Peter Swire, Peeping
Comment by: James Rule
PLSC 2009
Published version available here: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1418091
Workshop draft abstract:
There have been recent revelations of “peeping” into the personal files of celebrities. Contractors for the U.S. State Department looked at passport files, without authorization, for candidates Barack Obama and John McCain. Employees at UCLA Medical Center and other hospitals have recently been caught looking at the medical files of movie stars, and one employee received money from the National Enquirer to access and then leak information. In the wake of these revelations, California passed a statute specifically punishing this sort of unauthorized access to medical files.
This article examines the costs and benefits of laws designed to detect and punish unauthorized “peeping” into files of personally identifiable information. Part I looks at the history of “peeping Tom” and eavesdropping statutes, examining the common law baseline. Part II examines the current situation. As data privacy and security regimes become stricter, and often enforced by technological measures and increased audits, there will be an increasing range of systems that detect such unauthorized use. Peeping is of particular concern where the information in the files is especially sensitive, such as for tax, national security, intelligence, and medical files.
The remedy for peeping is a particularly interesting topic. Detection of peeping logically requires reporting of a privacy violation to someone. The recipient of notice, for instance, could include: (1) a manager in the hospital or other organization, who could take administrative steps to punish the perpetrator; (2) a public authority, who would receive notice of the unauthorized use (“peeping”); and/or (3) the individual whose files have been the subject of peeping. For the third category, peeping could be seen as a natural extension of current data breach laws, where individuals receive notice when their data is made available to third parties in an unauthorized way. An anti-peeping regime would face issues very similar to the debates on data breach laws, such as what “trigger” should exist for the notice requirement, and what defenses or safe harbors should exist so that notice is not necessary.