Mark MacCarthy, New Directions in Privacy: Disclosure, Unfairness, and Externalities
Comment by: Lauren Willis
PLSC 2010
Workshop draft abstract:
Several recent developments underscore a return of public concerns about access to personal information by businesses and its possible misuse. The Administration is conducting an extensive interagency review of commercial privacy, Congress is considering legislation on online behavioral advertising and in November an international conference of government officials will likely approve a global standard on privacy protection.
But what’s the best way to protect privacy? David Vladeck, the new head of consumer protection for the Federal Trade Commission, has said he is dissatisfied with the existing policy frameworks for thinking about the issue. He’s right. The traditional framework of fair information practices is severely limited by excessive reliance on informed consent. Restrictions on disclosure are impractical in a digital world where information collection is ubiquitous, where apparently anonymous or de-identified information can be associated with a specific person and where one person’s decision to share information can adversely affect others who choose to remain silent. The alternative “harm” framework, however, seems to allow all sorts of privacy violations except when specific, tangible harm results. If an online marketer secretly tracks you on the Internet and serves you ads based on which web sites you visited, well, where’s the harm? How are you hurt by getting targeted ads instead of generic ones? And yet people feel that secret tracking is the essence of a privacy violation.
The traditional harms approach is clearly too limited. It defines the notion of harm so narrowly that privacy itself is no longer at stake. And yet its focus on outcomes and substantive protection rather than process is a step in the right direction.
Part I of this paper describes the limitations on the informed consent model, suggesting that informed consent is neither necessary nor sufficient for a legitimate information practice. Part II explores the idea of negative privacy externalities, illustrating several ways in which data can be leaky. It also discusses the ways in which the indirect disclosure of information can harm individuals through invidious discrimination, inefficient product variety restrictions on access, and price discrimination. Part III outlines the unfairness model, explores the three-part test for unfairness under the Federal Trade Commission Act, and compares the model to similar privacy frameworks that have been proposed as additions to (or replacements for) the informed consent model. Part IV explores how to apply the unfairness framework to some current privacy issues involving online behavioral advertising and social networks.