Right to Not Be Forgotten (Sometimes): Celebrity Privacy Rights in a Data-Driven World

AuthorFranklin Graves and Germaine Gabriel
Pages20-38
Published in Landslide® magazine, Volume 13, Number 2, a publication of the ABA Section of Intellectual Property Law (ABA-IPL), ©2020 by the American Bar Association. Reproduced with permission. All rights reserved.
This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.
20 LANDSLIDE n November/December 2020
Image: sidneybernstein, GettyImages
Right to
Not
Be
Forgotten (Sometimes)
Celebrity Privacy Rights
in a Data-Driven World
By Franklin Graves and
Germaine Gabriel
Published in Landslide® magazine, Volume 13, Number 2, a publication of the ABA Section of Intellectual Property Law (ABA-IPL), ©2020 by the American Bar Association. Reproduced with permission. All rights reserved.
This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.
November/December 2020 n LANDSLIDE 21
A
ccess to data plays a crucial role in how
society consumes entertainment. At the
tap of an app, we can nd out the name
of the familiar face playing a second-
ary role in a classic TV sitcom or learn the
(estimated) net worth of an athlete fea-
tured in a commercial that just aired.
Additionally, we can explore the back
catalogs of our favorite artists on a
streaming music platform or read
about their careers without leaving the
platform. We can also dig into the
latest gossip or paparazzi video docu-
menting a celebrity’s meltdown.
The realms of entertainment, media, and sports law tradition-
ally rely on a bundle of privacy and publicity rights that, when
taken together, form a protective legal shield for celebrities.
These rights range from invasion of privacy to libel and slan-
der to misappropriation of name, image, and likeness. Whether
classied as celebrities, athletes, inuencers, or something else
entirely, famous individuals have always faced legal hurdles
across jurisdictions when they seek to secure legal protections
over their personal lives, businesses, brands, and numerous rev-
enue streams. Public gures are now looking to the ongoing
advent of groundbreaking privacy regulations around the world
to add more tools to their legal arsenal. However, to what extent
have they given up, or signed away, such rights?
Value and Ownership of Personal Data
Over the last few years, the general population has become
familiar with privacy laws through their routine, everyday use
of products and services. It is nearly impossible to avoid pri-
vacy issues, whether it is accepting an onslaught of updated
social media platform privacy policies1 or reading about weak
user passwords leading to bad actors gaining access to a cam-
era in a child’s bedroom.2 Data is commonly analogized as
the “new oil” and powers much of our economy and daily
lives.3 According to cloud software rm DOMO, predic-
tions indicate that “[b]y 2020, there will be 40x more bytes
of data than there are stars in the observable universe.4 What
is the value of all this data? Estimates attempting to place a
monetary value on personal data range from a couple hun-
dred dollars per service used5 up to thousands of dollars per
individual.6 It is clear that there is a value to businesses and
individuals when it comes to personal data and the regula-
tions that govern its use.
The most notable privacy legislation in recent years came
from Europe in the form of the General Data Protection Regu-
lation (GDPR).7 The state of California soon followed suit with
the California Consumer Privacy Act of 2018 (CCPA).8 Both
pieces of legislation laid the groundwork for handing over the
controls of personal privacy and the use of personal data to the
individual (referred to as “data subjects” under the GDPR and
“consumers” under the CCPA), as opposed to sole control and
use, termed “processing” under both regulations, by the busi-
nesses transacting with such data (referred to as “processors”
and/or “controllers” and “sub-processors” under the GDPR and
“businesses” and/or “service providers” under the CCPA).
Franklin Graves is technology counsel at HCA Healthcare, Inc., in
Nashville, Tennessee. He has extensive experience in technology, media,
and privacy laws. He can be reached at franklin.graves@gmail.com.
Germaine Gabriel is corporate counsel - privacy at ServiceNow in
Santa Clara, California. She has experience in technology, intellectual
property, product, and privacy law. Prior to entering Silicon Valley,
Germaine was a presidential appointee under President Barack Obama.
She can be reached at germaine.gabriel@gmail.com.
The concept of data “ownership” within the context of
personal data has largely been upended by privacy regula-
tions and resulted in a change to transacting with personal
data within the entertainment, media, and sports industries.
Currently, privacy regulations do not differentiate between
personal data subjects who are well-known and those who
might only have a couple of hundred Instagram followers, so
industries have been forced to adapt.
Key Rights and Obligations under the GDPR and CCPA
As a starting point, it is helpful to understand that, gener-
ally, the GDPR applies to: (1) the processing of personal data
within the European Economic Area (EEA), regardless of
whether it is the personal data of a citizen of an EEA member
state or not; and (2) the processing of EEA data subjects’ per-
sonal data, regardless of whether the processing takes place
within the EEA, or whether the controllers and/or processors
are established outside of the EEA.9 The CCPA establishes
a less broad approach for applicability by focusing on for-
prot legal entities that do business in California and meet the
following thresholds: (1) gross annual revenues over $25 mil-
lion; (2) annually buy, receive, sell, or share commercially the
personal information of over 50,000 consumers, households,
or devices; or (3) derive 50 percent or more of their annual
revenues from selling consumers’ personal information.10
Most companies within the entertainment, media, and
sports industries would easily fall within the categories of
businesses, or processors and/or controllers, subject to the
CCPA, the GDPR, or both. However, not all public gures
fall within the scope of existing privacy regulations. As regu-
lators expand protections, such as federal privacy regulations
in the U.S.,11 businesses will have to continue adapting pro-
cesses and procedures for the handling of personal data.
Absent an idyllic future in which a uniform approach to pri-
vacy laws exists, building a foundational understanding of
the CCPA and GDPR is a perfect starting point for shaping a
lawyer’s approach to personal data rights.
The CCPA allows consumers the right to prohibit busi-
nesses from selling their personal information, the so-called
“opt-out right,” with such options being clearly and conspicu-
ously located on a business’s website. Additionally, the CCPA
explicitly requires parent or guardian consent for consumers
under the age of 13, or explicit consent for consumers between
the ages of 13 and 16 (a so-called “right to opt-in”). This par-
ticular obligation might prove problematic for websites that
rely on user-generated content, or crowdsourcing, such as
IMDb or Wikipedia. By way of example, IMDb’s California
Consumer Privacy Act Disclosures list “professional infor-
mation, for example data you may provide about your acting

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT