Data Protection in the Digital Economy: Legislating in Light of Sorrell v. IMS Health Inc.

Consumers overwhelmingly believe that companies do not do enough to protect their personal data. As Congress considers federal data protection leg-islation, it must ensure that any proposed legislation comports with the First Amendment. In 2011, in Sorrell v. IMS Health Inc., the U.S. Supreme Court de-termined that a Vermont law prohibiting the use of physician-prescribing records for marketing purposes violated the First Amendment. At the heart of Sorrell is that shared data, unlike a traditional commodity like oil, conveys information and is thus First Amendment-protected speech. Since Sorrell, the use and retention of data, specifically personal data, has exploded and is only expected to increase. Nevertheless, the United States currently lacks comprehensive federal data pro-tection legislation. To fill this legislative gap, state legislatures have begun to pass data protection laws. These laws apply either to specific types of data—such as biometric information or Internet service provider customer information—or simply all consumer data. As state and federal legislative efforts advance, law-makers must consider the lessons from Sorrell to ensure that new legislation pro-tects consumer privacy interests without infringing on data holders’ protected speech. This Note argues that most data protection legislation will likely survive First Amendment scrutiny under Sorrell because the legislation establishes base-line personal data privacy rights while still generally allowing businesses to use personal data so long as they are transparent.