FC: Robert Gellman replies to privacy study critics, more responses

From: Declan McCullagh (declanat_private)
Date: Thu Mar 28 2002 - 21:05:01 PST

  • Next message: Declan McCullagh: "FC: Google bans ads bought by Church of Scientology critics"

    [Robert's initial response was: "Thanks for the offer for a debate. I don't 
    know that a point-counterpoint in e-mail fashion would be particularly
    enlightening." I'm glad he changed his mind! :) I've combined multiple 
    threads into one for this message. --Declan]
    Date: Thu, 28 Mar 2002 10:07:17 -0500
    From: Robert Gellman <rgellmanat_private>
    To: Declan McCullagh <declanat_private>
    CC: wfasonat_private
    Subject: Re: Texas private investigator replies to Robert Gellman on privacy
    Declan's report of my unwillingness to participate in the discussion
    here was premature.  I am reluctant, but I will respond to Bill Fason's
    comment on ID Theft.
    The report says "Identity theft occurs for many reasons, and the routine
    trafficking in personal information is a significant contributing
    cause."  The report offers no recommendations for regulation or
    I don't understand his defense of ChoicePoint and other companies.  They
    are not mentioned in the report.  My report cites several independent
    studies, including one from a private organization operated by a major
    information company, as stating that Internet accessibility of personal
    information has contributed to ID Theft.
    Mr. Fason asserts that "ChoicePoint's online system has been used in
    zero cases of identity fraud".  I would like to know the basis for this
    statement.  Unless there is some independent audit of ChoicePoint, its
    employees, and its customers, I am not prepared to accept that
    conclusion.  I don't mean to single out ChoicePoint here.  Mr. Fason
    named the company, not me.   Most cases of ID theft go uninvestigated so
    we simply do not know all of the causes or sources of data.  There are
    hundreds of thousands of cases of ID theft annually.  To suggest that
    readily available, online sources of personal information are not a
    contributing factor in ANY of these cases is not a conclusion that I can
    reach without evidence.  I hear often from information companies that
    their records are never abused, but when I ask if the company actually
    looked for evidence, the answer is invariably no.  I have never heard of
    a database that was never misused by by the company (or agency) that
    runs it or by its customers.
    + + + + + + + + + + + + + + + + + + + + + + +
    + Robert Gellman      <rgellmanat_private>   +
    + Privacy and Information Policy Consultant +
    + 419 Fifth Street SE                       +
    + Washington, DC 20003                      +
    + 202-543-7923 (phone)  202-547-8287 (fax)  +
    + + + + + + + + + + + + + + + + + + + + + + +
    From: "Singleton, Norman" <Norman.Singletonat_private>
    To: declanat_private
    Subject: RE: Free-market economist replies to Robert Gellman privacy paper
    Date: Thu, 28 Mar 2002 09:52:35 -0500
      There are many postal companies (e.g.
    "Mailboxes Etc.") that will give you a valid looking mailing
    address that is the same as a post office box.
    actually, thanks to the Post Office, the privacy value of getting a box 
    from an organization like Mailboxes etc. has been significantly diminished.
    Norman Kirk Singleton
    Legislative Director
    Congressman Ron Paul
    US House of Representatives
    Date: Thu, 28 Mar 2002 09:05:03 -0800
    From: lizard <lizardat_private>
    To: declanat_private
    CC: politechat_private, gellman-commentsat_private,
    Subject: Re: FC: Free-market economist replies to Robert Gellman privacy paper
    My own comment on this, several years old, focusing mostly on shopping 
    cards, as it turns out...
    Date: Thu, 28 Mar 2002 09:25:00 -0500
    To: Declan McCullagh <declanat_private>
    From: Jason Young <jyoungat_private>
    Subject: Harper's view is antiquated
    I've worked for the Privacy Commissioners' of Ontario and British Columbia 
    and for Zero-Knowledge Systems have two comments on Mr. Harper's post.
    First, since when does having a web site privacy policy equate with 
    consumer empowerment? As anyone who has ever looked at a web site privacy 
    policy knows, most are unintelligible and ambiguously-worded monstrosities 
    written by lawyers who have no interest in consumer privacy. I say this as 
    a law student and a privacy nerd, who actually likes to read these things.
    Here are some prominent examples:
    Amazon's ambiguously-named "Privacy Notice" 
    MSN's 5000 word statement on information collection 
    http://privacy.msn.ca/default.asp contrast with MS Canada's easy-to-digest 
    and more strongly-worded "Privacy Policy" 
    Yahoo!'s equally vague statement on information collection 
    http://privacy.yahoo.com/privacy/us/ contrast with Yahoo! Canada's much 
    more limited http://privacy.yahoo.com/privacy/ca
    Second, the paradigm is not "business vs. consumers" it is "strong privacy 
    = good business". Don't take my word for it. Ask DoubleClick, Disney, 
    RealNetworks, Microsoft, Lotus and Polk, to name only a few businesses that 
    have been subjected to litigation, public and government scrutiny and, in 
    some cases, have seen entire markets vanish in smoke, because they didn't 
    understand the equation.
    Best regards,
    Jason Young
    From: "japgray" <japgrayat_private>
    To: "Declan McCullagh" <declanat_private>
    Cc: "Robert Gellman" <rgellmanat_private>
    Subject: Comment on "Privacy, Consumers and Costs"
    Date: Thu, 28 Mar 2002 16:22:25 -0500
    While Bob Gellman's paper is interesting and controversial, he is hardly an 
    unbiased party. Thus, the data and the conclusions of his study are 
    suspect. For example, he underestimates the significant indirect costs to 
    consumers of government enforcement of privacy regulations, business 
    compliance with current and future privacy laws, and litigation costs. All 
    these costs are eventually passed on to consumers by businesses in the form 
    of higher prices, and by governments in the form of higher taxes.
    To be credible, a fair, unbiased perspective would consider both direct and 
    indirect costs, and weigh such costs against the benefits to society. 
    Unfortunately, this study does not achieve that objective.
    Date: Thu, 28 Mar 2002 12:29:46 -0800
    From: David Brownell <david-bat_private>
    Subject: Re: Free-market economist replies to Robert Gellman privacy paper
    To: declanat_private, politechat_private
    Cc: gellman-commentsat_private, rgellmanat_private
     > Governments have guns, businesses don't. However, Gellman believes
     > that businesses have voodoo powers to coerce the population that
     > are just as powerful as guns.
    Seems quite evident to me that businesses do have
    such powers -- which have nothing to do with voodo.
    In the same way that "brandishing" a gun can achieve
    coercion without actually needing to kill, so can threats
    to curtail other aspects of quality-of-life also coerce.
    Higher prices are exactly such threats/coercions.
     > The way that "narrow-minded" free-market economists measure
     > "social consequences" is to put a dollar value on them. The reason
     > is that every consumer values such consequences differently; you
     > can't apply a single value for everyone.
    And the fundamental fallacy of such economists is to assume
    that dollar values can be placed on everything.  You might as
    well ask how much the social consequences weigh, since you
    won't get a meaningful answer that way either.
     > I'm not so much trying to refute Gellman directly so much as
     > point out that there is nothing to refute. His conclusions are
     > drawn from his premises; but since he draws his premises from
     > his conclusions, he has a circular argument.
    For example, by premising that everything can (and should) be
    monetized, one is led to the inescapable conclusion (surprise!!)
    that market analyses apply ... which start by monetizing things.
    - Dave
    From: "Tony Dye" <tonyat_private>
    To: <declanat_private>
    Cc: <gellman-commentsat_private>
    Subject: RE: Free-market economist replies to Robert Gellman privacy paper
    Date: Thu, 28 Mar 2002 16:38:47 -0000
    Declan, you are, as always, welcome to repost this if you wish...
    From: myselfat_private
    Date: Wed, 27 Mar 2002 21:54:40 -0500 (EST)
    To: Declan McCullagh <declanat_private>
    Subject: FC: No broad U.S. privacy laws costs "tens of billions," study says
    "Coercion" is a strong, value-laden word. Frequent shopper cards
    are a straightforward business proposition. Due to advanced
    technology, it costs less to service customers that reveal
    private information, cost savings that can be passed along to
    Gellman asserts, with no proof, that if frequent shopper cards
    were outlawed, then all customers would get the same low prices.
    Free-market economists assert the opposite, that all customers
    would get the same high prices.
    Gellman concludes: "The higher prices paid by those who reject
    frequent shopper cards represent a direct financial sacrifice
    for privacy."
    A free-market economist might conclude: "The lower prices paid
    by those who use frequent shopper cards represent a direct
    financial benefit for disclosing private information."
    The reality, of course, is that neither of these things are actually true.
    Let's flog the 'Frequent-Shopper Card' idea a bit further:
    In Texas (well, in central TX at least... I can't speak for the rest of the
    state) there are two major grocery chains: H.E.B. and Randall's. Randall's
    offers a customer card, and the deals you get are significant if you use it.
    The proposed free-market economist and Gellman both oversimplify this
    example though; the actual fact is that Randall's artificially inflates the
    prices on 'Customer Card Discount' items AND other items in their stores. I
    assume they do this to recover the cost of discounting some items and to
    make an overall profit from your info, rather than trading you for the real
    value of the data. If you elect not to sell Randall's your personal info, it
    is difficult to find a price for any item that is lower than the same item
    at the H.E.B. across the street. H.E.B. does not offer a customer card, and
    their prices are generally lower than Randall's on any given item, but
    rarely lower or even the same as the 'customer card discount' price at
    So, what to make of that? Well, if you live in Austin, you get to choose
    between a medium-low price on everything and no privacy issues, or
    artifically high/low prices with a privacy tradeoff and a chance to save
    quite a bit of cash, assuming you buy the right things at the right time. If
    you live in East Podunk, where they only have a Randall's, you might have a
    problem if you like to protect your privacy. IMHO, given the right
    circumstances, both circular arguments can be equally true.
    In the real world, neither Gellman nor the free-market economist is
    particularly accurate with respect to coercion. Sometimes you get a benefit
    from exchanging your info ($20 off at Amazon.com for consenting to receive
    targeted spam about your hobbies) and sometimes you get screwed because the
    industry can coerce you into giving it to them (car insurance companies
    requiring a credit check for a policy, with no promise to keep the info
    private and an extra penalty if you have a bad rating).
    Neither Gellman nor the free-market economist have a realistic philosophy
    for creating a remedy, either. Privacy should be protected by law in some
    cases (regulating 3rd party sharing, ambiguous, open-ended 'business
    partner' clauses in loan applications, and requiring opt-in for some info)
    but in others, individuals and the market should determine the value of
    personal information.
    I know that Mr. Graham's comments are in part an argument to the absurd, but
    it's counterproductive for him to claim that privacy issues are as
    cut-and-dried as Gellman claims they are elusive. It seems to me that the
    free-market approach is best suited for point-of-purchase type situations,
    where the consumer can make a judgement about the value of his personal data
    and act accordingly. Regulation is best suited for controllign the 'behind
    the scenes' exchange of data between 3rd parties.
    The US personal information market lacks two essential things: consumers
    lack the ability to make an informed judgement about the value of their
    information, and they lack the legal declaration that personal data actually
    belongs to them. Without these two things, it's practically pointless to
    discuss free-market vs. regulation... both are sometimes right, sometimes
    wrong, and functionally broken.
    -Tony Dye
    From: adminat_private (admin)
    To: <wfasonat_private>
    Cc: <wfasonat_private>, <rgellmanat_private>, <declanat_private>
    Subject: RE: Texas private investigator replies to Robert Gellman on privacy
    Date: Thu, 28 Mar 2002 11:18:41 -0500
    It is clear that you have never dealt with these companies you discuss
    when the issue involves *your* personal information.  Just try to find
    what kind of information that have about you, try to find out where they
    got it, try to opt-out of having the information distributed to other
    parties for marketing purposes, and, if you can do all that, try to
    correct any mistakes.  Just read their privacy policy or listen to their
    propaganda and then try to actually the directions they give you about
    access and control over this information and see how far you get.  In
    fact why don't you try contacting the victims of identity fraud who
    contact these companies in an effort to clear things up.
    Putting up phony privacy policies and setting up sham "self regulatory"
    efforts that have no way to file complaints or have any enforcement
    mechanism is fraud and it is clearly illegal.  At least the drug cartels
    admit what they do is illegal.
    I have been to a number of meetings where people like you show up and
    give their spiel.  I have found that now a single one has ever actually
    tried to gain access and control over their own personal information and
    have no idea what a consumer actually goes through when they try to use
    the procedures that are discussed at these purely theoretical meetings.
    So when you have actually done your homework then you can try commenting
    with some facts behind you rather than your theories about things you
    have read.
    Russ Smith
    From: "Vincent Penquerc'h" <Vincent.Penquerchat_private>
    To: gellman-commentsat_private, rgellmanat_private
    Cc: "'declanat_private'" <declanat_private>
    Subject: RE: Free-market economist replies to Robert Gellman privacy paper
    Date: Thu, 28 Mar 2002 15:17:45 -0000
     > If Gellman gets his way, he passes laws to adjust for the
     > imbalance. If Gellman is right, then this isn't bad, but if the
     > free-market economist was right and if the privacy was really
     > worth only $1.50, then we have an Orwellian society where guns
     > coerce people.
    The problem with this omnipresent need to stick a "dollar value"
    on everything is that it is not easy to do so. Valueing something
    implies you assess this thing, and doing so requires thorough
    knowledge of the thing assessed.
    Privacy is not something you can look at and assess easily. There
    is direct value you could stick on a given physical situation,
    like "I am in my house, and someone is looking at me by the window".
    Such things are obvious. However, others are much less obvious,
    because they are things that could be made out of the information
    someone gleans on you. When you don't know what, eg, a software
    company can do with the info it amasses about you, you can't really
    put a "dollar value" on this info, because it's immaterial: it's
    really "potential". The potentiality is whatever *can* be done
    with it. This is a rather blurry thing on the horizon, it really
    seems small and unimportant. Still, the actual concrete results
    will only appear afterwards. By that time, the "dollar value" one
    places on privacy might be far higher than before. One of the
    reasons why is because the original assessment was not founded
    on thorough knowledge of what could happen.
    That said, I appreciate the fact that trying to prevent something
    nefarious happening to someone against one's will is not necessarily
    a good thing just because the "protector" is genuinely concerned
    about one's health/integrity/soul/whatever.
     > By the way, we still haven't left the realm of circular logic.
     > Gellman is afraid of me because he thinks my policies will lead
     > to an Orwellian society led by business. I fear Gellman because
     > I think his policies will lead to an Orwellian society led by
     > government.
    Which I'd rather avoid both.
    This is another rant altogether, but business despotism can be as
    chilling as goverment one, especially as, at least in the USA, the
    government is somewhat supposed to be serving citizens, businesses
    being supposed to gather money, which they have to find somewhere
    (not everyone is Alan Greenspan).
    Vincent Penquerc'h
    POLITECH -- Declan McCullagh's politics and technology mailing list
    You may redistribute this message freely if you include this notice.
    Declan McCullagh's photographs are at http://www.mccullagh.org/
    To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
    This message is archived at http://www.politechbot.com/
    Politech dinner in SF on 4/16: http://www.politechbot.com/events/cfp2002/

    This archive was generated by hypermail 2b30 : Thu Mar 28 2002 - 21:42:01 PST