Jan. 28, 2004UCB Sensor Nets Day1 TOWARD A LEGAL FRAMEWORK FOR SENSOR NETWORKS Pamela Samuelson, Law/SIMS UCB Sensor Nets Day January 28, 2004

Jan. 28, 2004UCB Sensor Nets Day2 IS FRAMEWORK POSSIBLE? Some existing laws will apply depending on nature of the sensor network deployment Some existing laws may not apply because they were adopted for different contexts Some new laws or regulations may be needed if sensor networks present issues existing laws don’t readily address Privacy most obvious issue, but others too

Jan. 28, 2004UCB Sensor Nets Day3 CONTEXT Redwoods going wireless –Trespass may apply if deploy sensor networks on owned land without permission –Environmental (if clutter of dead-ones?) Golden Gate Bridge –Sensing wind/weather data cf. sensing Fast- Track devices –EU: would need to get permission for collection/use of Fast-Track data

Jan. 28, 2004UCB Sensor Nets Day4 OTHER CONTEXTS Smart Buildings –Again, depends on what data being sensed Privacy if presence of humans Potential liability if bad data on structural integrity –Security responsibilities as to data collected Medical personalization –Privacy obvious but as to what/whom/purpose? –Confidentiality of doctor/patient relationship –Guardianship issues vis a vis families –Liability issues if bad data causes

Jan. 28, 2004UCB Sensor Nets Day5 WHAT ABOUT? Telecommunications laws (use of spectrum, FCC might have a role in regulating technology and uses)? Electronic Communications Privacy Act? Suppose wireless technology privacy law adopted for cellphones (what application to sensor networks? Computer Fraud & Abuse Act? Draft WIPO Broadcasting Treaty? EU Database Protection?

Jan. 28, 2004UCB Sensor Nets Day6 MODES OF REGULATION Norms (e.g., fair information practices) Market –Bad publicity, good publicity –Major purchasers influencing the market Technology –Encryption –Standards Law and policy

Jan. 28, 2004UCB Sensor Nets Day7 MODES OF LAW & POLICY Contracts/licenses (private regulation) Gov’t induced self-regulation (we will regulate unless you behave as we want you to) Bully pulpit (gov’t official speaks out on policy) Subsidies, taxes, other inducements Legislation –Can’t do X (no monitoring in bathrooms) –Must do Y (build tappable digital telephone system) Duties imposed by common law (keep in confidence if disclosed in confidence; fiduciary)

Jan. 28, 2004UCB Sensor Nets Day8 PRIVACY EVOLVING Initially, private property was key to privacy (what you do in privacy of your own home no one else’s business—Stanley v. GA) Trespass to land: property right in home; no need to prove harm; inviolability (may be relevant to sensor network deployment) Olmstead to Katz: gov’t tapping telephone call Olmstead: no trespass, so no 4 th A violation Katz: 4 th A protects people, not places; reasonable expectation of privacy in phone booth

Jan. 28, 2004UCB Sensor Nets Day9 TECHNOLOGY & EXPECTATIONS No need for law to protect privacy if technology doesn’t enable violation of it If advance in technology enables surveillance/monitoring, does privacy interest erode in the face of it? (not reasonable to expect privacy if technology enables violation?) Kyllo v. US: 4 th A violated by use of heat-sensing technology not in common use Wiretap law: illegal to intercept wire or electronic communication (even if it’s easy to do)

Jan. 28, 2004UCB Sensor Nets Day10 FAIR INFORMATION PRACTICES Limitations on collection of data (only what need); destroy data after need is fulfilled Right to collect data for specific purpose only; if want to reuse for other purpose, you have to get new permission Notice and choice Right of access to check data Obligations to keep data accurate, secure Accountability if screw up

Jan. 28, 2004UCB Sensor Nets Day11 SENSOR NETS POOR FIT? Data collection is norm Absence of cues that signal data collection Porous barriers between public and private spaces Everyone is a potential data collector New kinds of data “sensed” created, stored Increased ability to create patterns, knowledge out of seemingly unrevealing bits of data Once data collected, reuses easy but difficult to regulate (detect?)

Jan. 28, 2004UCB Sensor Nets Day12 MORE ON POOR FIT? Ability to influence behavior/alter environment in real-time based on data that may not meet definitions of personal info found in traditional data protection statutes Always on, broad accessibility Unclear responsibilities (duties of care owed to whom? Oops, sensors didn’t detect me in the building when earthquake; was this negligence?)

Jan. 28, 2004UCB Sensor Nets Day13 CONCLUSION Possible to build sensor networks in socially responsible way Law may provide helpful framework, but is also quite a blunt instrument Technology design may be better to protect privacy, other social interests California legislators/policymakers may be receptive if we can think of good framework