Privacy as intellectual property?

• Author: Samuelson, Pamela

INTRODUCTION

Information privacy is a scarce commodity in cyberspace.(1) The technical infrastructure of cyberspace makes it remarkably simple and inexpensive to collect substantial amounts of information identifiable to particular individuals.(2) Once these data have been collected, information technologies make it very easy and cheap to process the data in any number of ways (for example, to make profiles of particular users' interests).(3) Although some privacy-enhancing technologies (PETs) are being developed and deployed, these technologies have thus far done little to make cyberspace more privacy-friendly.(4) The market incentives for firms to collect and process personal data are very high. Data about users is not only useful in assessing how a firm might improve service for its customers,(5) but it also has become a key commercial asset which firms use both for internal marketing purposes and for licensing to third parties.(6) Although the Clinton Administration has worked very hard to persuade Internet economy firms to adopt privacy policies and practices to make users more comfortable about engaging in e-commerce transactions in cyberspace.(7) these efforts have done little to overcome the inertia of the current technical and economic environment(8) that is generally hostile to privacy interests.(9) This symposium has been convened to consider whether the law should play a greater role in promoting greater information privacy in cyberspace.

A recent book succinctly stated the principal utilitarian argument for providing greater protection to personal data in cyberspace and elsewhere:

Consider the incentives of a company that acquires private information. The company gains the full benefit of using the information in its own marketing efforts or in the fee it receives when it sells the information to third parties. The company, however, does not suffer losses from the disclosure of private information. Because customers often will not learn of the overdisclosure, they may not be able to discipline the company effectively. In economic terms, the company internalizes the gains from using the information but can externalize some of the losses and so has a systematic incentive to overuse it. This market failure is made worse by the costs of bargaining for the desired level of privacy. It can be daunting for an individual consumer to bargain with a distant Internet merchant ... about the desired level of privacy. To be successful, bargaining might take time, effort, and considerable expertise in privacy issues.(10) To overcome this market failure, some American commentators have proposed that the law should grant individuals a property right in their personal data which would enable individuals to bargain over which personal data to reveal to which firms for what purposes.(11) Other American commentators have recommended a contractual approach to protecting personal data in cyberspace (or more generally).(12) Some suggest that the law should try to facilitate, and perhaps to approximate, the "privacy agreement the two sides would reach if they were both well informed and it was not expensive to reach an agreement."(13) American commentators generally prefer market-based solutions to personal data protection over the strict comprehensive regulatory regime adopted some years ago in Europe.(14)

While utilitarian considerations weigh heavily in the minds of many Americans who have written on information privacy issues, noneconomic considerations provide an equally or more compelling rationale for legal protection of personal data in cyberspace, according to other commentators. Those who conceive of personal data protection as a fundamental civil liberty interest, essential to individual autonomy, dignity, and freedom in a democratic civil society, often view information privacy legislation as necessary to ensure protection of this interest.(15) Others regard cognitive limitations on the ability of individuals to comprehend and accurately assess the risks of revealing personal data to others as a reason for the law to provide corrective measures.(16) Still others argue for information privacy protection to guard against identity theft, harassment, and other wrongful uses of personal information.(17) Achieving consensus on the rationale for information privacy protection, however, may be unnecessary if both economic and noneconomic considerations favor greater protection for personal data in cyberspace.(18)

Part I considers both the appeal and limitations of the property rights model for protecting personal data. A property rights model offers two principal benefits: First, it would establish a right in individuals to sell their personal data and thereby capture some of the value their data have in the marketplace. Second, a property rights model would force companies to internalize certain social costs of the widespread collection and use of personal data now borne by others. By internalizing these costs, firms may make better investment decisions about what data to collect and what uses to make of the data. A property rights model for protecting personal data nevertheless presents many problems. This approach to personal data protection would, in essence, establish a new form of intellectual property right in information. But it would be an intellectual property right of a very different sort than existing regimes provide. Deep differences in the purposes and mechanisms of traditional intellectual property rights regimes and the proposed property rights regime in personal data raise serious doubts about the viability of a property rights approach and about its prospects of achieving information privacy goals.

Part II explores an alternative market-oriented legal regime for protecting personal information. Such a regime need not ground itself in property law. The law can establish a default rule providing individuals with certain rights to control the collection or processing of personal information about them while also providing individuals with the power to contract away this right (e.g., when they receive compensation for doing so). Because market imperfections may impede fair and effective licensing of personal data in cyberspace, the law can supply some default terms for the licensing of personal data. Certain trade secrecy licensing default rules may be adaptable to the licensing of personal data. The Uniform Computer Information Transactions Act (UCITA) may supply additional default rules for the licensing of personal data in cyberspace.(19) Adoption of online privacy policies could facilitate a market-based licensing approach to personal data protection. When Web sites post notices saying personal data will not be collected, disclosed, or used except for named purposes, users who supply data in reliance on those restrictions may be able to enforce the restrictions. A market-based licensing approach may also arise if technology evolves to allow "negotiated" agreements on the collection, use, or disclosures of personal data.

Although this article endorses a licensing approach to the protection of personal data, it recognizes that the law alone cannot solve information privacy problems in cyberspace. Work must continue on evolving norms about appropriate and inappropriate uses of personal data, on persuading firms that the trust necessary for electronic commerce to flourish requires the interests of individuals in information privacy to be given appropriate deference, and on adapting the technological infrastructure of cyberspace so that information privacy becomes easier to achieve. The principal challenge of these multifaceted endeavors is not to recreate in cyberspace some preexisting zone of privacy from the physical world,(20) but to articulate values inhering in information privacy that should constrain and structure social, economic, technological, and legal relations.(21)

1. THE APPEAL AND LIMITATIONS OF A PROPERTY RIGHTS APPROACH TO PROTECTING PERSONAL INFORMATION

   1. The Appeal of a Property Rights Approach

      It may seem natural for individuals to assume that they do or should own data about themselves.(22) It is surely true that the law will enforce the expectations of individuals that certain private information (for example, a diary or journal) should remain secret.(23) Because individuals generally have a legal right to exclude other people from access to their private data, they may have a sense that they have a property right in the data as well as a legal right to restrict access to it. Even when data about individuals are in the hands of others (such as banks, doctors, and insurance companies), individuals may perceive themselves to have a protectable interest in records of their financial transactions or medical histories.(24) Because the law will sometimes protect these and other types of data from unauthorized uses and disclosures,(25) this too may reinforce a sense of ownership in personal data.

      Although the law often protects the interests of individuals against wrongful uses or disclosures of personal data,(26) the rationale for these legal protections has not historically been grounded on a perception that people have property rights in personal data as such.(27) Indeed, the traditional view in American law has been that information as such cannot be owned by any person.(28) The Fourth Amendment and real property law may provide protection against certain unauthorized intrusions into one's real or personal property for purposes of getting access to information that might be stashed there, and the Fifth Amendment may provide protection against compulsion to reveal certain information about oneself. But these results are not grounded on a belief that people have property rights in information about themselves, but on the recognition of legally protectable interests of other sorts.(29) An individual, for example, may be able to obtain relief if a doctor releases details...