Introduction: Privacy self-management and the consent dilemma

Harvard Law Review

Volumn 126, Issue 7, 2013, Pages 1880-1903

  Solove, Daniel J ^a  

^a GEORGE WASHINGTON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84877983179     PISSN: 0017811X     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (99)

1. See Neil M. Richards, The Dangers of Surveillance, 126 Harv. L. Rev. 1945-52 (2013).
2. See Julie E. Cohen, What Privacy Is For, 126 Harv. L. Rev. 1904, 1918-27 (2013).
3. See Lior Jacob Strahilevitz, Toward a Positive Theory of Privacy Law, 126 Harv. L. Rev. 2010 (2013).
4. See Robert Gellman, Fair Information Practices: A Basic History, Bob Gellman 9-10 (Nov. 12, 2012), http://bobgellman.com/rg-docs/rg-FIPPShistory.pdf.
5. SEC'Y'S ADVISORY COMM. ON AUTOMATED PERS. DATA SYS., U.S. DEP'T OF HEALTH, EDUC. & WELFARE, RECORDS, COMPUTERS AND THE RIGHTS OF CITIZENS 41-42 (1973).
6. ORG. FOR ECON. CO-OPERATION AND DEV., OECD GUIDELINES ON THE PROTECTION OF PRIVACY AND TRANSBORDER FLOWS OF PERSONAL DATA (1980).
7. ASIA-PAC. ECON. COOPERATION, APEC PRIVACY FRAMEWORK (2004).
8. Gellman, supra note 4, at 7.
9. FED. TRADE COMM'N, PROTECTING CONSUMER PRIVACY IN AN ERA OF RAPID CHANGE, at i (2012), available at http://ftc.gov/os/2012/03/120326privacyreport.pdf.
10. THE WHITE HOUSE, CONSUMER DATA PRIVACY IN A NETWORKED WORLD 47 (2012), available at http://www.whitehouse.gov/sites/default/files/privacy-final.pdf.
11. See Julie Brill, Comm'r, Fed. Trade Comm'n, Remarks at Conference of Western Attorneys General Annual Meeting, Privacy 3.0 Panel (July 20, 2010).
12. 15 U.S.C. § 45(a)(1) (2006). For background about the FTC's enforcement regarding privacy, see.
13. DANIEL J. SOLOVE & PAUL M. SCHWARTZ, INFORMATION PRIVACY LAW 820-31 (4th ed. 2011).
14. 15 U.S.C. § 45(l)-(m).
15. Pub. L. No. 106-102, 113 Stat. 1338 (codified in scattered sections of 12 and 15 U.S.C).
16. 15 U.S.C. § 6802(a)-(b) (2006).
17. See HELEN NISSENBAUM, PRIVACY IN CONTEXT 105 (2010) (discussing a 2006 study showing that only 20% of people read privacy notices "most of the time" (quoting TRUSTe & TNS, Consumers Have a False Sense of Security About Online Privacy: Actions Inconsistent with Attitudes, PR NEWSWIRE, http://www.prnewswire.com/news-releases/consumers-have-false-sense-of-security-about-online-privacy---actions-inconsistent-with-attitudes-55969467.html (last visited Mar. 30, 2013) (internal quotation marks omitted))).
18. Fred H. Cate, The Failure of Fair Information Practice Principles, in Consumer Protection In The Age Of The 'Information Economy' 343, 361-62 (Jane K. Winn ed., 2006).
19. George R. Milne & Mary J. Culnan, Strategies for Reducing Online Privacy Risks: Why Consumers Read (or Don't Read) Online Privacy Notices, 18 J. Interactive Marketing 15, 20-21 (2004) (finding that only 4.5% of respondents said they always read website privacy notices and 14.1% frequently read them).
20. See, e.g., Omri Ben-Shahar & Carl E. Schneider, The Failure of Mandated Disclosure, 159 U. PA. L. Rev. 647, 665-78 (2011).
21. Florencia Marotta-Wurgler, Will Increased Disclosure Help? Evaluating the Recommendations of the ALI's "Principles of the Law of Software Contracts," 78 U. Chi. L. Rev. 165-178 (2011) (discussing a study that revealed that people accessed contract boilerplate terms far less than 1% of the time).
22. See Edward J. Janger & Paul M. Schwartz, The Gramm-Leach-Bliley Act, Information Privacy, and the Limits of Default Rules, 86 Minn. L. Rev. 1219-1230 (2002) (stating that according to one survey, "only 0.5% of banking customers had exercised their opt-out rights").
23. See Alessandro Acquisti & Jens Grossklags, What Can Behavioral Economics Teach Us About Privacy?, in Digital Privacy 363-369 (Alessandro Acquisti, Stefanos Gritzalis, Costas Lambrinoudakis & Sabrina De Capitani di Vimercati eds., 2008).
24. Jon Leibowitz, Comm'r, Fed. Trade Comm'n, So Private, So Public: Individuals, the Internet & the Paradox of Behavioral Marketing, Remarks at the FTC Town Hall Meeting on Behavioral Advertising: Tracking, Targeting, & Technology (Nov. 1, 2007), available at http://www.ftc.gov/speeches/leibowitz/071031ehavior.pdf.
25. See Annie I. Anton et al., Financial Privacy Policies and the Need for Standardization, 2 Ieee Security & PRIVACY 36, 42-44 (2004).
26. Janger & Schwartz, supra note 16, at 1230-32.
27. Erik Sherman, Privacy Policies Are Great - For PhDs, CBS NEWS (Sept. 4, 2008, 5:31 AM), http://industry.bnet.com/technology/1000391/privacypolicies-are-great-for-phds.
28. See M. Ryan Calo, Against Notice Skepticism in Privacy (and Elsewhere), 87 Notre Dame L. Rev. 1027-1033 (2012) ("Studies show only marginal improvement in consumer understanding where privacy policies get expressed as tables, icons, or labels, assuming the consumer even reads them.").
29. See id. at 1034-35.
30. Id. at 1069-70.
31. See Strahilevitz, supra note 3, at 2038.
32. Joseph Turow et al., Contrary to What Marketers Say, Americans Reject Tailored Advertising and Three Activities that Enable It 20-21 (Sept. 29, 2009) (unpublished manuscript), available at http://ssrn.com/paper=1478214.
33. Joseph Turow, Lauren Feldman & Kimberly Meltzer, Open To Exploitation: American Shoppers Online And Offline (Univ. of Pa., Annenberg Pub. Policy Ctr. 2005), available at http://www.annenbergpublicpolicycenter.org/downloads/information_and_society/turow_appc_report_web_final.pdf.
34. See Alessandro Acquisti & Jens Grossklags, Privacy and Rationality: A Survey, in Privacy And Technologies Of Identity 15-16 (Katherine J. Strandburg & Daniela Stan Raicu eds., 2006).
35. See Eric Goldman, The Privacy Hoax, Forbes, Oct. 14, 2002, at 42.
36. See Emily Nussbaum, My So-Called Blog, N.Y. Times, Jan. 11, 2004 § 6 (Magazine), at 32-34.
37. See Chris Jay Hoofnagle et al., How Different Are Young Adults from Older Adults When It Comes to Information Privacy Attitudes & Policies? (Aug. 14, 2010) (unpublished manuscript) available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1589864.
38. RICHARD H. Thaler & Cass R. Sunstein, Nudge 9 (2008).
39. DANIEL KAHNEMAN, Thinking, Fast And Slow 411 (2011).
40. See generally Choices, Values, And Frames (Daniel Kahneman & Amos Tversky eds., 2000).
41. Judgment Under Uncertainty: Heuristics And Biases (Daniel Kahneman, Paul Slovic & Amos Tversky eds., 1982).
42. Acquisti & Grossklags, supra note 26, at 25-26.
43. Acquisti & Grossklags, supra note 17, at 369.
44. THALER & SUNSTEIN, supra note 30, at 25.
45. Leslie K. John et al., The Best of Strangers: Context Dependent Willingness to Divulge Personal Information (July 6, 2009) (unpublished manuscript), available at http://ssrn.com/abstract=1430482.
46. Laura Brandimarte, Alessandro Acquisti & George Loewenstein, Misplaced Confidences: Privacy and the Control Paradox, Soc. Psychol. & Personality Sci. (forthcoming) (manuscript at 3), available at http://www.heinz.cmu.edu/~acquisti/papers/acquisti-SPPS.pdf.
47. See DAN ARIELY, Predictably Irrational 240-41 (2008).
48. FRANZ KAFKA, The Trial 215 (Breon Mitchell trans., Schocken Books 1998) (1925).
49. See August 2011 - Top US Web Brands, Nielsen Wire (Sept. 30, 2011), http://blog.nielsen.com/nielsenwire/online_mobile/august-2011-top-us-web-brands/.
50. See Danielle Keats Citron, Reservoirs of Danger: The Evolution of Public and Private Law at the Dawn of the Information Age, 80 S. Cal. L. Rev. 241, 243-51 (2007).
51. Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S: J. L. & Pol'y For Info. Soc'y 543-564 (2008).
52. In addition to learning new information by combining bits and pieces of old information, data analytics can make predictions about future behavior. Big Data might know something about people even before they know it themselves.
53. DANIEL J. SOLOVE, The Digital Person 44-47 (2004).
54. See DANIEL GILBERT, Stumbling On Happiness 24-25 (2006).
55. See Paul M. Schwartz & Daniel J. Solove, The PII Problem: Privacy and a New Concept of Personally Identifiable Information, 86 N.Y.U. L. Rev. 1814-1816 (2011).
56. See supra p. 1890.
57. Michael Barbaro & Tom Zeller Jr., A Face Is Exposed for AOL Searcher No. 4417749, N.Y. Times, Aug. 9, 2006, at A1.
58. See Acquisti & Grossklags, supra note 17, at 372.
59. E.g., Janger & Schwartz, supra note 16, at 1247.
60. See PRISCILLA M. REGAN, LEGISLATING PRIVACY 212-14 (1995).
61. Joel R. Reidenberg, Privacy Wrongs in Search of Remedies, 54 Hastings L.J. 877, 882-83 (2003).
62. Spiros Simitis, Reviewing Privacy in an Information Society, 135 U. Pa. L. Rev. 707-709 (1987).
63. Robert C. Post, The Social Foundations of Privacy: Community and Self in the Common Law Tort, 77 Calif. L. Rev. 957-959 (1989).
64. See Paul M. Schwartz, Privacy and Democracy in Cyberspace, 52 Vand. L. Rev. 1609-1613 (1999).
65. Id. at 1613-14.
66. Julie E. Cohen, Examined Lives: Informational Privacy and the Subject as Object, 52 Stan. L. Rev. 1373-1428 (2000).
67. See Cohen, supra note 2, at 1918.
68. Neil M. Richards, Intellectual Privacy, 87 Tex. L. Rev. 387 (2008).
69. Richards, supra note 1, at 1946.
70. Id. at 1951.
71. Schwartz & Solove, supra note 45, at 1866-68.
72. See Daniel J. Solove & Neil M. Richards, Rethinking Free Speech and Civil Liability, 109 Colum. L. Rev. 1650-1676 (2009).
73. See Jason Mazzone, The Waiver Paradox, 97 Nw. U. L. Rev. 801, 801-02 (2003). Some rights, however, cannot be relinquished with consent, such as the right to vote.
74. Solove & Richards, supra note 62, at 1653.
75. Jennings v. Minco Tech. Labs, Inc., 765 S.W.2d 497-502 (Tex. App. 1989) (holding that giving employees a choice between taking a drug test or being fired was sufficient to make the drug tests consensual).
76. ANITA L. ALLEN, Unpopular Privacy 13 (2011).
77. JULIE E. COHEN, Configuring The Networked Self 148 (2012).
78. Cohen, supra note 2, at 1905.
79. Omer Tene & Jules Polonetsky, Big Data for All: Privacy and User Control in the Age of Analytics, 11 Nw. J. Tech. & Intell. Prop. (forthcoming 2013) (manuscript at 6-12). Schwartz and I raise additional examples elsewhere.
80. Schwartz & Solove, supra note 45, at 1866-68.
81. Jan Whittington & Chris Jay Hoofnagle, Unpacking Privacy's Price, 90 N.C. L. Rev. 1327, 1328-29 (2012).
82. See id.
83. Strahilevitz, supra note 3, at 2022.
84. See id. at 2027.
85. See Paul M. Schwartz, The EU-U.S. Privacy Collision: A Turn to Institutions and Procedures, 126 Harv. L. Rev. 1966, 1971-76, 1992-2001 (2013).
86. Professor Fred Cate notes that although some EU officials downplay the extent to which the EU Data Protection Directive relies upon notice and consent, the Directive "plainly" does so, as "[m]any of its substantive protections can be waived without consent."
87. Cate, supra note 14, at 360.
88. Schwartz, supra note 75, at 1976.
89. Leibowitz, supra note 18, at 6.
90. Paul M. Schwartz, Privacy Inalienability and the Regulation of Spyware, 20 Berkeley Tech. L.J. 1269-1274 (2005).
91. See also Cate, supra note 14, at 366-67 "[If] consent is required as a condition for opening an account or obtaining a service, a high response rate can always be obtained."
92. Id. at 366.
93. Schwartz, supra note 80, at 1274.
94. See iTunes Store - Terms and Conditions, Apple, http://www.apple.com/legal/itunes/us/terms.html (last visited Mar. 30, 2013).
95. Cate, supra note 14, at 364-65.
96. Nicklas Lundblad & Betsy Masiello, Opt-in Dystopias, 7 Scripted 155-162 (2010), http://www.law.ed.ac.uk/ahrc/script-ed/vol7-1/lundblad.pdf.
97. See Peter P. Swire, The Surprising Virtues of the New Financial Privacy Law, 86 Minn. L. Rev. 1263-1316 (2002) ("[A] principal effect of the notices has been to require financial institutions to inspect their own practices In order to draft the notice, many financial institutions undertook an extensive process, often for the first time, to learn just how data is and is not shared between different parts of the organization and with third parties.").
98. See generally Kenneth A. Bamberger & Deirdre K. Mulligan, Privacy on the Books and on the Ground, 63 Stan. L. Rev. 247 (2011).
99. THALER & SUNSTEIN, supra note 30, at 5-6.