Featured Paper (citing Andrew's note): Confidentiality and the Problem of Third Parties: Protecting Reader Privacy in the Age of Intermediaries

A forthcoming article in the Yale Journal of Law and Technology (Winter 2013 issue) is worth the read: Confidentiality and the Problem of Third Parties: Protecting Reader Privacy in the Age of Intermediaries, written by BJ Ard - a Postdoctoral Associate in Law and Thomson Reuters Fellow at the Yale Law School Information Society Project. The abstract is in italics, below.

In addition to being a well-written article, Ard's piece also cites to Andrew's law review note which was published last year in the Indiana Law Journal. I believe this is the first cite to Andrew's note, so congratulations are definitely in order. I know from personal experience how exciting it is to get that first cite after tirelessly working on a law review note and wondering if anyone other than those who are forced to read it will actually do so.

Andrew's article can be found here: Andrew A. Proia, Note, A New Approach to Digital Reader Privacy: State Regulations and Their Protection of Digital Book Data, 88 Ind. L.J. 1593 (2013).

Abstract of Ard's article:

We often regulate actors as a proxy for protecting categories of information. Rather than directly protect reading records, for example, we target actors like libraries who are likely to possess them. This approach has proven increasingly untenable in the digital age, where the relevant actors are difficult to identify and constantly shifting. Unanticipated third parties now insert themselves as intermediaries or eavesdroppers in all manner of transactions, even in protected spaces like libraries. Where this happens, actor-defined regimes fail to vindicate their privacy commitments even within the institutions for which they were designed. 

Libraries provide a clear example of this problem. Private reading historically has been protected through a regime that restricts libraries’ ability to exploit reading records. Yet this regime now fails to protect reading records even in libraries because it does not bind third parties who provide library services digitally. Illustrating the point, Amazon facilitates e-book lending for a number of public and academic libraries. Although Amazon collects detailed reading records from patrons utilizing these services, the library confidentiality regime does not restrict what it can do with the records. These patrons accordingly confront the risks to intellectual privacy the library regime was meant to counter. 

This Article proposes a content-defined approach whereby confidentiality obligations would attach to particular types of information regardless of which actors possessed it. Such an approach would not only save extant confidentiality regimes from obsolescence, but also provide a vehicle for extending privacy commitments to future data practices that implicated the same types of sensitive records.