The End of “Notice and Consent” as Meaningful Privacy Protection

Scott Peppet, Unraveling Privacy: The Personal Prospectus & the Threat of a Full Disclosure Future, 105 NW L. Rev. (forthcoming 2012), available on SSRN.

Scott Peppet’s article Unraveling Privacy: The Personal Prospectus & the Threat of a Full Disclosure Future has offered a fundamental challenge to reigning privacy paradigms in cyberlaw.  The old privacy law assumed that the right set of laws could help individuals hide embarrassing facts or disable invasive tracking.  The encroaching “full disclosure future” ensures that those who try to maintain secrets look like they have “something to hide.”  We used to be afraid of shadowy watchers collecting incriminating “digital dossiers;” now we worry over not measuring up when rivals reveal better “personal prospectuses” than our own.  Peppet’s elegant interweaving of social science and law renders us unable to rely on old privacy paradigms like “notice and consent” online.

Something to Hide

Traditionally, privacy law experts have assumed that a combination of markets and law can preserve privacy.  Firms will compete to offer more or less privacy.  Data collectors will provide customers with various “privacy settings” that tailor online services to optimize self-disclosure.  Some have proposed “personal data vaults” to manage the emanations of sensor networks that track movements and actions in real space.  Jonathan Zittrain’s classic article on “privication” proposed that the same technologies used by copyrightholders to monitor or stop dissemination of works could be adopted by patients concerned about the unauthorized spread of health information.

These technological “self-help” measures reflect privacy law’s consent paradigm.  Generally speaking, data dissemination is not deemed an invasion of privacy if it is consented to.  The consent paradigm requires individuals to decide whether or not, at any given time, they wish to protect their privacy.  The consent paradigm sense if one assumes that we live in a society where individuals have a relatively free choice whether or not to disclose critical data. But it becomes less realistic as individuals are under more pressure to compete by revealing important aspects of their past.

Peppet  observes that individuals are increasingly volunteering information about themselves in order to stand out from the crowd.  When such self-disclosure reaches a critical mass, a tipping point is reached, and everyone essentially must disclose in order to avoid being stigmatized as someone with something to hide. Economists of information label this process “unraveling.”  As “rapidly changing information technologies are making possible the low-cost sharing of verified personal information for economic reward,” the ultimate effect will be little different than if snooping employers, government officials, and other decisionmakers could directly demand damaging information.

Reorienting Cyberspace’s Privacy Law

Mainstream privacy scholarship has for too long attempted to adopt old tort law and ossified, sectoral statutes to rapidly changing technologies. The scholarship has paid too little attention to economic changes that have made cutthroat competition in the workplace and pervasive surveillance not only de rigeur, but intimately connected. While the data can be used in many cases for good, it would be naïve to ignore the extent to which it will be repurposed to classify and stigmatize individuals. In an age of diminishing expectations, intensive data gathering is a critical tool for deciding which human resources should be invested in, and which should be treated like flotsam.

If individuals had enough time to manage their personal data the way they manage their checkbooks and gardens, perhaps the consent paradigm that Peppet challenges would be a good foundation for addressing concerns about privacy.  If applicants could easily bargain with would-be employers over privacy, or patients with hospitals, perhaps we could rely on them to protect their interests.  But the actual occurrence of such acts of self-assertion and self-protection are rare.  Given the frequently abstract benefits that privacy and reputational integrity afford, they are almost always traded away for competitive economic advantage.  This process further erodes societal expectations of privacy.

It is to Peppet’s great credit that he squarely wrestles with this phenomenon before engaging in the legal interpretation (or drafting of proposed statutes and regulations) that is the more common end of privacy scholarship.  By bringing a lucid account of the “economics of signaling” to the field, Peppet may help it leapfrog its current infatuation with “notice and consent” models and move on in three directions.

First, we may simply seek to assure that informational harms cannot bring any individual below a social minimum.  In that case, a good bit of privacy regulation and cyberlaw is effectively absorbed into broader campaigns of social justice.  For example, if we eventually enter into an equilibrium where employers are demanding very positive “personal prospectuses,” and a large and growing class of individuals cannot provide such profiles, the answer may not be to regulate information flow so much as it is to take on the larger social task of reducing the stigma and material wants arising out of unemployment. Similarly, health privacy becomes less of a concern when insurers can’t deny coverage to anyone, including those with pre-existing conditions.

The second response, which might be addressed in some of Peppet’s future work, is to turn a Panoptic eye onto those who demand personal prospectuses, subjecting them to the same level of competition as they subject individuals to.  As we become “transparent citizens” (as Joel Reidenberg puts it), we should demand that the corporate and governmental authors of that trend reciprocate, and become more open about the data they gather.

Finally, as full disclosure dynamics render the average citizen’s life an open book, one-time privacy advocates might seek a different end: equalizing the surveillance that is now being aimed disproportionately at the vulnerable.  Large corporations have used both privacy and trade secrecy laws to deflect scrutiny.  As David Brin suggested in his book The Transparent Society, the “full disclosure future” might be a little less scary for ordinary citizens and consumers if government and business powers had to live up to the same standards of openness that they impose on others.