PII

In 2007 Vermont enacted the Prescription Confidentiality Law, also known as Act 80, whose central provision appears at Vt. Stat. Ann., Tit. 18, §4631(d). The statute prohibits pharmacies, health insurers, electronic transmission intermediaries, and similar entities from selling, licensing, or exchanging prescriber-identifying information, and from permitting its use for marketing prescription drugs, unless the prescriber consents. It likewise bars pharmaceutical manufacturers and marketers from using such information for marketing absent consent. The prohibitions are subject to enumerated exceptions that permit dissemination and use for health-care research, enforcement of insurance formularies, patient care-management communications, law enforcement, and purposes otherwise provided by law. Pharmaceutical manufacturers promote brand-name drugs through a process called detailing, in which sales representatives visit physicians' offices to present information and samples. Pharmacies receive prescriber-identifying information when filling prescriptions pursuant to federal and state requirements and routinely sell that information to data-mining firms. The data miners analyze the records, produce reports on individual physicians' prescribing patterns, and lease the reports to pharmaceutical manufacturers under nondisclosure agreements so that detailers can tailor their presentations. Respondents are three Vermont data-mining companies and the Pharmaceutical Research and Manufacturers of America, an association of brand-name drug manufacturers. They filed two consolidated actions in the United States District Court for the District of Vermont. The suits named the Vermont Attorney General and other state officials as defendants. Respondents sought declaratory and injunctive relief on the ground that §4631(d) violates their First Amendment rights. After a bench trial the district court denied relief. The Court of Appeals for the Second Circuit reversed, holding that the statute unconstitutionally burdens protected speech. The Supreme Court granted certiorari to resolve the conflict with decisions of the First Circuit upholding similar statutes in Maine and New Hampshire. The Vermont Legislature accompanied the statute with formal findings. Detailing often conflicts with state public-health goals. Use of prescriber-identifying data increases the effectiveness of brand-name marketing. The resulting increase in prescriptions of newer, more expensive drugs raises healthcare costs. The Act also funded an evidence-based prescription-drug education program intended to promote therapeutic and cost-effective prescribing.

In 2006 Lori Drew, a resident of O’Fallon, Missouri, joined others in registering a MySpace profile for a fictitious sixteen-year-old boy named “Josh Evans” and posted a photograph of an actual boy without his knowledge or consent. The conspirators used the profile to contact thirteen-year-old Megan Meier, a classmate of Drew’s daughter, and exchanged flirtatious messages for several days. On October 16, 2006, they sent a final message stating that “the world would be a better place without her in it.” Later that day, after learning of Megan’s suicide, Drew caused the Josh Evans account to be deleted. MySpace required prospective members to check a box affirming agreement to its Terms of Service and Privacy Policy during registration. The full text of the terms appeared only after clicking a separate “Terms” hyperlink and was not mandatory reading. The 2006 Terms of Service prohibited providing false registration information, creating fake profiles, posting photographs without consent, and using the service for harassment or tortious activity. They also reserved to MySpace the unilateral right to restrict or terminate access for any reason. All member data and communications were stored on servers located in Los Angeles County, and every message sent between members was routed through those servers. A three-count indictment charged Drew with one count of conspiracy and three counts of violating the felony provisions of the Computer Fraud and Abuse Act, 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(B)(ii), on the theory that creating and using the fake profile constituted accessing MySpace computers without authorization or in excess of authorization. At trial the jury received instructions on the lesser-included misdemeanor offense under 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(A). The jury deadlocked on the conspiracy count, acquitted Drew of the three felony CFAA counts, and convicted her of the three misdemeanor CFAA counts. Drew thereafter moved under Federal Rule of Criminal Procedure 29(c) for judgment of acquittal, contending that the only evidence of unauthorized access was the deliberate violation of MySpace’s Terms of Service. The court heard testimony from MySpace’s Vice President of Customer Care describing the registration process, the content and enforcement of the terms, and the volume of accounts created daily, then took the motion under submission.

In 1994 Congress enacted the Driver’s Privacy Protection Act, which regulates the disclosure of personal information contained in the records of state motor vehicle departments. State DMVs require drivers and automobile owners to provide personal information that may include a person’s name, address, telephone number, vehicle description, Social Security number, medical information, and photograph as a condition of obtaining a driver’s license or registering an automobile. Many states sell this personal information to individuals and businesses, generating significant revenues such as the approximately $8 million received each year by the Wisconsin Department of Transportation. The DPPA generally prohibits any state DMV or its officers, employees, or contractors from knowingly disclosing or making available personal information obtained in connection with a motor vehicle record without the driver’s consent. The prohibition is subject to numerous statutory exceptions for uses such as motor vehicle safety, theft prevention, emissions compliance, and court proceedings. The Act also regulates the resale and redisclosure of drivers’ personal information by private persons who have obtained that information from a state DMV. Such persons must maintain records identifying to whom the records were disclosed and the permitted purpose for five years. Any person who knowingly violates the DPPA may be subject to a criminal fine. A state agency maintaining a policy or practice of substantial noncompliance may be subject to a civil penalty of not more than $5,000 per day imposed by the United States Attorney General. South Carolina law conflicts with the DPPA. Under that law, the information contained in the state’s DMV records is available to any person or entity that fills out a form listing the requester’s name and address. The form must state that the information will not be used for telephone solicitation. State law authorizes the DMV to charge a fee for releasing motor vehicle information and requires the DMV to allow drivers to prohibit use of their information for commercial activities such as telephone solicitation. Following the DPPA’s enactment, South Carolina and its Attorney General, respondent Condon, filed suit in the United States District Court for the District of South Carolina alleging that the DPPA violates the Tenth and Eleventh Amendments. The district court concluded that the Act is incompatible with principles of federalism, granted summary judgment for the state, and permanently enjoined the Act’s enforcement against the state and its officers. The Court of Appeals for the Fourth Circuit affirmed, and the Supreme Court granted certiorari in 1999.

Washington allows citizens to challenge state laws by referendum. Roughly four percent of Washington voters must sign a petition to place a referendum on the ballot, and each signature must include the signer's address and county of registration. The secretary of state verifies and canvasses the petitions to ensure only lawful signatures are counted. The Washington Public Records Act authorizes private parties to obtain copies of government documents, and the state treats submitted referendum petitions as public records subject to disclosure. In May 2009 Governor Christine Gregoire signed Senate Bill 5688, which expanded the rights and responsibilities of state-registered domestic partners, including same-sex domestic partners. That same month Protect Marriage Washington organized as a state political committee to collect signatures for a referendum on the bill. On July 25, 2009, Protect Marriage Washington submitted a petition containing over 137,000 signatures. The secretary of state determined the petition contained enough valid signatures, the referendum known as R-71 appeared on the November 2009 ballot, and voters approved the bill by a margin of 53 percent to 47 percent. By August 20, 2009, the secretary of state had received requests for copies of the R-71 petition from an individual and four entities, including Washington Coalition for Open Government and Washington Families Standing Together. Two entities issued a joint press release stating their intention to post the names of the R-71 petition signers online in a searchable format. The referendum petition sponsor and signers filed a complaint and motion for preliminary injunction in the United States District Court for the Western District of Washington. Count I of the complaint alleged the Public Records Act is unconstitutional as applied to referendum petitions generally. Count II alleged the Act is unconstitutional as applied to the Referendum 71 petition because signatories faced a reasonable probability of threats, harassment, and reprisals. The district court granted a preliminary injunction on Count I. The Ninth Circuit reversed that decision on Count I. The Supreme Court granted certiorari.