Privacy Roundtables - Comment, Project No. P095416
One of the bedrock principles of privacy law in nearly every country that has addressed data privacy is the principle of notice and choice. However, there were comments at the third Roundtable that the regulatory focus on notice and choice has been misplaced. In his testimony and his submitted comments, Prof. Fred Cate stated, "The flurry of notices may give individuals some illusion of enhanced privacy, but the reality is far different." The purpose of notice and choice in this context is not to bestow privacy on individuals or assure them that their privacy has been protected. Notice and choice has been a reasonable solution for many regulators who are faced with regulating a product or activity that has both benefits and attendant consequences, as is the situation when personally identifiable information is available in the marketplace. Notice and choice is a common free-market technique for regulators when a specific activity has many valuable attributes, but some troublesome consequences as well -- for example, FDA and SEC regulation are based on notice and choice. Regulators may not want to proscribe an activity because of its benefits, but also do not want unwary consumers to be caught in the attendant consequences of the activity. Notice provides education to the consumer and consent provides the opportunity for each consumer to individually weigh the benefits of the activity against the attendant consequences, and make an informed decision based on that consumer's risk tolerance and personal preferences. Since GLB was effective in 2001, the flurry of notices has given consumers awareness of the trade-offs inherent in the free flow of personally identifiable information. Social websites, media, and personal experiences have significantly enhanced consumers' awareness of privacy trade-offs. In an area so mutable and unpredictable, it has been the wisest course for regulators to avoid strict limitations on the Internet, and to resist the paternal instinct to dictate how much privacy each consumer is allow to have. Privacy law will evolve along with the Internet and the global marketplace. As it does, regulators should be vigilant to restrict or prohibit abusive practices that unduly threaten consumers' privacy. Nevertheless, there will always be a role for the concept of notice and choice, it has been the correct approach thus far, and will be the best approach for the near future. If the notice is unclear or inadequate, it should be changed. If the consent is not knowing and voluntary, it should be changed. The FTC has addressed both in its recent revisions to the GLB privacy notice rule. Otherwise, until there are specific abuses that must be addressed, regulators should not try to make the benefit/consequences decision on behalf of all consumers.