Consumer Law & Policy Blog

Solove & Hartzog Paper on the FTC's Common Law of Privacy

Daniel J. Solove of George Washington and Woodrow Hartzog of Samford's Cumberland School of Law and Stanford's Center for Internet and Society have written The FTC and the New Common Law of Privacy, forthcoming in the Columbia Law Review. Here's the abstract:

One of the great ironies about information privacy law is that the primary regulation of privacy in the United States has barely been studied in a scholarly way.  Since the late 1990s, the Federal Trade Commission (FTC) has been enforcing companies’ privacy policies through its authority to police unfair and deceptive trade practices.  Despite more than fifteen years of FTC enforcement, there is no meaningful body of judicial decisions to show for it.  The cases have nearly all resulted in settlement agreements.  Nevertheless, companies look to these agreements to guide their privacy practices. Thus, in practice, FTC privacy jurisprudence has become the broadest and most influential regulating force on information privacy in the United States – more so than nearly any privacy statute and any common law tort.   

In this article, we contend that the FTC’s privacy jurisprudence is the functional equivalent to a body of common law, and we examine it as such. We explore how and why the FTC, and not contract law, came to dominate the enforcement of privacy policies.  A common view of the FTC’s privacy jurisprudence is that it is thin, merely focusing on enforcing privacy promises.  In contrast, a deeper look at the principles that emerge from FTC privacy “common law” demonstrates that the FTC’s privacy jurisprudence is quite thick.   The FTC has codified certain norms and best practices and has developed some baseline privacy protections. Standards have become so specific they resemble rules.  We contend that the foundations exist to develop this “common law” into a robust privacy regulatory regime, one that focuses on consumer expectations of privacy, that extends far beyond privacy policies, and that involves a full suite of substantive rules that exist independently from a company’s privacy representations.

Calo Paper on Digital Market Manipulation

M. Ryan Calo of Washington has written Digital Market Manipulation.  Here's the abstract:

Jon Hanson and Douglas Kysar coined the term “market manipulation” in 1999 to describe how companies exploit the cognitive limitations of consumers.  Everything costs $9.99 because consumers see the price as closer to $9 than $10.  Although widely cited by academics, the concept of market manipulation has had only a modest impact on consumer protection law.

This Article demonstrates that the concept of market manipulation is descriptively and theoretically incomplete, and updates the framework for the realities of a marketplace that is mediated by technology.  Today’s firms fastidiously study consumers and, increasingly, personalize every aspect of their experience.  They can also reach consumers anytime and anywhere, rather than waiting for the consumer to approach the marketplace.  These and related trends mean that firms can not only take advantage of a general understanding of cognitive limitations, but can uncover and even trigger consumer frailty at an individual level.

A new theory of digital market manipulation reveals the limits of consumer protection law and exposes concrete economic and privacy harms that regulators will be hard-pressed to ignore.  This Article thus both meaningfully advances the behavioral law and economics literature and harnesses that literature to explore and address an impending sea change in the way firms use data to persuade.

Want to Know What a Data Broker Knows About You?

by Jeff Sovern

Acxiom is about to let you find out some of what it knows about you, as this Times story by Natasha Singer reports. Other data brokers should emulate Acxiom and enable consumers to learn what they know about them  And if they refuse to do so, Congress should pass legislation requiring them to tell us what they know about us.  Interestingly, the report indicates that Acxiom's file on its chief executive includes several errors, including the number of children he has, whether he has a mortgage, and his ethnic background. 

Paper on Behavioral Economics and Consent to Tracking Internet Use

Frederik J. Zuiderveen Borgesius of the Institute for Information Law (University of Amsterdam) has written Consent to Behavioural Targeting in European Law - What are the Policy Implications of Insights from Behavioural Economics?  Here is the abstract:

Behavioural targeting is the monitoring of people’s online behaviour to target advertisements to specific individuals. European law requires companies to obtain informed consent of the internet user before they use tracking technologies for behavioural targeting. Other jurisdictions also emphasise the importance of choice for internet users. But many people click ‘I agree’ to any statement that is presented to them. This paper discusses insights from behavioural economics to analyse problems with informed consent to behavioural targeting from a regulatory perspective. What are the policy implications of insights from behavioural economics in the context of behavioural targeting? Two approaches to improve regulation are explored. The first focuses on empowering the individual, for example by making informed consent more meaningful. The second approach focuses on protecting the individual. If aiming to empower people is not the right tactic to protect privacy, maybe specific prohibitions should be introduced.

World Wide Web Consortium Tracking Protection Working Group Text

Here, along with an explanatory memo.  We had previously blogged about this Do Not Track effort.  Here's the abstract:

 

This document contains the decision of the Tracking Protection Working Group of the World Wide Web Consortium, as issued in July, 2013 by the co-chairs, Peter Swire and Matthias Schunter, as well as a detailed Explanatory Memorandum for that decision.  In response to 27 comments and a large previous public record, the decision addresses the question of what base text to use for the Do Not Track Compliance Specification, and concludes that the draft put before the group in June (“June Draft”) will be the base text rather than the proposal submitted by the Digital Advertising Alliance and other group members (“DAA Proposal”).  Part I of the Explanatory Memorandum provides history and background of the process to date, with emphasis on the issues that differ between the two texts.  Part II is called “Do Not Target,” and discussing the definition of “tracking,” the means of user choice concerning targeted online advertising, and related topics.  Part III is called “Do Not Collect,” and addresses issues including minimization of data collection and the use of unique identifiers.  Part IV is called “Data Hygiene.”  It examines a range of controls that a company may apply to de-identify data and reduce the risk that data is revealed without authorization.  Parts II to IV include discussion of many of the comments submitted under the July 12, 2013 deadline concerning which base text to adopt.  Part V addresses additional comments submitted, responding especially to comments that supported the DAA Proposal to become the base text.

Things Happening in Privacy Too

by Jeff Sovern

Last week, we linked to Ed Mierzwinski's post about complaints about CFPB information-gathering processes.  There's more.  Over at the Taking Charge blog, Fred Williams has a post on the CFPB data collection, Privacy Agencies Say Don't Worry: Consumer Bureau is No Spy.  Here's an excerpt:

"I am not aware of any privacy or consumer group that has raised these issues," said David Jacobs, consumer protection counsel at the Electronic Privacy Information Center. EPIC has taken on the NSA in court over its telephone record collection, as part of its focus on government intrusions on privacy.

"If Congress was truly concerned with consumer privacy, they should pass comprehensive consumer privacy legislation," Jacobs added.

 

Onto real, rather than manufactured, privacy topics.  On Monday, the Times ran a story, Attention, Shoppers: Store Is Tracking Your Cell about how stores use signals from phones to determine how much time particular shoppers spend at various points around the stores, how often the shopper returns to the store, and other things. Interestingly, when Nordstrom posted a sign that it was tracking customers in this way, customer complaints caused it to back down. But no law I'm aware of obliges companies to let their customers know they are engaging in such practices, which makes me wonder how many stores do this without notfiying their customers. It also suggests that legislators should consider enacting such a disclosure law.

And another story: According to yesterday's Times, ‘Do Not Track’ Rules Come a Step Closer to an Agreement.  Here's an excerpt:

Web users should be able to tell advertising networks not to show them targeted advertisements based on their browsing activities — and those companies should comply. That is the verdict of the leaders of a working group that has been arguing for almost two years over how to establish a uniform Do Not Track standard for the Internet.

 

Ed Mierzwinski: Banks, Not CFPB, Spy on Consumers

Ed's excellent post is here.  Those who purport to be so concerned about the privacy of bank customers should seek to amend the Gramm-Leach-Bliley privacy provisions to bar banks from selling consumer information unless their customers affirmatively opt-in to the sale of that information. But that would mean supporting consumer protection, precisely what the CFPB opponents do not want. 

Privacy Documentary Due Out This Summer

 

Schwartz & Solove: Reconciling Personal Information in the United States and European Union

Paul M. Schwartz of Berkeley and Daniel J. Solove of George Washington have written Reconciling Personal Information in the United States and European Union. Herer's the abstract:

US and EU privacy law diverge greatly. At the foundational level, they diverge in their underlying philosophy: In the US, privacy law focuses on redressing consumer harm and balancing privacy with efficient commercial transactions. In the EU, privacy is hailed as a fundamental right that trumps other interests. Even at the threshold level - determining what information is covered by the regulation - the US and EU differ significantly. The existence of personal information - commonly referred to as “personally identifiable information” (PII) - is the trigger for when privacy laws apply. PII is defined quite differently in US and EU privacy law. The US approach involves multiple and inconsistent definitions of PII that are often quite narrow. The EU approach defines PII to encompass all information identifiable to a person, a definition that can be quite broad and vague. This divergence is so basic that it significantly impedes international data flow. A way to bridge the divergence remains elusive, and many commentators have generally viewed the differences between US and EU privacy law as impossible to reconcile.

In this essay, we argue that there is a way to bridge these differences at least with PII. We contend that a tiered approach to the concept of PII (which we call “PII 2.0”) represents a superior way of defining PII than the current approaches in the US and EU. We also argue that PII 2.0 is consistent with the different underlying philosophies of the US and EU privacy law regimes. Under PII 2.0, all of the Fair Information Practices (FIPs) should apply when data refers to an identified person or where these is a significant risk of the data being identified. Only some of the FIPs should apply when data is merely identifiable, and no FIPs should apply when there is a minimal risk that the data is identifiable. We demonstrate how PII 2.0 advances the goals of both US and EU privacy law and is consistent with their different underlying philosophies. PII 2.0 thus begins the process of bridging the current gap between US and EU privacy law.

Times Article: If My Data Is an Open Book, Why Can’t I Read It?

by Jeff Sovern

Last week, the Times ran an article about companies that sell consumer data to businesses but won't provide it to the consumers involved.  Despite the headline, reprinted above, I thought the article didn't really explain why companies won't provide the information to consumers.  So I wrote a letter with my explanation, which the Times has now posted on its website.  My letter is accompanied by another which offers an interesting take on this issue.