Stanford Law Review: Volume 63, Issue 2 - January 2011

Stanford Law Review

January 2011

Stanford Law Review

Volume 63, Issue 2

January 2011

Smashwords edition. Copyright © 2011 by the Board of Trustees of the Leland Stanford Junior University. All rights reserved. This work or parts of it may not be reproduced, copied, or transmitted (except as permitted by sections 107 and 108 of the U.S. Copyright Law and except by reviewers for the public press), by any means including voice recordings and the copying of its digital form, without the written permission of the print publisher.

Published by the Stanford Law Review. Digitally published in ebook editions, for the Stanford Law Review, by Quid Pro Books. Available in all major digital formats and at leading ebook retailers and booksellers.

Quid Pro Books

Quid Pro, LLC

5860 Citrus Blvd., suite D-101

New Orleans, Louisiana 70123

www.quidprobooks.com

For Volume 63, Issue 2 – January 2011:

ISBN-13: 9781610270496 (ePub)

ISBN: 1610270495 (ePub)

CONTENTS

[Page references are to the print edition.]

ARTICLES

PRIVACY ON THE BOOKS AND ON THE GROUND

Kenneth A. Bamberger & Deirdre K. Mulligan

WHAT JUDGES THINK OF THE QUALITY OF LEGAL REPRESENTATION

Richard A. Posner & Albert H. Yoon

JUST THE FACTS: THE CASE FOR WORKPLACE TRANSPARENCY

Cynthia Estlund

ESSAY

INDEPENDENCE AND EXPERIMENTALISM IN THE DEPARTMENT OF JUSTICE

Norman W. Spaulding

NOTE

THE BENEFIT OF SPYING: DEFINING THE BOUNDARIES OF ECONOMIC ESPIONAGE UNDER THE ECONOMIC ESPIONAGE ACT OF 1996

William J. Edelman

Information About the Stanford Law Review

Subscriptions (print edition): The Stanford Law Review (ISSN 0038-9765) is published six times a year (December, January, March, April, May, and June) by students of the Stanford Law School, Crown Quadrangle, 559 Nathan Abbott Way, Stanford, California 94305-8610. Subscriptions are $52 per year; for postage to a foreign address, add $5. All subscriptions are for the volume year and will be renewed automatically unless the subscriber provides timely notice of cancellation.

Postage: Periodicals Postage Paid at Palo Alto, California 94303, and additional mailing offices.

Postmaster: Mail change of address or other subscription information to Business Manager, Stanford Law Review, Crown Quadrangle, 559 Nathan Abbott Way, Stanford, California 94305-8610. Include name, new address (including zip code), and old address or mailing label. Please mail changes at least six to eight weeks before the publication date to ensure prompt delivery. The U.S. Postal Service will not forward copies unless additional postage is paid by the subscriber.

Single Issues (print edition): Issues in the current volume are available from the Review for $20 each plus shipping and handling fees. For back issues, volumes, and sets, inquire of William S. Hein & Co., Inc., 1285 Main Street, Buffalo, New York 14209-1987. Orders may also be placed by calling Hein at (800) 828-7571, via fax at (716) 883-8100, or by email at order@wshein.com. Back issues can be found in electronic format on HeinOnline (http://heinonline.org).

Manuscripts: The Review accepts the submission of unsolicited manuscripts through our website. For further information, please see http://www.stanfordlawreview.org/content/articles. Please include an email address with all submissions.

Citations: The text and citations of the Review generally conform to The Bluebook: A Uniform System of Citation (19th ed. 2010), copyright by The Columbia Law Review Association, The Harvard Law Review Association, the University of Pennsylvania Law Review, and The Yale Law Journal.

Internet Address: The Stanford Law Review homepage is located at http://www.stanfordlawreview.org.

EDITORIAL BOARD

VOLUME 63

MASHA GODINA HANSFORD

President

SHELTON L. ABRAMSON

JANINE ANN WETZEL

Executive Editors

LAURA E. CONNIFF

ERIC HANSFORD

Managing Editors

DMITRY KARSHTEDT

Senior Symposium Editor

JENNIFER CLARK

Senior Development Editor

JENNIFER A.L. SHELDON-SHERMAN

Senior Notes Editor

ZAC ALEXANDER COX

Senior Production Editor

JOSH PATASHNIK

Senior Articles Editor

JONATHAN JAMES GOODWIN

Senior Finance Editor

Projects Editor

ALEX REESE

Technical Managing Editor

COLLIN P. WEDEL

Symposium Editors

ZACHARY ORLO JONES CARPENTER

ANYU FANG

JUSTIN T. GOODWIN

MATT KELLOGG

ALLISON M.E. PEDRAZZI

ELIZABETH LAUREN VAN PELT

Development Editors

ELISSA LINDEN GYSI

HAYLEY HUNT HEDGES

BENJAMIN T. JACKSON

KEVIN C. LO

PRIYA NAIK

NORMAN ANDREW SFEIR

JOHN CARDENAS WILLIAMS

Notes Editors

KATHERINE BEARMAN

MICHAEL CAESAR

LOREN A. CRARY

WILL EDELMAN

MATTHEW XAVIER ETCHEMENDY

MORGAN A. GALLAND

SOPHIA LIN LAKIN

MICHAEL MILLER

ERIN MOHAN

JESSICA I. ROTHSCHILD

THOMAS M. SPAHN

Articles Editors

DANIEL WILLIAM BELL

ELIZABETH BOGGS

GAYLE JENNIFER DENMAN

ALEXANDRA L. LAMPERT

KYLE W. MAURER

ESTEBAN MORIN

GOVIND C. PERSAD

EMILY O’BRIEN ROBERTS

ANDREW PAUL SCHUPANITZ

TIMOTHY H. SHAPIRO

YANBAI ANDREA WANG

Members

JONATHAN ABEL

JULIA ALLEN

ALEXANDER B.M. ARONSON

AMY KNIGHT BURNS

CHRISTOPHER BROOKS COLE

EMILY C. CURRAN-HUBERTY

ROSE LEDA EHLER

LILLY FANG

JANE E. FARRINGTON

MAGGIE ELLEN FILLER

ERIC S. FLEEKOP

JAMES FREEDMAN

J. ROBERT GARCIA

JENNIFER M. GIBSON

JUSTIN MICHAEL GONZALES

JENNIFER M. HALBLEIB

JENNIFER A. HOLMES

KATHERINE C. HUDSON

WILLIAM JACOBSON

CORINNE F. JOHNSON

CHERYL JOSEPH

ADAM KOOL

EMILY KORINEK

MELINDA LEE KOSTER

STEPHANIE LINDSAY LAKE

JONATHAN LELAND

STEWART P. LYNN

CLINTON J. MARTIN

BLAKE MASTERS

BRIGGS MATHESON

JONATHAN R. MAYER

COLIN MCDONELL

AMY R. MOTOMURA

BETH NEITZEL

JACQUES MICHEL NTONME

LARA PALANJIAN

ANDREW G. PROUT

HOLLY RAGAN

C. HARKER RHODES IV

PETER J. RICHMOND

NOAH SMITH-DRELICH

PETER SQUERI

MICHAEL TAMKIN

KATHERINE TRAVERSO

Business Manager

JULIE YEE

The Stanford University School of Law

OFFICERS OF ADMINISTRATION

John Hennessy, B.E., M.S., Ph.D., President of the University

John Etchemendy, B.A., M.A., Ph.D., Provost of the University

Larry D. Kramer, A.B., J.D., Dean and Richard E. Lang Professor of Law and Professor (by courtesy) of History

Mark G. Kelman, A.B., J.D., James C. Gaither Professor of Law and Vice Dean

Deborah R. Hensler, A.B., Ph.D., Judge John W. Ford Professor of Dispute Resolution and Associate Dean for Graduate Studies

Lawrence C. Marshall, B.A., J.D., Professor of Law, David and Stephanie Mills Director of Clinical Education, and Associate Dean for Public Interest and Clinical Education

Jane Schacter, A.B., J.D., William Nelson Cromwell Professor of Law and Associate Dean for Curriculum

F. Daniel Siciliano, B.A., J.D., Senior Lecturer in Law and Associate Dean for Executive Education and Special Programs

Frank F. Brucato, B.A., Senior Associate Dean for Administration and Chief Financial Officer

Diane T. Chin, B.A., J.D., Lecturer in Law and Associate Dean for Public Service and Public Interest Law

Faye Deal, A.B., Associate Dean for Admissions and Financial Aid

Catherine Glaze, A.B., J.D., Associate Dean for Student Affairs

Sabrina Johnson, B.A., Associate Dean for Communications and Public Relations

Susan C. Robinson, B.A., J.D., Associate Dean for Career Services

Scott Showalter, B.A., Associate Dean for External Relations

FACULTY EMERITI

Barbara Allen Babcock, A.B., LL.B., LL.D. (hon.), Judge John Crown Professor of Law, Emerita

Paul Brest, A.B., LL.B., LL.D. (hon.), Professor of Law, Emeritus, and former Dean

William Cohen, B.A., LL.B., C. Wendell and Edith M. Carlsmith Professor of Law, Emeritus

Lance E. Dickson, B.A., LL.B., B.Com., M.L.S., Professor of Law, Emeritus, and former Director of Robert Crown Law Library

Marc A. Franklin, A.B., LL.B., Frederick I. Richman Professor of Law, Emeritus

William B. Gould IV, A.B., LL.B., LL.D. (hon.), Charles A. Beardsley Professor of Law, Emeritus

Thomas C. Grey, B.A., B.A., LL.B., LL.D. (hon.), Nelson Bowman Sweitzer and Marie B. Sweitzer Professor of Law, Emeritus

Thomas C. Heller, A.B., LL.B., Lewis Talbot and Nadine Hearn Shelton Professor of International Legal Studies, Emeritus

Miguel A. Méndez, A.A., B.A., J.D., Adelbert H. Sweet Professor of Law, Emeritus

John Henry Merryman, B.S., M.S., J.D., LL.M., J.S.D., Dr. h.c., Nelson Bowman Sweitzer and Marie B. Sweitzer Professor of Law, Emeritus, and Affiliated Professor of Art, Emeritus

David Rosenhan, A.B., M.A., Ph.D., Professor of Law and Psychology, Emeritus

Kenneth E. Scott, A.B., M.A., LL.B., Ralph M. Parsons Professor of Law and Business, Emeritus

Michael S. Wald, A.B., M.A., LL.B., Jackson Eli Reynolds Professor of Law, Emeritus

Howard R. Williams, A.B., LL.B., Robert E. Paradise Professor of Natural Resources Law, Emeritus

PROFESSORS

Janet Cooper Alexander, B.A., M.A., J.D., Frederick I. Richman Professor of Law

Joseph M. Bankman, A.B., J.D., Ralph M. Parsons Professor of Law and Business

R. Richard Banks, B.A., M.A., J.D., Jackson Eli Reynolds Professor of Law

Juliet M. Brodie, A.B., J.D., Professor of Law

Joshua Cohen, B.A., M.A., Ph.D., Professor of Political Science, Philosophy, and Law

G. Marcus Cole, B.S., J.D., Wm. Benjamin Scott and Luna M. Scott Professor of Law

Richard Craswell, B.A., J.D., William F. Baxter-Visa International Professor of Law

Mariano-Florentino Cuéllar, A.B., A.M., J.D., Ph.D., Professor of Law and Deane F. Johnson Faculty Scholar

Robert M. Daines, B.S., B.A., J.D., Pritzker Professor of Law and Business and Professor (by courtesy) of Finance

Michele Landis Dauber, B.S.W., J.D., Ph.D., Professor of Law, Bernard D. Bergreen Faculty Scholar, and Professor (by courtesy) of Sociology

John J. Donohue III, B.A., J.D., Ph.D., C. Wendell and Edith M. Carlsmith Professor of Law

David Freeman Engstrom, A.B., M.Sc., J.D., Ph.D., Assistant Professor of Law

Nora Freeman Engstrom, B.A., J.D., Assistant Professor of Law

George Fisher, A.B., J.D., Judge John Crown Professor of Law

Jeffrey L. Fisher, A.B., J.D., Associate Professor of Law

Richard Thompson Ford, A.B., J.D., George E. Osborne Professor of Law

Barbara H. Fried, B.A., M.A., J.D., William W. and Gertrude H. Saunders Professor of Law

Lawrence M. Friedman, A.B., J.D., LL.M., LL.D. (hon.), Marion Rice Kirkwood Professor of Law, Professor (by courtesy) of History, and Professor (by courtesy) of Political Science

Ronald J. Gilson, A.B., J.D., Charles J. Meyers Professor of Law and Business

Paul Goldstein, A.B., LL.B., Stella W. and Ira S. Lillick Professor of Law

Henry T. Greely, A.B., J.D., Deane F. and Kate Edelman Johnson Professor of Law and Professor (by courtesy) of Genetics

Joseph A. Grundfest, B.A., M.Sc., J.D., W.A. Franke Professor of Law and Business

Deborah R. Hensler, A.B., Ph.D., Judge John W. Ford Professor of Dispute Resolution and Associate Dean for Graduate Studies

Daniel E. Ho, B.A., A.M., Ph.D., J.D., Professor of Law and Robert E. Paradise Faculty Fellow for Excellence in Teaching and Research

Pamela S. Karlan, B.A., M.A., J.D., Kenneth and Harle Montgomery Professor of Public Interest Law

Mark G. Kelman, A.B., J.D., James C. Gaither Professor of Law and Vice Dean

Amalia D. Kessler, A.B., M.A., J.D., Ph.D., Professor of Law, Helen L. Crocker Faculty Scholar, and Professor (by courtesy) of History

Daniel P. Kessler, B.A., J.D., Ph.D., Professor of Law, Senior Fellow, Hoover Institution, and Professor of Health Research and Policy (by courtesy) of School of Medicine

Michael Klausner, B.A., M.A., J.D., Nancy and Charles Munger Professor of Business and Professor of Law

William S. Koski, B.B.A., J.D., Ph.D., Eric and Nancy Wright Professor of Clinical Education and Professor (by courtesy) of Education

Larry D. Kramer, A.B., J.D., Dean and Richard E. Lang Professor of Law and Professor (by courtesy) of History

Mark A. Lemley, B.A, J.D., William H. Neukom Professor of Law

Lawrence C. Marshall, B.A., J.D., Professor of Law, David and Stephanie Mills Director of Clinical Education, and Associate Dean for Public Interest and Clinical Education

Jenny S. Martinez, B.A., J.D., Professor of Law and Justin M. Roach, Jr. Faculty Scholar

Michael W. McConnell, B.A., J.D., Richard and Frances Mallery Professor of Law, Director, Stanford Constitutional Law Center, and Senior Fellow, Hoover Institution

Jay Mitchell, B.A., J.D., Associate Professor of Law and Director, Organizations and Transactions Clinic

Alison D. Morantz, A.B., M.Sc., J.D., Ph.D., Associate Professor of Law and John A. Wilson Distinguished Faculty Scholar

Joan Petersilia, B.A., M.A., Ph.D., Adelbert H. Sweet Professor of Law

A. Mitchell Polinsky, A.B., Ph.D., M.S.L., Josephine Scott Crocker Professor of Law and Economics and Professor (by courtesy) of Economics

Robert L. Rabin, B.S., J.D., Ph.D., A. Calder Mackay Professor of Law

Deborah L. Rhode, B.A., J.D., Ernest W. McFarland Professor of Law

Jane Schacter, A.B., J.D., William Nelson Cromwell Professor of Law and Associate Dean for Curriculum

Deborah A. Sivas, A.B., M.S., J.D., Luke W. Cole Professor of Environmental Law

Norman W. Spaulding, B.A., J.D., Nelson Bowman Sweitzer and Marie B. Sweitzer Professor of Law

Jayashri Srikantiah, B.S., J.D., Associate Professor of Law

James Frank Strnad II, A.B., J.D., Ph.D., Charles A. Beardsley Professor of Law

Kathleen M. Sullivan, B.A., B.A., J.D., Stanley Morrison Professor of Law and former Dean

Alan O. Sykes, B.A., J.D., Ph.D., James and Patricia Kowal Professor of Law

Barton H. Thompson, Jr., A.B., J.D., M.B.A., Robert E. Paradise Professor of Natural Resources Law, Director, Woods Institute for the Environment, and Senior Fellow (by courtesy), Freeman Spogli Institute for International Studies

Barbara van Schewick, Ph.D., Associate Professor of Law

Michael Wara, B.A., Ph.D., J.D., Assistant Professor of Law and Research Fellow, Freeman Spogli Institute for International Studies

Robert Weisberg, A.B., A.M., Ph.D., J.D., Edwin E. Huddleson, Jr. Professor of Law

SENIOR LECTURERS

Margaret R. Caldwell, B.S., J.D., Senior Lecturer in Law and Executive Director, Center for Oceans Solutions, Woods Institute for the Environment

Janet Martinez, B.S., J.D., M.P.A., Senior Lecturer in Law

David W. Mills, B.A., J.D., Senior Lecturer in Law

F. Daniel Siciliano, B.A., J.D., Senior Lecturer in Law and Associate Dean for Executive Education and Special Programs

Allen S. Weiner, A.B., J.D., Senior Lecturer in Law

VISITING PROFESSORS & AFFILIATED FACULTY

Michael Asimow, B.S., J.D., Visiting Professor of Law

Kyle Bagwell, B.S., Ph.D., Affiliated Faculty

Alexandria Boehm, M.S., Ph.D., Affiliated Faculty

Jared R. Curhan, A.B., A.M., Ph.D., Visiting Associate Professor of Law

Nita Farahany, M.A., J.D., Ph.D., Visiting Associate Professor of Law

Siegfried Fina, J.D., J.S.D., Visiting Associate Professor of Law

Pratheepan Gulasekaram, J.D., Visiting Assistant Professor of Law

Tamar Herzog, Ph.D., Affiliated Faculty

David Holloway, B.A., M.A., Ph.D., Affiliated Faculty

Daniel Hulsebosch, J.D., Ph.D., Visiting Professor of Law

Ron Kasznik, M.S., Ph.D., Affiliated Faculty

Chimene Keitner, M.P., D.P., J.D., Visiting Associate Professor of Law

Brian Lowery, B.S., M.A., Ph.D., Affiliated Faculty

Mark McKenna, J.D., Visiting Associate Professor of Law

Bernadette Meyler, J.D., Ph.D., Visiting Professor of Law

David Patton, J.D., Visiting Assistant Professor of Law

Rogelio Perez-Perdomo, Ph.D., Visiting Professor of Law

Paul C. Pfleiderer, B.A., M.Phil., Ph.D., Professor (by courtesy) of Law

Madhav Rajan, B.A., M.S., M.B.A., Ph.D., Professor (by courtesy) of Law

Jack Rakove, A.B., Ph.D., Professor (by courtesy) of Law

Nicholas Quinn Rosenkranz, B.A., J.D., Visiting Associate Professor of Law

Lee D. Ross, B.A., Ph.D., Affiliated Faculty

Rebecca Sandefur, B.A., M.A., Ph.D., Assistant Professor (by courtesy) of Law

William Simon, A.B., J.D., Visiting Professor of Law

Helen Stacy, LL.B., Ph.D., Affiliated Faculty

Frank A. Wolak, B.A., M.S., Ph.D., Affiliated Faculty

Jonathan Zittrain, B.S., M.P.A., J.D., Visiting Professor of Law

LECTURERS AND TEACHING FELLOWS

Alvin Attles, J.D.

Dmitry Barn, J.D.

Daniel Barton, J.D.

Marilyn M. Bautista, J.D.

Jeanine Becker, J.D.

Samuel Bray, J.D.

Viola Canales, J.D.

Diane T. Chin, J.D.

Daniel Cooperman, J.D., M.B.A.

John Crawford, M.A., J.D.

Elizabeth de la Vega, J.D.

Lothar Determann, J.D.

Michael Dickstein, J.D.

Bonnie Eskenazi, J.D.

Anthony Falzone, J.D.

Randee G. Fenner, J.D.

Bertram Fields, LL.B.

Jeremy Fogel, J.D.

David Forst, J.D.

Laurence Franklin, J.D., M.B.A., C.P.A.

Michelle Galloway, J.D.

Mei Gechlik, LL.B., LL.M., J.S.D., J.S.M., M.B.A.

Thomas C. Goldstein, J.D.

Richard Goldstone, LL.B.

Jonathan D. Greenberg, J.D.

Timothy H. Hallahan, J.D.

Brad Handler, J.D.

Keith Hennessey, M.P.P.

Brooke Heymach, J.D.

Amy Howe, M.A., J.D.

John Huhs, J.D., M.B.A.

Ivan Humphreys, J.D.

Erik Jensen, J.D.

David Johnson, J.D., J.S.M.

Danielle Jones, J.D.

Stephen Juelsgaard, D.V.M., J.D.

Kathleen Kelly, J.D.

Julie Matlof Kennedy, J.D.

Jason Kipnis, J.D.

Suzanne McKechnie Klahr, J.D.

Jeffrey W. Kobrick, J.D.

Charles Koob, J.D.

Phillip Levine, J.D.

Donald Lewis, J.D., LL.M.

Galit Lipa, J.D., LL.M.

J. Paul Lomio, J.D., LL.M., M.L.I.S.

Brian Love, J.D.

Steven Lucas, J.D.

Beth McLellan, J.D.

Jeanne Merino, J.D.

Roberta Morris, J.D., Ph.D.

Linda Netsch, J.D.

Thomas J. Nolan, J.D.

Jessica Notini, J.D.

Ralph Pais, J.D.

Moria Paz, J.S.D., LL.M.

B. Howard Pearson, J.D.

Lisa M. Pearson, J.D., J.S.M.

Pamela Phan, J.D.

Joe Pitts III, J.D.

Duane Quaini, J.D.

Stephan Ray, J.D.

Claudio Rechden, LL.B., LL.M.

Michael Romano, J.D.

Andrew Roper, M.A., Ph.D.

Stephen Rosenbaum, J.D.

Matthew Rossiter, J.D.

Thomas Rubin, J.D.

Kevin Russell, J.D.

Richard Salgado, J.D.

Ticien Sassoubre, Ph.D.

Rachelle Silverberg, J.D.

Smita Singh, Ph.D.

Stephanie E. Smith, J.D.

Steven Smith, M.P., LL.B., J.D.

Dee Smythe, LL.B., J.S.D., J.S.M

Sergio Stone, J.D., M.L.I.S.

Kimberly Summe, M.S., M.A., LL.B., J.D.

Stuart Taylor Jr., J.D.

Peter Thiel, J.D.

Jean Thomas, M.A., J.D., LL.M., J.S.D.

Dan Torres, J.D.

Erika V. Wayne, J.D., M.S.

Dana Weintraub, M.D.

Robert Wexler, J.D.

Katherine Wright, J.D.

PROFESSIONAL LIBRARY STAFF

Annie Chen, B.A., M.L.S.

Alba Holgado, B.A.

J. Paul Lomio, B.A., J.D., LL.M., M.L.I.S.

Rachael Samberg, J.D.

Sergio Stone, J.D., M.L.I.S.

Erika V. Wayne, A.B., J.D., M.S.

George D. Wilson, B.A., J.D., M.L.I.S.

Sarah Wilson, B.A., M.L.I.S.

Kathleen M. Winzer, B.A., M.L.S.

Naheed Zaheer, B.S., M.S., M.L.I.S.

ARTICLE

PRIVACY ON THE BOOKS AND ON THE GROUND

Kenneth A. Bamberger & Deirdre K. Mulligan

63 Stan. L. Rev. 247 (January 2011)

ARTICLES

PRIVACY ON THE BOOKS AND ON THE GROUND

Kenneth A. Bamberger* & Deirdre K. Mulligan**

U.S. privacy law is under attack. Scholars and advocates criticize it as weak, incomplete, and confusing, and argue that it fails to empower individuals to control the use of their personal information. These critiques present a largely accurate description of the law on the books. But the debate has strangely ignored privacy on the ground—since 1994, no one has conducted a sustained inquiry into how corporations actually manage privacy, and what motivates them.

This Article presents findings from the first study of corporate privacy management in fifteen years, involving qualitative interviews with chief privacy officers identified by their peers as industry leaders. Spurred by these findings, we present a descriptive account of privacy on the ground that upends the terms of the prevailing policy debate. This alternative account identifies elements neglected by the traditional story—the emergence of the Federal Trade Commission as a privacy regulator, the increasing influence of privacy advocates, market and media pressures for privacy protection, and the rise of privacy professionals—and traces the ways in which these players supplemented a privacy debate largely focused on processes (such as notice and consent mechanisms) with a growing emphasis on substance: preventing violations of consumers’ expectations of privacy.

This grounded account should inform privacy reforms. While widespread efforts to expand consent mechanisms to empower individuals to control their personal information may offer some promise, those efforts should not proceed in a way that eclipses robust substantive definitions of privacy and the processes and protections they are beginning to produce, or that constrains the regulatory flexibility that permits their evolution. This would destroy important tools for limiting corporate overreaching, curbing consumer manipulation, and protecting shared expectations about the personal sphere on the Internet and in the marketplace.

INTRODUCTION

I. REEVALUATING THE DOMINANT CRITIQUE OF U.S. PRIVACY POLICY ON THE BOOKS

A. The Dominant Discourse

1. The touchstone for measurement: comprehensive FIPPs-based regulation and enforcement

2. The prevailing critique of U.S. privacy statutes

B. Cracks in the Dominant Critique: Indications from Privacy on the Ground

1. External indications of a sea change: the rise of the chief privacy officer

II. INVESTIGATING PRIVACY ON THE GROUND: EMPIRICAL EVIDENCE FROM CPO INTERVIEWS

A. The Limited Import of the Rules-Compliance Approach to Privacy

1. The role of legal rules

2. The shortcomings of rules for privacy decisionmaking

B. The Articulation of an Alternative Framing of Privacy

1. Company law

2. Privacy measured by consumer expectations

3. Implications of a consumer expectations framing: from compliance to risk management

C. External Influences on Privacy’s Conception

1. Legal developments

a. The Federal Trade Commission

b. Data breach notification statutes

c. Legal changes and the court of public opinion

2. The role of professionalization in filling in ambiguous definitions of privacy

III. CONTEXTUALIZING THE INTERVIEWS: AN ACCOUNT OF PRIVACY ON THE GROUND

A. The Roots of a Consumer-Focused Language of Privacy

B. The U.S.-EU Divergence: The Timing of Institutionalization

C. Regulatory Developments and the Consumer-Oriented Privacy Frame

1. The Federal Trade Commission and the consumer-protection discourse

a. Jurisdictional entrepreneurship

b. Developing a consumer expectations metric

i. Nonenforcement regulatory tools

ii. Bringing investigation and enforcement powers to bear

2. State data breach notification laws and the harnessing of market reputation

D. The Turn to Professionals

IV. THE IMPLICATIONS FOR POLICY DEBATES

A. Implications for the Substantive Debate over Privacy Regulation

B. Implications for Debates over Regulatory Form

1. Background debates over regulatory specificity and ambiguity

2. Ambiguity in the privacy sphere

CONCLUSIONS: PRIVACY UNDER THE MICROSCOPE

INTRODUCTION

Scholars and advocates charge that U.S. law fails to protect privacy adequately. The dominant critique denounces the existing patchwork of privacy statutes as weak, incomplete, and fractured. It decries the absence of an agency dedicated to data protection and the consequent lack of clear guidance, oversight, and enforcement. And it argues that the U.S. privacy framework fails to provide across-the-board procedures that empower individuals to control the use and dissemination of their personal information.

Such critiques present a largely accurate description of the privacy law on the books. But the debate has strangely ignored privacy on the ground. Indeed, since 1994, no one has conducted a sustained inquiry into how corporations actually manage privacy and what motivates them.

That year, management scholar H. Jeff Smith released a landmark study of corporate privacy practices,¹ and his conclusions were grim. In the seven corporations studied, the privacy arena was marked by systemic inattention and lack of resources. Policies in important areas were nonexistent, and those that existed were not followed in practice.² Executive neglect signaled to employees that privacy was not a strategic corporate issue. Privacy decisions were left to midlevel managers who lacked substantive expertise, played particularly subservient roles in most privacy discussions,³ and responded piecemeal to issues as they arose. Privacy considerations were particularly absent in decisions about technological or business developments; in the words of one midlevel manager: The top executives rarely ask for [privacy] policy implications of ... new uses of information. If anybody worries about that, it’s my [midlevel] colleagues and myself. And we don’t usually know the right answer, we just try something.⁴

Smith attributed these failures to ambiguity regarding the legal meaning of privacy and the requirements governing its protection in the context of corporate data management.⁵ In the face of this ambiguity, corporate executives avoided action unless external parties demanded specific new policies and practices. This tendency was exacerbated because privacy was viewed as a goal in tension with core operational aims—an organizational phenomenon made worse by the inherent secrecy around corporate data management.

These findings led Smith to conclude that remedying the problem of corporate inattention to privacy concerns required a systemic fix,⁶ reflecting an ongoing credible threat of either consumer backlash or government scrutiny. More concretely, he argued, the primary objective of regulatory intervention must be the reduction of ambiguity in the U.S. privacy domain.⁷ In light of these objectives—comprehensive, credible and unambiguous external mandates—Smith advocated a suite of reforms reflecting elements of the European approach to privacy protection.⁸ He called for the adoption of a uniform set of principles and a framework of more individualized industry codes, based on Fair Information Practices Principles (FIPPs). This approach emphasizes vindication of individual rights through mechanisms like notice and consent in decisions about the use of personal information and the creation of a dedicated government board to assist in their implementation.⁹ These steps, he concluded, would be necessary to force corporations to devote effective attention to privacy, as had happened with environmental protection.¹⁰

Smith’s concerns have been echoed loudly for fifteen years. While they differ in detail, reform proposals generally concur that increasing the corporate attention and resources devoted to privacy and improving substantive privacy outcomes requires a model of protection adopted throughout Europe: omnibus FIPPs-based privacy principles in law or binding codes, interpreted and monitored by the kind of independent privacy agency for which Smith called.

Yet in their constancy, these proposals to reform privacy on the books have largely failed to take account of a more recent sea change in corporate practices on the ground—and have thus ignored a curious paradox for normative assessment.

Between 1995 and 2010, corporate privacy management in the United States has undergone a profound transformation. Thousands of companies have created chief privacy officer positions, a development often accompanied by prominent publicity campaigns. A professional association of privacy professionals boasts over 6500 members and offers information-privacy training and certification. A robust privacy law practice has arisen to service the growing group of professionals and assist them in assessing and managing privacy. PricewaterhouseCoopers and others conduct privacy audits across multiple sectors. Privacy seal and certification programs have developed.

Hence the paradox. In contrast to the lack of managerial time and attention devoted to privacy concerns documented fifteen years ago, corporate practice has promoted direct privacy leadership managing large and well-resourced staffs. Yet these changes cannot be attributed to the prescription born of the dominant critique. U.S. privacy regulations remain fragmented and ambiguous, having failed to shed their siloed and sectoral emphasis. U.S. privacy regulation has largely eschewed a commitment to robust FIPPs. Congress has declined to follow the European model of a dedicated privacy administrator.

This Article, presenting the initial findings of the first empirical research into corporate privacy practices in fifteen years, seeks to address this paradox. It draws on semistructured qualitative interviews with chief privacy officers (CPOs)¹¹ identified as industry leaders by their peers, government officials, and journalists to consider the following: If corporate attention to privacy seems to have flourished despite the failure to achieve what many believed were policy prerequisites, what has prompted the change? What was the role played by law, as opposed to other forces? And how do firms understand the meaning of privacy, despite external prompts that might seem as, or more, ambiguous as those identified by Jeff Smith fifteen years ago?

As described in Part II, although the leading CPOs we interviewed worked at heterogeneous firms, their responses evidenced considerable coherence on several points. First, they consistently reflected a profound shift in the definition of privacy and its treatment. Each of the corporate privacy leaders defined information privacy as more than informational self-determination protected by formal notice and consent, introducing a substantive notion of privacy rooted in consumer expectations. They understood the meaning of privacy to depend on the beliefs and assumptions of consumers as to the appropriate treatment of individual information and personal identity—expectations that evolve constantly and change by context. The success of privacy protection, then, would be measured not by the vindication of notice and consent rights, but in the actual prevention of substantive harms, such as preventing data breaches, or treating information in a way that protects the trust of those whose information is at stake. The identification of privacy with consumer expectations as reflected in malleable context-dependent norms, moreover, has moved privacy from a compliance-oriented activity to a risk-assessment process, requiring firms to embed privacy in decisions about product design and market entry, as well as policy development.

Second, the interviews uniformly pointed to the importance of law in this definitional shift. While individual U.S. sectoral statutes and the EU Data Protection directive were credited in some instances for firms’ initial commitment of resources and personnel, and for the establishment of a regulatory floor, the path these professionals would take was influenced by two other regulatory developments: the rise of the Federal Trade Commission’s (FTC’s) role as an activist privacy regulator advancing an evolving consumer-oriented understanding of privacy; and the passage of state security breach notification (SBN) laws as a means for binding corporate performance on privacy to reputation capital.

Finally, the interviews indicated a variety of nonlegal phenomena central to the formation and diffusion of the legal notion of privacy compliance as consumer harm prevention. These phenomena include the role of both technology changes and third-party advocates in making consumer privacy protection a market-reputation issue, and the importance of the professionalization of privacy officers as a force for transmitting consumer-expectation notions of privacy from diverse external stakeholders, and related best practices, between firms.

The conclusions that can be drawn directly from this first phase of empirical inquiry are necessarily limited. Specifically, the views reflected in these interviews do not, in and of themselves, provide evidence of corporate attitudes towards privacy more generally. The sample is small, and it focuses only on the self-reporting of identified industry leaders. Additionally, this inquiry as yet does not seek to measure outcomes, but rather focuses on reports of subjective understandings and related practices.

At the same time, the feedback from these interviews can be instructive in several ways. First, it—along with other data regarding the management practices and decision processes surrounding privacy put into place in the nine firms studied¹²—suggests a set of elements common to firms with privacy managers identified as leaders. These elements, in turn, will provide the basis for a broad-based survey of privacy attitudes and practices among representative firms, to determine the breadth and depth of convergence.

Second, the interviews direct scholarly attention to elements of regulatory practice, and to participants who shape the legal approach in the privacy field, that are often neglected in the dominant on the books narrative. Prompted by this direction, Part III of this Article looks to independent legal and historical sources to develop a new account of U.S. privacy on the ground. It documents the uniquely American way in which the privacy field has augmented the largely individual rights-based and process-oriented privacy protections with a substantive concern for preventing violations of consumers’ expectations about the treatment of information about them. Specifically, this account explores how the emergence of the FTC as a privacy regulator, the enactment of SBN laws, the increasing influence of privacy advocates, market and media pressures for privacy protection, and the rise of privacy professionals interacted in reconstructing privacy norms in consumer terms, and participated in the diffusion and institutionalization of those norms.

Finally, as Part IV argues, the privacy leaders’ responses in the interviews regarding the manner in which different ways of framing privacy might shape corporate approaches to its protection, in combination with the descriptive account of developments in the privacy field, indicate important directions for debates about both privacy law’s substance and its form. As to substance, the leaders’ responses offer texture to arguments regarding the incompleteness of a reliance on formal notice and consent mechanisms alone to protect privacy norms as rapid technology changes reduce the power of individuals to isolate and identify the use of data that concerns them. The survey responses provide concrete examples of the ways in which a procedural understanding of privacy protection framed around informational self-determination may be insufficient in guiding corporate decisionmakers, ex ante, in making choices about the technologies they employ in products or processes. The responses also identify a substantive language for declaring that corporations should not engage in certain types of practices regardless of the formal procedures they have used—a robust, if still emerging, language that has helped frame criticisms of recent privacy invasions by Google Buzz, Sears, and Sony. Indeed, the consumer-protection lens reflects approaches that a number of theorists have recently suggested will best vindicate individual and societal interests: those emphasizing subjective expectations over objective formalism, dynamism in the face of technological advance, and application by context in light of governing norms.

Moreover, the account of privacy on the ground offers indications for debates over regulatory form. While the dominant account argues for greater uniformity and specificity in privacy law, this account suggests the possibilities offered by governing privacy through flexible principles. It highlights the ways in which a regulator’s entrepreneurial deployment of a broad and imprecise legal mandate, combined with SBN laws’ reliance on information disclosure rather than behavioral mandates, centered a robust multiplayer discourse about privacy to focus market pressure and executive resources. While Smith saw ambiguity as a bug, it may now be an important feature, central to the increase in corporate time and attention devoted to privacy.

This research, as this Article’s Conclusion describes, suggests ways that the prevailing debate over the adequacy of U.S. information privacy law on the books might be diversified, just as Congress, the Obama Administration, and international organizations are revisiting national and global approaches to privacy. While bolstered procedural mechanisms for enhancing informational self-determination might be needed, pursuing that goal in a way that eclipses broader normatively grounded protections, or constrains the regulatory flexibility that permits their evolution, may destroy important tools for overcoming corporate overreaching, consumer manipulation, and the collective action problems raised by ceding privacy protection exclusively to the realm of individual choice.

I. REEVALUATING THE DOMINANT CRITIQUE OF U.S. PRIVACY POLICY ON THE BOOKS

The adequacy of U.S. information privacy law is the subject of heated debate. A majority of privacy scholars and advocates criticizes existing regulation for its market-based and sectoral approach to privacy protection in the corporate sector and contends that the existing patchwork of U.S. regulation fails to ensure across-the-board conformity with the standard measure of privacy protection: compliance with the Fair Information Practice Principles first articulated in the early 1970s. Legal academics and privacy experts have labeled the U.S. approach FIP[Ps]-Lite,¹³ an unfavorable comparison to the European Union where FIPPs are reflected through omnibus laws