As 2013 ended and 2014 began, privacy professionals took a moment to look back and choose the year’s most dubious achievements in privacy law.

The Coveted Golden Privy

The dubious achievement awards, also known as the Privies, were dominated by officials of the Obama Administration.

The awards are a light-hearted way of expressing skepticism about the effort to write evolving notions of privacy into law. Because concepts of what is private change rapidly while laws remain on the books for decades, unintended consequences are common. Outmoded privacy laws are often misused to protect the powerful or are invoked hypocritically to achieve other ends, and judicial applications of privacy statutes often make no sense to ordinary people, whose concepts of privacy have evolved faster than the law.

The winners of the 2014 Privies exemplify all of these flaws.

Health and Human Service Secretary Kathleen Sebelius was voted Privacy Hypocrite of the Year for imposing harsh penalties on private companies whose systems for handling personal health data had security weaknesses — the same kind of weaknesses that HHS ignored when it rolled out the deeply flawed healthcare.gov site. 

Agriculture Secretary Thomas Vilsack, meanwhile, won the prize for Worst Use of Privacy Law to Protect Power and Privilege. Vilsack’s Agriculture Department invoked privacy law to prevent the New York Times from checking the names and addresses of people who made questionable claims for federal funds in the “Pigford” scandal. Since media attention to fraud in the program would have cast doubt on the department’s stewardship of taxpayer funds, most voters thought the government was actually applying a common government understanding of privacy: “Privacy Law Protects You From Anything That Might Embarrass Me.”

Finally, in the one category where no executive branch candidates were nominated, the award for Dumbest Privacy Case of the Year went to U.S. District Court Judge Lucy Koh for her opinion opening the door to claims that all 425 million users of Gmail are victims of wiretapping by Google (and quite possibly are themselves aiding and abetting wiretapping when they send mail to others). The decision also hints that spam filters are themselves a form of wiretapping in the absence of detailed consent procedures. One decision, three remarkably dumb results.

The Privies are based on the votes of privacy professionals, who know the dirty secrets of privacy law better than most, but the general public was also invited to vote for a People’s Choice award in the same categories. Kathleen Sebelius and Tom Vilsack dominated the voting among both privacy professionals and the general public. Judge Koh was the clear favorite of privacy professionals, but she was edged out in popular voting by the Boston Police Department, which invoked wiretapping law to threaten a citizen who recorded and posted on the Internet his conversation with a press spokesman of the Boston Police Department.

The full slate of nominations can be found here. The final results of balloting are listed below.

Privacy Hypocrite of the Year

Worst Use of Privacy Law to Protect Power and Privilege

Dumbest Privacy Case of 2013

Note: columns may not sum to 100 due to rounding.