The Filter Bubble - Eli Pariser [94]
To make matters worse, even if you carefully read a company’s privacy policy and decide that giving over rights to your personal information is worth it under those conditions, most companies reserve the right to change the rules of the game at any time. Facebook, for example, promised its users that if they made a connection with a Page, that information would only be shared with their friends. But in 2010, it decided that all of that data should be made fully public; a clause in Facebook’s privacy policy (as with many corporate privacy policies) allows it to change the rules retroactively. In effect, this gives them nearly unlimited power to dispatch personal data as they see fit.
To enforce Fair Information Practices, we need to start thinking of personal data as a kind of personal property and protecting our rights in it. Personalization is based on an economic transaction in which consumers are at an inherent disadvantage: While Google may know how much your race is worth to Google, you don’t. And while the benefits are obvious (free e-mail!), the drawbacks (opportunities and content missed) are invisible. Thinking of personal information as a form of property would help make this a fairer market.
Although personal information is property, it’s a special kind of property, because you still have a vested interest in your own data long after it’s been exposed. You probably wouldn’t want consumers to be able to sell all of their personal data, in perpetuity. France’s “moral laws,” in which artists retain some control over what’s done with a piece after it’s been sold, might be a better template. (Speaking of France, while European laws are much closer to Fair Information Practices in protecting personal information, by many accounts the enforcement is much worse, partly because it’s much harder for individuals to sue for breaches of the laws.)
Marc Rotenberg, executive director of the Electronic Privacy Information Center, says, “We shouldn’t have to accept as a starting point that we can’t have free services on the Internet without major privacy violations.” And this isn’t just about privacy. It’s also about how our data shapes the content and opportunities we see and don’t see. And it’s about being able to track and manage this constellation of data that represents our lives with the same ease that companies like Acxiom and Facebook already do.
Silicon Valley technologists sometimes portray this as an unwinnable fight—people have lost control of their personal data, they’ll never regain it, and they just have to grow up and live with it. But legal requirements on personal information need not be foolproof in order to work, any more than legal requirements not to steal are useless because people sometimes still steal things and get away with it. The force of law adds friction to the transmission of some kinds of information—and in many cases, a little friction changes a lot.
And there are laws that do protect personal information even in this day and age. The Fair Credit Reporting Act, for example, ensures that credit agencies have to disclose their credit reports to consumers and notify consumers when they’re discriminated against on the basis of reports. That’s not much, but given that previously consumers couldn’t even see if their credit report contained errors (and 70 percent do, according to U.S. PIRG), it’s a step in the right direction.
A bigger step would be putting in place an agency to oversee the use of personal information. The EU and most other industrial nations have this kind of oversight, but the United States has lingered behind, scattering responsibilities for protecting personal information among the Federal Trade Commission, the Commerce Department, and other agencies. As we enter the second decade of the twenty-first century, it’s past time to take this concern seriously.