Data Ownership: Privacy Concern or Red Herring?

While privacy and piracy have been in the news quite a bit in the past few months as separate ideas, David Holtzman’s Viewpoint in Business Week Online - July 24, 2006, took the interesting step of combining them. Recent debate about privacy has been engulfed by repeated high profile breaches and the subsequent focus on data protection and security. Mr. Holtzman moves the discussion about privacy back to where it belongs – the value of personal data and how it is used.

The focus on “ownership” however, may be a red herring.

The concept of ownership bundles rights that a person can 1) assert around a thing, and 2) can restrict anyone else from asserting around such thing. This works well with physical objects (film, cars, CDs, etc.) but becomes more problematic when addressing data about such things. A person actually does not own personally identifiable data in many instances. For example, I don’t “own” my bank account number. While this may be counterintuitive, I cannot restrict my bank from changing or even reusing my account number. Because the bank has more rights over who can and how that number can be used, I can’t be said to “own” that number. Much personally identifiable data is subject to this quandary – the data is about me, but I don’t “own” it.

Control versus Ownership

This difficulty with “ownership” exposes Holztman’s red herring. Most of us aren’t as concerned with the technicality of ownership of our data, as much as asserting control over our data. Jim Harper of the Cato Institute articulates the definition of privacy like this:

“Privacy is the condition that people enjoy when they are given the opportunity to control information about themselves, and they exercise that control in a manner consistent with their interests and values.”

A privacy policy is supposed to do exactly that — to allow you to exercise of control over data about yourself. Without mentioning “ownership” this definition works well with how consumers interact with their data in the marketplace.

TRUSTe’s program requirements around what must go into a privacy policy expressly require this option of control. According to TRUSTe, a consumer must be given the option of limiting use beyond the transaction for which data was collected, and a company may not eliminate this requirement through privacy policy disclosures. (There is an exception for complying with legal disclosure requests from the government, as recently seen with the nation’s telecommunications firms.)

Further, where a website collects personally identifiable data from a third party, as in a gift delivery, the consumer must affirmatively opt-in to any other use by the same company that isn’t for the primary purpose of the collection. This means that if a friend sends you flowers, that flower shop shop is not able to send you offers for additional services unless you opt-in. . These requirements give control to the consumer regardless of who “owns” the data. A company, at least one certified by TRUSTe, can hardly do what ever it wants with data about an individual.

Mr. Holtzman and I do not greatly disagree. He offered our shared viewpoint with the statement:

“As consumers, we should be entitled to only give out our information when we want, and maintain some control over its subsequent disposition, including mandatory erasure when our business relationship is terminated.”

TRUSTe requirements, and all the regulatory environments which address personally identifiable data (e.g. Gramm-Leach-Bliley Act, HIPAA, Fair Credit Reporting Act, etc.) are in alignment with this concept of control versus ownership. Compliant policies restrict how personally identifiable data about an individual is used and disclosed regardless of who “owns” the data.

Commerce versus Stealing

Which brings us to the second privacy issue raised by Mr. Holtzman – the value of data. Mr. Holtzman makes a fascinating assertion that a privacy statement is a “…license to steal consumer information, wrapped up in legal tinsel.”

First, stealing is taking from a person, without their consent, something they “own” (which may or may not be the case with personally identifiable information.). Consequently, there are two elements in play here: 1) ownership of the data in question, and 2) lack of consent. If a person gives you something, that isn’t stealing. Further, if a person gives you something in exchange for something else, not only is that not stealing, that is called commerce.

So, putting aside the first threshold issue of “ownership,” let’s discuss the second issue of “bargained-for exchange,” which seems to be at the root of Mr. Holtzman’s complaint – “why can’t I get paid for data about me?”

A consumer interacts with a company (which would be the reason for a privacy policy to even apply) when the individual perceives a value to the interaction. Perceived value could come from information the individual receives from the company, or from the services that the company offers. I pay my bills at CheckFree because I perceive value when I don’t have to pay 37 cents to mail my bill. Further, when CheckFree personalizes communication with me, I perceive value in knowing I am not getting phished or spammed. So, for the disclosure of my information, I receive value in reducing my cost of paying bills, increased security in communication from Checkfree, and increased convenience of paying bils online.). All this for a service I don’t have to pay for. That looks a lot like bargained for exchange.

Regardless of “ownership”, the individual’s engagement with the business provides at least perceived, if not actual, benefit for the consumer. This is not stealing.

Now, a larger question lies in what kinds of companies actually do follow TRUSTe or GLB-like requirements? And additionally, is the benefit given to consumers actually realized to the level that the consumer wants? I think these are excellent questions and should be fully explored. However, these questions do not really lend themselves to the sensationalization that sells newspapers.

Regardless of how sexy the topic may not be, it is fundamentally the first principle of the privacy debate – can individuals control information about themselves in a way that is consistent with their interests and values; or is commerce placing a lower value on the bargained for exchange than the consumer might? This is a question of market motivations and consumer values. However, before any of this can happen in a meaningful way, commerce must adopt the business models that provide informed choice to the individual. TRUSTe is one way the marketplace does this.

3 comments July 26th, 2006

Can (and should) a business really “own” customer data?

Much ado has been made about businesses “owning” information. Information is difficult to “own”. Ownership is defined as the exclusive right of possession, enjoyment, and disposal of a thing. In today’s society multiple parties (businesses, consumers, governmental bodies, etc.) assert rights to information. And yet, all of those parties have a right to possess such information. While companies have a fundamental “ownership” right to their business records, TRUSTe contends that the question isn’t really about ownership. Fundamentally the issue is control. Consumers should have rights to say in how those records are used via informed consent.

This issue of data ownership has existed for many years, but has only recently come into the media spotlight when AT&T updated their privacy policy to clearly state their “ownership” of customer data. TRUSTe feels that clear notice of data use practices are the lynchpin of trust in an online world. Just as AT&T has done in their privacy statement, TRUSTe promotes informed choice about personal information and encourages the explicit disclosure of information collection and uses. The AT&T policy change is a positive step in the right direction as they have elevated the debate. Now we all know what has been occurring for the past few years.

Businesses (like AT&T) may have a fundamental “ownership” rights to data. However companies, have obligations to the subject of the information regardless of whether or not they own the information. For example, consumer protection statutes do not protect the data itself, they protect the consumer – the subject of the data. The “owner” is still responsible for how their use and misuse of information will affect the customer.

Businesses who “own” data should finally consider consumer choice – what choices do consumers have regarding what companies do business with. Based on the data use and sharing practices of the company. As mentioned above, TRUSTe promotes transparency and informed choice. Therefore, TRUSTe encourages businesses to let consumers exercise their right to have a say in how those records are used via informed consent arising from all the state and federal consumer protection statutes.

While companies have a fundamental “ownership” right in their business records, it is important to remember that consumers have rights to say in how those records are used via informed consent. The AT&T policy change is a positive one – being transparent is a good thing for all parties

Add comment July 5th, 2006