Abstract
Advocates of digital privacy law believe it is necessary to correct failures in the market for digital privacy. Though legislators allegedly craft digital privacy regulation to protect consumers, some advocates have understated the dangers that digital privacy law may engender. This paper provides evidence for Kirzner’s “perils of regulation” in the digital privacy arena. The regulatory process fails to simulate the market process, stifles entrepreneurial discovery, and creates opportunities for superfluous discovery. My research suggests that policy-makers should consider a more holistic accounting of the costs before imposing additional digital privacy regulation.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Notes
See Hirsch (2010) for a more comprehensive accounting of the ways that websites may collect information and of the parties who have a vested interest in information collected on the Internet.
Hirshleifer (1980) took issue with the Posnerian focus on “privacy” as “secrecy,” arguing that “privacy” should be defined more expansively, likening “privacy” to “autonomy.” For Hirshleifer, privacy as autonomy entails freedom from observation. I stick to the Posnerian conception.
Hirsch (2010) advocates a “co-regulatory” approach to protecting privacy in which governments and firms work cooperatively to set regulations. Incidentally, one of the most cited papers on the economics of co-regulation is an examination of its operation in the context of food safety economics (see Martinez et al. 2007).
Kirzner begins his discussion by exploring the “undiscovered discovery process.” He uses this terminology to highlight that what has been labeled a “market failure” is, in fact, an opportunity for entrepreneurial profit. Calls for regulation frequently follow from the belief that entrepreneurs are incapable of solving alleged market failures. The focus of this paper is not on how entrepreneurs may solve digital privacy problems (though such research is worthwhile). Rather, the focus of this paper is on the ways that digital privacy law distorts the entrepreneurial market process, and thus I begin my analysis by discussing the “unsimulated” rather than the “undiscovered” discovery process.
Note that a “security” risk differs from a “privacy” risk. The latter refers to the types of information I deal with in this paper: personal, but nonsensitive information. The former refers to sensitive information such as an individual’s credit card number.
The Directive also contains provisions for protecting against true invasions of property, such as credit card theft.
An early study (Gross and Acquisti 2005) of Facebook and other social media sites revealed that young users, on average, did not express a high desire for digital privacy or anonymity, suggesting that the aims of privacy legislators become quickly outdated.
The knowledge that ARGO aggregates is Hayekian in the sense that it is localized and dispersed, though not tacit.
For example, DuckDuckGo is a rapidly growing search engine that does not track individual’s queries.
Note that this paper focuses primarily on “privacy” risks, that is access to “nonsensitive” information, rather than on threats to “sensitive” information such as credit card theft. The latter fits more properly under the category of “cybersecurity.” What this section demonstrates, however, is the ironic fact that bureaucratic efforts to shield privacy may, in fact, result in graver threats to one’s own cybsersecurity.
This piece of legislation is based on the Obama Administration’s 2012 “Consumer Privacy Bill of Rights.”
I am indebted to a 2015 blog post entitled “Innovation Death Panels and Other Shortcomings” by Geoffrey Manne and Ben Sperry at the blog “Truth on the Market” for the idea that the “Consumer Privacy Bill of Rights” exposes consumers to greater privacy risks.
As Hirsch (2010) documents, providing consumers with “access” to their information–what this bill would do–is a cornerstone of the 1973 Fair Information Practice Principles (FIPPs) proposed by the Department of Health, Education, and Welfare (HEW).
Once an Internet merchant has established a digital storefront, the marginal cost of acquiring and serving an additional customer is often very low.
Sands is a technology executive who has experience with large companies as well as several startups, including several directly involved in providing digital privacy solutions.
Note that Milberg et al. (2000) argue that one benefit of digital privacy law is that it would correct the “reactive” failures of private firms.
Obviously, the same conclusion holds for entrepreneurs in any country.
References
Acquisti, A., & Grossklags, J. (2005). Privacy and rationality in individual decision making. IEEE Security and Privacy, 1, 26–33.
Acquisti, A., Taylor C. R., Wagman, L. (2015). The economics of privacy. Available at SSRN 2580411.
Baumol, W. J. (1996). Entrepreneurship: productive, unproductive, and destructive. Journal of Business Venturing, 11(1), 3–22.
Bergkamp, L. (2003). European Community Law for the New Economy. Intersentia nv.
Bibas, S. A. (1994). Contractual approach to data privacy. Harvard Journal of Law & Public Policy, 17, 591.
Buchanan, J. M. (2005) Afraid to be free: Dependency as Desideratum. In Policy Challenges and Political Responses (pp. 19–31). US: Springer.
Budnitz, M. E. (1997). Privacy protection for consumer transactions in electronic commerce: why self-regulation is inadequate. SCL Rev, 49, 847.
Campbell, J., Goldfarb, A., & Tucker, C. (2015). Privacy regulation and market structure. Journal of Economics and Management Strategy, 24(1), 47–73.
Clarke, R. (1999). Internet privacy concerns confirm the case for intervention. Communications of the ACM, 42(2), 60–67.
Consumercal (2015). The Children’s Online Privacy Protection Act (COPPA). Accessed June 26, 2015. http://consumercal.org/about-cfc/cfc-education-foundation/what-should- i-know-about-privacy-policies/californiaonline-privacy-protection-act-caloppa-2/.
Craig, T., & Ludloff M. E. (2011). Privacy and big data. O’Reilly Media, Inc.
Demsetz, H. (1969). Information and efficiency: another viewpoint. The Journal of Law & Economics, 12(1), 1–22.
Essers, L. (2015). Cloud startup zettabox touts privacy and local storage to appeal to EU Customers. Last modified June 10, 2015. http://www.pcworld.com/arti-cle/2934112/cloud-startup-zettabox-touts-privacyand-localstorage-to-appeal-to-eu- customers.html.
European Commission (2012). Press Release Database. Commission proposes a comprehensive reform of data Protection rules to increase users’ control of their data and to cut costs for businesses.
European Union Agency for Fundamental Rights (2014). Handbook on European Data Protection Law.
Executive Office of the President (2014). President’s Council of Advisers on Science and Technology Report to the President. Big data and privacy: a technological perspective.
Ezor, J. I. (2012). Privacy and data protection in business: Laws and practices. Lexis- Nexis.
Federal Trade Commission (2012). Protecting consumer privacy in an Era of rapid change. Washington, DC: FTC Report.
Federal Trade Commission (2013). Children’s Online Privacy Protection Rule; Final Rule, Part II, 2013, Federal Register 78, no. 12 (January 17, 2013): http://www.gpo.gov/fdsys/pkg/FR-2013-01-17/pdf/2012-31341.pdf#page=38.
Foldvary, F. E., & Klein, D. B. (2002). The half-life of policy rationales: how new technology effects old policy issues. Knowledge, Technology & Policy, 15(no. 3), 82–92.
FTC Privacy Report (2013). Oliver and Grimsely. Last modified. http://www.olivergrimsley.com/2013/05/ftcprivacyreport/.
Gaudin, S. (2011). Social Networks Credited with Role in Toppling Egypt’s Mubarak. Computerworld. Last modified February 11, 2011. http://www.computerworld.com/article/2513142/web-apps/social-networkscredited-with-role-in-toppling-egypt-s-mubarak.html.
Geiger, J. (2003). Transfer of data abroad by Private Sector Companies: data protection under the German Federal Data Protection Act. German Law Journal, 4, 747.
Goldfarb, A., & Tucker, C. E. (2011). Privacy regulation and online advertising. Management Science, 57(1), 57–71.
Granovetter, M. S. (1973). The srength of weak ties. American Journal of Sociology, 1360–1380.
Gross, R., & Acquisti A. (2005). Information revelation and privacy in online social networks. In Proceedings of the 2005 ACM Workshop on Privacy in the Electronic Society, pp. 71–80. ACM.
Heath, N. (2013). EU privacy laws to spell an end to facebook for free? ZDNet. Last modified. http://www.zdnet.com/article/eu-privacy-laws-to-spell- an-end-to-facebook-for-free/.
Higgs, R. (1997). Regime uncertainty. The Independent Review, 1(no. 4), 561–590.
Hirsch, D. D. (2010). Law and policy of online privacy: regulation, self-regulation, or co-regulation. The Seattle Univ Law Rev., 34, 439.
Hirshleifer, J. (1980). Privacy: its origin, function, and future. The Journal of Legal Studies, 649–664.
Hoofnagle, C. J. (2005) Privacy self regulation: A decade of disappointment. In J. K. Winn (Ed.) Consumer Protection in the Age of the ‘Information Economy’ (Ashgate 2006).
Ikeda, S. (2002) Dynamics of the mixed economy: Toward a theory of interventionism. Routledge.
Ikeda, S. (2005). The dynamics of interventionism. Advances in Austrian Economics, 8, 21–57.
Jamal, K., Maier, M., & Sunder, S. (2005). Enforced standards versus evolution by general acceptance: a comparative study of ecommerce privacy disclosure and practice in the United States and the United Kingdom. Journal of Accounting Research, 43(1), 73–96.
Jolly, I. (2014). Data protection in United States: Overview. Practical Law. Last modified July 1, 2014. http://us.practicallaw.com/6-502-0467#a89631.
Kirzner, I. M. (1985). Discovery and the capitalist process. University of Chicago Press.
Lenard, T. M., & Rubin, P. H. (2009). In defense of data: information and the costs of privacy. Technology Policy Institute Working Paper 9–44.
Lerner, J. (2012). The impact of privacy policy changes on venture capital investment in online advertising companies. Analysis Group, 1–27.
Lin, E. (2002). Prioritizing privacy: a constitutional response to the internet. Berkeley Technology Law Journal, 17, 1085.
Litan, R. E. (1999). Balancing costs and benefits of new privacy mandates. AEI-Brookings Working Paper, 99–03.
Madden, M. (2014). Public perceptions of privacy and security in the Post-Snowden Era. Pew Internet. Last modified November 12, 2014. http://www.pewinter-net.org/2014/11/12/public-privacy-perceptions/
Manne, G. & Sperry, B. (2015). Innovation death panels and other economic shortcomings of the White House Proposed Privacy Bill. Truth on the Market (blog). March 18, 2015, http://truthonthemarket.com/2015/03/18/innovation- death-panels-privacy-bill/
Martinez, M. G., Fearne, A., Caswell, J. A., & Henson, S. (2007). Co-Regulation as a possible model for food safety governance: opportunities for public–private partnerships. Food Policy, 32(no. 3), 299–314.
Mayer-Schönberger, V. (2010). Beyond privacy, beyond rights—toward a ‘systems’ theory of information governance. California Law Review, 1853–1885.
Milberg, S. J., Smith, H. J., & Burke, S. J. (2000). Information privacy: Corporate Management and National Regulation. Organization Science, 11(1), 35–57.
Mises, L. v. (1949, 1998). Human action, scholars’ edition. Auburn: Mises Institute.
Mole, B. (2015). New Flu tracker uses google search data better than google. ArsTechnica.
Neef, D. (2014). Digital exhaust: What everyone should know about big DATA, Digitization and Digitally Driven Innovation. Pearson Education.
New Singapore Data Protection Law: What You Need to Know (2015). London: Olswang LLP, 2012. Accessed June 29, 2015. http://www.alston.com/files/docs/OlswangNew_Data_Protection_Law.pdf.
O’Brien, D. (2014). Start-ups, Data Privacy and Disruption. Privacy Association. Last modified August 21, 2014. https://privacyassociation.org/news/a/start-ups-data-privacy-and-disruption/.
Online Privacy Protection Act of 2003 (2003). California Statute. Section 22575–22579. http://www.leginfo.ca.gov/cgi-bin/displaycode?section=bpc&group=22001-23000&file=22575-22579.
Pasquale, F. (2012). Privacy, antitrust, and power. George Mason Law Review, 20, 1009–1024.
Pavlou, P. A. (2011). State of the information privacy literature: where are we now and where should we go? MIS Quarterly, 35(no. 4), 977–988.
Posner, R. A. (1978). Economic theory of privacy. Regulation, 2, 19.
Posner, R. A. (1981). The economics of privacy. The American Economic Review, 405–409.
Rothbard, M. N. (1962). Man, economy, and state (Vol. 2). Princeton: Van Nostrand.
Sands, T. (2015). email correspondence.
Sands, T. (2016). email correspondence.
Sarathy, R., & Robertson, C. J. (2003). Strategic and ethical considerations in managing digital privacy. Journal of Business Ethics, 46(2), 111–126.
Scholz, L. (2015). Privacy as Quasi-Property. Iowa Law Review, Forthcoming.
Scott, M. (2015). As facebook sweeps across Europe, regulators gird for battle. New York Times.
Shirky, C. (2011). The political power of social media. Foreign Affairs, 90(1), 28–41.
Solove, D. J. (2004). The digital person: Technology and privacy in the information age. NYU Press.
Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review: 477–564.
Statista (2015). Number of Monthly active facebook users worldwide as of 1st Quarter 2015 (in Millions). Accessed June 25, 2015. http://www.statista.com/statistics/264810/number-of-monthly-active-facebook-usersworldwide/.
Stigler, G. J. (1980). An introduction to privacy in economics and politics. The Journal of Legal Studies, 623–644.
Swire, P. P. (2003). Efficient confidentiality for privacy, security, and confidential business information. Brookings-Wharton Papers on Financial Services, 2003(1), 273–310.
Techworld (2015). Zettabox Gambles on EU Privacy Law to Take on Google, Amazon and Microsoft in Cloud Storage Battle. Last modified June 11, 2015. http://www.techworld.com/news/cloud/cloudstartup-zettabox-touts-privacy-and-local-storage-to-appeal-to-eu-customers-3615326/.
Thierer, A. (2013). Privacy law’s precautionary principle problem. Maine Law Review, 66, 467–486.
Varian, H. R. (1997). Economic aspects of personal privacy. In Privacy and Self-Regulation in the Information Age. US Department of Commerce.
Warren, S. D., & Brandeis, L. D. (1890). The right to privacy. Harvard Law Review, 193–220.
Yang, S., Santillana, M., & Kou, S. C. (2015). Accurate estimation of influenza epidemics using google search data via ARGO. Proceedings of the National Academy of Sciences, 112(no. 47), 14473–14478.
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Fuller, C.S. The perils of privacy regulation. Rev Austrian Econ 30, 193–214 (2017). https://doi.org/10.1007/s11138-016-0345-0
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11138-016-0345-0