October 11, 2018 by Christopher
This is part 2 of a series on the constitution's role in informational privacy. There will be endnotes.
Platforms collect and interpret a vast amount of information about their users’ activities including the websites they visit, how long they spend there, and where they go next, and what they might like. Information about their interests and demographics is not advertising in and of itself, but renders it more efficient. The sweep of that collection, however, can be large, and platforms can assemble detailed profiles of individuals’ activity. If someone is collecting information about you, aggregating it with a bunch of other information to develop a picture of you, and selling that information, why can’t the government just pass a law that stops or limits it? As a leading First Amendment scholar put it in the title of an article, the answer is because of the “troubling implications of a right to stop people from speaking about you.”[1]
A prior post discussed how state legislatures have responded with laws that burden or limit the dissemination of personal information writ broadly. California, for example, defines it as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household,” and includes things like “commercial information,” such as personal property records, browsing activity and professional information.[2] California’s definition does not include “publicly available information,” which it defines as information lawfully made available from public records.[3] The very same definition then goes on to say that information ceases to be “publicly available” if it is either used in a way that is not compatible with the purpose for which it is maintained and made available, or for which it is publicly maintained.[4] Vermont’s definition is similar, stating that personal information includes “information that, in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty,” and has no exemption for public records.[5]
California’s law permits consumers to cause the deletion of accurate, lawfully acquired information by those who collect it from them and prohibit further sale by those who may have that information in their possession. Can privacy statutes simply direct people to cease transmitting or collecting this kind of information, and does the First Amendment have anything to say about it?
There are three basic questions that have to be answered:
(1) does this kind of legislation regulate speech at all;
(2) if so, what kind of speech is it regulating;
and (3) what level of scrutiny applies to that speech and how would it apply?
This post deals with the first question.
Much of the concern about the information collected by platforms relates to advertising. First Amendment protection of the commercial information conveyed by advertising began over 50 years ago, in a seminal case called Va. Pharmacy Bd. v. Va. Consumer Council.[6] In that case, Virginia passed a statute that effectively prohibited pharmacies from advertising drug prices. A group of consumers brought suit alleging that they, as lawful users of prescription drugs, had a right to have accurate pricing information communicated to them.[7] The Court rejected the premise behind the statute, namely that “the State’s protectiveness of its citizens rests in large measure on the advantages of their being kept in ignorance.”[8] Instead, it adopted a different premise: “that this information is not in itself harmful, that people will perceive their own best interests if only they are well enough informed, and that the best means to that end is to open the channels of communication rather than to close them.”[9] Ultimately, the Court overturned the ban, holding that even speech that does no more than propose a commercial transaction receives First Amendment protection—so long as it is accurate.[10] The Virginia Pharmacy case has both formally recognized some form of First Amendment protection for advertising and embraced the idea of a free flow of information helping free market competition in the same way that it helps the marketplace for political ideas.[11] As importantly, the Court recognized two sets of First Amendment speakers harmed by restrictions on accurate information: harm to those who wanted to speak (e.g., the advertisers) and harm to those who wanted to receive the information (e.g., consumers).
Virginia Pharmacy recognized speech protection for advertising, but did not give much guidance with respect to a standard of review. That standard came in Central Hudson Gas & Electric Corp. v. Public Service Commission of New York.[12] There, the Court invalidated a New York utility commission order that banned advertising encouraging the use of electricity.[13] After noting that misleading commercial speech receives no First Amendment protection, the Court set forth a three-part test.[14] First, the regulation must advance a “substantial” state interest. Second, the regulation has to be in proportion to the state’s interest: it must “directly advance” the state’s goal, and if a narrower, less-speech restrictive alternative would do just as well, the regulation cannot be sustained.[15]
Central Hudson and Virginia Pharmacy related to advertising that has a grain of public interest, not anything that could be construed as personal information. Unlike drug prices, which may be of interest to a host of different constituencies and the public, personal information (an individual’s loan balances, for example) should not receive First Amendment protection.
A plurality of the Court subsequently rejected such a distinction. Dun and Bradstreet, Inc. v. Greenmoss Builders considered the extent to which the extraordinary First Amendment protections given to media defendants reporting on public figures should apply to a credit bureau that reports defamatory information in an individual’s credit report.[16] Dun and Bradstreet argued that in order to recover presumed and punitive damages, a plaintiff had to prove “actual malice”—knowledge of falsity or a reckless disregard for the truth. The Court rejected that argument for matters of private concern, ruling that if a consumer was defamed by a credit bureau falsely stating that bankruptcy had occurred, all the consumer needed to show was that the report was false.[17]
The Court rejected the suggestion that the transmission of credit report information received no First Amendment protection: “We also do not hold, as the dissent suggests we do… that the report is subject to reduced constitutional protection because it constitutes economic or commercial speech. We discuss such speech, along with advertising, only to show how many of the same concerns that argue in favor of reduced constitutional protection in those areas apply here as well.”[18]
Dun and Bradstreet acknowledged the protected First Amendment status of personal information, and subsequent cases have made clear that interference with the transmission of any information triggers First Amendment scrutiny. For example, in Bartnicki v. Vopper, the Court invoked the First Amendment to protect a radio station from application of the federal wiretap statute when it played an illegally recorded phone call.[19] The radio station had acquired lawful access to that information.[20] In finding that the First Amendment prevented the application of the statute, the Court noted that “[i]f the acts of disclosing and publishing information do not constitute speech, it is hard to imagine what does fall within that category, as distinct from the category of expressive conduct."[21] Similarly, in a D.C. Circuit case involving a challenge to the FTC’s barring of targeted marketing lists by credit bureaus, Justices O’Connor and Kennedy took the unusual step of dissenting from the refusal to grant certiorari and urged the Court to review the level of scrutiny that should be applied to truthful, non-defamatory speech.[22]
It would be another several years before the Court directly took up the question posed by Dun and Bradstreet, but a Vermont statute gave them no choice. In IMS Health v. Sorrell, the Court granted certiorari to review a Vermont law designed to prevent marketing information from being transmitted to drug companies.[23] More specifically, the statute prohibited pharmacies from telling pharmaceutical manufacturers the prescribing patterns of doctors if that information was going to be used for a marketing purpose—unless the doctor had opted into that disclosure.[24]
Following the markers laid down in Dun and Bradstreet, Virginia Pharmacy, and other cases the Court confirmed that “the creation and dissemination of information are speech for First Amendment purposes.”[25] The court specified that First Amendment protections extend to “the sale, disclosure and use of prescriber-identifying information,” that is, information that allows marketers or others to ascertain which doctor prescribed which medicines. It rejected Vermont’s attempts to characterize the marketing information as commercial conduct was rejected: “facts are, after all, the beginning point for much of the speech that is most essential to advance human knowledge and to conduct human affairs.”[26] At the same time, however, the Court endorsed certain sectoral privacy laws, such as the Health Information Patient Protection and Portability Act (HIPPA).[27]
IMS Health and the other cases on which it relies establish a few different propositions, with important consequences. First, the collection, dissemination, and use of personal data, like the prescriber-identifying in, information in IMS, is speech, and is entitled to First Amendment protection. The fact that collection and publication of this information comes from a commercial motivation does not strip it of its status as speech, [28] nor does its aggregation into databases. As a result, privacy statutes like California’s that regulate the collection, dissemination, and use of personal information in private hands are subject to First Amendment review. [29]
Second, when a privacy law makes a distinction between those who are permitted to share personal information and those who are not, the statute will receive First Amendment scrutiny. This scrutiny will occur regardless of the First Amendment status of the information. In IMS Health, the Vermont statute prevented use of the information by pharmaceutical marketers, but permitted the transmission and use of the very same information by other kinds of speakers to counter pharmaceutical advertising.[30] This was no different in the Court’s mind from a statute that required newspapers to pay a special tax on ink.[31]
The next post in this series will examine what that scrutiny might look like.
[1] See generally Eugene Volokh, Freedom of Speech and Information Privacy: The Troubling Implications of A Right to Stop People from Speaking About You, 52 Stan. L. Rev. 1049, 1051 (2000) (“While privacy protection secured by contract is constitutionally sound, broader information privacy rules are not easily defensible under existing free speech law.”)
[2] See Cal. Civ. Code 1798 (o)(1). California’s reference to “households” and “inferences” as part of the definition render the definition broader than Europe’s General Protection Data Regulation. Cf. [GDPR]
[3] Cal. Civ. Code 1798 (o)(2).
[5] 9 Vermont Stat. Ann. 2430(1)(a)(vi).
[10] Id. at 763; 771 (accuracy).
[11] Id. at 765 (“So long as we preserve a predominantly free enterprise economy, the allocation of our resources in large measure will be made through numerous private economic decisions. It is a matter of public interest that those decisions, in the aggregate, be intelligent and well informed. To this end, the free flow of commercial information is indispensable.”).
[12] 447 U.S. 557 (1980).
[16] 472 U.S. 749, 763 (1985). The specific issue considered was whether a plaintiff could receive presumed and punitive damages without a showing of actual malice. Id.
[17] Greenmoss, 447 U.S. at 761.
[19] 532 U.S. 514 (2001).
[21] Id. at 527 (internal citation and quotes omitted).
[22] Trans Union LLC v. Fed. Trade Comm'n, 536 U.S. 915, 122 S. Ct. 2386, 2387, 153 L. Ed. 2d 199 (2002). (arguing that “[t]he plurality opinion in Dun & Bradstreet concluded that a false statement in a credit report was not speech on a matter of public concern, as that term is used in the context of defamation law. It is questionable, however, whether this precedent has any place in the context of truthful, nondefamatory speech. Indeed, Dun & Bradstreet rejected in specific terms the view that its holding “leaves all credit reporting subject to reduced First Amendment protection.”) (internal citation omitted); see also Rubin v. Coors Brewing Co., 514 U.S. 476, 481 (1995) (noting that alcoholic content information on beer labels is speech).
[23] Sorrell v. IMS Health Inc., 131 S. Ct. 2653 (2011).
[27] Id. at 2668 (citing Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. § 1320d-2; 45 CFR pts. 160 and 164 (2010)).
[28] See IMS Helalth, 131 S.Ct. at 2666-67. IMS’s observation that a profit motivation for the creation of speech does not exempt it from protection represents long-standing First Amendment doctrine. See Virginia Pharmacy, at 761 (citing Smith v. California, 361 U. S. 147, 150 (1959) (striking down strict liability statute prohibiting booksellers from having obscene books in their stores); Joseph Burstyn, Inc. v. Wilson, 343 U. S. 495, 501-02 (1952) (rejecting profit motive as reason to deny protection to motion pictures)).
[29] See IMS Health, 131 S. Ct. at 2665-66 (noting that “An individual's right to speak is implicated when information he or she possesses is subjected to "restraints on the way in which the information might be used" or disseminated” and permitting facial challenge to the statute).
[30] See IMS Health, 131 S.Ct. at 2667 (“The State has imposed content- and speaker-based restrictions on the availability and use of prescriber-identifying information. So long as they do not engage in marketing, many speakers can obtain and use the information. But detailers cannot. Vermont's statute could be compared with a law prohibiting trade magazines from purchasing or using ink. ... Like that hypothetical law, [the Vermont statute] imposes a speaker- and content-based burden on protected expression, and that circumstance is sufficient to justify application of heightened scrutiny.”) (internal citation omitted).
Christopher Mohr is General Counsel and VP, Intellectual Property Policy & Enforcement at SIIA.