A "Bill of Rights" for the Complacent

-- By NelsonHua - 06 Mar 2015

On February 28, the Obama administration proposed the Consumer Privacy Bill of Rights Act. The proposed bill, supposedly in recognition of the extent to which “Americans cherish privacy as an element of their individual freedom,” creates a system of notice and control regarding firms’ collection of user data. However, the bill, if enacted as proposed, lacks the regulatory teeth to compel a meaningful response from the private sector. This inadequate policy response is reflective of the inadequate regard for privacy from all parties involved – the government, private firms, and the affected general public itself.

The Bill

The proposed bill places the burden on industry members to develop “codes of conduct” on their handling of consumer information. Such codes of conduct are subject to a transparent, public comment period and review by the Federal Trade Commission on the basis of certain enumerated requirements. Through the practices embodied in their codes, industry members required to provide notice of data collection, offer some level of access and user control over one’s own individual data, and “responsibly” collect, retain, and use personal data.

At a glance, the proposal seems to at least recognize areas of inadequate consumer protection. However, the language is ultimately so couched in concessions and exceptions to industry that it would be unlikely to provide any sort of consumer relief. For example, the collection and processing of personal data that is “reasonable in light of context” is not covered by the bill. Likewise, the requirement of individual access to data does not extend to such requests that are “frivolous or vexatious.” The broad language establishing the standard by which the bill evaluates industry practices suggest that privacy is ultimately a secondary concern.

The bill has also been criticized as one that “would effectively codify bad behavior. By placing the ultimate burden of drafting codes of conduct on industry members, and even upon review, offering broad latitude in doing so, the bill establishes weak final guidelines of practice. Furthermore, in pre-empting (sometimes stronger) state privacy laws, it could very well have a destructive effect.

A More Pervasive Problem

The proposal represents nothing more than a very limited nominal recognition that some level of privacy protection in the digital age is important. Its terms are far from comprehensive and lack regulatory teeth. It is reflective of a society that is invested in the idea of privacy, but not actually concerned with violations in practice.

Enforcement is in the hands of the FTC. Effectively, the regulatory scheme places our privacy concerns in the hands of a few individual commissioners appointed by a government as a whole that does not itself respect the individual’s need for privacy. At its most basic level, the system is flawed. Privacy is not just deserving of some protection as something that American’s “cherish” – it is a basic Constitutional right. An appropriate amount of regard for such a right would not involve such a “flexible” system, but rather, strong protective substance and (near) absolute enforcement.

The introduction of the bill paints a narrative that the government has been historically protective of consumer privacy, and that it meets the need for some minor tweaking in light of “keep[ing] pace as technology and business practices evolve.” Of course, a policy response crafted to address such a minor problem is inadequate to address a problem that is increasingly revealed to be much more pervasive.

Towards a Solution

The drafters of the bill should hardly shoulder the blame themselves for an inadequate response. Nor should even this nation’s legislators for letting the problem become what it has today. Much of the responsibility belongs to the general public for complacency. A significant part of the nation will stand and fight for the right to own firearms, but few will stand for the right to privacy. In a sense, this “Bill of Rights” is in direct proportion with what society demands.

Ignorance is no excuse. The “new technologies” are hardly new anymore. Private parties and government agencies alike have been very publicly exposed for practices that show little to no regard for individual privacy. Yet, the public largely engages in willful blindness. Many shrug or even shake their heads at the work of individuals such as Edward Snowden, and consumers continue to use the very products that they know violate their privacy rights, in fact handing them information directly.

Alternatives exist. A surrender of one’s own self is a high price to pay for the marginal convenience familiar products afford. It would be imprudent to expect a government to safeguard rights that its constituents seemingly do not care about.

The benefits of a public reclamation of privacy are twofold: First, it would send a message about consumer preferences to the industry members through profit margins, which is what they understand the most; Second, it would compel a proportional legislative response.

This isn't really analysis yet, either of policy or politics.

For policy analysis, it would be wise to begin with an understanding of what the WH is trying to achieve with the legislation. The pattern, of voluntary adoption of policies to be policed by the FTC through "prosecutorial" administrative action where companies fail to meet their own voluntary commitments, is the existing mechanism expanded. We have discussed the constitutional barriers to European-style "data protection" approaches to privacy in the US, which should help you to explain why the form in which legislation is proposed tends in the direction of what you consider "toothlessness": an absolute constitutional prohibition on abridging freedom of speech pulls many legislative teeth, as it is supposed to do.

Political analysis would focus on what can pass and what voters want.

The route to the improvement of the draft is to make both policy and political analysis appear where only rhetoric is now.