“Tool Without A Handle” “Justified Regulation (Part 2 – Privacy)

This blog moves from discussion of cases of justified and widely supported regulation to examine current topics that are more complex and more hotly contested. A currently popular topic in privacy is the potential for information flows to distort the ordinary balance of economic power,^[1] and the concomitant impact on individuals.  It’s my contention that a better understanding of this topic can come from framing the issue using the “tool” metaphor, coupled with a more granular understanding of the privacy values at stake. 

Current discussions about privacy, “big data,” and economic power have illustrated the need for better clarity about privacy issues, harms and violations.  In some cases, privacy issues have been framed as a debate over whether the core issue is individual control of personal information or corporate / government control.^[2]  In some cases, the topic is framed as a civil rights issue.^[3]  In other views, it is a “due process” issue.^[4]  Some notable analyses of privacy issues include observations on a “taxonomy” of privacy,^[5] delineation of “subjective” and “objective” privacy harms,^[6] and distinctions between “tangible,” “intangible,” and “abstract” privacy harms.^[7]

This blog draws a more basic distinction - between “privacy” questions on one hand, and “fairness” questions on the other.  I believe the “privacy” conversation is not well served when we fail to carefully distinguish “privacy” and “fairness” issues.  Moreover, for much of current privacy law and policy, the debate is not really about privacy so much as it is about “fairness.”^[8]

Rules and beliefs about “privacy” (individual rights against publicity or surveillance) address a different and separate set of concerns than “fairness” (including civil rights, consumer protection, and economic opportunity). Too often, these considerations are lumped together. As the introductory letter to the 2012 White House Report on Consumer Data Privacy put it,

Justice Brandeis taught us that privacy is the “right to be let alone,” but we also know that privacy is about much more than just solitude or secrecy. Citizens who feel protected from misuse of their personal information feel free to engage in commerce, to participate in the political process, or to seek needed health care. This is why we have laws that protect financial privacy and health privacy, and that protect consumers against unfair and deceptive uses of their information. ^[9]

Put differently, “privacy as solitude” is about the freedom to choose whether or not certain information linked (or linkable) to you is shared or even made public.  “Privacy as fairness,” in contrast, concerns personal data that is already volunteered in some fashion or context, and aims to set rules about the relative rights of the data subject and of public and private sector parties who collect and use that data.  Both privacy and fairness are important, including for the reasons the White House report notes, but they ultimately derive from different sets of values.

Here is a quick chart illustrating differences between “solitude” and “fairness” topics^[10]:  Please note, by "topics" I mean "topics of discussion"; I do not imply here whether any of these should (or should not) be classified as privacy "violations," "harms," or be subject to regulation.

One reason to recommend distinguishing “privacy” from “fairness” is there is broad social consensus about “solitude” concerns – as discussed in my prior blog post.^[11]  However, debates about economic fairness and power imbalances are often informed by different (and irreconcilable) political philosophies.  Such debates are an important part of democracy, but less likely to lead to at a broad and strong social consensus.^[12]

Additionally (or as a result), the “fairness” issues are relatively more complicated.  As FTC Commissioner Julie Brill recently noted, “[w]hether and how consumer profiles based on big data are used to discriminate or treat consumers unfairly involves many subtle and difficult questions.”^[13]  So it’s helpful to start by asking what “fairness” principles are actually well-settled, and to see how any of them might illuminate concerns that are more contested.  Among the well-settled rules of “privacy as fairness” are:

·       Right of individuals to have decisions to issue credit or offer employment based on accurate data, and to redress if decisions are based on incorrect data.  For example, rights protected by the Fair Credit Reporting Act.^[14]

·       Right of individuals to some level of notice of data collection and use. Examples include the Privacy Act of 1974 (vis-à-vis the federal government),^[15] the FTC Act,^[16] California’s Online Privacy Protection Act (requiring privacy notices),^[17] and widely accepted “fair information privacy practices.”^[18]

·       Right to have choices with respect to certain uses of data.  For example, laws governing financial, health, and telephone record data require, in certain circumstances, some form of notice and choice before data is shared with 3d parties for novel purposes.^[19]

·       Rights to security and accountability.  Individuals who entrust personal data to others may have remedies if data is handled carelessly or inconsistent with promises made.^[20]

Current issues can then be understood as questions about refining these well-settled principles.  For example:

●      What types of decisions are so important that law should regulate data accuracy? 

●      How far should the right of individuals to control use of data about them extend?

●      How do balance fairness interests, including fairness to those who make beneficial use of data? 

(N.B. - these are only examples; I take no position on any given issue in any current regulatory inquiry). 

This approach – starting from concepts of “fairness” and then determining how to apply them - may reduce the extent to which debates about “privacy principles” obscure the issues, and obscure the motives behind a given position. While there is broad consensus in support of “fairness,” there is less consensus as to what “fairness” entails in a given situation. Each “well-settled” rule of “privacy as fairness” is the application of a principle, not a principle itself.  Thus policy analysis of "fairness" issues should focus more on facts, and on cost-benefit analysis, than on an attempt to reason from first principles (which is better suited to issues of "privacy as solitude.")