The Costs of Privacy

Privacy is both an individual and a social good. Still, the no-free-lunch principle holds true. Legislating privacy comes at a cost: more notices and forms, higher prices, fewer free services, less convenience, and, often, less security. More broadly, if less tangibly, laws regulating privacy chill the creation of beneficial collective goods and erode social values. Legislated privacy is burdensome for individuals and a dicey proposition for society at large. Information flows in subtle and nuanced ways, and well-intentioned regulations can easily go awry. After all, enforcing privacy restricts the free flow of information. Putting First Amendment implications aside, limiting the communication and use of personal information strikes at the heart of the New Economy, known formerly as "the Information Revolution." Many of the privacy laws proposed or enacted to date have been overbroad, inefficient, bureaucratic, and inconsistent. A review of the numerous hidden issues associated with typical elements of "fair information practices"--notice, consent, access, and third-party transfer--reveals the difficulty of translating these general notions into sensible policy. I argue not against privacy but in favor of striking a reasoned balance between privacy and other countervailing interests; not against regulation but in favor of carefully tailored regulations to address specific problems at minimal cost. I. THE INDIVIDUAL, COLLECTIVE, AND SOCIAL COSTS OF PRIVACY REGULATION Most people want to know things about others but simultaneously want to block others from knowing personal information about them. The desire to exercise complete control over one's personal information is understandable as a means of maintaining a zone of privacy and reducing the possibility that information will be misused. But to what degree should we incorporate such preferences into actual regulations? More important, what would we lose--individually, collectively, and socially--from legislating broadly in this arena? The question cannot be answered by a blithe invocation of privacy rights. We have no inalienable right to keep others from talking about us. You have no legal right to prevent your local baker from telling an assistant that you like cinnamon rolls. Nor do you have a legal right to demand to see if you are on your local florist's list of good customers. Leaping to assertions of nonnegotiable rights unfortunately tends to preempt reasoned discussion of the costs and benefits of regulatory action. (1) The alternative--tallying the costs and benefits of new information regulations--would seem uncontroversial. Yet a cost-benefit perspective is notably absent from the contemporary debates over information privacy. For example, the Federal Trade Commission omitted such a review before issuing its May 2000 Privacy Report calling for privacy legislation. (2) As Commissioner Orson Swindle noted in dissent: [T]he Privacy Report fails to pose and to answer basic questions that all regulators and lawmakers should consider before embarking on extensive regulation that could severely stifle the New Economy. Shockingly, there is absolutely no consideration of the costs and benefits of regulation; nor the effects on competition and consumer choice; nor the experience to date with government regulation of privacy; nor constitutional implications and concerns; nor how this vague and vast mandate will be enforced. (3) The following sections undertake a cost-benefit analysis of regulating the use of personal information in the New Economy. A. Individual Costs The costs to individual consumers of regulating the use of personal information are relatively clear. (4) Such regulation would likely increase both direct and indirect costs to the individual consumer, reduce consumer choice, and inhibit the growing trend toward personalization and tailoring of goods and services. …