Chairman Rockefeller recently sent letters to a dozen different companies seeking information on how they share information with third parties. The letters are an extension of previous requests sent to “data brokers” asking for clarification of the companies’ “data collection, use and sharing practices.” In the letters, the Chairman opines that the privacy policies on many websites “appear to leave room for sharing a consumer’s information with data brokers or other third parties who in turn may share with data brokers.” He also stresses the importance of transparent privacy practices for consumers.
While a call for more information and data is certainly commendable, one should ask, “Where is this all going?” Is the Chairman suddenly seeing the need for some data to inform policy making in this area?
While we would hope so, the Chairman’s letter infers the assumption that there is something inherently harmful about data collection and sharing, although this harm is not explicitly described. He also posits that consumers may not be aware that their information is being collected or how it’s being used. Again, there is no information offered on how this conclusion is reached.
Overall, more data to inform privacy policy-making would be a good thing. As Tom Lenard has pointed out in filings, Congressional testimony, and a recent book chapter submission, the last comprehensive survey of privacy policies was back in 2001, a lifetime ago in the technology industry. Ideally, any privacy proposals from Congress or the FTC should be based upon a survey of the actual current events on the ground, as opposed to opinions and assumptions. Only with relevant data can policies be drafted that are targeting towards specific harms. Additionally, data-driven policymaking can be evaluated to ensure that specific policy is performing as intended, and that benefits derived outweigh the costs of the regulation.
Data collection is burdensome and time consuming for companies involved. Any other government entity (besides Congress) would be required under the Paperwork Reduction Act to have its proposal be assessed, as they are required to “reduce information collection burdens on the public.” Since it doesn’t appear that Rockefeller’s recent requests for information are part of any systematic study or plan, it is understandable why some companies would bristle at the thought of spending time and resources on answering a list of questions.
The FTC recently conducted its own query in preparation for a study on “big data” and the privacy practices of data brokers. One hopes the study, expected to be out by the end of the year, is well-designed and an objective look at the industry without a predetermination of results. Such a study would be useful going forward.
Amy V. Smorodin was Vice President of Communications and External Relations at the Technology Policy Institute. Prior to joining TPI, she was Vice President of Communications at The Progress & Freedom Foundation. Smorodin also served as a public policy communications specialist at the Computing Technology Industry Association (CompTIA), a global tech industry association. She began her media and public relations career at the National Center for Missing and Exploited Children, where she acted as liaison between families, law enforcement, and the media. Smorodin attended American University in Washington, DC.
