Stormy Daniels and Cambridge Analytica

JB

Mark Graber has argued that the First Amendment should protect Stormy Daniels' violation of her nondisclosure agreement with Donald Trump. I doubt that this is correct-- for reasons described below, I think her best argument sounds in contract law. But even if Mark is correct,  I want to argue in this post that there are very good reasons why the First Amendment generally does not forbid enforcement of contacts that prevent the disclosure of sensitive personal information. Most companies' privacy policies depend on this proposition. These considerations are especially important in the digital age. We should not use First Amendment doctrine to make it difficult if not impossible for governments to implement reasonable privacy protections that will prevent the disclosure and manipulation of sensitive personal information.

Suppose a very rich and powerful company--let's call it Facebook--signs a contract with another person--let's call him Alexsandr Kogan. Under this contract, Facebook gives Kogan the right to harvest Facebook data about end-users, with the proviso that Kogan may not use or disclose this information for purposes other than nonprofit scientific research. Unbeknownst to Facebook, Kogan is allied with a political consulting business--let's call it Cambridge Analytica--that wants to use the data to target political advertising to people in order to benefit various conservative and Republican political candidates, including Donald Trump.

Kogan breaches his agreement with Facebook, and, together with Cambridge Analytica, uses the personal data harvested from Facebook to serve targeted political ads to unsuspecting voters. The scheme is eventually revealed and many people are outraged-- at Facebook, at Kogan, at Cambridge Analytica, and especially at Donald Trump, because his campaign benefited from the ads.

Now one objection to the scheme is that Cambridge Analytica is staffed by non-U.S. persons, and therefore violates campaign finance laws. This is an important issue, and that is no doubt why Robert Mueller is interested in the transaction, but I am interested in a different issue in this post.

A different objection is that Facebook had a duty-- or should have had a duty--to prevent its data from being disclosed to and misused by third parties. In general, Facebook should not disclose sensitive personal data to the public, and to the extent it does disclose its data, it should carefully vet the people who are permitted to use the data, and hold them to very strict requirements for how they use the data and whom they in turn can disclose it to. In terms of my own work on digital speech, I would say that Facebook is an information fiduciary. Information fiduciaries have responsibilities to protect vulnerable end-users from manipulation and self-dealing both by the company and by those with whom the company shares their personal data.

According to this objection, Facebook's policies for allowing third parties to harvest its data and use it are too lax. Facebook should have investigated Kogan more carefully. It should have monitored more carefully what he did with the data. It should have designed a system of audits to check up on third parties harvesting its data to ensure that their uses continued to be consistent with its privacy policies. It should have taken steps to prevent Kogan's work with Cambridge Analytica. Finally, once it discovered a breach of its privacy policies, it should have used every possible legal means to punish Kogan and Cambridge Analytica and get them to disgorge the information they harvested. Moreover, Kogan and Cambridge Analytica were also information fiduciaries as a result of their agreement with Facebook, because they had a duty to use the data consistent only with the terms of the Facebook's privacy policy.

The political ads themselves are protected under the First Amendment (that is, assuming no foreign employees worked on the project, which may not be the case). Yet Facebook should be able to sue Kogan and Cambridge Analytica for breach of contract for misusing the data. Moreover, without violating the First Amendment, governments could create additional causes of action for breach of privacy or breach of fiduciary duty that would allow end-users to sue for damages against both Facebook and Kogan/Cambrige Analytica. Goverments might also pass disgorgement laws that would fine Kogan and Cambrige Analytica and require them to hand over all copies of the data, as well as injunctive relief against future use of Facebook's data. These remedies, presumably, would chill any attempts to replicate their strategy in the future.

Suppose, however, that Kogan and Cambridge Analytica respond that even if they breached their contract with Facebook, the breach was justified by the First Amemdment. The data was harvested to run political ads-- core First Amendment expression. Moreover, put in terms of Mark's post,  Facebook is rich and wealthy, and it is using its financial power to silence political activists like Kogan and Cambridge Analytica: If their First Amendment defense is rejected, "the most affluent citizens, who already have the right to buy as much favorable speech as they wish, [will also be able to] buy the right to silence as much unfavorable speech as they desire."

I believe that Kogan and Cambridge Analytica's First Amendment defense should fail.  In addition, I think that Mark has a number of decent arguments for distinguishing the Daniels case from this one.

First, Trump is suing to prevent Stormy Daniels' *disclosure* of sensitive personal information to the general public. Facebook and Facebook's end-users, by contrast, would be suing to punish the *use* of sensitive personal information by Kogan and Cambridge Analytica. Restrictions on use are more likely to be constitutional than restrictions on disclosure. In fact, Kogan and Cambridge Analytica probably want to keep the underlying data secret, because they want to maintain a competitive advantage over other political consultants. If they had decided to disclose the underlying data publicly, their case would be more like Stormy Daniels' case.

Second, while Trump's sensitive personal information is a matter of public concern about a public figure, the personal data harvested from Facebook's end users is not a matter of public concern and (almost exclusively) concerns private figures. If Trump's case is analogous to New York Times v. Sullivan, Facebook's case is analogous to Dun and Bradstreet v. Greenmoss Builders, in which the Supreme Court held that the constitutional privileges of New York Times v. Sullivan and its progeny did not apply to matters of purely private concern about private figures.

Third, as I have just argued, Facebook is an information fiduciary, and anyone who receives its end-users' personal data through contractual agreement should also be treated as an information fiduciary. (The fiduciary duties, in other words, should run with the data.) At the very least, governments could impose such a requirement in privacy regulations  consistent with the First Amendment. By contrast, Stormy Daniels lacks a fiduciary relationship to Donald Trump. She is an ex-lover, but ex-lovers and friends are not fiduciaries (although in some common-law jurisdictions she might conceivably be liable for a related tort, breach of confidence).

So the two cases are distinguishable on several grounds. Even so, I don't think, as Mark does, that Stormy Daniels' best argument is the First Amendment rather than contract law. I think that there are very good reason to maintain the general principle that people can contract away their right to speak consistent with the First Amendment. If that were not so, reporters might not be able to credibly promise confidentiality to sources (This is the subject of Cohen v. Cowles Media Company). Nor, as noted above, would private companies be able to enforce privacy policies. 

Rather, Daniels' strongest argument is a public policy argument within contract law-- courts should refuse to enforce some (but not all) nondisclosure agreements because they are against public policy.  The public policy in this case is the public's right to know about the private life of the President of the United States before he became President. In the alternative, there might be a public policy justifying a much narrower right of disclosure--namely, the right of the public to know whether the President and his allies violated campaign finance rules in order to keep Daniels quiet. There are plausible arguments for both of these positions, but they sound more in contract law than in First Amendment doctrine.


Posted 5:50 PM by JB [link]