Database Nation

The upside of "zero privacy"

Declan McCullagh from the June 2004 issue

(Page 3 of 5)

The privacy torts usually are said to date back to an influential Harvard Law Review article written in 1890 by Samuel Warren and future Supreme Court Justice Louis Brandeis, titled "The Right to Privacy." They complained that journalists were being too aggressive and nosy: "Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life....For years there has been a feeling that the law must afford some remedy for the unauthorized circulation of portraits of private persons; and the evil of invasion of privacy by the newspapers, long keenly felt, has been but recently discussed by an able writer."

Permission to Speak Freely

What's shocking to modern eyes is the degree to which Warren and Brandeis wanted to muzzle the press, in a way that today would be viewed as an unacceptable violation of the First Amendment. Warren was miffed to find details of his personal life described in the society pages of the Boston newspapers -- the 19th-century equivalent of The National Enquirer or the New York Post's Page Six column. He and Brandeis complained: "The press is overstepping in every direction the obvious bounds of propriety and of decency. Gossip is no longer the resource of the idle and of the vicious, but has become a trade, which is pursued with industry as well as effrontery. To satisfy a prurient taste the details of sexual relations are spread broadcast in the columns of the daily papers."

Warren and Brandeis's article brings into sharp relief the tension between privacy and free speech. In the 114 years since the essay was published, privacy has become a remarkably wiggly and fluid notion, encompassing the right to an abortion or contraception, the right to be free of telemarketers and Internet cookies, and the right to keep government goons out of your home.

A cornerstone of the American approach to informa-tion flows in the private sector is that in general they strongly favor free speech over privacy. With a few exceptions, the default assumption for data exchanges is an "opt-out" standard, under which information you provide to a company is theirs to use unless you say otherwise. Under an "opt-in" standard, by contrast, the data are to be kept private unless you explicitly give your permission. Defaults are important: Research from the Columbia Business School suggests that people tend not to change the options they have been presented.

The European Union has adopted a general opt-in rule aimed at damming the flow of information. Known as the European Data Directive, the European rule says personal information generally may not be "processed" without the subject's unambiguous consent.

As you might expect, the European rule has run head on into the law of unintended consequences, and the results have hurt activists as well as consumers. Jacob Palme, a professor of computer science at Stockholm University, has documented how Sweden's implementation of the European directive has imperiled free speech. Swedish regulators prevented American Airlines from transferring customer information from Europe to its SABRE reservation system in the United States. Regulators prosecuted an animal rights activist who published a list of fur producers and a consumer activist who criticized a large bank on a Web page that named the bank's directors. "Looking at the way the law is used," Palme concludes, "one can see that unpopular or controversial opinions are suppressed."

Nevertheless, at the prodding of pro-regulation privacy activists, the U.S. has veered in the same direction in the last few years. "The question is, 'Is information being used in a way that has social utility?'" says Chris Hoofnagle, legislative counsel for the Electronic Privacy Information Center in Washington, D.C. "If it's simply done to profit-maximize, there are questions about whether consumers are really getting the benefit. We're searching for a framework of protections very similar to the E.U. privacy directive that regulates the collection and use of information across all contexts rather than the piecemeal approach we currently have."

By guaranteeing freedom of speech, the First Amendment to the U.S. Constitution poses an obstacle to laws that interfere with the free flow of information. The U.S. Supreme Court has struck down some ordinances that required opt-in consent, including a law enacted by the city of Struthers, Ohio, that banned uninvited door-to-door solicitations and a federal law that required affirmative consent from recipients of communist propaganda.

Optional Costs

Constitutional questions aside, how would an opt-in rule work? Consider how it would affect the MBNA Corporation, a financial services company that became a multibillion-dollar success story not long after it was incorporated in 1981. MBNA grew to more than 51 million customers through its aggressive "affinity" program, which let a number of groups -- NASCAR, universities, the Atlanta Braves, and so on -- market credit cards imprinted with their own logos. Not counting its existing customers, in 2000 MBNA had a database of 800 million names of prospective cardholders provided by affinity groups, but it could afford to send only 400 million solicitations.

Writing in the Duke Law Journal in February 2003, Indiana law professor Fred Cate and Georgetown business professor Michael Staten described how MBNA winnowed its list down to an affordable size through aggressive information sharing. MBNA first looked at public records and then, by exchanging information with its affiliates, tried to evaluate the creditworthiness of the remaining names on the list. The remaining 400 million people received solicitations with the endorsement of the affinity group to which they belonged.

Staten and Cate's conclusion: "Mandatory opt-in requirements on MBNA's operations would impair MBNA's affinity group business model, raise account acquisition costs and lower profits, reduce the supply of credit and raise credit card prices, generate more offers to uninterested or unqualified consumers and raise the number of missed opportunities for qualified consumers, and impair efforts to prevent fraud and identity theft." Under an opt-in rule, recipients of the offers would "be more risky and less profitable than MBNA's target group reached under the current rules. As a result, MBNA's delinquency and charge-off rates will rise, relative to its current experience, thereby imposing additional costs that will be passed along to all of MBNA's customers."

MBNA's experience highlights how data exchanges fuel the economic engine of an information society. Choking a society's data flow by setting the default rule to "no" restricts that fuel. An opt-in regime suffocates the economic activity that takes place when businesses use personal information to offer new products and tell customers about them without obtaining explicit permission in advance. Because it assumes customers who have expressed no preference would object to a solicitation, it is more expensive than an opt-out approach.

"Suppose you're a financial company and you have an idea," says Solveig Singleton, a lawyer at the pro-market Competitive Enterprise Institute in Washington, D.C. "Say you'd like to offer a mortgage for first-time home buyers. You design a flyer and look at your expenses and realize it would be pretty expensive to send it to everyone. Instead, you want to get some information to lower your costs and [target just a subset]. If you don't have that information, the costs of identifying your potential customer base are so high you don't offer the product at all."