This blog is a part of the S.J. Quinney College of Law Spring semester 2016 Information Privacy Law course. This blog features a "Question of the Week" (which all students answer "yes" or "no"); a weekly "Featured Blog Topic" (where one student writes about a selected course topic on which all students comment); and a weekly "What Have I Learned" summary based on the week's readings, posts and class discussions.
Thursday, March 17, 2016
Quesiton of the Week No. 9
Should an individual have an unqualified legal
right to control the collection, use, access and retention of personal
information about them and their activities?
No, an individual should not have this right (apart from their right not to use the technology or engage in the activity collecting their data). Not only would this right be impractical to implement, it could lessen some of the positive effects of big data. To provide for some privacy protection, companies and government agencies collecting personal data should be required to articulate the purposes for which they are collecting the data, who it is being shared with, etc. The idea of giving consumers the ability to review their data (similar to reviewing a credit report) would also provide some additional transparency. However, this would likely be more complicated than a credit report given the amount of sensors and the variety of the data being collected.
No. No right is unqualified. Providing someone with an unqualified right to control their data would likely nullify the advantages associated the internet of things. I imagine many services that utilize personal data in some way rely heavily on a uniform terms of service policy. If people had carte blanche control of their private data, these services would have to individually tailor their terms of service, or these services would have to cease operating or adjust their business model in way that significantly reduces the benefits of the service. I think there should be an unqualified right to know how an entity uses a persons private. Similar to a click-wrap agreement, I think businesses should be required to inform consumers in a clear, unambiguous way how there data will be used. Further, I think businesses should be required to obtain express consent when using private data not initially contemplated in the terms of service.
I think an unqualified right to control private data would also make litigation more expensive during the discovery phase. If people has an unqualified right to their private data, I imagine that the subpoena process would become more burdensome and expensive. Banks and hospitals would have less latitude to comply with a subpoena, which would further the compound the burdensome cost of litigation.
No, not an unqualified right. I think awareness and consent is key and scope of agreement of said information. In certain activities consumers should be able to get control over their data, especially regarding targeted advertisements. Where a recovering alcoholic gets advertisements from their local gas station about beer sales, this information being sold to the gas station is simply wrong. The more we know about the individual behaviors the more intense this marketing behavior will become. However, there is just simply so much data out there that having an unqualified right to the collection on personal information is extreme. There may be reasons that the retention of personal information for long periods of time is incredibly important when it comes to understanding outcomes and evidence based social policy. But consent is key. If people are able to remain anonymous the data is more advantageous for society than the risk of a breach. However, using information gathered for another purpose should require absolute consent; for instance, the Havasupai Tribe agreed to allow research for Diabetes on their tribe; however, after this failed study researchers took it upon themselves to use the same blood samples and use this information for another study on schizophrenia, and inbreeding—these subjects were incredibly offensive by this tribe. http://genetics.ncai.org/casestudy/havasupai-Tribe.cfm
Imagine a potential employer knowing what google terms I searched even in just one day. It is this type of personal information I struggle with on whether it should be collected at all.
No. Although I believe there need to be stronger individual legal rights, the use of the word "unqualified" in this statement requires me to answer "no." Such a policy would be difficult to implement. Also, some big data collection leads to socially desirable outcomes, despite the privacy risks. And such an individualized system could threaten the existence of big data collection entirely. Perhaps there could be a different regime for when the data is anonymized versus when it's not--however, the fear with big data collection is that with so much data, it could become impossible to completely remove each individual's identifier. Perhaps the better policy would be to ban collection of certain types of data. Or just to create an ex post remedy relating to private causes of action for breaches of privacy. But to individualize the regulatory framework on an individual basis would likely be logistically unfeasible.
No, I don't think that a person is entitled to an unqualified right to information. We are so far past that point that it would be nearly impossible to reverse the trend. Also, some of the information is collected by the government and it would be counter productive to allow people control of that information.
I concur with John that no right is absolute. There are always some inherent limitations to rights, including privacy rights. Assuming the right were not unqualified, the extent to which it can be realistically protected will vary by context. Policy language regarding the collection, use, access and retention of PII is often included in the service contracts; however, these are adhesion contracts, and the customer does not have room to negotiate. Whereas a person can always choose to not to use services like Facebook or Twitter, if a utility company's website were to collect, using accessing and retaining PII more than minimally necessary, that would raise important questions regarding the need to regulate, since most consumers do not have a choice with regard to utilities. Therefore, the probative questions with regard to the right to control PII should be whether the consumer has a choice, and whether the business is collecting the minimal necessary amount of PII.
No, an individual should not have this right (apart from their right not to use the technology or engage in the activity collecting their data). Not only would this right be impractical to implement, it could lessen some of the positive effects of big data. To provide for some privacy protection, companies and government agencies collecting personal data should be required to articulate the purposes for which they are collecting the data, who it is being shared with, etc. The idea of giving consumers the ability to review their data (similar to reviewing a credit report) would also provide some additional transparency. However, this would likely be more complicated than a credit report given the amount of sensors and the variety of the data being collected.
ReplyDeleteNo. No right is unqualified. Providing someone with an unqualified right to control their data would likely nullify the advantages associated the internet of things. I imagine many services that utilize personal data in some way rely heavily on a uniform terms of service policy. If people had carte blanche control of their private data, these services would have to individually tailor their terms of service, or these services would have to cease operating or adjust their business model in way that significantly reduces the benefits of the service. I think there should be an unqualified right to know how an entity uses a persons private. Similar to a click-wrap agreement, I think businesses should be required to inform consumers in a clear, unambiguous way how there data will be used. Further, I think businesses should be required to obtain express consent when using private data not initially contemplated in the terms of service.
ReplyDeleteI think an unqualified right to control private data would also make litigation more expensive during the discovery phase. If people has an unqualified right to their private data, I imagine that the subpoena process would become more burdensome and expensive. Banks and hospitals would have less latitude to comply with a subpoena, which would further the compound the burdensome cost of litigation.
This comment has been removed by the author.
ReplyDeleteNo, not an unqualified right. I think awareness and consent is key and scope of agreement of said information. In certain activities consumers should be able to get control over their data, especially regarding targeted advertisements. Where a recovering alcoholic gets advertisements from their local gas station about beer sales, this information being sold to the gas station is simply wrong. The more we know about the individual behaviors the more intense this marketing behavior will become. However, there is just simply so much data out there that having an unqualified right to the collection on personal information is extreme. There may be reasons that the retention of personal information for long periods of time is incredibly important when it comes to understanding outcomes and evidence based social policy. But consent is key. If people are able to remain anonymous the data is more advantageous for society than the risk of a breach. However, using information gathered for another purpose should require absolute consent; for instance, the Havasupai Tribe agreed to allow research for Diabetes on their tribe; however, after this failed study researchers took it upon themselves to use the same blood samples and use this information for another study on schizophrenia, and inbreeding—these subjects were incredibly offensive by this tribe.
ReplyDeletehttp://genetics.ncai.org/casestudy/havasupai-Tribe.cfm
Imagine a potential employer knowing what google terms I searched even in just one day. It is this type of personal information I struggle with on whether it should be collected at all.
No. Although I believe there need to be stronger individual legal rights, the use of the word "unqualified" in this statement requires me to answer "no." Such a policy would be difficult to implement. Also, some big data collection leads to socially desirable outcomes, despite the privacy risks. And such an individualized system could threaten the existence of big data collection entirely. Perhaps there could be a different regime for when the data is anonymized versus when it's not--however, the fear with big data collection is that with so much data, it could become impossible to completely remove each individual's identifier. Perhaps the better policy would be to ban collection of certain types of data. Or just to create an ex post remedy relating to private causes of action for breaches of privacy. But to individualize the regulatory framework on an individual basis would likely be logistically unfeasible.
ReplyDeleteNo, I don't think that a person is entitled to an unqualified right to information. We are so far past that point that it would be nearly impossible to reverse the trend. Also, some of the information is collected by the government and it would be counter productive to allow people control of that information.
ReplyDeleteI concur with John that no right is absolute. There are always some inherent limitations to rights, including privacy rights. Assuming the right were not unqualified, the extent to which it can be realistically protected will vary by context. Policy language regarding the collection, use, access and retention of PII is often included in the service contracts; however, these are adhesion contracts, and the customer does not have room to negotiate. Whereas a person can always choose to not to use services like Facebook or Twitter, if a utility company's website were to collect, using accessing and retaining PII more than minimally necessary, that would raise important questions regarding the need to regulate, since most consumers do not have a choice with regard to utilities. Therefore, the probative questions with regard to the right to control PII should be whether the consumer has a choice, and whether the business is collecting the minimal necessary amount of PII.
ReplyDelete