Surveillance

'An International Legal Framework for Surveillance' by Ashley Deeks in (2015) 55 Virginia Journal of International Law comments -

Edward Snowden’s leaks laid bare the scope and breadth of the electronic surveillance that the U.S. National Security Agency and its foreign counterparts conduct. Suddenly, foreign surveillance is understood as personal and pervasive, capturing the communications not only of foreign leaders but also of private citizens. Yet to the chagrin of many state leaders, academics, and foreign citizens, international law has had little to say about foreign surveillance. Until recently, no court, treaty body, or government had suggested that international law, including basic privacy protections in human rights treaties, applied to purely foreign intelligence collection. This is now changing: several U.N. bodies, judicial tribunals, U.S. corporations, and victims of foreign surveillance are pressuring states to bring that surveillance under tighter legal control.

This article tackles three key, interrelated puzzles associated with this sudden transformation. First, it explores why international law has had so little to say about how, when, and where governments may spy on other states’ nationals. Second, it draws on international relations theory to argue that the development of new international norms regarding surveillance is both likely and essential. Third, it identifies six process-driven norms that states can and should adopt to ensure meaningful privacy restrictions on international surveillance without unduly harming their legitimate national security interests. These norms, which include limits on the use of collected data, periodic reviews of surveillance authorizations, and active oversight by neutral bodies, will increase the transparency, accountability, and legitimacy of foreign surveillance.

This procedural approach challenges the limited emerging scholarship on surveillance, which urges states to apply existing — but vague and contested — substantive human rights norms to complicated, clandestine practices. In identifying and valuing new, objectively verifiable, neutral norms, the article offers a more viable and timely solution to the perils of foreign surveillance.

Rank and Forfeiture

'Rank Among Equals' by Ben A. McJunkin in Michigan Law Review (Forthcoming) comments

Dignity is on the march. As illustrated by Justice Kennedy’s recent majority opinion in United States v. Windsor, the concept — once seen as exclusive to moral philosophy — has taken on increasing importance in the legal realm, particularly in the recognition of individual human rights. Jeremy Waldron's recent book, Dignity, Rank, and Rights, offers a profound and provocative take on dignity's newfound centrality to law. Waldron contends that dignity currently operates as a universal legal status that entails individual rights. He suggests that this development reflects the gradual democratization of aristocratic privilege — a kind of "leveling up" of humanity. 

This Review disentangles and separately examines the two core accounts of dignity in Waldron's work. The first, which purports to identify the nature of contemporary legal dignity as a form of status, appears to be promising step toward better understanding the role dignity plays in law. The second, Waldron's historical account of dignity's development that offers up something like an origin story for our contemporary conceptions, is more troubling. Borrowing from feminist theory and queer theory, as well as from the equality projects to which they are allied, I contend that Waldron's narratives of extending aristocratic privilege threaten to entrench inequality and injustice while limiting the potential for marginalized groups to employ dignity as a deeply remedial legal tool. I urge Waldron to revisit dignity's expressive connection to human worth, which has proven central to dignity-based antidiscrimination and antisubordination projects.

The Victorian Law Reform Commission's The Forfeiture Rule report states

The forfeiture rule prevents a person who has unlawfully killed another from inheriting from their victim or acquiring another financial benefit from the death. It is an unwritten rule of public policy enforced by the courts. It has no statutory basis yet overrides the words of a will, entitlements provided in legislation, and legally binding agreements to which the deceased person was a party. The rule applies where the court is satisfied, in civil proceedings, that the person was responsible for an unlawful killing. A person acquitted in criminal proceedings, or not prosecuted for a criminal offence at all, may still be precluded from obtaining a benefit. The only exception in Victoria is where the person is not guilty because of mental impairment. 

Emerging in the late 19th century from common law doctrines that stripped murderers and other felons of their property, the rule remains relevant today. It conveys the community’s strongest condemnation of the act of unlawfully taking another human life. 

The rule is not applied often, as it is directed to circumstances where the person responsible for the death stands to benefit from the deceased person’s estate or otherwise as a result of their close relationship with the deceased person. However, of the 85 homicides in Victoria last year, 27 (33 per cent) were committed by a family member. It is likely that in many of these cases the forfeiture rule prevented the person responsible from obtaining a benefit. 

Need for reform 

Although the public policy is sound, the rule requires reform for two reasons: clarity and fairness. The scope of the rule as it applies in Victoria is unclear. There is no doubt that it applies to murder, but the reach of the rule to all forms of unlawful killing, including inadvertent and involuntary acts, is unsettled. Where it does apply, the effect that the rule has on the subsequent distribution of forfeited benefits is uncertain. The rule can operate unfairly because it is applied inflexibly and without regard to the moral culpability of the person responsible for the unlawful killing. This is at odds with changes in community attitudes, as reflected in the greater range of criminal offences and sentence options today compared to when the rule was first articulated. 

The application of the forfeiture rule can also have unfair consequences for third parties as it can affect their potential rights to take a forfeited benefit. Those affected may include alternative beneficiaries named in a will, other beneficiaries of the deceased person’s estate, the innocent descendants of the unlawful killer, and any person who co-owns property with the unlawful killer and the deceased person as joint tenants. 

Legislative responses in other jurisdictions 

Responding to similar concerns, other jurisdictions have introduced legislation to replace or augment the operation of the common law rule. New Zealand’s Succession (Homicide) Act 2007 (NZ) (‘the NZ Act’) codifies the rule. It sets out the homicides to which the rule applies, excises those to which it does not apply, and specifies its effect on the distribution of the benefits to which the person would have been entitled. 

The United Kingdom has taken a minimalist approach. The Forfeiture Act 1982 (UK) (‘the UK Act’) leaves the scope and effect of the rule at common law intact, but gives the court a discretion to modify its effect if required by the justice of the case. The Australian Capital Territory and New South Wales subsequently introduced legislation that is closely modelled on the UK Act: the Forfeiture Act 1991 (ACT) (‘the ACT Act’) and the Forfeiture Act 1995 (NSW) (‘the NSW Act’). The key difference between the three statutes is that the NSW Act was amended in 2005 to give the court a discretion to apply the rule to a person who has been found not guilty by reason of mental illness. 

There have been no recorded applications under the ACT Act to modify the effect of the rule. Five such applications have been made under the NSW Act, and a further three to apply the rule to a person found not guilty of an unlawful killing because of a mental illness. All applications under the NSW Act have been successful. However, most cases concerning the forfeiture rule are not made under the Forfeiture Act but involve applications seeking clarification of the effect of the rule and a determination as to where the offender’s interest is to be redirected. 

Proposed Forfeiture Act 

The Commission released a consultation paper and sought submissions on possible options for reform, based on the approaches illustrated in the NZ, UK, ACT and NSW Acts. A recurring theme in submissions and consultations was that legislative reform is needed, to provide certainty about the scope and effect of the rule and to overcome concerns about the lack of regard to the offender’s moral culpability. 

The Commission concluded that Victoria should introduce a Forfeiture Act that draws both from the reforms in New Zealand that codified the rule in order to create greater certainty and from the reforms in New South Wales and elsewhere that introduced a discretion to ensure greater fairness in the application of the rule. The proposed Forfeiture Act would specify the unlawful killings to which the rule applies and, either directly or by consequential amendment to other legislation, clarify its effect. To overcome concerns about the harsh effects of the rule, certain offences would be excluded from its operation. In addition, the court would have a discretion, on application, to modify the effect of the rule on a case-by-case basis where required by the justice of the case. 

Scope of the rule 

The determining factor for the Commission in defining the scope of the rule for the purposes of the proposed Forfeiture Act is the moral culpability of the person responsible for the unlawful killing. For clarity, the Commission recommends establishing a nexus between the unlawful killings to which the rule applies and murder and other indictable homicide offences under the Crimes Act 1958 (Vic). 

In the interests of justice, the Commission recommends excluding from the scope of the rule a small number of homicide offences where any perpetrator is likely to be considered to have low moral culpability and the offence does not warrant a bar on the offender taking a benefit from the deceased person. These are:

• dangerous driving causing death 

• manslaughter pursuant to a suicide pact with the deceased person or aiding or abetting a suicide pursuant to such a pact 

• infanticide. 

These offences were identified in submissions and consultations and have been excluded from the rule in other jurisdictions. Motor manslaughter is excluded at common law from the operation of the rule in the United Kingdom, and the NZ Act excludes killings caused by negligent acts or omissions, killings in pursuance of a suicide pact and infanticide. Given the nature of each of these offences and the low moral culpability of the offenders, any application to modify the effect of the rule in the circumstances of these offences would be likely to succeed. The exclusion of these offences will therefore create greater certainty and will reduce costs to the estate resulting from unnecessary litigation. 

Judicial discretion 

Under provisions similar to those in the UK, ACT and NSW Acts, the court in Victoria would have the discretion to modify the effect of the rule as required by the justice of the case. However, unlike the equivalent legislation, the proposed Forfeiture Act would expressly direct the court to consider the moral culpability of the person responsible for the unlawful killing and set out the evidence to which it should have regard. An interested person—who could be the person responsible, the executor or administrator of the deceased person’s estate, or any other person who in the opinion of the court has an interest in the matter—would be able to make an application for a forfeiture modification order. The procedural details of the scheme would be modelled on the UK, ACT and NSW Acts. 

Unlike the NSW Act, however, the proposed Forfeiture Act would not empower the court to extend the scope of the rule beyond the limits of the common law to persons who have been found not guilty by reason of mental impairment. The Commission does not consider that the rule should apply to a person who is not morally culpable for the unlawful killing. 

Effect of the rule 

The deceased person may leave a will that appoints the person who is later responsible for their death as executor. If the deceased person does not leave a will, the court usually appoints a person who is a major beneficiary to administer the estate. The Commission recommends that the proposed Forfeiture Act should clearly preclude a person who is responsible for the death from taking up an appointment either as executor or administrator. This would be achieved by deeming them to have died before the deceased person. 

As the person’s responsibility for the death may not be established until some time after the death, the Commission also recommends that the court be given an express power to pass over a person who applies for probate or administration where there are reasonable grounds for believing that they committed an offence related to the deceased person’s death. 

The effect of the rule on the entitlements of innocent beneficiaries and third parties would also be clarified. In some circumstances, another beneficiary under a will, or a descendant of an offender, may stand to gain a share of the estate but only if the offender dies before or shortly after the deceased person. Even though they are innocent of any wrongdoing, they are unable to take a share if the offender is alive but precluded by the rule from inheriting. This will be the case even if it is likely that the deceased person would have wanted them to inherit or if they were the deceased person’s closest living relative. To overcome this problem the Commission recommends deeming the offender to have predeceased the deceased person. 

The Commission also recommends that a person who is responsible for the death of a person should be disentitled from making an application for family provision in order to obtain a larger share of the deceased person’s estate. 

If the deceased person and the offender owned property as joint tenants, perhaps in conjunction with one or more other people, the rule has consequences for the beneficiaries of the deceased person and any innocent joint tenants. In normal circumstances, the deceased person’s interest in the property would vest in the surviving joint tenant or tenants in accordance with the law of survivorship. Where one surviving joint tenant is responsible for the death of another, courts have taken different approaches to determining the impact of the rule. The favoured approach has been to deem that the person responsible for the death holds the deceased person’s share on constructive trust for the deceased person’s estate. The Commission recommends that the interest of the person responsible for the death should be severed at the time of the death. This is clearer, simpler and fairer. 

These clarifications would make it easier for an executor or administrator to distribute the deceased person’s estate and reduce the associated legal costs. If the outcome is unfair in any particular circumstances, the court could, on application, modify the effect of the rule.

 The Commission's recommendations are - 

1 Victoria should introduce a Forfeiture Act that defines the scope and effect of the common law rule of forfeiture and provides for the Supreme Court, on application, to modify the effect of the rule if the justice of the case requires it. 

2 The purpose of the Forfeiture Act should be set out in the legislation and include: (a) to reinforce the common law rule of public policy that a person who has unlawfully killed another person cannot acquire a benefit in consequence of the killing and, in so doing, to: (i) manifest the community’s denunciation of unlawful killing (ii) deter persons from unlawfully killing others for financial gain (b) to modify the application of the rule to exclude offences where justice requires (c) to provide for the effect of the rule to be modified if the justice of the case requires it in view of an offender’s moral culpability and responsibility for the offence (d) to codify the effect of the rule on rights of succession. 

3 The Forfeiture Act should specify that, subject to the exceptions in Recommendation 4, the forfeiture rule applies only where the killing, whether done in Victoria or elsewhere, would be murder or another indictable offence under the Crimes Act 1958 (Vic). 

4 The Forfeiture Act should specify that the forfeiture rule does not apply where the killing, whether done in Victoria or elsewhere, would be an offence under the Crimes Act 1958 (Vic) of: (a) dangerous driving causing death (b) manslaughter pursuant to a suicide pact with the deceased person or aiding or abetting a suicide pursuant to such a pact, or (c) infanticide. 

5 The existing exception to the common law rule of forfeiture for persons found not guilty by reason of mental impairment should be retained. 

6 The Supreme Court should be empowered to make a forfeiture rule modification order if satisfied that, having regard to the offender’s moral culpability and responsibility for the unlawful killing and such other matters as appear to the Court to be material, the justice of the case requires the effect of the rule to be modified. 

7 In determining the moral culpability of the offender, the Supreme Court should have regard to: (a) findings of fact by the sentencing judge (b) findings by the Coroner (c) victim impact statements presented at criminal proceedings for the offence (d) submissions on interests of victims (e) the mental state of the offender at the time of the offence, and (f) such other matters that in the Court’s opinion appear to be material to the offender’s moral culpability. 

8 The Forfeiture Act should empower the Supreme Court to make a forfeiture rule modification order that modifies the effect of the rule in such terms and subject to such conditions as the Court thinks fit. 

9 Where a person has unlawfully killed another person and is thereby precluded by the forfeiture rule from obtaining a benefit, and the unlawful killing does not constitute murder, that person, or another ‘interested person’, should be able to apply for a forfeiture rule modification order. 

10 An ‘interested person’ should mean: (a) the ‘offender’ (a person who has unlawfully killed another person) or a person applying on the offender’s behalf (b) the executor or administrator of a deceased person’s estate, or (c) any other person who in the opinion of the Court has an interest in the matter. 

11 The property, entitlements and other benefits that may be affected by a forfeiture rule modification order should be specified in the Forfeiture Act and include: (a) gifts to the offender made by the will of the deceased person (b) entitlements on intestacy (c) eligibility to make an application for family provision under Part IV of the Administration and Probate Act 1958 (Vic) (d) any other benefit or interest in property that vests in the offender as a result of the death of the deceased person. 

12 On the making of a forfeiture rule modification order, the forfeiture rule should have effect for all purposes (including purposes relating to anything done before the order was made) subject to modifications made by the order. 

13 On application by an interested person, the Supreme Court should be empowered to revoke or vary a forfeiture rule modification order if the justice of the case requires it. 

14 An interested person (as defined in Recommendation 10) should be able to apply for revocation or variation of a forfeiture rule modification order if: (a) the offender is pardoned (b) the offender’s conviction is quashed or set aside and there are no further avenues of appeal available in respect of the decision to quash or set aside the conviction, or (c) in all other cases—if the Court considers it just in all the circumstances to give leave for such an application to be made. 

15 If a forfeiture rule modification order is revoked or varied, the forfeiture rule should have effect for all purposes (including purposes relating to anything done before the order was revoked or varied): (a) in the case of a revocation—subject to the terms on which the Court revokes the order, and (b) in the case of a variation—subject to modifications made by the varied order. 

16 The Forfeiture Act should provide that, unless the Supreme Court gives leave for a late application to be made, an application for a forfeiture rule modification order must be made by the later of: (a) if the forfeiture rule operates immediately on the death of a deceased person to prevent the offender from obtaining the benefit concerned—within six months from the date of the death of the deceased person (b) if the forfeiture rule subsequently prevents the offender from obtaining a benefit— within six months from the date on which the forfeiture rule operates to preclude the offender from obtaining the benefit concerned (c) six months after grant of probate of the will of the deceased person or letters of administration of the deceased person’s estate (d) six months after all charges of unlawful killing laid against any beneficiary have been dealt with. 

17 The Supreme Court should be permitted to give leave for a late application for a forfeiture rule modification order if: (a) the offender concerned is pardoned by the Governor after the expiration of the relevant period (b) the offender’s conviction is quashed or set aside by a court after the expiration of the relevant period and there are no further avenues of appeal available in respect of the decision to quash or set aside the conviction (c) the fact that the offender committed the unlawful killing is discovered after the expiration of the relevant period, or (d) the Court considers it just in all the circumstances to give leave. 

18 The Forfeiture Act should provide that a conviction in Victoria or another Australian state or territory is conclusive evidence that an offender is responsible for the unlawful killing. 

19 The transitional provisions should be based on section 9 of the Forfeiture Act 1995 (NSW). 

20 The Administration and Probate Act 1958 (Vic) should be amended to provide that, where a person appointed executor by a will or who is otherwise eligible to be appointed administrator is precluded by the forfeiture rule from acquiring an interest in the deceased’s estate, the person is to be treated as having died immediately before the deceased person. 

21 The Administration and Probate Act 1958 (Vic) should be amended to provide for the Court to pass over a person who applies for a grant of representation where there are reasonable grounds for believing that the person has committed an offence related to the deceased’s death. The provision should be based on section 348 of model legislation proposed in the December 2009 report of the National Committee for Uniform Succession Laws to the Standing Committee of Attorneys-General on the administration of estates of deceased persons. 

22 Part 4 of the Wills Act 1997 (Vic) should be amended with the effect that: (a) where a will contains a devise or bequest to a person who: (i) disclaims it, or (ii) has been precluded by the common law rule of forfeiture from acquiring it the person is, unless a contrary intention appears by the will, to be treated for the purposes of the Act as having died immediately before the will-maker, and entitled to the devise or bequest at the time of the deemed death. (b) this amendment does not affect the Court’s power under the Forfeiture Act to modify the effect of the forfeiture rule 

23 The Administration and Probate Act 1958 (Vic) should be amended with the effect that: (a) for the purposes of the distribution of an intestate’s residuary estate, a person who: (i) is entitled in accordance with section 52 to an interest in the residuary estate but disclaims it, or (ii) would have been so entitled if not precluded from acquiring it by the common law rule of forfeiture is to be treated as having died immediately before the intestate, and entitled to the interest in the residuary estate at the time of the deemed death (b) this amendment does not affect the Court’s power under the Forfeiture Act to modify the effect of the forfeiture rule. 

24 Part IV of the Administration and Probate Act 1958 (Vic) should be amended to disentitle persons to whom the forfeiture rule applies from making an application for family provision in respect of the deceased person’s estate. 

25 The effect of section 50 of the Transfer of Land Act 1958 (Vic) should be amended to provide that, where a joint proprietor has been unlawfully killed (within the meaning of the Forfeiture Act) by another joint proprietor, the property shall devolve at the death of the victim as follows: (a) where the offender and the victim were the only joint proprietors, as if the property were owned by each of them as tenants in common in equal shares (b) where there were more than two joint proprietors, as if: (i) the offender holds their interest as a tenant in common (ii) the surviving innocent joint proprietor(s) take the victim’s interest by survivorship (iii) as between the offender on the one hand and the innocent joint proprietors on the other hand, a tenancy in common exists (iv) as between the innocent joint proprietors, a joint tenancy exists. 

26 If an offender obtains registration by survivorship under section 50 of the Transfer of Land Act 1958 (Vic) before it becomes apparent that the forfeiture rule applies, the Registrar should be empowered to rectify the Register appropriately. 

27 Payments that would have been made to a person who is responsible for unlawfully killing a person who is a member of a state statutory defined benefit superannuation scheme or who otherwise has pension entitlements under state legislation should be redirected as if that person had died before the victim.

Breach

'Empirical Analysis of Data Breach Litigation' by Sasha Romanosky, David Hoffman and Alessandro Acquisti in (2014) 11(1) Journal of Empirical Legal Studies 74–104 argues

The surge in popularity of social media, e-commerce, and mobile services is proof of the benefits consumers are enjoying from information and communication technologies. However, these same technologies can create harm when personal consumer information is lost or stolen, causing emotional distress or monetary damage from fraud and identity theft. Since 2005, an estimated 543 million records have been lost from over 2,800 data breaches,  and identity theft caused $13.3 billion in consumer financial loss in 2010 (BJS 2011). In response, federal legislators have introduced numerous bills that define appropriate business practices regarding the collection and protection of consumer information,  and federal regulators have drafted privacy frameworks for consumer data protection (Department of Commerce 2010; FTC 2010). A significant concern for policymakers, therefore, is balancing ex ante regulation with ex post litigation to protect both consumer and commercial interests. For instance, the Department of Commerce inquired: “should baseline commercial data privacy legislation include a private right of action?” (Department of Commerce 2010:30). At issue is the degree to which the current liability regime sufficiently addresses modern privacy harms, or whether a new, more effective federal liability standard is required. 

On one hand, a weak litigation regime would be ineffective at deterring a firm's harmful or negligent behavior. Lawsuits that are inappropriately disposed of eliminate a plaintiff's ability to obtain appropriate relief for legitimate harms. For example, a case was successfully brought against Rite Aide for carelessly tossing pharmacy labels and employment applications in a public trash dumpster.  In the settlement, Ride Aide agreed to “a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers.”  Without legal action, such careless practices may have never been corrected.

On the other hand, a heavy-handed litigation regime could impose excessive legal fees and damage awards and—according to some—stifle innovation. For instance, Netflix, an online movie rental site, offered a $1 million prize to anyone who could sufficiently improve its movie recommendation algorithm. To facilitate the contest, Netflix published (what was believed to be) anonymized rental information for a sample of its users. Due to lawsuits stemming from the reidentification of these data, Netflix cancelled a subsequent contest. While the total social value of such innovation may be limited, the Netflix case provides one example of how litigation can impact firms' product development.

Our research attempts to offer novel insight into this debate by providing the first comprehensive empirical analysis of data breach litigation, and investigates the drivers, mechanisms, and outcomes of data breach litigation.

Determining whether current U.S. privacy laws are too weak or too strong is not easy. It is difficult (and perhaps impossible) to assess the aggregate costs and benefits for both consumers and firms of different privacy regimes in purely monetary terms (Romanosky & Acquisti 2009). However, even just understanding the landscape of privacy litigation is a problem. Little is known about the trends in data breach litigation—which breaches are litigated and which are not, and with what outcomes. While there exists some legal scholarship regarding data breach litigation (Citron 2007, 2011; Rice 2007; Serwin 2009), it typically examines a narrow subset of lawsuits, focusing on high-profile cases or those with published opinions. Unfortunately, given that as few as 15 percent of all federal lawsuits produce reported opinions (Hoffman et al. 2007), any conclusions reached from examining particular, high-profile cases are likely unrepresentative of the full population of data breach lawsuits. Consequently, it remains still unclear what characteristics these lawsuits actually possess, and how “successful” they have been.

To our knowledge, no empirical research involving data breach lawsuits has been conducted. The purpose of this article is to address this research and policy gap by investigating empirically a representative collection of federal data breach lawsuits and their outcomes. We overcome common sample selection issues by searching Westlaw and acquiring data directly from court dockets (PACER), in combination with other publicly available data sources.

In addition to presenting rich descriptive information about these lawsuits, we explore two sets of questions. First, what kinds of data breaches are being litigated in federal court, and why? Second, what kinds of data breach lawsuits are settling, and why? Our first question examines federal lawsuits resulting from reported data breaches, while the second question includes all known federal lawsuits related to the unauthorized disclosure of personal information.

Our analysis reveals that federal data breach lawsuits typically exhibit a number of significant characteristics. First, plaintiffs seek relief for one or more of: actual loss from identity theft (e.g., financial or medical fraud), emotional distress, cost of preventing future losses (e.g., credit monitoring and identity theft insurance), and the increased risk of future harm. Second, the lawsuits are usually private class actions, though some are brought by public entities such as the Federal Trade Commission or state attorneys general. Third, defendants are typically large firms such as banks, medical/insurance entities, retailers, or other private businesses. Fourth, complaints allege a staggering range of both common-law (tort, breach of contract) and statutory causes of action. And fifth, the vast majority of cases either settle, or are dismissed, either as a matter of law, or because the plaintiff was unable to demonstrate actual harm.

In addition, we find that that the odds of a firm being sued are 3.5 times greater when individuals suffered financial harm, but over 6 times lower when the firm provides free credit monitoring to those affected by the breach. Moreover, the odds of a firm being sued as a result of improperly disposing of data are 3 times greater relative to breaches caused by lost/stolen data, and 6 times greater when the data breach involved the loss of financial information. Our analysis suggests that defendants settle 30 percent more often when plaintiffs allege financial loss from a data breach, or when faced with a certified class action suit. The odds of a settlement are found to be 10 times greater when the breach is caused by a cyber attack, relative to lost or stolen hardware, and the compromise of medical data increases the probability of settlement by 31 percent.

By providing a comprehensive empirical analysis of data breach litigation, these findings offer insight into the debate over privacy litigation versus privacy regulation. Specifically, we believe that answering these questions will help inform firms, consumers, and policymakers regarding the risks associated with the collection and use of personal information, and the characteristics and outcomes of federal data breach litigation.

The next section provides background literature related to data breaches, docket analysis, and litigation. We then examine which breaches are litigated and, conditional on suit, which cases settle. Discussions of limitations and final conclusions complete the article.

Torts

'Exemplary Damages for Invasions of Privacy' by Normann Witzleb in (2014) 6(1)Journal of Media Law 69-93 comments 

As part of the [UK] government response to the Leveson Report, the Crime and Courts Act 2013 (UK) introduces new provisions on the availability of exemplary damages for media torts. This Act creates a statutory bar to the awarding of exemplary damages against a publisher who has become a member of an approved regulator but otherwise makes them available in narrowly defined circumstances. The article explores the extent to which the changes are likely to affect media publishers and, as part of this analysis, compares the new provisions with current English law as well as the relevant law in Australia, New Zealand and Canada. It also examines whether the new statutory regime is compatible with the UK’s obligations under the European Convention on Human Rights. The article concludes that the statutory measures are to be welcomed because exemplary damages have an important but limited role in deterring particularly egregious media misconduct and the provisions provide more certainty to media publishers as to when they can be ordered. The article also argues that the new provisions on exemplary damages are compatible with the UK’s obligations under the Convention.

Decent Illiberal People

'Fifteen Years Later: Reflections on Realism and Utopia in 'The Law of Peoples' by John Rawls' by Wojciech Sadurski (Sydney Law School Research Paper No. 14/93) comments 

Fifteen years ago, the last important, book-length statement about liberal values and ideals by John Rawls appeared, "The Law of Peoples". It was met with a good deal of surprise and disenchantment by many admirers of the “early Rawls" (the Rawls of "A Theory of Justice"). This essay reflects upon The Law of Peoples, and the grounds of liberal disenchantment with the book. It explores the status of "illiberal decent peoples" in the law of peoples, and connects this issue with the purposes of Rawls’ theory understood as a “realistic utopia", and argues that the inclusion of illiberal, decent peoples must be seen as a matter of moral choice rather than a concession to Realpolitik. This moral choice is supported by Rawls’ methodology in "The Law of Peoples", and in particular, the deliberately emaciated social contract, original position and reflective equilibrium. The key answers to the puzzles raised by these revisions of Rawls’ original liberal theory s are to be found, it is claimed, in the role assigned to the ideal of toleration in "The Law of Peoples". However, the use of this ideal is ill-advised as no link is demonstrated, or even asserted, between toleration and the individuals who belong to the peoples who are to be tolerated.

Economics

'Economics of Legal History' by Daniel M. Klerman in Francesco Parisi (ed) Oxford Handbook of Law & Economics (2014) surveys economic analyses of legal history.

 In order to make sense of the field and to provide examples that might guide and inspire future research, it identifies and discusses five genres of scholarship.

1) Law as the dependent variable. This genre tries to explain why societies have the laws they do and why laws change over time. Early economic analysis tended to assume that law was efficient, while later scholars have usually adopted more realistic models of judicial and legislative behavior that take into account interest groups, institutions, and transactions costs.

2) Law as an independent variable. Studies of this kind look at the effect of law and legal change on human behavior. Examples include analyses of the Glorious Revolution, legal origin, and nineteenth-century women’s rights legislation.

3) Bidirectional histories. Studies in the first two genres analyze law as either cause or effect. In contrast, bidirectional histories view law and society as interacting in dynamic ways over time. Laws change society, but change in society in turn leads to pressure to change the law, which starts the cycle over again. So, for example, the medieval communal responsibility system fostered international trade by holding traders from the same city or region collectively responsible. Nevertheless, the increase in commerce fostered by the system undermined the effectiveness of collective responsibility and put pressure on cities and nations to develop alternative enforcement institutions.

4) Private ordering. A significant body of historical work investigates the ability of groups to develop norms and practices partly or wholly independently of the state. Such norms include rules relating whaling, the governance of pirate ships, and, more controversially, medieval commercial law (the “law merchant”).

5) Litigation and Contracts. Law and economics has developed an impressive body of theories relating to litigation and the structure of contracts. These theories often shed light on legal behavior in former times, including contracts between slave ship owners and captains, and the suit and settlement decisions of medieval private prosecutors.

Metadata and Discovery

A reminder about the potential for use by private investigators of metadata - on which the national Government is alas still apparently confused - is provided in AS v Murray [2013] NSWSC 733, which centres on the tort of intimidation.

The plaintiff [subject of a non-publication order under the Court Suppression and Non-Publication Orders Act 2010 (NSW)] sought to recover $26,666 claimed to have been paid to Stephen James Murray as a result of extortion. The plaintiff also sought orders restraining Murray from communicating to any person any representation in relation to the plaintiff and restraining Murray from communicating in any form with the plaintiff other than by communicating with the plaintiff's solicitors. The plaintiff sought exemplary damages against the defendant in respect of the extortion.

The judgment states that

There is no doubt that the plaintiff paid the sum of $26,666 as a result of extortion. The plaintiff gives uncontradicted evidence to that effect and there is no reason to doubt that evidence. The only real question in this case is whether the extortionist was the defendant.

The extortion began in about December 2011 when the plaintiff received, at work, an unsolicited email from a person who identified themselves as "Felicity Jones". In a series of emails the extortionist demanded $26,666 and threatened to reveal to the plaintiff's wife, family and employer personal information concerning the plaintiff, and in particular the fact that the plaintiff had joined an internet dating site, if the plaintiff did not pay the amount demanded. It was apparent from the email sent to the plaintiff that the sender had considerable information concerning the plaintiff and appeared to have obtained that information by hacking into the plaintiff's computer and mobile telephone.

Eventually arrangements were made for the money to be paid in cash by leaving it at a place nominated by the extortionist, which is what happened. The plaintiff heard nothing further until 8 November 2012 when the extortionist began to make a fresh demand for $40,000. In response, the plaintiff engaged a computer forensic expert who was able to identify the IP address from which it was highly likely that the extortionist's emails had been sent. That IP address belonged to Telstra Corporation Limited (Telstra). The plaintiff then commenced these proceedings on 9 February 2013 initially seeking preliminary discovery against Telstra for records in relation to the IP address and against Vodafone Hutchison Australia Pty Ltd (Vodafone) for records kept in relation to the mobile telephone number from which the extortionist sent the plaintiff text messages.

Metadata, in other words, with discovery by a private agent rather than by the AFP, ASIO or other government agency.

The judgment goes on to state that

Preliminary discovery against Vodafone did not lead anywhere. However, preliminary discovery against Telstra revealed that two Telstra account holders had accessed the IP address identified by the forensic expert. One account holder was the defendant. The information disclosed by Telstra also disclosed a post office box number as the billing address for that account. The second email address was said to belong to a Christopher Robbins. It may be inferred that that name is fictitious. As a result of the information provided by Telstra, the plaintiff sought preliminary discovery against the Australian Postal Corporation (Australia Post). Material produced by Australia Post showed that the post office box belonged to the defendant and gave a physical address for the defendant in Huntingdale, Victoria. Using that address, the plaintiff joined the defendant and applied for search orders, which were granted on 15 March 2013.

The independent solicitor appointed by the court sought to execute those orders on 18 March 2013. However, the defendant refused to comply with them. In the meantime, the plaintiff arranged for a private investigator to conduct surveillance of the defendant. Following the attempt to execute the search order the defendant, at approximately 9 pm on 18 March 2013, drove to a place where he worked and appeared to place something in a large bin. Subsequently the private investigator searched that bin, but only found garden refuge.

A further search order was made by the court on 20 March 2013. That order was executed on 22 March 2013. During the execution of that order the defendant claimed that his home had been burgled and that a computer had been stolen. The defendant also conceded that he worked as a private investigator and had investigated the plaintiff about four years previously. He said that he may have a file relating to that investigation, although that file could not be found. The defendant did, however, have other files relating to his work as a private investigator. The search party found an internet thumb drive. The defendant denied that he had any other means of accessing the internet. However, shortly afterwards the search party found a Netgear-Bigpond wireless server. The defendant denied that he knew the login name and password for that device. However, the IP address associated with that device is the same as the IP address that the forensic expert identified as the one from which it was highly likely the emails had been sent. The search order was also executed at other premises.

As a result of the search order two computer towers, two memory cards and a laptop were located and impounded. Among material found were copies of a number of the emails that had been sent to the plaintiff under the name Felicity Jones.

In my opinion it is clear from this material that the defendant is the extortionist. That conclusion is supported by the fact that the emails were sent from an IP address associated with the defendant and the fact that the defendant had copies of the offending emails. It is also supported by the defendant's behaviour. Although nothing was found in the bin, the defendant's behaviour in driving to it at around 9 pm at night, the claim that he had been the victim of a burglary whilst under surveillance, the absence of any evidence of a burglary and the absence of the defendant's file relating to the plaintiff, strongly suggest that that file was destroyed by the defendant. The fact that the defendant had investigated the plaintiff four years earlier explains how the defendant chose the plaintiff to be the object of his extortion.

In the email the defendant sent to my associate he complains about the way the search order was executed. However, Mr Stevens, the independent solicitor appointed to conduct the search order, has provided a detailed account of the steps he took to serve and execute the order. I accept that evidence and, in my opinion, it demonstrates that there was no unfairness in the way the order was executed.

The Court concluded that Murray committed the tort of intimidation and referred to an offence under s 249K of the Crimes Act 1900 (NSW).

The judgment states that 

By [the] unlawful threats, the defendant compelled the plaintiff to pay the sum of $26,666. The plaintiff is entitled to recover that sum as damages.

In my opinion, the plaintiff is also entitled to injunctions in the form that he seeks. There are two bases for those injunctions. First, the plaintiff is entitled to an injunction to restrain threatened further conduct that would amount to the tort of intimidation. Second, the plaintiff is entitled to restrain the defendant from using confidential information that the defendant obtained improperly by hacking into the plaintiff's computer.

As to the first basis, s 66 of the Supreme Court Act 1970 (NSW) provides: (1) The Court may, at any stage of proceedings, by interlocutory or other injunction, restrain any threatened or apprehended breach of contract or other injury. (2) Subsection (1) applies as well in a case where an injury is not actionable unless it causes damage as in other cases. ...

It will often be appropriate for the court to grant an injunction to restrain the threatened commission of a tort where damages are an inadequate remedy. In the present case, damages are clearly not an adequate remedy. The vice in the defendant's conduct is as much in the threat as in the conduct that completes the tort and there is no means by an award of damages to compensate the plaintiff for the injury caused by that threat. As to the second basis, the court will grant an injunction to restrain the publication of improperly obtained confidential information; see Meagher, Gummow and Lehane's Equity Doctrines & Remedies, 4th ed (2002) LexisNexis Butterworths at [41-045]. The information obtained by the defendant was confidential because it was personal information concerning the plaintiff. It was clearly obtained improperly because it was obtained by hacking into the plaintiff's computer.

The injunctions sought by the plaintiff are expressed very broadly. However, there is no relationship between the plaintiff and the defendant. The defendant has no reason either to contact the plaintiff or to make representations concerning the plaintiff other than in furtherance of his attempts at extortion. There are difficulties in formulating narrower injunctions which achieve the objective of preventing the defendant making further threats and carrying out those threats, and at the same time making it clear what the defendant must not do. For those reasons, in my opinion, it is appropriate to grant injunctions in the terms sought by the plaintiff.