JOEL REIDENBERG, Fordham University
Email: JREIDENBERG@LAW.FORDHAM.EDU
JAMELA DEBELAK, affiliation not provided to SSRN
Email: debelak@law.fordham.edu
ADAM PAUL GROSS, affiliation not provided to SSRN
Email: adam.gross@ngc.com
LEE A. MAYBERRY, affiliation not provided to SSRN
Email: leemayberry@gmail.com
JUDITH SIMMS, affiliation not provided to SSRN
Email: simms@law.fordham.edu
ELIZABETH WOODARD, affiliation not provided to SSRN
Email: woodarde@gmail.com

Following the No Child Left Behind mandate to improve school quality, there has been a growing trend among state departments of education to establish statewide longitudinal databases of personally identifiable information for all K-12 children within a state in order to track progress and change over time. This trend is accompanied by a movement to create uniform data collection systems so that each state’s student data systems are interoperable with one another. This study examines the privacy concerns implicated by these trends. The study reports on the results of a survey of all fifty states and finds that state educational databases across the country ignore key privacy protections for the nation's K-12 children. The study finds that large amounts of personally identifiable data and sensitive personal information about children are stored by the state departments of education in electronic warehouses or for the states by third party vendors. These data warehouses typically lack adequate privacy protections, such as clear access and use restrictions and data retention policies, are often not compliant with the Family Educational Rights and Privacy Act, and leave K-12 children unprotected from data misuse, improper data release, and data breaches. The study provides recommendations for best practices and legislative reform to address these privacy problems.

WENDY SELTZER, Harvard University - Berkman Center for Internet & Society, University of Colorado Law School
Email: wendy@seltzer.com

Digital Rights Management, law-backed technological control of usage of copyrighted works, is clearly imperfect: It often fails to stop piracy and frequently blocks non-infringing uses. Yet the drive to correct these imperfections masks a deeper conflict, between the DRM system of anticircumvention and open development in the entire surrounding media environment. This conflict, at the heart of the DRM schema, will only deepen, even if other aspects of DRM can be improved. This paper takes a systemic look at the legal, technical, and business environment of DRM to highlight this openness conflict and its effects.

Scholars have described DRM’s failures to protect copyright exceptions, its failures to stop unauthorized copying, and its impact on complementary innovation. This paper takes those debates as background to focus on the foreclosure of an entire mode of development and its opportunities for user innovation.

Under an anticircumvention regime, the producers of media content can authorize or deny authorization to technologies for playing their works. Open source technologies and their developers cannot logically be authorized. “Open-source DRM� is a contradiction in terms, for open source encourages user modification (and copyleft requires its availability), while DRM compels “robustness� against those same user modifications. Since DRM aims to control use of content while permitting the user to see or hear it, it can be implemented only in software or hardware that is able to override its user’s wishes—and can’t be hacked to do otherwise. For a DRM implementation to make any sense, therefore, its barriers against user modification of the rights management must be at least as strong as those against user access to its protected content.

I characterize a “DRM imperative� and explore the technical incompatibilities between regulation by code and exploration of code. We see DRM centralizing development and forcing the black-boxing of complementary media technology, in a widening zone as it mandates that protected media be played only on compliant devices, that those may output media content only to other compliant devices, etc. The home media network is thus progressively closed to open-source development.

Foreclosing open development costs us technically, economically, and socially. We lose predicted technological improvements, those of user-innovators (von Hippel) or disruptive technologies (Christensen) from outside the incumbent-authorized set, that could offer new options for content creators and audiences (such as better playback, library, mixing, and commerce options). We lose social and cultural opportunities for commons-based peer production.

In the full cost-benefit analysis of anticircumvention, the loss to open innovation would outweigh the gains from this imperfect mechanism of copyright enforcement. Treating code literally as law leaves the law with too many harmful side effects.

CHRISTOPHER KUNER, Hunton & Williams
Email: ckuner@hunton.com

Data protection law has been the subject of an increasing number of jurisdictional disputes, which have largely been driven by the ubiquity of the Internet, the interconnectedness of the global economy, and the growth of data protection law around the world in recent years. There are also an increasing number of instances where data protection law conflicts with legal obligations in other areas. Moreover, the rapid development of new computing techniques (such as so-called ‘cloud computing’) is putting even greater pressure on traditional jurisdictional theories. Jurisdictional uncertainties about data protection law have important implications, since they may dissuade individuals and companies from engaging in electronic commerce, can prove unsettling for individuals whose personal data are processed, and impose burdens on regulators. These difficulties are increased by the fact that, so far, there is no binding legal instrument of global application covering either jurisdiction on the Internet or data protection. This article examines international jurisdiction as it relates to data protection law, and specifically to instances in which jurisdiction under data protection law may be considered ‘exorbitant’, with a particular focus on rules of public international law.