Consumer Law & Policy Blog

Roberds and Schreft on the Economics Behind Data Security, Privacy, and Identity Theft

William Roberds and Stacey L. Schreft, both of the Fed, have written Data Security, Privacy, and Identity Theft: The Economics Behind the Policy Debates, 23 Economic Perspectives (2009).  Here is the (very short) abstract:

In this article, we explore the concept of efficient confidentiality, using some ideas from economic theory.

Andrew Serwin on Privacy Litigation

Andrew B. Serwin of Foley & Lardner LLP has written Poised on the Precipice: A Critical Examination of Privacy Litigation.  Here's the abstract:

A collection of factors has caused the United States to be poised on the precipice of a new wave of litigation - litigation arising from the improper use or collection of information. Public concern over privacy is ever increasing while, and some would say because, information has become critical to our everyday existence. In what is now a self-reinforcing cycle, increased public concern has caused an exponential increase in regulations, and the new regulations have caused increased attention and public concern because many of the new laws require public disclosure of security breaches, which increases societal concerns over privacy.

Security breach laws, the laws that mandate public disclosure of data incidents, provide the best example of the increase in regulation - Just a few short years ago California passed the first security breach law. Now, 43 other states, the City of New York, Washington, D.C., and Puerto Rico, have adopted laws and many other countries have either adopted, or are likely to adopt, security breach laws as well. Restrictions on the collection and use of Social Security number laws provide another such example as now more than 35 states have adopted these type of laws.

Whether the increasing public concern over privacy is caused by, or reflected in, the new privacy laws, the phenomenal expansion in the number of privacy laws will have a predictable effect - a geometric increase in the number of privacy laws will result in an equally geometric increase in the number of violations of privacy laws. As violations increase there is an equally predictable consequence - increased incentives for individuals to attempt to enforce these new rights.

One of the first challenges in privacy litigation is to define what "privacy" litigation actually is. While consumer-based privacy litigation gains much of the attention, to focus exclusively on consumer-oriented privacy litigation misses half the picture. The increase in value of information has increased the number of businesses that are bringing litigation to protect their intellectual capital and their networks. Though these claims are not thought of as "privacy" litigation in the traditional sense, these claims are no less about the improper use of information than actions brought by individuals. This litigation is frequently brought under the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, CAN-SPAM, the unfair competition law, including portions of the Lanham Act.

In the privacy realm, the Federal Trade Commission ("FTC") serves as the primary federal privacy enforcer. However, the FTC does not have unlimited resources, privacy is not its only responsibility, and the actual number of enforcement actions is not as high as one might guess. As a result, state attorney generals have an important role to play in privacy enforcement. However, with limited exceptions, state attorney generals have not brought a significant number of privacy matters. As a result, enforcement in many cases falls to private plaintiffs, and they play a role in enforcing privacy laws where violations are alleged to have occurred.

However, the road to plaintiffs' recovery in privacy litigation is littered with a number of issues that can derail a case before it truly starts, not the least of which is that plaintiffs in many cases cannot prove actual damage, and may actually lack standing to bring an action. Moreover, even if the case clears this hurdle, many class actions fail the certification requirements because of issues unique to privacy litigation.

This article examines the common theories of privacy litigation, the issues faced by plaintiffs, and examines class action issues generally, as well as some class issues that are unique to privacy litigation. While privacy cases have had mixed success, the increased importance of information, coupled with increased public attention, and the ever-increasing number of privacy laws guarantees that we will be stepping off of the precipice and into privacy litigation.

Times Story on Medical Information Privacy

Today's Times has an article, And You Thought a Prescription Was Private, about the sale of information about patients' use of prescriptions. The article also reports about how February's stimulus bill prohibits the sale of much personal health information.  The Center for Democracy and Technology has more.

Website Collects Medical Data and Uses That Data for Drug Company Solicitations

by Jeff Sovern

Today's Times includes Online Age Quiz is a Window for Drug Makers, about a web site, RealAge, which tells you your "biological age" if you answer some 150 questions and offers suggestions for reducing that age.  Sounds great. But, the article explains, the information collected is then used to identify patients who might be candidates for medications, and the company sends these patients emails sponsored by drug companies that sell the medications.  Some excerpts:

“Our primary product is an e-mail newsletter series focused on the undiagnosed at-risk patient, so we know the risk factors if someone is prehypertensive, or for osteoarthritis,” said Andy Mikulak, the vice president for marketing at RealAge. “At the end of the day, if you want to reach males over 60 that are high blood pressure sufferers in northwest Buffalo with under $50,000 household income that also have a high risk of diabetes, you could,” he said.

RealAge’s privacy policy does not specifically address the firm’s relationship with drug companies, but does state, in part, “we will share your personal data with third parties to fulfill the services that you have asked us to provide to you,” and it adds test results to its database only when respondents become RealAge members. Some critics, however, charge that consumers do not have enough information when they join.

“Literally millions of people have unknowingly signed up,” said Peter Lurie, the deputy director of the Health Research Group at Public Citizen, a public interest group in Washington. The company, he said, “can create a group of people, and hit them up and create anxiety even though the person does not have a diagnosis.”

The article explains that the company does not provide the drug companies personally identifiable information.  But this business model strikes me as meriting FTC review.  I don't think the privacy policy is clear enough about what the company is doing with the information, especially given the sensitivity of medical information.  See Weld v. CVS Pharmacy, Inc., 1999 WL 494114 (Mass. Super. Ct. 1999) (noting that consumers "arguably possess a greater expectation of privacy as to the use of their names in connection with their prescriptions and medical information . . . ."). And then there's the widely-held suspicion that few consumers even read privacy policies, and many misinterpret them.  For example, one survey found that 75% of American adult users of the internet believe that the fact that a web site has a privacy policy means that the site won't reveal their information to others.  See Joseph Turow, Lauren Feldman, and Kimberly Meltzer, Open to Exploitation: American Shoppers Online and Offline 3 (2005).  If you can give RealAge your information without actually reading their privacy policy, as is common on web sites, which usually permit you to read the privacy policy only if you click on it, RealAge can probably tell how many of its members actually go to its privacy policy page, and if it's not very many, and the company knows that, it raises questions about whether this conduct is unfair within the meaning of the FTC Act.  On top of that, their privacy policy goes on forever, raising questions about how many people who set out to read it make it through the whole thing.  RealAge also reserves the right to change its privacy policy.  My own opinion is that before seeking private medical information, the company should make clear even to those who don't click on the privacy policy what it will do with that information.  But then, I've taken the view, which thus far the FTC has not embraced, that collecting and selling consumer information without the consumer's knowledge or consent violates the FTC Act and UDAP statutes.  See Jeff Sovern, Protecting Privacy with Deceptive Trade Practices Legislation, 69 Fordham L. Rev. 1305 (2001).  

Hoofnagle and King on What Californians Understand About Online Privacy

After co-authoring What Californians Understand about Privacy Offline, Chris Jay Hoofnagle and Jennifer King, both of Berkeley, have collaborated on What Californians Understand about Privacy Online.  Here's the abstract:

The volume of online commerce grows every year, in absence of a federal law setting baseline protections for the collection, use, and disclosure of personal information. Instead, information collected by websites are governed by individual privacy policies.

In order to gauge Californians' understanding of privacy policies and default rules in the online environment, we commissioned a representative survey of adults in the State (N=991). The telephonic survey of Spanish and English speakers was conducted by the Survey Research Center of University of California, Berkeley.

A gulf exists between California consumers' understanding of online rules and common business practices. For instance, Californians who shop online believe that privacy policies prohibit third-party information sharing. A majority of Californians believes that privacy policies create the right to require a website to delete personal information upon request, a general right to sue for damages, a right to be informed of security breaches, a right to assistance if identity theft occurs, and a right to access and correct data.

These findings show that California consumers overvalue the mere fact that a website has a privacy policy, and assume that websites carrying the label have strong, default rules to protect personal data. In a way, consumers interpret "privacy policy" as a quality seal that denotes adherence to some set of standards. Website operators have little incentive to correct this misperception, thus limiting the ability of the market to produce outcomes consistent with consumers' expectations. Drawing upon earlier work, we conclude that because the term "privacy policy" has taken on a specific meaning in the minds of consumers, its use should be limited to contexts where businesses provide a set of protections that meet consumers' expectations.  

Stephen Baker's The Numerati

by Jeff Sovern

I've been listening to the audio version of Stephen Baker's fascinating book The Numerati, and while I'm not done with it, I thought I would blog about some of what I've encountered in it thus far, as well as some thoughts it's prompted.  Baker's thesis is that data miners are attempting to construct mathematical models of individuals which will enable them to predict how those individuals will respond to particular stimuli.  Though Baker ranges across politics (how to get people to vote the way you want) and the workplace, I'm going to focus on consumer matters, as befits our Blog. 

Suppose a grocer wants to persuade consumers to buy a particular item, say Advil.  One option is to offer coupons, but those will reach many shoppers (or even non-shoppers) who won't respond to them.  Thus, the grocer will waste money advertising to people who aren't interested, while also burdening shoppers who read the ad but are not interested in Advil.  Inefficient.  But now suppose the grocer offers frequent shopper cards that enable it to identify consumers who have used such coupons in the past.  If the grocer can target such consumers with coupons, it can reach those likely to be influenced by the coupons without wasting money on (and wasting the time of) those who would not be interested in the coupons. So far, it sounds like a winning proposition all around.

Baker reports that existing technology permits that. Some stores use "smart carts," shopping carts that can flash to shoppers specials, etc., that are likely to be of interest to the particular shopper.  The smart cart reads the chip embedded in the frequent shopper card to figure out what is likely to matter to the owner of the card.  OK--but what if the item is something that the consumer might not want to have flashed on a screen, like an ad for savings on condoms or laxatives?  Probably grocers would figure out not to use the technology on such items.  Even so, some consumers might be troubled by the invasion of privacy this technology implies, but they could always not use the frequent shopper card, if they know what use of that card permits retailers to do.  But that's something that probably few consumers are aware of.  For what it's worth, I wrote about whether collecting and using information about consumers without informing them of that fact violates the FTC Act and UDAP statutes in an article, Protecting Privacy with Deceptive Trade Practices Legislation, 69 Fordham Law Review 1305 (2001). 

The book also has implications for consumer discrimination law.  Baker describes how the technology can be used to drive away undesirable shoppers, the so-called "barnacles" who buy only a few items, and those on sale.  Barnacles may cost grocers money by buying loss-leaders (items priced at below cost to attract consumers in the hope that the consumers, once in the store, will also buy more profitable items) and not buying anything else.  Smart carts could flash barnacles specials on caviar and other expensive items rather than the items that more conventional shoppers might see, in an attempt to cause the barnacles to go elsewhere.  Put that way, it's kind of funny, but what if the grocer uses the smart card to show different specials to consumers of different races or genders--something that the technology would not only be able to do, but because of its ability to target consumers who are interested in different products, seems like a real possibility, if it turns out that people of different races or genders respond differently to the same offers.  Could we end up with price discrimination based on such classifications, with some groups getting access to specials that others never learn about?

Baker writes about how when one cell phone company charged an extra fee for a particular service, it received numerous complaints from consumers almost all of whom shared certain characteristics.  Suppose, he goes on, the company had offered that service for free to consumers with those characteristics, but charged consumers who were less likely to complain?  Again, we have price discrimination.  Is that troubling?  Suppose those of a particular race or gender generally end up paying more for that service.  I think most people would find that troubling.  I know I do.  How would we even know? 

Anyway, it's a thought-provoking book and I'm looking forward to the rest of it.

Times Reports on Identity Theft Risks, Foreclosure Crisis, Privacy Policies, and More

by Jeff Sovern

Lots in the Times this week on consumer law issues, so here goes.  Tomorrow's Times will include Bob Tedeschi's Mortgages column, Your Financial Data: How Safe is it? about a Wolters Kluwer Financial Services of Minneapolis survey that found that many smaller lenders transmit consumer financial data in unsecure email, thus exposing borrowers to the risk of identity theft. Meanwhile, today's Times had a story, Some Banks Will Put Off Foreclosures Until March, while they wait for the Obama administration plan, about which Alan blogged earlier today. The Times had a brief story about the Obama administration's attempts to develop such a plan yesterday.

Yesterday the Times also published Agency Skeptical of Internet Privacy Policies.  Here's an excerpt:

The Federal Trade Commission had some sharp words for Internet companies Thursday, saying that they are not explaining to their users clearly enough what information they collect about them and how they use it for advertising.

For now, the commission is sticking to its view that the Internet industry can voluntarily regulate its own privacy practices.

But the tone of the report, and comments by several commission members and staff officials, indicated that if the industry does not move faster, the agency would increase regulation or call for Congress to legislate stricter online privacy rules.

* * *

Ms. Harrington challenged Internet companies to explain what they are doing in a section other than its privacy policy.

The commission did not specify what sort of notice companies should give, but it noted that some have proposed methods that are more visible to the average user, like a link right on each advertisement that leads to an explanation of what data the advertiser collects and uses.

“This is about advertising, so these people ought to be creative,” she said.

“We know advertisers can get their messages across when they want to. They darn better want to get this message across: ‘This is what we are collecting and this is how we are using it.’ ”

Thursday's issue included a story about a crime that may become a sad sign of the times: Philadelphia Grand Jury Says Crime Ring Fraudulently Sold 82 Houses.  The ring sold unoccupied houses, thereby injuring both the current and putative owners.   

Wednesday brought A Pill That Promised Too Much about the settlement reached between the FDA and attorneys general with Bayer over allegedly deceptive advertising of the birth control pill, Yaz.  Those using our casebook this semester will be pleased to see that the settlement includes corrective advertising, something discussed in chapter one. 

Times Piece by Debt Collector and Reports on Other Consumer Issues

Today's Times has a piece written by a debt collector about how he helps people, In Tough Times, A Debt Collector Sees the Pain.  An excerpt:

When someone calls back and thanks you for suggesting they get the debt resolved with me before it appears on a credit report, I think, “Wow, I did do good for someone.” It’s a great feeling to help someone out of a dire situation. I’ve helped young people just out of school and took time out to explain how bad credit could hurt them in the long run. They call back and say: “Thanks for the advice. You’ve saved me years of heartache.”

I wonder if the Times will print any letters from those who have different feelings about debt collectors (maybe readers of the Blog?).  The article was in the business section, so letters should be emailed to sunbiz@nytimes.com. 

Another article in the Business section, Phones as Credit Card? Americans Must Wait, describes how we may someday use cell phones as payment instruments, something that has been occurring in Japan for years.  Does that mean that cell phone contracts will someday include TILA disclosures? And from the Real Estate section, Safeguarding Against Loan Discrimination, about settlements reached by the New York State Attorney General's Office with two mortgage brokers accused of charging minority borrowers higher fees than white borrowers, and how borrowers can protect themselves. 

Wednesday's paper brought distressing news: Big Breach in Card Data Raises Risk for Millions.  Here's the first paragraph:

Heartland Payment Systems, a major payment processing company, disclosed a data breach on Monday that potentially exposed tens of millions of credit and debit cardholders to the risk of fraud in what could quickly become one of the country’s biggest data compromises.

At the risk of trampling on Alan White's territory, here's an article from back on December 21 that I never got around to posting, Bob Tedeschi's Mortgages column titled Revising Loan Modifications.  Some excerpts:

“The average loan servicer wants to reach a resolution about a loan modification with a single letter or a phone call,” said Steven Horne, the president of Wingspan Portfolio Advisors, which helps clients renegotiate loan terms. But, he said, devising an effective long-term strategy to enable a borrower to avoid foreclosure might take several rounds of communication.

* * *

But Mr. Horne, a former executive at Fannie Mae, suggested that the new loans had not been structured to best meet borrowers’ financial circumstances, in large part because the loan servicers that collect mortgage payments cannot engage in a lengthy analysis of each borrower’s finances.

It is up to the borrowers, therefore, to be more proactive. Mr. Horne says they can increase the likelihood of securing the right loan if they push for more personal attention, and do a little homework about their own finances.

And from December 18, Yahoo Puts New Limits on Keeping User Data, about how Yahoo will keep some personally-identifiable data for only 90 days, less time than the other major search engines.

Hoofnagle & King on Company Sharing of Consumer Information

Chris Jay Hoofnagle and Jennifer King, both of Berkeley, have co-authored Consumer Information Sharing: Where the Sun Still Don't Shine.  Here's the abstract: 

In late 2007, the popular social networking site Facebook.com adopted "Beacon," an application that informs Facebook users' friends about purchases made and activities on other websites. For example, if a Facebook user bought a movie ticket on Fandango.com, that user's friends would be informed of that fact through a news "feed" on Facebook. Some users objected vigorously to the Beacon application, because their activities were reported on an opt-out basis, meaning that the user had to take affirmative action to prevent others from learning about their activities. An activism website, Moveon.org, organized a protest, calling users to action by asking, "When you buy a book or movie online - do you want that information automatically shared with the world on Facebook?" Facebook responded to these critiques by changing its policy to obtain express approval before activities on other sites would be shared with friends.

The Facebook folly demonstrates how intensely consumers reject the "sharing" of personal information for marketing purposes. In this instance, consumers learned of Facebook's strategy because it was transparent and obvious to the individual. But what most do not realize is that, in the absence of a specific law prohibiting information sharing, businesses are generally free to monetize their customer databases by selling, renting, or trading them to others. In fact, the sale of customer information is a common, albeit opaque practice that, if disclosed at all, is usually mentioned in a "privacy policy." Facebook's Beacon simply made information sharing obvious to users.

Studies have shown that most consumers oppose the sale of personal information. Unfortunately, most consumers are under the misimpression that a company with a "privacy policy" is barred from selling data. To learn more about information selling, the authors, using a California privacy law, made requests to 86 companies for a disclosure of information sharing practices. The results show that while many companies have voluntarily adopted a policy of not sharing personal information with third parties, many still operate under an opt-out model that is inconsistent with consumer expectations, and others simply did not respond to the request. Based on these results, the authors propose several public policy approaches to bringing business practices in information sharing in line with consumer expectations.

Corey Ciocchetti on E-Commerce and Information Privacy

Corey Ciocchetti has written "E-Commerce and Information Privacy: Privacy Policies as Personal Information Protectors," 44 American Business L.J. --.  Here's the abstract:

This article dives into the contemporary debate surrounding information privacy in the twenty-first century e-commerce environment through the lens of consumers submitting personally identifying information into the vast abyss of cyberspace. I argue that this information must be better protected and that United States law should emphasize electronic privacy policies as privacy-protecting devices. Currently, the United States operates under primarily a self-regulatory environment where the federal and state governments allow industry to regulate the use and content of their privacy policies. This article details [the] current state of the United States legal regime, addresses its inefficiencies in this area and proposes a new federal law designed to remedy this situation. This piece argues that with minimal governmental regulation, electronic privacy policies can become effective tools to protect consumers personally identifying information.