Information Privacy and the Inference Economy

Abstract

Information privacy is in trouble. Contemporary information privacy protections emphasize individuals’ control over their own personal information. But machine learning, the leading form of artificial intelligence, facilitates an inference economy that strains this protective approach past its breaking point. Machine learning provides pathways to use data and make probabilistic predictions—inferences—that are inadequately addressed by the current regime. For one, seemingly innocuous or irrelevant data can generate machine learning insights, making it impossible for an individual to anticipate what kinds of data warrant protection. Moreover, it is possible to aggregate myriad individuals’ data within machine learning models, identify patterns, and then apply the patterns to make inferences about other people who may or may not be part of the original data set. The inferential pathways created by such models shift away from “your” data, and towards a new category of “information that might be about you.” And because our law assumes that privacy is about personal, identifiable information, we miss the privacy interests implicated when aggregated data that is neither personal nor identifiable can be used to make inferences about you, me, and others.

This Article contends that accounting for the power and peril of inferences requires reframing information privacy governance as a network of organizational relationships to manage—not merely a set of data flows to constrain. The status quo magnifies the power of organizations that collect and process data, while disempowering the people who provide data and who are affected by data-driven decisions. It ignores the triangular relationship among collectors, processors, and people and, in particular, disregards the co-dependencies between organizations that collect data and organizations that process data to draw inferences. It is past time to rework the structure of our regulatory protections. This Article provides a framework to move forward. Accounting for organizational relationships reveals new sites for regulatory intervention and offers a more auspicious strategy to contend with the impact of data on human lives in our inference economy.

Keywords: Information Privacy, Data Privacy, Privacy Law, Law and Technology, AI and Law, Administrative Law, Regulation, Legislation, Machine Learning