Treating consumer data like oil: how re-framing digital interactions might bolster the Federal Trade Commission's new privacy framework.

• Author: Hasty, Andrew

TABLE OF CONTENTS I. INTRODUCTION II. THE MODERN DIGITAL ENVIRONMENT DEMANDS A NEW REGULATORY APPROACH A. Consumer Technologies Are Rapidly Evolving B. Information-Based Monetization Strategies Are Powering Technological Growth C. Technology's Benefits D. Technology's Privacy Dilemmas 1. Privacy's "Ratchet" and "Shrouding" Problems 2. Privacy Dilemmas Evolve with Changes in Technology III. THE UNITED STATES' REGULATORY REGIME HAS NOT KEPT PACE WITH TECHNOLOGY A. The United States ' Initial Approach to Consumer Privacy in the Digital Era B. The Inadequacy of Existing Mechanisms Prompted the FTC to Step In IV. THE UNITED STATES SHOULD RECOGNIZE DIGITAL INTERACTIONS AS THE COMMERCIAL EXCHANGES OF VALUE THAT THEY ARE A. Digital Interactions Can Be Framed As Commercial Exchanges of Value B. Recognizing Digital Interactions as Commercial Exchanges of Value Synchronizes Well with the FTC's Mandate, Jurisdiction, and Authority C. Recognizing Digital Interactions as Commercial Exchanges of Value Would Substantiate the FTC's New Privacy Framework 1. Transparency Would Have to Increase 2. Consumers Would Encounter Simpler Choices as Firms Competed for Consumers' Data and Attention 3. Firms Would Be Incentivized to Account for Consumer Privacy in the Design of Their Services D. Implementing the Data-As-Oil Framing V. CONCLUSION I. INTRODUCTION

Americans have grappled with consumer privacy concerns for a long time. More than 120 years have passed since Samuel Warren and Louis Brandeis--fearing that innovations such as "instantaneous photography" and "newspaper enterprise" would "proclaim[] from the house-tops" what "is whispered in the closet"--wrote their famous article calling for "the right 'to be let alone.'" (1) And yet, the same concern remains manifest in today's headlines. (2) More than a century later, solutions to the consumer privacy dilemma have not materialized.

Today's technologies enable unprecedented collection and analysis of consumer data, but mechanisms aimed at protecting consumer privacy have lagged. (3) When consumers use search engines to explore the web, exchange messages with friends, or download apps to their smartphones, these digital interactions are often tracked and monetized by a number of behind-the-scenes companies. (4) Yet, as business models centered on monetizing consumers' data and attention have taken off, (5) safeguarding consumer privacy in the United States remains the job of a motley assortment of protections. (6) Indeed, to the extent that regulations exist, they are "sectoral, with different laws regulating different industries and economic sectors." (7) This patchwork has created large gaps in coverage, making the Federal Trade Commission (FTC)--through enforcement of section 5 of the Federal Trade Commission Act ("Section 5") (8)--the United States' "regulator" of consumer privacy. (9)

Over the years, the FTC has skillfully leveraged its tools and experience to advance and enforce three different frameworks for safeguarding consumer privacy, but it has so far been unable to create a regulatory model that keeps pace with rapidly evolving technologies. (10) Beginning in the 1990s, as consumers turned to the Internet to communicate, shop, and explore new possibilities, the FTC promulgated the first of its three privacy frameworks. (11) Widely referred to as the "notice and choice" framework, the FTC's initial attempt to grapple with the consumer privacy implications of connected digital technologies centered on encouraging companies to tell consumers how their data was handled so that consumers could choose which services to use. (12) Despite some early successes, the "notice and choice" approach quickly proved inadequate to deal with the "increasing convergence of online and offline data systems" ushered in by the new millennium. (13) Under its second framework--referred to as the FTC's "harm-based" approach--the FTC "targeted practices that caused or were likely to cause physical or economic harm, or 'unwarranted intrusions in [consumers'] daily lives,"' instead of "emphasizing potentially costly notice-and-choice requirements for all uses of information." (14)

Like the earlier "notice and choice" model, however, the harm-based framework also relied heavily on self-regulation, which developed too slowly to provide consumers with "adequate and meaningful protection" in light of technology's continued march forward. (15) In a recent effort to ensure that adequate and meaningful consumer privacy protections kept pace with technological change, the FTC set out to develop a third framework. In March 2012, after hosting a series of public roundtables and issuing a preliminary report for notice and comment, (16) the FTC released its latest framework for safeguarding consumer privacy. (17)

Meanwhile, consumer technologies--and the privacy problems they raise--continue to evolve. Yesterday's desktop-based Internet technologies are paving the way for tomorrow's "Internet of Things," which seeks to give every device, from pacemakers, eyeglasses, and refrigerators to watches, cars, and HVAC systems, the ability to sense, remember, and communicate information with every other device. (18) Although these technologies promise to improve efficiency, lower costs, and create new products and services that enrich consumers' lives, they also raise serious privacy concerns by making consumers' every action potentially visible to anyone or anything with an Internet connection. (19) Already, as companies rush to extract information from consumers, the expression "data is the new oil" has become a tired cliche. (20) If consumer privacy regulation in the United States is to keep pace without restraining technological development, it must scale to meet complex and evolving challenges.

With the "Internet of Things" on the horizon, this Note asks how the United States' approach to consumer privacy regulation would change if the "digital oil" cliche were taken seriously. The Note proceeds by describing the consumer technology landscape as it currently exists, before turning to the FTC's role as the United States' primary privacy regulator. Through references to existing technologies and services, this Note argues that consumers' digital interactions should be recognized as the commercial exchanges of value that they are. Such a framing would substantiate the FTC's new privacy framework and could realistically be achieved through incremental implementation. After submitting the "data-as-oil" construct to public scrutiny for further refinement, the FTC could bring pilot cases to establish and stress test the theory in varying factual scenarios. This approach--matching the FTC's new privacy framework with the "data-asoil" recognition--could ultimately be used to create a flexible regulatory solution to the complex privacy problems created by evolving technologies.

2. THE MODERN DIGITAL ENVIRONMENT DEMANDS A NEW REGULATORY APPROACH

   The modern digital environment requires a flexible regulatory structure capable of resolving complex consumer privacy dilemmas. As the number of transistors that can fit onto a square inch of silicon continues to double approximately every two years, (21) today's engineers continue to conceive and build products, services, and systems that solve problems and enrich lives. These developments also foster tremendous amounts of data collection, sharing, and use--raising difficult consumer privacy dilemmas that outstrip regulatory capacity. If consumers are to retain control over their information while harnessing the promise of tomorrow's technologies, the United States must implement a flexible regulatory solution that keeps pace with technological development.

   1. Consumer Technologies Are Rapidly Evolving

      What used to be confined to the creative minds of yesterday's science fiction writers is now the stuff of today's technological reality. Over the past few years, consumers have started carrying powerful personal computers at an astonishingly fast rate. Smartphone adoption has "outpaced the 1980s PC revolution, the 1990s Internet boom, and the social networking craze of the 'aughts,'" (22) and is reported to be " (10) times that of what we might now perceive as the positively glacial pace of early personal computer adoption." (23) More than fifty-six percent of adults in the United States own smartphones (24) and spend a considerable amount of time using their devices to interact with the digital world. (25)

      Possessing considerably more power than the guidance computers that first put astronauts on the moon, (26) today's ordinary smartphones are capable of identifying their user's every movement within inches and reporting these movements to anyone or anything with an Internet connection. (27) Brick and mortar retailers can combine their stores' video surveillance with facial recognition technologies to analyze customers' expressions (and, if any of those customers have the retailer's app on their phone, connect their customer's digital interactions with their physical ones). (28) Other examples abound. Bracelets worn around consumers' wrists help their wearers track steps taken, calories burned, and other physical activities. (29) Today's cars integrate sophisticated sensing and processing technologies to detect looming dangers and take preventive actions before the "driver" is even aware of an issue. (30) Many also take advantage of persistent data connections to keep the car in contact with service providers at all times. (31)

   2. Information-Based Monetization Strategies Are Powering Technological Growth

      The rapid development of technology, fueled by information-based monetization strategies, fosters a tremendous amount of data collection, use, and sharing. Aptly described as a "revolution," (32) companies are rapidly adopting "big data" technologies, which promise to yield lucrative insights by mining unimaginably large data sets for previously undiscovered...