Consumer Law & Policy Blog

It’s Tracking Your Every Move and You May Not Even Know

by Jeff Sovern

That's the headline of an article in today's Times about how cell phones enable cell phone companies to know the location of consumers where ever they go, something of which consumers may not be aware.  One of the problems with our privacy laws is that they generally do not give consumers a right to learn what companies know about them (the Fair Credit Protection Act being one of the exceptions).  That is also a problem with so-called self-regulation and privacy policies: because companies define for themselves what the regulation and policy will entail, they have little reason to give consumers a right to find out what the company knows about consumers.  just as we did not know how frequent data security breaches were until California enacted a law requiring that companies suffering such a breach disclose that it had occurred (a statute many other states later mimicked), I believe we will not discover what companies know about us until we see statutes requiring companies to disclose that information upon request.  And when we learn what they know, I suspect many of us will not be pleased. 

The State of Online Consumer Privacy

Last week, the Senate Committee on Commerce, Science, and Transportation held hearings on the State of Online Consumer Privacy.  Here's a quote from the testimony of Chris Calabrese, Legislative Counsel, American Civil Liberties Union:

If this collection of data is allowed to continue unchecked, then capitalism will build what the government never could—a complete surveillance state online. Without government intervention, we may soon find the internet has been transformed from a library and playground to a fishbowl, and that we have unwittingly ceded core values of privacy and autonomy.

You can read more quotes in the Committee's press release.  A webcast of the hearings can be found here.  Coverage here.  (Hat tip: Mike Murray)

The Good Old Days, When the Big Consumer Protection Problems Were Things Like Spam

Before the subprime meltdown, and its associated consumer protection problems (foreclosures, robosigners, predatory lending, etc.), one of the consumer protection issues that generated the most media attention was spam.  Congress enacted the CAN-SPAM Act to deal with it, but sadly, spam is still very much with us.  Depending on your perspective, CAN-SPAM could either be a lesson in the limits of consumer protection laws at dealing with some problems, or a lesson in poor statutory drafting. 

Serwin Paper on History of FTC Privacy Enforcement

Andrew B. Serwin of Foley & Lardner has written The Federal Trade Commission and Privacy: Defining Enforcement and Encouraging the Adoption of Best Practices.  Here's the abstract:

This article examines the history and path of privacy enforcement by the Federal Trade Commission, as well as the FTC's recently issued "Protecting Consumer Privacy in an Era of Rapid Change: A proposed Framework for Businesses and Policymakers", in which the FTC suggested the adoption of best practices, including a "privacy by design" framework. The article examines the history of Section 5 jurisdiction, the privacy enforcement cases by the FTC, the new proposed framework, and proposes that the FTC take the proposed framework and implement it in a way that includes a focus on the sensitivity of data, provides a "safe harbor" from enforcement for businesses that choose to adopt the framework, and link the framework in a meaningful way to existing EU processes, such as Binding Corporate Rules. By combining these elements, the FTC can achieve meaningful and focused self-regulation and provide appropriate protection to consumers, while giving business an incentive to adopt best-practices, and also increase the level of international cooperation regarding privacy.

Truth 1, vitaminwater 0

by Steve Gardner

The Center for Science in the Public Interest, working with private plaintiff firms Reese Richman, LLP  and Whatley Drake & Kallas, were pleased to get a very well-considered opinion in our lawsuit against Coke involving vitaminwater (Coke  uses the lower case, as does the Court, so I grudgingly do as well).

I say that the opinion is "well-considered" because the Court wrote thoughtfully and well on many nuances of the law involving FDA regulation of food labels and the interplay with state consumer protection law.

Of course, it's nice that the Court roundly rejected almost all of Coke's arguments.

In short, our lawsuit says that it's deceptive to call a sugar-water drink "vitamin"-anything and the opinion essentially agreed that this states a cause of action.

                       

 

Recent Opt-out and Opt-in News

by Jeff Sovern

Two recent developments illustrate anew the difference between opt-outs and opt-ins.  As the New York Times reported last month, JPMorgan Chase is bombarding customers with mailings urging them to opt in to over the limit fees on their debit cards.  That's because under rules to take effect this summer, banks won't be able to charge over the limit fees unless depositors opt in.  So, according to the Times, "Chase and other banks are preparing a full-court marketing blitz, which is likely to include filling mailboxes with various aggressive and persuasive letters, calling account holders directly, and sending a steady stream of e-mail to urge consumers to keep their overdraft service turned on."  In other words, the effect of an opt-in is to give companies an incentive to get the attention of consumers and argue that they should depart from the default. 

Opt-outs create a very different incentive.  Take, for example, the Gramm-Leach-Bliley privacy rules.  They permit financial institutions to sell information about consumer  transactions unless consumers opt out.  Financial institutions are obliged to send consumers annual notices of their privacy rights.  Because banks want to sell consumer information, they face incentives to construct privacy notices that fly under the consumers' radar, so consumers don't notice them and opt out.  As a result, regulators had to promulgate detailed rules designed to increase the likelihood that consumers will read the notices.  It appears, however, that those rules have largely failed; my impression is that relatively few consumers have opted out (I wrote about this in the context of transaction costs here).  Last November, regulators promulgated model forms for financial institutions to use; financial institutions using the model forms are deemed in compliance with GLB.  I haven't yet heard of any institutions using the model forms, but if you have, please so indicate in the comments below.  Actually, I'm not sure why institutions selling consumer information would use the model forms. Because they're relatively readable, as opposed to the forms many financial institutions use, the model forms increase the likelihood that consumers will opt out, thus reducing revenue from selling information.  By contrast, not using the model forms increases the risk that a financial institution will be found to have violated GLB--but since there's no private claim under GLB, it's not clear that matters much.

So notice the contrast: opt-outs create incentives that lead to consumers not being aware of their rights, while opt ins give businesses an incentive to try to get consumers to notice.  Opt-ins also result in consumers being exposed to the arguments for departing from the default (as Chase put it "We want [consumers] to make an informed decision."), while opt-outs give businesses an incentive to conceal those arguments.  The argument the other way, of course, is that opt-ins are more expensive.  I wrote about this once upon a time at 74 Washington Law Review 1033 (1999); it's disappointing that nothing has changed.

Online (Non) Privacy

Today's New York Times explains "How Privacy Vanishes Online."  Among other things, the article explains how, by combining information from a variety of sources, someone can correctly "guess" a lot of people's social security numbers:

Even more unnerving to privacy advocates is the work of two researchers from Carnegie Mellon University. In a paper published last year, Alessandro Acquisti and Ralph Gross reported that they could accurately predict the full, nine-digit Social Security numbers for 8.5 percent of the people born in the United States between 1989 and 2003 — nearly five million individuals.

Social Security numbers are prized by identity thieves because they are used both as identifiers and to authenticate banking, credit card and other transactions.

The Carnegie Mellon researchers used publicly available information from many sources, including profiles on social networks, to narrow their search for two pieces of data crucial to identifying people — birthdates and city or state of birth.

That helped them figure out the first three digits of each Social Security number, which the government had assigned by location. The remaining six digits had been assigned through methods the government didn’t disclose, although they were related to when the person applied for the number. The researchers used projections about those applications as well as other public data, like the Social Security numbers of dead people, and then ran repeated cycles of statistical correlation and inference to partly re-engineer the government’s number-assignment system.

Corey Ciocchetti Paper on the Future of Privacy Policies

Corey Ciocchetti has written The Future of Privacy Policies: A Privacy Nutrition Label Filled with Fair Information Practices, 26 John Marshall Journal of Computer and Information Law.  Here's the abstract:

E-commerce continues to blossom as evidenced by online retail sales in excess of $33 billion over the first quarter 2008. This growth helps spur the staggering economy but also magnifies the serious threats surrounding personally identifying information (PII) submitted during e-commerce transactions. The most common threats, such as identity theft and aggregated data files, do the most damage when companies are careless (i.e., losing laptops filled with unencrypted data) or callous (selling data on the open market) with the PII they collect. The first line of defense against these threats is the electronic privacy policy. In theory, privacy policies are supposed to force companies to analyze and strengthen their privacy practices and then provide Web surfers with a detailed picture of what happens to their information upon submission. Privacy policies are most effective when Web site visitors can locate, read and comprehend their terms. Armed with this knowledge, individuals are supposed to make accurate privacy assessments before submitting information online. Problematically, contemporary privacy policies fail to live up to their promise because they are posted inconspicuously, purposefully vague and filled with legalese. This inaccessibility leads Web surfers to ignore privacy practices completely while they continue to submit PII blindly.

Privacy policies can be effective if companies clearly and conspicuously discuss how their privacy terms relate to fair information practices (FIPs). FIPs are widely agreed upon guidelines covering the most important areas of the data trade - PII collection, use, storage and dissemination. The Federal Trade Commission has designated the five core FIPs to be notice, choice, access, integrity and enforcement. This article argues that a standardized privacy nutrition label - similar to the labels required by the Nutrition Labeling and Education Act - posted conspicuously on all e-commerce homepages can increase policy effectiveness. These federally mandated labels require companies to discuss their privacy practices in relation to each Key FIP. Although companies need not adopt specific policy terms or run their practices through a governmental clearinghouse, they must honestly disclose their practices. This is true of even the most unpopular practices such as external PII dissemination. Over time, consumers will become aware of these standardized labels, begin to understand FIPs, differentiate between privacy-protective and privacy-invasive practices and make better decisions before submitting PII.

Sprague & Ciocchetti Paper on Protecting Personal Identifying Information

Robert Sprague and Corey Ciocchetti have written Preserving Identities: Protecting Personal Identifying Information through Enhanced Privacy Policies and Laws, 19 Albany Law Journal of Science & Technology.  Here's the abstract:

This article explores the developing phenomenon of the ongoing collection and dissemination of personal identifying information (PII): first, explaining the nature and form of PII, including the consequences of its collection; second, exploring one of the greatest threats associated with data collection - unauthorized disclosure due to data breaches, including an overview of state and federal legislative reactions to the threats of data breaches and identity theft; third, discussing common law and constitutional privacy protections regarding the collection of personal information, revealing that United States privacy laws provide very little protection to individuals; and fourth, examining current practices by online commercial enterprises regarding privacy policy disclosure and conduct. This section reveals that there is almost no legal regulation of online privacy policies. This paper concludes that new, stronger laws are required to protect individuals regarding the collection and dissemination of their PII. A model law is therefore proposed to address those areas where PII protection is lacking.

Journal of Consumer Affairs Special Issue on Privacy Literacy

Here's the table of contents from the Journal of Consumer Affairs, Fall 2009, Volume 43, Number 3 Special Issue on: Privacy Literacy -- How Consumers Understand and Protect Their Privacy:

Editorial Prelude by guest editors of special issue Jeff Langenderfer and Anthony D. Miyazaki: Privacy in the Information Economy

Determinants of Online Privacy Concern and Its Influence on Privacy Protection Behaviors among Young Adolescents by Seounmi Youn

Consumers’ Rules of Engagement in Online Information Exchanges by Amit Poddar, Jill Mosteller, and Pam Scholder Ellen

Toward an Understanding of the Online Consumers' Risky Behavior and Protection Practices by George R. Milne, Lauren I. Labrecque, and Cory Cromer

Providing Parents with Online Privacy Information: Approaches in the United States and the United Kingdom by Andrea J. S. Stanaland, May O. Lwin, and Susanna Leong

Standing in the Footprint: Including the Self in the Privacy Debate and Policy Development by Patricia A. Norberg, David A. Horne, and Daniel R. Horne

Bits, Briefs and Applications

Credit Scoring And Its Effects On The Availability And Affordability Of Credit by Robert B. Avery, Kenneth P. Brevoort and Glenn B. Canner

Responding Commentary: Unresolved Issues In The Use Of Credit Scores To Underwrite Or Price Financial Products And Services by Calvin Bradford

Editorial Postlude: Privacy Crimes, Annoyances and Self-Defeating Business Practices by Herbert Jack Rotfeld