Comments on Developing the Administration’s Approach to Consumer Privacy

27 Pages Posted: 3 Feb 2020

See all articles by Geoffrey A. Manne

Geoffrey A. Manne

International Center for Law & Economics (ICLE)

Kristian Stout

International Center for Law & Economics (ICLE)

Dirk Auer

International Center for Law & Economics (ICLE)

Date Written: November 13, 2018

Abstract

Although the US does not have a single, omnibus, privacy regulation, this does not mean that the US does not have “privacy law.” In the US, there already exist generally applicable laws at both the federal and state level that provide a wide scope of protection for individuals, including consumer protection laws that apply to companies’ data use and security practices, as well as those that have been developed in common law (property, contract, and tort) and criminal codes.

In addition, there are specific regulations pertaining to certain kinds of information, such as medical records, personal information collected online from children, credit reporting, as well as the use of data in a manner that might lead to certain kinds of illegal discrimination.

Getting regulation right is always difficult, but it is all the more so when confronting evolving technology, inconsistent and varied consumer demand, and intertwined economic effects — all conditions that confront online privacy regulation. Given this complexity, and the limits of our knowledge regarding consumer preferences and business conduct in this area, ICLE’s evaluation suggests that the proper method of regulating privacy is, for now at least, the course that the Federal Trade Commission (FTC) has historically taken: case-by-case examination of actual privacy harms, without ex ante regulations, coupled with narrow legislation targeted at problematic uses of personal information.

Many (if not most) services on the Internet are offered on the basis that user data can, within certain limits, be used by a firm to enhance its services and support its business model, thereby generating benefits to users. To varying degrees (and with varying degrees of granularity), services offer consumers the opportunity to opt-out of this consent to the use of their data, although in some cases the only way effectively to opt-out is to refrain from using a service at all.

Critics of the US approach to privacy sometimes advocate for a move to an opt-in regime (as is the case in the GDPR). But the problem is that “‘[o]pt-in’ provides no greater privacy protection than ‘opt-out’ but imposes significantly higher costs with dramatically different legal and economic implications.” In staunching the flow of data, opt-in regimes impose both direct and indirect costs on the economy and on consumers, reducing the value of certain products and services not only to the individual who does not opt-in, but to the broader network as a whole. Not surprisingly, these effects fall disproportionately on the relatively poor and the less technology-literate.

U.S. privacy regulators have generally evidenced admirable restraint and assessed the relevant tradeoffs, recognizing that the authorized collection and use of consumer information by data companies confers enormous benefits, even as it entails some risks. Indeed, the overwhelming conclusion of decades of intense scrutiny is that the application of ex ante privacy principles across industries is a fraught exercise as each firm faces a different set of consumer expectations about its provision of innovative services, including privacy protections.

This does not mean that privacy regulation should never be debated, nor that a more prescriptive regime should never be considered. But any such efforts must begin with the collective wisdom of the agencies, scholars, and policy makers that have been operating in this space for decades, and with a deep understanding of the business realities and consumer welfare effects involved.

Suggested Citation

Manne, Geoffrey and Stout, Kristian and Auer, Dirk, Comments on Developing the Administration’s Approach to Consumer Privacy (November 13, 2018). Available at SSRN: https://ssrn.com/abstract=3384395 or http://dx.doi.org/10.2139/ssrn.3384395

Geoffrey Manne (Contact Author)

International Center for Law & Economics (ICLE) ( email )

2117 NE Oregon St.
Suite 501
Portland, OR 97232
United States
503-770-0076 (Phone)

HOME PAGE: http://www.laweconcenter.org

Kristian Stout

International Center for Law & Economics (ICLE) ( email )

2117 NE Oregon St.
Ste 501
Portland, OR Oregon 97232
United States
5037700076 (Phone)
5037700076 (Fax)

HOME PAGE: http://www.laweconcenter.org

Dirk Auer

International Center for Law & Economics (ICLE) ( email )

5005 SW Meadows Rd.
Suite 300
Lake Oswego, OR 97035
United States

HOME PAGE: http://https://laweconcenter.org/author/dirkauer/

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
18
Abstract Views
244
PlumX Metrics