The costs of privacy.

• Author: Walker, Kent
• Position: Costs and benefits of new information laws

Privacy is both an individual and a social good. Still, the no-free-lunch principle holds true. Legislating privacy comes at a cost: more notices and forms, higher prices, fewer free services, less convenience, and, often, less security. More broadly, if less tangibly, laws regulating privacy chill the creation of beneficial collective goods and erode social values. Legislated privacy is burdensome for individuals and a dicey proposition for society at large.

Information flows in subtle and nuanced ways, and well-intentioned regulations can easily go awry. After all, enforcing privacy restricts the free flow of information. Putting First Amendment implications aside, limiting the communication and use of personal information strikes at the heart of the New Economy, known formerly as "the Information Revolution." Many of the privacy laws proposed or enacted to date have been overbroad, inefficient, bureaucratic, and inconsistent. A review of the numerous hidden issues associated with typical elements of "fair information practices"--notice, consent, access, and third-party transfer--reveals the difficulty of translating these general notions into sensible policy.

I argue not against privacy but in favor of striking a reasoned balance between privacy and other countervailing interests; not against regulation but in favor of carefully tailored regulations to address specific problems at minimal cost.

1. THE INDIVIDUAL, COLLECTIVE, AND SOCIAL COSTS OF PRIVACY REGULATION

   Most people want to know things about others but simultaneously want to block others from knowing personal information about them. The desire to exercise complete control over one's personal information is understandable as a means of maintaining a zone of privacy and reducing the possibility that information will be misused. But to what degree should we incorporate such preferences into actual regulations? More important, what would we lose--individually, collectively, and socially--from legislating broadly in this arena?

   The question cannot be answered by a blithe invocation of privacy rights. We have no inalienable right to keep others from talking about us. You have no legal right to prevent your local baker from telling an assistant that you like cinnamon rolls. Nor do you have a legal right to demand to see if you are on your local florist's list of good customers. Leaping to assertions of nonnegotiable rights unfortunately tends to preempt reasoned discussion of the costs and benefits of regulatory action. (1)

   The alternative--tallying the costs and benefits of new information regulations--would seem uncontroversial. Yet a cost-benefit perspective is notably absent from the contemporary debates over information privacy. For example, the Federal Trade Commission omitted such a review before issuing its May 2000 Privacy Report calling for privacy legislation. (2) As Commissioner Orson Swindle noted in dissent:

   [T]he Privacy Report fails to pose and to answer basic questions that all regulators and lawmakers should consider before embarking on extensive regulation that could severely stifle the New Economy. Shockingly, there is absolutely no consideration of the costs and benefits of regulation; nor the effects on competition and consumer choice; nor the experience to date with government regulation of privacy; nor constitutional implications and concerns; nor how this vague and vast mandate will be enforced. (3) The following sections undertake a cost-benefit analysis of regulating the use of personal information in the New Economy.

   1. Individual Costs

      The costs to individual consumers of regulating the use of personal information are relatively clear. (4) Such regulation would likely increase both direct and indirect costs to the individual consumer, reduce consumer choice, and inhibit the growing trend toward personalization and tailoring of goods and services. Laws that make it harder for you to share contact information also make it less likely that you will receive the discounts and offers that interest you--whether free videos, discounts on kids' toys, a deal on a new computer, or cut-rate airfare. These kinds of tailored offers reduce the cost of living for millions of Americans.

      From a macroeconomic perspective, targeted offers reduce marketing and distribution costs for sellers, and thus ultimately reduce the prices of all goods and services. Auctions, reverse auctions, and other pricing innovations that make it easier for buyers and sellers to exchange information not only reduce online prices but also create competitive pressures that reduce offline prices as well. Online exchanges that help buyers and sellers locate each other also facilitate the sale of perishable goods--airline tickets, hotel rooms, and long-distance time--that would otherwise go to waste. Some of this targeting and tracking is automatic, as when a supermarket provides a discount coupon for jelly on the back of a receipt given to someone buying peanut butter, but much of it requires depositing information into a database for later retrieval.

      Recent studies have shown the significant costs of erecting elaborate systems to track and monitor personal information but have not considered the second-order costs of the burdens imposed on individual consumers. Costs for the online sector alone have been estimated at $9-36 billion. (5) The costs of the recently adopted privacy regulations in the health industry, even as liberalized by the Bush Administration, are estimated at $17.6 billion. (6) Such costs are passed on to consumers in the form of higher prices and, ultimately, reduced consumer choice. (7)

      Beyond higher costs and reduced access, information restrictions threaten to burden the personalization and tailoring of goods and services--one of the signal advantages of the new technology infrastructure. Federal Reserve Board Chairman Alan Greenspan has cited the use of detailed data to fine-tune product specifications to most individual customer needs as one of the reasons for the rapid rise in U.S. productivity over the last decade. (8) From a personal perspective, there is comfort and convenience in knowing that, like your local restaurant, your retailer knows your name, knows your "usual," and knows that you like a table by the window.

      Personalization (with preferences derived from a user's conduct), customization (with preferences derived from a user's expressed desires), and interactivity (a user's interaction with a website to obtain tailored content) add tremendous value. According to Business Week: "At Excite Inc., for example, customers who exchange tidbits about themselves in return for a personalized experience--in the form of selected news, movie listings, local weather, etc.--return to the site roughly 20 times more often than those who don't." (9)

      Having some personal information accessible online--using third parties to warehouse information like billing and shipping addresses, credit card numbers, and individual preferences--has advantages. It can dramatically simplify the purchasing experience, ensure that you get a nonsmoking room, or automate the task of ordering a kiddie meal each time your child boards a plane. Giving others information about your purchases lets you receive notice of recalls, facilitation of technical support, and discounts on related products. In the not-too-distant future, information sharing may let intelligent agents do your shopping and store valuable information resources on a free-floating network accessible from anywhere.

      Even the kinds of programs that might be deemed unacceptable uses of customer information--like Amazon.com's foray into charging different shoppers different prices for the same books--offer overall savings to users. After receiving unfavorable press coverage, Amazon dropped the practice, which was merely a variant of other types of benefit programs for loyal customers. (10) Through Green Stamps, loyalty programs, and premier frequent-flyer clubs, many companies have traditionally offered different promotions and levels of service to different customers. Classical economics holds that such price discrimination is efficient, resulting in the socially optimal production of the goods or services in question. (11) As one economist noted, price discrimination "would obviously be good for Amazon. But it would also be good for the overall book business. Publishers would be willing to publish more titles, book buyers who would otherwise have delayed their purchase until the thing came out in paper would be spared the wait." (12) The distributional effects might even be progressive because the more affluent are typically less price sensitive and, thus, likely to be charged more.

      Although overbroad privacy regulations certainly threaten to burden all of these individual advantages, such costs have been widely discussed. The collective and social costs of privacy regulation are less obvious but no less real or important.

   2. Collective Costs

      Broad-brush privacy laws risk upsetting a delicate balance of incentives that produce many collective benefits. Three issues arise in the collective cost analysis: 1) informational network effects that make technologies more valuable as the number of users increases; 2) the difficulty of handling informational externalities so that social actors face the true costs of their choices; and 3) the need to have a critical mass of participants sharing personal information before a collective information benefit is worth providing. These phenomena highlight how the regulation of personal information comes at a high collective cost.

      1. Network Effects

         Information is the quintessential network good with its exchange frequently benefiting others not party to a specific transaction. Network effects arise with any technology or system whose value increases with the number of people who use it. The doctrine of network effects--discussed in technology circles as Metcalfe's Law...