History of Privacy Timeline

Brandeis "Right to Privacy" Law Review Article

The Right to Privacy (or “the right to be let alone”) is a law review article published in the 1890 Harvard Law Review. Written primarily by Justice Louis Brandeis (but credited to both Brandeis and Samuel Warren), it is one of the most influential essays in American legal history and is considered the first publication in the U.S. to argue for a right to privacy. The authors charge that “instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life” and seek to “consider whether the existing law affords a principle which can properly be invoked to protect the privacy of the individual.”

Ruling on Protection of Sealed Mail

In the second decade of the 20th century, the newly established Bureau of Investigations was actively working on investigating acts of foreign sabotage and rooting out subversion. Surveillance extended to monitoring and illegally opening correspondence of suspected subversives. When the bureau filed an official request to open mail, Solicitor General Judge William Lamar ruled against the privacy infringement and upheld long-established protections of sealed mail.

U.N. Declaration of Human Rights

Proclaimed by the United Nations General Assembly on December 10, 1948, the U.N. Declaration of Human Rights (UDHU) was drafted by representatives from all over the world with a variety of legal and cultural backgrounds. Article 12 states that “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.”

Alan Westin Writes Privacy and Freedom

Alan Westin, who defined privacy as “the claim of individuals … to determine for themselves when, how and to what extent information about them is communicated,” helped set the stage for modern debates about technology, privacy, and personal freedom. His book, Privacy and Freedom, is still one of the seminal works on privacy to this day.

In United States v. U.S. District Court, 407 U.S. 297 (Keith Case) the United States Supreme Court ruled unanimously that warrants are required for domestic intelligence surveillance.

FERPA Student Privacy

FERPA, the Family Educational Rights and Privacy ACT of 1974, or Buckley Amendment, is a federal law that safeguards the privacy of student education records. The law applies to all schools, colleges, universities, and other institutions that receive funds from the U.S. Department of Education.

Privacy Commission Report

Established in Section 5 of the Privacy Act of 1974, the U.S. Privacy Protection Study Commission was tasked with evaluating the Privacy Act and issuing a report containing its findings and recommendations for improvement. The Commission issued its final report and ceased operation in 1977.

Common Rule Human Subject Research Privacy

In 1991, revisions were made to the U.S. Department of Health and Human Services Title 45 CFR 46 (Public Welfare) Subparts A, B, C and D. Subpart A, known as The Common Rule, is an updated version of a 1981 rule of ethics in the United States concerning biomedical and behavioral research involving human subjects. It was adopted by Institutional Review Boards for oversight of human research and is the standard of ethics guiding all government funded (and most non government funded) research in the U.S. The regulation was last updated in 2018.

HIPAA Health and Medical Privacy

HIPAA, or the Health Insurance Portability and Accountability Act of 1996, was created to streamline the flow of healthcare information, protect Personally Identifiable Information maintained by the healthcare and health insurance industries from theft and fraud, and deal with limitations on health insurance coverage. Also known as the Kennedy-Kassebaum Act, it was put in place by the 104th United States Congress and signed by President Bill Clinton.

Chief Counselor for Privacy in Federal Government

Before U.S. government agencies had Chief Privacy Counselors, they had Privacy Act Officers. They primarily dealt with requests from individuals for their government records under the access provisions of the Privacy Act and the Freedom of Information Act (FOIA). Realizing the need for a more effective position, the Clinton administration began requiring agencies to designate a Chief Privacy Counselor. Peter Swire was named the Chief Privacy Counselor for the administration within the Office of Management and Budget.

First Chief Privacy Officer

A Chief Privacy Officer (CPO) is a senior level executive responsible for managing risk related to and ensuring compliance with information privacy laws. The role exists in an increasing number of corporations, public agencies, and other organizations. While the first example of a CPO can be found with the 1991 implementation of the role at the consumer database marketing company Acxiom, it became more well known with the 1999 hiring of privacy lawyer Ray Everett by the internet advertising technology firm AllAdvantage.

E-Government Act of 2002

The E-Government Act of 2002 was passed by Congress in an effort to bring the federal government into the 21st century by applying advances in information technology to improve access to and use of government services and information. A central part of the legislation was the requirement for all federal government agencies to perform a Privacy Impact Assessment (PIA) for any new technology that “collects, maintains, or disseminates personally identifiable information (PII), or for a new aggregation of information that is collected, maintained, or disseminated using information technology.”

The Intelligence Reform and Terrorism Prevention Act (IRTPA) amended the National Security Act of 1947 and created the position of “Civil Liberties Protection Officer” within the Office of the Director of National Intelligence.

EU Right to be Forgotten

The European Commission in 2012 released a draft European Data Protection Regulation that would supersede the EU Data Protection Directive. The law allows EU citizens to submit requests to search engines to have personal information delinked from the results of searching their name.

CCPA

The California Consumer Privacy Act (CCPA) is a state statute intended to regulate how businesses handle the personal information of residents of the state of California. The CCPA was signed into law in 2018 and went into effect on January 1, 2020.

Artificial Intelligence (AI) and Innovative Technologies

2023 was the breakout year for Generative AI and AI tools are becoming ubiquitous across industries and organizations, including higher education. Processing vast amounts of information using these tools poses risks of exposing sensitive personal information, while algorithms and automated decision-making introduce inherent challenges with legal, individual, and societal impacts.

In April 2021, the European Commission proposed the first regulatory framework for AI. As of January 2024, the European AI Act is waiting to be formally adopted by Parliament and Council to become EU law.

In the United States, there is no comprehensive federal law governing AI use. Specific applications of AI, such as autonomous vehicles or drones, are regulated by a patchwork of federal, state, and local regulations. The Federal Trade Commission (FTC) is actively examining AI and algorithmic transparency under its authority to prevent deceptive or unfair business practices. Legislations including the Algorithmic Accountability Act and the Commercial Facial Recognition Privacy Act have been introduced in Congress, but are yet to be enacted into law. Several states are forging ahead with their own AI regulations. 

This evolving regulatory landscape reflects the ongoing efforts to balance the benefits of innovative technology with the need to protect privacy, security, and other democratic values. (This summation was written in collaboration with U-M GPT)