Consumer Law & Policy Blog

Study Finds Data Breach Laws Have Only Marginal Effect on Identity Theft

Sasha Romanosky, Rahul Telang, and Alessandro Acquisti, all of Carnegie Mellon, have co-authored Do Data Breach Disclosure Laws Reduce Identity Theft?  Here's the abstract:

Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. We use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. We find that adoption of data breach disclosure laws have a marginal effect on the incidences of identity thefts and reduce the rate by just under 2%, on average. While this effect is marginal, reducing identity theft is only one means by which these laws can be evaluated: we appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices.

Skiba and Tobacman on Whether Payday Loans Cause Bankruptcy

Paige Marta Skiba of Vanderbilt and Jeremy Tobacman of Penn have co-authored Do Payday Loans Cause Bankruptcy?.  Here's the abstract:

An estimated ten million American households borrow on payday loans each year. Despite the prevalence of these loans, little is known about the effects of access to this form of short-term, high-cost credit. We match individual-level administrative records on payday borrowing to public records on personal bankruptcy, and we exploit a regression discontinuity to estimate the causal impact of access to payday loans on bankruptcy filings. Though the size of the typical payday loan is only $300, we find that loan approval for first-time applicants increases the two-year Chapter 13 bankruptcy filing rate by 2.48 percentage points. There appear to be two components driving this large effect. First, consumers are already financially stressed when they begin borrowing on payday loans. Second, approved applicants borrow repeatedly on payday loans and pawn loans, which carry very high interest rates. For the subsample that identifies our estimates, the cumulative interest burden from payday and pawn loans amounts to roughly 11% of the total liquid debt interest burden at the time of bankruptcy filing.

Hoofnagle and King on What Californians Understand About Online Privacy

After co-authoring What Californians Understand about Privacy Offline, Chris Jay Hoofnagle and Jennifer King, both of Berkeley, have collaborated on What Californians Understand about Privacy Online.  Here's the abstract:

The volume of online commerce grows every year, in absence of a federal law setting baseline protections for the collection, use, and disclosure of personal information. Instead, information collected by websites are governed by individual privacy policies.

In order to gauge Californians' understanding of privacy policies and default rules in the online environment, we commissioned a representative survey of adults in the State (N=991). The telephonic survey of Spanish and English speakers was conducted by the Survey Research Center of University of California, Berkeley.

A gulf exists between California consumers' understanding of online rules and common business practices. For instance, Californians who shop online believe that privacy policies prohibit third-party information sharing. A majority of Californians believes that privacy policies create the right to require a website to delete personal information upon request, a general right to sue for damages, a right to be informed of security breaches, a right to assistance if identity theft occurs, and a right to access and correct data.

These findings show that California consumers overvalue the mere fact that a website has a privacy policy, and assume that websites carrying the label have strong, default rules to protect personal data. In a way, consumers interpret "privacy policy" as a quality seal that denotes adherence to some set of standards. Website operators have little incentive to correct this misperception, thus limiting the ability of the market to produce outcomes consistent with consumers' expectations. Drawing upon earlier work, we conclude that because the term "privacy policy" has taken on a specific meaning in the minds of consumers, its use should be limited to contexts where businesses provide a set of protections that meet consumers' expectations.  

A Bit More on Whether Consumers Read

by Jeff Sovern

I posted yesterday the abstract of Debra Pogrund Stark's and Jessica M. Choplin's article, A License to Deceive: Enforcing Contractual Myths Despite Consumer Psychological Realities, NYU Journal of Law & Business (2009), but I wanted to mention a bit more about it. One way the authors tested whether people read forms was to have students fill out a thee-page consent form to participate in a study.  Here's an excerpt which I suspect will become a classic:

The second paragraph was a long-winded explanation of informed consent, but buried three quarters of the way through this paragraph, was a sentence suggesting that participants should not sign this consent form as its terms were clearly not in their best interests. The third and fourth paragraphs described unproblematic aspects of studies typically conducted at the university. Buried within the fifth paragraph, however, were clauses that were certain to be unacceptable if read by participants. In particular, these clauses committed participants to administering electric shocks to fellow participants, if instructed to do so, even if that participant screamed, cried, and asked for medical assistance. It also required participants to do push-ups, if the experimenter instructed them to do so. Contrary to human-subject protection guidelines, the form required participants to remain in the laboratory until and unless the experimenter allowed them to leave.

So how many signed?  87 of the 91 participants, or 95.6%.  The authors report: "Very few read any provisions or even skimmed enough to get a vague idea of those provisions. The average time that these participants spent looking at the bogus consent form was 2.0 seconds."  To be sure, that may not say very much about whether consumers read other contracts, or even that these students were typical of consumers, but it sure rings true, doesn't it.  I should also note that the authors also surveyed 207 people on whether they read contracts.

Marotta-Wurgler Study Finds Firms With Market Power Don't Impose One-Sided Terms on Consumers in Software License Agreements

Florencia Marotta-Wurgler  of NYU has written Competition and the Quality of Standard Form Contracts: The Case of Software License Agreements, 5 Journal of Empirical Legal Studies (2008).  Here's the abstract:

Standard form contracts are pervasive. Many legal academics believe that they are unfair. Some scholars and some courts have argued that sellers with market power or facing little competitive pressure may impose one-sided standard form terms that limit their obligation to consumers. This paper uses a sample of 647 software license agreements drawn from many distinct segments of the software industry to empirically investigate the relationship between competitive conditions and the quality of standard form contracts. I find little evidence for the concern that firms with market power, as measured by market concentration or firm market share, require consumers to accept particularly one-sided terms; that is, firms in both concentrated and unconcentrated software market segments, and firms with high and low market share, offer similar terms to consumers. The results have implications for the judicial analysis of standard form contract enforceability.

Ben-Shahar on the Opportunity to Read Contracts

Omri Ben-Shahar  of Chicago has written The Myth of the 'Opportunity to Read' in Contract Law.  Here's the abstract:

Standard form contracts in consumer transactions are usually not read by consumers. This "unreadness" of contracts creates opportunities for drafters to engage in unfair trade practices. Various doctrines of contracts and consumer protection law address this concern. One of the prominent solutions coming out of recent proposals for reform is to give individuals a more substantial opportunity to read the contract before manifesting assent. With the greater opportunity to read, more transactors will actually read the terms and assent to the boilerplate will be more "robust." This Essay argues that solutions that focus on providing consumers an opportunity to read are useless, and can potentially be harmful. Most likely, greater opportunity to read would not produce greater readership of contracts - not the type that can help people make informed decisions - and the purpose of this solution would not be achieved, and could have unintended consequences. Even if the compliance with the requirement of opportunity-to-read is fairly cheap (e.g., giving consumers access to the boilerplate in advance), making this a central feature of the legal regulation of standard form contracts makes little sense. The paper ends by proposing non-legal approaches to making the contract terms more transparent, by building on market devices such as ratings and labeling.

Block-Lieb and Wiener on Whether Disclosure Helps Prevent Overindebtedness

Susan Block-Lieb of Fordham and Richard L. Wiener  of Nebraska have co-authored Disclosure as an Imperfect Means for Addressing Overindebtedness: An Empirical Assessment of Comparative Approaches.  Here's the abstract: 

Within a generation, household overindebtedness has grown to become a social problem of significant proportion in the US, the UK, and around the world. Public policy makers on both sides of the Atlantic have taken initial steps to ameliorate excessive and unwise use of consumer credit, by reforming the procedures for settling and collecting defaulted consumer debt (including the procedures available under consumer bankruptcy law) and by providing enhanced disclosure and other protections to borrowers. We focus on credit card disclosure reforms in this paper and note that empirical research (ours and others) suggest that enhanced disclosure requirements are, at best, an incomplete mechanism for tackling the problem of overindebtedness. Enhanced disclosure presumes a rational actor model of consumer decisionmaking. In earlier articles, both together and with other co-authors, we have argued that extant data do not support fundamental assumptions underlying a strong version of the rational actor model of consumer credit but do support models that view consumer borrowers as quasi-rational, emotional actors. Research supporting a behavioral, emotional model of consumer decisionmaking undercuts enhanced disclosure as a remedy for increased consumer debt loads. This article proceeds in four parts: Part I compares household indebtedness - and measures of overindebtedness - in the US and UK. Part II looks at recent legislative responses to this problem, and concludes that the US approach is premised on a rational actor model of consumer decisionmaking, while the UK presumes a consumer in need of regulatory protection, enhanced information and debt advice. In Part III, we describe our most recent experimental work and its results, and reach similar conclusions about the likelihood that enhanced disclosure will quell the problem of overindebtedness. Part IV draws tentative conclusions for future research intended to study overindebtedness.

Gail Hillebrand of Consumers Union on Payments Law

Gail Hillebrand of Consumers Union has written Before the Grand Rethinking: Five Things to Do Today with Payments Law and Ten Principles to Guide New Payments Products and New Payments Law, 82 Chicago-Kent Law Review 769 (2008).  Here's the abstract:

U.S. consumers today have a broad range of choices about how to make payments. In addition to checks, credit cards and traditional debit cards, consumers may be offered prepaid cards, contactless cards, mobile payment devices, online payment sites, online credit payments, and other new ways to pay.

Federal payments law was developed before many of these methods existed, so it is no surprise that it has gaps in coverage. The variations in the law underlying the different payments methods place consumers in very different legal positions when something goes wrong. The gaps in the law mean that the particular payment method used, and how the payment is processed, can affect the consumer's ability to get his or her money back if the goods are not delivered as ordered, the payment information is stolen and misused, the payment was unauthorized, or the payment is processed for the wrong amount.

This article, first published at 83 Chicago-Kent Law Review, No. 2, 769 (2008), describes the current state of confusion and gaps in the payments law; outlines a set of five immediate changes to current law that would address major problems and ambiguities in payment law; and offers ten principles to evaluate existing and future payments methods, regulations and laws.

First, the article describes the current state of the law as applied to some of the new payments methods in terms of the questions consumers might ask: Is my money safe? Will it disappear in fees before I have a chance to spend it? Will I get my money back if someone else makes a mistake? Can I stop or reverse payment if I do not get the goods? This section describes the different answers to these questions depending on which payment product is used.

Second, the article describes how many of these problems could be eliminated and greater consumer protection in the non-cash payment marketplace could be accomplished with a handful of changes to the Electronic Fund Transfer Act, the Fair Credit Billing Act, and the Expedited Funds Availability Act, plus more vigorous regulatory use of the power to prohibit unfair practices. These changes could provide a baseline set of consumer protections, built from the strongest elements of current federal consumer protections in payments law. Finally, the article recommends ten principles for evaluating new payments products and new payments law.

Simkovic Study Finds 2005 Bankruptcy Act Profits Credit Card Companies at Consumers' Expense

Michael Simkovic of Harvard's Olin Center for Law and Economics has written The Effect of 2005 Bankruptcy Reforms on Credit Card Industry Profits and Prices.  Here's the abstract:

The U.S. Bankruptcy code changed dramatically with the passage of The Bankruptcy Abuse Prevention and Consumer Protection Act Of 2005. This act increased the costs and decreased the benefits of bankruptcy to consumers. Supporters of the law claimed that it would benefit consumers as well as creditors, because reducing the losses faced by creditors would lower the cost of credit to consumers. Critics of the law depicted it as special interest legislation designed to profit credit card companies at the expense of consumers. This study tests whether the 2005 Bankruptcy Reform: (1) reduced the number of bankruptcies; (2) reduced credit card company losses; (3) lowered the cost to consumers of credit card debt; and (4) increased credit card company profits. The data suggests that although bankruptcies and credit card company losses decreased, and credit card companies achieved record profits, the cost to consumers of credit card debt actually increased. In other words the 2005 bankruptcy reforms profited credit card companies at consumers' expense.

Hillman and Barakat on Warranties and Disclaimers in the Electronic Age

Robert A. Hillman of Cornell and Ibrahim Barakat of White and Case have written
Warranties and Disclaimers in the Electronic Age.  Here's the abstract:

This paper reports on software-licensor express warranty and disclaimer practices on the Internet. Our data show that virtually all of the websites and End User License Agreements (EULAs) we sampled include express warranties on the website and disclaimers of the warranties in the EULAs that may erase all or much of the quality protection. Next, the paper reviews the reasons why consumers generally do not read their e-standard forms despite the prevalence of disclaimers and other adverse terms. We then argue that e-commerce exacerbates the problem of warranties and disclaimers and that lawmakers should address this issue. We contend that improved disclosure of disclaimers, including making them easily accessible on a website prior to any particular transaction and possibly even the subject of a pop-up window during a transaction, is the best of various imperfect solutions to the problem. Disclosure is inexpensive and, at minimum, creates the potential for more legitimate consumer assent to e-standard forms, including assent to disclaimers of warranty. Even if in the short term consumers do not read their forms, perhaps consumers will eventually learn of misleading warranties and disclaimers because the Internet creates communication possibilities and research tools unavailable to disgruntled purchasers in the paper world. The prospect of the word getting out that a licensor does not intend to stand behind its promises and representations may be sufficient to curtail the practice of misleading warranties and disclaimers.