Writing Homework on Privacy

PRIVACY AND TECHNOLOGY IN THE TWENTY-FIRST CENTURY Mark A.

Rothstein We live in a society increasingly dependent on and enamored by technology, including communications, surveillance, forensic, health care, and other forms of technology.

Yet, we also purport to value privacy.

Is it possible to have both technology and privacy—to realize the benefits of technology without compromising privacy?

Do current laws provide adequate protections in light of new technologies? These are difficult questions and, to start, we need to define what we mean by privacy.

Privacy has different aspects or dimensions,' including informational,' physical,^ decisional," proprietary,^ and relational or associational* privacy.

This talk will focus primarily on informational privacy, which fits well within the general definition of privacy as a condition of limited access to an individual or information about an individual.' The related concept, confidentiality, is defined as a condition under which information obtained or disclosed within a confidential relationship is not redisclosed without the permission of the individual.^ Security is defined as personal, physical, and electronic measures granting access to certain information to persons or entities authorized to receive it and denying access to others.' Any discussion of the law of privacy, especially in this building, should start with Justice Brandeis.

As many of you know, Brandeis coauthored a famous law review article in 1890 with his law partner, Samuel D.

Warren, * Herbert F.

Boehl Chair of Law and Medicine, University of Louisville School of Medicine.

Nicholas Craddock, J.D. 2014, provided excellent research assistance. Annotated and expanded version of remarks for Constitution Day, September 17, 2013, at the Brandeis School of Law, University of Louisville.

' TOM L.

BEAUCHAMP & JAMES F.

CHILDRESS, PRINCIPLES OF BIOMÉDICAL ETHICS 312 (7th ed.

2013) (principally relying on the work of Anita Allen).

^ Id ^ Physical privacy focuses on persons and their personal spaces.

Id.

* Decisional privacy concerns personal choices.

Id.

Proprietary privacy involves property interests in the person, such as a person's image.

Id.

' Relational or associational privacy includes the family and similarly intimate relations.

Id.

' NAT'L COMM. ON VITAL & HEALTH STATISTICS (NCVHS), PRIVACY AND CONFIDENTIALITY IN THE NATIONWIDE HEALTH INFORMATION NETWORK (2006), available at www.ncvhs.hhs.gov/060622 /t.htm.

' See id ' See id 333 334 UNIVERSITY OF LOUISVILLE LAW REVIEW [Vol. 52:333 called "The Right to Privacy."'" What was their motivation for writing it?

Warren was married to the former Mabel Bayard, the daughter of Senator Thomas F. Bayard of Delaware, a leading Democrat who unsuccessfully sought his party's presidential nomination three times." As a society couple, Samuel and Mabel Warren were featured frequently in the press. In fact, according to one study, between 1882, when they were first engaged, and 1890, when the Harvard Law Review article was published, sixty stories about their personal lives appeared in the newspapers of Boston, New York, and Washington.'^ Warren resented the press intruding into his private life,'^ and he asked Brandeis to help develop a legal theory to redress "the more fiagrant breaches of decency and propriety."''* Technology also played a role. The first easily portable cameras were developed at the end of the nineteenth century, which allowed photographers to invade "the sacred precincts of private and domestic life."'' The article by Warren and Brandeis, in which they brilliantly argued for the creation of a tort of invasion of privacy, received glowing reviews from legal scholars, such as Dean Roscoe Pound of the Harvard Law School,'^ but it did not immediately translate into widespread judicial acceptance.

That was the role of another giant in the law with a local connection. In 1960, William L. Prosser, who was bom in New Albany, Indiana, published an article in the California Law Review simply called "Privacy."'^ Prosser proposed that the common law should recognize four types of invasion of privacy: (1) intrusion upon the plaintiffs seclusion or solitude; (2) public disclosure of embarrassing private facts about the plaintiff; (3) publicity that places the plaintiff in a false light; and (4) appropriation of the plaintiffs name or likeness.'^ These four categories appeared in the Restatement (Second) of Torts" and they were widely adopted by the '" Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV.

193 ( 1890).

" Amy Gajda, What if Samuel D. Warren Hadn 't Married a Senator's Daughter?: Uncovering the Press Coverage That Led to "The Right to Privacy, " 2008 MICH. ST. L. REV. 35, 41.

Thomas F.

Bayard (1885-1889): Secretary of State, Miller Center, htlp://millercenter.org/president/cleveland/essays/cabinet/372 (last visited Jan.

21,2014).

'^ Gajda, supra note 11, at 44.

" MELVIN I. UROFSKY, LOUIS D. BRANDEIS: A LIFE 98 (2009).

''' Id. See also Warren & Brandeis, supra note 10, at 215-16.

" Warren & Brandeis, supra note 10, at 195.

"• UROFSKY, supra note 13, at 101.

" William L. Prosser, Privacy, 48 CALIF.

L.

REV.

383 (1960).

" Id at 389.

" RESTATEMENT (SECOND) OF TORTS §§ 652A-652E (1977). Prosser was the reporter. 2014] Privacy and Technology in the Twenty-First Century 335 courts.^" Tort actions for invasion of privacy, of course, only apply to private actors.

Constitutional law, applicable to governmental action, also has been asserted to be a source for protecting informational privacy.

In Whalen v.

Roe^^ the plaintiffs challenged the constitutionality of a New York state law requiring the collection in a centralized database of the names and addresses of all persons who obtain, pursuant to a doctor's prescription, certain controlled drugs, including powerful analgesics.^^ The Supreme Court stopped short of recognizing a constitutionally protected interest in informational privacy, holding that even assuming there were such a right, the statute was a reasonable measure to prevent the unlawful diversion of controlled substances.^^ The Court also recognized the growing threat to privacy posed by governmental data collection.

In his lead opinion. Justice Stevens wrote:

"We are not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files . . .

."^'' In a concurring opinion. Justice Brennan added:

"I am not prepared to say that future developments will not demonstrate the necessity of some curb on such technology."^^ Future developments certainly brought ever-greater computer capabilities and government utilization of data collection and analysis.

Thus far, however, there have yet to be any meaningful curbs on the technology. After Whalen, the lower courts assumed there was a constitutional right to informational privacy, but the courts overwhelmingly found the government had a compelling interest in accessing and using various types of personal information and therefore they upheld a wide range of challenged government actions.^* The Supreme Court revisited the issue in 2011 in NASA v.

Nelsonf a challenge to allegedly intrusive background questionnaires and interviews of references mandated for employees of NASA contractors.

The Supreme Court, in an opinion by Justice Alito, again assumed without deciding there is a constitutional right ™ DAN B.

DOBBS, THE LAW OF TORTS 1197-98 (2000); W.

PAGE KEETON ET AL., PROSSER AND KEETON ON TORTS 849-51 (5th ed. 1984).

^' Whalen v. Roe, 429 U.S. 589 (1977).

''/¿at 591-93.

'^ /d at 600,603-06.

" Id. at 605.

'' Id. at 607 (Brennan, J., concurring).

'' See Mark A.

Rothstein, Constitutional Right to Informational Health Privacy in Critical Condition, 39 J.L.

MED.

& ETHICS 280, 281 (2011).

'' NASA V.

Nelson, 131 S. Ct.

746 (2011). 336 UNIVERSITY OF LOUISVILLE LAW REVIEW [Vol. 52:333 to informational privacy and again held the government interest justified the infi-ingement on privacy.^^ The final type of privacy law is statutory. During the 1970s Congress considered, but failed to enact, comprehensive privacy legislation.^' In 1974, however. Congress enacted the federal Privacy Act,^° which established a code of fair information practices for government agencies that collect, use, or disseminate information. Importantly, the law only applies to information held by federal government agencies.^' There are also a number of subject-specific privacy laws at both the federal and state levels, such as the Family Educational Rights and Privacy Act (FERPA) (dealing with student records)^^ and the Health Insurance Portability and Accountability Act (HIPAA)" and its notorious Privacy Rule (dealing with health information).^'* Although much of my research involves health privacy, you will, no doubt, be pleased to learn that I will not be addressing HIPAA and other arcane statutes and regulations today.

What I want to talk about are some other current issues involving technology and privacy, beginning with surveillance and then moving to genetic testing.

During the last few months there has been a flood of information disclosed about government surveillance programs. Some of the disclosures resulted from Edward Snowden's leaks about the existence of the National Security Agency (NSA) program of telephone-based metadata analysis.^^ Other disclosures resulted from voluntary governmental releases of information, judicial opinions, and investigative journalism.^* These ^' /¿at751.

^' See Daniel J. Solove, Privacy and Power:

Computer Databases and Metcfihorsfor Information Privacy, 53 STAN.

L.

REV.

1393,1440 (2001).

" 5 U.S.C. § 552a (2012).

" 5 U.S.C. § 552a(a) (2012); 5 U.S.C. § 552(f) (2012) (defining covered "agencies" as government entities only).

" 20 U.S.C. § 1232g(2012).

" 42 U.S.C. §§ 300gg-300gg-2 (2012).

'" Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R.

pts. 160, 164 (2012).

" See, e.g., Jennifer Stisa Grannick & Christopher Jon Sprigman, Op-Ed., The Criminal N.S.A., N.Y.

TIMES, June 27,2013, http://www.nytimes.com/2013/06/28/opinion/tiie-criminal-nsa.htinl?_i=0.

'^ See, e.g., Glenn Greenwald, XKeyscore:

NSA Tool Collects 'Nearly Everything a User Does on the Internet,' THE GUARDIAN, July 31, 2013, http://www.theguardian.com/world/2013/jul/31/nsa-top-secret- program-online-data (revealing investigative findings about a government program tracking individuals' intemet activity); Ellen Nakashima, FISA Court Releases Opinion Upholding NSA Phone Program, WASH. POST, Sept.

17, 2013, http://articles.washingtonpost.com/2013-09-17/world/421465161 all-call-detai 1-records-phone- records-opinion (discussing the release of a FISA court opinion upholding the constitutionality of the NSA's "bulk records" collection of phone data); Ron Nixon, Postal Service Confirms Photographing All U.S.

Mail, N.Y.

TIMES, Aug. 2, 2013, http://www.nytimes.com/2013/08/03/us/postal-service-confirms-photographing-all- us-mail.html (discussing Postal Service's Mail Isolation and Tracking System). 2014] Privacy and Technology in the Twenty-First Century 337 disclosures raise fundamental issues of privacy protection in the age of technology.

At the end of July of this year, the Fifth Circuit decided a case in which it held that the federal government does not need a warrant to obtain cell phone location data from a cellular service provider.

" Cell phone location (or cell site) data indicate the location of a particular cell phone at various times in the past.^^ In addition, triangulating cell signal data from more than one cell tower or signal receiver can reveal movement of the cell phone and thereby the travel of the individual possessor of the phone.^' According to the Fifth Circuit, cell phone usage is a voluntary activity and therefore a user "voluntarily conveys his cell site data each time he makes a call."^" The court also emphasized the government is not collecting the information; it is merely getting access to information collected by the service provider.'*' Unsurprisingly, federal legislation to require a warrant before disclosing cell site information has been stalled in Congress.'*^ Meanwhile, Maine'*^ and Montana'*'* have enacted laws requiring a warrant for access to cell site location data and additional state legislation is likely.

The effect of this state legislation, however, is not entirely clear because of the possibility of federal preemption of telecommunications regulation.

A case pending in Oregon illustrates an important preemption issue in a slightly different context.

In 2009, the Oregon Legislature established the Oregon Prescription Drug Monitoring Program, an electronic database maintained by the Oregon Health Authority that records information about all "prescription drugs dispensed by pharmacies in Oregon that are classified in schedules II through rV under the federal Controlled Substances Act . . . ."'*^ The Oregon law provides that after filling a prescription for a controlled " In re Application of the U.S.

for Historical Cell Site Data, 724 F.3d 600, 615 (5th Cir. 2013) [hereinafter Cell Site Data].

^* M at 602.

^' See L. Scott Harrell, Locating Mobile Phones Through fínging and Triangulation, PURSUrr MAGAZINE, July 1, 2008, http://pursuitmag.com/locating-mobile-phones-through-pinging-and-triangulation/ (discussing triangulating cell phone data to show phone's location).

"" Cell Site Data, 724 F.3d at 614.

"' M at 611-12.

*^ Online Communications and Geolocation Protection Act, H.R. 983,113th Cong. (2013).

"' 2013 Me. Laws 402.

•'•' 2013 Mont. Laws 394.

"' OR. REV.

STAT.

§ 431.962(l)(a) (2011).

As of 2013, every state except Missouri had enacted similar legislation. Jason Hancock, Drug Czar Will Push Missouri to Track Prescription Medicines, KAN. CITY STAR (Aug. 15, 2012), http://www.kansascity.com/2012/08/14/3762592/dmg-czar-to-push- for-prescription.html. 338 UNIVERSITY OF LOUISVILLE LAW REVIEW [Vol. 52:333 substance, Oregon pharmacies are required to report electronically the name, address, and date of birth of the patient, as well as information about the prescribing physician."* The law prohibits the state fi"om disclosing prescription records to law enforcement agencies unless presented with a "valid court order based on probable cause and issued at the request of a federal, state or local law enforcement agency engaged in an authorized, drug-related investigation involving a person to whom the requested information pertains.""^ Notwithstanding this language, the federal Drug Enforcement Administration (DEA) has attempted to obtain prescription drug information for federal law enforcement purposes by using an administrative subpoena, as authorized by the Controlled Substances Act."^ The DEA's position is that the state requirement of a court order is preempted by federal law."' The State of Oregon disagrees, and it sued the DEA in United States District Court seeking a declaratory judgment that the Oregon statute is valid and not preempted by federal law.^" The American Civil Liberties Union (ACLU) intervened to assert that, notwithstanding the preemption issue, individuals have a reasonable expectation of privacy in their prescription drug records, as evidenced by Fourth Amendment case law and the traditional precepts of the physician-patient relationship.^' The ACLU's motion for summary judgment is currently pending before the district court. In the interest of full disclosure, I am working with the ACLU on this case as an unpaid expert witness.

A link between the NSA metadata telephone record program and the pending Oregon DEA case was disclosed in a New York Times story on September 2, 2013.^' The Hemisphere Project, which started in 2007 but was previously unknown, involves DEA again using administrative subpoenas, but this time to gain access to and data mine comprehensive telephone records from AT&T in combating drug trafficking.'^ DEA agents are actually embedded at the telecommunications company, where they ^ OR. REV. STAT.

§431.964(1) (2011).

"' OR. REV. STAT.

§ 431.966(2)(a)(C) (2011).

"' 21 U.S.C. §876(2012).

"" Complaint for Declaratory Judgment, Or. Prescription Drug Monitoring Program v. U.S. Drug Enforcement Admin., No, 12CVO2023,2012 WL 5898554, at H 5 (D. Or. Nov. 9,2012).

'' See generally Plaintiffs-lntervenors' Combined Response to Defendant DEA's Cross-Motion for Summary Judgment and Reply in Support of Plaintiffs-lntervenors' Motion for Summary Judgment, No.: 3:12- CV-02023-HA (D. Or. Sept. 23, 2013), available at htlps://www.aclu.org/sites/default/files/assets /48._aclu_ response-reply brief.pdf '^ Scott Shane & Colin Moynihan, Drug Agents Use Vast Phone Trove, Eclipsing N.S.A.

's, N.Y.

TIMES, Sept. 2,2013, at Al. 2014] Privacy and Technology in the Twenty-First Century 339 have access to the phone records of literally billions of telephone calls dating back to 1987.^'* With each new disclosure the public has become increasingly concerned about intrusive surveillance. Attempting to allay public apprehension, James Clapper, Director of National Security, reported to Congress that the agency has no current plans to collect cell location data as part of its surveillance program." Unfortunately, surveillance programs do not have a good track record of staying within the bounds of their mandate.

On August 21, 2013, a previously classified decision of the Foreign Intelligence Surveillance Court was released, and it strongly criticized the NSA for failing to limit the nature of its activities.

The Court is troubled that the government's revelations regarding NSA's acquisition of Internet transactions mark the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection program. ...

Contrary to the government's repeated assurances, NSA had been routinely running queries of the metadata using querying terms that did not meet the standard for querying. The Court concluded that this requirement had been "so frequently and systematically violated that it can be fairly said that this critical element of the overall. . . regime has never iunctioned effectively."^^ These latest revelations raise many questions. If one reluctantly concedes that the importance of preventing terrorism justifies some intrusive surveillance activities, should the cloak of constitutionality also extend to the legitimate, but less exigent, need to monitor billions of personal phone calls as part of a countemarcotics law enforcement program? Is there a difference between one's reasonable expectation of privacy in prescription drug records and phone call metadata? What " Id. In another controversial revelation in September 2013, it was established that the United States has been engaged in a massive program of cryptography. According to a story in the New York Times, the government now has virtually unfettered access to messages encrypted with the most common encryption technology. Nicole Perlroth et al., N.S.A.

Able to Foil Basic Safeguards of Privacy on Web, N.Y. TIMES, Sept. 6, 2013, http://www.nytimes.com/2013/09/06/us/nsa-foils-much-intemet- encryption.html?pagewanted=l&r=0&hp.

" Letter from James Clapper, Dir. of Nat'I Intelligence, Office of the Dir. of Central Intelligence, to Senator Ron Wyden (July 26, 2013), available at http://www.wyden.senate.gov/download /?id=285dc9e7-195a-4467-b0fe-caa857fc4e0d.

" Memorandum Opinion of Judge John D. Bates, 2011 WL 10945618, at '*5 n.l4 (Foreign Intelligence Surveillance Court Oct. 3, 2011) (case name redacted). A second highly critical judicial opinion, issued in 2009, was released by the government in September 2013. Scott Shane, Court Upbraided N.S.A.

on its Use of Call-Log Data, N.Y. TIMES (Sept. 10, 2013), http://www.nytimes.com/2013/09/ll/us/court- upbraided-nsa-on-its-use-of-call-log-data.html?pagewanted=all& r=0. 340 UNIVERSITY OF LOUISVILLE LAW REVIEW [Vol. 52:333 constitutional or other boundaries are essential to protect unreasonable intrusions of what Warren and Brandeis called individuals' "inviolate personality"?" Finally, how can we protect against the expansion of surveillance through "function creep"?

Perhaps the best example of function creep involves a wholly different type of technology—DNA forensics. The technology for uniquely identifying individuals from a DNA sample was developed in the United Kingdom by Alec Jeffreys in the mid-1980s,'^ and it was soon adopted in the United States for law enforcement.^' At first, state laws limited the use of mandatory DNA collection and forensic database creation to individuals convicted of murder or rape.^° These crimes were chosen because of their severity and the likelihood of DNA being left at a crime scene. It was not long, however, before a steady stream of federal and state legislation was enacted to expand the categories for DNA collection to all felons, all misdemeanants, all juvenile offenders, and finally, all arrestees.*' The expansion occurred without any peer-reviewed evidence of the efficacy of wider-scope DNA collection in solving crimes*^ and despite substantial backlogs in processing samples from existing categories.^^ In June 2013, the Supreme Court decided Maryland v.

King.^'^ The Court, five-to-four, in an opinion by Justice Kennedy, upheld Maryland's warrantless DNA collection from all arrestees charged with a serious crime.^^ According to the majority opinion, the search was lawful because it was used to identify the individual and because the Court considered DNA testing using a buccal swab for obtaining a DNA sample no more intrusive than a fingerprint.** In dissent. Justice Scalia said the purpose of the search was not identification, but to discover evidence of criminal wrongdoing, and therefore a warrant was required.*^ He also expressed his strong belief that the majority's position of upholding DNA testing of " Warren & Brandeis, supra note 10, at 205.

'* See Alec Jeffreys et al, Individual-Specific 'Fingerprints' of Human DNA, 316 NATURE 76 (1985).

^' See Andrews v. State, 533 So. 2d 841 (Fla. Dist. Ct. App. 1988) (affirming conviction of first reported U.S. case to admit DNA identification evidence).

'° See Mark A. Rothstein & Sandra Camahan, Legal and Policy Issues in Expanding the Scope of Law Enforcement DNA Data Banks, 67 BROOK. L. REV. 127, 128 (2001 ).

" See Mark A. Rothstein & Meghan K. Talbott, 7?!e Expanding Use of DNA in Law Enforcement:

What Role for Privacy?, 34 J.L.

MED.

& ETHICS 153, 153 (2006).

" Id at 154.

"Id " Maryland v. King, 133 S. Ct. 1958 (2013).

'' Id at 1980.

"" Id " See id at 1985-86 (Scalia, J., dissenting). 2014] Privacy and Technology in the Twenty-First Century 341 arrestees will be extended beyond the "serious crimes" of the Maryland law.*^ Justice Scalia wrote, "Make no mistake about it: As an entirely predictable consequence of today's decision, your DNA can be taken and entered into a national DNA database if you are ever arrested, rightly or wrongly, and for whatever reason."*' Today, besides "direct" DNA searches, law enforcement agencies use indirect searches,^" low stringency searches,''' dragnet searches,^^ surname searches," health care biobank searches,^'* and phenotypic profiling." There are also calls for a DNA sample to be taken from every individual in the country.^* The expansion of DNA forensic analysis has taken place with very little objection fi-om the public or elected officials because of the unproven assumption that each expansion of testing reduces crime and therefore additional incursions on privacy are justified. In the realm of DNA forensics, we have lost our privacy rights through a series of incremental incursions, but this should offer little consolation. As Justice Douglas wrote in Osbom v. United States:

[T]he privacy and dignity of our citizens is heing whittled away by sometimes imperceptible steps. Taken individually, each step may be of little consequence. But when viewed as a whole, there begins to emerge a society quite unlike any we have seen - a society in which government '* Id. at 1989 (Scalia, J., dissenting).

" Id. (Scalia, J. dissenting).

™ Indirect searches involve obtaining the DNA of a family member of a suspect, often surreptitiously, to get genetic information from which an inference may be made about the genetic makeup of the suspect. See Rothstein & Talbott, supra note 61, at 156.

" Low stringency searches occur when DNA testing results in short tandem repeat matches with crime scene or other DNA insufficient to establish a match, but greater than a random amount and therefore suggestive that the test subject is related to the individual being sought. See id. at 156-57.

" Dragnet searches entail the collection of DNA from individuals who fit tiie general description of a perpetrator, usually residing or working in the same geographic area where a crime occurred. See id.

at 155-56.

" Surname searches involve matching crime scene evidence against a data bank of surname haplotypes. See id.

at 157.

'* Health care biobank searches involve obtaining physical specimens of suspects from health care facilities for DNA analysis. See id.

at 157-58.

" Phenotypic profiling involves using the resuhs of DNA analysis on an unknown sample to construct a profile of the phenotypic characteristics (e.g., gender, illnesses) of the individual. See id. at 158.

See genera/^y National Institute of Justice, Forensic DNA: Alternative Genetic Markers, Research Projects List, available at http://www.nij.gov/topics/forensics/evidence/dna/research/altemative- markers.htm (reporting that DNA analysis can indicate ethnicity, physical characteristics, and skin, hair, or eye color).

'^ See Rothstein & Talbott, supra note 61, at 154. 342 UNIVERSITY OF LOUISVILLE UW REVIEW [Vol. 52:333 may intrude into the secret regions of a man's life at will.^^ Genetic testing raises many other fascinating privacy issues, including surreptitious testing. Suppose, after my talk, I leave my empty water bottle here on the lectern. Would it be lawful for you to pick up the bottle, send it to a commercial laboratory, and have whole genome sequencing performed?^^ The answer is that nonconsensual genetic testing is probably lawful in virtually every state, including the twelve states with laws requiring consent for certain kinds of genetic testing.^' Would it matter if the bottle were picked up and tested by the FBI or some law enforcement agency?

No. As a matter of constitutional law and property law, if I "abandon" an item, I have relinquished any property or other interest I have in it and finders of the item can do with it whatever they want.^" In my view, when individuals inadvertently leave behind or intentionally discard an object, such as an empty water bottle, used chewing gum, or cigarette butt, they are not impliedly consenting to have any dumpster diver retrieve the object and have whole genome sequencing performed. These new technologies can reveal a wealth of information about an individual's current and future health as well as familial risk factors, parentage, ancestral origin, and other information. Although I doubt there is much interest in my DNA, one can assume there is a substantial market for the DNA of entertainers, sports figures, politicians, and other celebrities.^' In 2012, the Presidential Commission for the Study of Bioethical Issues identified nonconsensual DNA testing as a key policy issue that should be addressed.^^ In the United Kingdom, section 45 of the Human Tissue Act of 2004 makes it unlawful for any individual, without proper consent, to possess any " Osbom V.

United States, 385 U.S. 323, 343 (1966) (Douglas, J., dissenting).

" Today, whole genome sequencing costs $3,000-$4,000, but the cost keeps dropping and soon it will be under $1,000.

DNA Sequencing Costs, NAT'L HUMAN GENOME RESEARCH INST., http://www.genome.gov/sequencingcosts (last updated Oct. 29, 2013).

See also Ivan Karabaliev, The $1,000 Genome Is Almost Here—Are We Ready?, Sei. Am. (Oct. 15, 2012), http://blogs.scientificamerican.com/guest-blog/2012/10/15/the-1000-genome-is-here-are-we-ready/ (guest commentary).

" These states are Alaska, Arizona, Florida, Georgia, Massachusetts, Michigan, Nebraska, New Mexico, New York, South Carolina, South Dakota, and Vermont.

See Mark A.

Rothstein, Genetic Stalking and Voyeurism:

A New Challenge to Privacy, 57 U. KAN. L. REV. 539, 560 n.l52 (2009).

*° See Califomia v. Greenwood, 486 U.S. 35, 39-43 (1988).

*' See Rothstein, supra note 79, at 539-43.

*^ PRESIDENTIAL COMM'N FOR THE STUDY OF BIOETHICAL ISSUES, PRIVACY AND PROGRESS IN WHOLE GENOME SEQUENCING 2-3 (2012), available at http://bioethics.gov/sites/default/files/Privacy Progress508_l .pdf 2014] Privacy and Technology in the Twenty-First Century 343 "bodily material" with the intent to have DNA testing performed.*^ There are exceptions for medical treatment, law enforcement, research, and other uses.^" The reason for the law is that in 2002 there were press reports about an alleged plot to steal hair from Prince Harry and perform genetic testing.^' The purpose was to determine if IVIajor James Hewitt, with whom Princess Diana had an affair, was the father of Prince Harry, rather than Prince Charles.^'' Section 45 makes any unauthorized DNA testing a crime punishable by up to three years in prison.^^ Fortunately, we have no royal family in the United States; unfortunately, we have no law comparable to the statute that the British royal family inspired.

Finally, I want to comment briefiy on the following argument I often hear. It goes something like this: "Times have changed. The younger generation does not care about privacy the way their parents did. Look at all of the highly personal information and photos they post on social media sites.

Besides, it is impossible to protect privacy in an age of technology, and attempting to do so is a waste of time and effort." Or, as Scott McNealy, co-founder of Sun Microsystems, famously told reporters in 1999, "You have zero privacy anyway. Get over it."^^ I agree it is difficult and costly to protect privacy—and the cost is not just money. It includes constraints on law enforcement and national security agencies; limitations on commercial entities and financial institutions; inconvenience for educators; extra burdens for employers; additional administrative steps for medical researchers; and a more time- consuming consent process for health care providers. I agree that some of the burdens could be reduced and that efforts are needed to streamline and minimize procedures. Despite these costs, I strongly believe that privacy is worth the cost. It is the price we pay for living in a civil society that respects the dignity, autonomy, and personal space of every individual. It is disconcerting to contemplate a society that would abandon privacy in favor of technology and expediency.

*' Human Tissue Act, 2004, c. 30, § 45(1) (Eng.).

'•* Rothstein, supra note 79, at 566.

''Id *' Prince Harry 'Honey Trap' Allegations, BBC NEWS (Dec. 15, 2002), http://news.bbc.co.Uk/l/hi/ uk/2577539.stm.

" Human Tissue Act, § 45(3)(b)(l).

" Private Lives? Not Ours!, PC WORLD (Apr. 18, 2000), http://www.pcworld.com/article/16331 /article.html. 344 UNIVERSITY OF LOUISVILLE LAW REVIEW [Vol. 52:333 Let me end by quoting from Brandeis's majestic dissent in Olmstead v.

United States:

The makers of our Constitution undertook to secure conditions favorable to the pursuit of happiness. They recognized the significance of man's spiritual nature, of his feelings and of his intellect. They knew that only part of the pain, pleasure and satisfactions of life are to be found in material things. They sought to protect Americans in their beliefs, their thoughts, their emotions, and their sensations. They conferred as against the Government, the right to be let alone - the most comprehensive of rights and the right most valued by civilized men.

' Olmstead v. United States, 277 U.S. 438,478 (1928) (Brandeis, J., dissenting). Copyright ofUniversity ofLouisville LawReview isthe property ofUniversity ofLouisville School ofLaw anditscontent maynotbecopied oremailed tomultiple sitesorposted toa listserv without thecopyright holder'sexpresswrittenpermission. However,usersmayprint, download, oremail articles forindividual use.