Model(ing) Privacy: Empirical Approaches to Privacy Law & Governance
54 Pages Posted: 27 Jun 2018
Date Written: June 7, 2018
Privacy can be difficult for people to conceptualize, including for the policymakers charged with designing, interpreting, and enforcing privacy law. In both consumer privacy law and Fourth Amendment jurisprudence, the privacy protections afforded to individuals are shaped by the ability of governmental decision-makers to assess privacy norms, which they are rarely in a position to do accurately. In consumer privacy law, privacy norms are assessed through individuals’ engagement with notice and choice mechanisms, a paradigm that assumes that labyrinthine disclosures are sufficient to facilitate users’ control over their data, while ignoring the impact of informational asymmetries, nuanced contextual factors, and cognitive limitations that prevents meaningful privacy decision-making. The failure of notice and choice, as well as ineffective privacy survey methodologies, have fueled the narrative of the so-called privacy paradox, and undermined the basis for strong and comprehensive consumer privacy protections. In criminal law, Fourth Amendment protections are determined by a judge’s perception of privacy norms, which often conflicts with that of the average person. The result is a policy narrative shaped by a misunderstanding of privacy norms, and privacy legal regimes that lag far behind what the law is purported to protect.
While policymakers have a hard time understanding the subtle factors influencing privacy decision-making or deducing seemingly contradictory privacy incentives, it is an area where new empirical approaches have begun to excel. Researchers have used empirical techniques like machine learning, natural language processing, and crowdsourcing to explain the complexities of privacy decision-making, and to illustrate the nuances surrounding privacy decision-making that opinion surveys can often fail to grasp. Recent work has focused on eliciting privacy norms through the use of crowdsourcing; modeling individual privacy preferences and expectations using machine learning; extracting necessary information from privacy policies through the use of natural language processing; modeling AI assistants based on context and user preferences to predict (or nudge) future user decisions; and creative combinations thereof. Modeling user behavior and crowdsourced privacy norms can provide judges, regulators, and legislators with a more accurate and nuanced sense of privacy norms for future cases and policy discussions. Encouraging the implementation of proactive privacy tools, such as automated annotation of privacy policies and nudging assistants, can help bridge the gap separating user expectations, user behavior, and how both are understood under existing laws. While the use of this research in privacy law and policy cannot fundamentally transform the structural flaws that skew regulators’ perceptions of societal norms, it can at least correct the worst of those excesses, and allow privacy law to function closer to the way it is designed to do.
Keywords: privacy, consumer protection, Fourth Amendment, law
Suggested Citation: Suggested Citation