Data Privacy 2011 - Stanford

Cases 2011-3-27.doc

For April 28, please prepare written outlines for Cases 6 and 7.


Assignments for April 21


1. prepare a written outline for the rights and remedies in Case 5.

2. revisit (or: study up) on your knowledge of defamation laws, first amendment, torts, etc., and

3. Analyze whether a television station that permits website visitors to post comments following an article about a former news anchor's arrest on felony drug charges is contributorily liable for the content of the comments. Assume the news organization neither created nor edited the entries. The article was accurate. The comments are highly offensive and some contain inaccurate factual asssertions.


Assignments for April 14

1. review the Warshak court decisions (summary and links on Wikipedia at and outline the rights and remedies of Warshak under the SCA and 4th Amendment,

2. prepare an outline of Case 4, and

3. prepare an outline of the rights and remedies of a Gmail user and a Hotmail user who does not subscribe to Gmail but exchanges emails with a Gmail user, both based in California, under California and U.S. Federal law, as well as under laws that were proposed in California in 2004 in response to the announcements regarding the service (see press reports at and;txt - if you search, you should be able to find the actual bills); you may seek inspiration in the recent complaint against Google in the Eastern District of Texas (, but please analyze the situation also on your own initiative and under California law, and contribute to your team's preparation of arguments for class next week.


Assignments for April 7

To follow up on today's class, please prepare a brief written outline of your answer to the questions relating to Case 1 and review Morales v. Daley, 116 F. Supp. 2d 801, 809 and 816. (S.D. Tex. 2000).

For next week, please prepare written outlines of your answers to the U.S.-law related questions relating to Case 2 and Case 3 ( ). Use the statutes provided to prepare your outline. Reading the cases is optional.

* * *

Welcome To Data Privacy Law!

Dear students,

Thank you for your interest in our course, I am looking forward to meeting you this Thursday.

If you have time, please ask yourself: What is data privacy? Why should the law protect data privacy or privacy more generally? Protect against what and whom?

(You can also ask your friends and family – for example, if you are running out of conversation topics at formal dinner parties or if someone asks you, so, what are you doing at Stanford this year).

If you have even more time, please review the attached case and materials.

See you on Thursday,


Case 1 - Census

A. Case

After the devastating terror-attacks of 9/11, which are attributed to fundamentalist Muslims, the U.S. government wants to gain more knowledge about the “Arab community” in the United States. Following populist proposals from the “Coffee Party” movement, government leaders start to believe that the census, which is to be conducted every 10 years, is a good opportunity to achieve this goal.

After discussing the topic, the legislation enacts a “Census Act 2011” that orders a nation-wide census. Every person living in the United States is obligated to truthfully and completely answer the questions under penalty of law (fines and imprisonment for unanswered or inaccurately answered questions). Answers are noted by a census taker on a questionnaire, one per house hold.

The questions, set forth in the Census Act 2010, include the following: name (given and family name), place and date of birth, gender, address, phone number, e-mail-address, country of origin, race and ethnicity, profession, current occupation and education.

The so obtained data shall be used only for the following purposes:

1. for local planning by municipalities;

2. By intelligence services in order to find accumulations of Muslims and people originating from Middle East Countries; and

3. For statistical analysis.

The Census Bureau creates a form with the questions set forth in the Census Act 2010 and adds a question asking respondents to list all religious and political organizations that they are a member of, or that they have supported by way of donations or otherwise.

German politicians have been following the developments in the United States and push for a similar census in Germany. Tired of trailing developments in the US by 10+ years, some politicians push for immediate enactment of a literal translation of the US Census Act 2011. But there are constitutional concerns.

Ms. Katharina Blum, a multi-lingual executive admin, working for Divided Airlines, a large multi-national airline business, spends half the year in the US, half the year in Germany, and braces for having to answer the census survey twice.

B. Assignments

Please answer the following questions with an outline of your analysis:

1.1 Does the Census Act 2011 comply with the U.S. constitution?

1.2 Would the Census Act 2011 be constitutional under the German Constitution?

1.3 What rights and remedies would Ms. Blum have if she refused to answer individual questions in the census surveys in the United States and the US government subjected her to fines?

1.4 Would your answers change, if the single datasets are redacted by removing the name? What would you suggest to efficiently redact the datasets?

C. Materials

German Constitution (excerpts)


Article 1 [Human dignity – Human rights – Legally binding force of basic rights]

(1) Human dignity shall be inviolable. To respect and protect it shall be the duty of all state authority.

(2) The German people therefore acknowledge inviolable and inalienable human rights as the basis of every community, of peace and of justice in the world.

(3) The following basic rights shall bind the legislature, the executive and the judiciary as directly applicable law.

Article 2 [Personal freedoms]

(1) Every person shall have the right to free development of his personality insofar as he does not violate the rights of others or offend against the constitutional order or the moral law.

(2) Every person shall have the right to life and physical integrity. Freedom of the person shall be inviolable. These rights may be interfered with only pursuant to a law.

Article 4 [Freedom of faith and conscience]

(1) Freedom of faith and of conscience, and freedom to profess a religious or philosophical creed, shall be inviolable.

(2) – (3) […]

Article 5 [Freedom of expression, arts and sciences]

(1) Every person shall have the right freely to express and disseminate his opinions in speech, writing and pictures, and to inform himself without hindrance from generally accessible sources. Freedom of the press and freedom of reporting by means of broadcasts and films shall be guaranteed. There shall be no censorship.

(2) These rights shall find their limits in the provisions of general laws, in provisions for the protection of young persons, and in the right to personal honour.

(3) […]

Article 13 [Inviolability of the home]

(1) The home is inviolable.

(2) Searches may be authorised only by a judge or, when time is of the essence, by other authorities designated by the laws, and may be carried out only in the manner therein prescribed.

(3) - (7) […]

Article 140 - [Law of religious denominations]

The provisions of Articles 136, 137, 138, 139 and 141 of the German Constitution of 11 August 1919 shall be an integral part of this Basic Law.

Article 136 of the German Constitution of 11 August 1919 [Religion and Religious Societies]

(1) - (2) […]

(3) No person shall be required to disclose his religious convictions. The authorities shall have the right to inquire into a person’s membership in a religious society only to the extent that rights or duties depend upon it or that a statistical survey mandated by a law so requires.

(4) […]

U.S. Constitution (excerpts)


Article I

Section 1.

All legislative powers herein granted shall be vested in a Congress of the United States, which shall consist of a Senate and House of Representatives.

Section 2.

The House of Representatives shall be composed of members chosen every second year by the people of the several states, and the electors in each state shall have the qualifications requisite for electors of the most numerous branch of the state legislature.

No person shall be a Representative who shall not have attained to the age of twenty five years, and been seven years a citizen of the United States, and who shall not, when elected, be an inhabitant of that state in which he shall be chosen.

Representatives and direct taxes shall be apportioned among the several states which may be included within this union, according to their respective numbers, which shall be determined by adding to the whole number of free persons, including those bound to service for a term of years, and excluding Indians not taxed, three fifths of all other Persons. The actual Enumeration shall be made within three years after the first meeting of the Congress of the United States, and within every subsequent term of ten years, in such manner as they shall by law direct. The number of Representatives shall not exceed one for every thirty thousand, but each state shall have at least one Representative; and until such enumeration shall be made, the state of New Hampshire shall be entitled to chuse three, Massachusetts eight, Rhode Island and Providence Plantations one, Connecticut five, New York six, New Jersey four, Pennsylvania eight, Delaware one, Maryland six, Virginia ten, North Carolina five, South Carolina five, and Georgia three.

When vacancies happen in the Representation from any state, the executive authority thereof shall issue writs of election to fill such vacancies.

The House of Representatives shall choose their speaker and other officers; and shall have the sole power of impeachment.

Amendment I

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.

Amendment IV

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.


Data Privacy Course Syllabus

Prof. Dr. Lothar Determann

More and more companies and government agencies find themselves in the press and courtrooms for data privacy and security law violations. Given the rapidly increasing technological options to collect and commercialize personal data, this area of the law is rapidly growing. Law students should therefore, be prepared for the challenges of data protection laws.

Objective of the lecture is to familiarize students with the typical legal problems arising from the conflicting interests in data and privacy in today's global economy and society, in particular in the areas of law enforcement, commerce, media and employment. The significance and practical relevance of domestic, international and foreign national laws is rapidly increasing for individuals, businesspeople, attorneys, judges, and legislators around the world. We will look at how data processing and laws affect individual privacy in the various areas, including government and private surveillance, press reporting, commercial treatment of financial, health and communications information, and direct marketing.

Topics covered include common law, constitutional and statutory rights and obligations regarding data privacy, data security and legal protection for data bases under California, U.S. Federal, European Community, public international and other countries' laws, including, for example, the U.S.-EU Safe Harbor Principles, rules on spamming, wiretapping, homeland security, and employee monitoring.

Method of teaching involves be the introduction of hypotheticals and cases and their analysis under applicable laws and policy considerations.

Materials consist of problems, applicable statutes and precedents (handed out before class for preparation) and outlines / samples answers (handed out after class for repetition). Discussions will take place in question/answer style, moot court proceedings, students' presentations and drafting/revising privacy policies and data processing contracts. Final exam will be a two hour essay-style exam (applicable statutes and regulations will be provided with the problem). We can also schedule a mid-term practice exam.

Assignments for April 28


Assignments for May 19

For next week, per popular vote in class today, we will cover the new Cases 9 and 10, which I just sent out via email; please prepare written outlines in preparation of a lively discussion in class, as usual.

Also per popular vote today, in two weeks from today, May 26, I will provide an overview regarding sectoral privacy legislation in the US (HIPAA, GLB, FCRA, etc.) and then we will discuss some recent proposals and an article by Paul Schwartz on PROs and CONs of calls for omnibus federal privacy legislation. That will be our last session and we will reserve an hour or so for "final review / Q&A," as requested.

I also emailed you with an updated the syllabus to reflect these proposed the changes and a list of laws / legal principles that we have applied - or will apply - throughout our course, together with some definitions, rules and elements for consideration. Also, as follow-up to today's class, I sent a draft article on employee privacy, as optional reading.


Assignments for May 12

1. review the FTC complaint and settlement decree in the Sears case ( and prepare brief, bullet point, written advice to (a) a retailer like Sears on how to structure marketing studies similar to a program like Sears was cited for, but in a manner that complies with law, to avoid similar charges by the FTC, and (b) a service provider that offers technology and services to enable retailers like Sears to run such programs. Assume that your clients want to conduct research as similar as possible to what Sears did, but in compliance with all laws.

2. prepare a written outline of Case 8 for discussion in class.


Assignments for May 5

As discussed in class today, please go through the analysis we used for case 7 for a company of your choice (which should have a business in the EEA and outside the EEA, including the United States, and require data transfers) and prepare

1. a brief description of your company's business activities with respect to processing of personal data in Europe and outside of Europe,

2. a policy on how to assure compliance with European data protection laws (use the EU Data Protection Directive as the basis for your analysis, as if it constituted national law of its member states), and

3. specifically discuss, in a brief written memo to management, how the company should legitimize international data transfers, particularly focusing on the options consent, data transfer agreements (consider controller/processor options) and the EU-US Safe Harbor program.

For background, I sent you a couple of articles via email and recommend that you also review the applicable adequacy decisions (all reading is optional).


Optional Mid Term Exam for May 1 / 5: I emailed you the Mid Term Practice Exam. As discussed - and voted on - in class today, I will review and provide comments to you if I receive your exam by noon on May 1, 2011 via email with a note confirming that you only took 2 hours and you did not take any pre-formulated text by way of cut-and-paste. Participation is completely optional and voluntary and nothing will be held against you. Good exams count for discretionary grade adjustment. But, the real reason why you should participate is that it is an interesting case and you can practice your exam taking skills. Enjoy! If you don't feel like submitting anything, or if you can't meet the deadline, I recommend you prepare at least an outline. We will discuss the case in class on May 5, 2011.