'Legislating Data Loyalty' by Woodrow Hartzog and Neil M Richards in (2022) 97 Notre Dame Law Review Reflection 356 (2022) comments
Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its ‘notice and consent’ roots to confront people’s vulnerabilities in their relationship with powerful data collectors.
In this short Essay, we propose a model for legislating data loyalty. Our model takes advantage of loyalty’s strengths – it is well-established in our law, it is flexible, and it can accommodate conflicting values. Our Essay also explains how data loyalty can embolden our existing data privacy rules, address emergent dangers, solve privacy’s problems around consent and harm, and establish an antibetrayal ethos as America’s privacy identity.
We propose that lawmakers use a two-step process to (1) articulate a primary, general duty of loyalty, then (2) articulate ‘subsidiary’ duties that are more specific and sensitive to context. Subsidiary duties regarding collection, personalization, gatekeeping, persuasion, and mediation would target the most opportunistic contexts for self-dealing and result in flexible open-ended duties combined with highly specific rules. In this way, a duty of data loyalty is not just appealing in theory – it can be effectively implemented in practice just like the other duties of loyalty our law has recognized for hundreds of years. Loyalty is thus not only flexible, but it is capable of breathing life into America’s historically tepid privacy frameworks.
