Sixth Edition

ASPEN CASEBOOK SERIES

INFORMATION PRIVACY LAW

Sixth Edition

Daniel J. Solove John Marshall Harlan Research Professor of Law George Washington University Law School

Paul M. Schwartz Jefferson E. Peyser Professor of Law U.C. Berkeley School of Law Faculty Director, Berkeley Center for Law & Technology

Published by Wolters Kluwer in New York.

Wolters Kluwer Legal & Regulatory U.S. serves customers worldwide with CCH, Aspen Publishers, and Kluwer Law International products. (www.WKLegaledu.com)

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or utilized by any information storage or retrieval system, without written permission from the publisher. For information about permissions or to request permissions online, visit us at www.WKLegaledu.com, or a written request may be faxed to our permissions department at 212-771-0803.

To contact Customer Service, e-mail [email protected], call 1-800-234-1660, fax 1-800-901-9075, or mail correspondence to:

Wolters Kluwer Attn: Order Department PO Box 990 Frederick, MD 21705

Printed in the United States of America.

1 2 3 4 5 6 7 8 9 0

ISBN 978-1-4548-9275-5

Library of Congress Cataloging-in-Publication Data

Names: Solove, Daniel J., 1972- author. | Schwartz, Paul M., 1959- author. Title: Information privacy law / Daniel J. Solove, John Marshall Harlan Research Professor of Law, George Washington University Law School; Paul M. Schwartz, Jefferson E. Peyser Professor of Law, U.C. Berkeley School of Law, Faculty Director, Berkeley Center for Law & Technology. Description: Sixth edition. | New York : Wolters Kluwer Law & Business, [2018] | Series: Aspen casebook series | Includes bibliographical references and index. Identifiers: LCCN 2017045456 | ISBN 9781454892755 Subjects: LCSH: Privacy, Right of--United States. | Data protection--Law and legislation--United States. | Confidential communications--United States. | Personality (Law)--United States. | LCGFT: Casebooks. Classification: LCC KF1262 .S66 2018 | DDC 342.7308/58--dc23 LC record available at https://lccn.loc.gov/2017045456 SUMMARY OF CONTENTS

Contents xi

Preface xxvii

Acknowledgments xxix

1 INTRODUCTION 1 A. Information Privacy, Technology, and the Law 1 B. Information Privacy Law: Origins and Types 10

2 PERSPECTIVES ON PRIVACY 41 A. The Philosophical Discourse about Privacy 41 B. The Definition and the Value of Privacy 43 C. Critics of Privacy 63 D. The Feminist Perspective on Privacy 70

3 PRIVACY AND THE MEDIA 79 A. Information Gathering 81 B. Disclosure of Truthful Information 106 C. Dissemination of False Information 174 D. Appropriation of Name or Likeness 211 E. Privacy Protections for Anonymity and Receipt of Ideas 233

4 PRIVACY AND LAW ENFORCEMENT 253 A. The Fourth Amendment and Emerging Technology 256 B. Information Gathering About First Amendment Activities 331 C. Federal Electronic Surveillance Law 344 D. Digital Searches and Seizures 359

5 NATIONAL SECURITY AND FOREIGN INTELLIGENCE 407 A. The Intelligence Community 408 B. The Fourth Amendment Framework 409 C. Foreign Intelligence Gathering 417 D. NSA Surveillance 444

x SUMMARY OF CONTENTS

6 HEALTH PRIVACY 475 A. Confidentiality of Medical Information 477 B. Constitutional Protection of Medical Information 542 C. Genetic Information 582

7 GOVERNMENT RECORDS 603 A. Public Access to Government Records 604 B. Government Records and Use of Personal Data 663 C. Identification Records and Requirements 720

8 FINANCIAL DATA 737 A. The Fair Credit Reporting Act 737 B. The Gramm-Leach-Bliley Act 773 C. Federal and State Financial Privacy Laws 776

9 CONSUMER DATA 785 A. The U.S. System of Consumer Data Privacy Regulation 786 B. Tort Law 820 C. Contract Law 829 D. Property Law 842 E. FTC Section 5 Enforcement 845 F. Statutory Regulation 876 G. First Amendment Limitations on Privacy Regulation 918

10 DATA SECURITY 945 A. Introduction 945 B. Data Security Breach Notification Statutes 947 C. Civil Liability and Standing 952 D. FTC Regulation 975

11 EDUCATION PRIVACY 991 A. School Searches and Surveillance 991 B. Drug Testing 997 C. School Records 1007

12 EMPLOYMENT PRIVACY 1017 A. Workplace Searches 1020 B. Workplace Surveillance 1028 C. Workplace Drug Testing 1031 D. The Issue of Consent 1042 E. Testing, Questionnaires, and Polygraphs 1049 F. Telephone Monitoring 1062 G. Computer Monitoring and Searches 1069

SUMMARY OF CONTENTS xi

13 INTERNATIONAL PRIVACY LAW 1093 A. The OECD Privacy Guidelines 1096 B. Privacy Protection in Europe 1100 C. International Transfers of Data 1173 D. The APEC Privacy Framework 1203 E. Privacy Protection in North America 1205 F. Privacy Protection in South America 1208 G. Privacy Protection in Africa and the Middle East 1209 H. Privacy Protection in Asia-Pacific 1210

Index 1215

CONTENTS

Preface xxvii

Acknowledgments xxix

1 INTRODUCTION 1 A. INFORMATION PRIVACY, TECHNOLOGY, AND THE LAW 1 ● Sidis v. F-R Publishing Corp. 3 B. INFORMATION PRIVACY LAW: ORIGINS AND TYPES 10 1. Common Law 10 (a) The Warren and Brandeis Article 10 ● Samuel D. Warren and Louis D. Brandeis, The Right to Privacy 13 (b) The Recognition of Warren and Brandeis’s Privacy Torts 25 ● William Prosser, Privacy 27 ● Lake v. Wal-Mart Stores, Inc. 29 (c) Privacy Protection in Tort Law 32 (d) Privacy Protection in Evidence Law 33 (e) Privacy Protection via Property Rights 33 (f) Privacy Protection in Contract Law 33 (g) Privacy Protection in Criminal Law 34 2. Constitutional Law 34 3. Statutory Law 36 4. International Law 39

2 PERSPECTIVES ON PRIVACY 41 A. THE PHILOSOPHICAL DISCOURSE ABOUT PRIVACY 41 1. The Concept of Privacy and the Right to Privacy 41 2. The Public and Private Spheres 42

xiii

xiv CONTENTS

B. THE DEFINITION AND THE VALUE OF PRIVACY 43 ● Alan Westin, Privacy and Freedom 44 ● Julie E. Cohen, Examined Lives: Informational Privacy and the Subject as Object 49 ● Daniel J. Solove, Conceptualizing Privacy 52 ● Anita L. Allen, Coercing Privacy 55 ● Paul M. Schwartz, Privacy and Democracy in Cyberspace 58 ● Spiros Simitis, Reviewing Privacy in an Information Society 60 C. CRITICS OF PRIVACY 63 ● Richard A. Posner, The Right of Privacy 63 ● Fred H. Cate, Principles of Internet Privacy 67 D. THE FEMINIST PERSPECTIVE ON PRIVACY 70 ● State v. Rhodes 70 ● Reva B. Siegel, “The Rule of Love”: Wife Beating as Prerogative and Privacy 72 ● Catharine A. MacKinnon, Toward a Feminist Theory of the State 75 ● Anita L. Allen, Uneasy Access: Privacy for Women in a Free Society 76

3 PRIVACY AND THE MEDIA 79 A. INFORMATION GATHERING 81 1. Intrusion upon Seclusion 81 ● Restatement (Second) of Torts § 652B: Intrusion upon Seclusion 81 ● Nader v. General Motors Corp. 82 ● Dietemann v. Time, Inc. 87 ● Desnick v. American Broadcasting Co., Inc. 89 ● Shulman v. Group W Productions, Inc. 94 2. Paparazzi 98 ● Galella v. Onassis 99 ● California Anti-Paparazzi Act 100 3. Video Voyeurism 103 ● Video Voyeurism Prevention Act 104 B. DISCLOSURE OF TRUTHFUL INFORMATION 106 1. Public Disclosure of Private Facts 106 (a) Introduction 106 ● Restatement (Second) of Torts § 652D: Publicity Given to Private Life 106 (b) Private Matters 108 ● Gill v. Hearst Publishing Co. 108 ● Daily Times Democrat v. Graham 113

CONTENTS xv

(c) The Newsworthiness Test 120 ● Sipple v. Chronicle Publishing Co. 120 ● Shulman v. Group W Productions, Inc. 130 ● Bonome v. Kaysen 133 2. First Amendment Limitations 140 ● Cox Broadcasting Corp. v. Cohn 142 ● The Florida Star v. B.J.F. 149 ● Bartnicki v. Vopper 164 C. DISSEMINATION OF FALSE INFORMATION 174 1. Defamation 174 (a) Introduction 174 (b) Defamation and the Internet 176 ● Zeran v. America Online, Inc. 177 (c) First Amendment Limitations 185 ● New York Times Co. v. Sullivan 185 ● Gertz v. Robert Welch, Inc. 189 2. False Light 196 (a) Introduction 196 ● Restatement (Second) of Torts § 652E: Publicity Placing Person in False Light 196 (b) First Amendment Limitations 198 ● Time, Inc. v. Hill 198 3. Infliction of Emotional Distress 202 ● Hustler Magazine v. Falwell 203 ● Snyder v. Phelps 205 D. APPROPRIATION OF NAME OR LIKENESS 211 1. Introduction 211 ● Restatement (Second) of Torts § 652C: Appropriation of Name or Likeness 211 2. Name or Likeness 214 ● Carson v. Here’s Johnny Portable Toilets, Inc. 214 3. For One’s Own Use or Benefit 221 ● Raymen v. United Senior Association, Inc. 221 4. Connection to Matters of Public Interest 225 ● Finger v. Omni Publications International, Ltd. 226 5. First Amendment Limitations 230 ● Zacchini v. Scripps-Howard Broadcasting Co. 230

xvi CONTENTS

E. PRIVACY PROTECTIONS FOR ANONYMITY AND RECEIPT OF IDEAS 233 1. Anonymity 233 (a) Anonymous Speech 233 ● Talley v. State of California 233 ● McIntyre v. Ohio Elections Commission 234 ● Doe v. Cahill 239 (b) Reporter’s Privilege 245 2. Privacy of Reading and Intellectual Exploration 247 ● Stanley v. Georgia 248

4 PRIVACY AND LAW ENFORCEMENT 253 A. THE FOURTH AMENDMENT AND EMERGING TECHNOLOGY 256 1. How the Fourth Amendment Works 256 (a) Applicability: Searches and Seizures 256 (b) Reasonable Searches and Seizures 257 (c) Enforcement: The Exclusionary Rule and Civil Remedies 259 (d) Subpoenas and Court Orders 260 2. Wiretapping, Bugging, and Beyond 263 ● Olmstead v. United States 264 ● Lopez v. United States 271 ● Katz v. United States 273 ● United States v. White 280 3. The Reasonable Expectation of Privacy Test 284 (a) The Third Party Doctrine 284 ● Smith v. Maryland 284 (b) Items Abandoned or Exposed to the Public 295 ● California v. Greenwood 295 (c) Surveillance and the Use of Sense Enhancement Technologies 301 ● Florida v. Riley 302 ● Dow Chemical Co. v. United States 309 ● Kyllo v. United States 313 ● United States v. Jones 321 B. INFORMATION GATHERING ABOUT FIRST AMENDMENT ACTIVITIES 331 ● Stanford v. Texas 333 ● Gonzales v. Google 340

CONTENTS xvii

C. FEDERAL ELECTRONIC SURVEILLANCE LAW 344 1. Section 605 of the Federal Communications Act 344 2. Title III 345 3. The Electronic Communications Privacy Act 346 (a) The Wiretap Act 348 (b) The Stored Communications Act 350 (c) The Pen Register Act 352 4. The Communications Assistance for Law Enforcement Act 353 5. The USA PATRIOT Act 354 6. State Electronic Surveillance Law 356 D. DIGITAL SEARCHES AND SEIZURES 359 1. Searching Computers and Electronic Devices 359 ● United States v. Andrus 361 ● Riley v. California 369 2. Encryption 375 3. Video Surveillance 378 4. E-mail and Online Communications 379 ● Steve Jackson Games, Inc. v. United States Secret Service 379 ● United States v. Warshak 385 5. ISP Account Information 391 ● United States v. Hambrick 391 6. IP Addresses, URLs, and Internet Searches 399 ● United States v. Forrester 399

5 NATIONAL SECURITY AND FOREIGN INTELLIGENCE 407 A. THE INTELLIGENCE COMMUNITY 408 B. THE FOURTH AMENDMENT FRAMEWORK 409 ● United States v. United States District Court (The Keith Case) 410 C. FOREIGN INTELLIGENCE GATHERING 417 1. The Foreign Intelligence Surveillance Act 417 ● Global Relief Foundation, Inc. v. O’Neil 420 ● United States v. Isa 422 2. The USA PATRIOT Act 424 ● The 9/11 Commission Report 424 ● In re Sealed Case 429 3. National Security Letters 437 xviii CONTENTS

4. Internal Oversight 440 (a) The Attorney General’s FBI Guidelines 440 (b) The Homeland Security Act 442 (c) The Intelligence Reform and Terrorism Prevention Act 443 D. NSA SURVEILLANCE 444 1. Standing 446 ● Clapper v. Amnesty International USA 446 2. The Snowden Revelations 455 ● Klayman v. Obama 457 ● In re FBI 466

6 HEALTH PRIVACY 475 A. CONFIDENTIALITY OF MEDICAL INFORMATION 477 1. Professional Ethics and Evidentiary Privileges 477 (a) Ethical Rules 477 ● Oath and Law of Hippocrates 477 ● Current Opinions of the Judicial Council of the American Medical Association Canon 5.05 477 (b) Evidentiary Privileges 477 ● Jaffee v. Redmond 479 2. Tort Liability for Disclosure of Patient Information 483 ● McCormick v. England 483 ● Hammonds v. Aetna Casualty & Surety Co. 485 3. Tort Liability for Failure to Disclose Patient Information 492 ● Tarasoff v. Regents of University of California 492 ● McIntosh v. Milano 499 4. Statutory Reporting Requirements 504 5. State Law Privacy Protections for Medical Information 506 6. Health Insurance Portability and Accountability Act 509 (a) A Brief History of HIPAA 509 (b) Scope and Applicability of HIPAA 511 (c) The Privacy Rule 514 ● Northwestern Memorial Hospital v. Ashcroft 520 (d) The Security Rule 524 (e) The Breach Notification Rule 525 (f) HIPAA Enforcement and Preemption 525 ● Parkview Health System, Inc. Resolution Agreement and Corrective Action Plan 526 ● University of California at Los Angeles Health System Resolution Agreement and Corrective Action Plan 529 CONTENTS xix

● New York Presbyterian Hospital Resolution Agreement and Corrective Action Plan 530 ● North Memorial Health Care Resolution Agreement and Corrective Action Plan 531 ● United States v. Zhou 538 ● Byrne v. Avery Center for Obstetrics and Gynecology 539 B. CONSTITUTIONAL PROTECTION OF MEDICAL INFORMATION 542 1. The Constitutional Right to Privacy 542 ● Griswold v. Connecticut 543 ● Planned Parenthood of Southeastern Pennsylvania v. Casey 549 ● Lawrence v. Texas 555 2. The Constitutional Right to Information Privacy 560 ● Whalen v. Roe 560 ● 42 U.S.C. § 1983 and “Constitutional Torts” 567 ● Carter v. Broadlawns Medical Center 568 ● Doe v. Borough of Barrington 569 ● Doe v. Southeastern Pennsylvania Transportation Authority 572 3. The Fourth Amendment 579 ● Ferguson v. City of Charleston 579 C. GENETIC INFORMATION 582 1. Genetic Privacy 582 2. Property Rights in Body Parts and DNA 584 ● Moore v. Regents of the University of California 584 3. Genetic Testing and Discrimination 596 ● Richard A. Epstein, The Legal Regulation of Genetic Discrimination: Old Responses to New Technology 597 ● Paul M. Schwartz, Privacy and the Economics of Health Care Information 598

7 GOVERNMENT RECORDS 603 A. PUBLIC ACCESS TO GOVERNMENT RECORDS 604 1. Public Records and Court Records 604 ● Doe v. Shakur 605 2. The Freedom of Information Act 610 ● United States Dep’t of Justice v. Reporters Committee for Freedom of the Press 613 ● National Archives and Records Administration v. Favish 619 3. Constitutional Requirements of Public Access 628 ● Los Angeles Police Department v. United Reporting Publishing Corp. 630 xx CONTENTS

4. Constitutional Limitations on Public Access 636 (a) Public Records 636 ● Kallstrom v. City of Columbus 636 (b) Police Records 644 ● Cline v. Rogers 645 ● Scheetz v. The Morning Call, Inc. 646 (c) Megan’s Laws 650 ● Paul P. v. Verniero 651 5. The Driver’s Privacy Protection Act 661 B. GOVERNMENT RECORDS AND USE OF PERSONAL DATA 663 1. Fair Information Practices 663 ● Marc Rotenberg, Fair Information Practices and the Architecture of Privacy (What Larry Doesn’t Get) 664 2. The Privacy Act 665 ● Pippinger v. Rubin 668 ● Doe v. Chao 673 3. The Computer Matching and Privacy Protection Act 685 4. The Use of Government Records 686 (a) Airline Passenger Screening 686 ● The 9/11 Commission Report 686 (b) Government Data Mining 689 ● U.S. GAO, Data Mining: Federal Efforts Cover a Wide Range of Uses 690 ● Mary DeRosa, Data Mining and Data Analysis for Counterterrorism 691 ● United States v. Sokolow 695 ● Arizona v. Evans 703 ● United States v. Ellison 707 (c) DNA Databases 711 ● United States v. Kincade 711 ● Maryland v. King 715 C. Identification Records and Requirements 720 1. Identification and the Constitution 721 ● Hiibel v. Sixth Judicial District Court 722 2. Social Security Numbers 726 ● Greidinger v. Davis 728 3. National Identification Systems 731 ● Richard Sobel, The Degradation of Political Identity Under a National Identification System 732 CONTENTS xxi

8 FINANCIAL DATA 737 A. THE FAIR CREDIT REPORTING ACT 737 1. FCRA’s Scope and Structure 739 ● United States v. Spokeo, Inc. 741 2. Permissible Uses of Consumer Reports 746 ● Smith v. Bob Smith Chevrolet, Inc. 748 3. Consumer Rights and Agency Responsibilities 754 4. Civil Liability and Qualified Immunity 755 ● Sarver v. Experian Information Solutions 757 5. Identity Theft and Consumer Reporting 763 ● Sloane v. Equifax Information Services, LLC 765 B. THE GRAMM-LEACH-BLIELY ACT 773 C. FEDERAL AND STATE FINANCIAL PRIVACY LAWS 776 1. State Financial Laws 776 2. Laws Regulating Government Access to Financial Data 777 3. Identity Theft Statutes 778 4. Tort Law 780 ● Wolfe v. MBNA America Bank 780

9 CONSUMER DATA 785 A. THE U.S. SYSTEM OF CONSUMER DATA PRIVACY REGULATION 786 1. Structure 786 2. Types of Law 788 3. Personally Identifiable Information (PII) 794 ● Pineda v. Williams-Sonoma Stores 795 ● Apple v. Krescent 798 4. Injury and Standing 807 ● Spokeo, Inc. v. Robins 808 ● In re Google, Inc. Privacy Policy Litigation 812 B. TORT LAW 820 ● Dwyer v. American Express Co. 820 ● Remsberg v. Docusearch, Inc. 826 C. CONTRACT LAW 829 1. Privacy Policies 829 ● Jeff Sovern, Opting In, Opting Out, or No Options at All 829 xxii CONTENTS

● Michael E. Staten & Fred H. Cate, The Impact of Opt-In Privacy Rules on Retail Markets 830 2. Contract and Promissory Estoppel 833 ● In re Northwest Airlines Privacy Litigation 833 D. PROPERTY LAW 842 E. FTC SECTION 5 ENFORCEMENT 845 ● In the Matter of Snapchat, Inc. 847 ● FTC v. Toysmart.com 855 ● In the Matter of Facebook. Inc. 861 ● In the Matter of Sears Holdings Management Corp. 867 ● In the Matter of Nomi Technologies, Inc. 873 F. STATUTORY REGULATION 876 1. Entertainment Records 876 (a) The Video Privacy Protection Act 876 ● Daniel v. Cantell 879 ● In re Hulu Privacy Litigation 881 ● In re Hulu Privacy Litigation 883 (b) The Cable Communications Policy Act 886 2. Internet Use and Electronic Communications 888 (a) The Children’s Online Privacy Protection Act 888 ● United States v. Path, Inc. 890 (b) The Electronic Communications Privacy Act 894 ● In re Google, Inc. Gmail Litigation 894 ● Dyer v. Northwest Airlines Corp. 902 (c) The Computer Fraud and Abuse Act 904 ● Creative Computing v. Getloaded.com LLC 905 ● United States v. Drew 908 3. Marketing 912 (a) The Telephone Consumer Protections Act 912 (b) The CAN-SPAM Act 915 G. FIRST AMENDMENT LIMITATIONS ON PRIVACY REGULATION 918 ● Rowan v. United States Post Office Department 919 ● Mainstream Marketing Services, Inc. v. Federal Trade Commission 920 ● U.S. West, Inc. v. Federal Communications Commission 923 ● Trans Union Corp. v. Federal Trade Commission 931 ● Sorrell v. IMS Health, Inc. 934

CONTENTS xxiii

10 DATA SECURITY 945 A. INTRODUCTION 945 B. DATA SECURITY BREACH NOTIFICATION STATUTES 947 C. CIVIL LIABILITY AND STANDING 952 ● Reilly v. Ceridian Corporation 952 ● Resnick v. AvMed 954 ● Remijas v. Neiman Marcus Corp. 962 ● Beck v. McDonald 965 D. FTC REGULATION 975 ● FTC v. Wyndham Worldwide Corporation 977 ● In the Matter of Trendnet 983

11 EDUCATION PRIVACY 991 A. SCHOOL SEARCHES AND SURVEILLANCE 991 ● New Jersey v. T.L.O. 991 B. DRUG TESTING 997 ● Vernonia School District v. Acton 997 ● Board of Educational v. Earls 1002 C. SCHOOL RECORDS 1007 ● The Family Education Rights and Privacy Act 1007 ● Owasso Independent School District v. Falvo 1009

12 EMPLOYMENT PRIVACY 1017 A. WORKPLACE SEARCHES 1020 ● O’Connor v. Ortega 1020 ● K-Mart Corp. v. Trotti 1027 B. WORKPLACE SURVEILLANCE 1028 ● Thompson v. Johnson County Community College 1028 C. WORKPLACE DRUG TESTING 1031 ● National Treasury Employees Union v. Von Raab 1031 ● Chandler v. Miller 1037 ● Borse v. Piece Goods Shop 1038 D. THE ISSUE OF CONSENT 1042 ● Baggs v. Eagle-Picher Industries, Inc. 1042 xxiv CONTENTS

E. TESTING, QUESTIONNAIRES, AND POLYGRAPHS 1049 1. Testing and Questionnaires 1049 ● Greenawalt v. Indiana Department of Corrections 1049 ● National Aeronautics and Space Administration v. Nelson 1052 2. Polygraph Testing 1058 ● The Employee Polygraph Protection Act 1061 F. TELEPHONE MONITORING 1062 ● Watkins v. L.M. Berry & Co. 1062 ● Deal v. Spears 1066 G. COMPUTER MONITORING AND SEARCHES 1069 1. E-mail 1069 ● Smyth v. Pillsbury Co. 1070 2. Internet Use 1078 ● Leventhal v. Knapek 1078 ● United States v. Ziegler 1087

13 INTERNATIONAL PRIVACY LAW 1093 A. THE OECD PRIVACY GUIDELINES 1096 1. The 1980 Original Guidelines 1096 2. The 2013 OECD Privacy Guidelines 1098 B. PRIVACY PROTECTION IN EUROPE 1100 1. Divergence or Convergence? 1100 ● James Q. Whitman, The Two Western Cultures of Privacy: Dignity Versus Liberty 1100 ● Paul M. Schwartz & Karl-Nikolaus Peifer, Transatlantic Data Privacy Law 1104 2. European Convention on Human Rights Article 8 1107 ● ECHR Article 8 1109 ● Von Hannover v. Germany [No. 1] 1111 ● In the Case of Mosley v. The United Kingdom 1122 ● Satukunnan Markkinapörssi Oy and Satamedia Oy v. Finland 1133 3. European Union Data Protection 1140 (a) The European Charter of Fundamenal Rights, Articles 7 and 8 1140 ● EU Charter of Fundamental Human Rights, Articles 7 and 8 1140 (b) The Data Protection Directive 1141 ● Criminal Proceedings Against Bodil Lindqvist 1146 ● Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González 1151 ● Tele2 Sverige AB v. Post-och telestyrelsen & Sec’y of State for Home Dept v. Watson (Joined Cases) 1159 CONTENTS xxv

● Opinion 1/15 of the Court 1163 (c) The General Data Protection Regulation 1168 C. INTERNATIONAL TRANSFERS OF DATA 1173 1. International Data Transfers in Litigation 1174 ● Volkswagen, A.G. v. Valdez 1174 2. Adequate Level of Protection 1177 3. From the Safe Harbor to the Privacy Shield 1179 ● Shrems v. Data Protection Commissioner 1181 ● EU-U.S. Privacy Shield Framework Principles Issued by the U.S. Department of Commerce 1187 ● Paul M. Schwartz & Karl-Nikolaus Peifer, Transatlantic Data Privacy Law 1193 ● Opinion 1/15 of the Court 1197 D. THE APEC PRIVACY FRAMEWORK 1203 E. PRIVACY PROTECTION IN NORTH AMERICA 1205 1. Canada 1205 2. Mexico 1207 F. PRIVACY PROTECTION IN SOUTH AMERICA 1208 1. Argentina 1208 2. Brazil 1208 G. PRIVACY PROTECTION IN AFRICA AND THE MIDDLE EAST 1209 1. Africa 1209 2. The Middle East 1209 H. PRIVACY PROTECTION IN ASIA-PACIFIC 1210 1. Australia 1210 2. Japan 1211 3. China and Hong Kong 1211 4. South Korea 1213 5. India 1213

Index 1215