Privacy Prowess

FIRST CLASS: Chief Privacy Officer Program leader Jeewon Kim Serrato ’04 (second from right) and Assistant Dean for Strategy, Innovation, and Education Eric Askins (right) talk with members of the first program cohort after their graduation event. Photo by Anastasiia Sapon

hen Berkeley Law Professor Paul Schwartz got his start as a privacy law scholar more than 30 years ago, you could assemble most of the field’s experts in a Capitol Hill conference room. Voices and data traveled over physical wires. Vital personal and financial records were consigned to paper. Prying eyes had to be literal.

The rise of the internet changed absolutely everything. The conveniences of the digital world — instant communication over multiple modes, an explosion of media offerings, and a shopping revolution, just to name a few — came with a price. These days, nearly everything that we do leaves virtual breadcrumbs unless we take overt steps to avoid them.

“Way back when we’d watch TV and it’d be over the air, there was no record of it,” Schwartz says. “And of course now, whether it’s Netflix or TikTok, there’s not just a record but it shapes what you might watch next.”

The transition from tightly controlled and regulated utilities to the freewheeling world of the internet sparked a need for new rules — and novel legal approaches. These days, that small coterie of privacy experts has expanded to tens of thousands of lawyers and researchers, Schwartz says.

And if he wants to chat with some of this booming sector’s top experts, all he has to do is open his office door. Professor of Law in Residence Chris Jay Hoofnagle, a premier cybersecurity scholar, is right down the hall. So is Clinical Professor Jennifer M. Urban ’00, director of policy initiatives at the pathbreaking Samuelson Law, Technology & Public Policy Clinic and inaugural board chair of the California Privacy Protection Agency (CPPA), which is setting an international standard for consumer privacy [see Guardians of the Data Galaxy].

One floor up is Professor Kenneth A. Bamberger, whose long-term research on content moderation and the power of platforms continues to evolve as AI takes center stage, and Clinical Professor and Samuelson Clinic Director Catherine Crump, who has gained state and national influence on the growing public surveillance state.

Other privacy powerhouses are just a short walk away: Professors Sonia Katyal, Tejas N. Narechania, Collen V. Chien ’02, and Clinical Professor and Samuelson Associate Director Erik Stallman ’03. All are faculty co-directors of the Berkeley Center for Law & Technology (BCLT), a hub for both students and practitioners with enormous influence across the state.

“Berkeley Law has the deepest bench in privacy and technology law of any school in the country, ” Hoofnagle says. “The clearest evidence of its value is the placement record: Berkeley students have gone into privacy practice at leading firms, chief privacy officer roles, regulator positions, and the academy in numbers no other school matches. Part of that is the course work, but part of it is that we helped build the professional community these students enter.”

The history of privacy law goes back more than half a century at Berkeley Law: Then-Dean William Prosser’s seminal 1960 California Law Review article “Privacy” identified four broad categories of privacy torts and essentially launched the field. Through work with the American Law Institute (ALI), Prosser successfully pushed to include privacy torts as part of a restatement of the law.

For Schwartz, who joined the faculty in 2006 and spent seven years working on a similar ALI project involving data privacy, being a privacy scholar at Berkeley Law is “a very humbling experience.”

A few years before he arrived, the founding of BCLT and the Samuelson Clinic put the school at the forefront of the burgeoning technology law sector. The clinic, which celebrated its 25th anniversary with a symposium and gala in late September, was established by a $2 million donation from Professor Pamela Samuelson and her husband Robert Glushko to advance the public interest in tech and intellectual property law.

“Not only was the Samuelson Clinic the first of its kind, it was the first to focus a substantial part of its work on privacy,” Urban says. “We were working on privacy from the very beginning, well before the legal and policy worlds started to catch up to its importance. Seeing around the corner has made students’ and faculty’s work highly influential.”

For example, the clinic helped pioneer California legislation to protect anonymous speech online, defined the privacy issues with ubiquitous sensing and the “Internet of Things,” was first to confront the issues with geolocation data, developed and won the first rule in the world to protect highly revealing “smart grid” electricity data, helped create resources for online victims of sexual harassment and violence, advocated for consumer protections in commercial data, pushed to limit National Security Agency spying on Americans, and spoke up for public rights in police surveillance.

As digital monitoring companies like Flock gain a deeper foothold in cities, clinic faculty and students have kept pace. Most recently, two teams of students conducted research and provided suggestions for an assessment report of the Oakland Police Department’s drone policies for the City of Oakland’s Office of the Inspector General.

“I’m especially proud that the clinic’s intersecting expertise means we see issues others don’t — like the profound privacy implications of tracking people’s engagement with copyrighted works,” Urban says, citing the pioneering efforts of Samuelson and UC Berkeley School of Information Professor Deirdre Mulligan, both also BCLT co-faculty directors.

Nicole Ozer ’03 was part of the first clinic cohort and came to Berkeley Law to focus on issues at the intersection of technology law, access, and justice after working in Bay Area “digital divide” centers during the early years of AmeriCorps.

“When I first considered law school, some people would ask me, ‘Are you going to be a public interest lawyer or a technology lawyer?’” she says. “And when I’d say, ‘I’m going to be a public interest technology lawyer,’ they’d ask, ‘Does that exist?’ But from the minute I walked in the door at Berkeley, it supported nuanced thinking about how to utilize law and policy to ensure that technology is really working for people and society.

“Berkeley is the epicenter for public interest technology work and for privacy law, and I’m so fortunate to have been able to start my career at Berkeley Law.”

After founding the Technology and Civil Liberties Program at the ACLU of Northern California and leading its cutting-edge digital rights work for more than 20 years, Ozer became the Electronic Frontier Foundation’s executive director this past summer. Earlier this year, she joined the CPPA board, alongside Urban and several other Berkeley Law alums.

Ozer was in law school on 9/11 and her privacy career was shaped by the rise of government surveillance in the wake of the attacks. She led the effort to enact groundbreaking surveillance oversight laws in local communities and to pass the California Electronic Communications Privacy Act (CalECPA) — the nation’s strongest electronic surveillance law.

Ozer saw many Berkeley Law relationships bolster the coalition that helped enact CalECPA.

“The fact that major technology companies supported that state bill, which doesn’t happen often, is because there were relationships at companies like Google and Apple,” she says. “Berkeley really is a community, and we learned in law school how to collaborate and find opportunities to move issues together.”

Today, as the AI explosion sparks new questions about how to protect privacy, she sees another pivotal moment for policymakers.

“The stakes are higher than ever for how information about who we are, where we go, and what we do is being collected and shared, and what the real ramifications are for people’s lives and safety,” Ozer says.

As technology has evolved, state and federal laws and rules have rushed to match the speed of innovation.

“Over the past 25 years we’ve moved from a Wild West regulatory environment to a relatively prescriptive one,” says Hoofnagle. “There were practices commonplace in 2000 that no reputable company would engage in today. That shift came less from any single omnibus statute than from an accretion of state law, Federal Trade Commission enforcement, and a broad sharing of privacy norms. In 2000, there were serious thinkers saying that there would be no privacy in the future. It turns out no one wanted that future.”

Schwartz is a co-author of two popular textbooks, Privacy Law Fundamentals and Information Privacy Law, that are in their seventh and eighth editions, respectively. Keeping up with the rapid changes — while keeping the books at a manageable length — has been a challenge, he says.

When he first started in academia, Schwartz’s mother made a practice of clipping and mailing him newspaper articles about privacy issues. Over time, the volume of media reports became so overwhelming that she told him that she was officially retiring as his ad hoc research assistant.

“There’s been such an incredible increase in just the amount of privacy statutes and regulations,” Schwartz says. “It’s daunting to try and keep up.”

Looking ahead, Hoofnagle thinks something has shifted in favor of more regulation for technology companies, while U.S. and European policymakers enact new rules so fast firms can’t comply with all of them. While each new rule might look like a discrete decision about a specific problem, the aggregate is something nobody would design on purpose.

“The calls for new rules extend very little trust to firms and give them almost no opportunity to demonstrate responsibility before the obligations arrive,” Hoofnagle says. “AI governance has moved from principles to binding prescription faster than any technology regime I can think of, and largely without the empirical record that preceded comparable interventions.”

Hoofnagle worries about where this is leading us, as the existing landscape favors larger firms that can absorb the cost of compliance and disadvantages smaller companies.

“Everyone has heard of patent trolls,” he says. “We now have privacy trolls — people serially suing startups for no-harm technical violations of privacy statutes. This is bad for innovation and for privacy.”

California, particularly through the California Consumer Privacy Act and its enforcement, has been at the forefront of shaping privacy law — with Berkeley Law scholars and alumni enjoying a particularly strong influence.

For example, Schwartz’s ALI project on data privacy proposed the idea of data portability for consumers more than a decade ago. That’s now part of the California law and has spread to some other states as well.

Countless alumni are practicing privacy law and policy in lead roles across Silicon Valley and the nation, including Jeff Marowits ’97, the CEO at Keystone, which helps companies navigate technological change. Sanjana Gorenz ’20 is the product and regulatory counsel at the AI design company Figma. Brian Gzowski ’17 is a senior counsel at cryptocurrency leader Coinbase.

Jeewon Kim Serrato ’04, who’s just moved from industry to head Berkeley Law’s new Chief Privacy Officer Program, leads the State Bar of California’s Privacy Law Specialization consulting group and convinced the Bar to greenlight the new specialization [see Innovation Engine].

In addition to Urban and Ozer, alum Drew Liebert ’84 is on the CPPA board, working with the agency’s Senior Privacy Counsel and Adviser Lisa Kim ’03 and Chief Privacy Auditor Sabrina Boyson Ross ’09. Stacy Schesser ’06 is enforcing the state’s privacy laws in the office of California Attorney General Rob Bonta as supervising deputy attorney general for the consumer and privacy units.

Amid the breakneck pace of legal changes, Berkeley Law is training students to enter practice with the most up-to-date knowledge. In addition to the Samuelson Clinic, students have access to a robust slate of privacy courses, from Schwartz’s Information Privacy Law to Hoofnagle’s Cybersecurity, Computer Crime & Investigation, which features an in-class computer lab component to help students understand where and how security attacks happen and is based on his 2024 textbook Cybersecurity in Context.

BCLT’s annual Privacy Lecture Series hosts numerous top-tier academics, and its annual privacy forum brings together practitioners and experts on hot topics in the field. Recent archives of both are available on the center’s virtual B-CLE platform, along with many other resources to keep attorneys informed about new developments.

The popular student-led Privacy Law at Berkeley (PrivLAB), which Schwartz advises, hosts talks by experts, circulates pragmatic tips for safeguarding digital privacy, supports privacy initiatives on campus, and helps students engage with practitioners at local gatherings.

Last year, the group hosted 12 events, featuring invigorating discussions with scholars, lawyers, and other experts.

“It’s a great organization, and such a good illustration of just how much is going on in the privacy area at Berkeley,” Schwartz says.

Recent PrivLAB President and 3L Zhi-Ying Chua is passionate about privacy issues because they touch every aspect of our lives and are highly relevant to the social issues she cares about. She was also a co-leader of the student-led pro bono Digital Rights Project, which focuses on how surveillance technologies are leveraged against marginalized communities.

“I’ve found it really rewarding facilitating meaningful conversations about cutting-edge topics in the field and, in tandem, building a stronger privacy law community at Berkeley Law,” Chua says. “This past year, I prioritized collaborating with other student groups, including those outside of the tech law network, and creating opportunities for students to learn from other students — from office hours to panel discussions.”

Aaniyah Hicks ’26, one of Schwartz’s research assistants during the last academic year, came to Berkeley Law already interested in privacy law. Her experiences strengthened her commitment, and also showed how versatile — and vital — a career in that area could be.

“Working alongside one of the field’s leading scholars gave me more than doctrinal knowledge,” she says. “I’ve built a foundation spanning the historical origins of privacy rights, the mechanics of government investigations into privacy and security violations, and the most recent regulatory and judicial developments shaping the field today.

“It’s this pairing of foundational knowledge and firsthand exposure to unsettled questions that I plan to carry with me into practice.”

Ozer says her own career trajectory demonstrates how Berkeley Law’s long-term depth and breadth in privacy fosters creativity and excellence in practice.

“People say this work isn’t a sprint but a marathon, but to me it’s a relay race,” she says. “And so many people have taught me, supported me, and helped me to think carefully, and now I’m leading the effort forward with all of that in mind.

“We’re at this moment where the decisions we make right now — in the courts, in the legislature, in our communities — about how AI is used, who it’s built for, and who benefits, are going to impact generations to come. It’s an honor and an opportunity and a real responsibility, and I do think coming from Berkeley, where there’s a history of thinking about the real ramifications of the decisions we make, is an advantage.”