FC: No broad U.S. privacy laws costs "tens of billions," study says

[Declan McCullagh <declan () well com>]

[Thanks to Robert for sending this along. Do any of the authors of the 
"business privacy papers" (probably better characterized as free-market 
privacy papers) want to reply? Also, "privacy" laws in this context are 
mostly government regulations governing business' collection, use, 
retention, and transfer of certain types of data. --Declan]

---

Date: Tue, 26 Mar 2002 12:01:14 -0500
From: Robert Gellman <rgellman () cais com>
To: declan () well com
Subject: A new report on Privacy, Consumers, and Costs

Declan-- Don't know if this is of interest to you and your list.

You might be interested in a new (released March 26, 2002)
on Privacy, Consumers, and Costs.  The purpose of the paper is to
examine how the lack of privacy costs consumers and why some recent
business studies of privacy costs are biased and incomplete.

Support for the paper came from the Digital Media Forum. The Digital
Media Forum is a project of the Ford Foundation to encourage
collaboration among its grantees in the area of media policy. This paper
reflects the views of the author, not necessarily the views of the Ford
Foundation, Digital Media Forum, or participants in the Digital Media
Forum.

The paper's executive summary can be found below the signature box of
this message.  The entire paper (approximately 37 pages) is available
through websites of the Electronic Privacy Information Center and the
Center for Democracy and Technology

http://www.epic.org/reports/dmfprivacy.html or
http://www.epic.org/reports/dmfprivacy.pdf

http://www.cdt.org/publications/dmfprivacy.shtml or
http://www.cdt.org/publications/dmfprivacy.pdf

Bob

--
+ + + + + + + + + + + + + + + + + + + + + + +
+ Robert Gellman      <rgellman () cais com>   +
+ Privacy and Information Policy Consultant +
+ 419 Fifth Street SE                       +
+ Washington, DC 20003                      +
+ 202-543-7923 (phone)  202-547-8287 (fax)  +
+ + + + + + + + + + + + + + + + + + + + + + +

Privacy, Consumers, and Costs

How The Lack of Privacy Costs Consumers and
Why Business Studies of Privacy Costs are Biased and Incomplete

by Robert Gellman

Executive Summary

Privacy is an elusive, value-laden concept, and it is hard to reach
consensus on a definition.  In recent, self-serving studies, the
business community seized upon this lack of clarity to distort debates
about the true costs of privacy - costs to individuals, society and to
the business community itself.  These studies have led to a mainly
one-sided public discussion of privacy, overstating the costs to
businesses, ignoring the costs consumers incur to protect their privacy,
and understating the benefits that privacy offers to commerce and to
society.

The cost of privacy is a legitimate issue, but the studies and the
conclusions drawn from them have serious flaws.  They suggest that:

· consumers' demands for privacy are irrational and that consumers do
not know what is in their own interest,
· unrestricted trafficking in personal information - the very thing that
business wants - always benefits individuals and
· privacy can be evaluated only on the basis of monetary costs and
benefits.

In fact, the costs incurred by both business and individuals due to
incomplete or insufficient privacy protections reach tens of billions of
dollars every year.

Shortcomings with Business Studies

The privacy cost studies sponsored by the business community suffer from
a variety of defects.  Studies of the credit reporting system seek to
prove that the free flow of credit records benefits consumers while
ignoring the benefits of legislation that gives consumers a wide range
of privacy protections and legal remedies.  These policies demonstrate
how privacy can be compatible with business success in the marketplace.

Some studies, offered as objective but written by trade association
employees, rely on old business models that assume that past
information-intensive marketing methods are the only way to do business
in the future.  New ways to find consumers are ignored, as is the amount
of business lost under current practices because of privacy concerns.

Calculating consumer benefits is the basis for some cost/benefit
estimates.  However, the definition of consumer benefits is so broad as
to include the nonconsensual sale and exploitation of consumer
information that most, if not all, consumers would reject, if given an
informed choice.

Costs to Business of Not Protecting Privacy

The absence of privacy rules imposes expenses on businesses that many
industry-sponsored studies ignore when calculating the costs of
privacy.  For example, consumers routinely abandon shopping carts on
websites because of demands for too much personal information.  Analysts
estimate that Internet retail sales lost due to privacy concerns may be
as much as $18 billion.

Attempts by business to show losses from privacy protections often
reflect only traditional models of marketing that may be less effective
than privacy-friendly approaches.  Relationship marketing - based on the
use of large amounts of personal information - may not be as effective
as permission marketing, where consumers select what advertising they
want to see.

Because many other countries have comprehensive privacy laws, the United
States is significantly behind international privacy standards.  The
European Union limits the export of data to organizations in countries
that do not have adequate privacy protections.  The result is lost
opportunities for U.S. businesses and higher costs when providing
privacy protections for imported personal data.  Better U.S. privacy
protections could expand international business opportunities and reduce
costs.

Accumulated personal data is increasingly attractive to law enforcement
agencies, other businesses, and private litigants.  Businesses are
spending more and more time and money responding to subpoenas for their
compilations of personal data.

Investors lost hundreds of billions of dollars in companies with
business models based on exploiting personal information obtained from
Internet users.  The lack of privacy protections led many to believe
wrongly that personal data could be exploited without limit.

The Costs Consumers Incur When Privacy Is Not Protected

When laws and practices do not provide adequate protections for personal
information, individuals act to protect themselves and their privacy.
The costs incurred by individuals to protect themselves from unwanted
view or intrusion constitute a privacy toll paid in both dollars and
time.  The privacy toll includes costs associated with higher prices,
stopping junk mail and telemarketing calls, avoiding identity theft and
protecting privacy on the Internet.  A privacy sensitive family could
spend between $200 and $300 and many hours annually to protect their
privacy.

Supermarket frequent shopper cards and other registration and monitoring
programs coerce consumers to sell their personal information for lower
prices at the cash register.  Customers unaware of or unwilling to sign
up for these programs often pay more.

Traditional junk mail is a longstanding consequence of the inability of
individuals to control the collection, compilation, and sale of their
personal information.  The average person receives more than ten pieces
of junk mail each week, of which nearly half is discarded unopened and
unread.  Opting out of junk mail often requires writing multiple
letters, which is a small expense, but still a significant barrier for
most individuals.

About 80% of Americans strongly object to receiving unsolicited sales
calls and, to prevent or deter these telemarketing calls, many
households buy services such as Caller ID, call waiting, answering
machines or voice mail, and unlisted or unpublished numbers.  Some
estimate that 25% of households pay an average of $1.50/ month to be
unlisted.  The total price that telephone subscribers pay for
privacy-protecting services is more than $400 million/year.

Identity theft is a growing threat that creates financial and other
hardships for hundreds of thousands of individuals each year.  Identity
theft results in part from the ready availability of personal
information and the lack of protections that would give individuals more
control over that information.  It can take years of hard work and
hundreds or thousands of dollars in out-of-pocket expense before all
vestiges of identify theft are removed from a victim's record.  In the
interim, a victim of identity theft may be unable to obtain a job,
purchase a car, or qualify for a mortgage.  Government agencies advise
individuals seeking protection against identity theft to purchase copies
of credit reports annually or to subscribe to credit watch services.
Annual costs for a family can easily exceed one hundred dollars annually
while estimates of losses for financial institutions appear to be in the
hundreds of millions.  Identity theft undermines consumer confidence,
deters the growth of electronic commerce, and increases costs that may
be passed on to consumers.

Unwanted commercial electronic mail, often called spam, imposes costs on
Internet users who cannot control the collection and sale of their email
addresses.  Users spend hours each year downloading and deleting spam.
Spam also raises costs for Internet providers, delays service to users,
and undermines the vitality of the Internet as a means of open
communications.  Estimates are that worldwide costs of spam range from
$8-10 billion.

Broader effects of the lack of privacy cannot be measured in dollars.
The effects on individuals and institutions due to the evolving "dossier
society" are significant and often unwelcome.  Non-economic interests
protected by privacy policy and laws include avoiding solicitations, the
exercise of First Amendment rights, and protection of children.




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
Declan McCullagh's photographs are at http://www.mccullagh.org/
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------
Politech dinner in SF on 4/16: http://www.politechbot.com/events/cfp2002/
-------------------------------------------------------------------------