FC: No broad U.S. privacy laws costs "tens of billions," study says

From: Declan McCullagh (declanat_private)
Date: Tue Mar 26 2002 - 22:21:24 PST

  • Next message: Declan McCullagh: "FC: Former Virginia guv Gilmore waxes libertarian on nat'l id cards"

    [Thanks to Robert for sending this along. Do any of the authors of the 
    "business privacy papers" (probably better characterized as free-market 
    privacy papers) want to reply? Also, "privacy" laws in this context are 
    mostly government regulations governing business' collection, use, 
    retention, and transfer of certain types of data. --Declan]
    Date: Tue, 26 Mar 2002 12:01:14 -0500
    From: Robert Gellman <rgellmanat_private>
    To: declanat_private
    Subject: A new report on Privacy, Consumers, and Costs
    Declan-- Don't know if this is of interest to you and your list.
    You might be interested in a new (released March 26, 2002)
    on Privacy, Consumers, and Costs.  The purpose of the paper is to
    examine how the lack of privacy costs consumers and why some recent
    business studies of privacy costs are biased and incomplete.
    Support for the paper came from the Digital Media Forum. The Digital
    Media Forum is a project of the Ford Foundation to encourage
    collaboration among its grantees in the area of media policy. This paper
    reflects the views of the author, not necessarily the views of the Ford
    Foundation, Digital Media Forum, or participants in the Digital Media
    The paper's executive summary can be found below the signature box of
    this message.  The entire paper (approximately 37 pages) is available
    through websites of the Electronic Privacy Information Center and the
    Center for Democracy and Technology
    http://www.epic.org/reports/dmfprivacy.html or
    http://www.cdt.org/publications/dmfprivacy.shtml or
    + + + + + + + + + + + + + + + + + + + + + + +
    + Robert Gellman      <rgellmanat_private>   +
    + Privacy and Information Policy Consultant +
    + 419 Fifth Street SE                       +
    + Washington, DC 20003                      +
    + 202-543-7923 (phone)  202-547-8287 (fax)  +
    + + + + + + + + + + + + + + + + + + + + + + +
    Privacy, Consumers, and Costs
    How The Lack of Privacy Costs Consumers and
    Why Business Studies of Privacy Costs are Biased and Incomplete
    by Robert Gellman
    Executive Summary
    Privacy is an elusive, value-laden concept, and it is hard to reach
    consensus on a definition.  In recent, self-serving studies, the
    business community seized upon this lack of clarity to distort debates
    about the true costs of privacy - costs to individuals, society and to
    the business community itself.  These studies have led to a mainly
    one-sided public discussion of privacy, overstating the costs to
    businesses, ignoring the costs consumers incur to protect their privacy,
    and understating the benefits that privacy offers to commerce and to
    The cost of privacy is a legitimate issue, but the studies and the
    conclusions drawn from them have serious flaws.  They suggest that:
     consumers' demands for privacy are irrational and that consumers do
    not know what is in their own interest,
     unrestricted trafficking in personal information - the very thing that
    business wants - always benefits individuals and
     privacy can be evaluated only on the basis of monetary costs and
    In fact, the costs incurred by both business and individuals due to
    incomplete or insufficient privacy protections reach tens of billions of
    dollars every year.
    Shortcomings with Business Studies
    The privacy cost studies sponsored by the business community suffer from
    a variety of defects.  Studies of the credit reporting system seek to
    prove that the free flow of credit records benefits consumers while
    ignoring the benefits of legislation that gives consumers a wide range
    of privacy protections and legal remedies.  These policies demonstrate
    how privacy can be compatible with business success in the marketplace.
    Some studies, offered as objective but written by trade association
    employees, rely on old business models that assume that past
    information-intensive marketing methods are the only way to do business
    in the future.  New ways to find consumers are ignored, as is the amount
    of business lost under current practices because of privacy concerns.
    Calculating consumer benefits is the basis for some cost/benefit
    estimates.  However, the definition of consumer benefits is so broad as
    to include the nonconsensual sale and exploitation of consumer
    information that most, if not all, consumers would reject, if given an
    informed choice.
    Costs to Business of Not Protecting Privacy
    The absence of privacy rules imposes expenses on businesses that many
    industry-sponsored studies ignore when calculating the costs of
    privacy.  For example, consumers routinely abandon shopping carts on
    websites because of demands for too much personal information.  Analysts
    estimate that Internet retail sales lost due to privacy concerns may be
    as much as $18 billion.
    Attempts by business to show losses from privacy protections often
    reflect only traditional models of marketing that may be less effective
    than privacy-friendly approaches.  Relationship marketing - based on the
    use of large amounts of personal information - may not be as effective
    as permission marketing, where consumers select what advertising they
    want to see.
    Because many other countries have comprehensive privacy laws, the United
    States is significantly behind international privacy standards.  The
    European Union limits the export of data to organizations in countries
    that do not have adequate privacy protections.  The result is lost
    opportunities for U.S. businesses and higher costs when providing
    privacy protections for imported personal data.  Better U.S. privacy
    protections could expand international business opportunities and reduce
    Accumulated personal data is increasingly attractive to law enforcement
    agencies, other businesses, and private litigants.  Businesses are
    spending more and more time and money responding to subpoenas for their
    compilations of personal data.
    Investors lost hundreds of billions of dollars in companies with
    business models based on exploiting personal information obtained from
    Internet users.  The lack of privacy protections led many to believe
    wrongly that personal data could be exploited without limit.
    The Costs Consumers Incur When Privacy Is Not Protected
    When laws and practices do not provide adequate protections for personal
    information, individuals act to protect themselves and their privacy.
    The costs incurred by individuals to protect themselves from unwanted
    view or intrusion constitute a privacy toll paid in both dollars and
    time.  The privacy toll includes costs associated with higher prices,
    stopping junk mail and telemarketing calls, avoiding identity theft and
    protecting privacy on the Internet.  A privacy sensitive family could
    spend between $200 and $300 and many hours annually to protect their
    Supermarket frequent shopper cards and other registration and monitoring
    programs coerce consumers to sell their personal information for lower
    prices at the cash register.  Customers unaware of or unwilling to sign
    up for these programs often pay more.
    Traditional junk mail is a longstanding consequence of the inability of
    individuals to control the collection, compilation, and sale of their
    personal information.  The average person receives more than ten pieces
    of junk mail each week, of which nearly half is discarded unopened and
    unread.  Opting out of junk mail often requires writing multiple
    letters, which is a small expense, but still a significant barrier for
    most individuals.
    About 80% of Americans strongly object to receiving unsolicited sales
    calls and, to prevent or deter these telemarketing calls, many
    households buy services such as Caller ID, call waiting, answering
    machines or voice mail, and unlisted or unpublished numbers.  Some
    estimate that 25% of households pay an average of $1.50/ month to be
    unlisted.  The total price that telephone subscribers pay for
    privacy-protecting services is more than $400 million/year.
    Identity theft is a growing threat that creates financial and other
    hardships for hundreds of thousands of individuals each year.  Identity
    theft results in part from the ready availability of personal
    information and the lack of protections that would give individuals more
    control over that information.  It can take years of hard work and
    hundreds or thousands of dollars in out-of-pocket expense before all
    vestiges of identify theft are removed from a victim's record.  In the
    interim, a victim of identity theft may be unable to obtain a job,
    purchase a car, or qualify for a mortgage.  Government agencies advise
    individuals seeking protection against identity theft to purchase copies
    of credit reports annually or to subscribe to credit watch services.
    Annual costs for a family can easily exceed one hundred dollars annually
    while estimates of losses for financial institutions appear to be in the
    hundreds of millions.  Identity theft undermines consumer confidence,
    deters the growth of electronic commerce, and increases costs that may
    be passed on to consumers.
    Unwanted commercial electronic mail, often called spam, imposes costs on
    Internet users who cannot control the collection and sale of their email
    addresses.  Users spend hours each year downloading and deleting spam.
    Spam also raises costs for Internet providers, delays service to users,
    and undermines the vitality of the Internet as a means of open
    communications.  Estimates are that worldwide costs of spam range from
    $8-10 billion.
    Broader effects of the lack of privacy cannot be measured in dollars.
    The effects on individuals and institutions due to the evolving "dossier
    society" are significant and often unwelcome.  Non-economic interests
    protected by privacy policy and laws include avoiding solicitations, the
    exercise of First Amendment rights, and protection of children.
    POLITECH -- Declan McCullagh's politics and technology mailing list
    You may redistribute this message freely if you include this notice.
    Declan McCullagh's photographs are at http://www.mccullagh.org/
    To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
    This message is archived at http://www.politechbot.com/
    Politech dinner in SF on 4/16: http://www.politechbot.com/events/cfp2002/

    This archive was generated by hypermail 2b30 : Tue Mar 26 2002 - 23:39:55 PST