The arrival of the “era of big data” has been heralded as transformative for industry, economic growth, and efficiency. Every day brings new headlines about technological advances that have the potential to greatly improve our lives. But we also notice advertisements that are increasingly tailored to our interests, after browsing for autos, we begin to see more ads for cars.
Although we always knew that our data was out there being used, it has become more salient as we see companies use it in new innovative ways. Yet, many of us are happy to hand over personal data in exchange for valuable services. For example, we might use an application that scans our email looking for travel plans and creates travel itineraries, saving valuable time. We might be delighted when the “personal assistant” function on our mobile phone reminds us of appointments. On the other hand, news of widespread government surveillance has made many of us nervous, as we had not expected that this surveillance was occurring.
In the face of these trends, it is difficult for policy-makers to know how to respond. Antitrust and privacy regulators both face a classic tradeoff between allowing technological innovation to proceed disciplined only by the market and consumer choice, or intervening and risking doing more harm than good.
Despite the fact that policy-makers profess an acute awareness of these tradeoffs, much of the public discourse around these issues misses fundamental facts as well as economic principles that provide some guidance as to when market solutions are likely to do well and poorly, as well as when regulatory solutions might do well and poorly. A deeper understanding is crucial to achieving an appropriate balance between costs and benefits of government intervention.
Market Failures in the Market for Privacy and the Role of Regulation
Markets don’t function well when it comes to privacy. First, many consumers are not informed about privacy and do not understand the risks and benefits of alternative privacy policies of firms. They are complex and not standardized. Even experts find it difficult to understand governments and private entities make use of data. This first factor contributes to the second, which is that there is little evidence that consumers change their behavior in response to differences in privacy policies.
Third, for many technology products, markets are highly concentrated, and consumers do not perceive choices that are different enough on privacy policy to understand. Thus, a policy of “notify and consent” may not seem meaningful if there is no comparable alternative to a company’s product, or if the consumer has already invested in learning and using a company’s product and does not want to switch when privacy policies are changed. The incentives for consumers to “punish” a firm for poor privacy policy is low. Fourth, and as a consequence it is difficult to measure the consumer benefits of improved privacy policy in a coherent way: it is hard to measure consumer preferences for something that consumers do not understand.
Fifth, consumers may also change their feelings about the risks of a large firm retaining their data after news about government subpoenas or U.S. National Security Administration surveillance. Indeed, Marthews and Tucker (2012) show that users change their search behavior, reducing their queries on politically sensitive terms, after media reports about government surveillance. In such an environment, it is difficult to know how to put a dollar value on benefits to privacy protection to trade off against harm to long-term welfare, innovation, and so on.
Sixth, consumers face a free rider problem faced by consumers – no individual has the incentive (nor the expertise) to audit major technology firms with which they interact. Regulation could, in principle, provide organized and expert-designed information to consumers about the choices that consumers face, helping consumers choose between a better defined set of alternatives.
Regulatory Failures
Now let us consider some potential harms from privacy regulation. First and foremost, privacy regulation may interfere with the effectiveness of online advertising and make it harder for new ventures to attract an initial user base or to monetize their content. This lower efficiency of online advertising can lead to decreases in innovation and in the creation of content.
Second, harming the efficiency of online advertising is typically regressive. Advertising supports free products, typically more appreciated and used by low income people. For instance, the evidence suggests that disadvantaged women are harmed by the lack of medical information, whose diffusion is financed by advertising, when they come to the hospital.
Third, past attempts at privacy regulation results in privacy policies which are typically too difficult to read. “Notice and consent” has had little impact on consumer behavior; only a tiny fraction of users read such notices, and an even smaller fraction understand them.
Fourth, in concentrated sectors privacy regulation can be used by incumbents to keep users out. For example, incumbent firms may have more data than entrants for targeted advertising. Privacy policies can make it hard for small, new firms to get a toe-hold (Goldfarb and Tucker, 2011).
What kinds of policies, then, have some hope of balancing the costs and benefits appropriately? One approach, promoted by Microsoft’s Craig Mundie, is to attach metadata to every piece of personal information, which would describe the uses to it can be put, as per the instructions of the individuals it concerns. A very large penalty would be enacted for violating the rules. Under this proposal, efficiency enhancing innovations such as targeted advertising could be used, but users could control the use of the data even in a complex ecosystem whose details they might not understand. Although it might have seemed technologically challenging to implement such a shared database, recent innovations in decentralized ledger technology such as Bitcoin have shown that a large public ledger can maintain security. One could envision blockchain technology keeping a ledger of personal data (described by a hash, not the data itself) as well as its permissions; and users would have the key that could be used to revoke privileges at any time. This kind of proposal can be contrasted with an approach of banning particular technologies. Policy aimed primarily at forbidding, e.g., cookies can be undermined through the use of other technology that accomplishes a similar goal. And cookies may not even be relevant in new form factors or settings (like the “internet of things,” the “smart home,” “wearables,” or mobile).
Limits on Data Retention
Another type of policy provides broader protection through limits on data retention. Chiow and Tucker (2014) provided evidence from recent data that changes in retention policy did not change the quality of search engine results, consistent with general industry understanding that recent data is much more useful. A potential policy would require the data to be anonymized and/or aggregated after a certain time period.
Although there is always some value to having older data, particularly for research and development and for analyzing trends over time, there are also large potential costs to keeping that data. To see why, let us take the perspective that an individual values privacy because of the risk of economic harm or reputational risk due to discovering information about the individual. (Of course, there are many other perspectives on privacy, as outlined above.) Note that there may be many sources of information about an individual’s current behavior. One could observe their shopping physically, for example. On the other hand, over time, it is more likely that a user might have changed their preferences and behavior, and thus face some costs if their previous behavior was revealed. At the same time, as time passes, there are fewer and fewer ways for an outsider to find detailed data about a user’s past behavior, other than the digital data retained by online firms. Thus, eliminating the digital data has a material impact on the risk that the information is revealed.
Limits on retention are easy for consumers to understand. A consumer can have confidence that something that happened two years ago is more or less “gone” unless they have specifically opted in to retention (e.g. retaining old credit card or bank statements, or historical orders on an e-commerce site).
Limits on retention may seem like a blunt instrument, but, although historical data does have real value, and in some contexts (such as studying health conditions that develop over many years) may be indispensable, in many online contexts, the benefit of long retention of non-anonymized historical data may not outweigh the privacy costs and risks. If limits on retention help consumers become more comfortable with richer uses of current data, and thus policy permits the use of current data to create more value and efficiency (for example in online advertising for small websites and apps), such a policy may have substantial welfare benefits.
Conclusions
Privacy policy needs to consider carefully economic costs and benefits, and it must also be sensitive to the mechanisms through which firm behavior is impacted. Relying on uninformed individual consumers to police firms through “notice and consent” policies is unlikely to result in efficient outcomes. Policy should recognize the limitations of markets in environments where consumers get limited return from the substantial investment they would need to make to understand how privacy practices impact them. Themes in effective policy include simplifying and standardizing information, and making sure that the most important aspects of privacy from a cost/benefit perspective are highlighted to consumers in ways they can understand. In some cases, there may be industry standards that should be enforced by governments, since consumer behavior cannot be relied upon to provide sufficient incentives.
More robust policies may include the establishment of property rights for data, which at least have the potential to allow the efficiency benefits of using data for personalization to be realized, as well as broad measures such as limits on retention that are easy for consumers to understand and also solve a wide range of potential privacy and security concerns simultaneously, without limiting technology. Even retention policies must be carefully considered in each domain, however, because in some domains (such as health), longer retention of data may be justified.
**
This article is taken from “Information, Privacy, and the Internet: An Economic Perspective” by Susan Athey. Professor Athey first shared this work in her lecture at the Central Planning Bureau (CPB) Netherlands Bureau for Economic Policy Analysis workshop on 'Internet Economics and Privacy' in June 2014.
Susan Athey, an economic theorist who has made significant contributions to the study of industrial organization, is the Economics of Technology Professor at Stanford Graduate School of Business. She also is Professor of Economics (by courtesy), School of Humanities and Sciences, and Senior Fellow, Stanford Institute for Economic Policy Research. Her current research focuses on the economics of the Internet, marketplace design, auction theory, the statistical analysis of auction data, and the intersection of computer science and economics. She is an expert in a broad range of economic fields – including industrial organization, econometrics, and microeconomic theory – and has used game theory to examine firm strategy when firms have private information.
In 2007, Professor Athey was named the first female recipient of the American Economic Association’s prestigious John Bates Clark Medal, awarded every other year to the most accomplished American economist under the age of 40 “adjudged to have made the most significant contribution to economic thought and knowledge.”
The preceding article is re-published on TAP with permission by its author, Professor Susan Athey, and by the Toulouse Network for Information Technology (TNIT). “An Economic View of Privacy” was originally published in TNIT’s December 2015 newsletter.