Consumer Law & Policy Blog

Hartzog & Solove on the FTC and Data Protection

Woodrow Hartzog of Samford's Cumberland School of Law and Stanford's Center for Internet and Society and Daniel J. Solove of George Washington have written The Scope and Potential of FTC Data Protection, 83 George Washington Law Review (2015, Forthcoming).  Here is the abstract:

For more than fifteen years, the Federal Trade Commission (FTC) has regulated privacy and data security through its authority to police deceptive and unfair trade practices as well as through powers conferred by specific statutes and international agreements.  Recently, the FTC’s powers for data protection have been challenged by Wyndham Worldwide Corporation and LabMD.  These recent cases raise a fundamental issue, and one that has surprisingly not been well explored: How broad are the FTC’s privacy and data security regulatory powers?  How broad should they be?

In this article, we address the issue of the scope of FTC authority over privacy and data security, which together we will refer to as "data protection"  We  argue that the FTC not only has the authority to regulate data protection to the extent it has been doing, but it also has the authority to expand its reach much more.  Normatively, we argue that the FTC’s current scope of data protection authority is essential to the United States data protection regime and should be fully embraced to respond to the privacy harms unaddressed by existing torts, contracts, and statutes.  For example, the FTC can regulate with a much different and more flexible understanding of harm that one focused on monetary or physical injury. 

Thus far, the FTC has been quite modest in its enforcement, focusing on the most egregious offenders and enforcing the most widespread industry norms.  The FTC should push the development of the norms a little more (though not in an extreme or aggressive way).  We also discuss steps the FTC should take to change the way it exercises its power, such as greater transparency and more nuanced sanctioning and auditing.

Hoofnagle & Urban Reexamine Alan Westin's Privacy Classifications of Consumers

Chris Jay Hoofnagle and Jennifer M. Urban, both of Berkeley, have written Alan Westin's Privacy Homo Economicus, 49 Wake Forest Law Review 261 (2014).  Here's the abstract:

Homo economicus reliably makes an appearance in regulatory debates concerning information privacy.  Under the still-dominant U.S. “notice and choice” approach to consumer information privacy, the rational consumer is expected to negotiate for privacy protection by reading privacy policies and selecting services consistent with her preferences. A longstanding model for predicting these preferences is Professor Alan Westin's well-known segmentation of consumers into “privacy pragmatists,” “privacy fundamentalists,” and “privacy unconcerned.”  

To be tenable as a protection for consumer interest, “notice and choice” requires homo economicus to be broadly reliable as a model.  Consumers behaving according to the model will know what they want and how to get it in the marketplace, limiting regulatory approaches to information privacy.  While notice and choice is undergoing strong theoretical, empirical, and political critique, U.S. Internet privacy law largely reflects these assumptions.

This Article contributes to the ongoing debate about notice and choice in two main ways.  First, we consider the legacy Westin's privacy segmentation model itself, which as greatly influenced the development of the notice-and-choice regime. Second, we report on original survey research, collected over four years, exploring Americans’ knowledge, preferences, and attitudes about a wide variety of data practices in online and mobile markets. Using these methods, we engage in considered textual analysis, empirical testing, and critique of Westin’s segmentation model. 

Our work both calls into question longstanding assumptions used by Westin and lends new insight into consumers’ privacy knowledge and preferences. A close textual look at factual and theoretical assumptions embedded in the segmentation model shows foundational flaws. With testing, we find that the segmentation model lacks validity in important dimensions.  In analyzing data from nationwide, telephonic surveys of Internet and mobile phone users, we find an apparent knowledge gap among consumers concerning business practices and legal protections for privacy, calling into question Westin’s conclusion that a majority of consumers act pragmatically. We further find that those categorized as “privacy pragmatists” act differently from Westin’s model when directly presented with the value exchange — and thus the privacy tradeoff — offered with these services.

These findings reframe the privacy pragmatist and call her influential status in U.S. research, industry practice, and policy into serious question.  Under the new view, she cannot be seen as “pragmatic” at all, but rather as a consumer making choices in the marketplace with substantial deficits in her understanding of business practices.  This likewise calls into question policy decisions based on the segmentation model and its assumptions.  We conclude that updated research and a policy approach that addresses both rationality and knowledge gaps are key.

 

My Latest Op-Ed, on Data Brokers

by Jeff Sovern

Here, in the Pittsburgh Post-Gazette.

Hoofnagle on Big Data, Privacy, and the FCRA

Chris Jay Hoofnagle of Berkeley has written How the Fair Credit Reporting Act Regulates Big Data for the Future of Privacy Forum Workshop on Big Data and Privacy: Making Ends Meet, 2013. Here is the abstract:

This short essay, prepared for the Future of Privacy Forum's Big Data and Privacy: Making Ends Meet event in September 2013, makes two observations concerning "big data." First, big data is not new. Consumer reporting, a field where information about individuals is aggregated and used to assess credit, tenancy, and employment risks, achieved the status of big data in the 1960s. Second, the Fair Credit Reporting Act of 1970 (FCRA) provides rich lessons concerning possible regulatory approaches for big data.

Some say that "big data" requires policymakers to rethink the very nature of privacy laws. They urge policymakers to shift to an approach where governance focuses upon "the usage of data rather than the data itself."  Consumer reporting shows us that while use-based regulations of big data provided more transparency and due process, they did not create adequate accountability. Indeed, despite the interventions of the FCRA, consumer reporting agencies (CRAs) remain notoriously unresponsive and unaccountable bureaucracies.

Like today's big data firms, CRAs lacked a direct relationship with the consumer, and this led to a set of predictable pathologies and externalities. CRAs have used messy data and fuzzy logic in ways that produce error costly to consumers. CRAs play a central role in both preventing and causing identity fraud, and have turned this problem into a business opportunity in the form of credit monitoring. Despite the legislative bargain created by the FCRA, which insulated CRAs from defamation suits, CRAs have argued that use restrictions are unconstitutional.

Big data is said to represent a powerful set of technologies. Yet, proposals for its regulation are weaker than the FCRA. Calls for a pure use-based regulatory regime, especially for companies lacking the discipline imposed by a consumer relationship, should be viewed with skepticism.

 

Solove & Hertzog on the FTC and Privacy and Security Duties for the Cloud

Daniel J. Solove of George Washington and Woodrow Hartzog of Samford's Cumberland Law School and Stanford Law School's Center for Internet and Society have written The FTC and Privacy and Security Duties for the Cloud, 13 BNA Privacy & Security Law Report 577 (2014). Here's the abstract:

Increasingly, companies, hospitals, schools, and other organizations are using cloud service providers (and also other third party data service providers) to store and process the personal data of their customers, patients, clients, and others.  When an entity shares people’s personal data with a cloud service provider, this data is protected in large part through a contract between the organization and the cloud service provider.  In many cases, however, these contracts fail to contain key protections of data.  Because the consumer is not a direct party to these contracts and often cannot even have access to these contracts, the consumer is often powerless, and the consumer’s interests are often not adequately represented.  

In this short essay, we argue that there is a remedy in Section 5 of the Federal Trade Commission (FTC) Act that prohibits unfair and deceptive trade practices.  Certain key cases from the emerging body of FTC enforcement actions on data protection issues can be read together to create a double-edged set of duties – both on the organizations contracting with cloud service providers and on the cloud service providers themselves.  Not only does an organization owe a duty to consumers to appropriately represent their privacy and data security interests in the negotiation, but cloud service providers have an obligation to the consumer as well, and cannot enter into contracts that lack adequate protections and controls.

 

George Mason Policy Conference on the Future of Privacy and Data Security

The Law & Economics Center's Henry G. Manne Program in Law & Economics Studies will present its Public Policy Conference on the Future of Privacy and Data Security Regulation at George Mason University School of Law, Wednesday, May 14, 2014 from 8:30 am to 5:00 pm.

PANEL 1: Section 5 and the FTC's Proper Role in Privacy and Data Security Regulation

PANEL 2: Government and Commercial Surveillance: Spillovers and Constitutional Issues

LUNCHEON KEYNOTE: A Conversation with Maureen K. Ohlhausen

The luncheon keynote will consist of a "living room" conversation between FTC Commissioner Maureen Ohlhausen and Christopher Wolf, partner at Hogan Lovells LLP and co-chair of the Future of Privacy Forum.

PANEL 3: Big Data and Privacy

PANEL 4: Issues in Data Security Regulation

CONFIRMED PANELISTS (as of April 16, 2014) listed below the fold:

Regulating Data Brokers

by Jeff Sovern

In a column last week, The Wild West of Privacy, Times columnist Joe Nocera called for, among other things, regulating data brokers.  In response, I wrote a letter to the Times, which they ran here.  Here's what I said:

Joe Nocera argues that data brokers should be obliged to tell consumers what information the brokers have collected about them.

To understand why consumers might want that, consider that Acxiom, a company that tells consumers what data it has collected about us, reports incorrectly all of the following: my income; whether I live with children; that I own a truck; that I have bought art, antiques, jewelry, bathroom furnishings, window treatments and golf products; and that I am interested in fine cooking, crafts, collecting antiques and golf. (Acxiom thinks that I’m much more fun than I am.)

It accurately reports my ethnicity, birthday, marital status, political party and lots of other information about me.

I wonder what other companies know about us, how much of it is incorrect, and to whom they provide the information. What consequences flow from the incorrect records? Why should strangers be able to buy private information about us without our knowledge, and what do they do with the information they collect? Laws of the sort Mr. Nocera calls for might help us learn that.

Want to know what Acxiom knows (or thinks it knows) about you? Go here. For readers teaching consumer protection and using our casebook, this might be a useful exercise when you get to chapter five of the book.

Ed Mierzwinski: What Congress Should Do About Data Breaches

Here. A look at the bigger picture, and a lot of sage advice.

Dennis Hirsch Article Proposes Sectoral Global Privacy Rules

Dennis D. Hirsch of Capital has written In Search of the Holy Grail: Achieving Global Privacy Rules Through Sector-Based Codes of Conduct, 74 Ohio St. L.J. (2013). Here is the abstract:

The movement of personal data across national borders is fundamental to the Internet economy. Yet the laws that govern such data flows remain national or, at best, regional. This mismatch weakens privacy protection, increases costs and uncertainty for business, creates tension and political strife between major trading partners such as the US and the EU, and confronts global privacy managers with difficult challenges. These problems have made the harmonization of national and regional privacy laws a very hot topic in privacy law and policy today. Several initiatives have sought to achieve such harmonization, but none has proven satisfactory.

This article proposes a relatively simple and elegant solution: internationally-approved, industry codes of conduct. The European Union and the Asia-Pacific Economic Cooperation (APEC) organization have each established privacy rules for their respective region. The proposed solution would take advantage of these existing arrangements. It would work as follows. An industry sector would draft a privacy code of conduct that fulfilled the core requirements of the EU and APEC regional privacy regimes. It would then submit the same code to the relevant authority in each system. If each approved the terms of the code, then firms that met those terms could feel quite confident that their activities complied with EU and APEC-region legal requirements. The approved code would function as a nearly global set of privacy rules.

The Article provides a fuller exposition of this proposal, situates it in regulatory theory, and explains how it fits with current legal frameworks. It shows that existing privacy law regimes already contain many of the pieces needed to support the proposed approach. It identifies the legal reforms that will be required in order to make this solution work, and so to come closer to that Holy Grail of privacy law: harmonized, global privacy rules.

American Banker: Cordray Loses Cool After House GOP Attacks

by Jeff Sovern

Here (behind a paywall). Cordray was testifying before the House Financial Services Committee and, according to the article, was subject to some attacks that seem absurd, at least to me. Excerpt:

[Rep. Stevan Pearce, R-N.M] suggested that data collection undertaken by the CFPB could be passed onto political campaigns.

"But I will say that the collection of data like you’re collecting has tremendous value in political campaigns and I worry that there might just be someone down the system who might release that information,² Pearce said.

I have not yet listened to this hearing, but the issue of the Bureau's data collection has routinely come up in other hearings, and Cordray has stated more than once that much of the data the Bureau receives about consumer borrowing comes without information identifying the particular consumer.  It's hard to see how information that doesn't identify specific people would be of value in a political campaign.  When consumers complain directly to the Bureau, the Bureau would know who they are--except that's information that consumers decide to provide the Bureau.  Meanwhile, businesses collect plenty of information about consumers they can identify.  I wish Representative Pearce cared more about the information businesses collect, which the businesses can use for their own purposes (and who knows if they sell it to political campaigns?  Is that where Pearce got the idea?), as opposed to the information collected by the Bureau, which is supposed to be used only for the benefit of consumers.

Representative Pearce is also quoted in the article as saying that Cordray is waging war on the poor. Would those be the poor people for whom the Bureaus has secured refunds? Incidentally, according to the Center for Responsive Politics, commercial banks have given more to Pearce's current reelection campaign than all but three other industries and his fourth largest contributor is a bank.