Consumer Law & Policy Blog

Paper on Google and Privacy

Omer Tene of the College of Management - School of Law, Israel, has written What Google Knows: Privacy and Internet Search Engines, available at http://ssrn.com/abstract=1021490.  Here's the abstract:

Search engines are the most important phenomenon on the Internet today and Google is the gold standard of search. Google evokes ambivalent feelings. It is adored for its ingenuity, simple, modest-looking interface and superb services offered at no (evident) cost. Yet increasingly, it is feared by privacy advocates who view it as a private sector big brother posing perhaps the biggest privacy problem of all times. Google is an informational gatekeeper harboring previously unimaginable riches of personal data. Billions of search queries stream across Google's servers each month, the aggregate thoughtstream of humankind, online. Google compiles individual search logs, containing information about users' fears and expectations, interests and passions, and ripe with information that is financial, medical, sexual, political, in short - personal in nature. How did Google evolve from being a benevolent giant seeking to do no evil into a privacy menace reviled by human rights advocates worldwide? Are the fears of Google's omniscient presence justified or overstated? What personal data should Google be allowed to retain and for how long? What rules should govern access to Google's database? What are the legal protections currently in place and are they sufficient to quell the emerging privacy crisis? These are the main issues addressed in this article.

Journal of Consumer Affairs Call for Papers on Privacy

The Journal of Consumer Affairs plans a special issue on Privacy Literacy -- How Consumers Understand and Protect Their Privacy.  Here is the Call for Papers:

Special Issue Guest Editors
Jeff Langenderfer                   Anthony Miyazaki
Meredith College                   Florida International University
 
Consumers increasingly confront a wide array of privacy-related information and are called upon to make decisions impacting their privacy in a growing number of arenas and contexts.  Existing research suggests that many consumers do not understand the decisions they are forced to make nor the impact of those decisions.  For this special issue of the Journal of Consumer Affairs, manuscripts are being solicited devoted to the effects of privacy literacy on consumer welfare.  The goal of this special issue is to extend our theoretical and practical knowledge of how consumers obtain, process, and use information and mechanisms that relate to their privacy.  We seek contributions from multiple disciplines including communications, consumer education, economics, finance, law, public policy, psychology and marketing.  Authors may submit empirical studies or conceptual work.  Papers that are theoretically grounded and also contain significant implications for consumer welfare are especially appropriate.
 
Topics that would be appropriate for this special issue include, but are not limited to:

• Consumer understanding of privacy and privacy-related information
• The interplay between privacy knowledge and consumer behavior
• Cost assessments for the surrender of personal information
• Tradeoffs between the surrender of private information and online access
• Deceptive or covert practices in information exchange
• Measurement and assessment of privacy literacy
• Legal and regulatory issues in privacy
• How consumers respond to solicitations for private information
• Consumer understanding of privacy certifications, trustmarks, and seals of approval
• Methods to improve privacy literacy
• The privacy literacy of vulnerable consumers (e.g., children, low-income, etc.)
• Relationships between desire-for-privacy, privacy concern, trust, and privacy knowledge
• Disclosure versus practice regarding privacy-related behaviors
• Consumer awareness regarding seller use of private information
• Consumer understanding of medical and financial privacy practices and disclosures

Submission Information
Manuscripts are due by June 1, 2008. Please follow the submission guidelines for The Journal of Consumer Affairs as detailed under "JCA Author Guidelines" on the Blackwell Publishing web site (http://www.blackwellpublishing.com/submit.asp?ref=0022-0078&site=1).  Authors wishing to submit a manuscript should send two (2) electronic copies of their manuscript (one with the full title page and one copy cleaned of all information that identifies the authors) to the special issue co-editor:

Times Articles on Subprime Crisis, Debt Collection, the CPSC Bills, Reverse Mortgages, and Online Privacy

I've accumulated a huge backlog of recent Times articles on consumer law issues, so here goes an attempt to reduce the backlog.

Many of the articles involve the mortgage crisis and plans to do something about it.  For example, the lead article in today's Times is headlined "White House Offers Plan to Ward Off Credit Crisis."  Here's an excerpt:

The plan, which relies primarily on state regulators and private industry to tighten their oversight of financial markets, calls on states to issue nationwide licensing standards for mortgage brokers.

The plan would also require lenders to make more complete disclosures about payment terms to home buyers. And it would curtail possible conflicts of interest at companies that assign levels of risk to packages of mortgages that are sold to investors.

* * *

But in many ways, the plan relies on the same market participants — from mortgage brokers to credit-rating agencies and Wall Street firms — that government officials and other experts blame for the current crisis.

How Much Do Consumers Value Not Getting Telemarketing Calls?

In a paper titled "On the Value of Privacy from Telemarketing: Evidence from the 'Do Not Call' Registry," and available at http://ssrn.com/abstract=1000533, Ivan P.L. Png of the National University of Singapore, estimates the value of privacy at a surprisingly low $8.25 per year.  Here's the abstract:
   

Despite tremendous debate and policy interest, there has been relatively little research into the issue of how much individuals value their privacy. In this paper, I estimate the demand for the value of privacy from telemarketing as provided by the federal "do not call" registry. From the demand curve, I compute two estimates of the household value of privacy: a lower bound of $3.22 per year, and a best estimate of $8.25 per year.  The telemarketing industry must provide consumers with at least this much expected consumer surplus to persuade them not to conceal themselves through the "do not call" registry.

University of Oregon Takes Legal Stand Against RIAA In Downloading Suits

This story in yesterday's New York Times describes how the University of Oregon is standing up for what it believes are its students' privacy and due process rights by refusing to give up the students' identities in suits by the Recording Industry Association of America. The RIAA suits are going after what it claims is unlawful downloading of copyrighted music. Well worth a read.

Sarah Ludington Article on Liability for Traders in Consumer Information

Sarah Ludington of Duke's article "Reining in the Data Traders: A Tort for the Misuse of Personal Information, " in 66 Maryland Law Review, can be found at http://ssrn.com/abstract=1008343.

Here's the abstract:

In 2005, three spectacular data security breaches focused public attention on the vast databases of personal information held by data traders such as ChoicePoint and LexisNexis, and the vulnerability of that data. The personal information of hundreds of thousands of people had either been hacked or sold to identity thieves, yet the data traders refused to reveal to those people the specifics of the information sold or stolen. While Congress and many state legislatures swiftly introduced bills to force data traders to be more accountable to their data subjects, fewer states actually enacted laws, and none of the federal bills were taken to a vote before the election in 2006. In large part, individuals remain powerless to discover the information a data trader holds about them, to discover what information was sold or stolen, to prevent data traders from using their personal information in unauthorized ways, or to hold
data traders accountable for lax security.

The Article argues that a new common law tort should be used to force reform and accountability on data traders, and to provide remedies for individuals who have suffered harm to their core privacy interests of choice and control-choice about who may receive their information, control over the information revealed, and how the recipient of that information may use it. The Article examines the current legislative and common law regimes, concluding that there are no effective remedies for individuals who have suffered harm from data misuse. Given the ineffective legislative response to the security breaches of 2005, the Article argues that the existing scheme of common law privacy torts should be expanded to create a new tort for information misuse. The new tort borrows from existing privacy torts - in particular, the tort of appropriation - and existing privacy statutes, importing the Fair Information Practices from the Privacy Act of 1974 as a standard of care.

Jennifer Chandler on Negligence Liability for Breaches in Data Security

Jennifer A. Chandler of the University of Ottawa Faculty of Law has authored "Negligence Liability for Breaches of Data Security," forthcoming in the Banking and Finance Law Review.  Here's the abstract:

Due to the concern over identity fraud, data security issues are now attracting growing attention from legislators, legal scholars, and an increasing number of litigants. This article addresses the possibility of using liability in negligence as a means to deter unreasonably careless data security practices as well as to offer compensation to those harmed by data security breaches. Part I of the article discusses the need for civil liability in order to deter careless data security practices. Part II reviews U.S. cases involving negligence liability for breaches of data security, identifying the key problems facing plaintiffs. Part III addresses additional legal problems that may face plaintiffs in the Canadian context, and Part IV draws on case law and regulatory decisions to suggest some conclusions about what are "reasonable" security measures.

You can download the article at http://ssrn.com/abstract=998305.

Reports on Senator Dodd's Mortgage Bill and Ask.Com's Privacy Protections

Here is the report in today's Times on Senate Banking Committee Chair Dodd's mortgage bill.  The story compares the Dodd bill to the House bill.  An excerpt:

Like the House measure . . . Mr. Dodd’s bill requires lenders to make only those loans that benefit borrowers and that they can repay. But Mr. Dodd’s proposal would also require brokers to act in the interest of borrowers, and that Wall Street firms could be sued.

Investment banks that securitize mortgages could also be sued under Mr. Frank’s measure, but state authorities would be prohibited from pursuing certain claims against Wall Street.

In an interview last week, [Congressman Barney] Frank [who authored the House bill] said he planned to toughen his bill’s enforcement provisions as it relates to investment banks, but he added that the demand for home loans would dry up if investors in mortgage securities were subject to lawsuits brought by state officials.

Unlike the Frank bill, Mr. Dodd’s proposal would bar specific practices in subprime lending like prepayment penalties, which borrowers have to pay if they try to refinance or pay off their loans early within a few years, and yield spread premiums, which are commissions lenders pay to brokers for gettingpersuading borrowers to take out a higher-cost loan than they could qualify for. But Mr. Dodd’s bill would not create a national registry of brokers and loan officers as the House measure would.

The Times also reports here on Ask.com's program to discard information gathered from consumer searches.  Consumers wishing to keep Ask.com from retaining their information wil have to use "AskEraser," which is to be conspicuously displayed on Ask.com's main search page.  Ask.com contrasts with other search engines, like Google, which retain consumer information for 18 months or so.  This promises to be an interesting privacy experiment.  Ask.com is betting that enough consumers care about their privacy to switch to their service from competitors; it will be interesting to see whether Ask.com's market share, currently under 5%, increases.  It's not clear to me, though, how much privacy protection consumers will get.  Ask.com will still provide query information to Google (!) which supplies many of Ask.com's ads. 

CL&P Roundup

by Deepak Gupta

• Chair of Product Safety Agency Says Beefing Up Her Agency Would "Harm" Americans:  In the wake of growing public concern over the number of unsafe toys and other products on the market, the chair of the Consumer Product Safety Commission, Nancy Nord, has told Congress that a Senate safety bill--which would more than double her anemic agency budget and expand its authority--would "put the American people at greater risk."  [U.S. PIRG Consumer Blog] [Washington Post].
• Postgame Coverage of the Arbitration Hearing:  For those of you who didn't get to attend or watch yesterday's hearing on binding mandatory arbitration, we plan to bring you the next best thing: Paul Bland of Public Justice will be posting his own expert observations on the proceedings.  In the meantime, here's some coverage from around the web: How Arbitration Steals Your Day in Court [MSNBC] and Liveblogging the House Judiciary Subcommitee Hearing [Consumerist].
• FTC Workshop on Privacy and Advertising:  On November 1st and 2nd, the Federal Trade Commission is holding a two-day workshop to address consumer protection issues raised by the tracking of consumers' activities online in connection with online advertising/behavioral advertising.  The agenda is available here.  Those who are interested but cannot attend can watch a live webcast here.
• Numbers Won't Be Dropped from the Do-Not-Call List (At Least For Now): The FTC has announced that it's not going to drop numbers from the do-not-call list, at least pending a final Congressional or agency decision on whether to make registration permanent.  Because of an internal scrubbing program that removes reassigned or disconnected numbers, there's no need to drop the numbers on the list.

Times Reports on Spam, Telemarketing, Credit Discrimination, Credit Card Legislation, and More

I've fallen behind on my reading of the Times, but here's an attempt to make up for that.  Today's "What's Online" column has several pieces relevant to consumer law.  The column opens  by noting that Symantec's monthly State of Spam report observed an increase in spam in September. The increase is due in part to spam offering loans and homes in response to the Fed's rate cut.  So much for CAN-SPAM.  The column goes on to describe something reported on consumerist.com (which occasionally picks up our postings and is listed on our blog roll at left): DirecTV claims the right to make "informational calls" to consumers on its Do-Not-Call list to give consumers "an opportunity to change [their] do-not-call preference."  Finally, according to Geoff Williams of Entrepreneur.com, telemarketing is among ten industries likely to die in the next decade.  That contrasts with earlier reports that telemarketing has grown since adoption of the Do-Not-Call rule.

In other recent stories, the Times reported here that the N.A.A.C.P. has filed suit against eleven mortgage lenders for steering African-Americans to subprime loans even though they could have qualified for prime rates.  The suit is founded on ECOA and the Fair Housing Act, and the plaintiffs are seeking to have it certified as a class action.  An editorial in yesterday's issue, titled "Common Sense and Credit Cards" praises bills that would outlaw universal default and limit credit card marketing to college students.  It calls for Congress to look at school-themed credit cards offered by alumni associations.  Finally, just to prove that identity thieves spare no one, here's a report on the victimization of the billionaire Mayor Bloomberg.