material from which direct marketing and advertising are derived.

 

23.  Finally, the fourth rationale is that society has an interest in the free flow of commercial information to ensure the proper functioning of the free market economy.[109]  The system cannot work unless consumers are informed purchasers.[110]  Electronic databases are simply a more efficient way for this goal to be realized.[111]  Critics argue that the societal interest rationale is not met by extending the free speech domain to databases because the database-marketing regime actually harms the delicate balance of the enterprise economy.[112]  Companies know way more about consumers than consumers do about them.  As database marketers become comparatively omniscient, they turn into “unaccountable Frankensteins” shielded from law enforcement and any sort of accountability for their actions.[113]  Yet, these arguments are flawed in two crucial respects.  First, they reek of paternalism and protection through forced ignorance and suppression of commercial speech.  The Virginia State Board of Pharmacy court made it clear that it does not look favorably upon such justifications.[114]  Secondly, these arguments underestimate the power of public opinion.  Even casual glances at the scandals that have rocked the media in recent years show the dire consequences of database marketers overstepping their bounds.[115]  When enough people are sufficiently galvanized by privacy infringements, Congress responds with legislation to enforce fair data use procedures.[116]  The power individuals exert on companies through their ability to switch their business, raise a public uproar, or attract the attention of legislatures is formidable, and serves as an effective balance to the power differential.[117]

 

24.  Thus, calling databases commercial speech does not offend the goals of the commercial speech regime laid out by the U.S. Supreme Court in Virginia State Board of Pharmacy.[118]  The free flow of personal data permits companies to maximize their effectiveness by targeting the right customers with the least amount of resources expended, and assists consumers in becoming intelligent decision-makers in our free enterprise system.  Increasingly, data is the epoxy that holds our enterprise economy together.

 

D.  Data Applications and the First Amendment

 

25.  While the Supreme Court has not yet been heard on the issue of whether data itself is a form of commercial speech, it has consistently held that the uses to which such data is put do constitute commercial speech.  For instance, exploiting databases for solicitation or direct mail purposes is constitutionally protected commercial speech.[119]  Direct mail solicitation places only a negligible burden on consumers because it imposes no “captive quality.”[120]  

 

The mail box, however noxious its advertising contents often seem to judges as well as other people, is hardly the kind of enclave that requires constitutional defense to protect ‘the privacies of life.’ The short, though regular, journey from mailbox to trash can…is an acceptable burden, at least so far as the Constitution is concerned.[121] 

 

26.  Courts have remained faithful to these beliefs, in spite of the emergence of powerful new data storage and mining technologies that enable companies to conduct more sophisticated, and some might say intrusive, direct marketing efforts.[122]  In Shapero, for instance, the Court expressly validated the Constitutionality of targeted marketing.[123]   The case arose from a challenge to a Kentucky statute, which prohibited lawyers from soliciting legal business for pecuniary gain by sending letters to potential clients facing particular legal problems.[124]  Shapero was a lawyer who, on the basis of public information, identified people in danger of losing their homes from foreclosure and sent personalized letters urging them to seek his legal assistance.[125]  The Court held that it made no difference whether Shapero was able to send his message to specifically targeted individuals, rather than to the general public.[126]  Admittedly, a personalized letter to a specific recipient presents an increased risk of deception.[127]  Intentionally or not, the letter could mislead the recipient about the nature or seriousness of her legal problem, or lead the recipient to think the lawyer is more familiar with her case than he really is.[128]   Nonetheless, these dangers do not justify a total ban on that mode of protected speech.[129]  Lawyers have a right to solicit business from potential clients using all the technological tools available.[130]

 

IV.  The Right to Privacy

 

27.  The benefits that consumers enjoy from personalization do not come without a price.  That price is a growing feeling of exposure and vulnerability.  Many people are left cold at the impertinence and arrogance of some database marketers.  Stories of insensitive and egregious privacy violations abound.[131]  In addition to the annoyance or alarm of getting unsolicited calls or mail, the potential applications for personal data can be downright disturbing.  For instance, one could envision a health insurance company charging a premium for subscribers whose grocery purchases indicate they eat too much junk-food, or an cult leader posting a list of individuals who bought items the group found offensive, along with incendiary messages.  Even seemingly innocuous data about one’s buying habits could be dangerous if the wrong people get hold of it.  For example, an opposing party in a civil or criminal case could use data held by companies to demonstrate liability or guilt.  This possibility is not as far-fetched as it may seem, as illustrated by Independent Counsel Kenneth’s Starr attempt to subpoena Monica Lewinsky’s book purchases during his investigation of President Clinton.[132] 

 

28.  In complaining about actual and imagined transgressions by over-zealous database marketers, consumer advocates generally refer to an abstract, natural right to privacy.  Does such a right exist?  The right of privacy delineated in Griswold v. Connecticut and its progeny is, of course, well established by now.[133]  Yet, many argue that it does not extend beyond the realms of procreation, reproduction, marriage, and privacy of the marital bed.[134]  The type of privacy implicated in electronic databases—“informational privacy”—is of an entirely different sort.[135]   “Informational privacy” expresses the desire of persons to choose freely under what circumstances and to what extent they will expose themselves, their attitudes, and their behavior to others.[136]  The Court has never been willing to find either a general Constitutional right to privacy,[137] or a specific right of informational privacy.[138]  There are indications, however, that courts are not totally adverse to the notion of an individual right against government disclosure of personal information.[139]  In Whalen, the U.S. Supreme Court said in dicta that it was “not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks.”[140]   The government or other party’s right to collect and use personal and potentially embarrassing data is typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures.[141]  The particular application challenged in Whalen was not problematic because it had appropriate limits and safeguards.  If the databases did not have adequate measures to protect individual privacy, “the central potential for abuse of that information [would render the Court] not prepared to say that future developments will not demonstrate the necessity of some curb on such technology.”[142] 

 

29.  In United States Department of Justice v. Reporter’s Committee for Freedom of the Press, the Court seemed even more sympathetic to the possibility of a right of informational privacy against the government.[143]  This case centered on a statutory exemption in the Freedom of Information Act that prohibited disclosure to a reporter of an individual’s criminal records held by the Federal Bureau of Investigation.[144]  Of course, “the question of the statutory meaning of privacy under the FOIA is…not the same as…the question whether an individual’s interest in privacy is protected by the Constitution.”[145]  Nevertheless, the Court asserted as a general proposition that “both the common law and literal understandings of privacy encompass the individual’s control of information concerning his or her person.”[146]  Disclosure of FBI rap sheets violates an individual’s privacy because it reveals too much information, even though all of the information is public.[147]  There is a huge difference between “scattered bits of criminal history” that may be publicly available in various sources and “a federal compilation” that presents it together in one easy package.[148] 

 

30.  Some people, including Washington attorney Robert Belair, believe that the decision in Reporters Committee confirms that individuals have a right to informational privacy, separate from an FOIA exemption.[149] 

 

Previously, the court had resisted finding a privacy interest in records unless the records contained intimate, personal information, such as health or family information, and unless the records had been held in more or less strict confidence…What the court found in Reporters Committee is that there is an expectation of privacy in a computerized, comprehensive record of all of an individual’s activities – but not necessarily an expectation of privacy in a single criminal event.[150]

 

31.  Not all Courts share Belair’s conviction.  In fact, the situation in regard to informational privacy in the various judicial districts can be summed up in one word: inconsistent.  Some districts refuse to hold that a right of information privacy exists,[151] while others expressly accept that Whalen establishes that right.[152]  This confusion is the contextual background for Condon v. Reno, a case currently before the Supreme Court.[153]  At issue in Condon is the constitutionality of Congress’ Driver Privacy Protection Act of 1994 (DPPA), which regulates the dissemination and use of certain information contained in State Motor Vehicle Records, and prohibits any person from knowingly obtaining or disclosing personal information from motor vehicle records.[154]  The Act was upheld in two Federal Circuits, and struck down in two others.[155]  In Condon, the Fourth Circuit District Court began its analysis by confirming that the Constitution protects informational privacy.[156]   The Court then balanced the interests of an individual’s reasonable right to privacy in the Constitution against the government’s interest in disclosure, concluding that information contained in drivers’ records that is otherwise freely available in public records is not protected from disclosure.[157]  The Court of Appeals affirmed the judgment, holding that the sort of information found in motor vehicles records is not the sort to which people have a reasonable expectation of privacy. [158]

 

32.  The Supreme Court’s decision in Condon could finally dispel all doubts about the existence of a Constitutional right to informational privacy against the government, or it could restrict its decision to the narrow facts of the instant case.  Privacy advocates will of course, eagerly welcome a positive affirmation of a right to informational privacy.  Yet, in reality such a finding would not offer much solace to individuals concerned about private-sector use of their personal data.  Any finding of a Constitutional right to informational privacy will only apply against the government, not private entities.[159]  Private actors are immune from restrictions imposed by the Fourteenth Amendment.[160]  In short, the Constitution does not appear to provide consumers with a remedy for the collection and use of their personal information against database marketers.[161]  Consumers must look elsewhere if they wish to block companies from gathering their information.

 

33.  In fact, it may not even be in consumers’ best interest for the Court to find a right to informational privacy.  For all it offers, privacy imposes many costs on society.[162]  Institutionalized privacy would facilitate the dissemination of false information by making it more difficult for individuals to discover falsities.[163]  It could also interfere with the collection, organization, and storage of information needed by companies to make rapid, informed decisions, and to efficiently market their products and services.[164]  In addition, privacy protects the withholding of relevant true information, such as when an employee fails to disclose a medical condition that would affect his or her job performance.[165]  As a result, a regime of ultimate privacy could reduce productivity, and result in higher prices for products and services.[166]  Privacy rights could also threaten physical safety by blocking access to records, such as information about an individual’s child abuse or molestation, sexual offenses, or communicable diseases.[167]  Finally, privacy can impede upon healthy individual voyeuristic curiosity which “opens people’s eyes to opportunities and dangers.”[168]

 

V.  Statutory Attempts to Protect Privacy

 

A.  American Attitudes Toward Regulation

 

34.  American consumers may feel discomfort over their increasing loss of privacy but as a whole they have not pushed for legislative solutions.  Instead, they appear to prefer leaving businesses alone to work out satisfactory self-regulation techniques, especially in the Internet industry.[169]  This preference can be explained by Americans’ basic faith in the private sector and their recognition that regulation of it can have unintended and harmful consequences.[170]  Mandatory rules could chill further technological innovation.[171]  Furthermore, Americans believe in the power of mass media and popular opinion to hold private sector abuses in check.[172]  They also tend to be disinclined to impose regulations until problems actually occur.[173]  Finally, American consumers believe that problems caused by new technologies can be solved using newer technologies.[174]  For instance, consumers can use anonymizer services to mask their identity on the Internet[175] or filter technologies to keep their children away from unsavory websites.

 

35.  The approach of the federal government mirrors consumer ambivalence about privacy and innovation.  In the traditional retail sphere, privacy protection is a popular cause—within the first three months of the 1999 congressional term, 50 different privacy bills were introduced.[176]  Over all, however, the popular appeal of privacy protection has not translated into strong informational privacy laws.  When Congress does regulate data uses, it tends to draft narrow acts in reaction to examples of extreme privacy infringement.[177]  Currently, the extent of Congress’ privacy laws are regulations governing use of data by actors in specific industries,[178] as well as two bills governing the Federal Government’s use of personal data.[179]   State legislatures have been somewhat more aggressive in protecting the informational privacy of their citizens.[180]  This is goods news for consumers because state laws apply when consumers challenge database owners for selling their data to other businesses.[181] One common form of control imposed is the requirement that companies provide “opt-out” provisions to enable consumers to initially decide whether the company could disclose the information they collect about particular consumers.[182] 

 

36.  When it comes to Internet data protection policies, the government appears even less willing to regulate database use.[183]  A handful of states have adopted laws that impose civil liabilities for privacy infringements on the Internet.[184]  Yet the overwhelming order of the day on both the national and state level is industry self-regulation with an emphasis on six privacy principles: awareness, choice, data security, data integrity, consumer access, and accountability.[185]  The Clinton Administration has been a vocal supporter of the self-regulation regime.[186]  Internet companies have risen to the challenge by creating guidelines that enable them to take advantage of the electronic medium’s data-intensive capabilities, while respecting consumer privacy.[187]  Several independent watchdog groups also provide industry oversight.[188]  Critics argue that these self-regulatory bodies are not effective because they lack an effective mechanism to punish deviants.[189]  Even when companies purport to adhere to a self-regulation regime they suffer very few consequences if they fail to comply with the organization’s rules.[190]  Nevertheless, the precedent for self-regulation will not be easily reversed.  The Internet marketing industry is too firmly entrenched in its lobbying and self-regulation efforts to acquiesce to onerous regulations,[191] and the American public is not ready to give up on it yet.[192]

 

B.  Central Hudson Test

 

37.  If and when government does seek to regulate use of database information, it must be mindful of companies’ rights of commercial speech.  Government is permitted to regulate some commercial speech but it does not have free reign to do so in any manner it chooses.[193]  In Central Hudson, the Supreme Court articulated the standard for determining whether a regulation impermissibly violates a company’s First Amendment rights.[194]  At issue was the constitutionality of a New York ban on advertising promoting the use of electricity.  New York defended itself by pointing to its interests in conserving energy and ensuring fair and effective rates for electricity.[195]  The Court devised a four-prong test to assist it in analyzing the constitutionality of the regulation.[196]  First, the speech sought to be regulated must either concern unlawful activity and be misleading, or, second, the state must show a substantial interest to justify the speech suppression.  Third, the state’s regulation must directly advance its asserted interest.  Finally, the regulation may not be more extensive than necessary to serve that interest.[197]  On the basis of this test, the Court struck down the state’s ban on energy advertising.[198]  Although the regulation was not problematic under the first three prongs, it failed on the fourth prong because the state’s interests could have been adequately served if it adopted a less restrictive limitation on the types of promotional advertising and its contents.[199] 

 

38.  When applied to database marketing, Central Hudson severely limits the restrictions that states can place on the use and collection of consumer data.  As a general rule, such regulations do not tend to fail the second prong of the test.  Until recently, there was no question that courts would consider privacy protection of individual citizens to be a substantial state interest.[200] As the Supreme Court noted, “[T]he State’s interest in protecting the well-being, tranquility, and privacy of the home is certainly of the highest order in a free and civilized society.”[201]  Indeed, “[the Supreme Court’s] precedents…leave no room for doubt that ‘the protection of potential clients’ privacy is a substantial state interest.’”[202]  Yet, there is some indication that this presumption may not be universally guaranteed, as the Tenth Circuit’s recent ruling in U.S. West suggests.[203]  The U.S. West court held that a broad, general interest in privacy may not automatically rise to the level of a substantial state interest.[204]  Rather, to satisfy the second prong of the test, the government must specify and properly justify the particular notion of privacy and the interest served.[205] 

 

39.  The government must show that the dissemination of information it seeks to keep confidential “would inflict specific and significant harm on individuals” such as undue embarrassment or ridicule, intimidation or harassment, or misappropriation of sensitive personal information for the purposes of assuming another’s identity.[206]  A general level of discomfort and vulnerability over companies having access to personal information does not necessarily rise to the level of a substantial state interest because it is not based on an identified harm.[207]  In the end, “notwithstanding our reservations,” the Tenth Circuit assumed for the sake of the appeal, the government’s interest in preventing disclosure of individuals’ sensitive information was substantial but its hesitation could portend a broader change in attitude.[208]

 

40.  State regulations invariably fail under the third and fourth Central Hudson prongs.  As to the third prong, the government must prove that the harms it claims are caused by the commercial speech which it seeks to restrict are real and that restriction will in fact materially alleviate them.[209]  Mere speculation or conjecture that harm to privacy will result from the speech is inadequate.[210]  In Edenfield, the Supreme Court struck down a ban on solicitation by certified public accountants because the State had not presented any evidence—anecdotal or empirical—that such solicitation caused the state’s asserted interests of fraud, over-reaching, or compromised independence.[211] Other than a conclusory affidavit, the state offered no evidence to substantiate its claim.[212]  In fact, the only evidence in the record tended to contradict, rather than strengthen, its arguments.[213]  Where the state can show statistical and anecdotal data the courts will be much more receptive to its claims.[214]  In Went for It, the Florida Bar submitted a 106-page summary of a two-year study of lawyer advertising and solicitation practices to support its ban on attorneys soliciting clients within thirty days after a major accident.[215]  The reports demonstrated that such solicitation was indeed harmful and that the government’s interests in, “protecting the personal privacy and tranquility of citizens from crass commercial intrusion by attorneys upon their personal grief in times of trauma” were directly met by the ban.[216] 

 

41.  Another common failing of legislation under Central Hudson’s third prong is the use of selective exemptions.[217]  In United Reporting, the appeals court struck down California’s ban on certain parties’ access to arrest records due to the numerous exceptions for journalistic, scholarly, political, governmental, and investigative purposes rendered the statute unconstitutional.[218]  The many exceptions undermined and counteracted the asserted governmental interest in preserving privacy.[219]  By comparison, in Lanphere & Urbaniak v. Colorado, the Court upheld a similar Colorado statute that limited public access to criminal justice and official action records when the motive was soliciting business for pecuniary gain.[220]  The Colorado statute contained no exceptions: it refused access for all commercial purposes.  Such a restriction was deemed by the court to directly advance the State’s interest in protecting privacy and preventing overreaching by solicitors.[221]

 

42.  To satisfy the fourth prong, the government must prove that the restriction is narrowly tailored to achieve the desired objective.[222]  The fit between the legislature’s means and its desired objective need not be perfect, but reasonable.  A fit, “that represents not necessarily the single best disposition but one whose scope is, ‘in proportion to the interest served.’”[223] A prophylactic rule against a particular type of activity probably is not the least restrictive means possible.[224]  Similarly, requiring a database marketer to get permission from customers before it uses their data is not the least restrictive means possible to protect consumer privacy.[225]  Rather, a traditional opt-out strategy, which permits companies to use data unless a customer specifically opts out of the program will be sufficiently effective.[226]

 

VI.  Private Right of Action: The Privacy Tort

 

43.  Where legislation and governmental oversight fails, consumers in some states have a private right of action against database marketers in the form of a privacy tort.[227]  The privacy tort recognizes four types of privacy violations: public disclosure of private facts, false light in the public eye, appropriation of name, likeness, or personality, and intrusion upon physical solitude or seclusion.[228]  Of the four options, public disclosure of private facts and appropriation of name, likeness, or personality is what consumers turn to for relief from intrusive companies.[229]  These claims are usually unsuccessful, although not on First Amendment grounds.[230]  Clearly, enforcement of the tort against database marketers would limit their ability to express themselves to consumers.[231]  In such a conflict, the companies’ constitutional rights to commercial speech would inevitably trumps the tort actions of consumers.[232]  Yet the Court has not completely resolved the issue of whether the First Amendment protects the publication of true facts pertaining to private affairs, as mandated in the public disclosure of private facts tort.[233]  Further, the appropriation tort averts a First Amendment conflict because it does not challenge speech per se but rather the act of appropriating or using the information in a way that suggests control over it.[234]

 

44.  Beyond First Amendment conflicts, consumers wishing to assert their privacy rights get little help from the public disclosure tort because several limitations make this cause of action unwieldy.[235]  One obstacle lies in the requirement that the materials be disclosed to a wide audience.[236]  Because the “publication” of commercial data contained in databases is usually made to a small group, often one at a time, it may not satisfy this requirement.[237]  In addition, the information disclosed must be highly offensive to a reasonable person.[238] Personal data stored in commercial databases may be embarrassing or private in nature but it is rarely offensive.[239]  For these reasons, the public disclosure of private facts tort is hardly ever enforced against database marketers.[240]

 

45.  The other relevant branch of the tort is appropriation of name, likeness, or personality.[241]   It has been argued that a collection of personal information sold as a personality profile is an appropriation of an element of the plaintiff’s personality for commercial use.[242]  When an individual’s data is sold as part of a mailing list or credit report, a facet of his or her personality is exploited for commercial gain and associated with a particular type of good, service, or viewpoint for advertising purposes.[243] In reality, although compelling, this tort is seldom successful in claims against database marketers.  Shibley v. Time, Inc. is fairly representative of courts’ unsympathetic treatment of the appropriation tort.[244]   In Shibley, the Ohio Court of Appeals refused to hold Time Magazine liable for selling subscriber lists without first obtaining the consent of the subscribers.[245]  The plaintiff argued that Time wrongfully appropriated his identity for profit when it compiled and sold personality profiles and subjected him to solicitations from direct mail advertisers without his permission.[246]  The court dismissed the claim on the grounds that the appropriation tort only applies where the plaintiff’s name or likeness is displayed to the public.[247] Even if the practice amounted to the sale of plaintiff’s personality as such, the information was only used to determine what types of advertisements the plaintiff should receive.[248]  In addition, Time did not invade consumer privacy because they have no expectation of privacy in their mailboxes.[249]  In Dwyer v. American Express, the Illinois Supreme Court went a step further and declared that there is “no intrinsic value” associated with one’s name in this context.[250]

 

VII.  Conclusion

 

46.  There is no doubt that database marketing sacrifices individual consumer privacy interests for the interests of the companies collecting and using the data.  One’s personal life is no longer private, at least in the realms of subscriptions, purchasing decisions, memberships in organizations, websites visited, and data held by the government.  As personalization technology becomes more accurate and efficient, the personality profiles that companies create about individual consumers will become eerily accurate.  Overall, consumers can do very little to stop the use of personal data for pecuniary purposes.  They have limited non-legal recourse in the form of switching their business to another firm, opting out of programs they know exist, raising a public uproar, or employing technological means to shield their privacy on the Internet.  Such methods are surprisingly effective.  Often, the legislature will take notice and impose regulations on the offending party’s industry.  At the very least, companies are motivated to not lose customers to competitors with more enlightened privacy policies.

 

47.  Consumers’ legal protections at common law, however, are tenuous and insubstantial.  Courts have yet to unequivocally recognize a right to informational privacy under the Constitution.  Even if such a right existed, consumers could not assert it against private sector companies.  Currently, individuals can try challenging database marketers with private rights of action but the privacy tort also offers little solace because its underlying requirements are ill suited to the characteristics of database marketing.  Furthermore, simple logistics render the tort unhelpful to private citizens.  A single privacy tort case can take years to move through the court system.[251]  When a precedent in one circuit is created, it will not necessarily be adhered to in other circuits.[252]  Finally, by the time a concrete precedent is established, database marketers most likely will have moved on to new collection and dissemination technologies that escape the specific confines of a given decision.[253]

 

48.  In contrast to the poor pedigree of consumers’ privacy rights, companies enjoy a right of commercial speech protected by the First Amendment.[254] Database collection and use for marketing purposes appears to fit within the definition of and interests served by commercial speech.  Databases are simply one tool employed by companies in their efforts to communicate their commercial message to consumers.  The data cannot be separated from the communication.  Both merit constitutional protection.  The fact that databases enable  marketers to be more accurate and efficient than ever before does not change the fact that companies have the right to solicit business from and advertise to consumers. 

 

49.  Of course, this trend could change, when the U.S. Supreme Court hears cases involving questions of informational privacy and the First Amendment status of database marketing.[255]  If the Court recognizes a right to informational privacy, the entire landscape of the debate could change as companies would no longer have a monopoly on the presumptive power of the Supremacy Clause.[256]  From a policy perspective, such an outcome may not be desirable.  Privacy sounds like a righteous ideal but, in truth, institutionalized privacy has the power to seriously impair the American economy and culture.  Our economy is built upon a network of databases. The free dissemination of data is essential to the smooth functioning of our complex economy.  Companies share data because it is cost-efficient and effective.  By contrast, a regime that favors protecting personal privacy by keeping valuable information secret is inefficient and possibly even dangerous.  It would force companies to work harder, resulting in increased prices and decreased customer service.  Institutionalized privacy would also have the effect of keeping valuable information away from parties that need it.

 

50.  Consumers benefit more from what databases offer than they would from informational privacy rights.  On one level, databases ensure that individuals can continue to buy goods and services without the long delays or extra costs that would accompany a system of secrecy and uncertainty about a person’s creditworthiness.  People have become accustomed to this luxury and take it for granted.  On another level, curbing companies’ uses of personal data would chill the future potential of the personalization revolution.  Personalization is founded upon the simple premise of giving consumers exactly what they want at the lowest price.  One would be hard pressed to think of a business strategy more aligned with consumer interests.  Alerting consumers to promising new products and services is only the beginning.  Sophisticated database marketers can leverage their knowledge about a consumer to offer value-added services, such as those offered by MicroStrategy and Amazon.com.[257]  If companies had to instead focus their energies on the old concerns of finding appropriate customer leads, they could not provide an optimal level of customer service.

 

51.  Privacy is not the ultimate ideal that consumers assume.  The trend toward personalization and effective database marketing benefits companies, consumers, and society as a whole.  From a policy and legal standpoint, consumer privacy rights must take a subordinate position to companies’ rights of commercial speech.  The current legal regime supports the preferred policy outcome. 



[1] The author is a third year student at the University of Virginia School of Law, and a graduate of the University of Vermont.  Prior to law school, she was a senior writer with CIO, a magazine for and about Chief Information Officers.  In the fall of 2001, she will begin work as an associate with Palmer & Dodge in Boston, Massachusetts.

[2] 60 Minutes: Interview with Michael Saylor on Privacy (CBS television broadcast, Nov. 28, 1999) (hereinafter 60 Minutes), available at http://www.microstrategy.com/news/articles/ramfiles/SixtyMinutes.ram (last accessed Dec. 22, 2000)(Saylor is CEO of MicroStrategy, an Internet technology company specializing in personalization).

[3] Personalization refers to the art of leveraging data about individual consumers’ preferences and purchases to figure out how to serve them better, and make more money in the process.

[4] Scott Shorr, Personal Information Contracts: How to Protect Privacy Without Violating the First Amendment, 80 Cornell L. Rev. 1756, 1762 (1995) [hereinafter Personal Information].

[5] See U.S. West, Inc. v. Federal Communications Commission, 182 F.3d 1224 (1999); Grant Buckler, Court Decision on Free Speech for Telcos Raises FCC Hackles, Newsbytes PM, Aug. 27, 1999 (the FCC will ask that the 10th Circuit Court of Appeals re-hear an appeal of its ruling against telecommunications companies using customers’ records for telemarketing purposes); Condon v. Reno, 155 F.3d 453 (1998), cert. granted, 67 U.S.L.W. 3705 (U.S. May 17, 1999); Los Angeles Police Dep’t v. United Reporting Publ’g Corp., 146 F.3d 1133 (1998), cert. granted, 67 U.S.L.W. 3468 (U.S. Jan. 25, 1999) (no. 98-678).

[6] William J. Fenrich, Common Law Protection of Individuals’ Rights in Personal Information, 65 Fordham L. Rev. 951, 951 (1996) [hereinafter Common Law].

[7] Shorr, Personal Information, supra note 4, at 1762-63.

[8] Fenrich, Common Law, supra note 6, at 961.

[9] Id.

[10] See, e.g., Frances Stead Sellers, All the Best! From a Heartfelt Database, Wash. Post, Dec. 5, 1999 at B1 (hoping to foster greater loyalty, companies in every industry send holiday cards to persons listed in their databases).

[11] See, e.g., Sonia Ossorio, Anatomy of a Mailing List, Gannett Suburban Newspapers, Mar. 30, 1994.

[12] Testimony Before the Subcomm. On Gov’t Mgmt., Info., & Tech. Of the House Comm. On Gov’t Reform and Oversight, 105th Cong. (May 19, 1998) (Testimony of Janlori Goldman, Director, Health Privacy Project, Institute for Health Care Research and Policy, Georgetown University).

[13] National Telecommunications and Information Administration, Inquiry on Privacy Issues Relating to Private Sector Use of Telecommunications-Related Personal Information, 59 Fed. Reg. 6842, 6842 (1994). 

[14] Fenrich, Common Law, supra note 6, at 956.

[15] Jonathan P. Cody, Protecting Privacy Over the Internet: Has the Time Come to Abandon Self-Regulation?, 48 Cath. U. L. Rev. 1183, 1186 (1999) [hereinafter Protecting Privacy].

[16] Id. at 1185 n.10 (A cookie is a user file attached to an online user’s hard drive.  When the user visits a website, the cookie allows the website to save certain user information, such as a password, so the site may identify that particular user and his preferences each time he visits the site.).

[17] See Fed. Trade Comm’n, Individual Reference Serv.: A Report to Congress 3-4 (1997) (defining a clickstream as a user’s path through the Internet, which can be monitored, stored, reused, and aggregated).

[18] Id.

[19] Peter H. Lewis, You Say You Want Evolution?, N.Y. Times, Mar. 4, 1999, at E1 (Explaining that the Intel chip’s “Processor Serial Number” can follow individuals on the Internet by tracking their computers when uses are online, even when the user has disabled the feature. Intel claims the serial number is a security feature that enables network employees to prevent unauthorized use of the network and to diminish fraudulent electronic commerce transactions); John Markoff, Microsoft to Alter Its Software, Responding to Privacy Concerns, N.Y. Times, Mar. 7, 1999 (describing Microsoft’s claims the number allows support personnel “to help users diagnose problems with their computers more accurately”).

[20] Cody, Protecting Privacy, supra note 15, at 1187 (citing Information Policy Committee, National Information Infrastructure Task Force, Options for Promoting Privacy on the National Information Infrastructure 10 (1997) (Draft for Public Comment)).

[21] Karl D. Belgum, Who Leads at Half-time?: Three Conflicting Visions of Internet Privacy Policy, 6 RICH. J. L. & TECH. 1, (Symposium 1999), at http://www.richmond.edu/jolt/v6i1/belgum.html  [hereinafter Who Leads].

[22] 60 Minutes, supra note 2.

[23] Id.

[24] Belgum, Who Leads, supra note 20.

[25] See Amazon.com website at http://www.amazon.com (last accessed Dec. 22, 2000).

[26] Id.

[27] Joe Salkowski, Purchase Circles Create Wrong Spin, Chi. Trib., Sept. 13, 1999 (Amazon.com’s Purchase Circles allow customers to browse for books, CDs, and videos by peeking at the Amazon.com purchases made by other groups of people).

[28] See, e.g., Ariana Eujung Cha and Leslie Walker, A Pyramid Marketing Ploy Clicks; Web Users Cash in as Firms Pay by Hour for ‘Eyeballs’, Wash. Post, Dec. 8, 1999 (AllAdvantage.com pays people to let it track where they and their friends surf on the Web.); The War Is to Provide the Best Intelligence: CEO Michael Saylor of MicroStrategy talks about his company’s multifaceted intelligent transaction network, BW Online Daily Briefing,  http://www.businessweek.com/bwdaily/dnflash/dec1999/nf91201c.htm (Dec. 1, 1999) [hereinafter Saylor interview].

[29] Saylor interview, supra note 28.

[30] Id. (Saylor says, “I can put a computer on the corner which makes 150,000 optimizing decisions on behalf of sleeping, drunk, or illiterate customers.  So whereas the status quo of the past was those people get the worst deal, the status quo in the future is the computer optimizes the economy for everybody.”).

[31] Letter from James Madison to W.T. Berry (Aug. 4, 1822), in James MADISON, The Complete Madison 337 (Saul K. Padover ed., 1953).

[32] U.S. Const. amend. I (“Congress shall make no law…abridging the freedom of speech, or of the press”).

[33] See, e.g., Boos v. Barry, 485 U.S. 312, 318 (1988).

[34] See, e.g., Whalen v. Roe, 429 U.S. 589, 608 (1977).

[35] Id.

[36] 429 U.S. 589 (1977).

[37] Id.

[38] Id. at 598.

[39] Id.

[40] Id.

[41] Id. at 597.

[42] Id. at 601-02.

[43] Id.

[44] See Houchins v. KQED, Inc., 438 U.S. 1, 9 (1978) (the First Amendment does not guarantee a right of access to all sources of information within government control).

[45] See, e.g., Title 5 U.S.C. §552(a)(3) (the Freedom of Information Act requires agencies to make their records available for public inspection and copying).

[46] See, e.g., Linda Greenhouse, The Supreme Court Roundup: Court to Decide Whether States can Reveal Information on Drivers, N.Y. Times, May 18, 1999 at A20 [hereinafter Supreme Court Roundup] (New York earned $17 million in one recent year from charging for access to the State’s computers for examining driver information.); Larry Rohter, Florida Weighs Fee for its Computer Data: Some See Profits, Others Too High a Price, N.Y. Times, Mar. 31, 1994 at B9 (the State of Florida has quoted a price of $33 million for a one-time sale of its motor vehicle records database).

[47] See, e.g., Condon, 155 F.3d 453; United Reporting Publ’g, 146 F.3d 1133 (1998).

[48] See, e.g., U.S. West, 182 F.3d 1224.

[49] 425 U.S. 748 (1976).

[50] Id. at 766.

[51] Id. at 770.

[52] Id.

[53] Id. at 762-66.

[54] Id. at 763.

[55] Id. at 764.

[56] Id. at 765.

[57] Id. at 765; See also, Edenfield v. Fane, 507 U.S. 761, 767 (1993) (“The commercial marketplace, like other spheres of our social and cultural life, provides a forum where ideas and information flourish.  Some of the ideas and information are vital, some of slight worth.  But the general rule is that the speaker and the audience, not the government, assess the value of the information presented.  Thus, even a communication that does no more than propose a commercial transaction is entitled to the coverage of the First Amendment.”).

[58] Virginia Bd. of Pharmacy, 425 U.S. at 770.

[59] Id. at 771 n.24.

[60] Id.

[61] Id. at 762 (quoting Pittsburgh Press Co. v. Human Relations Comm’n, 3 U.S. 376, 385 (1973)).

[62] 447 U.S. 557, 561 (1980); See also, United Reporting Publ’g, 146 F.3d at 1137 (the Central Hudson definition is broader because people often discuss their economic interests without proposing a commercial transaction).

[63] See, e.g,, Bolger v. Youngs Drug Products, 463 U.S. 60, 66 (1983) (advertisements are not necessarily commercial speech, despite the inherent economic motivation of the advertiser); see also, Commodity Trend Serv., Inc. v. Commodity Futures Trading Comm’n, 149 F.3d 679, 684 (7th Cir. 1998) (“The Court has not offered any nuanced distinctions between the [the Virginia Pharmacy and Central Hudson definitions], and the Court noted in Discovery Network that it had not utilized the broader test in its recent commercial speech cases.”) (citing City of Cincinnati v. Discovery Network, Inc., 507 U.S. 410, 422 (1993); United Reporting, 146 F.3d at 1137 (“The Supreme Court has abstained from creating bright-line rules in this area and so should we.”).

[64] Shorr, Personal Information, supra note 4, at 1799.

[65] Id.

[66] U.S. West, 182 F.3d at 1233 n.4.

[67] 472 U.S. 749, 762 n. 8 (1985).

[68] Id. (“We…do not hold…that the [credit] report is subject to reduced constitutional protection because it constitutes…commercial speech.  We discuss such speech…only to show how many of the same concerns that argue in favor of reduced constitutional protection in those areas apply here as well.”).

[69] Id. at 762.

[70] See, e.g., United Reporting, 146 F.3d at 1136; U.S. West, 182 F.3d at 1233.

[71] See, e.g., Millstone v. O’Hanlon Reports, Inc., 528 F.2d 829, 833 (8th Cir. 1976) (holding that consumer credit reports merit relaxed First Amendment protection because they constitute commercial speech); Hood v. Dun & Bradstreet, 486 F.2d 25, 29-30 (5th Cir. 1973) (noting that private subscription credit report “coincides with the doctrine of commercial speech” mainly because it “was distributed…for commercial purposes and clearly without regard to social concerns or grievances”); Grove v. Dun & Bradstreet, 438 F.2d 433, 438 (3rd Cir. 1970) (holding that credit reports are not entitled to the extended constitutional protections under New York Times v. Sullivan).

[72] Los Angeles Police Dep’t v. United Reporting Publ’g Corp., 146 F.3d 1133 (1998), cert. granted, 67 U.S.L.W. 3468 (U.S. Jan. 25, 1999) (no. 98-678).

[73] U.S. West, Inc. v. Federal Communications Comm’n, 182 F.3d 1224 (1999); Grant Buckler, Court Decision on Free Speech for Telcos Raises FCC Hackles, NEWSBYTES PM, Aug. 27, 1999 (the FCC will ask that the 10th Circuit Court of Appeals re-hear an appeal of its ruling against telecommunications companies using customers’ records for telemarketing purposes).

[74]United Reporting, 146 F.3d at 1135.

[75] Id. at 1135.

[76] Id.

[77] Id.

[78] Id. at 1136

[79] Id. at 1137.

[80] Id. (“United Reporting’s speech would be considered commercial under either a broad or a narrow definition.”).

[81] Id. at 1140.

[82] U.S. West, 182 F.3d 1224.

[83] Id. at 1230; See also, 47 U.S.C. § 222(c)(1).

[84] U.S. West, 182 F.3d at 1228 (CPNI data includes information on when, where, and to whom a customer places call.  In comparison, aggregate customer information is collective data that relates to a group or category of services or customers, from which individual customer identities and characteristics have been removed, and subscriber lists information contains names, numbers, addresses and primary advertising classifications.).

[85] Id. at 1232

[86] Id.

[87] Id. at 1233.

[88] Id.

[89] Id. at 1232.

[90] Id.

[91] Id. at 1233.

[92] Id.

[93] Virginia State Bd. of Pharmacy, 425 U.S. 748.

[94] Id. at 762-66.

[95] See, infra

[96] Fenrich, Common Law, supra note 6 at 961.

[97] See, Robert J. Posch, The 25-Year Privacy Debate Has an Institutional Memory, Direct MkT, Apr. 1, 1996, at 2 (in 1994, direct marketing led to as much as $600 billion in sales of goods and services).

[98] Virginia State Bd. of Pharmacy, 425 U.S. at 763.

[99] Oscar H. Gandy, Jr., Legitimate Business Interest: No End in Sight? An Inquiry into the Status of Privacy in Cyberspace, 1996 U Chi Legal F 77, 88 [hereinafter Legitimate Business)] (“The greater the angler’s store of knowledge, the more likely is her creel to be filled with the largest fish in the brook.  This knowledge, often jealously guarded, clearly serves the angler, not the truth, even though I must confess, no trout of my acquaintance has ever been ‘forced’ to bite.”).

[100] See, Central Hudson Gas & Elec. Corp., 447 U.S. 557, 561; Virginia State Bd. of Pharmacy, 425 U.S. at 770.

[101] Virginia State Bd. of Pharmacy, 425 U.S. at 763.

[102] See, Shapero v. Kentucky Bar Ass’n, 486 U.S. 466, 473-74 (1988).

[103] Shorr, Personal Information, supra note 4, at 1760.

[104] Id.

[105] Virginia State Bd. of Pharmacy, 425 U.S. at 764.

[106] Greenmoss, 472 U.S. at 762.

[107] Shorr, Personal Information, supra note 4, at 1802 n. 236 (“Neither subsequent Court decisions nor commentators emphasize the third rationale for protecting commercial speech.”).

[108] Id.

[109] Virginia State Bd. of Pharmacy, 425 U.S. at 765.

[110] Id.

[111] See, e.g., Shapero v. Kentucky Bar Ass’n, 486 U.S. at 474-74.

[112] Gandy, Legitimate Business, supra note 99, at 77-78.

[113] Carl J. Mayer, Personalizing the Impersonal: Corporations and the Bill of Rights, 41 Hastings L.J. 577, 659 (1990).

[114] Central Hudson, 447 U.S. at 561-62; Virginia State Bd. of Pharmacy, 425 U.S. at 770.

[115] See generally, Jennifer Bresnahan, Up Close and Personal, CIO MAG. 63 (May 15, 1997) [hereinafter Up Close] (Lexis-Nexis, Lotus Development Corp., Cyber Promotions Inc., and Metromail Corp. all learned the hard way that privacy infringement can incite the public’s rage).

[116] See, e.g., Video Privacy Act, 18 U.S.C. 2710-2711 (1944).

[117] See, e.g., Pamela Samuelson, Intellectual Property and Contract Law for the Information Age Foreward, 87 Calif. L. Rev. 751, 757 (1999) [hereinafter Intellectual Property]; but see, Paul M. Schwartz & Joe R. Reidenberg, Data Privacy Law: A Study of United States Data Protection 8 (1996) (individual consumers will have little luck bargaining with database marketers because they lack real power to force changes, and they may never know if the bargain is actually kept).

[118] 425 U.S. 748.

[119] Edenfield v. Fane, 507 U.S. 761, 765 (1993) (“Whatever ambiguities may exist at the margins of the category of commercial speech...it is clear that this type of personal solicitation is commercial expression to which the protections of the First Amendment apply.”) (citations omitted); United States v. Kokinda, 497 U.S. 720, 725 (1990) (plurality opinion) (“Solicitation is a recognized form of speech protected by the First Amendment.”); But see, Ohralik v. Ohio State Bar Ass’n, 436 U.S. 447, 466-67 (1978) (holding that in-person solicitations pose particular regulatory difficulties because they are “not visible or otherwise open to public scrutiny,” and are thus open to regulation).

[120] Lamont v. Commissioner of Motor Vehicles, 269 F. Supp. 880, 882 (S.D.N.Y.), aff’d, 386 F.2d 449 (2d Cir. 1967), cert. denied, 391 U.S. 915 (1968) (if they don’t like the solicitation, they can simply throw it away).

[121] Lamont, 269 F. Supp. at 993.

[122] See generally, Bresnahan, Up Close, supra note 115.

[123] 486 U.S. 466 (emphasis added).

[124] Id. at 468.

[125] Id. at 469.

[126] Id. at 473-74.

[127] Id. at 476.

[128] Id. at 476.

[129] Id. at 473-74 (“The First Amendment does not permit a ban on certain speech merely because it is more efficient; the State may not constitutionally ban a particular letter on the theory that to mail it only to those whom it would most interest is somehow inherently objectionable.”).

[130] Id.

[131] Sandra Byrd Petersen, Your Life as an Open Book: Has Technology Rendered Personal Privacy Virtually Obsolete?, 48 Fed. Comm. L.J. 163, 166-67 (1995) [hereinafter Open Book] (In one case, a woman became pregnant and ordered a maternity catalog.  That company sold her name to other companies, and soon the woman was bombarded by many more catalogs, calls from telemarketers, and other advertisements.  In the meantime, however, she had had a miscarriage.  Despite the woman’s repeated attempts to stop the flow of solicitations, the marketers continued to send birthday wishes and baby product offers to correspond with the unborn child’s development.  They stopped after three years only when she threatened litigation.  In another case, a man in Florida who was experiencing financial difficulties received a letter from evangelist Oral Roberts, with whom Mr. Hughes had had no previous contact. Roberts’ letter sympathized with Hughes’ situation, and urged him to get out from under the grips of the devil who caused his debt by sending $100 to Oral Roberts so he could intercede with God on Hughes’s behalf.  Hughes was upset that people could know about his financial difficulties.).

[132] Industry Newsroom: Starr Subpoena Update, Apr. 10, 1998, Am. Booksellers Ass’n, at http://www.bookweb.org/news/flash/75.html (last visited Dec. 22, 2000).

[133] 381 U.S. 479 (1965) (recognizing a right to privacy regarding matters of contraception); see also, Zablocki v. Redhail, 434 U.S. 374 (1978) (recognizing a right to privacy regarding matters of  marriage); Roe v. Wade, 410 U.S. 113 (1973) (recognizing a right to privacy regarding matters relating to reproduction) (1973), Eisenstadt v. Baird, 405 U.S. 438, 453 (1972) (“[I]f the right to privacy means anything, it is the right of the individual, married or single, to be free from unwarranted government intrusion into matters to fundamentally affecting a person as the decision whether to bear or beget a child.”).

[134] Whalen, 429 U.S. at 608 (Stewart, J. concurring) (“The Supreme Court has limited the ‘right to privacy’ to matters of reproduction.”).

[135] Paul v. Davis, 424 U.S. 693, 713 (1976) (holding that citizens have no right to privacy against the State publicizing personal data); A. Westin, Privacy and Freedom 7 (1967).

[136] Westin, Privacy, supra note 135, at 7.

[137] Whalen, 429 U.S. at 608 (Stewart, J., concurring) (“There is no general constitutional right to privacy.”); See generally, David H. Flaherty, The Right to Privacy One Hundred Years Later: On the Utility of Constitutional Rights to Privacy and Data Protection, 41 Case W. Res. L. Rev. 831, 837 (1991) [hereinafter One Hundred Years].

[138] Paul, 425 U.S. at 713 (although people have a fundamental right to privacy in decisions involving marriage, procreation, contraception, and child rearing, that right does not protect people from the State’s publicizing records of official acts in which they are involved, such as arrests).

[139] See, e.g., Condon, 155 F.3d 453, cert. granted, 67 U.S.L.W. 3705 (U.S. May 17, 1999).

[140] Whalen, 429 U.S. at 605.

[141] Id.

[142] Id. at 607.

[143] Reporters Comm., 489 U.S. 749, 763 (1989).

[144] 5 U.S.C.S. 552(b)(7)(C).

[145] Reporters Comm., 489 U.S at 762 n.13.

[146] Id. at 763.

[147] Id. at 767-70 (“The fact that an event is not wholly private does not mean that an individual has no interest in limiting disclosure or dissemination of the information.”).

[148] Id. at 767.

[149] Flaherty, One Hundred Years, supra note 137, at 840-41.

[150] Belair, Redefining Information Privacy, Privacy Journal, July 1989, at 7.

[151] See, e.g., American Fed. Of Gov’t Employees, AFL-CIO v. Dep’t of H.U.D., 118 F.3d 786, 791 (D.C. Cir. 1997) (“We begin our analysis by expressing our grave doubts as to the existence of a constitutional right of privacy in the nondisclosure of personal information.”).

[152] See, e.g., Taylor v. Best, 746 F.2d 220, 225 (4th Cir. 1984), cert. denied, 474 U.S. 982 (1985); Walls v. City of Petersburg, 895 F.2d 188, 192 (4th Cir. 1990); Watson Lowcountry Red Cross, 974 F.2d 482 (4th Cir. 1992).

[153] Condon, 155 F.3d 453.

[154] 18 U.S.C. § § 2721-25, 2721(a). 

[155] Greenhouse, Supreme Court Roundup, supra note 46.

[156] Condon, 972 F. Supp. 977, 989 (“While is it clear from the foregoing cases that at least in the Fourth Circuit there is a constitutional right to privacy in the nondisclosure of some form of personal information, the contours of this right are, as the Third Circuit has characterized, at best ‘murky’”.) (citing Scheetz v. The Morning Call, Inc. 946 F.2d 202, 206 (3d Cir. 1991)).

[157] Id. at 991-92.

[158] 155 F.3d at 465.

[159] Shorr, Personal Information, supra note 4, at 1776-77 (“The Supreme Court may come to recognize that a constitutionally protected right of privacy prevents the government from publicly disclosing personal information about United States residents…Even if informational privacy comes to occupy a privileged position in the hierarchy of constitutional rights, however, that fact would furnish only moral support to a plaintiff who claims that a private actor, rather than a state actor, violated his right of privacy.”).

[160] See, e.g., Jackson v. Metro. Edison Co., 419 U.S. 345, 349 (1974).

[161] Maureen S. Dorney, Privacy and the Internet, 19 Hastings Comm. & Ent. L.J. 635, 639 (1997).

[162] U.S. West, 182 F.3d at 1235 (quoting Fred H. Cate, Privacy In the Information Age 28-30 (1997).

[163] Id.

[164] Id.

[165] Id.

[166] Id.

[167] Id.

[168] Id.

[169] Samuelson, Intellectual Property, supra note 117, at 756.

[170] Id. at 756-57.

[171] Id.

[172] Id.

[173] Id.

[174] Id.

[175] Belgum, Who Leads, supra note 21.

[176] Orla O’Sullivan, The Darker Side of Database Marketing, U.S. Banker, May 1999.

[177] Fenrich, Common Law, supra note 6 at 965-66.

[178] See, e.g., The Electronic Communications Privacy Act of 1986, 18 U.S.C. 2510-2522, 2701-2709, 3121-3127 (1994 & Supp. III 1997); Videocassette Rental Industry, 18 U.S.C. 2710-11 (1994); The Cable Television Industry, 47 U.S.C. 551 (1994) (as amended by Cable Television Consumer Protection and Competition Act of 1992, Pub. L. No. 102-385 20, 106 Stat. 1460, 1497 (1992); The Fair Credit Reporting Act, 15 U.S.C. 1681 (1994); Telecommunications Act of 1996, 47 U.S.C. §222(a), repealed by Pub.L. 103-414, Title III, § 304(a)(6), 108 Stat. 4297.

[179] The Privacy Act of 1974, 5 U.S.C. 552a (1994 & Supp. III 1997) (governing federal agencies’ collection and use of personal information for government records); The Freedom of Information Act, 5 U.S.C. 552 (1995) (governing the federal government’s use of personal data about its citizens) (§552(b)(3)-(7) contains exemptions from the statute’s disclosure requirements in the name of protecting the privacy of individual citizens, including medical and personnel files and law enforcement records, particularly § 552(b)(3)-(7) which contains exemptions from the statute’s disclosure requirements in the name of protecting the privacy of individual citizens, including medical and personnel files and law enforcement records).

[180] See, e.g., N.Y. Civ. Rts. L. 50-51 (McKinney 1992 & Supp. 1996) (New York legislature passed laws prohibiting the use of the name, portrait, or picture of any living person for “advertising purposes” or for “purposes of trade” without prior written consent); Cal. Const. art. I, § 1 (providing that all California residents enjoy a right to privacy, as amended in 1972).

[181] David J. Klein, Keeping Business Out of the Bedroom: Protecting Personal Privacy Interests from the Retail World, 15 J. Marshall J. Computer & Info. L. 391.

[182] Id.

[183] Cody, Protecting Privacy, supra note 15, at 1189.

[184] See also, Donald J. Karl, State Regulation of Anonymous Internet Use After ACLU v. Miller, 30 Ariz. ST. L.J. 513, 516 (1998); see, e.g., 1999 Reg. LEXIS 35550 (proposed Nov. 12, 1999) (proposing rule that would require Texas agencies to comply with standards regarding websites and citizens’ privacy); VA. Code Ann. §18.2-152-3 to 152.11 (Michie 1996) (protecting privacy of consumers on the Internet); W. Va. Code §61-3C-12 (1997) (regulating third party voyeurism into the electronic movements of other persons); Mo. Ann. Stat. § 569.095(5) (West 1994) (regulating third party voyeurism into electronic movements of other persons).

[185] See Dept. of Commerce, Elements of Effective Self-Regulation for the Protection of Privacy and Questions Related to Online Privacy, No. 980422102-8102-01, available at http://www.ntia.doc/ntiahome/privacy/6_5_98fedreg.htm (last visited Dec. 22, 2000).

[186] Cody, Protecting Privacy, supra note 15, at 1189 (citing William J. Clinton & Albert Gore, Jr., A Framework for Global Electronic Commerce at 18 (1997) (noting the Clinton administration’s preference for industry self-regulation over government intervention at this juncture in the development of electronic commerce)).

[187] Id. at 1217.

[188] See, e.g., Truste  http://www.truste.org (visited Nov. 10, 2000).

[189] Cody, Protecting Privacy, supra note 15, at 1225.

[190] Id.; But see; In Re Geocities, 63 FR 44624 (Aug. 20, 1998) (The FTC can punish Internet merchants whose privacy infringements reach the level of deception.); see also, Federal Trade Comm’n Act, 38 STAT. 721, 15 U.S.C. 46.

[191] Gandy, Legitimate Business, supra note 99, at 93 (Corporate interests in policy debates are pursued actively through specialized industry associations with professional staff responsible for mobilizing segments of the electorate when needed.).

[192] Samuelson, Intellectual Property, supra note 117, at 756.

[193] Ohralik, 436 U.S. at 456 (commercial speech rights are in a “subordinate position in the scale of First Amendment values”).

[194] 447 U.S. 557.

[195] Id. at 559-60.

[196] Id. at 566.

[197] Id.

[198] Id.

[199] Id. at 570-71.

[200] See, Edenfield, 507 U.S. at 769 (“The protection of potential clients’ privacy is a substantial state interest.”).

[201] Carey v. Brown, 447 U.S. 455, 471 (1980).

[202] Florida Bar v. Went For It, Inc., 515 U.S. 618, 625 (1995).

[203] U.S. West, 182 F.3d at 1234-35.

[204] Id.   

[205] Id. at 1235.

[206] Id.

[207] Id.

[208] Id.

[209] Rubin v. Coors Brewing Co., 514 U.S. 476, 487 (1995).

[210] U.S. West, 182 F.3d at 1237.

[211] Edenfield, 507 U.S. at 771.

[212] Id.

[213] Id. at 772.

[214] Went For It, 515 U.S. at 626.

[215] Id.

[216] Id. at 630.

[217] See, e.g., United Reporting, 146 F.3d at 1140; see also, Rubin, 514 U.S. 476 (ban on brewers disclosing the alcohol content of beers on their labels violated the First Amendment because the numerous exceptions to the ban assured that the regulation did not directly and materially advance governmental interest).

[218] United Reporting, 146 F.3d at 1140.

[219] Id.

[220] 21 F.3d 1508 (10th Cir. 1994).

[221] Id. at 1515.

[222] Central Hudson, 447 U.S. at 608.

[223] Board of Tr. of the State Univ. of N.Y. v. Fox, 492 U.S. 469, 480 (1989).

[224] Edenfield, 507 U.S. at 774.

[225] U.S. West, 182 F.3d at 1238.

[226] Id.

[227] Restatement (Second) of Torts § 652D (1997).

[228] See generally,  William L. Prosser, Privacy, 48 CAL. L. REV. 383 (1960).

[229] George B. Trubow, Protecting Informational Privacy in the Information Society, 10 N. ILL. U. L. REV. 521 (1990) [hereinafter Informational Privacy].

[230] Diane L. Zimmerman, Requiem for a Heavyweight: A Farewell to Warren and Brandeis’ Privacy Tort, 68 Cornell L. Rev. 291, 293 (1983).

[231] Trubow, Informational Privacy, supra note 229 at 534-35.

[232] U.S. Const. art. VI.

[233] Trubow, Informational Privacy, supra note 229, at 534-35.

[234] Id. at 539.

[235] Restatement (Second) of Torts §652D(a)-(b) (1997). 

[236] Trubow, Informational Privacy, supra note 229, at 537.

[237] Tureen v. Equifax, Inc., 571 F.2d 411 (9th Cir. 1978) (holding information disseminated by a credit bureau is insufficient publication to support a claim for disclosure of private fact).

[238] Trubow, Informational Privacy, supra note 229, at 537.

[239] Id.

[240] Id. at 538.

[241] RESTATEMENT (SECOND) OF TORTS § 652C (1977).

[242] William L. Prosser, HANDBOOK ON THE LAW OF TORTS § 97 (2d ed. 1955).

[243] Trubow, Informational Privacy, supra note 229, at 539.

[244] 341 N.E.2d 337 (Ohio Ct. App. 1975).

[245] Id.

[246] Id. at 339.

[247] Id.

[248] Id. at 339-40.

[249] Id.

[250] 652 N.E.2d 1351, 1356 (Ill. App. Ct. 1995) (emphasis added).

[251] Petersen, Open Book, supra note 131, at 165.

[252] Id.

[253] Id.

[254] U.S. Const. amend. I.

[255] See, Condon v. Reno, 155 F.3d 453 (1998), cert. granted, 67 U.S.L.W. 3705 (U.S. May 17, 1999); Los Angeles Police Dep’t v. United Reporting Publ’g Corp., 146 F.3d 1133 (1998), cert. granted, 67 U.S.L.W. 3468 (U.S. Jan. 25, 1999) (no. 98-678).

[256] U.S. Const. art. VI.

[257] See, supra note 2 and 25.