The Right to Data Privacy: Revisiting Warren & Brandeis

Warren and Brandeis in their famous 1890 article The Right to Privacy found privacy as an implicit right within existing law. Regarded as perhaps the most influential legal essay of all time, it offers concepts that ring as true today as they did in 1890. In defining privacy as an important legal principle implicit in the law, they focused on informational rather than decisional privacy (i.e., public disclosure of personal information). Analyzing the 1890 article is an ideal starting point to assess the origins of privacy law and to understand privacy issues from a simpler time in terms of law and technology, and its concepts are thus highly understandable to the masses before diving into more challenging modern issues. It is thus an ideal frame of reference for assessing a path forward. Accordingly, this article compares each key principle from 1890, exploring privacy issues that remain similar versus privacy issues that seem new based on particular advances in technology. The key similarity between 1890 and today is that problems of information dissemination present similar issues, albeit on a larger scale. However, some key differences between 1890 and today are that computer technologies now allow massive data collection, massive data storage, and increasingly sophisticated data analysis that can be used to abuse privacy even with ostensibly public data. 1890 teaches us that new technologies continually present new privacy issues; thus, as new technologies are evolving today, thought must still be given to how the law might flexibly adapt to new and unforeseen changes in tech. The 1890 article exposed that various US laws were insufficient to broadly protect information privacy, causing the authors to imply a broad right. Today, the same problem persists that the US has no broad express privacy law, and a path forward might contemplate making express what Warren and Brandeis had to imply in order to address new privacy harms. I propose two key ideas. First, the law needs to more clearly distinguish decisional privacy from information privacy and realize that decisional privacy is really not a privacy interest at all (it is instead a personal liberty interest separate from information privacy). Second, when contemplating legal protection for information privacy, perhaps it’s time to consider the arduous and improbable task of enacting a broad and general constitutional amendment guaranteeing protection against information privacy abuse from both government and private actors. While difficult to enact, such a broad express federal right could provide significant advantages, such as (1) establishing a baseline right from which states and Congress could add consistent legislation; (2) enabling courts to restrict clear instances of privacy abuse without waiting for Congress to act, which seems especially helpful given the expected proliferation of AI and new and unforeseen privacy harms; (3) increasing harmonization with the EU and potentially other jurisdictions; (4) and finally, avoiding the problem of originalist or strict constructionist judges refusing to infer or imply a constitutional information privacy right in the wake of the SCOTUS Dobbs v. Jackson decision. Thus, a flexible and general broad right of federal protection from information privacy abuse might provide an optimal, flexible baseline for courts and regulators to quickly restrict new privacy abuses while allowing states and Congress to enact further detailed legislation.