Consumer Law & Policy Blog

Call for Papers: Legal and Ethical Issues in Predictive Data (Including Consumer Protection Issues)

RESEARCH COLLOQUIUM: CALL FOR PAPERS

LEGAL AND ETHICAL ISSUES IN PREDICTIVE DATA ANALYTICS

June 19 & 20, 2014

Blacksburg, Va.

Abstract Submission Deadline: March 3, 2014

A research colloquium, “Legal and Ethical Issues in Predictive Data Analytics,” hosted by Professor Janine Hiller of Virginia Tech and co-organized by Professor Tonia Hap Murphy of the University of Notre Dame, is sponsored by the Center for Business Intelligence and Analytics in the Pamplin College of Business, Virginia Tech. Topics include privacy and data security and consumer protection: price discrimination, targeting.

Up to four invitations for research presentation slots will be extended based on this call for papers. In order to receive consideration, researchers are invited to submit an abstract by March 3, 2014.

Continued below the fold.

Paper Explores How the Amount of Privacy Affects Industry Profits, Consumer Welfare, and Total Welfare

Oz Shy of the Federal Reserve Bank of Boston and Rune Stenbacka of the Swedish School of Economics and Business Administration have written Customer Privacy and Competition.  Here is the abstract:

We analyze how different degrees of privacy protection affect industry profits, consumer welfare and total  welfare. Firms earn higher profits under weak privacy protection compared with strong or no privacy protection. Therefore, the relationship between the degree of privacy protection and equilibrium profits is not monotonic. Consumers monotonically benefit from an increase in the degree of privacy protection. Finally, total welfare  monotonically increases with the degree of privacy protection.

Paper Explores How Much Consumers Value Privacy

Scott  Savage

and

Donald M. Waldman

, both of the University of Colorado at Boulder - Department of Economics, have written The Value of Online Privacy. Here is the abstract:

We estimate the value of online privacy with a differentiated products model of the demand for Smartphone apps. We study the apps market because it is typically necessary for the consumer to relinquish some personal information through “privacy permissions” to obtain the app and its benefits. Results show that the representative consumer is willing to make a one-time payment for each app of $2.28 to conceal their browser history, $4.05 to conceal their list of contacts, $1.19 to conceal their location, $1.75 to conceal their phone’s identification number, and $3.58 to conceal the contents of their text messages. The consumer is also willing to pay $2.12 to eliminate advertising. Valuations for concealing contact lists and text messages for “more experienced” consumers are also larger than those for “less experienced” consumers. Given the typical app in the marketplace has advertising, requires the consumer to reveal their location and their phone’s identification number, the benefit from consuming this app must be at least $5.06.
 

 

Jeff Gelles Column: A Victory in the Fight Against Robocalls

Here.  An interesting report on a third circuit case on whether consumers can revoke their consent to receive automated calls.  The case arose in the debt collection context and given the steep penalties under the Telephone Consumer Protection Act--$500 per call and $1500 for willful violations--could lead to a lot of litigation.

Paper on the Telephone Consumer Protection Act and Changing Technology

Daniel B. Heidtke, Jessica Stewart and Spencer Weber Waller, all of Loyola of Chicago's School of Law and its Institute for Consumer Antitrust Studies have written The Telephone Consumer Protection Act of 1991: Adapting Consumer Protection to Changing Technology.  Here is the abstract:

In the late 1980’s, spurred on by advances in technology, the telemarketing industry began aggressively seeking out consumers in the hundreds of thousands.  Companies began using machines that automatically dialed consumers and delivered prerecorded messages (“robocalls”).  Marketers also took advantage of another new and increasingly available piece of technology known as the facsimile machine (“fax machine”).  With the fax machine, marketers could now send tens of thousands of unsolicited advertisements (“junk fax”) each week to consumers across the nation.

Consumers and businesses became overwhelmed with unsolicited telemarketing calls and advertisements. Calls for action grew louder.  States enacted laws, but could not reach the interstate practices of telemarketers. After reviewing and debating ten different pieces of legislation, Congress enacted the Telephone Consumer Protection Act of 1991 (“TCPA”).

The primary focus of this report is the Telephone Consumer Protection Act of 1991.  The TCPA was born out of abusive telemarketing practices, made more intrusive by advances in technology.  Originally, the TCPA imposed restrictions on the use of telephones for unsolicited advertising by telephone and fax.   The TCPA has since been expanded and adapted by administrative rule, judicial interpretation, and congressional amendment.

The original purpose of the TCPA was to regulate certain uses of technology that are abusive, invasive, and potentially dangerous. The TCPA effectively regulates these abuses by prohibiting certain technologies altogether, rather than focusing specifically on the content of the messages being delivered. The expansion of the TCPA into areas outside of telemarketing and new technologies over the years is consistent with its original purpose.

Private parties are largely responsible for the enforcement of the TCPA, and have done so primarily through the class action mechanism. While this has drawn some criticism because of the provision of high statutory damages, the threat of class action has provided a significant deterrent to violators.  Historically the government has only enforced the TCPA to a limited extent, yet the statute has been relatively successful in reducing the conduct it was enacted to regulate.

Technology is again rapidly changing and a number of trends are emerging. The number of entities that are operating in intentional disregard of the TCPA are growing, and they are using technology to help evade detection and enforcement. According to the FTC, about 59% of phone spam cannot be traced or blocked because the phone calls are routed through “a web of automatic dialers, caller ID spoofing and voice-over-Internet protocols.”  Although the traditional scheme of TCPA enforcement, with its strong reliance on the private right of action, has been successful in the past, two main issues are becoming clear. The private right of action is limited in both incentivizing lawsuits against, and deterring the actions of, intentional violators; and FCC enforcement is limited by its slow process.

In order for the TCPA to stay relevant over twenty years later, certain modifications and improvements can be made. We recommend improving government enforcement efforts and increasing the uniformity of interpreting the statute. The FTC's recent contest for a technical solution to robocalls is commendable, and should be followed with respect to other types of media currently exposed to unsolicited commercial messages such as text messages and e-mail.

In order for the TCPA to continue to remain relevant going forward, this report recommends:

1. Increase government enforcement of the TCPA by providing State Attorney Generals with a larger incentive to bring TCPA cases, and empowering the FTC to bring suit under the TCPA;

2. Increase uniformity of application of the TCPA by encouraging more frequent and quicker FCC rule making procedures;

3. Continue to protect cell phones by requiring prior express consent for any communication (call or text) made to a cell phone;

4. Place a time limit on the Junk Fax Established Business Relationship;

5. Create incentives for fax broadcasting companies to determine whether the faxes they are sending on behalf of clients are in violation of the TCPA;

6. Rebuff efforts to remove or otherwise modify the private right of action; and

7. Place additional restrictions on entities that enable caller ID manipulation.

Richards on the Constitutionality of Data Privacy Law

Neil M. Richards of Wash U. has written Why Data Privacy Law Is (Mostly) Constitutional, forthcoming in his book, Intellectual Privacy, Oxford University Press (2014).  Here's the abstract:

This essay argues that privacy critics arguing that most privacy rules create constitutional problems overstate their case.  Since the New Deal, American law has rested on the wise judgment that, by and large, commercial regulation should be made on the basis of economic and social policy rather than blunt constitutional rules.  This has become one of the basic principles of American Constitutional law.   Although some observers have suggested that the Supreme Court’s recent decision in Sorrell v. IMS Health (2011) changes this state of affairs, such readings are incorrect.  Sorrell involved a challenge to a poorly-drafted Vermont law that discriminated on both content and viewpoint.  Such a law would have been unconstitutional if it had regulated even unprotected speech.  As the Sorrell Court made clear, the real problem with the Vermont law at issue was that it didn’t regulate enough, unlike the “more coherent policy” of the undoubtedly constitutional federal Health Insurance Portability and Accountability Act of 1996.

Data privacy law should thus rarely be thought as implicating serious constitutional difficulties, which is a good thing.  As we move into the digital age, in which more and more of our society is affected or constituted by data flows, we face a similar threat.  If “data” were somehow “speech,” virtually every economic law would become clouded by constitutional doubt.  Economic or commercial policy affecting data flows (which is to say all economic or social policy) would become almost impossible.  This might be a valid policy choice, but it is not one that the First Amendment commands.  Any radical suggestions to the contrary are unsupported by our Constitutional law.  In a democratic society, the basic contours of information policy must ultimately be up to the people and their policymaking representatives, and not to unelected judges.  We should decide policy on that basis, rather than on odd readings of the First Amendment.

Fairfield Paper on Do-Not-Track

Joshua Fairfield of Washington and Lee University has written Do-Not-Track as Default, 11 Northwestern Journal of Technology and intellectual Property (2013). Here's the abstract:

Do-Not-Track is a developing online legal and technological standard that permits consumers to express their desire not to be tracked by online advertisers. Do-Not-Track has the ability to change the relationship between consumers and advertisers in the information market. Everything will depend on implementation. The most effective way to allow users to achieve their privacy preferences is to implement Do-Not-Track as a default feature.

The World Wide Web Consortium’s (W3C) standard setting body for Do-Not-Track has, however, endorsed a corrosive standard in its Tracking Preferences Expression (TPE) draft. This standard requires consumers to set their privacy preference by hand. This "bespoke" standard follows in a long line of privacy preference controls that have been neutered by increased transaction costs.
This article argues that privacy controls must be firmly in consumers’ hands, and must be automated and integrated to be effective. If corporations can deprive consumers of privacy through automated End User License Agreements or Terms of Service, while consumers are constrained to set their privacy preferences by hand, consumers cannot win. Worse, the TPE bespoke standard is anticompetitive. Already, browsers like Microsoft’s Internet Explorer 10 (IE10) will launch with default Do-Not-Track enabled. But the TPE bespoke standard offers advertisers a free pass to ignore the Do-Not-Track flags that will be set by IE10 and prohibits other browsers from offering automatic, integrated, and therefore useable privacy features.

Strandburg Paper on Online Privacy's Market Failure

Katherine J. Strandburg of NYU has written Free Fall:  the Online Market's Consumer Preference Disconnect, University of Chicago Law Forum (2013).  Here's the abstract:

Do Internet users “pay” for online products and services with personal data? The common analogy between online data collection for behaviorally targeted advertising and payment for purchases is seriously misleading. There is no functioning market based on exchanges of personal information for access to online products and services. In a functioning market, payment of a given price signals consumer demand for particular goods and services, transmitting consumer preferences to producers. Data collection serves as “payment” in that critical sense only if its transfer from users to collectors adequately signals user preferences for online goods and services.  It does not.  Indeed, for reasons explored in this article, the behavioral advertising business model leads to a failed online market and erects barriers to entry for no-data-collection alternatives.  The market failure is due in part to the intertwined nature of personal information and involves collective action problems that cannot be solved by consent-based approaches to single transactions.  Those collective action problems, in turn, erect barriers to entry for online businesses employing paid or contextual advertising business models. As a result of these factors, the online market is likely to be stuck in a failed state in which products and services are tailored to advertiser preferences for data extraction, rather than to consumer preferences.

Sovern Paper: Cost-Benefit Analysis and Consumer Protection

by Jeff Sovern

I've posted a paper on SSRN, Can Cost-Benefit Analysis Help Consumer Protection Laws? Or at Least Benefit Analysis?, forthcoming in the University of California-Irvine Law Review.  Here's the abstract:

Cost-benefit analysis is often troubling to consumer advocates. But this article argues that in some circumstances it may help consumers. The article gives several examples of supposed consumer protections that have protected consumers poorly, if at all. It also argues that before adopting consumer protections, lawmakers should first attempt to determine whether the protections will work. The article suggests that because lawmakers are unlikely to adopt multiple solutions to the same problem, one cost of ineffective consumer protections is a kind of opportunity cost, in that ineffective consumer protections might appear to make unnecessary adoption of effective ones. Ironically, such an opportunity cost is unlikely to be taken account of in cost-benefit analysis. Among the protections that especially risk failing to benefit consumers are laws that require consumers to perform certain tasks, such as disclosure laws that presuppose consumers will pay attention to and act on the disclosures; if consumers instead generally ignore the disclosures, the consumer protection will be largely illusory. Accordingly, before adopting measures that depend on consumers to do something, lawmakers should try to verify that consumers will in fact undertake those actions. The article also makes some suggestions for ascertaining whether consumer protections will work—i.e., benefit consumers--and concludes with a brief critique of the proposed Independent Agency Regulatory Analysis Act.

A Pair of Privacy Papers: Big Data

Michael Birnhack of Tel Aviv University has written S-M-L-XL Data:  Big Data as a New Informational Privacy Paradigm. Here's the abstract:

Can informational privacy law survive Big Data? A few scholars have pointed to the inadequacy of the current legal framework to Big Data, especially the collapse of notice and consent, the principles of data minimization and data specification. These are first steps, but more is needed. To better understand the informational privacy implications of Big Data, this short comment locates Big Data as the newest point on a continuum of Small-Medium-Large-Extra Large data situations. This path indicates that Big Data is not just "more of the same", but a new informational paradigm.

One suggestion is to conceptualize Big Data in terms of property: Perhaps data subjects should have a property right in their data, so that when others process it, subjects can share the wealth. However, privacy has a complex relationship with property. Lawrence Lessig's 1999 proposal to propertize personal data, was criticized: instead of more protection, said the critics, there will be more commodification. Does Big Data render property once again a viable option to save our privacy? I begin a query about the property/privacy relationship, by juxtaposing informational privacy with property, real and intangible, namely copyright. This path indicates that current property law is unfit to address Big Data.

Meanwhile, OMER TENE of the College of Management - School of Law, Israel and JULES POLONETSKY, of the Future of Privacy Forum have co-authored Judged by the Tin Man: Individual Rights in the Age of Big Data, forthcoming in the Journal of Telecommunications and High Technology Law.  Here's their abstract:

Big data, the enhanced ability to collect, store and analyze previously unimaginable quantities of data in tremendous speed and with negligible costs, delivers immense benefits in marketing efficiency, healthcare, environmental protection, national security and more.  While some privacy advocates may dispute the merits of sophisticated behavioral marketing practices or debate the usefulness of certain data sets to efforts to identify potential terrorists, few remain indifferent to the transformative value of big data analysis for government, science and society at large.  At the same time, even big data evangelists should recognize the potentially ominous social ramifications of a surveillance society governed by heartless algorithmic machines. 

In this essay, we present some of the privacy and non-privacy risks of big data as well as directions for potential solutions. In a previous paper, we argued that the central tenets of the current privacy framework, the principles of data minimization and purpose limitation, are severely strained by the big data technological and business reality.  Here, we assess some of the other problems raised by pervasive big data analysis. In their book, “A Legal Theory for Autonomous Artificial Agents,” Samir Chopra and Larry White note that “as we increasingly interact with these artificial agents in unsupervised settings, with no human mediators, their seeming autonomy and increasingly sophisticated functionality and behavior, raises legal and philosophical questions.”  In this article we argue that the focus on the machine is a distraction from the debate surrounding data driven ethical dilemmas, such as privacy, fairness and discrimination. The machine may exacerbate, enable, or simply draw attention to the ethical challenges, but it is humans who must be held accountable. Instead of vilifying machine-based data analysis and imposing heavy-handed regulation, which in the process will undoubtedly curtail highly beneficial activities, policymakers should seek to devise agreed-upon guidelines for ethical data analysis and profiling. Such guidelines would address the use of legal and technical mechanisms to obfuscate data; criteria for calling out unethical, if not illegal, behavior; categories of privacy and non-privacy harms; and strategies for empowering individuals through access to data in intelligible form.