Notice and Choice and Its Problems Robert Sloan Richard Warner

Notice and Choice The “notice” is the presentation of information  Typically in a privacy policy. The “choice” is some action by the consumer  Typically using the site, or clicking on an “I agree” button. Claims: 1. Notice and Choice ensure free and informed consent. 2. The pattern of free and informed consent defines an acceptable tradeoff between privacy and the benefits of information processing.

Informed Consent The knowledge requirement: to give informed consent, consumers must know what information websites collect and what they do with it. The problem: Consumers may have little knowledge of the ways in which businesses process information. The “notice” appears to offer the obvious solution: present the information in a privacy policy which can be read and understood with reasonable time and effort.

The Obvious Objection The vast majority of visitors do not read privacy notices “[P]rocessing privacy notices is a cost that most consumers apparently do not believe is worth incurring. The perceived benefits are simply too low.” J. Howard Beales, III & Timothy J. Muris, Choice or Consequences: Protecting Privacy in Commercial Information, 75 U. C HI. L. R EV. 109 (2008). So doesn’t it follow that the vast majority of visitors do not give informed consent?

The Reply: Assumption of the Risk “Assumption of the risk” principle: If you know that, with reasonable time and effort, you could obtain information relevant to a choice, and you freely choose not to obtain that information, then you assume the risk of consequences of which you would have been aware had you obtained the information. So even if a consumer does not read, you can properly regard the person as informed as long as Notice is sufficiently informative, and the person had an adequate opportunity to read and understand it.

Free Consent Free consent “requires a knowing understanding of what one is doing in a context in which it is actually possible for one to do otherwise, and an affirmative action in doing something, rather than a merely passive acquiescence in accepting something.” Margaret Jane Radin, Humans, Computers, and Binding Commitment, 75 I ND. L.J. 1125, 1126 (1999). An informed person has the knowing understanding; is free not to use the site, and the choice is the affirmative action.

The Tradeoff The overall pattern of giving or withholding consent draws a line between permissible and impermissible uses of personal information, and that line defines tradeoff between the benefits of processing information and the need to protect informational privacy Why should the overall result of each person getting what he or she wants not also be acceptable?

Critique of Notice and Choice The critique is that Notice and Choice fails to ensure free and informed consent, and fails to implement an acceptable tradeoff.

Failure to Ensure Informed Consent Notice and Choice yields informed consent if two conditions are fulfilled.  First, the Notice contains sufficient information.  Second, consumers have an adequate opportunity to read and understand. Assume—as is currently the case--information collected on one occasion for one purpose is typically retained, analyzed, and distributed for a variety of other purposes in unpredictable ways. Given this assumption, it is impossible to fulfill the first condition, and any reasonably close approximation to it ensures that the second condition is not fulfilled

Notices Cannot Be Sufficient An individual “may give out bits of information in different contexts, each transfer appearing innocuous. However, the information can be aggregated and could prove to be invasive of the private life when combined with other information... From the standpoint of each particular information transaction, individuals will not have enough facts to make a truly informed decision. The potential future uses of that information are too vast and unknown to enable individuals to make the appropriate valuation.” Daniel J. Solove, Privacy and Power: Computer Databases and Metaphors for Information Privacy, 53 S TAN. L. R EV. 1393, 1452 (2001).

The Data Processing Assumption Our argument that Notices cannot be sufficient depends on this assumption:  Information collected on one occasion for one purpose is typically retained, analyzed, and distributed for a variety of other purposes in unpredictable ways. What if we abandon the assumption? The FTC in effect proposes just this.

FTC Proposals They insist that “companies should limit data collection to that which is consistent with the context of a particular transaction or the consumer’s relationship with the business, or as required or specifically authorized by law.” And that companies “implement reasonable restrictions on the retention of data and should dispose of it once the data has outlived the legitimate purpose for which it was collected.”  Federal Trade Commission, Protecting Consumer Privacy in an Era of Rapid Change, March 2012, 61, We argue against this when in the context of the tradeoff issue.

Failure to Ensure Free Consent Free consent “requires a knowing understanding of what one is doing in a context in which it is actually possible for one to do otherwise, and an affirmative action in doing something, rather than a merely passive acquiescence in accepting something.” The problem: consent to Notices appears to be “a merely passive acquiescence in accepting something” and hence not free.  The Vicky wine store example. Notice and Choice has no solution to this problem.

The Tradeoff Problem The resulting overall pattern of consent would determine a tradeoff between privacy and competing concerns. It is extremely unlikely that the tradeoff would result in a socially optimal balance.  The telephone book example.

The FTC’s Proposed Restrictions The principles for restricting the use of data that the FTC appears to be advocating are hardly clear, but it is difficult to see how they would allow retaining the Bing searches that led to the life-saving discovery of the combined effects of Paxil and Pravachol, or how they would permit the donation of all tweets to the Library of Congress.