Author: Washington Journal of Law, Technology & Arts

Remote Test Scans Expose Larger Privacy Failures

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: James Ostrowski

In a major challenge to pandemic remote learning practices, the court in Ogletree v. Cleveland State University ruled that scanning students’ rooms violates the Fourth Amendment’s prohibition against unreasonable searches. While this decision is a definitive rebuke of a widely used practice, the case also reveals systemic flaws in university privacy practices. This blog will build off Ogletree to strike a balance between test integrity and privacy rights. 

Covid Acceleration 

For technology companies, the coronavirus pandemic was an accelerant. Startups rushed out messaging apps, video platforms, and ecommerce sites to thaw a populace frozen by a blizzard of lockdowns. There was perhaps no greater market capture for technology companies than in education. Colleges moved entirely online, deploying previously known but relatively new technologies, such as Zoom, on an unprecedented scale. Legions of students attended class from their kitchen tables and bedrooms. Professors, intent on maintaining their in-person standards in a remote world, relied on proctoring tools, many of which required room scans from students who had little choice but to comply. Now, two years later, hundreds of programs still record students throughout remote tests. 

Remote Test Scans Ruled Unconstitutional 

In February 2021, a student at Cleveland State University, Aaron Ogletree, was sitting for a remote chemistry exam when his proctor told him to scan his bedroom. He was surprised. Ogletree assumed the room scan policy had been abolished, until, two hours before the test, Cleveland State emailed him that he would have to scan his room. Ogletree responded that he had sensitive tax documents exposed and could not remove them. Like many students, Ogletree had to stay home due to health considerations, and he could only take exams in the bedroom of his house. Faced with the false choice of complying with the search or failing the test, he panned his laptop’s webcam around his bedroom for the proctor and all the students present to see. 

Ogletree sued Cleveland State for violating his Fourth Amendment rights. The Fourth Amendment protects “[t]he right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures.” 

Ohio District Court judge J. Philip Calabrese decided in favor of the student because of the heightened Fourth Amendment protection afforded to the home, the lack of alternatives for Ogletree, and the short notice. Calabrese conceded that this intrusion may have been minor, but cited Boyd v. United States to support the slippery slope argument that “unconstitutional practices get their first footing…by silent approaches and slight deviations.” 

The facts of this case are a symptom of a larger problem. The university failed its students and its professors when it did not consistently apply its online education technology. 

Arbitrary Application and Lack of Policies 

Cleveland State provides professors with an arsenal of services to administer online classes. These tools include a plagiarism detection system that faculty can use to see students’ IP addresses, a proctoring service that records students and uses artificial intelligence to flag suspicious behavior, and, of course, pre-test room scans.

The school leaves it entirely to the discretion of faculty members—many of whom are not experts in student privacy—to choose which tools or combinations of tools to use. Cleveland State’s existing policies offer no guidance on the tradeoffs of using any one method. This is tantamount to JetBlue asking its pilots to fly through a whiteout without radar.

Toward a Unified Policy

What may have been an understandable oversight in the early pandemic whirlwind cannot be considered so now. The tension between privacy and security is well-known. Only by careful balancing of students’ privacy rights and university interest in test integrity will we find a workable solution. Schools across the country should take heed of the Ogletree ruling. University leadership holds the responsibility to balancing those interests and impart clear guidance to test administrators. To foster this progression, we offer two recommendations: 

  1. Cost-Benefit Guidance: The university should score tools on privacy interests involved and the expected benefit of its application. This should include guidance on whether a method can be easily circumvented. As individual teachers are not necessarily savvy on the legal implications of certain remote test policies, the university must provide clear analysis and guidance. An example entry may read, “Blackboard provides student location data. Though location tracking is a relatively common practice, students must be made aware of it. This tool can ensure that students are where they say there are, which is not usually relevant for test integrity. If students wished, they could easily evade this using a low-cost VPN.” 
  1. Test Policy Clearly Outlined in Syllabi: Professors should provide guidance within their course descriptions on what technologies and methods are used to administer tests, and students could sign an acknowledgment form. For example, a professor would delineate applications they use to administer exams, information about whether the exams are proctored, and recourse for not following a policy. This way, students can make affirmative decisions about their privacy exposure by choosing a course that aligns with their interests rather than be blindsided by heavy-handed policy in the final weeks of a semester. This way, professors will not have to worry about future disagreements because their students knowingly consented to the course’s policies.

The university must balance policy considerations around security and privacy rights. A failure to balance these conflicting pursuits can cause student anxiety, unnecessary privacy violations, and poor test integrity.

Closing the Loop: Solving the Impossibility of Data Deletion

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: Josephine Laing

Personal information is the newest and shiniest coin of the realm. The more personal the data, the more valuable it may be. While most consumers are aware that their data is worth its weight in gold, it is not always clear who is mining this data and what can be done to protect it. Luckily, efforts have been made to create consumer protections that shine a light on the notorious data broker industry. 

Data brokers collect personal information about consumers. Personal information is not directly gathered from consumers. Rather, personal information is collected from commercial entities, government, and other sources – unbeknownst to the consumer. This data is constantly being sold. For a consumer to track down their personal information, they would have to follow an ever-winding trail of sales between data brokers. As a result, this industry is commonly critiqued for its lack of transparency. While public awareness of this industry is crucial, the key issue is what consumer deletion rights are available to combat the collection. If consumers’ deletion rights are not extended to affect data brokers, deletion rights become meaningless. Meaningless deletion rights prevent consumers from exerting control over their personal information. Consequently, privacy rights are directly linked to one’s ability to require data brokers to delete information. Without this right to delete, there is no true right to privacy. 

The Delete Act 

On October 10th, 2023, California’s Governor Newsom signed the Delete Act into law. The Delete Act promises consumers a new age of data control. Starting in August 2026, California consumers will have the ability to effectively exercise their deletion rights. This might come as a surprise to some, as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) already granted Californians deletion rights in 2018 and 2020 respectively. These deletion rights, however, were caveated by exceptions that were, until recently, abused by the data broker industry. 

The Delete Act, introduced by Senator Becker and sponsored by Privacy Rights Clearinghouse, amends and adds to Section 1798.99.80-87 of the California Civil Code. These amendments create important changes in the data broker provisions included in the CCPA. The changes embrace a more inclusive definition for data brokers, preventing a notoriously shifty industry from evading jurisdiction. This Act requires data brokers to disclose when they collect personal information about minors, consumers’ precise geolocations, and consumers’ reproductive health care data. Data brokers must also include informational links on their websites about collection techniques and deletion rights. Interestingly, brokers are forbidden from using dark patterns. While data brokers are already required to register in California, the penalty for failing to register has increased to $200 per day from $100. These daily penalties also apply for each deletion request that goes unheeded by the broker. These fines can add up, especially as many consumers in California are ready to make deletion requests.

The Delete Act addresses the Sisyphean task of data management. Consumers are constantly producing data. Thus, the management of data is never-ending. This law includes a provision that makes the deletion right effective. Data brokers must access the deletion mechanism and reassess the mechanism at least once every forty-five days. When a data broker accesses the mechanism, they must: (1) process all deletion requests; (2) direct all service providers or contractors to delete personal information related to the request; (3) send an affirmative representation of deletion to the California Privacy Protection Agency indicating number of records deleted and what service providers or contractors were contacted. After a consumer has submitted a deletion request, data brokers must continue to delete the consumer’s data every forty-five days unless otherwise requested. By requiring monthly engagement with the deletion mechanism, the Act actively protects consumer data.

Who cares? 

Why is this Act necessary? Why weren’t the original deletion rights enough? Through the CPRA’s amendments to the CCPA, California citizens are granted preliminary rights to delete their data. California consumers’ right to delete was limited to data retained by businesses providing services to Californians. And the CCPA only affects businesses that handle 50,000 California consumers, make $25 million in gross revenue, or profit primarily (50% or more) by selling data. This means that if a business qualifies, there are many exceptions the business can claim to avoid facing enforcement. Section 1798.145 outlines the right-to-delete exceptions and allows for businesses to “collect, use, retain, sell, share, or disclose consumers’ personal information that is identified or aggregate consumer information.” 1798.145(a)(6). Such exceptions allow for consumers’ personal information to be excluded from privacy protections. Information can still be used to identify consumers via aggregation efforts. Once the personal data is sold to a data broker (service provider or contractor) the consumer’s right to delete is vastly reduced. Thus, the exceptions carved out for data deletion effectively reduce consumer privacy protections. 

The Delete Act addresses the gaps in consumer privacy by empowering consumers to delete their personal information from data brokers. Since personal information is constantly collected from consumers, expecting consumers to repeatedly delete their information from data brokers is unreasonable. Accordingly, for consumers to efficiently utilize a right to delete they must be able to delete information at scale. The Delete Act calls for the right for consumers to delete “any personal information related” to them “held by the data broker or associated service provider or contractor” through a “single verifiable consumer request.” The bill addresses the persistence of data collection by eliminating the consumer’s need to continually and repetitively request deletion. 
So where is Washington’s Delete Act? Emory Roane of Privacy Rights Clearinghouse hopes that the Delete Act can “serve as an impetus – if not a direct model – for other states to model… [as] there is a massive blind spot when it comes to businesses that don’t have a direct relationship with the consumer.” Emory notes that data brokers are a bipartisan issue, pointing to the passing of data broker registries in both Texas and Oregon in 2023. Washington has yet to establish a data broker registry. Getting to the heart of the issue, Emory states that: “Republican or Democrat, old or young, across the country and across every demographic, everyone rightfully feels like they’ve lost control of their personal information and privacy and data brokers are a huge part of that problem.” Tackling the data broker industry is a tall task, and creating an effective right to delete is a necessary start. As California tries out its deletion portal, Washington should take heed.

Emojis Speak Louder Than Words: A Legal Perspective

/ Washington Journal of Law, Technology & Arts / Leave a comment
Photo by cottonbro CG studio on Pexels.com

By: Lauren Lee

Imagine being legally bound to a contract with nothing more than a ‘thumbs-up’ emoji. In our ever-evolving digital landscape, each new phone software update introduces an array of new emojis and emoticons to our keyboards. These small digital icons serve as time-saving tools, enabling more efficient expression of emotions and tone. However, emojis and emoticons bring forth the challenge of potential ambiguity, as many lack a ‘defined meaning.’ For example, the “praying hands” emoji is sometimes misconstrued as a “high five” emoji. In the legal realm, while interpreting emojis may be complex, their admissibility as evidence in trials holds undeniable importance.

A seemingly uncontroversial smiley face emoji or emoticon can have significant implications on cases. In 2015, U.S. District Judge for the Southern District of New York, Katherine Forrest, ruled that all symbols, including emojis or emoticons, be read by jury members. Tyler Schnoeblen, a linguist at Stanford, explained how the use of emoticons provides insight into a writer’s intention. A smiley face may indicate politeness, a frowning face may signal disapproval, while a winking face may convey flirtatiousness. More recently, in July 2023, the District Court of D.C. ruled that when the Bed, Bath, and Beyond CEO tweeted a smiling moon emoji, it symbolized “to the moon” or “take it to the moon,” reflecting optimism about the company’s stock. This interpretation influenced investors to purchase the stock, and the court found that the moon emoji was actionable.

While civil cases often focus on interpreting emoji meanings rather than their admissibility, attorneys should prepare for litigation by understanding the bar of procedural requirements when submitting emojis for evidence. Texts or messages containing emojis or emoticons must be relevant for presentation to the jury. Testimony from the sender can offer context and highlight the intent of the sender when they send the emoji. Once relevance is established, the messages must be authenticated, with the admitting party ensuring that both the sender and receiver saw the same image.

Already, tens of cases each year in the U.S. address the meaning of emojis in a legal context and some states have permitted the use of emojis as evidence. In a report sponsored by the State Bar of Texas, the authors suggest that emoticons and emojis resemble hearsay statements, which is admissible evidence. Rule 801(d)(2) of the Federal Rules of Evidence (FRE) defines a hearsay statement as an oral, written, or nonverbal assertion that is made outside of trial. Emojis could be admitted as hearsay statements for evidence if authenticated because they likely fall under the written assertion category.

Admitting emojis as evidence in a trial has its challenges. Undoubtedly, expanding the scope of what is permitted as evidence complicates litigation. The downside of allowing emojis as evidence lies in the potential increase in the duration and cost of litigation, increased reliance on the jury or judge’s interpretation of emojis, and potential for parties to evade liability through emoji use. Additionally, emojis may appear differently on different devices (e.g. Apple products vs. Androids). Admitting emojis as evidence might also lead to unintended agreements or commitments.Despite the increasing complexity of emoji interpretation, their admissibility in trials should be acknowledged. Emojis expand our means of expression and can play a crucial role in conveying nuanced emotional and contextual information, fostering more accurate communication within the legal system. It is vital to understand that language should not be interpreted solely within its plain meaning but also in the context in which it is used. This concept is similar to statutory interpretation canons in administrative law, where various interpretive modes are employed to derive meaning. Emojis and emoticons, in this context, can be likened to symbols that effectively convey ideas and the author’s tone, making them a significant component for establishing contextual evidence in cases. To prepare for the ever-expanding use of emojis and emoticons, courts and attorneys should deploy appropriate tools to develop fluency in this new ‘emoji language.’

Sand Trap: The Future of the PGA Tour’s Nonprofit Status

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: Sam William Kuper

“Saudi Arabia’s sovereign wealth fund” is not a collection of words typically linked to tax-exempt nonprofits. However, that is exactly who stands to benefit from the century-old 501(c)6 Internal Revenue Code when the PGA Tour and LIV Golf complete their tentative agreement to merge in 2024. But is this merger and the PGA Tour’s planned continued use of its tax exemption as necessarily bad—or even evil—as many politicians are saying they will be?

Money Talks

Led by Chairman Crown Prince Mohammed Bin Salman (de facto leader of Saudi Arabia) and Governor Yassir Al-Rumayyan (former chairman of Saudi Arabia’s national oil company, Aramco), Saudi Arabia’s Public Investment Fund (“PIF”) has over $700 billion USD in assets and is seen as a cornerstone for the development of Saudi Arabia’s Vision 2030 project. Starting in 2014, PIF began investing and reaching beyond Saudi Arabia’s borders to extend its influence and investment opportunities. From stakes in Silicon Valley sweethearts Uber and WeWork(oof) to video game icons Electronic Arts and Activision Blizzard, PIF has become an investment hegemon. Its next goal? Dominating international sports.

Coined “sportswashing,” PIF has used its immense wealth to insert itself into the world’s most popular sports in an attempt to bolster its reputation and hide from Saudi Arabia’s awful human rights record. They bought a middling Premier League soccer team and infused it with cash. They backed Formula One races in Saudi Arabia, headlined by post-race concerts from Travis Scott, Charlie Puth, and Calvin Harris. PIF’s crown jewel, however, was its introduction of LIV Golf in October of 2021.

(Don’t) Pay for Play

For the better part of a century, the PGA Tour has been the preeminent golf league in the world. In 2021, it hosted 113 tournaments in 36 U.S. states and 10 countries, with about 200 golfers competing for $765 million in prize money. It generated over $1.59 billion in revenue and paid executives over $30 million—with Commissioner Jay Monahan raking in $13 million. The catch? They have been a 501 (c)6 tax-exempt nonprofit since 1977.

Initially enacted within the 1913 Tariff Act, 501(c)6 organizations (in comparison to 501(c)3) are organizations that share a common business interest. Their purpose is to promote that interest for the benefit of their members, and “not to engage in a regular business of a kind ordinarily carried on for profit.” In return, they must publicly file a 990 form disclosing their finances—including their sources of funding, charitable donations, and payments to executives.

The PGA Tour was not alone in claiming this exception amongst its peers. In 1966, the Tariff Act was amended to include “football leagues” when the National Football League (NFL) merged with a competitor. Major League Baseball (MLB) and the National Hockey League (NHL) also claimed nonprofit status in the decades following. But while the MLB, NHL, and NFL have all discarded their non-profit status in recent years, the PGA Tour has remained steadfast—mostly because their players are individual contractors and not member teams who make their own profits from ticket sales, merchandise, etc.

By co-sponsoring tournaments with 501(c)3 charities (such as the FedeEx St. Jude Classic), the PGA Tour provides a platform for raising money. However, a 2013 ESPN report flamed the PGA Tour for donating just 16% of its revenue from tournaments on average to charities—the industry standard is 65%—and in one case, caused a charity to lose money.

Pitching the Wedge

Documents prepared for PIF by Mckinsey & Company—known to hold authoritarian governments as clients—advised that LIV needed to lure the top 12 players in the world from the PGA Tour to be profitable. They managed four. Nicknamed “Project Wedge,” LIV’s launch was met with expected criticism. Signing stars like Phil Michelson, Dustin Johnson, and Bryson DeChambeau to massive contracts, the PGA immediately banned them from future Tour events. Commissioner Monahan publicly admonished these players, saying that he “would ask any player that has left, or any player that would consider leaving, ‘have you ever had to apologize for being a member of the PGA Tour?’” In its first season, LIV spent $784 million on 8 events. Their revenue was “virtually zero.”

But despite LIV’s flop, they persisted—and the golf world was thrown into further chaos. The 11 banned golfers sued the PGA Tour for antitrust violations and the PGA counterclaimed for tortious interference. The Justice Department launched its own antitrust investigation into professional golf. But in May of 2023, over breakfast near Palazzo Ducale in Venice, Monahan and Al-Rumayyan came to terms with what, in hindsight, was likely inevitable.

Big Beautiful Deal

The announced agreement, described by former President Trump as “big, beautiful, and glamourous,” would combine the European Tour, LIV Golf, and the PGA Tour into one, new for-profit entity that would control the PGA’s commercial rights. The PGA Tour would retain its nonprofit status and control over how tournaments are played. LIV would reserve the exclusive right to invest in the company. Al-Ramyan would be the Chairman. All lawsuits would be dropped. Almost immediately, two Senate committees launched investigations into the merger so they could assess the “risks associated with a foreign government’s investment in American cultural institutions, and the implications of this planned agreement on professional golf in the United States going forward.”

“Golf is a sport in which players call penalties on themselves, whether an infraction is visible to others or not” – PGA Tour mission statement

“Any hypocrisy I have to own.” Jay Monahan, in walking back his initial comments about players leaving for LIV, reiterated that he felt like the merger was best for golf. But it is without a doubt problematic. From Saudi Arabia’s connection to 9/11 to the 2018 killing of Washington Post journalist Jamaal Kashoggi, there is no good way to frame Saudi involvement in American sport.

But here are the facts. The PGA Tour has raised $3.6 billion for charitable donations since 1938, and $1.6 billion since 2014. In 2021, it generated $173 million, or about 12% of total revenue—just 8 million away from cracking the top 100 of the most charitable organizations in the U.S. The NFL Foundation, in contrast, gave away $70 million in 2022, or about .5% of the NFL’s total revenue. Patagonia, who was widely praised for shifting ownership to a nonprofit and dedicating 100% of its profits to environmental causes, still gives away only about 6.6% of its revenue.

We still do not know much about the details of the merger or the future of the PGA Tour as a nonprofit. But if the PGA Tour either decides or is forced to give up its nonprofit status, it will no longer be required to publicly disclose its finances. With Al-Rumayyan serving as the chairman for the new joint entity, and PIF’s reputation for a lack of transparency, this would likely not be an optimal outcome.

Saudi Arabian investment in American culture is not coming—it is already here. But its benefits here of providing consistent wages for all professional golfers, making the game more available across the globe, and ultimately raising more money for charities, may be worth it. We should push for clarity, disclosure, and charitable giving when we can, in whatever form that may take.

Swift’s New Era of Film Deals

/ Washington Journal of Law, Technology & Arts / Leave a comment

By: Mackenzie Kinsella

Taylor Swift’s Eras Tour is argued to be one of the largest tours in history. From the friendship bracelets, elaborate costumes representing each of her eras, and the frenzy to get tickets, the Eras Tour has had not only a cultural impact, but an economic impact. According to NPR, Swift’s tour is estimated to produce $5 billion by the end of the tour in November. With the COVID-19 pandemic over, music tours and other events have been attracting guests at a higher level than ever before. Economists have claimed Taylor Swift’s the Eras Tour and Beyoncé’s Renaissance Tour have boosted tourism sales for cities listed on their tour by hundreds of millions of dollars. According to Time Magazine, Enchanted Swift concertgoers spend an average of $1,300-$1,500 per show on expenses like tickets, outfits, merchandise, travel and food. The Eras Tour has impacted the economy by generating $4.6 billion in consumer spending alone in the United States.

Swift’s record-breaking tour has continued to break records as “Taylor Swift: The Eras Tour” (The Eras Tour) hit the box office. Swift’s concert film sold a record $123.5 million in tickets around the world over opening weekend. Industry experts expect Swift’s concert film to be in the league of some of this year’s biggest box office hits like Barbie and The Super Mario Bros. Movie. Taylor Swift: The Eras Tour now holds the record for the highest-grossing concert film in the history of concert films. Taylor Swift: The Eras Tours not only differs from its predecessors due to its economic impact but also by Swift’s Mastermind deal with AMC.

Traditionally, most big budget movies are distributed by a major studio, which then gets a portion of the profit. However, Swift produced the concert film herself and created a deal for distribution directly with AMC, a theater company. Swift hired a director and was able to successfully market her new film to her 365 million social media followers. Swift and AMC will split the remainder of The Eras Tour profits, after compensating the hosting theaters. This direct deal allows for the theaters to receive 43% in gross ticket sales and the remaining 57% in gross ticket sales will be split by Swift and AMC. Through this Delicate deal, Swift was also able to secure streaming rights for the film. Beyoncé made a similar kind of deal for the release of her upcoming concert film, “Renaissance: A Film by Beyoncé.” However, never in her Wildest Dreams would Swift be able to make this agreement with AMC, if not for a recent change in antitrust law. 

In 1938, the Department of Justice (DOJ) sued the major studios at the time, also known as the Big Five (MGM, Paramount, RKO, 20th Century Fox, and Warner Brothers) and the Little Three (Universal, United Artists, and Columbia). In United States v. Paramount Pictures, Inc., the Supreme Court was concerned about the exhibition tactics being taken by these major studios. For example, studios would send a film to only their cinemas for the first runs. During these first runs, the films would be arguably the most profitable due to marketing and reviews. After a couple of weeks showing the film in their self-owned theaters, only then, would studios send the film to competing or independent studios. To combat this monopolization of the film industry, the Supreme Court established a landmark antitrust decision, which required the eight studios to stop monopolistic practices that gave wealthy studios an advantage over smaller studios and independent filmmakers. These requirements were dubbed “the Paramount Decrees.” 

In August of 2020, these Paramount Decrees were overturned at the request of the DOJ. The DOJ outlined two major concerns for their repeal of the Paramount Decrees. The first concern was that the Paramount Decrees were essentially outdated because many of the studios that signed the Decrees no longer existed, or existed in the capacity they did when the Paramount Decrees were signed. Secondly, the DOJ was concerned that major streaming companies were not held to the same standards and restrictions as major studios. The DOJ argued that repealing the Decrees would allow for major studios to compete with streaming services. The Paramount Decrees no longer serve as government intervention in the free markets. Swift’s Fearless direct deal for her concert film signals a new era of innovation in deal making for the film industry. 

However, there are some critics who are not fans of this new Style of film deal. Some critics of Swift’s deal argue that it allows major studios to compete with streamers at the expense of struggling independent producers. Others believe that a better alternative to repealing the Paramount Decrees would be to update antitrust legislation and adjust for major streaming companies like Netflix and Amazon in the film industry.