Designing Privacy Legislation

Eakinomics: Designing Privacy Legislation The issue of privacy and the use of personal information — especially in the tech sphere — has garnered considerable public attention. Most followers of the issue expect that Congress will legislate on standards for privacy in the upcoming year. Not all privacy legislation is created equal, however, as carefully laid out by AAF's Will Rinehart. In particular, a threshold decision is whether a tech company can collect and use individuals' information without the explicit consent of the individual. In such an "opt-out regime," the default is in favor of collecting and using information. In contrast, in an "opt-in regime," use of personal information is barred unless the individual proactively gives his or her consent. In thinking about opt-in versus opt-out, several issues arise. The first is an educational issue. Some argue in favor of opt-in because it forces the individual to understand that their data is being collected and used. This is an empirical argument that turns out not to be true. People do understand that their information is being collected and used. As Rinehart notes: "In the most recent survey of its kind, economist Caleb Fuller found that nine out of ten people who use Google are aware of its business practice. Moreover, as users consume the service more, they are more aware of the information collection. For those who use Google about once a day, 78 percent are aware of information collection, but this number jumps up for those who use the site 'dozens of times a day or more' to 93 percent. Fuller also found that, 'of the 71% of all respondents who said they would prefer not to be tracked, a full 74% are unwilling to pay anything to retain their privacy.'" Second is the perceived value of privacy. The notion that so many individuals are "…unwilling to pay anything to retain their privacy" reminds us that privacy is not an absolute. Instead, there is an understood tradeoff between privacy of information and the value of the services that providing it enables. Again, Rinehart notes: "Pew found, for example, that 'there are a variety of circumstances under which many Americans would share personal information or permit surveillance in return for getting something of perceived value.' As those researchers found, many will willingly trade shopping histories for a discount card, but will not do the same when car insurance companies offer cheaper rates if a tracking device is installed." So people understand that their information is being used, and in some occasions think that the service justifies the collection. It makes sense, then, to minimize the number of times that the individual has to act. Rather than an opt-in approach that requires action by both the individual and firm for every occasion, it will be less costly to have an opt-out regime that reaches the right bottom line — information being collected in exchange for services that are valued — in the most economically efficient fashion.