Consumer Law & Policy Blog

Derek Bambauer Paper on Privacy vs. Security

Derek E. Bambauer of Arizona has written Privacy Versus Security, forthcoming in the Journal of Criminal Law and Criminology.  Here is the abstract:

Legal scholarship tends to conflate privacy and security. However, security and privacy can, and should, be treated as distinct concerns. Privacy discourse involves difficult normative decisions about competing claims to legitimate access to, use of, and alteration of information. It is about selecting among different philosophies, and choosing how various rights and entitlements ought to be ordered. Security implements those choices – it intermediates between information and privacy selections. This Article argues separating privacy from security has important practical consequences. Security failings should be penalized more readily, and more heavily, than privacy ones, because there are no competing moral claims to resolve, and because security flaws make all parties worse off. Currently, security flaws are penalized too rarely, and privacy ones too readily. The Article closes with a set of policy questions highlighted by the privacy versus security distinction that deserve further research.

 

 

James Nehf on the Failed Promise of Information Privacy

James P. Nehf of Indiana University has written Open Book: The Failed Promise of Information Privacy in America.  Here's the abstract:

With financial and other personal information about us in countless databases, and with companies such as Facebook and Google collecting data about their users to drive profits and satisfy expectations of shareholders, there is a pervasive concern that we have little control over access to potentially harmful uses of that information. Moreover, many consumers believe that little can be done to address the problem except to give out as little information as possible and try our best to monitor our credit reports and financial accounts in an effort to detect unexpected activity if it occurs. By not enacting strong information privacy laws in the non-governmental sector, the U.S. Congress and the fifty states have effectively defaulted to a market-based model of privacy protection that relies heavily on individual self-policing and market incentives as the primary means of information control. A self-policing privacy protection model could be effective if a market for information privacy were possible — if well informed individuals could shop their privacy preferences effectively. This book-length paper examines the reasons why this is highly unlikely and why privacy laws in the United States (or the lack thereof) will not protect legitimate consumer interests in the years to come. Part 1 shows why information privacy is a social or societal value and not just an individual concern. Part 2 examines in more detail why individualist, market approaches to privacy protection are destined to fail. Part 3 continues this theme and examines research in behavioral sciences about how consumers make decisions in market transactions. Part 4 concludes by critiquing the “new” privacy framework released by the Federal Trade Commission. While the framework contains hopeful rhetoric calling for greater emphasis on societal solutions to privacy concerns, most of the framework continues to rely heavily on individual notice and choice in transactions that involve exchanges of personal information.  

 

 

Industry Opposition to the FTC's Nutrition Facts Privacy Label

by Jeff Sovern

According to an article in Evan Hendricks's Privacy Times from October 24 (I'm behind in my reading), the FTC is working on a standardized privacy label akin to the nutrition facts labeling on food.  The label is to focus on five main items.  Not so readable as a single grade, but it still sounds more readable than what we have now (though I have on my pile of things to get to a study that shows that consumers won't read standardized privacy tables, but maybe this is a different kind of label; as I say, I haven't gotten to that study yet, so I just don't know).  In any event, how does the industry react?  Well, the headline of the Privacy Times story tells it all: "Leibowitz's 'Nutrition Labels' Sparks Pushback from Industry."  And what is the basis of this pushback?  Concern for the consumer.  One big firm lawyer is quoted as saying that she isn't certain that five elements are going to tell consumers any more information than they already have.  Another is concerned that nuances will be lost.  Very thoughtful of them.  But given that it appears that most consumers already don't read privacy policies, could it be that many consumers are not getting any information, much less picking up on nuances?  Could it also be that some businesses benefit when consumers don't read privacy policies because it allows the businesses to do what they want with consumer information--and that businesses that have that freedom don't want to lose it by having consumers understand privacy policies and take them into account in deciding which businesses to patronize?  Might that be a reason for businesses to oppose simpler disclosures--one that businesses dare not acknowledge?

Do Consumers Want a Do-Not-Mail List?

Chris Jay Hoofnagle and Jennifer M. Urban, both of Berkeley Law, and Su Li of Berkely's Center for the Study of Law and Society, have written Privacy and Advertising Mail.  Here's the abstract:

In this paper, we consider why Americans may frame the generation and receipt of unsolicited advertising mail as a privacy violation. We then present data from our nationwide survey showing that a very large majority of Americans, across all ideologies, educational attainment levels, age, and income levels, support the creation of a do-not-mail mechanism similar to the popular Telemarketing Do Not Call Registry. We discuss our results in light of the fact that direct advertising mail now makes up more than half of all mailpieces sent by the United States Postal Service (USPS).

 

 

Calo's Against Notice Skepticism

by Jeff Sovern

I've moved on to the privacy chapter of our casebook, and in that regard I just finished reading M. Ryan Calo's (Calo is at the University of Washington and affilated with Stanford)  intriguing Against Notice Skepticism In Privacy (And Elsewhere), 87 Notre Dame Law Review 1027 (2012).  Before I add my two cents, here's the abstract:

What follows is an exploration of innovative new ways to deliver privacy notice. Unlike traditional notice that relies upon text or symbols to convey information, emerging strategies of “visceral” notice leverage a consumer’s very experience of a product or service to warn or inform. A regulation might require that a cell phone camera make a shutter sound so people know their photo is being taken. Or a law could incentivize websites to be more formal (as opposed to casual) wherever they collect personal information, as formality tends to place people on greater guard about what they disclose. The thesis of this Article is that, for a variety of reasons, experience as a form of privacy disclosure is worthy of further study before we give in to calls to abandon notice as a regulatory strategy in privacy and elsewhere.

Calo is clearly more a fan of notice than outright regulation.  At one point he paraphrases Winston Churchill and writes that “notice is the worst regulatory mechanism, except for all of the alternatives."  Regular readers of this blog know that I am less fond of notice as a way of conveying information to consumers.  Still, notice may yet have a role to play in privacy, in the form of the single letter-grade approach.  As I have blogged about before, restaurant grades have been effective to convey health department assessments to consumers, and have improved the health not only of consumers who pay attention to the grades, but also of those who don't.  Surely it would be possible for some external agency to devise criteria for privacy policies, so that companies that don't use consumer information at all would get an "A", those who use it only internally would get a "B", and so forth.  That way, consumers could continue to forego reading privacy policies, but still know what privacy choices they are making.  And just as restaurateurs strive for better health department grades, to attract the business of those who care about the grades, which helps all consumers, perhaps businesses would strive for better privacy grades.  It seems like such an obvious idea, I wonder if someone has already tried it. 

Calo calls for more research, and I agree.  We need to try different ways of providing notice to see what consumers actually use.  The CFPB is willing to do this with its notices. Perhaps the FTC will follow suit on privacy.  I would love to see one of those Innocentive contests for notices that convey privacy policies to consumers in such a way that consumers will actually use them.

Disclosure vs. Regulation

by Jeff Sovern

Last week I had a very interesting conversation with a Ph.D candidate from the University of Amsterdam, Frederik J. Zuiderveen Borgesius, who is researching privacy regulation and behavioral targeting. He asked me if I could refer him to a book that explores when disclosure is an appropriate response to consumer protection problems as opposed to regulation of conduct, such as a prohibition on troublesome behavior.  I realized that I don't know of such a book, or even an article on the issue--something I had never realized before.  Does anyone out there know of such a work?

What makes this particularly embarrassing for me is that it connects to one of the themes of our casebook. The first two chapters focus on information remedies, including disclosure, while the remaining chapters look at conduct regulation.  We ask students to consider why the law takes one approach for some problems and the other in different contexts.  It seems like a natural thing for consumer protection folks to write about, and yet if any of us have, I don't know about it.

My own view is that since the sixties or so, the law has tried to use disclosure in consumer markets and conduct regulation in non-market matters. For example, Truth in Lending tries to make lending markets work better while Magnuson-Moss tries to fix warranty markets.  But when there is no relevant market--such as when consumers try to get credit reports fixed or debt collectors to back off, Congress relies on regulation, in the form of the Fair Credit Reporting Act and the Fair Debt Collection Practices Act, respectively.  But as behavioral economics has made clearer that consumers do not always act rationally, Congress is moving toward regulation even where markets operate.  That latter point is made by my co-author, Dee Pridgen, in her recent paper. 

And another thought: Mr. Borgesius's primary interest was in disclosure vs. regulation in the privacy context.  It appears that disclosure has not worked very well in privacy, in that consumers seem not to read privacy disclosures.  On the other hand, regulation seems paternalistic and risks regulate something consumers don't want.  What to do?  I wondered whether a middle-ground might work, in which government provides that if businesses want to collect, use, and disclose information about consumers, they should be obliged to give consumers something in return: money, discounts, or something else. Government could establish a floor for what that something could be, and companies and consumers would be free to contract for more than the floor if they wanted.  That way, consumers could continue paying little attention to their privacy, but would still receive something for yielding it. It's just a half-baked idea, and may not taste so good upon more reflection, but maybe it is worth contemplating. 

All of this is another lesson, for me at least, that you can think about something for a quarter-century and still miss the basics. I think we will be hearing more from Mr. Borgesius.

 

Mark Budnitz on Mobile Financial Services

Mark Elliott Budnitz of Georgia State has written Mobile Financial Services: The Need for a
Comprehensive Consumer Protection Law, 27 Banking & Finance Law Review (2012).  Here's the abstract:

The article first describes mobile financial services for consumers and the types of companies participating in the provision of those services. Anticipated consumer problems are explored, including: security, privacy, unauthorized transfers, error resolution, viruses, system breakdown, consumer mistake, and the need for documentation and a history of transactions. Public policy and government
regulatory issues are examined. Applicable U.S. state and federal laws are reviewed; their gaps and inadequacies are identified. The article concludes with a description of a proposed Model Law that provides satisfactory consumer protection.

 

 

Times Magazine Asks Who Do Online Advertisers Think You Are?

by Jeff Sovern

Here.  The piece is by GW's Jeffrey Rosen and explores how online marketers gather and use information about consumers.  Rosen describes how he visited different web sites using two different browsers, as a result of which one online marketer, BlueKai, created two inconsistent personae for him.  BlueKai, incidentally, allows consumers to see what information it has collected on them here.  But what about the marketers who don't give consumers such a right?  Shouldn't Congress do for online marketing what it has done for credit reports in the FCRA--namely, give consumers the right to find out what is reported about them and correct errors?  Certainly the errors in Rosen's online avatars suggests that such errors are common. 

And then there's the discrimination risk.  Such finely-targeted advertising raises the possibility that advertisers are treating different groups differently. Advertising presents opportunities. If some ethnic groups, for example, see some types of ads that others don't, does that create issues of discrimination?  What if only whites see ads for Maui vacations, and a different ethnic group, say, sees ads for vacations in Atlanta?  Congress enacted the Home Mortgage Disclosure Act to enable observers to determine if mortgage lenders are treating different groups differently.  Perhaps we need something similar to see if advertisers are offering the same opportunities to different groups.

Solove Paper on Privacy Self-Management vs. Paternalism

Daniel J. Solove of GW has written Privacy Self-Management and the Consent Paradox, 126 Harvard Law Review (2013).  Here's the abstract:

The current regulatory approach for protecting privacy involves what I refer to as the “privacy self-management model” – the law provides people with a set of rights to enable them to decide for themselves about how to weigh the costs and benefits of the collection, use, or disclosure of their information. People’s consent legitimizes nearly any form of collection, use, and disclosure of personal data.

Although the privacy self-management model is certainly a laudable and necessary component of any regulatory regime, I contend in this essay that it is being asked to do work beyond its capabilities. Privacy self-management does not provide meaningful control. Empirical and social science research has undermined key assumptions about how people make decisions regarding their data, assumptions that underpin and legitimize the privacy self-management model.

Moreover, even if individuals were well-informed and rational, they still cannot appropriately self-manage their privacy due to a series of problems. For example, the problem of scale involves the fact that there are too many companies collecting and using data for a person to be able to manage privacy with every one. The problem of aggregation involves the fact that privacy harms often consist of an aggregation of disparate pieces of data, and there is no way for people to assess whether revealing any piece of information will sometime later on, when combined with other data, reveal something sensitive or cause harm. The essay also discusses a number of other problems.

In order to advance, privacy law and policy must confront a complex and confounding paradox with consent. Consent to collection, use, and disclosure of personal data is often not meaningful, and the most apparent solution – paternalistic measures – even more directly denies people the freedom to make consensual choices about their data. No matter which direction the law takes, consent will be limited, and a way out of this dilemma remains elusive.

 

 

Petition to Bar Caller ID Spoofing by Telemarketers

Here.  Nice to see consumer law getting attention in petitions.