Fiduciary Boilerplate: Locating Fiduciary Relationships in Information Age Consumer Transactions.

• Author: Scholz, Lauren Henry

1. INTRODUCTION 144 II. CONSUMER-FIRM ENGAGEMENT IN THE INFORMATION ECONOMY 147 A. Reconceptualizing Consumer Transactions as Fiduciary Relationships 147 B. Consumer Contracts as Pervasive and Networked 151 C. Widespread Deviation from Mutable Boilerplate Terms 157 III. FROM CONTRACT LAW TO FIDUCIARY LAW 164 A. The Consent Debate and the Battle for the Soul of Contract Law 165 B. Beyond Consent: The Turn to Obligations Implied in Law 175 i. Reinforcing Unconscionability 176 ii. Relational Contracting and Reasonable Expectations 179 iii. Unconscionability and Relational Contracting as Precedents for Finding Consumer-Firm Fiduciary Relationships 184 IV. JUSTIFYING FIDUCIARY RELATIONSHIPS IN CONSUMER LAW 186 A. Mandatory Terms for Mandatory Transactions 187 B. Fiduciary Duties for Ongoing Relationships of Trust 191 C. Implementation 194 V. CONCLUSION 198 I. INTRODUCTION

   Many consumer-firm relationships in the information age have come to resemble fiduciary relationships, yet American law has failed to recognize this new reality, leaving the consumer vulnerable to loss of privacy and elevated cybersecurity risks.

   In fiduciary relationships, one party (the fiduciary), has discretionary power over another party's (the entrustor) important practical interests. (1) There are many types of fiduciaries recognized at law, as disparate as clergy, medical professionals, and corporate officers. (2) What unites all fiduciaries is the fiduciary's potential to misuse the power granted to her by the entrustor for her own benefit and the entrustor's detriment. (3) To prevent abuse of power, fiduciary law imposes duties upon the fiduciary, the core purpose of which is to hold the fiduciary to loyalty toward the entrustor and her interests. (4) Enforcing fiduciary loyalty at law has both moral and utilitarian justifications. (5)

   This Article argues that consumer transactions in the information age should create fiduciary relationships between consumer and company. This means companies would have fiduciary duties to consumers that consumers cannot waive, regardless of boilerplate's text. In a fiduciary law framework, the role and significance of consumer boilerplate would be as follows. The offer of a consumer boilerplate contract by a company signals its intent to enter an ongoing fiduciary relationship with consumers in the provision of services. A consumer's assent to the boilerplate signals a consumer's intention to participate in a fiduciary relationship with the company. The effect of fiduciary duties in this context is to create technology-neutral protections for consumers against exploitation. Fiduciary duties would mean expanded liability for data protection failures for companies. (6)

   Industry practices (7) and court rulings (8) support recognizing a fiduciary relationship between firms and consumers in many information age transactions. The consumer needs to do little more than switch on any media device to see advertising and other representations by companies asserting "your privacy is important to us" or "we will not sell your data to any third party." (9) Trust is a powerful currency in the internet age, and companies promote an image consistent with responsible stewardship of individual data and other consumer interests. These representations are not mere puffery. (10) Observers have documented that companies offer more services and protections than the consumer boilerplate's text suggests they are obligated to do. (11)

   Contemporary doctrinal and legislative trends suggest an emerging recognition of the fiduciary relationship between consumers and firms arising from information age consumer transactions. In recent years, several courts have held that companies can be bound to take action that protects consumer data protection interests, even if the contract between the two parties does not impose any such obligation. (12) The source of the obligation, for these courts, comes from comfort language in communications and policies outside the contract, including privacy policies. (13) Comfort language includes statements representing that the company will protect and prioritize the particular interests of the consumer. In line with this trend in the courts, Congress has recently proposed a bill that would create a duty of loyalty for companies to consumers concerning data protection. (14) While neither these courts nor the proposed legislation explicitly state that consumer transactions create fiduciary relationships, I suggest that a fiduciary relationship is consistent with the duties recognized and the best way to make sense of why companies would have these duties to consumers.

   I make three novel contributions to the consumer law literature in this Article. First, I establish that information-age consumer-company relationships have the characteristics of fiduciary relationships. Second, I explain how a fiduciary relationship in consumer contracting can be derived from existing common law history and current doctrine. Finally, I make the normative argument that implying fiduciary relationships into consumer contracts is feasible and desirable.

   My argument in this Article builds upon my earlier work on information privacy, where I argue that privacy is not property, but rather a strong power to limit another actor's behavior in a relationship between two actors. (15) In a fiduciary relationship, an entrustor has just such an interest in in the fiduciary's continued performance of her duties, a power frequently compared in its effect to a property interest (though, unlike property interests, not good against all persons, only the fiduciary). (16) I have also argued that, in many cases, the measurement of privacy remedies should be restitution, or relief measured in gain to defendant rather than by loss by plaintiff. (17) Restitution is often the measure of damages for breach of fiduciary duties. This serves to minimize opportunistic behavior in these relationships through providing remedies for a broader range of activities than compensation. (18)

   The Article will proceed as follows. In Part II, I will show how common business practices are consistent with the fiduciary framing the consumer boilerplate's role. Then, in Part III, I describe existing approaches to consumer boilerplate and develop and contrast the fiduciary approach to consumer transactions. Finally, in Part IV, I build a normative argument for understanding consumer transactions as fiduciary relationships and demonstrate this proposal's feasibility and limits.

2. CONSUMER-FIRM ENGAGEMENT IN THE INFORMATION ECONOMY

   The structure of the information economy forces consumers to trust companies with control of their data protection interests to obtain services. Companies routinely treat their customers' data with more solicitude than their contractual boilerplate and background law requires, suggesting an obligation that extends beyond these terms. (19) Furthermore, the contract text itself changes over time as the service and industry practice changes. Taken together, these factors suggest a fiduciary relationship in many information age consumer transactions. In fiduciary relationships, one party (the fiduciary) has discretionary power over important practical interests of another party (the entrustor), and the combination of delegation and complexity creates the potential for opportunistic behavior by the fiduciary. When they participate in the information economy, consumers grant companies control over selecting and implementing data protection. The risks and opportunities presented by data processing in the information economy are too specialized, complex, and dynamic for consumers to monitor. What exists between firm and consumer in the average ongoing consumer relationship is not just a contractual relationship, but an ongoing fiduciary relationship of trust. In this Part, I first define a fiduciary relationship and provide a general description of fiduciary duties. Then, I will illustrate the specific sense in which the term may be applied in the consumer contracting context.

   1. Reconceptualizing Consumer Transactions as Fiduciary Relationships

      A fiduciary relationship is one in which one party (the fiduciary) enjoys discretionary power over the significant practical interests of another (the entrustor). (20) One party to the relationship is dependent on the other for the provision of a service. (21) The service can only be performed if the fiduciary is so entrusted. As a result of this discretionary power in the context of a relationship of trust, the fiduciary has a series of duties to the entrustor. (22)

      There are two types of fiduciary relationships: relationships based on status and ad hoc fiduciary relationships. (23) The difference between the two is that status fiduciary relationships are based on the finding that a relationship of a certain type exists, such as lawyer-client, doctor-patient, or trustee-beneficiary. (24) No further inquiry beyond finding the status is necessary to find the fiduciary relationship, as the law assumes, prophylactically, that a relationship of dependence exists between fiduciary and entrustor. (25) Ad hoc fiduciary relationships, by contrast, are the result of a fact-based inquiry in which courts establish that a fiduciary relationship was formed between the parties, based on finding a relationship of trust and a granting of discretion from one individual to another. (26)

      There has been a resurgence in academic interest in fiduciary law in recent years, as the prominence of fiduciary duties in society grows. (27) Fiduciary relationships have long and deep roots in the common law. (28) Fiduciary duties have evolved and changed over time, based on social and economic contexts, as more relationships have been found to have fiduciary status over time because of the changing nature of relationships in business and society. (29)

      As this historical narrative shows, status-based fiduciary relationships are a...