Consumer Law & Policy Blog

Federal Reserve Paper on Industry Reaction to Data Breaches

Julia S. Cheney, Robert M. Hunt, Katy Jacob, Richard D. Porter and Bruce J. Summers, all of the  Federal Reserve, have written The Efficiency and Integrity of Payment Card Systems: Industry Views on the Risks Posed by Data Breaches.  Here is the abstract:

Consumer confidence in payment card systems has been built up over many decades. Cardholders expect to use their cards to execute payment instructions in a reliable and timely manner. Data breaches that degrade the perceived safety and reliability of payment cards may weaken consumer confidence in those systems and potentially cause cardholders to shift to other, and perhaps less efficient, forms of payment. A sizable shift away from payment cards — induced by the consequences of one or more data breaches is unlikely. Even so, the probability of such an outcome is uncertain. In other words, this could be an example of “tail risk” for payment card systems. The authors informally interviewed a number of market participants and several experts to better understand the risks presented by data breaches, the efforts to protect payment card systems against data breaches, and areas where more might be done to secure these systems. In particular, the authors investigated whether existing levels of investment,
coordination, information sharing, and management of incentives in securing payment card systems by firms and organizations in the private and public sectors are adequate to confront the threats arising from modern data breaches. The lessons learned from these conversations are described in this paper. These insights may also be helpful in considering the risks that data breaches may broadly pose to retail payments in the United States.

 

 

Papers on Privacy

Ira Rubinstein of NYU's Information Law Institut has written Big Data: The End of Privacy or a New Beginning?  Here's the abstract:

“Big data” refers to novel ways in which organizations, including government and businesses, combine diverse digital data sets and then use statistics and other data mining techniques to extract from them both hidden information and surprising correlations. While big data promises significant economic and social benefits, it also raises serious privacy concerns. In particular, big data challenges the Fair Information Practices (FIPs) as embodied in various privacy laws including the EU Data Protection Directive. This past January, the European Commission released a proposal to reform and replace the Directive by adopting a new Regulation. In this paper, I argue that this Regulation relies too heavily on the discredited informed choice model, and therefore fails to fully engage with the coming big data tsunami. My contention is that when this advancing wave arrives, it will so overwhelm the core privacy principles of informed choice and data minimization on which the Directive rests that reform efforts alone will prove inadequate. Rather, an adequate response must combine legal reform with encouragement of new business models premised on consumer empowerment and supported by a personal data ecosystem. This new business model is important for two reasons: first, existing business models have proven time and again that privacy regulation is no match for them. Businesses inevitably collect and use more and more personal data, and while consumers realize many benefits in exchange, there is little doubt that businesses, not consumers, control the market in personal data with their own interests in mind. Second, a new business model, which I describe in this paper, promises to stand processing of personal data on its head by shifting control over both the collection and use of data from firms to individuals. This “control shift” — and this alone — stands a chance of making the FIPs efficacious by giving individuals the capacity to benefit from big data and hence the motivation to learn about and control how their data is collected and used, while also enabling businesses to profit from a new breed of services that are both data-intensive and imbued with privacy values.

Meanwhile, Chris Jay Hoofnagle and of Jennifer M. Urban, both of  Berkeley, and Su Li of Berkely's Center for the Study of Law and Society have produced Privacy and Modern Advertising: Most US Internet Users Want 'Do Not Track' to Stop Collection of Data about their Online Activities for the 2012 Amsterdam Privacy Conference. Here's the abstract:

Most Americans have not heard of 'Do Not Track,' a proposal to allow Internet users to exercise more control over online advertising. However, when probed, most prefer that Do Not Track block advertisers from collecting data about their online activities. This is a much more privacy-protective approach for Do Not Track than what has been proposed by the advertising industry.

In previous studies, we have found that Americans think they are protected by strong online privacy laws. Here, we probed beliefs about tracking on medical websites and 'free' websites, with most not able to answer true/false questions correctly about tracking. This result brings into question notice-and-choice models that depend on consumer understanding of the terms for their legitimacy.

We also probed Internet users' attitudes towards advertising. Most Internet users say that they do not find utility in online advertising, with half claiming that they never click on ads.

Advertisers and consumers are at an impasse on privacy. Advertisers seem to be seeking a kind of total information awareness for behavioral advertising, and have proposed self-regulatory guidelines with little bite. At the same time, both our survey evidence and media reports show consumer opposition to tracking.

Do Not Track has emerged from the current skirmish between consumers and advertisers, but it is a relatively modest intervention that does little to shift the underlying incentives that have driven increasing tracking and aggregation of information about consumers. It is foreseeable that regardless of the form Do Not Track takes, websites will simply require consumers to disable it in order to access content. A fundamental change in incentives may be necessary to relieve this impasse and find an approach for advertising that is not so dependent upon third-party tracking and aggregation of information, both online and off.

 

Are Angry Birds Spying on You?

by Jeff Sovern

The Times reports that many phone apps, including the Angry Birds game (and the flashlight apps that many who lose power because of the storm on the East Coast today may use), spy on their users--and usually without the users' knowledge.  Sometimes they gather information from contact lists and even from photos. 

How should the law respond to this?  Is disclosure enough?  But will consumers read the disclosures?  More and more evidence suggests they won't.  I wonder if a prominent disclosure would work--rather than simply burying it in a EULA--or a letter grade that told consumers how protective of their privacy the app is.

Amitai Etzioni Paper on Privacy Merchants

Amitai Etzioni has written The Privacy Merchants: What is to Be Done?  Here is the abstract:

Rights have been long understood, first and foremost, as protection of the private from the public, the individual from the State. True, we also recognize positive rights (such as socioeconomic rights) and the government’s duty to protect citizens from violations of rights by other actors besides the State. However, when violations of privacy are discussed, the first violator that typically comes to mind is “Big Brother” — that is, the State. This Article focuses on the growing threat to privacy from private actors, specifically profit-making corporations. It briefly outlines a range of options aimed at protecting individual privacy against encroachment by private actors, and it evaluates them within the prevailing normative, legal, and political context in the United States.

Will Technology Make "Do Not Track" Laws Unnnecessary?

Sunday's Times reported that the next version of Microsoft's Internet Explorer will include a "Do Not Track" privacy setting as a default. Consumers installing the browser will be presented with the option of switching from the default to permit tracking.  Excerpts:

But the specter of people opting out of tracking en masse presents a serious risk for marketers.

Consumer data, marketers say, is the fuel that powers the Internet, driving ads that support free content and e-mail services, search engines and social networks. If millions of consumers opted out of behavior-based advertising, industry representatives argue, many ad-sponsored sites could shut down or put up pay walls for people who elect not to see the ads. * * *

But Jonathan Mayer, a graduate student in computer science at Stanford who has studied online tracking, says there is cause for deeper concern. For him, the issue is not behavior-based ads, but the data-mining necessary to produce them.

For instance, Mr. Mayer says, consumers may not be aware that when they visit a site, dozens of entities, like analytics companies and data aggregators, may be operating on that page, collecting online information about them, and amassing those details for advertising purposes. Moreover, he says, those entities could potentially have access to screen names or e-mail addresses that might be used to re-identify people.

Paper on Behavioral Advertising

Chris Jay Hoofnagle of Berkeley, Ashkan Soltani of Berkeley's School of Information, Nathan Good of Good Research, Dietrich James Wambach, a student at Wyoming, and Mika Ayenson of the Worcester Polytechnic Institute have written Behavioral Advertising: The Offer You Cannot Refuse, 6 Harvard Law & Policy Review 273 (2012).  Here's the abstract:

At UC Berkeley, we are informing political debates surrounding online privacy through empirical study of website behaviors. In 2009 and 2011, we surveyed top websites to determine how they were tracking consumers. We found that advertisers were using persistent tracking technologies that were relatively unknown to consumers. Two years later, we found that the number of tracking cookies expanded dramatically and that advertisers had developed new, previously unobserved tracking mechanisms that users cannot avoid even with the strongest privacy settings.

These empirical observations are valuable for the political debate surrounding online privacy because they inform the framing and assumptions surrounding the merits of privacy law.

Our work demonstrates that advertisers use new, relatively unknown technologies to track people, specifically because consumers have not heard of these techniques. Furthermore, these technologies obviate choice mechanisms that consumers exercise. We argue that the combination of disguised tracking technologies, choice-invalidating techniques, and models to trick the consumers into revealing data suggests that advertisers do not see individuals as autonomous beings. Once conceived of as objects, preferences no longer matter and can be routed around with tricks and technology.

In the political debate, “paternalism” is a frequently invoked objection to privacy rules. Our work inverts the assumption that privacy interventions are paternalistic while market approaches promote freedom. We empirically demonstrate that advertisers are making it impossible to avoid online tracking. Advertisers are so invested in the idea of a personalized web that they do not think consumers are competent to decide to reject it. We argue that policymakers should fully appreciate the idea that consumer privacy interventions can enable choice, while the alternative, pure marketplace approaches can deny consumers opportunities to exercise autonomy.

A Little Bit More on the Julie Williams Announcement

by Jeff Sovern

Deepak pointed out earlier this month that Julie Williams is stepping down from her position as Chief Counsel of the OCC.  Deepak observed that the news is seen as positive by consumer advocates; one graphic illustration of the feelings some have for her appeared in the movie Maxed Out when her image dissolved into a snake. Deepak also linked to a piece calling her the "Lex Luthor of bank regulators."  But you might get a completely different impression from the OCC's announcement, which states:

* * * Ms. Williams was an early advocate for the stronger bank privacy policies and more effective protections that are common today.  Her career at the OCC has included groundbreaking work ranging from bank interstate operations and bank powers to privacy rights to pioneering the theory, once thought radical, but now readily accepted and applied, that the Federal Trade Commission Act's ban on unfair and deceptive practices may be applied by the banking agencies to protect bank customers.  Nearly a decade ago, Ms. Williams pushed for taking a research-based approach to bank disclosures and using consumer testing to improve disclosures by asking in a speech why consumers got better disclosures on a bag of potato chips than when they engaged in what was likely most important financial transaction they would undertake—taking out a mortgage.

In other words, the announcement painted Ms. Williams as a consumer advocate.  Nor does it note the OCC's efforts to preempt state anti-predatory laws during her tenure, though Deepak pointed those efforts out (unless the mention in the announcement of her work on "bank powers" refers to preemption, though that's a pretty ambiguous reference).  And the announcement's attempt to highlight Ms. Williams's consumer protection accomplishments seems a bit unimpressive for a bank regulator of long duration. The last sentence is about a speech about mortgage disclosures, which would be more significant if the OCC created mortgage disclosures (at the time of the speech, mortgage disclosures were within the Fed's purview; they now are under the CFPB's jurisdiction).  While Ms. Williams has indeed expressed strong views about privacy protections, again, the GLB privacy protection rules were formulated by the Fed, not the OCC.

What are we to make of this?   A more honest appraisal of Ms. Williams work would have referred clearly to the preemption actions taken by the OCC during her tenure.  After all, preemption is the classic lawyer's issue.  Surely those actions are more central to Ms. Williams's work than speeches she gave about rules that her agency lacked the power to write. Is the OCC now embarrassed by its preemption position?  It is under new leadership.  Is Ms. Williams embarrassed by them?  That would be plausible after the financial crisis to which they may have contributed, except that the OCC continued to interpret its preemption powers very aggressively after the financial crisis, even interpreting Dodd-Frank Act so favorably to banks that the Treasury Department took issue with the OCC.  Is the explanation that preemption is too technical for most people to follow and so doesn't merit mention in this kind of announcement?  But wouldn't the people who know about the OCC, or that it has a Chief Counsel, or about bank interstate operations--which got a mention in the press release--be able to understand preemption?

Or is this just a cynical attempt to cast someone who helped banks at the expense of consumers as a consumer protecter?

 

Times Report on E-Scores

Here.  An excerpt:

These digital scores, known broadly as consumer valuation or buying-power scores, measure our potential value as customers. What’s your e-score? You’ll probably never know. That’s because they are largely invisible to the public. But they are highly valuable to companies that want — or in some cases, don’t want — to have you as their customer.

[E-scores] can take into account facts like occupation, salary and home value to spending on luxury goods or pet food, and do it all with algorithms that their creators say accurately predict spending.

A growing number of companies, including banks, credit and debit card providers, insurers and online educational institutions are using these scores to choose whom to woo on the Web. These scores can determine whether someone is pitched a platinum credit card or a plain one, a full-service cable plan or none at all. They can determine whether a customer is routed promptly to an attentive service agent or relegated to an overflow call center.

Federal regulators and consumer advocates worry that these scores could eventually put some consumers at a disadvantage, particularly those under financial stress. In effect, they say, the scores could create a new subprime class: people who are bypassed by companies online without even knowing it. Financial institutions, in particular, might avoid people with low scores, reducing those people’s access to home loans, credit cards and insurance.

Will e-scores lead to discrimination?  Should they be regulated under the Fair Credit Reporting Act or a similar statute?  The article notes that USPIRG's Ed Mierzwinski and Jeffrey Chester of the Center for Digital Democracy have a forthcoming article in the Suffolk University Law Review that may shed more light on how they should be regulated.

Paper Reports on Survey on Mobile Phones and Privacy

Jennifer M. Urban, Chris Jay Hoofnagle, and Su Li, all of Berkeley, have written Mobile Phones and Privacy.  Here's the abstract

Mobile phones are a rich source of personal information about individuals. Both private and public sector actors seek to collect this information. Facebook, among other companies, recently ignited a controversy by collecting contact lists from users’ mobile phones via its mobile app. A recent Congressional investigation found that law enforcement agencies sought access to wireless phone records over one million times in 2011. As these developments receive greater attention in the media, a public policy debate has started concerning the collection and use of information by private and public actors. To inform this debate and to better understand Americans’ attitudes towards privacy in data generated by or stored on mobile phones, we commissioned a nationwide, telephonic (both wireline and wireless) survey of 1,200 households focusing upon mobile privacy issues. We found that Americans overwhelmingly consider information stored on their mobile phones to be private — at least as private as information stored on their home computers. They also overwhelmingly reject several types of data collection and use drawn from current business practices. Specifically, large majorities reject the collection of contact lists stored on the phone for the purposes of tailoring social network “friend” suggestions and providing coupons, the collection of location data for tailoring ads, and the use of wireless contact information for telemarketing, even where there is a business relationship between the consumer and merchant. Respondents evinced strong support for substantial limitations on the retention of wireless phone usage data. Respondents also thought that some prior court oversight is appropriate when police seek to search a wireless phone when arresting an individual.

 

 

Can Consumers Have Facebook and Privacy Too?

 

Andrew Chin

 and

Anne Klinefelter

, both of North Carolina, have written Differential Privacy as a Response to the Reidentification Threat: The Facebook Advertiser Case Study, 90 North Carolina Law Revi

 

Recent computer science research on the reidentification of individuals from anonymized data has given some observers in the legal community the impression that the utilization of data is incompatible with strong privacy guarantees, leaving few options for balancing privacy and utility in various data-intensive settings. This bleak assessment is incomplete and somewhat misleading, however, because it fails to recognize the promise of technologies that support anonymity under a standard that computer scientists call differential privacy. This standard is met by a database system that behaves similarly whether or not any particular individual is represented in the database, effectively producing anonymity. Although a number of computer scientists agree that these technologies can offer privacy-protecting advantages over traditional approaches such as redaction of personally identifiable information from shared data, the legal community’s critique has focused on the burden that these technologies place on the utility of the data. Empirical evidence, however, suggests that at least one highly successful business, Facebook, has implemented such privacy-preserving technologies in support of anonymity promises while also meeting commercial demands for utility of certain shared data.

This Article uses a reverse-engineering approach to infer that Facebook appears to be using differential privacy-supporting technologies in its interactive query system to report audience reach data to prospective users of its targeted advertising system, without apparent loss of utility. This case study provides an opportunity to consider criteria for identifying contexts where privacy laws might draw benefits from the adoption of a differential privacy standard similar to that apparently met by Facebook’s advertising audience reach database. United States privacy law is a collection of many different sectoral statutes and regulations, torts, and constitutional law, and some areas are more amenable to incorporation of the differential privacy standard than others. This Article highlights some opportunities for recognition of the differential privacy standard as a best practice or a presumption of compliance for privacy, while acknowledging certain limitations on the transferability of the Facebook example.