New Privacy Study Challenges Industry Assertions on the Cost of Protecting Consumers' Privacy (Gellman)

Posted: Apr 16 2002

Robert Gellman has released a paper on the costs of NOT protecting privacy. The March 26, 2002, white paper is titled "Privacy, Consumers, and Costs: How The Lack of Privacy Costs Consumers and Why Business Studies of Privacy Costs Are Biased and Incomplete."

 

Gellman is a privacy and information policy consultant in Washington, D.C., specializing in health confidentiality policy, privacy and data protection, and Internet privacy. A graduate of the Yale Law School, Gellman served for 17 years as chief counsel to the Subcommittee on Government Information in the House of Representatives. His responsibilities on the Subcommittee included privacy, freedom of information, and health record privacy issues.

 

The study was funded by the Digital Media Forum, a project of the Ford Foundation. Gellman's 37-page report is published on the web sites of the Electronic Privacy Information Center and of the Center for Democracy and Technology as follows:

The Executive Summary is reproduced below.

Privacy, Consumers, and Costs:
How The Lack of Privacy Costs Consumers and
Why Business Studies of Privacy Costs are Biased and Incomplete

by Robert Gellman
March 2002

Executive Summary

Privacy is an elusive, value-laden concept, and it is hard to reach consensus on a definition. In recent, self-serving studies, the business community seized upon this lack of clarity to distort debates about the true costs of privacy - costs to individuals, society and to the business community itself. These studies have led to a mainly one-sided public discussion of privacy, overstating the costs to businesses, ignoring the costs consumers incur to protect their privacy, and understating the benefits that privacy offers to commerce and to society.

 

The cost of privacy is a legitimate issue, but the studies and the conclusions drawn from them have serious flaws. They suggest that:

  • consumers' demands for privacy are irrational and that consumers do not know what is in their own interest,
  • unrestricted trafficking in personal information - the very thing that business wants - always benefits individuals, and
  • privacy can be evaluated only on the basis of monetary costs and benefits.

In fact, the costs incurred by both business and individuals due to incomplete or insufficient privacy protections reach tens of billions of dollars every year.

 

Shortcomings with Business Studies

The privacy cost studies sponsored by the business community suffer from a variety of defects. Studies of the credit reporting system seek to prove that the free flow of credit records benefits consumers while ignoring the benefits of legislation that gives consumers a wide range of privacy protections and legal remedies. These policies demonstrate how privacy can be compatible with business success in the marketplace.

 

Some studies, offered as objective but written by trade association employees, rely on old business models that assume that past information-intensive marketing methods are the only way to do business in the future. New ways to find consumers are ignored, as is the amount of business lost under current practices because of privacy concerns.

 

Calculating consumer benefits is the basis for some cost/benefit estimates. However, the definition of consumer benefits is so broad as to include the nonconsensual sale and exploitation of consumer information that most, if not all, consumers would reject, if given an informed choice.

 

Costs to Business of Not Protecting Privacy

The absence of privacy rules imposes expenses on businesses that many industry-sponsored studies ignore when calculating the costs of privacy. For example, consumers routinely abandon shopping carts on websites because of demands for too much personal information.

 

Analysts estimate that Internet retail sales lost due to privacy concerns may be as much as $18 billion. Attempts by business to show losses from privacy protections often reflect only traditional models of marketing that may be less effective than privacy-friendly approaches. Relationship marketing - based on the use of large amounts of personal information - may not be as effective as permission marketing, where consumers select what advertising they want to see.

 

Because many other countries have comprehensive privacy laws, the United States is significantly behind international privacy standards. The European Union limits the export of data to organizations in countries that do not have adequate privacy protections. The result is lost opportunities for U.S. businesses and higher costs when providing privacy protections for imported personal data. Better U.S. privacy protections could expand international business opportunities and reduce costs.

 

Accumulated personal data is increasingly attractive to law enforcement agencies, other businesses, and private litigants. Businesses are spending more and more time and money responding to subpoenas for their compilations of personal data.

 

Investors lost hundreds of billions of dollars in companies with business models based on exploiting personal information obtained from Internet users. The lack of privacy protections led many to believe wrongly that personal data could be exploited without limit.

 

The Costs Consumers Incur When Privacy Is Not Protected

When laws and practices do not provide adequate protections for personal information, individuals act to protect themselves and their privacy. The costs incurred by individuals to protect themselves from unwanted view or intrusion constitute a privacy toll paid in both dollars and time. The privacy toll includes costs associated with higher prices, stopping junk mail and telemarketing calls, avoiding identity theft and protecting privacy on the Internet. A privacy sensitive family could spend between $200 and $300 and many hours annually to protect their privacy.

 

Supermarket frequent shopper cards and other registration and monitoring programs coerce consumers to sell their personal information for lower prices at the cash register. Customers unaware of or unwilling to sign up for these programs often pay more.

 

Traditional junk mail is a longstanding consequence of the inability of individuals to control the collection, compilation, and sale of their personal information. The average person receives more than ten pieces of junk mail each week, of which nearly half is discarded unopened and unread. Opting out of junk mail often requires writing multiple letters, which is a small expense, but still a significant barrier for most individuals.

 

About 80% of Americans strongly object to receiving unsolicited sales calls and, to prevent or deter these telemarketing calls, many households buy services such as Caller ID, call waiting, answering machines or voice mail, and unlisted or unpublished numbers. Some estimate that 25% of households pay an average of $1.50/ month to be unlisted. The total price that telephone subscribers pay for privacy-protecting services is more than $400 million/year.

 

Identity theft is a growing threat that creates financial and other hardships for hundreds of thousands of individuals each year. Identity theft results in part from the ready availability of personal information and the lack of protections that would give individuals more control over that information. It can take years of hard work and hundreds or thousands of dollars in out-of-pocket expense before all vestiges of identify theft are removed from a victim's record. In the interim, a victim of identity theft may be unable to obtain a job, purchase a car, or qualify for a mortgage. Government agencies advise individuals seeking protection against identity theft to purchase copies of credit reports annually or to subscribe to credit watch services.

 

Annual costs for a family can easily exceed one hundred dollars annually while estimates of losses for financial institutions appear to be in the hundreds of millions. Identity theft undermines consumer confidence, deters the growth of electronic commerce, and increases costs that may be passed on to consumers.

 

Unwanted commercial electronic mail, often called spam, imposes costs on Internet users who cannot control the collection and sale of their email addresses. Users spend hours each year downloading and deleting spam.

Spam also raises costs for Internet providers, delays service to users, and undermines the vitality of the Internet as a means of open communications. Estimates are that worldwide costs of spam range from $8-10 billion.

Broader effects of the lack of privacy cannot be measured in dollars. The effects on individuals and institutions due to the evolving "dossier society" are significant and often unwelcome. Non-economic interests protected by privacy policy and laws include avoiding solicitations, the exercise of First Amendment rights, and protection of children.

The complete report can be found at these web sites: