Privacy Harms Under Massachusetts Law

Last month, the Massachusetts Appeals Court decided Amato v. District Attorney, a case involving privacy and DNA. The plaintiff was one of many men who voluntarily submitted a DNA sample to prosecutors in connection with a murder investigation. Following the completion of that investigation, the indictment and conviction of another individual, and the exhaustion of the appellate process, the plaintiff sought confirmation that, as prosecutors had promised him, his DNA sample had been destroyed. He received no such confirmation; in fact, a representative of the state crime lab stated that the lab continued to hold all the voluntarily-submitted DNA samples associated with that case.

In his class action suit, the plaintiff claimed the defendant had violated two Massachusetts laws, the Fair Information Practices Act (FIPA) and the statutory protection against privacy invasions. In addition, he argued that the defendants had breached a promise made by investigating detectives and the district attorney that his DNA sample would not be retained.

The trial court dismissed the plaintiff’s claims and the Appeals Court reversed. Regarding the scope of FIPA, the court held that, as the statutory text indicates, government agencies may not collect or maintain more personal data than reasonably necessary in connection with their legal functions; an agency that violates this rule may be subject to an action for equitable relief. In this case, the court concluded the plaintiff’s allegations sufficed to show the defendants kept more of his personal data than reasonably necessary—after all, the criminal investigation had ended and the appellate process had run its course.

As for the invasion of privacy claim, the Appeals Court noted that, under the statute, an individual has the right to be free from unreasonable, substantial and serious interference with privacy, and the trial court has the equitable power to enforce this right. The court agreed that the DNA information at issue should be considered highly sensitive, and the allegation that the defendants retained this information without the plaintiff’s consent, and made it available for use in other criminal investigations, sufficed to show the retention was unreasonable.

Finally, the Appeals Court held that the investigating detectives had made an enforceable promise to the plaintiff when they solicited a DNA sample from him, which they broke, thereby creating an actionable claim for breach of contract.

And so the court remanded for further proceedings, and we are left with a decision that stands as a rare vindication of privacy interests. To be sure, victory depended upon the existence of statutory rules governing the collection and maintenance of private information, a statutory protection of privacy interests, and particularly egregious facts. At the same time, the decision gives us some sense of the kind of privacy harm that will be actionable.

The understanding of privacy harm embraced by the Amato court may have some utility for individuals seeking to pursue privacy violations in other contexts. One of the most difficult issues confronting plaintiffs who claim a privacy violation is the way the harm should be characterized. It is not the same as physical harm, which can be quantified and measured. And, under statutes that require a showing of actual harm, it may be difficult to demonstrate that a loss of control over personal information caused an injury.

In contrast, the Amato court’s reasoning indicates that the presence of certain factors will point to the existence of an injury which is subject to remedy. Consider that, while the court recognized data collection and maintenance may be reasonably necessary, such necessity does not extend indefinitely into the future. For example, in the context of a criminal case, when the investigation has ceased, and certainly when a conviction has been upheld, it is no longer necessary to retain information that is not relevant to the case. At the point in time when consensually-submitted personal information ceases to be relevant to a government function, control over that information essentially reverts back to the individual and the continued retention of it amounts to unreasonable interference with privacy—that is, an actionable injury.

This injury existed, moreover, even absent evidence that the privacy violator made use of the personal information at issue. In other words, the Appeals Court in Amato concluded that the merely holding this information without the information-owner’s consent stated a claim for relief.

This kind of analyis suggests that, at least under Massachusetts law, the default position is individual control over personal information, and the loss of that control without appropriate justification must be regarded as a particularized harm, one which the courts have the power to remedy.

Lawrence Friedman