Consumer Law & Policy Blog

Major Chicago Conference: Contracting Over Privacy

The Journal of Legal Studies is holding a conference at the University of Chicago titled "Contracting Over Privacy" on October 16 & 17.  The conference features an all-star lineup. Here's the conference blurb:

Information privacy is rapidly emerging as one of the key areas of consumer protection in our era. This conference will examine the role of contract in policing information privacy. Are private contracts an efficient regulatory tool of data privacy? Should the law incorporate mandatory protections, not waivable by consumers? Can disclosures effectively inform consumers about firms’ data practices?

More information here.  (HT: ContractsProf Blog).

George Mason Study of Self-Regulation of Privacy

Siona Robin Listokin of George Mason's  School of Policy, Government, and International Affairs has written Industry Self Regulation of Data Privacy and Security.  Here is the abstract:

Industry self-regulation of consumer data privacy and security has been proposed as a flexible alternative and compliment to traditional government regulation. This study analyzes whether different types of existing industry-led standards improve online privacy and security. The paper examines which types of firms join voluntary standards and whether there is a difference in outcomes between trade association memberships (like the Digital Advertising Alliance) and certification programs (like TRUSTe). Results suggest that more trafficked websites are more likely to adopt standards, and that trade association membership does not have an effect on privacy and security performance. There is some evidence that paid certification can hurt subsequent privacy and security. This study also compares website privacy measures and highlights the need for a valid privacy metric.

Amy Schmitz Article on Big Data and Consumer Scores

Amy Schmitz of Colorado has written Secret Consumer Scores and Segmentations: Separating Consumer 'Haves' from 'Have-Nots', Michigan State Law Review, p. 1411 (2014). Here is the abstract:

“Big Data” is big business. Data brokers profit by tracking consumers’ information and behavior both on- and offline and using this collected data to assign consumers evaluative scores and classify consumers into segments. Companies then use these consumer scores and segmentations for marketing and to determine what deals, offers, and remedies they provide to different individuals. These valuations and classifications are based on not only consumers’ financial histories and relevant interests, but also their race, gender, ZIP Code, social status, education, familial ties, and a wide range of additional data. Nonetheless, consumers are largely unaware of these scores and segmentations, and generally have no way to challenge their veracity because they usually fall outside the purview of the Fair Credit Reporting Act (FCRA). Moreover, companies’ use of these data devices may foster discrimination and augment preexisting power imbalances among consumers by funneling the best deals and remedies to the wealthiest and most sophisticated consumers. Use of these scores and segmentations increases the growing gap between powerful “haves” and vulnerable “have-nots.” This Article sheds light on these data devices and aims to spark adoption of data privacy regulations that protect all consumers regardless of their educational, economic, ethnic, or social status.

Dennis Hirsch Paper on Big Data and the FTC's Unfairness Authority

Dennis D. Hirsch of Capital has written That's Unfair! Or Is It? Big Data, Discrimination and the FTC's Unfairness Authority, 103 Kentucky Law Journal (2015). Here is the abstract:

Big data and data analytics (“big data”) can produce many social and economic benefits.  But they can also generate privacy injuries and harmful discrimination.  The governance of big data should, accordingly, focus on balancing benefits and risks.  Where the potential benefits outweigh the risks, the big data application should be seen as appropriate.  Where the risks outweigh the benefits, it should be seen as inappropriate.  This provides a framework for sorting beneficial from harmful uses of big data, and so for figuring out which big data applications are in bounds, and which are not.

Others have advocated a risk-benefit approach to big data.  However, the scholarly literature has not yet identified a legal basis on which to ground such an approach.  This Article does.  It argues that the FTC could use its Section 5 “unfairness authority” to draw the line between those big data uses that are appropriate and fair, and those that are inappropriate and unfair. In this way, it could provide guidance to big data businesses that are struggling to find a coherent, legally-grounded framework for making such calls.  It could also take an important step towards protecting privacy and civil rights in the era of big data.

This raises an important legal question. Does the Commission’s unfairness authority encompass the governance of big data?  Or does this task lie outside the scope of the FTC's  statutory jurisdiction?  Here, the essay offers an original reading of FTC v. Wyndham Worldwide Corp., a district court decision (on appeal at the time of this writing) that provides the latest word on the scope of the FTC’s unfairness jurisdiction.  It shows that the Wyndham decision both supports the FTC’s authority to govern big data practices and provides guidance on how the Commission could go about doing so.

Jeff Gelles: Is Congress taking wrong direction on data privacy?

Here. An excerpt:

To opponents, the bill might better be named the "Data Insecurity and Breach Hiding Act." Beth Givens, executive director of the Privacy Rights Clearinghouse, says its passage "would be a giant step backward for consumer protection."

Even more emphatic is John Breyault of the National Consumers League.

"Only in Washington would they think about actually reducing existing data-security protections at a time when tens of millions of consumers are being hurt by these massive data breaches at companies like Target, Home Depot, and Anthem," Breyault told me Wednesday after the bill was passed by the Energy and Commerce Committee on a party-line vote.

ABA Consumer Protection Conference Focuses on Big Data, Internet of Things and Ad Substantiation Standards

By Dee Pridgen

The ABA Consumer Protection Conference held February 12 on the campus of the George Washington University in Washington, D.C., focused on the work of the Federal Trade Commission (FTC), as well as the work of advertising self-regulatory bodies, especially in the areas of big data and the “Internet of Things.”  FTC Chair Edith Ramirez kicked things off by summarizing the FTC’s consumer protection agenda.  She praised the recent DC Circuit Court opinion in the POM Wonderful case, stating that the decision shows that health claims need to be backed by “strong science.”  She also said that the FTC will focus on the growing sector of mobile payments, especially unauthorized billings, as well as privacy and data security issues.  She stated that the FTC wants to eliminate the common carrier exemption from the FTC Act so that it can better pursue issues like billing practices and “cramming” of unauthorized charges onto telephone bills.

This conference featured two “interactive oxford style debate” sessions, one of which was on the proper standards for advertising substantiation.  I debated Howard Beales (photo below), former FTC Bureau of Consumer Protection Director and currently an economics professor at George Washington.  The proposition to be debated was:  “Even in a world of evolving science and new products, the FTC’s traditional advertising substantiation standard of competent and reliable scientific evidence best maximizes consumer welfare.”  Beales argued in favor, stating among other things that requiring anything more than competent and reliable evidence would deter advertisers from disseminating truthful health and nutrition claims, and that otherwise safe food products did not need to be tested in the same way as drugs.  I argued against the resolution, saying that the traditional standard, while necessary, is not sufficient to protect consumers who pay more for certain products based on specific disease related claims that are said to be “proven.”  For these specific claims, as was the case in POM Wonderful, a higher level of substantiation may be required.  Before the debate, 79% of the audience was in favor of the resolution and 21% were against.  After the debate, 55% were in favor and 45% were against. 

Several sessions dealt with privacy.  Ilana Westerman, CEO of Create with Context, suggested that marketers persuade customers to want to give their data, due to the convenience and benefits, rather than just taking it for the marketer’s benefit.  An example was consumers who share a “wish list” of gifts they desire for special occasions with friends and relatives, and an app that alerts the consumer when he or she is in a store that has an item on their friend’s wish list.  This was well received by consumers, whereas an app that tells you in the store that you need to buy milk (because of prior buying patterns) would
feel “creepy.” 

Another panel discussed the “Internet of Things,” the subject of a just released FTC staff report, available here.  There are now over 25 billion devices that are interconnected and that collect personal information, such as in cars, “wearable” technology, and “smart” appliances.  The consensus at the FTC seems to be that there should be “privacy by design” incorporated into such devices to avoid security breaches and unauthorized access and misuse of personal information, and that consumers should have some notice and choice with regard to sharing their data.  No one advocated special regulations for this aspect of data sharing, but the FTC wants to have a general federal privacy statute that would be broad, flexible and not technology specific, that would allow the FTC to give guidance on data security and online tracking, among other things.

The packed agenda also featured a discussion of third party liability for fraud (e.g., payment processors), globalized privacy norms, and consumer protection in the direct selling industry. The conference closed with a panel on the advertising industry’s premier self-regulation body, the National Advertising Division of the Better Business Bureau. 

NYT Report: Obama to Call for Laws Covering Data Hacking and Student Privacy

Here.

Times Privacy Op-Ed and WaPo Story on Rent to Own

Frank Pasquale of Maryland has a terrific op-ed in today's Times, The Dark Market for Personal Data, about lists of consumers with various characteristics.  An excerpt:

There are three problems with these lists. First, they are often inaccurate. For example, as The Washington Post reported, an Arkansas woman found her credit history and job prospects wrecked after she was mistakenly listed as a methamphetamine dealer. It took her years to clear her name and find a job.

Second, even when the information is accurate, many of the lists have no business being in the hands of retailers, bosses or banks. Having a medical condition, or having been a victim of a crime, is simply not relevant to most employment or credit decisions.

Third, people aren’t told they are on these lists, so they have no opportunity to correct bad information.

Meanwhile, the Washington Post ran a piece yesterday on rent-to-own headlined Rental America: Why the poor pay $4,150 for a $1,500 sofa. 

Paper on Privacy Harms and the Notice and Choice Framework

Joel R. Reidenberg, N. Cameron Russell, Alexander J. Callen, Sophia Qasir, and Thomas B. Norton, all of Fordham, have written Privacy Harms and the Effectiveness of the Notice and Choice Framework. Here is the abstract:

In the last fifteen years, the Federal Trade Commission and the White House have promoted notice and choice as the preferred mechanism for protecting consumers’ privacy online.  But law and policy scholars doubt the efficacy of this mechanism.  Research shows that consumers rarely read website privacy policies, that such policies are often too complex for users to understand, and that website policy statements do not match consumers’ privacy expectations.  Efforts to ameliorate theses issues through technological tools, such as privacy filters and do-not-track codes, have been unsuccessful.  Further, these tools do not address whether notice and choice theory aligns with the actual privacy harms that consumers experience. 

This alignment remains unexplored.  This article, thus, proposes to examine the relationship between the notice and choice theory and users’ actual privacy concerns.  The article takes a novel approach that examines privacy litigation and FTC enforcement actions.  This focus on the wrongs litigated in the real world reveals the most important harms that consumers experience and provides a better understanding of the efficacy of the notice and choice framework.

The data set compiled to support the research for the article consists of all federal class action complaints alleging online privacy violations filed during the last ten years and the Federal Trade Commission complaints and settlements addressing online privacy.  The article next addresses the roles that jurisdiction and competence play in framing claims and identifies a typology of the wrongful acts experienced by consumers.  The research shows that four types of claims appear in both private litigation and public enforcement with respect to personal information:  (1) unauthorized disclosure, (2) surreptitious collection, (3) failure to secure, and (4) undue retention.

The article then applies this typology to map “zones of effectiveness” for the notice and choice regime.  The article identifies which wrongs a proper notice and choice regime can and cannot address.   The research demonstrates that while some wrongful practices might be avoided by the inclusion of specific statements in a notice, others will be incurable through notice.  The latter set of wrongs is, thus, outside the “zone of effectiveness” of a notice and choice regime.  Lastly, the article concludes with a discussion of whether and how the harms that consumers experience match the outcomes of litigation and FTC settlement orders.

This research is supported by the National Science Foundation grant 1330214 “TWC SBE: Option: Frontier: Collaborative: Towards Effective Web Privacy Notice and Choice: A Multi-Disciplinary Prospective.”

Should HIPPA Block Doctors' Offices From Posting Baby Pictures? It Does.

by Jeff Sovern

You know those bulletin boards you used to see at some doctors' offices with snapshots of babies they had either treated or delivered?  Well, last week, the Times ran an article, Baby Pictures at the Doctor’s? Cute, Sure, but Illegal about how display of the photos where patients and others could see them violates HIPAA, the federal law protecting patient privacy.  Today the Times published my letter responding to the article.  It says, in part:

You report that federal privacy laws block doctors from posting pictures of patient babies where others can see them. Surely parents sending baby pictures to physicians do not expect the photos to be secret.

The law should be amended to permit their posting, unless parents request that they be kept private. This is the type of regulation that fuels claims that government is the problem.

If you find this interesting, the other letters on the matter are worth reading also.