Se O. Tene & J. Polonetsky, "A Theory of Creepy: Technology, Privacy and Shifting Norms", Yale Journal of Law & Technology (2013) s. 59; se också R. Van Loo, "Technology Regulation by Default: Platforms, Privacy, and the CFPB", Georgetown Law Technology Review (2018) s. 531. Ett försök att identifiera olika slags information utifrån ett beteendevetenskapligt informerat ekonomiskt perspektiv görs i J. E. Cohen, "Irrational Privacy?", Journal on Telecommunications & High Technology Law (2012) s. 241. Datasäkerheten kan emellertid ses inte endast som ett "instrumentellt" ekonomiskt värde utan som ett "finalt" värde som är eftersträvansvärt i sig (se J. Farrell, "Can Privacy Be Just Another Good?", Journal on Telecommunications & High Technology Law (2012) s. 251). Natalie M. Banta diskuterar de digitala föremålsobjektens "feodala" drag och hur de avviker från vad som vanligen gäller beträffande äganderätten (se "Property Interests in Digital Assets: The Rise of Digital Feudalism", Cardozo Law Review (2017) s. 1099). De särskilda utmaningar som Big Data kan medföra för försäkringsväsendet diskuteras i M. N. Helveston, "Consumer Protection in the Age of Big Data", Washington University Law Review (2016) s. 859; R. Swedloff, "Risk Classification's Big Data (R)evolution", Connecticut Insurance Law Journal (2014) s. 339; P. Siegelman, "Information & Equilibrium in Insurance Markets with Big Data", Connecticut Insurance Law Journal (2014) s. 317; och Sh. Hoffman, "Medical Big Data and Big Data Quality Problem", Connecticut Insurance Law Journal (2014) s. 289. Motsvarande frågeställningar för kreditbedömningar diskuteras i M. Hurley & J. Adebayo, "Credit Scoring in the Era of Big Data", Yale Journal of Law & Technology (2016) s. 148. Paul Ohm har särskilt belyst utmaningarna med komplexa och icke-linjär tillväxt av datamängderna i "Regulating at Scale", Georgetown Law Technology Review (2018) s. 546. 1 4 Se K. L. Bergemann, "A Digitial Free Trade Zone and Necessarily-Regulated SelfGovernance for Electronic Commerce: The World Trade Organization, International Law, and Classical Liberalism", The John Marshall Journal of Information Technology & Privacy Law (2002) s. 595; se också redan M. Kirby, "Legal Aspects of Transborder Data Flows", The John Marshall Journal of Information Technology & Privacy Law (1991) s. 233; E. W. Ploman, "Transborder Data Flows: The International Legal Framework", The John Marshall Journal of Information Technology & Privacy Law (1981) s. 551; C. Manny, "Proposed Privacy Reform Legislation in Europe and its Effect on International Data Transfers", Business Law Review (2012) s. 75; och "Transborder Data Flow Regulation: Technical Issues of Legal Concern", The John Marshall Journal of Information Technology & Privacy Law (1981) s. 105. 15 Se P. J. Wantanabe, "An Ocean Apart: The Transatlantic Data Privacy Divide and the Right to Erasure", Southern California Law Review (2017) s. 1111; G. Drake, "Navigating the Atlantic: Understanding EU Data Privacy Compliance Amidst a Sea of Uncertainty", Southern California Law Review (2017) s. 163; P. M. Schwartz & K.-N. Pfifer, "Transatlantic Data Law", The Georgetown Law Journal (2017) s. 115; P. K. Yu, "The Political Economy of Data Protection", Chicago-Kent Law Review (2009) s. 777; R. Funta, "EU-USA Privacy Protection Legislation and the SWIFT Bank Data Transfer Regulation: A Short Look", Masaryk University Journal of Law and Technology (2011) s. 23; K. N. Rashbaum, M. Knauff & M. C. Albert, "U.S. Legal Holds Across Borders: A Legal Conundrum", North Carolina Journal of Law & Technology (2011) s. 69; P. M. Schwartz & D. J. Solove, "Reconciling Personal Information in the United States and European Union", California Law Review (2014) s. 877; C. Manny, "Recent Controversy Surrounding the EU – US Safe Harbor Data Protection Regime", Business Law Review (2014) s. 33, "Proposed Privacy Reform Legislation in Europe and its Effect on International Data Transfers", Business Law Review (2012) s. 75 och "Data Transfers from the EU to the U.S. After Schrems", Business Law Review (2016) s. 1; och redan H. Burkert, "Institutions of Data Protection – An Attempt at a Functional Explanation of European National Data Protection Laws", The John Marshall Journal of Information Technology & Privacy Law (1981) s. 167. M. J. Kelly och D. Satola talar om "an evolving transatlantic data struggle" (se "The Right to be Forgotten", University of Illinois Law Review (2017) s. 1), medan William McGeveran understryker likheterna i resultatet av dataskyddsmyndigheternas arbete i USA och EU (se "Friending the Privacy Regulators", Arizona Law Review (2016) s. 959). Naturligtvis är frågorna också viktiga inom EU ur den gemensamma marknadens perspektiv (se t.ex. R. Zallone, "Here, There and Everywhere: Mobility Data in the EU (Help Needed: Where is Privacy?", Santa Clara High Technology Law Journal (2013) s. 57 och U. U. Wuermeling, "Harmonisation of European Union Privacy Law", The John Marshall Journal of Information Technology and Privacy Law (1996) s. 411). Se allmänt, M. B. Sedgewick, "Transborder Data Privacy as Trade", California Law Review (2017) s. 1513; A. Zinser, "International Data Transfer Out of the European Union: The Adequate Level of Data Protection According to Article 25 of the European Data Protection Directive", The John Marshall Journal of Information Technology & Privacy Law (2003) s. 547; och A. D. Mitchell & J. Hepburn, "Don't Fence Me In: Reforming Trade and Investment Law to Better Facilitate Cross-Border Data Transfer", Yale Journal of Law & Technology (2017) s. 182. EU och Japan ingick nyligen en överenskommelse som kan möjliggöra "världens största frihandelsområde för säkra dataöverföringar" (M. Khan, "EU and Japan strike data flow deal", Financial Times 2018-07-17 (https:// www.ft.com/content/ee7e8bca-89a5-11e8-b18d-0181731a0340)). 16 Se M. Rotenberg & D. Jacobs, "Updating the Law of Information Privacy: The New Framework of the European Union", Harvard Journal of Law & Public Policy (2013) s. 605; J. Ph. Albrecht, "How the GDPR Will Change the World", European Data Protection Law Review (2016) s. 287; och M. Clear, "Falling Into the Gap: The Eur opean Union's Data Protection Act and its Impact on U.S. Law and Commerce", The John Marshall Journal of Information Technology and Privacy Law (2000) s. 981. 17 Se D. J. B. Svantesson, "Extraterritoriality in the Context of Data Privacy Regulation", Masaryk University Journal of Law and Technology (2013) s. 87 och "The (Un)Certain Future of Online Data Privacy", Masaryk University Journal of Law and Technology (2015) s. 129 (s. 131 ff.). Dataskyddsfrågorna har också en internationellt privat- och processrättslig aspect (se I. Revolidis, "Judicial Jurisdiction over Internet Privacy Violations and the GDPR: A Case of 'Privacy Tourism'?", Masaryk University Journal of Law and Technology (2017) s. 7). 18 Jfr Zallone (2013). Michael Birnhack ("Reverse Engineering Information Privacy Law", Yale Journal of Law and Technology (2013) s. 23) kallar EU:s reglering "the engine of data protection law" (s. 24). Så har exempelvis "rätten att glömma" – som slogs fast av EUD i målet C-131/12 Google Spain mot Agencia Española de Protección de Datos, ECLI:EU:C:2014:317 (2014) (se Svantesson (2015) s. 141 ff.) – väckt uppmärksamhet och diskuterats också utanför EU. Se t.ex. Wantanabe (2017); M. Cunningham, "Privacy Law That Does not Protect Privacy, Forgetting the Right to Be Forgotten", Buffalo Law Review (2017) s. 495; H. Kranenborg, "Google and the Right to Be Forgotten", European Data Protection Law Review (2015) s. 70; D. Hoffman, P. Bruening & S. Carter, "The Right to Obscurity: How We Can Implement the Google Spain Decision", North Carolina Journal of Law & Technology (2016) s. 437; C. Manny, "The European Union's 'Right to be Forgotten'", Business Law Review (2015) s. 51; Kelly & Satola (2017); L. Siry, "Forget Me, Forget Me Not: Reconciling Two Different Paradigms for the Right to be Forgotten", Kentucky Law Journal (2014—2015) s. 311; P. Sánchez Abril & J. D. Lipton, "The Right to be Forgotten: Who Decides What the World Forgets?", Kentucky Law Journal (2014—2015) s. 363. Se också t.ex. Balaban (2009); R. Sh. R. Ku, "Data Privacy as a Civil Right: The EU Gets It?", Kentucky Law Journal (2014—2015) s. 391; A. Forde, "Implications of the Right to be Forgotten ", Tulane Journal of Technology and Intellectual Property (2015) s. 83; A. Tamò & D. George, "Oblivion, Erasure and Forgetting in the Digital Age", Journal of Intellectual Property, Information Technology and E-Commerce Law (2014) s. 71; och P. Sanchez Abril & E. Pizarro Moreno, "Lux In Arcana: Decoding the Right to Be Forgotten in Digital Archives", Laws (2016) s. 33. – Internationella jämförelser görs i Chatterjee (2018). 19 Se S. Simitis, "Privacy—An Endless Debate?", California Law Review (2010) s. 1989; J. Wagner DeCrew, "Privacy and Its Importance with Advancing Technology", Ohio Northern University Law Review (2016) s. 471; Alessandra Suuberg, "The View From the Crossroads: The European Union's New Data Rules and the Future of U.S. Privacy Law", Tulane Journal of Technology and Intellectual Property (2013) s. 267; S. Diorio, "Data Protection Laws: Quilts Versus Blankets", Syracuse Journal of International Law & Commerce (2015) s. 485; och P. Perri & D. Thaw, "Ancient Worries and Modern Fears: Different Roots and Common Effects of U.S. and E.U. Privacy Regulation", Connecticut Law Review (2017) s. 1621. 20 K. F. King, "Personal Jurisdiction, Internet Commerce, and Privacy: the Pervasive Legal Consequences of Modern Geolocations Technologies", Albany Law Journal of Science and Technology (2011) s. 61. 21 Se E. F. Judge & T. E. Brown, "A Right Not to Be Mapped? Augmented Reality, Real Property, and Zoning", Laws (2018) s. 23. 22 M. S. Kirsch, "Do Not Track: Revising the EU’s Data Protection Framework to Require Meaningful Consent for Behavioral Advertising", Richmond Journal of Law and Technology (2011) s. 1 och K. F. King, "Personal Jurisdiction, Internet Commerce, and Privacy: The Pervasive Legal Consequences of Modern Geolocation Technologies", Albany Law Journal of Science & Technology (2011) s. 61. 23 Se J. Dunagin, "Incoming: Regulating Drones in Oklahoma", Oklahoma Law Review (2017) s. 457; R. H. Gruber, "Commercial Drones and Privacy: Can We Trust States with ‘Drone Federalism’?", Richmond Journal of Law and Technology (2015) s. 1; T. T. Takahashi, "Drones and Privacy", The Columbia Science & Technology Law Review (2012) s. 72; J. J. Vacek, "Remote Sensing of Private Data by Drones is Mostly Unregulated: Reasonable Expectations of Privacy are at Risk Absent Comprehensive Federal Legislation", North Dakota Law Review (2014) s. 463; och J. Frankle, "For Drone Operators, Privacy is Key for Smooth Takeoff and Landing", Georgetown Law Technology Review (2016) s. 125. 24 Se A. G. Ferguson, "The Internet of Things and the Fourth Amendment of Effects", California Law Review (2016) s. 805; R. Kester, "Demystifying the Internet of Things: Industry Impact, Standardization Problems, and Legal Considerations", Elon Law Review (2016) s. 205; W. Hartzog & E. Selinger, "The Internet of Heirlooms and Disposable Things", North Carolina Journal of Law & Technology (2016) s. 581; A. D. Thierer, "The Internet of Things and Wearable Technology: Addressing Privacy and Security Concerns without Derailing Innovation ", Richmond Journal of Law and Technology (2015) s. 1; S. S. Beale & P. Berris, "Hacking the Internet of Things: Vulnerabilities, Dangers, and Legal Responses", Duke Law & Technology Review (2018) s. 161; A. Peyton, "The Connected State of Things: A Lawyer’s Survival Guide in an Internet of Things World ", Catholic University Journal of Law and Technology (2016) s. 369; S. Poudel, "Internet of Things: Underlying Technologies, Interoperability, and Threats to Privacy and Security", Berkeley Technology Law Journal (2016) s. 997; R. H. Weber, "Governance of the Internet of Things—From Infancy to First Attempts of Implementation?", Laws (2016) s. 28; och Santesson (2015). 25 Se B. L. Bollinger, "The Security and Privacy in Your Car Act: Will It Actually Protect You?", North Carolina Journal of Law & Technology (2017) s. 214. 26 Se S. Ducich, "These Walls Can Talk! Securing Digital Privacy in the Smart Home Under the Fourth Amendment", Duke Law & Technology Review (2018) s. 278; se också S. M. Stern, "The Inviolate Home: Housing Exceptionalism in the Fourth Amendment", Cornell Law Review (2010) s. 905. 27 Se J. L. Hubley, "Online Consent and the On-Demand Economy: An Approach for the Millennial Circumstance", Hastings Science and Technology Law Journal (2016) s. 1 och A. Armitage, A. K. Cordova & R. Siegel, "Design Thinking: The Answer to the Impasse Between Innovation and Regulation", Georgetown Law Technology Review (2017) s. 3. 28 Se D. Parisi, "Mobile App Privacy: Developing Standard and Effective Privacy Tools for Consumers", North Carolina Journal of Law & Technology (2014) s. 240. 29 Se M. L. McLellan, J. A. Sherer & E. R. Fedeles, "Wherever You Go, There You Are (With Your Mobile Device): Privacy Risks and Legal Complexities Associated with International 'Bring Your Own Device' Programs", Richmond Journal of Law & Technology (2015) s. 1 30 För svensk rätt, se lagen (2010:566) om vidareutnyttjande av handlingar från den offentliga förvaltningen, som implementerar Europaparlamentets och rådets direktiv 2003/98/EG om vidareutnyttjande av information från den offentliga sektorn. 31 Se J. Ledendal, S. Larson & J. Wernberg, Offentlighet i det digitala samhället. Vidareutnyttjande, sekretess och dataskydd (2018) och M. van Eechoud, "Making Access to Government Data Work", Masaryk University Journal of Law and Technology (2016) s. 61; se också F. Z. Borgesius, J. Gray & M. van Eechoud, "Open Data, Privacy, and Fair Information Principles: Towards a Balancing Framework", Berkeley Technology Law Journal (2015) s. 2073. 32 Se Zs. Bódogh, "Privacy Issues of the Internet Search Engines – in the Light of EU Data Protection Legislation", Masaryk University Journal of Law and Technology (20 11) s. 163 och A. H. Stuart, "Google Search Results: Buried if Not Forgotten", North Carolina Journal of Law & Technology (2014) s. 463. 33 A. C. DeVore, "Cloud Computing: Privacy Storm on the Horizon?", Albany Law Journal of Science and Technology (2010) s. 365 och P. M. Schwartz, "Information Privacy in the Cloud", University of Pennsylvania Law Review (2013) s. 1623. 34 Se L. Barrett, "Deconstructing Data Mining: Protecting Privacy and Civil Liberties in Automated Decision-Making", Georgetown Law Technology Review (2016) s. 153. 35 Se B. Bodo, H. Helberger, K. Irion, F. Zuiderveen Borgesius, J. Moller, B. van de Velde, N. Bol, B. van Es & C. de Vreese, "Tackling the Algorithmic Control Crisis – the Technical, Legal, and Ethical Challenges of Research into Algorithmic Agents", Yale Journal of Law & Technology (2017) s. 133. 36 Se J. A. Dillard, "Big Brother Is Watching: The Reality Show You Didn't Audition For", Oklahoma Law Review (2011) s. 461; D. H. Goetz, "Locating Locating Privacy", Berkeley Technology Law Journal (2011) s. 823; A. M. Wright, "Civil Society and Cybersurveillance", Arkansas Law Review (2017) s. 745; C. Burten, "Unwarranted! Privacy in a Technological Age: The Fourth Amendment Difficulty in Protecting Against Warrantless GPS Tracking and the Substantive Due Process and First Amendment Boost", Southern California Interdisciplinary Law Journal (2012) s. 359; E. Pait, "Find My Suspect: Tracking People in the Age of Cell Phones", Georgetown Law Technology Review (2017) s. 155; D. Moussa, "Protecting Privacy in our Financial Transactions: An Alternative Method to Thinking about our Privacy in the Digital Era", Georgetown Law Technology Review (2017) s. 342; B. Turner, "When Big Data Meets Big Brother: Why Courts Should apply Unites States v. Jones to Protect People's Data", North Carolina Journal of Law & Technology (2015) s. 377; C. Cohn, "Lawless Surveillance, Warrantless Rationales", Journal on Telecommunications and High Technology Law (2010) s. 351; J. M. Paulson, "Cyber Insecurity: Constitutional Rights in the Digital Era", Southern Illinois University Law Journal (2017) s. 261; R. H. Thornburg, "Face Recognition Technology: The Potential Orwellian Implications and Constitutionality of Current Uses Under the Fourth Amendment", The John Marshall Journal of Information Technology & Privacy Law (2002) s. 321; S. McCoy, "O' Big Brother Where Art Thou?: The Constitutional Use of FacialRecognition Technology", The John Marshall Journal of Information Technology & Privacy Law (2002) s. 471; och S. Freiwald, "Online Surveillance: Remembering the Lessons of the Wiretap Act", Alabama Law Review (2004) s. 9. Eftersom "[f]ree communication is the most subversive practice of all" (M. Castells, Communication Power, 2u (2013) s. xxi) är det föga förvånande att den kinesiska regimen har utnyttjat den nya teknikens panoptiska potential i mycket hög grad (se N. Ferguson, The Square and the Tower (2017) s. 413 ff.); men t.ex. (och i synnerhet) den federala amerikanska regeringen besitter i princip samma åtminstone teknologiska kapacitet (se Ferguson (2017) s. 394; se också J. Heidenreich, "The Privacy Issues Presented by the Cybersecurity Information Sharing Act", North Dakota Law Review (2015) s. 395; A. Chander & U. P. Lê, "Data Nationalism", Emory Law Journal (2015) s. 678; och J. Reed, "US legislators urge Facebook, Google to store data outside Vietnam", Financial Times 2018-07-17 (https://www.ft.com/content/e8a1b772-899b11e8-bf9e-8771d5404543)). Alla stater fruktar ett fritt informationsflöde, eftersom den politiska makten vanligen har byggt på informationskontroll (se Castells (2001) s. xxi och xxiii). 37 Se A. M. Froomkin, "Government Data Breaches", Berkeley Technology Law Journal (2009) s. 1019. Genom den ogenerade bristen på respekt för dataskyddslagstiftningen som myndigheter som t.ex. den svenska Transportstyrelsen har visat, är det inte nödvändigtvis en lösning att medge informationsdelning inom begränsade kretsar eller för begränsade syften (som föreslås i M. D. Fan, "Private Data, Public Safety: A Bounded Access Model of Disclosure", North Carolina Law Review (2015) s. 161). Myndigheter – dvs. inkl. myndigheternas högsta företrädare – är helt enkelt inte tillräckligt pålitliga för att en aldrig så "stark" normgivning skulle räcka som skydd. 3 8 Se S. W. Brenner, "Law, Dissonance, and Remote Computer Searches", North Carolina Journal of Law & Technology (2012) s. 43. 39 Se O. H. Dombalagan, "Regulating Informational Intermediation", American University Business Law Review (2011) s. 58. Jfr P. C. Leyens, Informationsintermediäre des Kapitalmarkts (2017). Niall Ferguson har noterat den märkliga förkärleken hos främst europeiska politiker att delegera den av dem själva åstundade censuren till de dominerande privata aktörerna; som därmed blir ännu starkare (se Ferguson (2017) s. 412 f.). 40 Se P. Ohm, "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization", UCLA Law Review (2010) s. 1701; se också Y. Lagos, "Taking the Personal Out of Data: Making Sense of De-Identification", Indiana Law Review (2014) s. 187. 41 Se D. Green, "Big Brother is Listening to You: Digital Eavesdropping in the Advertising Industry", Duke Law & Technology Review (2018) s. 353; A. S. Bohm, E. J. George, B. Cyphers & Sh. Lu, "Privacy and Liberty in an Always-On, AlwaysListening World", The Columbia Science & Technology Law Review (2017) s. 1; och redan D. J. Klein, "Keeping Business Out of the Bedroom: Protecting Personal Privacy Interests from the Retail World", The John Marshall Journal of Technology and Privacy Law (1997) s. 391. Dessa ansträngningar leder till konstitutionella utmaningar i länder där åsiktsfriheten är särskilt skyddad (för svensk del, se t.ex. D. Hanqvist, "The Empire Strikes Back – EU, åsiktsfriheten och kreditvärderingsinstituten", SvJT 2016 s. 687, "The Phantom Menace – Duplik till Magnus Schmauch om kreditbetyg och annan 'kommersiell yttrandefrihet', åsiktsfriheten och konstitutionellt styre", SvJT 2017 s. 48 och "Rara temporum felicitate: åsiktsfrihet och EU-förordningen om referensvärden", JP 2018 s. 147; för USA, se t.ex. J. R. Bambauer & D. E. Bambauer, "Information Libertarianism", California Law Review (2017) s. 335). Adam Thierer menar att det europeiska exemplet är av mindre relevans för USA p.g.a. att man i USA skulle värdera yttrandefrihet och e-handel högre än i Europa (se "The Pursuit of Privacy in a World Where Information Control Is Failing", Harvard Journal of Law & Public Policy (2013) s. 409 (s. 411 f.); se också Wantanabe (2017) s. 1122 ff.). Rättsordningen måste också hantera hur tillgången till data hos sociala medier hanteras t.ex. avseende edition i civilprocessen (se A. McPeak, "Social Data Discovery and Proportional Privacy", Cleveland Law Review (2016) s. 59). 42 Se J. A. Fisher, "Secure My Data or Pay the Price: Consumer Remedy for the Negligent Enablement of Data Breach", William & Mary Business Law Review (2013) s. 215. 43 J. R. Reidenberg, "The Transparent Citizen", Loyola University Chicago Law Journal (2015) s. 437. 44 Se R. A. Ford, "Unilateral Invasions of Privacy", Notre Dame Law Review (2016) s. 1075 45 Se S. B. Toeniskoetter, "Preventing A Modern Panopticon: Law Enforcement Acquisition Of Real-Time Cellular Tracking Data", Richmond Journal of Law and Technology (2007) s. 1. Det panoptiska perspektivet diskuteras också i B.-J. Koops & R. Leenes, "'Code' and the Slow Erosion of Privacy", Michigan Telecommunications and Technology Law Review (2005) s. 115 (s. 117 f.). Se också B. E. Thon & C. Nes, "Controlling the Algorithms", European Data Protection Law Review (2017) s. 16 och T. Wu, The Attention Merchants (2016), kap. 19. 46 Framväxten av olika normer för informationshanteringen på webbsidor diskuteras i S. A. Hetcher, "The Emergence of Website Privacy Norms", Michigan Telecommunications and Technology Law Review (2000–2001) s. 97; se också K. K. Sty lianou, "An Evolutionary Study of Cloud Computing Services Privacy Terms", The John Marshall Journal of Computer and Information Law (2010) s. 593. 47 Se också J. Míšek, "Consent to Personal Data processing – the Panacea or a Dead End?", Masaryk University Journal of Law and Technology (2014) s. 69; Santesson (2015) s. 148 f.; Y. Hermstrüwer, "Contracting Around Privacy. The (Behavioral) Law and Economics of Consent and Big Data", Journal of Intellectual Property, Information Technology and E-Commerce Law (2017) s. 9; Ch. E. MacLean, "It Depends: Recasting Internet Clickwrap, Browsewrap, 'I Agree,' and Click-Through Privacy Clauses as Waivers of Adhesion", Cleveland State Law Review (2016) s. 43; K. P. McLaughlin, "Sharing You with You: Informational Privacy, Google, & the Limits of Use Limitation", Albany Law Journal of Science and Technology (2013) s. 55; J. A. Rothchild, "Against Notice and Choice: The Manifest Failure of the Proceduralist Paradigm to Protect Privacy Online (Or Anywhere Else)", Cleveland State Law Review (2018) s. 559; J. S. Livingston, "Invasion Contracts: The Privacy Implications of Terms of Use Agreements in the Online Social Media Setting", Albany Law Journal of Science and Technology (2011) s. 591; Sh. Monteleone, "Addressing the 'Failure' of Informed Consent in Online Data Protection: Learning the Lessons from Behaviour-Aware Regulation", Syracuse Journal of International Law & Commerce (2015) s. 69; och Aa. T. Chiu, "Irrantionality Bound: Terms of Use Licenses and the Breakdown of Consumer Rationality in the Market for Social Network Sites", Southern California Interdisciplinary Law Journal (2011) s. 165. 48 Se t.ex. C. Schmierer, "Better Late than Never: How the Online Advertising Industry’s Response to Proposed Privacy Legislation Eliminates the Need for Regulation", Richmond Journal of Law and Technology (2011) s. 1; K. Z. Oussayef, "Selective Privacy: Facilitating Market-Based Solutions to Data Breaches by Standardizing Internet Privacy Policies", B.U. Journal of Science & Technology Law (2008) s. 104; R. M. Marsh, Jr., "Legislation for Effective Self-Regulation: A New Approach to Protecting Personal Privacy on the Internet", Michigan Telecommunications and Technology Law Review (2009) s. 543; och D. Skivington, "Self Regulation or Privacy Legislation", Albany Law Journal of Science and Technology (2010) s. 393. 49 Behovet av en tekniskt upplyst lagstiftning understryks i J. Park, "VPN: Privacy and Anonymity for All", Georgetown Law and Technology Review (2017) s. 129. 50 J. S. Levy, "Towards a Brighter Fourth Amendment: Privacy and Technology Change", Virginia Journal of Law & Technology (2011) s. 502; jfr A. Rallo, "Privacy and Freedeom", European Data Protection Law Review (2018) s. 150. 51 https://fil.forbrukerradet.no/wp-content/uploads/2018/06/2018-06-27-deceivedby-design-final.pdf, s. 3. Se också D. K. Mulligan & K. A. Bamberger, "Saving Governance-By-Design", California Law Review (2018) s. 697; A. Bunn, "Facebook and Face Recognition: Kinda Cool, Kinda Creepy", Bond Law Review (2013) s. 35; L. A. Strachan, "Re-Mapping Privacy Law: How the Google Maps Scandal Requires Tort Law Reform", Richmond Journal of Law and Technology (2011) s. 1; A. Kirchner, "Reflections on Privacy in the Age of Global Electronic Data Processing with a Focus on Data Processing Practices of Facebook", Masaryk University Journal of Law and Technology (2012) s. 73; I. S. Rubenstein & N. Good, "Privacy by Design: A Counter"default settings and dark patterns, techniques and features of interface design meant to manipulate users, are used to nudge users towards privacy intrusive options. The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-orleave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users. Facebook and Google have privacy intrusive defaults, where users who want the privacy friendly option have to go through a significantly longer process. They even obscure some of these settings so that the user cannot know that the more privacy intrusive option was preselected. The popups from Facebook, Google and Windows 10 have design, symbols and wording that nudge users away from the privacy friendly choices." fact ual Analysis of Google and Facebook Privacy Incidents ", Berkeley Technology Law Journal (2013) s. 1333; och G. S. Hans, "Privacy Policies, Terms of Service, and FTC Enforcement: Broadening Unfairness Regulation for a New Era", Michigan Telecommunications and Technology Law Review (2012) s. 163. 52 Se t.ex. "Privacy by Design. The 7 Foundational Principles", https:// www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.pdf. 53 Artikel 25 diskuteras, analyseras och utvärderas som en del av privacy by designrörelsen i L. A. Bygrave, "Data Protection by Design and by Default: Deciphering the EU's Legislative Requirements", Oslo Law Review (2017) s. 105. 54 Se https://www.datainspektionen.se/lagar--regler/dataskyddsforordningen /inbyggt-dataskydd-och-dataskydd-som-standard/. 55 European Data Protection Supervisor, Opinion 5/2018, Preliminary Opinion on privacy by design (https://edps.europa.eu/sites/edp/files/publication/18-05-31 _preliminary_opinion_on_privacy_by_design_en_0.pdf). Avsnitt 1: Varför design ska tas på allvar i dataskyddslagstiftningen Kapitel 1: Varför design är allt Kapitel 2: Frånvaron av design inom integritetsrätten Avsnitt 2: En agenda för design inom integritetsrätten Kapitel 3: Integritetsvärderingar inom design Kapitel 4: Gränser för design Kapitel 5: Verktygslåda för integritetsdesign Avsnitt 3: Tillämpning av integritetsplanen Kapitel 6: Sociala media Kapitel 7: Teknologier för kurragömma Kapitel 8: Internet of Things 5 6 Hartzog är inte ensam om detta anslag. Ett liknande anslag – delvis med överlappande terminologi – ges av A. E. Waldman i "Privacy, Notice, and Design", Stanford Technology Law Review (2018) s. 74. Se också Koops & Leenes (2005); I. S. Rubinstein, "Regulating Privacy by Design", Berkeley Technology Law Journal (2011) s. 1409; E. Everson, "Privacy by Design: Taking Ctrl of Big Data", Cleveland State Law Review (2016) s. 27; och D. Krebs, "'Privacy by Design': Nice-to-have or a Necessary Principle of Data Protection Law?", Journal of Intellectual Property, Information Technology and E-Commerce Law (2013) s. 2. Kritiska synpunkter på privacy by default diskuteras i L. E. Willis, "Why Not Privacy by Default?", Berkeley Technology Law Journal (2014) s. 61. 57 Se D. A Norman, The Design of Everyday Things (2013) s. 4. Boken är den uppdaterade versionen av hans banbrytande The Psychology of Everyday Things (1988). Den nya upplagan är explicit uppdaterad inte minst med hänsyn till internet och digitaliseringen. 58 Se Castells (2013) s. xxv. 59 Uttrycket ska ha myntats av Lawrence Lessig i slutet av 1990-talet. Se också Koops & Leenes (2005) och P. De Filippi & Aa. Wright, Blockchain and the Law (2018), med underrubriken "The Rule of Code", och C. L. Reyes, "Conceptualizing Cryptolaw", Nebraska Law Review (2017) s. 384. 6 0 Se också J. Grimmelmann, "Privacy as Product Safety", Widener Law Journal (2010) s. 793. Ett slags konsumentskydd kan komma att behövas också inom andra delar av regleringen av informationsekonomin än dataskyddet, i takt med att allt fler funktioner – som tidigare utfördes av människor – nu utförs av informationsbehandlande maskiner (se D. C. Vladeck, "Consumer Protection in an Era of Big Data Analytics", Ohio Northern Univeristy Law Review (2016) s. 493). Generellt kan regleringen av olika marknader behöva ta mer hänsyn till hur icke-verbal kommunikation påverkar särskilt konsumenters beslut (se Sh. I. Becher & Y. Feldman, "Manipulationg, Fast and Slow: The Law of Non-Verbal Market Manipulations", Cardozo Law Review (2016) s. 459). – Mer allmänt kan cybersäkerheten behöva utvecklas, både tekniskt men även konceptuellt (se R. Weinstein, "Cybersecurity: Getting Beyond Technical Compliance Gaps ", N.Y.U. Journal of Legislation and Public Policy (2016) s. 913). Exempelvis ökade antalet anmälda fall av olovlig identitetsanvändning (inklusive kort- och kreditbedrägerier och skapande och kapningar av befintliga konton, framförallt på sociala medier) under det första halvåret 2018 med omkring 24 % jämfört med samma period i året innan (se Polisens Nationella bedrägericenter, "Brottsutvecklingen i riket", juni 2018, s. 11). Vad gäller cybersäkerhet menar Andra M. Matwyshyn att det inte i praktiken går separera den privata från den nationella cybersäkerheten (se "Cyber!", BYU Law Review (2017) s. 1109; se också N. A. Sales, "Regulating Cyber-Security", Northwestern University Law Review (2013) s. 1503 och "Privatizing Cybersecurity", U.C.L.A. Law Review (2018) s. 620; J. A. Cilek, "Cybersecurity Dilemma: Keeping Data Regulations Effective in the Online Age", Loyola University Chicago Journal of Regulatory Compliance (2016) s. 45; och J. Hurwitz, "Cyberensuring Security", Connecticut Law Review (2017) s. 1495). Inom EU har cybersäkerheten blivit föremål för harmoniserad lagstiftning (se Europaparlamentets och rådets direktiv (EU) 2016/1148 av den 6 juli 2016 om åtgärder för en hög gemensam nivå på säkerhet i nätverks- och informationssystem i hela unionen), som för svensk del har resulterat i lagen (2018:1174) om informationssäkerhet för samhällsviktiga och digitala tjänster, som trädde i kraft 2018-08-01 (se SOU 2017:36 och prop. 2017/18:205). 61 Se Norman (2013) s. xiv. 62 Se Norman (2013) s. 6. Norman kritiserar ingenjörer för att inte acceptera mänskligheten som hon är. Det är nog aningen överdrivet. En mer teknisk – och mer "ingenjörslik" – behandling av design ur just det faktiskt, empiriskt belagda mänskliga beteendets perspektiv är M. S. Sanders & E. J. McCormick, Human Factors in Engineering and Design (1987), som alltså kom ut året före Normans första upplaga (och som var kursbok när jag studerande ämnet vid universitetet i Lund). 63 Se också N. Richards & W. Hartzog, "Taking Trust Seriously in Privacy Law", Stanford Technology Law Review (2016) s. 431 ("privacy can and should be thought of as enabling trust in our essential information relationships") och R. H. Sloan, ""I'll See": How Surveillance Undermines Privacy By Eroding Trust", Santa Clara High Technology Law Journal (2016) s. 221. 6 4 Se R. Calo, "Privacy and Markets: A Love Story", Notre Dame Law Review (2016) s. 649. Viktor Mayer-Schönberger har argumenterat för ett mer nyanserat system för "information governance" (se "Beyond Privacy, Beyond Rights—Toward a 'Systems' Theory of Information Governance", California Law Review (2010) s. 1853. 65 Se också W. Hartzog & E. Selinger, "The Case for Online Obscurity", California Law Review (2013) s. 1 och "Surveillance as Loss of Obscurity", Washington & Lee Law Review (2015) s. 1343; Hoffman, Bruening & Carter (2016); och O. Tene & J. Polonetsky, "Judged by the Tin Man: Individual Rights in the Age of Big Data", Journal on Telecommunications and High Technology Law (2013) s. 351 (s. 362 ff.). Ett liknande perspektiv ges också I H. R. Anderson, "Plotting Privacy as Intimacy", Indiana Law Review (2013) s. 311. 66 Se B. T. Crowther, "(Un)Reasonable Expectations of Digital Privacy", BYU Law Review (2012) s. 343; M. Hirose, "Privacy in Public Spaces: The Reasonable Expectation of Privacy Against the Dragnet Use of Facial Recognition Technology", Connecticut Law Review (2017) s. 1591; B. C. Newell, "Rethinking Reasonable Expectations of Privacy in Online Social Networks", Richmond Journal of Law and Technology (2011) s. 1; G. Skok, "Establishing a Legitimate Expectation of Privacy in Clickstream Data", Michigan Telecommunications and Technology Law Review (1999– 2000) s. 61; F. H. Cate & R. Litan, "Constitutional Issues in Information Privacy", Michigan Telecommunications and Technology Law Review (2002) s. 35; D. A. Sklansky, "Too Much Information: How Not to Think About Privacy and the Fourth Amendment", California Law Review (2014) s. 1069; B. Mund, "Social Media Searches and the Reasonable Expectation of Privacy", Yale Journal of Law & Technology (2017) s. 238; och R. L. Weaver, "Privacy in an Age of Advancing Technology", Mississippi Law Journal (2012) s. 975. Se också L. F. Cranor, "Necessary but Not Sufficient: Standardized Mechanisms for Privacy Notice and Choice", Journal on Telecommunications and High Technology Law (2012) s. 273. Inte minst skulle ett skydd som bygger på Hartzogs obscurity-modell kunna användas för att bättre skydda privatlivet för personer som tabloidpressen anser sig ha ett legitimt intresse av att skildra i detalj (problematiken behandlas i C. L. Crisci, "All the World is Not a Stage: Finding a Right to Privacy in Existing and Proposed Legislation", N.Y.U. Journal of Legislation and Public Policy (2002) s. 207). 6 7 Jfr D. Hanqvist, Lagen om förvaltare av alternativa investeringsfonder. En kommentar (2016) s. 65 och 879. 68 Se också J. A. Fischer, "Secure My Data or Pay the Price: Consumer Remedy for the Negligent Enablement of Data Breach", William & Mary Business Law Review (2013) s. 215. 69 Se M. Bimhack, "Reverse Engineering Informational Privacy Law", Yale Journal of Law and Technology (2013) s. 24. Sålunda bygger 2 kap. 11 § andra stycket, 12 §, 15 § tredje stycket och 21 § andra stycket, liksom de därtill anslutande 2 kap. 2 § andra och tredje styckena UB, på tekniken med skriftliga handlingar och har endast delvis moderniserats genom HD:s avgörande i NJA 2017 s. 769. 7 0 Se J. M. Balkin, "Information Fiduciaries and the First Amendment", UC Davis Law Review (2016) s. 1183 och A. Dobkin, "Information Fiduciaries in Practice: Data Privacy and User Expectations", Berkeley Technology Law Journal (2018) s. 1. 71 Se C. D. Southard IV, "Individual Privacy and Government Efficiency: Technology's Effect on the Government's Ability to Gather, Store, and Distribute Information", The John Marshal Journal of Information Technology and Privacy Law (1989) s. 359. Även inom detta område behövs ordentliga cost/benefit-analyser (se A. Thierer, "A Framework for Benefit-Cost Analysis In Digital Privacy Debates", George Mason Law Review (2013) s. 1055; men se också J. Rosen, "Keeping Google Good: Remarks on Privacy Regulation and Free Speech", George Mason Law Review (2013) s. 1003). 72 Se G. Hosein, "Returning to a Principled Basis for Data Protection", ChicagoKent Law Review (2009) s. 803; F. Fagan, "Systemic Social Media Regulation", Duke Law & Technology Review (2018) s. 394; och Ei. Jungar, "Mind the Gap – Regulation Meets Reality", JP 2016 s. 27. 73 Se I. D. Manta, "Choosing Privacy", N.Y.U. Journal of Legislation and Public Policy (2017) s. 649; K. Wallman, "The Tension Between Privacy and Security: An Analysis Based on Coase and Pigou", Journal on Telecommunications and High Technology Law (2005) s. 397; A. K. Kasaudhan, "Surveillance and right to privacy: Issues and challenges", International Law Journal (2017) s. 73; och B. Schweiger, "Safety vs. Security: How Broad but Selective Public Access to Environmental Data Properly Balances Communities' Safety and Homeland Security", The John Marshall Journal of Information Technology & Privacy Law (2008) s. 273. 7 4 Se L. Reilly, "Automatic Consumer Privacy Rights Embedded in Smart Grid Technology Standards by the Federal Government", Vermont Law Review (2011) s. 471 75 Se M. J. Woods, "Data Retention Requirements And Outsourced Analysis: Should Private Entities Become Government Surrogates In The Collection of Intelligence?", American University Business Law Review (2014) s. 49; Ch. Soghoian, "Caught in the Cloud: Privacy Encryption, and Government Back Doors in the Web 2.0 Era", Journal on Telecommunications and High Technology Law (2010) s. 359; och redan N. A. Crain, "Bernstein, Karn, and Junger: Constitutional Challenges to Cryptographic Regulations", Alabama Law Review (1999) s. 869.
Se O. Tene & J. Polonetsky, "A Theory of Creepy: Technology, Privacy and Shifting Norms", Yale Journal of Law & Technology (2013) s. 59; se också R. Van Loo, "Technology Regulation by Default: Platforms, Privacy, and the CFPB", Georgetown Law Technology Review (2018) s. 531. Ett försök att identifiera olika slags information utifrån ett beteendevetenskapligt informerat ekonomiskt perspektiv görs i J. E. Cohen, "Irrational Privacy?", Journal on Telecommunications & High Technology Law (2012) s. 241. Datasäkerheten kan emellertid ses inte endast som ett "instrumentellt" ekonomiskt värde utan som ett "finalt" värde som är eftersträvansvärt i sig (se J. Farrell, "Can Privacy Be Just Another Good?", Journal on Telecommunications & High Technology Law (2012) s. 251). Natalie M. Banta diskuterar de digitala föremålsobjektens "feodala" drag och hur de avviker från vad som vanligen gäller beträffande äganderätten (se "Property Interests in Digital Assets: The Rise of Digital Feudalism", Cardozo Law Review (2017) s. 1099). De särskilda utmaningar som Big Data kan medföra för försäkringsväsendet diskuteras i M. N. Helveston, "Consumer Protection in the Age of Big Data", Washington University Law Review (2016) s. 859; R. Swedloff, "Risk Classification's Big Data (R)evolution", Connecticut Insurance Law Journal (2014) s. 339; P. Siegelman, "Information & Equilibrium in Insurance Markets with Big Data", Connecticut Insurance Law Journal (2014) s. 317; och Sh. Hoffman, "Medical Big Data and Big Data Quality Problem", Connecticut Insurance Law Journal (2014) s. 289. Motsvarande frågeställningar för kreditbedömningar diskuteras i M. Hurley & J. Adebayo, "Credit Scoring in the Era of Big Data", Yale Journal of Law & Technology (2016) s. 148. Paul Ohm har särskilt belyst utmaningarna med komplexa och icke-linjär tillväxt av datamängderna i "Regulating at Scale", Georgetown Law Technology Review (2018) s. 546. 1 4 Se K. L. Bergemann, "A Digitial Free Trade Zone and Necessarily-Regulated SelfGovernance for Electronic Commerce: The World Trade Organization, International Law, and Classical Liberalism", The John Marshall Journal of Information Technology & Privacy Law (2002) s. 595; se också redan M. Kirby, "Legal Aspects of Transborder Data Flows", The John Marshall Journal of Information Technology & Privacy Law (1991) s. 233; E. W. Ploman, "Transborder Data Flows: The International Legal Framework", The John Marshall Journal of Information Technology & Privacy Law (1981) s. 551; C. Manny, "Proposed Privacy Reform Legislation in Europe and its Effect on International Data Transfers", Business Law Review (2012) s. 75; och "Transborder Data Flow Regulation: Technical Issues of Legal Concern", The John Marshall Journal of Information Technology & Privacy Law (1981) s. 105. 15 Se P. J. Wantanabe, "An Ocean Apart: The Transatlantic Data Privacy Divide and the Right to Erasure", Southern California Law Review (2017) s. 1111; G. Drake, "Navigating the Atlantic: Understanding EU Data Privacy Compliance Amidst a Sea of Uncertainty", Southern California Law Review (2017) s. 163; P. M. Schwartz & K.-N. Pfifer, "Transatlantic Data Law", The Georgetown Law Journal (2017) s. 115; P. K. Yu, "The Political Economy of Data Protection", Chicago-Kent Law Review (2009) s. 777; R. Funta, "EU-USA Privacy Protection Legislation and the SWIFT Bank Data Transfer Regulation: A Short Look", Masaryk University Journal of Law and Technology (2011) s. 23; K. N. Rashbaum, M. Knauff & M. C. Albert, "U.S. Legal Holds Across Borders: A Legal Conundrum", North Carolina Journal of Law & Technology (2011) s. 69; P. M. Schwartz & D. J. Solove, "Reconciling Personal Information in the United States and European Union", California Law Review (2014) s. 877; C. Manny, "Recent Controversy Surrounding the EU – US Safe Harbor Data Protection Regime", Business Law Review (2014) s. 33, "Proposed Privacy Reform Legislation in Europe and its Effect on International Data Transfers", Business Law Review (2012) s. 75 och "Data Transfers from the EU to the U.S. After Schrems", Business Law Review (2016) s. 1; och redan H. Burkert, "Institutions of Data Protection – An Attempt at a Functional Explanation of European National Data Protection Laws", The John Marshall Journal of Information Technology & Privacy Law (1981) s. 167. M. J. Kelly och D. Satola talar om "an evolving transatlantic data struggle" (se "The Right to be Forgotten", University of Illinois Law Review (2017) s. 1), medan William McGeveran understryker likheterna i resultatet av dataskyddsmyndigheternas arbete i USA och EU (se "Friending the Privacy Regulators", Arizona Law Review (2016) s. 959). Naturligtvis är frågorna också viktiga inom EU ur den gemensamma marknadens perspektiv (se t.ex. R. Zallone, "Here, There and Everywhere: Mobility Data in the EU (Help Needed: Where is Privacy?", Santa Clara High Technology Law Journal (2013) s. 57 och U. U. Wuermeling, "Harmonisation of European Union Privacy Law", The John Marshall Journal of Information Technology and Privacy Law (1996) s. 411). Se allmänt, M. B. Sedgewick, "Transborder Data Privacy as Trade", California Law Review (2017) s. 1513; A. Zinser, "International Data Transfer Out of the European Union: The Adequate Level of Data Protection According to Article 25 of the European Data Protection Directive", The John Marshall Journal of Information Technology & Privacy Law (2003) s. 547; och A. D. Mitchell & J. Hepburn, "Don't Fence Me In: Reforming Trade and Investment Law to Better Facilitate Cross-Border Data Transfer", Yale Journal of Law & Technology (2017) s. 182. EU och Japan ingick nyligen en överenskommelse som kan möjliggöra "världens största frihandelsområde för säkra dataöverföringar" (M. Khan, "EU and Japan strike data flow deal", Financial Times 2018-07-17 (https:// www.ft.com/content/ee7e8bca-89a5-11e8-b18d-0181731a0340)). 16 Se M. Rotenberg & D. Jacobs, "Updating the Law of Information Privacy: The New Framework of the European Union", Harvard Journal of Law & Public Policy (2013) s. 605; J. Ph. Albrecht, "How the GDPR Will Change the World", European Data Protection Law Review (2016) s. 287; och M. Clear, "Falling Into the Gap: The Eur opean Union's Data Protection Act and its Impact on U.S. Law and Commerce", The John Marshall Journal of Information Technology and Privacy Law (2000) s. 981. 17 Se D. J. B. Svantesson, "Extraterritoriality in the Context of Data Privacy Regulation", Masaryk University Journal of Law and Technology (2013) s. 87 och "The (Un)Certain Future of Online Data Privacy", Masaryk University Journal of Law and Technology (2015) s. 129 (s. 131 ff.). Dataskyddsfrågorna har också en internationellt privat- och processrättslig aspect (se I. Revolidis, "Judicial Jurisdiction over Internet Privacy Violations and the GDPR: A Case of 'Privacy Tourism'?", Masaryk University Journal of Law and Technology (2017) s. 7). 18 Jfr Zallone (2013). Michael Birnhack ("Reverse Engineering Information Privacy Law", Yale Journal of Law and Technology (2013) s. 23) kallar EU:s reglering "the engine of data protection law" (s. 24). Så har exempelvis "rätten att glömma" – som slogs fast av EUD i målet C-131/12 Google Spain mot Agencia Española de Protección de Datos, ECLI:EU:C:2014:317 (2014) (se Svantesson (2015) s. 141 ff.) – väckt uppmärksamhet och diskuterats också utanför EU. Se t.ex. Wantanabe (2017); M. Cunningham, "Privacy Law That Does not Protect Privacy, Forgetting the Right to Be Forgotten", Buffalo Law Review (2017) s. 495; H. Kranenborg, "Google and the Right to Be Forgotten", European Data Protection Law Review (2015) s. 70; D. Hoffman, P. Bruening & S. Carter, "The Right to Obscurity: How We Can Implement the Google Spain Decision", North Carolina Journal of Law & Technology (2016) s. 437; C. Manny, "The European Union's 'Right to be Forgotten'", Business Law Review (2015) s. 51; Kelly & Satola (2017); L. Siry, "Forget Me, Forget Me Not: Reconciling Two Different Paradigms for the Right to be Forgotten", Kentucky Law Journal (2014—2015) s. 311; P. Sánchez Abril & J. D. Lipton, "The Right to be Forgotten: Who Decides What the World Forgets?", Kentucky Law Journal (2014—2015) s. 363. Se också t.ex. Balaban (2009); R. Sh. R. Ku, "Data Privacy as a Civil Right: The EU Gets It?", Kentucky Law Journal (2014—2015) s. 391; A. Forde, "Implications of the Right to be Forgotten ", Tulane Journal of Technology and Intellectual Property (2015) s. 83; A. Tamò & D. George, "Oblivion, Erasure and Forgetting in the Digital Age", Journal of Intellectual Property, Information Technology and E-Commerce Law (2014) s. 71; och P. Sanchez Abril & E. Pizarro Moreno, "Lux In Arcana: Decoding the Right to Be Forgotten in Digital Archives", Laws (2016) s. 33. – Internationella jämförelser görs i Chatterjee (2018). 19 Se S. Simitis, "Privacy—An Endless Debate?", California Law Review (2010) s. 1989; J. Wagner DeCrew, "Privacy and Its Importance with Advancing Technology", Ohio Northern University Law Review (2016) s. 471; Alessandra Suuberg, "The View From the Crossroads: The European Union's New Data Rules and the Future of U.S. Privacy Law", Tulane Journal of Technology and Intellectual Property (2013) s. 267; S. Diorio, "Data Protection Laws: Quilts Versus Blankets", Syracuse Journal of International Law & Commerce (2015) s. 485; och P. Perri & D. Thaw, "Ancient Worries and Modern Fears: Different Roots and Common Effects of U.S. and E.U. Privacy Regulation", Connecticut Law Review (2017) s. 1621. 20 K. F. King, "Personal Jurisdiction, Internet Commerce, and Privacy: the Pervasive Legal Consequences of Modern Geolocations Technologies", Albany Law Journal of Science and Technology (2011) s. 61. 21 Se E. F. Judge & T. E. Brown, "A Right Not to Be Mapped? Augmented Reality, Real Property, and Zoning", Laws (2018) s. 23. 22 M. S. Kirsch, "Do Not Track: Revising the EU’s Data Protection Framework to Require Meaningful Consent for Behavioral Advertising", Richmond Journal of Law and Technology (2011) s. 1 och K. F. King, "Personal Jurisdiction, Internet Commerce, and Privacy: The Pervasive Legal Consequences of Modern Geolocation Technologies", Albany Law Journal of Science & Technology (2011) s. 61. 23 Se J. Dunagin, "Incoming: Regulating Drones in Oklahoma", Oklahoma Law Review (2017) s. 457; R. H. Gruber, "Commercial Drones and Privacy: Can We Trust States with ‘Drone Federalism’?", Richmond Journal of Law and Technology (2015) s. 1; T. T. Takahashi, "Drones and Privacy", The Columbia Science & Technology Law Review (2012) s. 72; J. J. Vacek, "Remote Sensing of Private Data by Drones is Mostly Unregulated: Reasonable Expectations of Privacy are at Risk Absent Comprehensive Federal Legislation", North Dakota Law Review (2014) s. 463; och J. Frankle, "For Drone Operators, Privacy is Key for Smooth Takeoff and Landing", Georgetown Law Technology Review (2016) s. 125. 24 Se A. G. Ferguson, "The Internet of Things and the Fourth Amendment of Effects", California Law Review (2016) s. 805; R. Kester, "Demystifying the Internet of Things: Industry Impact, Standardization Problems, and Legal Considerations", Elon Law Review (2016) s. 205; W. Hartzog & E. Selinger, "The Internet of Heirlooms and Disposable Things", North Carolina Journal of Law & Technology (2016) s. 581; A. D. Thierer, "The Internet of Things and Wearable Technology: Addressing Privacy and Security Concerns without Derailing Innovation ", Richmond Journal of Law and Technology (2015) s. 1; S. S. Beale & P. Berris, "Hacking the Internet of Things: Vulnerabilities, Dangers, and Legal Responses", Duke Law & Technology Review (2018) s. 161; A. Peyton, "The Connected State of Things: A Lawyer’s Survival Guide in an Internet of Things World ", Catholic University Journal of Law and Technology (2016) s. 369; S. Poudel, "Internet of Things: Underlying Technologies, Interoperability, and Threats to Privacy and Security", Berkeley Technology Law Journal (2016) s. 997; R. H. Weber, "Governance of the Internet of Things—From Infancy to First Attempts of Implementation?", Laws (2016) s. 28; och Santesson (2015). 25 Se B. L. Bollinger, "The Security and Privacy in Your Car Act: Will It Actually Protect You?", North Carolina Journal of Law & Technology (2017) s. 214. 26 Se S. Ducich, "These Walls Can Talk! Securing Digital Privacy in the Smart Home Under the Fourth Amendment", Duke Law & Technology Review (2018) s. 278; se också S. M. Stern, "The Inviolate Home: Housing Exceptionalism in the Fourth Amendment", Cornell Law Review (2010) s. 905. 27 Se J. L. Hubley, "Online Consent and the On-Demand Economy: An Approach for the Millennial Circumstance", Hastings Science and Technology Law Journal (2016) s. 1 och A. Armitage, A. K. Cordova & R. Siegel, "Design Thinking: The Answer to the Impasse Between Innovation and Regulation", Georgetown Law Technology Review (2017) s. 3. 28 Se D. Parisi, "Mobile App Privacy: Developing Standard and Effective Privacy Tools for Consumers", North Carolina Journal of Law & Technology (2014) s. 240. 29 Se M. L. McLellan, J. A. Sherer & E. R. Fedeles, "Wherever You Go, There You Are (With Your Mobile Device): Privacy Risks and Legal Complexities Associated with International 'Bring Your Own Device' Programs", Richmond Journal of Law & Technology (2015) s. 1 30 För svensk rätt, se lagen (2010:566) om vidareutnyttjande av handlingar från den offentliga förvaltningen, som implementerar Europaparlamentets och rådets direktiv 2003/98/EG om vidareutnyttjande av information från den offentliga sektorn. 31 Se J. Ledendal, S. Larson & J. Wernberg, Offentlighet i det digitala samhället. Vidareutnyttjande, sekretess och dataskydd (2018) och M. van Eechoud, "Making Access to Government Data Work", Masaryk University Journal of Law and Technology (2016) s. 61; se också F. Z. Borgesius, J. Gray & M. van Eechoud, "Open Data, Privacy, and Fair Information Principles: Towards a Balancing Framework", Berkeley Technology Law Journal (2015) s. 2073. 32 Se Zs. Bódogh, "Privacy Issues of the Internet Search Engines – in the Light of EU Data Protection Legislation", Masaryk University Journal of Law and Technology (20 11) s. 163 och A. H. Stuart, "Google Search Results: Buried if Not Forgotten", North Carolina Journal of Law & Technology (2014) s. 463. 33 A. C. DeVore, "Cloud Computing: Privacy Storm on the Horizon?", Albany Law Journal of Science and Technology (2010) s. 365 och P. M. Schwartz, "Information Privacy in the Cloud", University of Pennsylvania Law Review (2013) s. 1623. 34 Se L. Barrett, "Deconstructing Data Mining: Protecting Privacy and Civil Liberties in Automated Decision-Making", Georgetown Law Technology Review (2016) s. 153. 35 Se B. Bodo, H. Helberger, K. Irion, F. Zuiderveen Borgesius, J. Moller, B. van de Velde, N. Bol, B. van Es & C. de Vreese, "Tackling the Algorithmic Control Crisis – the Technical, Legal, and Ethical Challenges of Research into Algorithmic Agents", Yale Journal of Law & Technology (2017) s. 133. 36 Se J. A. Dillard, "Big Brother Is Watching: The Reality Show You Didn't Audition For", Oklahoma Law Review (2011) s. 461; D. H. Goetz, "Locating Locating Privacy", Berkeley Technology Law Journal (2011) s. 823; A. M. Wright, "Civil Society and Cybersurveillance", Arkansas Law Review (2017) s. 745; C. Burten, "Unwarranted! Privacy in a Technological Age: The Fourth Amendment Difficulty in Protecting Against Warrantless GPS Tracking and the Substantive Due Process and First Amendment Boost", Southern California Interdisciplinary Law Journal (2012) s. 359; E. Pait, "Find My Suspect: Tracking People in the Age of Cell Phones", Georgetown Law Technology Review (2017) s. 155; D. Moussa, "Protecting Privacy in our Financial Transactions: An Alternative Method to Thinking about our Privacy in the Digital Era", Georgetown Law Technology Review (2017) s. 342; B. Turner, "When Big Data Meets Big Brother: Why Courts Should apply Unites States v. Jones to Protect People's Data", North Carolina Journal of Law & Technology (2015) s. 377; C. Cohn, "Lawless Surveillance, Warrantless Rationales", Journal on Telecommunications and High Technology Law (2010) s. 351; J. M. Paulson, "Cyber Insecurity: Constitutional Rights in the Digital Era", Southern Illinois University Law Journal (2017) s. 261; R. H. Thornburg, "Face Recognition Technology: The Potential Orwellian Implications and Constitutionality of Current Uses Under the Fourth Amendment", The John Marshall Journal of Information Technology & Privacy Law (2002) s. 321; S. McCoy, "O' Big Brother Where Art Thou?: The Constitutional Use of FacialRecognition Technology", The John Marshall Journal of Information Technology & Privacy Law (2002) s. 471; och S. Freiwald, "Online Surveillance: Remembering the Lessons of the Wiretap Act", Alabama Law Review (2004) s. 9. Eftersom "[f]ree communication is the most subversive practice of all" (M. Castells, Communication Power, 2u (2013) s. xxi) är det föga förvånande att den kinesiska regimen har utnyttjat den nya teknikens panoptiska potential i mycket hög grad (se N. Ferguson, The Square and the Tower (2017) s. 413 ff.); men t.ex. (och i synnerhet) den federala amerikanska regeringen besitter i princip samma åtminstone teknologiska kapacitet (se Ferguson (2017) s. 394; se också J. Heidenreich, "The Privacy Issues Presented by the Cybersecurity Information Sharing Act", North Dakota Law Review (2015) s. 395; A. Chander & U. P. Lê, "Data Nationalism", Emory Law Journal (2015) s. 678; och J. Reed, "US legislators urge Facebook, Google to store data outside Vietnam", Financial Times 2018-07-17 (https://www.ft.com/content/e8a1b772-899b11e8-bf9e-8771d5404543)). Alla stater fruktar ett fritt informationsflöde, eftersom den politiska makten vanligen har byggt på informationskontroll (se Castells (2001) s. xxi och xxiii). 37 Se A. M. Froomkin, "Government Data Breaches", Berkeley Technology Law Journal (2009) s. 1019. Genom den ogenerade bristen på respekt för dataskyddslagstiftningen som myndigheter som t.ex. den svenska Transportstyrelsen har visat, är det inte nödvändigtvis en lösning att medge informationsdelning inom begränsade kretsar eller för begränsade syften (som föreslås i M. D. Fan, "Private Data, Public Safety: A Bounded Access Model of Disclosure", North Carolina Law Review (2015) s. 161). Myndigheter – dvs. inkl. myndigheternas högsta företrädare – är helt enkelt inte tillräckligt pålitliga för att en aldrig så "stark" normgivning skulle räcka som skydd. 3 8 Se S. W. Brenner, "Law, Dissonance, and Remote Computer Searches", North Carolina Journal of Law & Technology (2012) s. 43. 39 Se O. H. Dombalagan, "Regulating Informational Intermediation", American University Business Law Review (2011) s. 58. Jfr P. C. Leyens, Informationsintermediäre des Kapitalmarkts (2017). Niall Ferguson har noterat den märkliga förkärleken hos främst europeiska politiker att delegera den av dem själva åstundade censuren till de dominerande privata aktörerna; som därmed blir ännu starkare (se Ferguson (2017) s. 412 f.). 40 Se P. Ohm, "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization", UCLA Law Review (2010) s. 1701; se också Y. Lagos, "Taking the Personal Out of Data: Making Sense of De-Identification", Indiana Law Review (2014) s. 187. 41 Se D. Green, "Big Brother is Listening to You: Digital Eavesdropping in the Advertising Industry", Duke Law & Technology Review (2018) s. 353; A. S. Bohm, E. J. George, B. Cyphers & Sh. Lu, "Privacy and Liberty in an Always-On, AlwaysListening World", The Columbia Science & Technology Law Review (2017) s. 1; och redan D. J. Klein, "Keeping Business Out of the Bedroom: Protecting Personal Privacy Interests from the Retail World", The John Marshall Journal of Technology and Privacy Law (1997) s. 391. Dessa ansträngningar leder till konstitutionella utmaningar i länder där åsiktsfriheten är särskilt skyddad (för svensk del, se t.ex. D. Hanqvist, "The Empire Strikes Back – EU, åsiktsfriheten och kreditvärderingsinstituten", SvJT 2016 s. 687, "The Phantom Menace – Duplik till Magnus Schmauch om kreditbetyg och annan 'kommersiell yttrandefrihet', åsiktsfriheten och konstitutionellt styre", SvJT 2017 s. 48 och "Rara temporum felicitate: åsiktsfrihet och EU-förordningen om referensvärden", JP 2018 s. 147; för USA, se t.ex. J. R. Bambauer & D. E. Bambauer, "Information Libertarianism", California Law Review (2017) s. 335). Adam Thierer menar att det europeiska exemplet är av mindre relevans för USA p.g.a. att man i USA skulle värdera yttrandefrihet och e-handel högre än i Europa (se "The Pursuit of Privacy in a World Where Information Control Is Failing", Harvard Journal of Law & Public Policy (2013) s. 409 (s. 411 f.); se också Wantanabe (2017) s. 1122 ff.). Rättsordningen måste också hantera hur tillgången till data hos sociala medier hanteras t.ex. avseende edition i civilprocessen (se A. McPeak, "Social Data Discovery and Proportional Privacy", Cleveland Law Review (2016) s. 59). 42 Se J. A. Fisher, "Secure My Data or Pay the Price: Consumer Remedy for the Negligent Enablement of Data Breach", William & Mary Business Law Review (2013) s. 215. 43 J. R. Reidenberg, "The Transparent Citizen", Loyola University Chicago Law Journal (2015) s. 437. 44 Se R. A. Ford, "Unilateral Invasions of Privacy", Notre Dame Law Review (2016) s. 1075 45 Se S. B. Toeniskoetter, "Preventing A Modern Panopticon: Law Enforcement Acquisition Of Real-Time Cellular Tracking Data", Richmond Journal of Law and Technology (2007) s. 1. Det panoptiska perspektivet diskuteras också i B.-J. Koops & R. Leenes, "'Code' and the Slow Erosion of Privacy", Michigan Telecommunications and Technology Law Review (2005) s. 115 (s. 117 f.). Se också B. E. Thon & C. Nes, "Controlling the Algorithms", European Data Protection Law Review (2017) s. 16 och T. Wu, The Attention Merchants (2016), kap. 19. 46 Framväxten av olika normer för informationshanteringen på webbsidor diskuteras i S. A. Hetcher, "The Emergence of Website Privacy Norms", Michigan Telecommunications and Technology Law Review (2000–2001) s. 97; se också K. K. Sty lianou, "An Evolutionary Study of Cloud Computing Services Privacy Terms", The John Marshall Journal of Computer and Information Law (2010) s. 593. 47 Se också J. Míšek, "Consent to Personal Data processing – the Panacea or a Dead End?", Masaryk University Journal of Law and Technology (2014) s. 69; Santesson (2015) s. 148 f.; Y. Hermstrüwer, "Contracting Around Privacy. The (Behavioral) Law and Economics of Consent and Big Data", Journal of Intellectual Property, Information Technology and E-Commerce Law (2017) s. 9; Ch. E. MacLean, "It Depends: Recasting Internet Clickwrap, Browsewrap, 'I Agree,' and Click-Through Privacy Clauses as Waivers of Adhesion", Cleveland State Law Review (2016) s. 43; K. P. McLaughlin, "Sharing You with You: Informational Privacy, Google, & the Limits of Use Limitation", Albany Law Journal of Science and Technology (2013) s. 55; J. A. Rothchild, "Against Notice and Choice: The Manifest Failure of the Proceduralist Paradigm to Protect Privacy Online (Or Anywhere Else)", Cleveland State Law Review (2018) s. 559; J. S. Livingston, "Invasion Contracts: The Privacy Implications of Terms of Use Agreements in the Online Social Media Setting", Albany Law Journal of Science and Technology (2011) s. 591; Sh. Monteleone, "Addressing the 'Failure' of Informed Consent in Online Data Protection: Learning the Lessons from Behaviour-Aware Regulation", Syracuse Journal of International Law & Commerce (2015) s. 69; och Aa. T. Chiu, "Irrantionality Bound: Terms of Use Licenses and the Breakdown of Consumer Rationality in the Market for Social Network Sites", Southern California Interdisciplinary Law Journal (2011) s. 165. 48 Se t.ex. C. Schmierer, "Better Late than Never: How the Online Advertising Industry’s Response to Proposed Privacy Legislation Eliminates the Need for Regulation", Richmond Journal of Law and Technology (2011) s. 1; K. Z. Oussayef, "Selective Privacy: Facilitating Market-Based Solutions to Data Breaches by Standardizing Internet Privacy Policies", B.U. Journal of Science & Technology Law (2008) s. 104; R. M. Marsh, Jr., "Legislation for Effective Self-Regulation: A New Approach to Protecting Personal Privacy on the Internet", Michigan Telecommunications and Technology Law Review (2009) s. 543; och D. Skivington, "Self Regulation or Privacy Legislation", Albany Law Journal of Science and Technology (2010) s. 393. 49 Behovet av en tekniskt upplyst lagstiftning understryks i J. Park, "VPN: Privacy and Anonymity for All", Georgetown Law and Technology Review (2017) s. 129. 50 J. S. Levy, "Towards a Brighter Fourth Amendment: Privacy and Technology Change", Virginia Journal of Law & Technology (2011) s. 502; jfr A. Rallo, "Privacy and Freedeom", European Data Protection Law Review (2018) s. 150. 51 https://fil.forbrukerradet.no/wp-content/uploads/2018/06/2018-06-27-deceivedby-design-final.pdf, s. 3. Se också D. K. Mulligan & K. A. Bamberger, "Saving Governance-By-Design", California Law Review (2018) s. 697; A. Bunn, "Facebook and Face Recognition: Kinda Cool, Kinda Creepy", Bond Law Review (2013) s. 35; L. A. Strachan, "Re-Mapping Privacy Law: How the Google Maps Scandal Requires Tort Law Reform", Richmond Journal of Law and Technology (2011) s. 1; A. Kirchner, "Reflections on Privacy in the Age of Global Electronic Data Processing with a Focus on Data Processing Practices of Facebook", Masaryk University Journal of Law and Technology (2012) s. 73; I. S. Rubenstein & N. Good, "Privacy by Design: A Counter"default settings and dark patterns, techniques and features of interface design meant to manipulate users, are used to nudge users towards privacy intrusive options. The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-orleave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users. Facebook and Google have privacy intrusive defaults, where users who want the privacy friendly option have to go through a significantly longer process. They even obscure some of these settings so that the user cannot know that the more privacy intrusive option was preselected. The popups from Facebook, Google and Windows 10 have design, symbols and wording that nudge users away from the privacy friendly choices." fact ual Analysis of Google and Facebook Privacy Incidents ", Berkeley Technology Law Journal (2013) s. 1333; och G. S. Hans, "Privacy Policies, Terms of Service, and FTC Enforcement: Broadening Unfairness Regulation for a New Era", Michigan Telecommunications and Technology Law Review (2012) s. 163. 52 Se t.ex. "Privacy by Design. The 7 Foundational Principles", https:// www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.pdf. 53 Artikel 25 diskuteras, analyseras och utvärderas som en del av privacy by designrörelsen i L. A. Bygrave, "Data Protection by Design and by Default: Deciphering the EU's Legislative Requirements", Oslo Law Review (2017) s. 105. 54 Se https://www.datainspektionen.se/lagar--regler/dataskyddsforordningen /inbyggt-dataskydd-och-dataskydd-som-standard/. 55 European Data Protection Supervisor, Opinion 5/2018, Preliminary Opinion on privacy by design (https://edps.europa.eu/sites/edp/files/publication/18-05-31 _preliminary_opinion_on_privacy_by_design_en_0.pdf). Avsnitt 1: Varför design ska tas på allvar i dataskyddslagstiftningen Kapitel 1: Varför design är allt Kapitel 2: Frånvaron av design inom integritetsrätten Avsnitt 2: En agenda för design inom integritetsrätten Kapitel 3: Integritetsvärderingar inom design Kapitel 4: Gränser för design Kapitel 5: Verktygslåda för integritetsdesign Avsnitt 3: Tillämpning av integritetsplanen Kapitel 6: Sociala media Kapitel 7: Teknologier för kurragömma Kapitel 8: Internet of Things 5 6 Hartzog är inte ensam om detta anslag. Ett liknande anslag – delvis med överlappande terminologi – ges av A. E. Waldman i "Privacy, Notice, and Design", Stanford Technology Law Review (2018) s. 74. Se också Koops & Leenes (2005); I. S. Rubinstein, "Regulating Privacy by Design", Berkeley Technology Law Journal (2011) s. 1409; E. Everson, "Privacy by Design: Taking Ctrl of Big Data", Cleveland State Law Review (2016) s. 27; och D. Krebs, "'Privacy by Design': Nice-to-have or a Necessary Principle of Data Protection Law?", Journal of Intellectual Property, Information Technology and E-Commerce Law (2013) s. 2. Kritiska synpunkter på privacy by default diskuteras i L. E. Willis, "Why Not Privacy by Default?", Berkeley Technology Law Journal (2014) s. 61. 57 Se D. A Norman, The Design of Everyday Things (2013) s. 4. Boken är den uppdaterade versionen av hans banbrytande The Psychology of Everyday Things (1988). Den nya upplagan är explicit uppdaterad inte minst med hänsyn till internet och digitaliseringen. 58 Se Castells (2013) s. xxv. 59 Uttrycket ska ha myntats av Lawrence Lessig i slutet av 1990-talet. Se också Koops & Leenes (2005) och P. De Filippi & Aa. Wright, Blockchain and the Law (2018), med underrubriken "The Rule of Code", och C. L. Reyes, "Conceptualizing Cryptolaw", Nebraska Law Review (2017) s. 384. 6 0 Se också J. Grimmelmann, "Privacy as Product Safety", Widener Law Journal (2010) s. 793. Ett slags konsumentskydd kan komma att behövas också inom andra delar av regleringen av informationsekonomin än dataskyddet, i takt med att allt fler funktioner – som tidigare utfördes av människor – nu utförs av informationsbehandlande maskiner (se D. C. Vladeck, "Consumer Protection in an Era of Big Data Analytics", Ohio Northern Univeristy Law Review (2016) s. 493). Generellt kan regleringen av olika marknader behöva ta mer hänsyn till hur icke-verbal kommunikation påverkar särskilt konsumenters beslut (se Sh. I. Becher & Y. Feldman, "Manipulationg, Fast and Slow: The Law of Non-Verbal Market Manipulations", Cardozo Law Review (2016) s. 459). – Mer allmänt kan cybersäkerheten behöva utvecklas, både tekniskt men även konceptuellt (se R. Weinstein, "Cybersecurity: Getting Beyond Technical Compliance Gaps ", N.Y.U. Journal of Legislation and Public Policy (2016) s. 913). Exempelvis ökade antalet anmälda fall av olovlig identitetsanvändning (inklusive kort- och kreditbedrägerier och skapande och kapningar av befintliga konton, framförallt på sociala medier) under det första halvåret 2018 med omkring 24 % jämfört med samma period i året innan (se Polisens Nationella bedrägericenter, "Brottsutvecklingen i riket", juni 2018, s. 11). Vad gäller cybersäkerhet menar Andra M. Matwyshyn att det inte i praktiken går separera den privata från den nationella cybersäkerheten (se "Cyber!", BYU Law Review (2017) s. 1109; se också N. A. Sales, "Regulating Cyber-Security", Northwestern University Law Review (2013) s. 1503 och "Privatizing Cybersecurity", U.C.L.A. Law Review (2018) s. 620; J. A. Cilek, "Cybersecurity Dilemma: Keeping Data Regulations Effective in the Online Age", Loyola University Chicago Journal of Regulatory Compliance (2016) s. 45; och J. Hurwitz, "Cyberensuring Security", Connecticut Law Review (2017) s. 1495). Inom EU har cybersäkerheten blivit föremål för harmoniserad lagstiftning (se Europaparlamentets och rådets direktiv (EU) 2016/1148 av den 6 juli 2016 om åtgärder för en hög gemensam nivå på säkerhet i nätverks- och informationssystem i hela unionen), som för svensk del har resulterat i lagen (2018:1174) om informationssäkerhet för samhällsviktiga och digitala tjänster, som trädde i kraft 2018-08-01 (se SOU 2017:36 och prop. 2017/18:205). 61 Se Norman (2013) s. xiv. 62 Se Norman (2013) s. 6. Norman kritiserar ingenjörer för att inte acceptera mänskligheten som hon är. Det är nog aningen överdrivet. En mer teknisk – och mer "ingenjörslik" – behandling av design ur just det faktiskt, empiriskt belagda mänskliga beteendets perspektiv är M. S. Sanders & E. J. McCormick, Human Factors in Engineering and Design (1987), som alltså kom ut året före Normans första upplaga (och som var kursbok när jag studerande ämnet vid universitetet i Lund). 63 Se också N. Richards & W. Hartzog, "Taking Trust Seriously in Privacy Law", Stanford Technology Law Review (2016) s. 431 ("privacy can and should be thought of as enabling trust in our essential information relationships") och R. H. Sloan, ""I'll See": How Surveillance Undermines Privacy By Eroding Trust", Santa Clara High Technology Law Journal (2016) s. 221. 6 4 Se R. Calo, "Privacy and Markets: A Love Story", Notre Dame Law Review (2016) s. 649. Viktor Mayer-Schönberger har argumenterat för ett mer nyanserat system för "information governance" (se "Beyond Privacy, Beyond Rights—Toward a 'Systems' Theory of Information Governance", California Law Review (2010) s. 1853. 65 Se också W. Hartzog & E. Selinger, "The Case for Online Obscurity", California Law Review (2013) s. 1 och "Surveillance as Loss of Obscurity", Washington & Lee Law Review (2015) s. 1343; Hoffman, Bruening & Carter (2016); och O. Tene & J. Polonetsky, "Judged by the Tin Man: Individual Rights in the Age of Big Data", Journal on Telecommunications and High Technology Law (2013) s. 351 (s. 362 ff.). Ett liknande perspektiv ges också I H. R. Anderson, "Plotting Privacy as Intimacy", Indiana Law Review (2013) s. 311. 66 Se B. T. Crowther, "(Un)Reasonable Expectations of Digital Privacy", BYU Law Review (2012) s. 343; M. Hirose, "Privacy in Public Spaces: The Reasonable Expectation of Privacy Against the Dragnet Use of Facial Recognition Technology", Connecticut Law Review (2017) s. 1591; B. C. Newell, "Rethinking Reasonable Expectations of Privacy in Online Social Networks", Richmond Journal of Law and Technology (2011) s. 1; G. Skok, "Establishing a Legitimate Expectation of Privacy in Clickstream Data", Michigan Telecommunications and Technology Law Review (1999– 2000) s. 61; F. H. Cate & R. Litan, "Constitutional Issues in Information Privacy", Michigan Telecommunications and Technology Law Review (2002) s. 35; D. A. Sklansky, "Too Much Information: How Not to Think About Privacy and the Fourth Amendment", California Law Review (2014) s. 1069; B. Mund, "Social Media Searches and the Reasonable Expectation of Privacy", Yale Journal of Law & Technology (2017) s. 238; och R. L. Weaver, "Privacy in an Age of Advancing Technology", Mississippi Law Journal (2012) s. 975. Se också L. F. Cranor, "Necessary but Not Sufficient: Standardized Mechanisms for Privacy Notice and Choice", Journal on Telecommunications and High Technology Law (2012) s. 273. Inte minst skulle ett skydd som bygger på Hartzogs obscurity-modell kunna användas för att bättre skydda privatlivet för personer som tabloidpressen anser sig ha ett legitimt intresse av att skildra i detalj (problematiken behandlas i C. L. Crisci, "All the World is Not a Stage: Finding a Right to Privacy in Existing and Proposed Legislation", N.Y.U. Journal of Legislation and Public Policy (2002) s. 207). 6 7 Jfr D. Hanqvist, Lagen om förvaltare av alternativa investeringsfonder. En kommentar (2016) s. 65 och 879. 68 Se också J. A. Fischer, "Secure My Data or Pay the Price: Consumer Remedy for the Negligent Enablement of Data Breach", William & Mary Business Law Review (2013) s. 215. 69 Se M. Bimhack, "Reverse Engineering Informational Privacy Law", Yale Journal of Law and Technology (2013) s. 24. Sålunda bygger 2 kap. 11 § andra stycket, 12 §, 15 § tredje stycket och 21 § andra stycket, liksom de därtill anslutande 2 kap. 2 § andra och tredje styckena UB, på tekniken med skriftliga handlingar och har endast delvis moderniserats genom HD:s avgörande i NJA 2017 s. 769. 7 0 Se J. M. Balkin, "Information Fiduciaries and the First Amendment", UC Davis Law Review (2016) s. 1183 och A. Dobkin, "Information Fiduciaries in Practice: Data Privacy and User Expectations", Berkeley Technology Law Journal (2018) s. 1. 71 Se C. D. Southard IV, "Individual Privacy and Government Efficiency: Technology's Effect on the Government's Ability to Gather, Store, and Distribute Information", The John Marshal Journal of Information Technology and Privacy Law (1989) s. 359. Även inom detta område behövs ordentliga cost/benefit-analyser (se A. Thierer, "A Framework for Benefit-Cost Analysis In Digital Privacy Debates", George Mason Law Review (2013) s. 1055; men se också J. Rosen, "Keeping Google Good: Remarks on Privacy Regulation and Free Speech", George Mason Law Review (2013) s. 1003). 72 Se G. Hosein, "Returning to a Principled Basis for Data Protection", ChicagoKent Law Review (2009) s. 803; F. Fagan, "Systemic Social Media Regulation", Duke Law & Technology Review (2018) s. 394; och Ei. Jungar, "Mind the Gap – Regulation Meets Reality", JP 2016 s. 27. 73 Se I. D. Manta, "Choosing Privacy", N.Y.U. Journal of Legislation and Public Policy (2017) s. 649; K. Wallman, "The Tension Between Privacy and Security: An Analysis Based on Coase and Pigou", Journal on Telecommunications and High Technology Law (2005) s. 397; A. K. Kasaudhan, "Surveillance and right to privacy: Issues and challenges", International Law Journal (2017) s. 73; och B. Schweiger, "Safety vs. Security: How Broad but Selective Public Access to Environmental Data Properly Balances Communities' Safety and Homeland Security", The John Marshall Journal of Information Technology & Privacy Law (2008) s. 273. 7 4 Se L. Reilly, "Automatic Consumer Privacy Rights Embedded in Smart Grid Technology Standards by the Federal Government", Vermont Law Review (2011) s. 471 75 Se M. J. Woods, "Data Retention Requirements And Outsourced Analysis: Should Private Entities Become Government Surrogates In The Collection of Intelligence?", American University Business Law Review (2014) s. 49; Ch. Soghoian, "Caught in the Cloud: Privacy Encryption, and Government Back Doors in the Web 2.0 Era", Journal on Telecommunications and High Technology Law (2010) s. 359; och redan N. A. Crain, "Bernstein, Karn, and Junger: Constitutional Challenges to Cryptographic Regulations", Alabama Law Review (1999) s. 869.s. 800