Note: This is the webpage for a class that has ended. Information about current classes is available here.
Overview
This course is an introduction to information privacy and data protection law and policy. Governments and every sector of the economy collect, use, store, and share personal data. The headlines mirror the ubiquity of data use; nearly every day there is a new story about government surveillance, location tracking, identity theft, corporate data breaches, predictive analytics, or artificial intelligence. As these concerns have grown, so has the body of law surrounding them, from the paradigm-shifting U.S. v. Carpenter case in 2018, to the EU’s General Data Protection Regulation that went into effect in 2018, and the California Privacy Rights Act, passed by ballot initiative in November 2020, which itself rewrote the California Consumer Privacy Act—of 2018.
The course combines a practical approach to the daily problems that a privacy lawyer will face with the theory necessary to understand how the law is developing. We will cover the constitutional, statutory, and common law rules of privacy, as well as federal and state enforcement activity. We will learn about the policy questions arising from data-driven technologies, the theory behind them, and the questions to ask when assessing information practices. We will also examine privacy and data protection law through a critical lens, asking how the concepts interact with questions of discrimination, poverty, due process, and justice.
Course Objectives
At the end of this course you will be able to:
- Articulate and differentiate the different concepts and values contained in the idea of privacy
- Understand the basic structure of information privacy and data protection regulation in the United States and European Union, as well as how they interact
- Recognize the types of problems a privacy lawyer faces in practice and how one might approach them
- Critically evaluate the effects of data use and regulation on power relationships in society, including effects on consumers, relationships between individuals and governments, and effects on marginalized populations
- Anticipate how the legal landscape on data protection is likely to change in the near future
Class Meetings, Review Session, Final Exam
We will meet Monday and Wednesday, from 3:20–5:20 PM. At first, class will be located at the zoom link in BruinLearn, and when we resume in-person classes, we will meet in Room 1337.
The review session for this course is scheduled for Friday, May 6, from 3–4:15PM. The final exam will be on Tuesday, May 10. It will be 4-hour, take-home exam that you can complete at any time in the 24 hour period.
Materials
The casebook for this course will be McGeveran, Privacy and Data Protection Law. The 2021 Supplement is available in the OneDrive folder, linked to the right. Other readings, handouts, and lecture slides will also be made available there.
Attendance
Regular attendance is required for all classes at UCLA Law. Pursuant to our academic standards, students who do not regularly attend class may, at my discretion, be prohibited from sitting for the final exam, resulting in a grade of “F” or being dropped from the class. Students for whom this may be an issue will receive a written warning before this final action, and may need to attend all remaining classes after the written warning is given. If you must miss a class because of a medical need, or serious familial, religious, or professional obligation, please email me at least 2 hours before class to request an excused absence. Class will be recorded and the recordings will be available for review, but attendance will be taken and watching the recording is not a substitute for attending class sessions.
Grading
Your grade will be based on your performance on the final exam and to a limited degree, your class participation.
Class Participation
I expect you to come prepared to participate in class discussion. Good preparedness requires both reading and thinking about the material before showing up in class. Because this is an upper-level course, we will not necessarily discuss every bit of the reading assignments at length. I do want you to read the material for a full understanding of the topic. I encourage questions about anything you find puzzling.
Please note that you will be assessed on the quality, not the quantity, of your participation (though there is certainly correlation). Quality does not mean giving the “correct” answer; thoughtful discussions are more important than facile answers. We will be exploring many new topics for which the answers may change year to year or even week to week, so the answer today might not be the answer tomorrow; it is much more important to learn how to reason through the issues. The key is to be prepared and engaged. Any poor assessment regarding your participation will be the result of protracted absence from class, unexcused lack of participation, disrespectful comments, or sustained evidence of lack of preparation and engagement.
You are expected to support each other as colleagues in a joint learning community. Each class member is entitled to your respect, your professionalism, and a presumption that their views are being offered in good faith—even if they are views with which you sharply disagree. My hope is that much of the conversation will proceed like a free-flowing seminar, and I expect and encourage respectful disagreement in class discussions. Such disagreement will allow us to more thoroughly address the different topics and will result in better learning opportunities.
Because you are assessed on quality, not quantity, I also ask that you also be cognizant of your speaking time. Some students will be especially keen to volunteer, which I appreciate — but sometimes I will stop calling on frequent speakers to get a diversity of voices. I will also call on students at random sometimes, because I do not want a small number of students to do the large majority of the talking. If you find that you are speaking often, please consider making space for others in the room who speak less frequently to have their turn.
Office Hours
My office hours will be by appointment, in my office, Room 3370. I’ll stick around as long as you have questions, until 1PM. If you cannot make that time or want to have a private conversation, please email me to schedule another time. My office hours are subject to change if required.
Video
Discussion, participation, and presence are essential to all law school classes. While we are online, I ask that each of you please turn on your video whenever possible so we can be as fully engaged as possible while in a remote setting. If you must turn your video off for personal reasons or for bandwidth reasons, please let me know in advance where possible, and please limit it to be the exception rather than the rule. Please note that I am requesting camera usage to aid classroom discussion and presence, not as a way to introduce surveillance into the class; if you have a momentary need to turn off your camera for whatever reason, please do so at your own discretion.
Privacy
Per University policy, UCLA Student Conduct Code 102.28 says that expectations of privacy apply, and it specifically prohibits recording without the consent of all recorded parties and prohibits taking photographs where there is a reasonable expectation of privacy. In remote teaching, advising, chatting, and other engagement in course activities remotely there is a reasonable expectation that photographing, screen capture, or other copying methods or recordings will not occur without express permission from all participants. A violation subjects a student to the disciplinary process. Do not record your courses, do not take screen shots of your classes, professors, or classmates, and do not release, post, email, text, or otherwise share or sell course materials to others.
Accommodations
UCLA Law strives to provide accommodations in a way that supports students with disabilities while maintaining their anonymity and the fundamental nature of our law program. As such, students needing academic accommodations should not contact their professors directly, but contact Carmina Ocampo, Director of Student Life or the UCLA Center for Accessible Education (CAE) When possible, students should start this process within the first two weeks of the semester, as reasonable notice is needed to coordinate accommodations.
Resources for Health and Wellness
Students needing assistance with medical or mental health issues, substance abuse, anxiety or depression or other health-related matters should contact the Office for Student Affairs, UCLA Counseling and Psychological Services (CAPS) at 310-825-0768 (Courtney Walters is the counselor regularly assigned to the law school) or the Ashe Student Health & Wellness Center at 310-825-4073.
Structure of the Course
- Part I: Foundations
- Constitutional Law
- Tort Law
- Consumer Protection
- Data Protection
- Part II: The Life Cycle of Data
- Collection
- Processing and Use
- Storage and Security
- Disclosures and Transfers
- Part III: Sector-Specific Regulation (specific topics subject to change)
- National Security
- Government Data Collection
- Employment
- Medical Information
- Biometric Information and Facial Recognition
- Part IV: Information, Power, and Inequality
Assignments
Reading assignments are below. Given the content, this course is still evolving, and I am not sure how fast we’ll move through it or precisely what we will and will not cover. Accordingly, the list begins with the first two weeks, and reading assignments will be updated here as needed to match our pace. Most of the readings will be from the casebook (CB) or supplement (Supp). The supplement and other readings will be posted in the course OneDrive, along with any other handouts.
The book contains “Practice” problems in many of the sections that are meant to get you thinking about how you might advise a client on the issues presented in that chapter. I suggest that you spend some of your reading time trying to work through them. I cannot promise that we will always discuss them in class, but my intent is to do so with some frequency.
The first two weeks of casebook assignments have been scanned and posted on MyLaw and in the OneDrive to give you time to buy the book.
Note: We will not meet on April 6. That class has been rescheduled to April 1, from 12:10-2pm, in Room 1337.
| Date | Assignment | Topic |
| 1/19 (Wed) | CB 1, 88–97; Cohen, Configuring the Networked Self Ch. 6 excerpt (pdf); Nissenbaum, Privacy in Context Ch. 7 excerpt (pdf); Skinner-Thompson, Privacy at the Margins, Ch. 1 (pdf) Heavy reading on the first day. I promise it won’t always be this much. These readings reflect the different theoretical foundations that we will refer back to throughout the course. It’s not important you memorize every detail of the arguments, and you can feel free to skim for the main points. I just wanted us to be able to access all these different perspectives to compare and discuss and think about why we’re all here. Before you read, try to come up with your own defintion of “privacy.” Then as you read, think about all the ways the concept of privacy is used or expressed in the readings. See if they fit with your definition, and if not, consider how your defintion might change. | Introduction: Perspectives on Privacy |
| 1/24 (Mon) | CB 3–21, Supp. 1-18 | Constitutional Law: Fourth Amendment |
| 1/26 (Wed) | CB 43–66; 715–722 | Constitutional Law: First Amendment; Substantive Due Process |
| 1/31 (Mon) | CB 66–86 | Other Constitutional Systems |
| 2/2 (Wed) | CB 97–129 | Tort Law: Intrusion & Disclosure |
| 2/7 (Mon) | CB 129–149; Supp. 19–20 (different excerpt of CDA § 230 than in the CB); CB 150–153; Supp 21–26; CB 157–163 Optional: Richards & Solove, Prosser’s Privacy Law (excerpt)(pdf) | Tort Law: Appropriation, False Light, Limitations |
| 2/9 (Wed) | CB 165-180; Supp. 27–49 | Consumer Protection: Self-Regulation & Privacy Policies, Consumer Lawsuits |
| 2/14 (Mon) | CB 200 (statutory language); Supp. 50–56; 213–227; Supp. 57–64 | Consumer Protection: FTC Privacy & Security Regulation |
| 2/16 (Wed) | CB 233–243; Supp. 65–77; CB 246–247 (Focus Note) | Consumer Protection: Scope of FTC Authority |
| 2/21 (Mon) | NO CLASS | PRESIDENT’S DAY |
| 2/23 (Wed) | Supp. 78–95, CPRA vs. CCPA chart | Consumer Protection: California Privacy Rights Act |
| 2/28 (Mon) | CB 257–261; Supp. 96–126; CB 300–302 | Data Protection: EU Law: GDPR + Enforcement |
| 3/2 (Wed) | CB 302–324; IAPP State Privacy Law Comparison Chart (pdf) Focus on the requirements of the new privacy laws in Virginia and Colorado. We will compare them to California and try to figure out together whether they fit the data protection or consumer protection mold and why that might be important. | Data Protection: COPPA, New State Statutes |
| 3/7 (Mon) | CB 325–380 | Collection: Cookies, Wiretap Act, SCA |
| 3/9 (Wed) | CB 381–411 | Processing and Use: Big Data, FCRA, EU Approach |
| 3/14 (Mon) | No new reading, really. Just read this op-ed on the new Algorithmic Accountability Act | Catch-up Day / Guest Speaker: Natasha Amlani on the privacy law in practice |
| 3/16 (Wed) | CB 413–438 | Storage & Security: PCI Case Study, Civil Suits |
| 3/21 (Mon) | NO CLASS | SPRING BREAK |
| 3/23 (Wed) | NO CLASS | SPRING BREAK |
| 3/28 (Mon) | (Reread CB 413–438), CB 438–455 | Storage & Security: PCI Case Study, Civil Suits, Best Practices, Breach Notification |
| 3/30 (Wed) | CB 456–460, Supp. 126–140; 141–156 | Storage & Security: CFAA; Disclosures and Transfers: International Data Transfers |
| 4/1 (Fri) (makeup class) | CB 520–547, 549–578 | Disclosures and Transfers: US Speech Protections; National Security: Foundations |
| 4/4 (Mon) | CB 578–610 | National Security: The Communications Metadata Controversy |
| 4/6 (Wed) | NO CLASS | CLASS CANCELED |
| 4/11 (Mon) | CB 611–649 | Government Data Collection |
| 4/13 (Wed) | CB 665–67, 678–714 | Employment and Privacy |
| 4/18 (Mon) | CB 731–732, 752–771, 774–788; HIPAA and Wearables; In re Flo Health Inc (a recent FTC action for a health app, just skim – you’ve seen these before); | Medical Privacy and Genetic Information |
| 4/20 (Wed) | Selinger & Leong, Ethics of Facial Recognition (pdf); Illinois BIPA (pdf); WA Facial Recognition Law (pdf) (skim section headings, read Secs. 3(23), 8, 14, 15); Commercial Facial Recognition Privacy Act (skim headings) | Biometrics & Facial Recognition |
| 4/25 (Mon) | Richards & Hartzog, A Relational Turn for Data Protection? (pdf); Barocas & Selbst, Big Data’s Disparate Impact (pdf, read Part I, skim Part II if desired); Strahilevitz, Privacy versus Anti-Discrimination (pdf) | Privacy and Power: Classification and Discrimination |
| 4/26 (Tue) | Bridges, Privacy Rights and Public Families (pdf); Gilman, Class Differential in Privacy Law (pdf); Virginia Eubanks interview | Privacy and Power: Poverty and State Control |
Andrew Selbst 