CONCEALED DATA PRACTICES AND COMPETITION LAW: WHY … Kemp.pdf · Algorithms that Control Money and...

University of New South Wales Law Research Series

CONCEALED DATA PRACTICES AND COMPETITION LAW: WHY PRIVACY MATTERS

KATHARINE KEMP

[2019] UNSWLRS 53

UNSW Law UNSW Sydney NSW 2052 Australia

E: [email protected] W: http://www.law.unsw.edu.au/research/faculty-publications AustLII: http://www.austlii.edu.au/au/journals/UNSWLRS/ SSRN: http://www.ssrn.com/link/UNSW-LEG.html

Electronic copy available at: https://ssrn.com/abstract=3432769

mailto:[email protected]

http://www.law.unsw.edu.au/research/faculty-publications

http://www.austlii.edu.au/au/journals/UNSWLRS/

http://www.ssrn.com/link/UNSW-LEG.html

1

CONCEALEDDATAPRACTICESANDCOMPETITIONLAW:

WHYPRIVACYMATTERS

WorkingPaper

KatharineKemp*

1. Introduction

Therelationshipbetweenmarketpower,theaccumulationofconsumerdataandindividual

privacyindigitalmarketsincreasinglycommandstheattentionofregulators,andsparksdebate

aboutwhattypeofregulationshouldapply.TheUnitedStatesFederalTradeCommission

recentlysettledonafineofUSD5billionforFacebook’sconductinrepeatedlymisrepresenting

theextenttowhichitsuserscouldcontrolaccesstotheirpersonaldata.1Bycontrast,the

BundeskartellamtcontroversiallyfoundthatFacebook’spracticeofcollectingandcombiningits

users’informationacrossthird-partywebsitesamountedtoanabuseofitsdominantposition,

evenifconsumerswereawareofthepractice.2Meanwhile,aseriesofreportshave

investigatedhowconsumerprotection,privacyregulationandcompetitionpolicyshouldapply

toGoogle,Facebookandotherdigitalplatforms,3andparticularlywhethercompetition

*SeniorLecturer,FacultyofLaw,UNSWSydney.IamgratefultoGrahamGreenleaf,DavidHowarthandMeganRichardsonforhelpfulcommentsonanearlierdraft,andtoRoseannaBricknellforresearchassistance;withtheusualdisclaimers.1UnitedStatesFederalTradeCommission,‘FTC’s$5BillionFacebookSettlement:Record-BreakingandHistory-Making’(24July2019)<https://www.ftc.gov/news-events/blogs/business-blog/2019/07/ftcs-5-billion-facebook-settlement-record-breaking-history>.2Bundeskartellamt,Germany,‘BundeskartellamtprohibitsFacebookfromcombininguserdatafromdifferentsources:BackgroundinformationontheBundeskartellamt’sFacebookproceeding’(7February2019);FacebookInci.a.–TheUseofAbusiveBusinessTermspursuanttoSection19(1)GWB(B6-22/16,Bundeskartellamt,AdministrativeProceedings,6February2016).3See,eg,AustralianCompetition&ConsumerCommission,‘DigitalPlatformsInquiry:FinalReport’(June2019)(‘ACCCDigitalPlatformsReport’);EuropeanDataProtectionSupervisor,‘EDPSOpiniononOnlineManipulationandPersonalData’(Opinion3/2018,19March2018);GovernmentofCanada,‘StrengtheningPrivacyfortheDigital


2

regulatorsshouldalsotakeaccountofprivacyconcernsundercompetitionlaw.4Thispaper

arguesthatthedegradationofconsumerdataprivacyinthedigitalenvironmentcauses

objectivedetrimenttoconsumersandunderminesthecompetitiveprocessandshould

thereforebeofcriticalconcernundercompetitionlaw.

Therearelargerissuesatstakeinthebroaderdebateaboutincreasingdigitalsurveillanceand

corporatedatapractices.5Theseissuesultimatelygototheverynatureofthesocietywelivein

andourfundamentalhumanrightsinthatsociety.Thispaperisnotanattempttoaddress

theselargerissues,nortodiminishthem.Rather,itarguesforanacknowledgementofthe

importanceofprivacyharmsandconcernsunderonetypeofregulation,whichplaysakeyrole

indecisionsabouttheprivateacquisition,preservationandexploitationofmarketpowerand

themannerinwhichourmarketsfunction.

Thecollectionanduseofconsumers’personaldatahasbecomeavitalfeatureofdigital

marketsandcreatedsignificantefficienciesandbenefitsforconsumers.6Itiswellaccepted

that,whencompetitionauthoritiesassessthehealthofcompetitioninthesemarkets,they

shouldconsiderthebenefitsconsumersreceivefromdigitalservices–onlinesearch,social

Age’(DiscussionPaper,May2019);HouseofLordsSelectCommitteeonCommunications,‘RegulatinginaDigitalWorld’(2ndReportofSession2017-19,March2019).SeealsoMissiontoFrenchSecretaryofStateforDigitalAffairs,‘CreatingaFrenchFrameworktoMakeSocialMediaPlatformsMoreAccountable:ActinginFrancewithaEuropeanVision’(MissionReport,Version1.1,May2019).4See,eg,JacquesCrémer,Yves-AlexandredeMontjoyeandHeikeSchweitzer,‘CompetitionPolicyfortheDigitalEra’(EuropeanCommission,2019);DigitalCompetitionExpertPanel,UnitedKingdom,‘UnlockingDigitalCompetition’(Report,March2019)(‘FurmanReport’).SeefurtherEugeneKimmelman,HaroldFeldandAgustìnRossi,‘TheLimitsofAntitrustinPrivacyProtection’(2018)8InternationalDataPrivacyLaw270.5See,eg,ShoshanaZuboff,TheAgeofSurveillanceCapitalism:TheFightforaHumanFutureattheNewFrontierofPower(Profile,2019);BrettFrischmannandEvanSelinger,Re-EngineeringHumanity(CambridgeUniversityPress,2018);KarenYeung,‘“Hypernudge”:BigDataasaModeofRegulationbyDesign’(2017)20Information,Communication&Society118;DanielSusser,BeateRoesslerandHelenNissenbaum,‘Technology,AutonomyandManipulation’(2019)8InternetPolicyReview(forthcoming);FrankPasquale,TheBlackBoxSociety:TheSecretAlgorithmsthatControlMoneyandInformation(HarvardUniversityPress,2016).6SeePhuongNguyenandLaurenSolomon,‘ConsumerDataandtheDigitalEconomy:EmergingIssuesinDataCollection,UseandSharing’(Report,ConsumerPolicyResearchCentre,2018)20-21(‘CPRCEmergingIssuesReport’);GeorgeJStiglerCenterfortheStudyoftheEconomyandtheStateandTheUniversityofChicagoBoothSchoolofBusiness,‘CommitteefortheStudyofDigitalPlatforms:MarketStructureandAntitrustSubcommittee:DraftReport’(15May2019)5-6(‘StiglerCenterDigitalPlatformsReport’).


3

networks,fastandconvenientconnectionswithrelevantproducts,newsandentertainment,

andreal-timeinformationonhealthierlifestylechoices.7However,thereisuncertaintyand

disagreementabouttheextenttowhichcompetitionauthoritiesshouldtakeintoaccount,and

respondto,thedegradationofconsumerdataprivacywhichresultsfromdatapracticesin

thesemarkets.

Someantitrustcommentatorsarguethatprivacytermsareamatterofsubjectivepreference

whichshouldbelefttoindividualbargainsbetweeneachconsumerandthesupplierstheydeal

with,8andthatonlyanapparently“smallgroupofprivacy-sensitiveconsumers”whohavenot

protectedthemselveswithavailableprivacytools,areharmedbyreductionsinprivacyquality.9

Onthisversion,consumersaccepttheprivacytermsonwhichdigitalservicesareofferedifthey

continuetousethatservice:thisisapersonalchoice.10Thesecommentatorsalsotendtoargue

thatprivacyprotectiondoesnotfallwithintheeconomicobjectivesofantitrustandparticularly

antitrust’snarrowlydefinedconceptofconsumerwelfare.11Privacyisseenasanon-economic

objectivewhichshouldbelefttoconsumerprotectionandprivacyregulation,totheextentthat

7See,eg,‘CommonUnderstandingofG7CompetitionAuthoritieson“CompetitionandtheDigitalEconomy”’(July2019)3;DDanielSokolandRoisinComerford,‘AntitrustandRegulatingBigData’(2016)23GeorgeMasonLawReview1130,1133-1135;GeoffreyAManneandJoshuaDWright,‘GoogleandtheLimitsofAntitrust:TheCaseAgainsttheCaseAgainstGoogle’(2011)34HarvardJournalofLaw&PublicPolicy171,203-206.SeealsoDavidSEvans,‘AttentionPlatforms,theValueofContentandPublicPolicy’(January2019)3,21-24;AlessandroAcquisti,‘TheEconomicsofPersonalDataandPrivacy:30YearsAftertheOECDPrivacyGuidelines’(OrganisationforEconomicCo-operationandDevelopment(OECD),2010)8-11.8TorstenKörber,‘IsKnowledge(Market)Power?OntheRelationshipbetweenDataProtection,“DataPower”andCompetitionLaw’(2016)<https://ssrn.com/abstract=3112232>9-10,18;GeoffreyAManneandRBenSperry,‘TheProblemsandPerilsofBootstrappingPrivacyandDataintoanAntitrustFramework’(CPIAntitrustChronicle,May2015)5-6.SeefurtherSokolandComerford,aboven7,1144-1145;MaureenKOhlhausenandAlexanderPOkuliar,‘Competition,ConsumerProtection,andtheRight[Approach]toPrivacy’(2015)80AntitrustLawJournal121.9ManneandSperry,aboven8,5-6.10ManneandSperry,aboven8,3-4.SeefurtherMariaEstrellaGutierrezDavid,‘DiscussingTransparencyofPrivacyPoliciesintheAgeofBigData:Towardsthe‘SocialNorm’asaNewRuleofLaw’(2017)EticadeDatos,SociedadYCiudadania165,182.SeealsoKörber,aboven8,10,16-17.11Measuredintermsofpriceandoutputlevelsoftherelevantproduct.SeeSokolandComerford,aboven7,1145,1156-1158;MaureenKOhlhausenandAlexanderPOkuliar,‘Competition,ConsumerProtection,andtheRight[Approach]toPrivacy’(2015)80AntitrustLawJournal121.


4

interventionisnecessary.12

Othercommentatorsalsoregarddataprivacyasamatterforindividualbargainsbut

acknowledgethatconsumersarelikely“underpaid”inthesetransactionsduetotheirlackof

bargainingpowerandinformationaboutthevalueoftheirdata.13Seeingdataas“payment”by

consumersfordigitalservices,somehaveproposedmeasuresthatwouldallowconsumersto

havemorecontroloverwhichsupplierscollecttheirdataand/ortobecompensatedforthe

“true”valueoftheirpersonalinformationtothosesuppliers.14

Thispaperproposesanalternativeapproach:thecollectionanduseofpersonaldataisnotso

muchapricepaid,butanobjectivecostimposedonconsumersintheprocessofdigital

transactions.Theextentofthiscostisareflectionofthequalityoftheserviceinquestion.15We

shouldbemoreconcernedabouttheconsequencesoftheserevelationsforconsumers,than

whatthesuppliergainsfromeachincrementalrevelationofconsumerdata.16Acriticalproblem

12SeeManneandSperry,aboven8;SokolandComerford,aboven7,1156-1161;MaureenKOhlhausenandAlexanderPOkuliar,‘Competition,ConsumerProtection,andtheRight[Approach]toPrivacy’(2015)80AntitrustLawJournal121;EuropeanCommission,‘Facebook/Whatsapp’(COMP/M7217,3October2014)para164.13SeeGianclaudioMalgieriandBartCusters,‘PricingPrivacy:TheRighttoKnowtheValueofYourPersonalData’(2018)34ComputerLaw&SecurityReview289;ViktoriaHSERobertson,‘ExcessiveDataCollection:PrivacyConsiderationsandAbuseofDominanceinanEraofBigData’(WorkingPaper,June2019)9-11.SeealsoJanWhittingtonandChrisJayHoofnagle,‘UnpackingPrivacy’sPrice’(2012)90NorthCarolinaLawReview1327,1346-1351;CarmenLanghankeandMartinSchmidt-Kessel,‘ConsumerDataasConsideration’(2015)6EuCML218,219.14SeeOECD,‘ExploringtheEconomicsofPersonalData:ASurveyofMethodologiesforMeasuringMonetaryValue’(WhitePaper,2013)6,18-34(on“datalockers”);AlessandroAcquisti,CurtisTaylorandLiadWagman,‘TheEconomicsofPrivacy’(2016)54JournalofEconomicLiterature442,447-448(onattemptstovalue,andpermitconsumerstotradein,personalinformation).CfChrisJayHoofnagleandJanWhittington,‘Free:AccountingfortheCostsoftheInternet’sMostPopularPrice’(2014)61UCLALawReview606,637-640,646-648(onthevalueofpersonalinformationtoconsumers).15Importantly,thedegradationofprivacyisalsodetrimentaltobroadersocialwelfare:diminishedprivacyinsocietyingeneralwillbenefitsomewhileharmingothers:DanielJSolove,‘PrivacySelf-ManagementandtheConsentDilemma’(2013)126HarvardLawReview1880,1881.Privacyisalsoessentialtotheintellectual,politicalandculturaldevelopmentofsocietyasawhole:JulieECohen,‘ExaminedLives:InformationalPrivacyandtheSubjectasObject’(2000)52StanfordLawReview1373,1428.CfAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,4(explainingargumentsastowhyprivacyisasourceofeconomicinefficiencies).16SeeMichalSGalandDanielLRubinfield,‘TheHiddenCostsofFreeGoods:ImplicationsforAntitrustEnforcement’(2014)521(arguingthatregulatorsshouldnotbecontentwith“thesimplisticconclusionthatthefreegoodcreatespositivewelfareeffects”butthat“theanalysisshouldbeexpandedtoincludelong-termeffectsinthesamemarketaswellasininterdependentandaffectedmarkets”).


5

forconsumersandforthecompetitiveprocessisthat,currently,thesecostsarehiddenand

consumershavealmostnopowertoaddressthem.Asidefromthedirectharmtoconsumer

welfare,thesehiddendatapracticescriticallyimpedeprivacy-enhancingcompetitionthatmight

otherwiseimproveconsumerwelfare.17

Inthispaper,Idefineasetof“concealeddatapractices”whichhavebeenobservedin

numerousdigitalmarkets,andwhichcreateobjectivecostsanddetrimentsforconsumersand

underminethecompetitiveprocess.18Iarguethatcompetitionauthoritiesshouldtakeaccount

ofthesecostsanddetrimentsinassessingthestateofcompetitionanddeterminingwhether

therehasbeenasubstantiallesseningofcompetitioninthecaseofanyallegedanticompetitive

conduct.

Itisimportanttonoteatthispointthatsomecommentatorsobjecttotheveryideathatit

shouldbepossibleforindividualsto“bargainaway”theirprivacyrights.19Onthisview,given

thatprivacyisafundamentalrightwhich“belongstothecoreofhumandignity”,20itisvitalto

thehealthofoursocietyasawholethatindividualsshouldnotbeabletowaiveortradeat

leastcertainpartsofthisright.21Inthesamewaythatwedonotpermitindividualstoselltheir

ownorgans,weshouldnot,forexample,permitindividualstonegotiateabiggerdiscountin

exchangeforgivinguptheirrighttoaccesstheirpersonalinformation.22Thisisavitaldebate.

17AsexplainedinPart4.3below.SeeOECD,‘TheOECDPrivacyFramework’(2013)32(ontheimportanceofprivacy-enhancingtechnologies(PETs)incomplementinglawsprotectingprivacy).SeealsoAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,19-20.18SeePart3below.19SeeAnitaAllen,UnpopularPrivacy:WhatMustWeHide?(OxfordUniversityPress,2011)Chap7.SeefurtherRogerBrownsword,‘ConsentinDataProtectionLaw:Privacy,FairProcessingandConfidentiality’inSGutwirthetal(eds),ReinventingDataProtection?(Springer,2009)102.20VolkerBoehme-Neßler,‘Privacy:AMatterofDemocracy.WhyDemocracyNeedsPrivacyandDataProtection’(2016)6InternationalDataPrivacyLaw222,223.21AnitaAllen,UnpopularPrivacy:WhatMustWeHide?(OxfordUniversityPress,2011)Chap7(“Privacyshouldbethoughtofasapartlyinalienablefoundationalgood.”).SeealsoAdamDMoore,‘Privacy,Interests&InalienableRights’(ResearchPaper,22January2018)1-3<https://ssrn.com/abstract=3107324>.22PersonalcorrespondencewithGrahamGreenleaf.SeeMoore,aboven21,1-2(drawingcomparisonswithslavery).


6

However,these“bargains”presentlytakeplaceinnumerousjurisdictions,includingthose,like

Australia,whichonlydebatablyrecogniseprivacyasahumanright.23Weshouldrecognisethat

thesupposedefficiencyofthesepracticesfailstoweighupevenunderthefreemarketlens.

Thispaperproceedsasfollows.Part2providesanexplanationofthe“noticeandchoice”

approachtodataprivacyregulationandthechallengestothatapproachinthedigitalera.

Part3defines,andprovidesillustrationsof,“concealeddatapractices”whichhavebeenused

indigitalmarketsinparticulartosecureandmaintainconsumers’“consent”tothehandlingof

theirpersonalinformation.Itproceedstodescribetheobjectivecostsanddetrimentssuffered

byconsumersasaresultofconcealeddatapracticesanddegradeddataprivacy.

Part4considersthetwomainresponsesbyantitrustscholarstothequestionwhetherprivacy

isacompetitionlawissueandproposesathirdresponse,namelythatthedegradationofdata

privacycausesobjectiveharmtoconsumersandunderminesthecompetitiveprocessand

shouldthereforebeofconcerntocompetitionregulators.Itproceedstoexplainthemannerin

whichconcealeddatapracticesunderminethecompetitiveprocessbychillingcompetitionon

privacyqualityandincreasinginequalitiesinbargainingpowerandinformationasymmetries

betweensuppliersandconsumers.Part5setsoutfourwaysinwhichthesefactorsshouldbe

takenintoaccountbycompetitionauthorities.

2. Dataprivacyregulationandbigdataincentives

Onthetraditionalview,“[p]rivacy,initssimplestsense,allowseachhumanbeingtobeleft

aloneinacorewhichisinviolable.”24Whilescholarshaveprovidednumerousdefinitionsof

privacy,andaccountsofitsbenefits,25inessence,privacyestablishestheboundariesbetween

23SeeMeganRichardson,TheRighttoPrivacy:OriginsandInfluenceofaNineteenth-CenturyIdea(CambridgeUniversityPress,2017).24JusticeKSPuttaswamy(Ret’d)vUnionofIndia(SupremeCourtofIndia,24August2017)4[2](PluralityOpiniondeliveredbyChandrachudJ).25SeeDanielJSolove,‘ConceptualisingPrivacy’(2002)90CaliforniaLawReview1087.


7

ourselvesandothers;boundarieswhicharevitaltothedevelopmentanddignityofthe

individualandthecultural,politicalandeconomicdevelopmentofsocietyasawhole.26

“Dataprivacylawssystematicallyregulatetheuseofinformationaboutpeople.”27Dataprivacy

regulation,orinformationprivacyasitissometimestermed,thereforeconcernscontrolover

one’spersonalinformation.Informationprivacymaybedistinguishedfromotheraspectsof

privacy,includingbodilyprivacy(freedomfrominterferencewithourphysicalbodiesor

decisionsconcerningourbodies)andterritorialprivacy(freedomtobeletaloneinourown

homesandprivateplaces).

Intheareaofinformationprivacy,oneofthemajormodelsofregulation,whichprevailsinthe

UnitedStatesandlargelyinAustralia,isthe“noticeandchoice”model.28Essentially,suppliers

providenoticeoftheirproposedprivacytermsandconsumerschoosewhethertoacceptthose

termsandtherebypermitcertaincollectionanduseoftheirpersonalinformation.Regulation

doesnotimposesubstantiverestrictionsonthekindsofpersonalinformationthatmaybe

collectedortheusestowhichthatinformationcanbeput,butleavesthesetobeagreed

betweentheentitycollectingtheinformationandtheindividualinquestion.29

26“Partofwhatmakesasocietyagoodplaceinwhichtoliveistheextenttowhichitallowspeoplefreedomfromtheintrusivenessofothers.Asocietywithoutprivacyprotectionwouldbesuffocating…”:DanielJSolove,‘”I’veGotNothingtoHide”andOtherMisunderstandingsofPrivacy’(2007)44SanDiegoLawReview745,762.See,generally,JulieCohen,‘WhatisPrivacyFor’(2013)126HarvardLawReview1904(onthemannerinwhichprivacyallowsindividualstodevelopwithindependenceandspaceforcriticalthinkingandthevitalroleprivacyplaysininnovation).27GrahamGreenleaf,AsianDataPrivacyLaw(OxfordUniversityPress,2014)5.InEurope,theterm“dataprotectionlaw”tendstobeused,whileinNorthAmerica,AustraliaandNewZealand,theterm“privacylaw”isused,andthereisgrowinguseof“dataprivacylaw”:LeeBygrave,DataPrivacyLaw:AnInternationalPerspective(OxfordUniversityPress,2014)xxv.28ThomasBNorton,“TheNon-ContractualNatureofPrivacyPoliciesandaNewCritiqueoftheNoticeandChoicePrivacyProtectionModel”(2016)27FordhamIntellectualProperty,MediaandEntertainmentLawJournal181,195-198;Solove,‘PrivacySelf-Management’,aboven15,1882-1883.SeealsoPolicyandResearchGroup,OfficeofthePrivacyCommissionerofCanada,‘ConsentandPrivacy:ADiscussionPaperExploringPotentialEnhancementstoConsentunderthePersonalInformationProtectionandElectronicDocumentsAct’(DiscussionPaper,2016)2(‘PrivacyCommissionerofCanadaConsentandPrivacyReport’).29Solove,‘PrivacySelf-Management’,aboven15,1882.


8

The“noticeandchoice”modelthereforereliesheavilyontheadoptionofprivacypoliciesby

suppliersandtheideathatindividualscanmakeeffectivebargainsabouttheprivacyoftheir

informationinresponsetothosepolicies.InAustralia,forexample,entitiesregulatedbythe

PrivacyAct1988(Cth)arerequiredtopublishaprivacypolicywhichsetsout,amongother

things,thekindofpersonalinformationtheentitycollects,howandforwhatpurposethe

informationisused,howtheinformationcanbeaccessed,andwhethertheentityislikelyto

disclosetheinformationtooverseasrecipients.30Theseobligationsdonotapplyinrespectof

allinformationthatconcernsanindividual,butonlyto“personalinformation”,thatis,

informationoranopinionaboutanidentifiedindividual,oranindividualwhoisreasonably

identifiable.31

Thisapproachtoprivacyregulationhasbeensignificantlyinfluencedbyviewsonprivacywhich

prevailintheUnitedStates,andparticularlytheneoliberalapproachoftreatingprivacyasa

matterofindividualeconomicchoice.32Itisregardedasanacknowledgementoftheautonomy

oftheindividualandthewidevarietyofprivacypreferencesbetweenindividuals.33Thestate

shouldnotimposeitsviewsregardingprivacyonitscitizens,butleaveeachindividualto

determinetheirowninformationprivacydestiny.Theapproachhasthereforebeendescribed

as“privacyself-management”.34

30PrivacyAct1988(Cth),s15,sched1(AustralianPrivacyPrinciple1).Theseobligationsapplytocertaingovernmentagenciesandprivateorganisations,buttherearenumerousexemptentities,includingsmallbusinesses,whichaccountforthemajorityofbusinessesinAustralia.31PrivacyAct1988(Cth),s6,sched1.SeePrivacyCommissionervTelstraCorporationLtd[2017]FCAFC4;ACCCDigitalPlatformsReport,aboven3,458-461,ontheACCC’srecommendationtoamendthedefinitionof“personalinformation”underthePrivacyAct1988(Cth)toclarifyitsinclusionofcertain“technicaldata”thatmaybeusedtoidentifyanindividual.32SeeGordonHull,‘SuccessfulFailure:WhatFoucaultCanTeachUsaboutPrivacySelf-ManagementinaWorldofFacebookandBigData’(2015)17EthicsofInformationTechnology89,90-91(“individualriskmanagementcoupledwithindividualresponsibilityforpoorly-managedrisks”);OmriBen-ShaharandCarlESchneider,MoreThanYouWantedtoKnow:TheFailureofMandatedDisclosure(PrincetonUniversityPress)5.33SeeSolove,‘PrivacySelf-Management’,aboven15,1889,1895-1896;PrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,2.34Solove,‘PrivacySelf-Management’,aboven15,1880.


9

Foralongtime,however,somescholarshaveexpressedscepticismabouttheextenttowhich

individualsaretrulyabletodeterminetheirowninformationprivacydestiny.35Thatscepticism

hasjustifiablyincreasedinrecentdecadesasgiantleapsininformationtechnologyhave

reducedtheindividual’sabilitytocontrolorunderstandtheusesoftheirpersonaldata.36The

“noticeandchoice”model,itshouldberemembered,cametoprominenceinthe1970s,inan

eraoffilingcabinets,paperrecordsandfaxmachines.37Inthatcontext,itwasconceivablethat

theindividualconsumerwouldbeawareofwhatpersonalinformationwasbeingcollected,

whenandbywhom,andtheopportunitiesfordisclosureandstorageofpersonalinformation

werephysicallyandtechnologicallylimited.

Today’sconsumerinsteadfacespervasiveandinvisiblecollectionoftheirpersonalinformation

bycorporationsandgovernmentsalike,38andmountingproposalstoincreasedisclosureand

surveillance.39Individualsareconstantlytrackedastheyusecreditcardsanddevicestoaccess

theinternet;byCCTVandbiometricidentificationsystems;bytheirmobilephones,wearable

devices,in-homedigitalassistantsandeverydayappliancesconnectedviatheinternet.40

Wherethesuccessfulcombinationofhuman,capitalandphysicalresourcesdroveoutcomesin

35See,eg,HelenNissenbaum,PrivacyinContext:Technology,PolicyandtheIntegrityofSocialLife(StanfordUniversityPress,2010);JulieCohen,ConfiguringtheNetworkedSelf:Law,Code,andthePlayofEverydayPractice(YaleUniversityPress,2012);Hull,aboven32,91;FredHCate,‘TheFailureofFairInformationPracticePrinciples’inJaneKWinn(ed),ConsumerProtectionintheAgeof‘InformationEconomy’(2006)341.36SeePrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,1,8;TheWhiteHouse,‘ConsumerDataPrivacyinaNetworkedWorld:AFrameworkforProtectingPrivacyandPromotingInnovationintheGlobalDigitalEconomy’(Report,February2012).37Solove,‘PrivacySelf-Management’,aboven15,1882(describingtheFairInformationPracticePrinciples(FIPPs)whichappearedinthe1973USDepartmentofHealth,Education,andWelfareReport“toaddressconcernsabouttheincreasingdigitizationofdata”).SeealsoPrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,6.38SeeBruceSchneier,DataandGoliath(Norton,2015)92-103.39See,eg,ProductivityCommission,AustralianGovernment,‘DataAvailabilityandUse’(InquiryReportNo82,31March2017);DepartmentofPrimeMinisterandCabinet,CommonwealthofAustralia,‘NewAustralianGovernmentDataSharingandReleaseLegislation:IssuesPaperforConsultation’(IssuesPaper,4July2018).40MauriceEStuckeandArielEzrachi,‘Alexaetal,WhatAreYouDoingwithMyData?’(2018)5CriticalAnalysisofLaw148,149-150.


10

traditionalmarkets,technologyandtheuseofdatadeterminecommercialsuccessindigital

markets.Suppliershavebeenenjoinedto“measureeverything”intheinterestsofcustomer

profiling,targetedmarketing,customisation,pricediscrimination,riskanalysisandtosupport

otherpotentialapplicationsofartificialintelligenceintheirbusinesses.Forthesepurposes,on

oneview,moredataisbetter.41Machinelearningisdatahungry.42Competitorsarebenefiting

frommillionsof“insights”aboutconsumersinthemarketandpossibilitiesofextendinginto

othermarkets.Prominentcritiquesexplainthedynamicsofanew“surveillanceeconomy”or

“surveillancecapitalism”,whichpervasivelyandincreasinglymonitorsandextractshuman

experienceforprofit.43

Inthiscontext,suppliershaveanincentivetoaccumulateawiderangeofincreasinglydetailed

personalinformationaboutanenormousnumberofconsumers,44andtopersuadeconsumers

topermitthistooccur.45Thisincentiveoftenleadssupplierstousehiddentracking

technologies,46andconcealtheirdatapracticesfromtheconsumerstheyareinvestigating,lest

consumersexperienceconcernaboutthesepracticesandobject.47Suppliersrealisethat

wearingafitnesstrackermightnotbenearlysoappealingifthewearerknewtheirbiometric

41SeealsoAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,8.42SeeJosephACannataci,‘ReportoftheSpecialRapporteurontheRighttoPrivacytotheGeneralAssemblyoftheUnitedNations’(AdvancedUneditedReport,A/73/45712,17October2018)[91]-[97].43SeeZuboff,aboven5.SeealsoSusser,RoesslerandNissenbaum,aboven5.44StiglerCenterDigitalPlatformsReport,aboven4,23-24,27-28(onincreasingreturnstoscaleofdatacollection).CfAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,12-14(ontheeconomiccostsanddetrimentstofirmsfromcollectinglargequantitiesofconsumers’personalinformation).45SeeWhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1341-1342(ontheincentivesforopportunisticbehaviouronthepartof“information-intensivecompanies”);MauriceEStuckeandAllenPGrunes,BigDataandCompetitionPolicy(2016)54-56.46Eg,Googletrackers,Facebookpixels,webbeaconsandidentificationovermultipledevices:BrigidRichmond,‘ADayintheLifeofData:RemovingtheOpacitySurroundingtheDataCollection,SharingandUseEnvironmentinAustralia’(Report,ConsumerPolicyResearchCentre,2019)6(‘CPRCDayintheLifeofDataReport’);‘CPRCEmergingIssuesReport’,aboven6,11-12;ACCCDigitalPlatformsReport,aboven3,388-389.Ontheinternetofthings(IoT),seePrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,8.47SeeWhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1341-1342,1368.SeealsoMariaLindhandJanNolin,‘InformationWeCollect:SurveillanceandPrivacyintheImplementationofGoogleAppsforEducation’(2016)EuropeanEducationResearchJournal1,5-11.


11

informationcouldbeusedtoraisetheirfuturehealthinsurancepremiums,orexcludethem

frominsurance.Wemightthinktwiceaboutsearchingonlineforapsychologistifwerealised

potentialmentalillnesscouldbeaddedtoapermanentprofileattachedtoouridentity.

3. Concealeddatapracticesandconsequentdetrimenttoconsumers

“Concealeddatapractices”occurwhensuppliers’termsprovideweakprivacyprotectionsfor

consumerswhiletheextentofthoseterms,theresultantdatapracticesandtheconsequences

ofthesedatapracticesareconcealedfromconsumers.Theseobscuredtermsfrequentlypermit

thecollection,retention,useand/ordisclosureofpersonalinformation,beyondthatwhichis

necessaryfortheprovisionoftheserviceinquestionandbeyondthereasonableexpectations

oftheconsumer.48Practicesofthiskindhavebeenidentifiedwithconcernindigitalmarketsby

anumberofconsumerprotectionandprivacyregulatorsaroundtheworld,49andincreasingly

bycompetitionregulatorsinvestigatingthenatureofcompetitionindigitalmarkets.50

Consumersfaceobstaclesattheoutsetinattemptingtocomprehendprivacypolicytermsand

managetheirownprivacyduetotheirlackofbargainingpowerandunderstandingofthedata

environment.51Asinmanyconsumersituations,consumersinthisspheresufferfroma

48Inthecontextofthemany“free”onlineservicesprovidedtoconsumers,somearguethatbroaddatahandlingpracticesmaybeanecessaryelementofthistypeofbusinessmodel:seeSokolandComerford,aboven7,1133-34.SeealsoKörber,aboven8,17-18.Thatis,thesupplieroftheseservicesneedsto“leverage”consumerdatatoselladvertisingservices,whichinturnfundthezero-priceserviceforconsumers.However,eveninthesecases,privacytermsdonotseemtobesetataparticularlevelnecessarytosecurethisfundingfromadvertising.Insteadtheyfrequentlyappeartoprovidesupplierswithabroadandopen-endedlicencetoextractandexploitconsumerdataatwill:seeHoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,625.49SeePrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28;PatriciaKosseim,OfficeofPrivacyCommissionerofCanada,‘ConsentasaUniversalPrincipleofGlobalDataProtection’(Remarksat7thEuropeanDataProtectionDay,Berlin,Germany,15May2017);FederalTradeCommission,UnitedStates,‘DataBrokers:ACallforTransparencyandAccountability’(Report,May2014).SeealsoUnitedNationsHighCommissionerforHumanRights,‘TheRighttoPrivacyintheDigitalAge’(Report,30June2014).50See,eg,ACCCDigitalPlatformsReport,aboven3,chap7;Crémer,DeMontjoyeandSchweitzer,aboven4;AutoritédelaConcurrenceandBundeskartellamt,‘CompetitionLawandData’(Report,10May2016)25-28.51HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,640-641(“Despitelengthyandgrowingtermsofserviceandprivacy,consumersenterintotradewithonlinefirmswithpracticallynoinformationmeaningfulenoughtoprovidetheconsumerwitheitherexanteorexpostbargainingpower.Incontrast,thefirmisawareofitscoststructure,technicallysavvy,oftenmotivatedbythehigh-poweredincentivesofstockvalues,


12

collectiveactionproblem.Lefttomakeincrementalbargainswithsuppliers,individual

consumershavenopowertobargainforbetterprivacyterms:standardtermsareputforward

bysuppliersona“takeitorleaveit”basis.52Inmanycases,consumershavenorealchoicebut

tousetherelevantserviceinthefirstplace,ortocontinuetousetheserviceafterdata

practicesarerevealed,orunilaterallyamendedbythesupplier.53

Suppliersfrequentlyuseprivacypoliciestogivethemselvestherighttoamendprivacytermsin

futurewithouttheconsumer’sconsent,54andimposeanobligationonconsumerstocheck

periodicallyforsuchchangesonthesupplier’swebsite.Giventhenumberofsupplierswith

privacypoliciesthatapplytoaconsumer,itisclearlyanimpossibilityforanyindividual

consumertoinformthemselvesofthenewtermsinthisway.55Thisunilateralrighttochange

theprivacytermsmightalsobeexercisedbyasubsequentpurchaseroftherelevantbusiness

ordatabase,withquitedifferentbusinessinterestsorprivacyreputationtotheoriginal

supplier.

Manyconsumersalsosufferfromverypoorunderstandingofdatapractices.56Recentresearch

bytheAustralianCompetitionandConsumerCommission(ACCC)shows36percentof

andadeptatstructuringthedealsothatmorefinanciallyvaluableassetsareprocuredfromconsumersthanconsumerswouldprefer.”).52SeeMargaretJaneRadin,‘Boilerplate:TheFinePrint,VanishingRights,andtheRuleofLaw’(PrincetonUniversityPress,2014)13-16;Hull,aboven32,95(thecollectiveactionproblemmayinfactbeexacerbatedinthecaseofprivacyasstigmaattachestobeingtheonlypersonnottoshareinformation,eg,ininsurancesituationswhereothersconsenttotrackingoftheirdrivingorhealthdata).53SeeACCCDigitalPlatformsReport,aboven3,455;Hull,aboven32,94;MauriceEStuckeandArielEzrachi,‘HowDigitalAssistantsCanHarmOurEconomy,Privacy,andDemocracy’32BerkeleyTechnologyLawJournal1239,1286.CfProductivityCommission,AustralianGovernment,‘DataAvailabilityandUse’(InquiryReportNo82,31March2017)80(arguingthatinthecaseofsomeservices“suchassocialmedia,consumerscanchoosewhetherornottousetheclassofproductorserviceatall,withoutadverselyaffectingtheirqualityoflife”).54WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1363-1365.55SeeACCCDigitalPlatformsReport,aboven3,417(onunilateralchangestoGoogle’spolicyoncombininguserdatawithuserdatacollectedviaDoubleClick).56Solove,‘PrivacySelf-Management’,aboven15,1882-1883(“peopleoperateunderwoefullyincorrectassumptionsabouthowtheirprivacyisprotected”);PrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,9;WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1355-1357.


13

Australianconsumersbelievetheexistenceofaprivacypolicymeanssupplierswillnotshare

theirpersonalinformationwithanyoneelse.57Manyconsumersbelievethelawprevents

companiesfrom“misusing”theirpersonaldata.58Researchershavedemonstratedconsumers’

substantialmisunderstandingofprivacyoptionsandwhethertheyhaveinfactexercisedthese

options.59

However,evenwell-informedanddiligentconsumershaveseverelylimitedpowertoexercise

controlovertheirpersonalinformation.60Akeyreasonthatsuppliersareabletoimposetheir

owntermsonconsumersisthattheextentofthesetermsandrelatedcomplexdatapractices

arefrequentlyhiddenfromconsumers.Privacypolicieshavebecomeatoolusedtomanipulate

ratherthaninform.

Anumberofregulatorsandresearchershavecommentedonthemethodsbywhichprivacy

policieshideconcerningpracticesfromconsumersanddiminishtheirimportance.61These

policiesoftenheadlinewithcomfortingreassurances(“Wecareaboutyourprivacy”;“Wenever

sellyourpersonalinformation”)andlistobvious,uncontroversialdatapracticesfirst(“Weuse

57ACCC,‘DigitalPlatformsInquiry:PreliminaryReport’(December2018)174.Seealso‘CPRCEmergingIssuesReport’,aboven6,29,whichrevealedalmost1in5Australianconsumersheldthisbelief,andafurther22%ofAustralianconsumers“didnotknowenoughtoanswerthisquestion”:‘CPRCEmergingIssuesReport’,aboven6,29.SeealsoChrisJayHoofnagleandJenniferKing,ResearchReport2(2008),http://ssrn.com/abstract=1262130(majorityofCalifornianadultsbelievedexistenceofaprivacypolicymeanstherearespecificlimitationsonwhatacompanymaycollectordisclose);JosephTurow,LaurenFeldmanandKimberleyMeltzer,‘OpentoExploitation:AmericanShoppersOnlineandOffline’(UniversityofPennsylvania,AnnenbergPublicPolicyCenter,2005)(75%believeprivacypolicymeansthesitewillnotshareinformationwithotherwebsitesandcompanies).58‘CPRCEmergingIssuesReport’,aboven6,59.59SeealsoLeslieKJohn,‘UninformedConsent’(2018)TheBigIdea:HarvardBusinessReview.60See,eg,‘CPRCEmergingIssuesReport’,aboven6;JessicaRich,‘BCP’sOfficeofTechnologyResearchandInvestigation:TheNextGenerationinConsumerProtection’(FederalTradeCommission,23March2015);Hull,aboven32,91.61See,eg,ACCCDigitalPlatformsReport,aboven3,399-434;StiglerCenterDigitalPlatformsReport,aboven6,31;NorwegianConsumerCouncil,‘DeceivedbyDesign:HowTechCompaniesUseDarkPatternstoDiscourageUsfromExercisingOurRightstoPrivacy’(Report,June2018);OfficeofPrivacyCommissionerofCanada,‘JointInvestigationofFacebookIncbythePrivacyCommissionerofCanadaandtheInformationandPrivacyCommissionerforBritishColumbia’(Report,25April2019);LindhandNolin,aboven47,6-11.


14

yourpersonalinformationtoprovideyouwiththeservice”).62

Termswhichwouldbemoreconcerningtoconsumersappearmuchlaterintheselengthy

documents,63expressedinbroad,vagueorincompletelanguage(“Wemaycollectyour

personalinformationforresearch,marketing,forefficiencypurposes…”or“Wemayalsoshare

yourpersonalinformationwith…someonewithwhomwesharesomecommoncommercial

interest”).64Thesetermsdonotrevealtheactualpracticesofthesupplier,suchashowmany

entitieswillhaveaccesstotheinformation,wherethoseentitiesarelocatedandhowtheyare

regulated,orunexpectedusesoftheinformation.65

Theytendtobephrasedinpermissivelanguage,diminishingtherealityofthepractices(“We

maydisclose…”),giveexamplesofbeneficialuseswhichdistractattentionfrommore

concerninguses,66andcreateabroadlicenceforsupplierstousepersonaldatafornumerous

purposeswithoutattractingpotentialliability.67Researchamplydemonstratesthatconsumers

haveenormousdifficultyunderstandingtheimportoftheseterms,68andthechoiceofwording

makesithardtobelievethiswasaccidental.69

62LindhandNolin,aboven47,7,termthis“hands-offrhetoric”.63Acommonlycitedstudyfoundthatitwouldtaketheaverageperson244hours(sixworkingweeks)peryeartoreadalltheprivacypoliciespresentedfortheirapprovaloracquiescence:AMMcDonaldandLFCranor,“TheCostofReadingPrivacyPolicies”(2008)4JournalofLawandPolicyfortheInformationSociety540.64SeeACCCDigitalPlatformsReport,aboven3,405;Solove,‘PrivacySelf-Management’,aboven15,1885;JValentino-DeVries,NSingerandAKrolik,‘YourAppsKnowWhereYouWereLastNight,andThey’reNotKeepingItSecret’(TheNewYorkTimes,10December2018);StiglerCenterDigitalPlatformsReport,aboven6,31.65ACCCDigitalPlatformsReport,aboven3,418-421;‘CPRCDayintheLifeofDataReport’,aboven46,31;Solove,‘PrivacySelf-Management’,aboven15,1889(“therearealsoscoresofentitiesthattrafficinpersonaldatawithoutpeopleeverbeingaware”).SeealsoUnitedKingdomInformationCommissioner’sOffice,‘PrivacyRegulatorsStudyFindsInternetofThingsShortfalls’(MediaRelease,22September2016)<https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/09/privacy-regulators-study-finds-internet-of-things-shortfalls/>.66LindhandNolin,aboven47,7.67WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1358.68Consumershavecommentedthatprivacypoliciesarephrased“inwordsthatwecannoteventhinkin”,that“youneedtohaveamaster’sdegreetounderstand”;oritseems“theywriteitpurposelysothatnormalpeoplecannotunderstandit”:‘CPRCDayintheLifeofDataReport’,aboven46,21,25.69SeeNorwegianConsumerCouncil,‘EveryStepYouTake:HowDeceptiveDesignLetsGoogleTrackUsers24/7’(November2018);GillianKHadfield,RobertHowseandMichaelJTrebilcock,‘Information-BasedPrinciplesfor


15

Intheiroverallpresentation,manyprivacypoliciesgivetheimpressionthatsuppliersareusing

thesedocumentsasamarketingopportunitytomanipulate,confuseandoverwhelm

consumersintoaccedingtotheirdatapractices,ratherthantoinform.70Theinappropriateness

ofthisstyleisevidentifwecompareanalogoussituations–itwouldclearlybeunacceptablefor

asnackfoodmanufacturertouseasimilarapproachinprovidingstandardnutritional

information(seeFigure1below).Bycontrast,onlinesuppliersregularlytakeadvantageofa

socialatmospheretobenefitfromthehumandesiretodiscloseinformationtoforgesocial

connections.71Thedisclosureofourpersonalinformationtocompletestrangerswhowilluseit

forcommercialpurposesisnotsalientinthesesettings.72

Whereasupplierdoesprovideconsumerswithanymeansofprotectingtheirprivacy,the

relevantprocessesgenerallyrequireactionbytheconsumer(lessprivacyisthedefault),73and

introduceunnecessarycomplexitywheretheconsumerattemptstolimitoroptoutofthe

disclosureofinformation.74

Tobeclear,theissueisnotjustthepresentationofthetermsthemselvesbutthelackof

RethinkingConsumerProtectionPolicy’(1998)21JournalofConsumerPolicy,131,143(“Lookingatthestrategicresponsethatfirmsarelikelytomaketodisclosureregulations,itisnothardtopredictthat,giventhattheinformationtheyarebeingforcedtodiscloseisofstrategicvalueandthatanyrepresentationsmadeincompliancewithadisclosureregulationwillinturnformthebasisforliabilityifuntrueandmisleading,sellerswillattempttominimizedisclosureandliabilitybycomplyingthroughobfuscationandcomplexordifficulttodecipher(orevenreceive)statements.”)70SeeStiglerCenterDigitalPlatformsReport,aboven6,31.71SeeSolove,‘PrivacySelf-Management’,aboven15,1895(“manywebsitesaredesignedtoencourageexposurewhileminimizingawarenessoftherisks”);LeslieKJohn,‘UninformedConsent’(2018)TheBigIdea:HarvardBusinessReview.72BruceSchneier,DataandGoliath(Norton,2015)239.73NorwegianConsumerCouncil,‘DeceivedbyDesign’,aboven61,13-15.Onthepowerofdefaults(“optouts”)overconsumerbehaviour,andwelfare-enhancingdefaults,seeMichaelSBarr,SendhilMullainathanandEldarShafir,‘AOne-Size-Fits-AllSolution’,NewYorkTimes(Online,26December2007).74ACCCDigitalPlatformsReport,aboven3,424-434;NorwegianConsumerCouncil,‘DeceivedbyDesign’,aboven61,19;‘CPRCDayintheLifeofDataReport’,aboven46,25.SeefurtherRyanNakashima,‘APExclusive:GoogleTracksYourMovements,LikeitorNot’(APNews,14August2018);MaryHanbury,‘AlexaCanNowDeleteYourRecordedVoiceCommands,ButAmazonHasn’tMadeitEasy’(BusinessInsiderAustralia,30May2019).


16

transparencyaboutcurrentandfuturedatapracticesandtheabilitytounderstandthe

consequencesofthesepractices.75Itisnotthecase,assomescholarshaveasserted,that

consumers“aregenerallyabletoassesstherisksofdisclosureorothermisuseoftheir

information,andtoassesstheexpectedcoststothemselvesifsuchmisuseshouldoccur”,even

withrevelationsbyregulators.76Noristheacceptanceofprivacytermssimplyamatterof

“presentbias”(thatis,consumersovervaluetheimmediatebenefitsoffreeonlineservices

relativetofutureconsequencesofoverbroadprivacyterms).77Giventhelackofcandourand

transparencyonthepartofsuppliers,consumershavelittlehopeofunderstandingthecontent

andfutureconsequencesofthesedecisionseveniftheyarediligentandconcerned.78Howcan

wecomparefuturecoststopresentbenefitswhenweareplainlypreventedfrom

understandingthefuturecosts?79

75Hull,aboven32,91(“dataminingconspirestomakeconsentmeaninglessbecausetheusestowhichdatawillbeputarenotknowabletotheuser—orperhapseventhecompany—atthetimeofconsent”);WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1359-1360.76ManneandSperry,aboven8,3.77LeslieKJohn,‘UninformedConsent’(2018)TheBigIdea:HarvardBusinessReview;Oxera,‘TooMuchInformation?TheEconomicsofPrivacy’(OxeraAgenda,October2014)3.SeeAAcquistiandJGrossklags,‘PrivacyAttitudesandPrivacyBehavior’inJCampandRLewis(eds),EconomicsofInformationSecurity(Kluwer,2004)165-178.78SeePrivacyCommissionerofCanadaConsentandPrivacyReport,aboven32,9.79Hull,aboven32,93(“usersdonotandcannotplausiblybeexpectedtoknowenough—neitherabouttheusestowhichtheirinformationmightbeput,noraboutthespecificbenefitsandharmsthatmightresultfromthoseuses,noraboutthelikelihoodthatsuchharmsmightresult—forconsenttobemeaningful”);Solove,‘PrivacySelf-Management’,aboven15,1881(“Itisvirtuallyimpossibleforpeopletoweighthecostsandbenefitsofrevealinginformationorpermittingitsuseortransferwithoutanunderstandingofthepotentialdownstreamuses…”).Thereisalsothedifficultythatthebenefitmaybefarmorelimitedthanconsumersrealise–eg,targetedadsmaybenobetterthancontextualads:KatherineStrandburg,‘FreeFall:TheOnlineMarket’sConsumerPreferenceDisconnect’[2013]UniversityofChicagoLegalForum95,172.


17

Figure1:IfNutritionalInformationwereDraftedLikePrivacyPolicies


18

Consumersareoftenunawarethattheyhavepurportedlyconsentedtotermswhichprovide

permissionforthesupplierto:

• aggregateinformationfrommultiplesources(onlineandoffline)tocreatedetailed

consumerprofiles,80and/orplacetheconsumerwithinconsumersegments,whichcan

negativelyaffectthefutureopportunitiesoftheconsumer;

• tracktheconsumer’sphysicallocation,andproximitytoothers,beyondwhatisrequired

fortheprovisionoftheservice;81

• collectandretaintheconsumer’sbiometricdata–forexample,heartrate,blood

pressure,physicalactivity–beyondthatwhichisnecessaryfortheconsumer’s

purposes;82

• usethepersonalinformationforpurposesnotreasonablywithintheexpectationof

consumers;83

• disclosethepersonalinformationtootherentitiesnotreasonablywithinthe

expectationofconsumers;84

• storepersonalinformationlongerthannecessaryorindefinitely;

• transferpersonaldatainasaleofbusiness,orasaseparateasset,withoutbeingobliged

toimposerestrictionsonthepurchaserofthatinformation;

• exchangetheconsumer’spersonalinformationwithdataaggregators,databrokers

and/ordataanalyticsfirms;85and

• excludeorseverelylimittheliabilityofsuppliersforunauthoriseduseordisclosureof

theconsumer’spersonalinformation.86

80‘CPRCDayintheLifeofDataReport’,aboven46,7-8,29.81ResearchhasshownthemajorityofAustralianconsumersdonotwanttheirlocationdatasharedwiththirdparties:PNguyenandLSolomon,‘ConsumerDataandtheDigitalEconomy’(Report,ConsumerPolicyResearchCentre,2018)60.82UriGal,‘TheAgeofBigDataisGoingtoChangeHowWeBehave’(TheConversation,12October2016).83SeeACCCDigitalPlatformsReport,aboven3,399-400,414-422.84Hull,aboven32,91.85‘CPRCDayintheLifeofDataReport’,aboven46,8-11.86HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,625.


19

Revelationsaboutsomeoftheactualdatapracticesofsuppliersgenerallycomeonlyfrom

sporadicmediareportsfollowingmajordatabreaches.87Thesereportsgiverisetosome

distrustbutconcernedconsumersoftenfeelthereisnopracticalmeansofprotectingtheir

informationormakinganyrealdifference.Manybecomedesensitizedbyrepeatedreportsof

databreaches.88Resignationanddespairareevident,withconsumersexpressingthesensethat

constantdatacollectionisinescapable.89

Regardlessofanindividualconsumer’ssubjectiveattitudetoprivacyandsuppliers’data

practices,theseconcealedpracticesimposeobjectivecostsanddetrimentsonconsumers,

includingthosedescribedinthefollowingsection.

Objectiveconsumerdetrimentsfromconcealeddatapracticesanddegradeddataprivacy

Increasingthe“AttackSurface”andResultantRisksofHacking,AccidentalDisclosureand

IllegalUseofPersonalInformation

Weakprivacyprotectionsincreasethe“attacksurface”oftheconsumer’spersonalinformation.

Themorepersonalinformationiscollectedandstored,themorebroadlyitisdisclosed,andthe

longeritisstored,themorelikelyitwillbehacked,accidentallydisclosedorusedforillegal

purposes.90Thisisnotsimplyaquestionofthequalityofthesupplier’sdatasecuritysystems.

87LeslieKJohn,‘UninformedConsent’(2018)TheBigIdea:HarvardBusinessReview.88Acquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,13.89‘CPRCDayintheLifeofDataReport’,aboven46,21;‘CPRCEmergingIssuesReport’,aboven6,4;JosephTurow,MichaelHennessyandNoraDraper,‘TheTradeoffFallacy:HowMarketersareMisrepresentingAmericanConsumersandOpeningThemuptoExploitation’(Report,AnnenbergSchoolforCommunication,UniversityofPennsylvania,June2015)https://www.asc.upenn.edu/sites/default/files/TradeoffFallacy_1.pdf(“morethanhalfdonotwanttolosecontrolovertheirinformationbutalsobelievethislossofcontrolhasalreadyhappened”).SeefurtherStuckeandEzrachi,‘DigitalAssistants’,aboven53,1292-1293.90See,eg,ACCC,‘DigitalPlatformsInquiry:PreliminaryReport’(December2018)200,onimproperdisclosuresofpersonaldataofFacebookusersintheCambridgeAnalyticabreach;Dataon540MillionFacebookUsersExposed,(BBCOnline,4April2019)<https://www.bbc.com/news/technology-47812470>;LNewman,‘ANewGoogle+BlunderExposedDataFrom52.5MillionUsers’(Wiredonline,12October2018).


20

Datasecurityexpertsacknowledgethatevenhighlysecuresystemsarealmostcertaintobe

breachedatsomestage.91Absentahack,datamaybeimproperlyaccessed(includingbythe

supplier’sownemployeesorcontractors),92exposedorusedduetotechnicalglitchesor

operatorerror.93Theserisksaregreatlyincreasedbythefactthatthispersonalinformation

maylaterbecontrolledbyasubsequentpurchaserofthesupplier’sbusiness,94ordatabrokers,

aggregatorsorassociates,whoarenotcontractuallyobligedtoprotecttheconsumer’s

information.95Theextentofdatacollected,thedurationofitsstorageandtheextentofits

disclosureareallfactorswhich,inthemselves,increasethevulnerabilityofthedata.

Identitytheftisakeyriskcreatedbyincreasedcollectionanddisclosureofpersonal

information.96Followingadatabreach,perpetratorsmaywaitanextendedperiodtocommit

identitytheftagainsttheconsumer,sometimesusingtheopportunityofafurtherbreachwhich

revealsadditionalinformation.Whenidentitytheftoccurs,thevictimmayspendyears

attemptingtocleartheirnameofdebt,bankruptcyandcriminalactivity,sufferingrepeated

lossesintheirqualityoflife,reputation,financesandtime.97Thisdifficultybecomesextremein

<https://www.wired.com/story/google-plus-bug-52-million-users-data-exposed/>.91BruceSchneier,‘DataisaToxicAsset,SoWhyNotThrowItOut?’(CNNonline,1March2016)<https://edition.cnn.com/2016/03/01/opinions/data-is-a-toxic-asset-opinion-schneier/index.html>.92See,eg,AmendedStatementofClaim,TracyEvansvHealthAdministrationCorporation&Anor(NSWSC2017/00374456),filed27March2018,claimingfordamagecausedbyacontractorofNSWAmbulanceServiceaccessing,compiling,andsellingthemedicalrecordsofambulanceemployeeswithouttheirknowledgeorconsent.93HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,644-48;DanielJSolove,‘ATaxonomyofPrivacy’(2006)154UniversityofPennsylvaniaLawReview477,515.94WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1363-1364.95SeeHoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,628,633;‘CPRCDayintheLifeofDataReport’,aboven46,8-11.96SeeDanielleKeatsCitron,‘ReservoirsofDanger:TheEvolutionofPublicandPrivateLawattheDawnoftheInformationAge’(2007)80SouthernCaliforniaLawReview241,246-256;Acquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,15-17.In2016,11%ofAustralianshadbeenthevictimofidentitytheft:PJornaandRGSmith,‘NationalIdentitySecurityStrategy:IdentityCrimeandMisuseinAustralia2017’(AICStatisticalReport,2019)36.97SeePJornaandRGSmith,‘NationalIdentitySecurityStrategy:IdentityCrimeandMisuseinAustralia2017’(AICStatisticalReport,2019)(reportingthatimpactsonvictimsofidentityfraudincluderefusalofcredit,refusalof


21

thecaseofbiometricidentitytheft,whereaperson’sveryphysicalfeatures–theiririsscansor

fingerprints–arestolenfromdigitaldatabasesandusedtoimpersonate.98

Theincreasedexposureofpersonalinformationtoattackshouldberecognisedasadetriment

totheindividualevenbeforeharmofthiskindcrystallises.Increasedvulnerabilitytoserious

harmisdetrimentinitself.Thelawrecognises,forexample,thatmedicalmalpracticewhich

increasesapatient’svulnerabilitytoadiseaseordisordercausesdamagetothepatientbefore

thediseaseordisorderisactuallycontracted.99Sotoounfairdatapracticeswhichincreasea

consumer’svulnerabilitytohackingandotherunauthoriseddataaccessaredetrimentaltothe

consumer.100

Databreachesmaybeaninescapablefactoftwenty-firstcenturyexistence.Thisdoesnotmean

thatweshouldresignourselvestotheharm.Rather,thepracticeswhichprovidethe

opportunityforthisharm–thecollection,storage,useanddisclosureofpersonalinformation–

shouldbeminimizedandkeptproportionatetotherealbenefitstheyarelikelytocreatefor

consumers.

governmentbenefits,mentalandemotionaldistress,financialdifficultiesresultinginrepossessionofhouse,landormotorvehicles,legalaction,wrongfulaccusationofcriminalconductandreputationaldamage).98Citron,aboven96,254fn71(“Athief'suseofanindividual'sbiometricdatatocommitidentitytheftwillcreateenormousproblemsforvictimsseekingtoprovethetheft,asallidentity-theftvictimsfaceacertainamountofdifficultyinprovingthatfraudulentexpensesarenottheirown.…Butthelikelyassumptionthatone'sfingerprintdoesnotliecompoundsthatdifficultyforanindividualwhosuffersfinancialtheftasaresultoftheleakoftheindividual'sbiometric.”).99DanielJSoloveandDanielleKeatsCitron,‘RiskandAnxiety:ATheoryofData-BreachHarms’(2018)96TexasLawReview737,761-762.100Ibid.


22

DisclosureofPersonalInformationtheConsumerDoesNotWishtoDisclose

Moderndatapracticesallowsupplierstoplacetheconsumerunderthemicroscope,101without

makingconsumersawareofthescrutiny.Consumersmaybeawarethattheyaredisclosing

theirname,address,mobilephonenumber,productpreferencesandcreditcarddetails.They

aremuchlesslikelytobeawareofsupplierstrackingtheirsubsequentinternetbrowsing

historyandthewaytheynavigatewebsites,downtoscrollspeed,hoveringoverimagesand

clicks;orthefactthatthedatatheyprovideiscombinedwithfurtherpersonalinformation

collectedfromothersuppliersanddataaggregatorstopermitmoredetailedscrutinyof,102and

inferencesabout,theconsumer’scharacteristics,behaviourandtendencies.103New

developmentsmayevenallowearlydetectionoftheonsetofdiseases,suchasParkinson’sand

Alzheimer’s,fromconsumers’“tremorswhenusingamouse,repeatqueriesandaverage

scrollingvelocity”.104

Theoriginalinformationdisclosedbytheconsumermayseeminnocuous.Itmayseemless

innocuouswhencombinedwithcontinued,unanticipatedtrackingoftheconsumer’sbehaviour

andaggregationofthatinformationwithotherdata,includingage,gender,occupation,social

mediaactivity,purchasinghistory,detailsofchildrenandspousesandothermoresensitive

101StiglerCenterDigitalPlatformsReport,aboven6,7(“whatdigitalbusinessescanlearnbyusinghigh-dimensional,largedatasetstoexploreeverynookandcrannyofconsumers’manybehavioralshortcomingsandbiasesinrealtime”).102Eg,fewconsumerswouldbeawarethatAcxiomhasmarketedaproductwhichallowssupplierstorequestonlyapostcodefromthecustomeratthepointofsaleandcombinethatpostcodewiththesaletransactiondatatoprovidethemerchantwiththecustomer’sundisclosedaddress:WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1361-1362.103‘CPRCEmergingIssuesReport’,aboven6,11-12,60;‘CPRCDayintheLifeofDataReport’,aboven46,29-30.SeealsoHoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,610,636-37;StiglerCenterDigitalPlatformsReport,aboven6,25.104SumathiReddy,‘CluestoParkinson’sandAlzheimer’sFromHowYouUseYourComputer:AStudyInvolvingtheMicrosoftSearchEngineBingShowsHowArtificialIntelligenceMightDetectMedicalConditionsTraditionalMedicineMisses’,WallStreetJournal(online,29May2018).SeefurtherCitron,aboven96,253-255(onthepotentialforretinascansandfingerprintstorevealdiseasesandgeneticdisorders).


23

information.105Thisinformationcanalsobeusedtomakedisadvantageousinferencesabout

theconsumer,asexplainedbelow.

Combiningpersonaldatafrommultiplesourcesismadepossiblebyadataecosystemwhichis

almostentirelyinvisibleandunknowableforconsumers.106Dataaggregatorscompileimmense

quantitiesofpersonalinformationaboutindividualconsumers,usingdataacquiredfrom

supplierswithwhomtheconsumerhasdealtaswellasdataacquiredfromotherdatabrokers

andaggregatorswithwhomtheconsumerhasneverhadanydealings.107Thispersonal

informationcanbeusedtomakeinferencesaboutconsumers’intimatecharacteristics,108and

profileandsortconsumers,particularlytocompilelistsofconsumersforsaletoothersuppliers

anddatabrokers.109

Importantly,theaggregationofpersonaldatamayalsobeusedtore-identifysensitive

informationwhichtheconsumerdisclosedinothercontextsinthebeliefthatthissensitive

informationwasdisclosedonade-identifiedoranonymousbasis.110Thisunanticipated

105‘CPRCEmergingIssuesReport’,aboven6,13-15;HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,637-639.Solove,‘PrivacySelf-Management’,aboven15,1889(“people…greatlystruggletofactorinhowtheirdatamightbeaggregatedinfuture.…Unexpectedly,thisdatamightbecombinedandanalyzedtorevealsensitivefactsabouttheperson.Thepersonneverdisclosedthesefactsnoranticipatedthattheywouldbeuncovered.Theproblemwasthatthepersongaveawaytoomanyclues.”).SeealsoBriefforTechnologyCompaniesasAmiciCuriaeinSupportofNeitherParty,CarpentervUnitedStates,No16-402,2017WL3530959(14August2017)25(“digitaldevicesandservicesproduceandrecorddatathat,aloneorintheaggregate,hasthepotentialtorevealhighlysensitiveinformationaboutallaspectsofourprivatelives”).106Solove,‘PrivacySelf-Management’,aboven15,1889(“therearealsoscoresofentitiesthattrafficinpersonaldatawithoutpeopleeverbeingaware”);LeslieKJohn,‘UninformedConsent’(2018)TheBigIdea:HarvardBusinessReview.107FederalTradeCommission,UnitedStates,‘DataBrokers:ACallforTransparencyandAccountability’(Report,May2014);‘CPRCDayintheLifeofDataReport’,aboven46,8-11;HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,633;Acquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,8.108SeeCitron,aboven96,253-255(onthepotentialuseofbiometricstorevealdiseasesandgeneticdisorders).109Ibid.SeealsoPrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,6-7.110SeeLucRocher,JulienMHendrickxandYves-AlexandredeMontjoye,‘EstimatingtheSuccessofRe-IdentificationsinIncompleteDatasetsUsingGenerativeModels’(2019)10NatureCommunications3069;PrivacyCommissionerofCanadaConsentandPrivacyReport,aboven28,15-16(riskofre-identificationincreasesovertime);Crémer,DeMontjoyeandSchweitzer,aboven4,77-78,86.SeealsoJosephACannataci,‘ReportoftheSpecialRapporteurontheRighttoPrivacytotheGeneralAssemblyoftheUnitedNations’(AdvancedUneditedReport,A/73/45712,17October2018)[61]-[67].


24

collectionandcombinationofinformationcanrevealfarmoreintimatedetailsofthe

consumer’ssexualactivity,sexualorientation,religion,politicalviews,levelofdebt,

consumptionofalcohol,tobaccoandotherdrugs,diseases,disorders,insecurities,behavioural

biases,andfinancialvulnerability,detailstheconsumerwouldneverhavechosentodiscloseto

thesupplierinquestionorothersupplierswhomayusetheservicesofadatabroker.111

PersonalInformationUsedtoDiscriminate,ManipulateandExclude

Consumersarenotgenerallyawareofhowtheyhavebeenprofiledorthelistsinwhichthey

havebeenincluded.112TheACCCpointedoutinitsDigitalPlatformsReportthatFacebook

advertisingcategoriesinAustraliaincluded“oppositiontoimmigration”;“farleftpolitics”;

“vaccinecontroversies;and“climatechangedenial”.113Quantium,adatabroker,statesthatit

dividesAustralianhouseholdsinto15distinctcustomersegments,including“Affluent

Adventurers”,“CountrysideElite”,“SuburbanThrift”and“ProsperousFamilies”,“basedentirely

onreal-worldpeopleandtheirreal-worldtransactions”.114Inits2014investigationintothe

databrokerindustry,theUSFederalTradeCommissionrevealedsomeoftheeuphemistically

namedlistswhicharetradedbetweendatabrokersandsuppliers,including“Diabetes

Interest”;“CholesterolFocus”;“FinanciallyChallenged”;and“UrbanScramble”.115

Theaggregationanddisclosureofconsumers’personalinformationintheprocessofconsumer

profilingandsegmentingcancausesignificantfinancialdetriment.Datacollectedabouta

consumerwithouttheirknowledgecanbeusedtodiscriminateagainsttheconsumeronthe

111See‘CPRCEmergingIssuesReport’,aboven6,23-24,32-33;Hull,aboven32,92;‘CPRCDayintheLifeofDataReport’,aboven46,15,36.112HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,633-634.113ACCCDigitalPlatformsReport,aboven3,446.114Quantium,‘Q.SegmentsCrowdsBrochure’,(Quantiumwebsite)accessed4August2019,<https://www.quantium.com/wp-content/uploads/2018/07/Q.Segments_Crowds_brochure_2018.pdf>.115FederalTradeCommission,UnitedStates,‘DataBrokers:ACallforTransparencyandAccountability’(Report,May2014)47.


25

basisoftheironlineandofflinebehaviour.116Thisinformationcanbeusedtodrawunexpected

andadverseinferencesabouttheconsumer’screditriskonthebasisofitemstheypurchaseor

placestheyvisit,117ortochargetheconsumermoreonthebasisoftheirperceivedabilityto

pay.118Itmaymean,forexample,thattheconsumerischargedhigherinterestratesor

insurancepremiums;119shownmoreexpensivesearchresults;120quotedhigherpricesforthe

sameproduct;121orcompletelyexcludedfromcertainoffers.122

Suppliersarealsoknowntouseprofiling,micro-targetingandmanipulation123totake

advantageofconsumerneeds,habits,addictionsandvulnerabilities.124AsPasqualehas

116SeeStuckeandEzrachi,‘DigitalAssistants’,aboven53,1263-1270.Cfthedescriptionofahypothetical“virtuous”digitalassistantthat“couldwarnuserswhenbehavioraldiscriminationisatplay,whenoutsideoptionsareignored,whenpricealignmentseemsoutoforder,orwhenpersonaldataiscollected.Theymayevendeploycountermeasurestomaximizeuserwelfareinthefaceofsuchstrategies…Theycanpromoteusers’interest—awareoftheirpreferencesandsafeguardingtheirautonomy.”:at1287.117SeeHull,aboven32,91(onestimatesofthelikelihoodofdefaultandcreditdelinquencybasedonpurchasesoffeltpadstoprotectfurnitureversusvisitstoSharxxPoolBarandobesity).118Acquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,17.SeeRafiMohammed,‘HowRetailersUsePersonalisedPricestoTestWhatYouareWillingtoPay’(HarvardBusinessReviewonline,20October2017).119SeeProductivityCommission,AustralianGovernment,‘DataAvailabilityandUse’(InquiryReportNo82,31March2017)86-89(ondatasharinginthecontextofinsurancecompanies’riskanalysisandmarketing).120See,eg,DanaMattioli,‘OnOrbitz,MacUsersSteeredtoPricierHotels’,TheWallStreetJournal(online,updated23August2017).121SeeChristopherTownley,EricMorrisonandKarenYeung,‘BigDataandPersonalisedPriceDiscriminationinEUCompetitionLaw’(King’sCollegeLondonDicksonPoonSchoolofLaw,LegalStudiesResearchPaperSeries:PaperNo2017-38)1-2.122FederalTradeCommission,‘BigData:AToolforInclusionorExclusion?UnderstandingtheIssues’(Report,January2016)9-12;‘CPRCEmergingIssuesReport’,aboven6,24-25;‘CPRCDayintheLifeofDataReport’,aboven46,36;Stacy-AnnElvy,“CommodifyingConsumerDataintheEraoftheInternetofThings”(2018)59BostonCollegeLawReview423,449-451.SeefurtherOfficeofthePrivacyCommissionerofCanada,‘TheAgeofPredictiveAnalytics:FromPatternstoPredictions’(Report,August2012).123SeeSusser,RoesslerandNissenbaum,aboven5(‘Inourview,manipulationishiddeninfluence…manipulatingsomeonemeansintentionallyandcovertlyinfluencingtheirdecision-making,bytargetingandexploitingtheirdecision-makingvulnerabilities.Covertlyinfluencingsomeone…meansinfluencingtheminawaytheyaren’tconsciouslyawareof,andinawaytheycouldn’teasilybecomeawareofweretheytotryandunderstandwhatwasimpactingtheirdecision-makingprocess.’).124EuropeanDataProtectionSupervisor,aboven3,8-9.SeefurtherDamianClifford,‘Citizen-ConsumersinaPersonalisedGalaxy:EmotionInfluencedDecision-Making,aTruePathtotheDarkSide?’(forthcominginLilianEdwards,BurkhardSchaferandEdinaHarbinja(eds),FutureLawSeries(EdinburghUniversityPress)(ontheuseofemotiondetectiontechnologytocreate“emotionallytailoredprofiles”adding“alayerofmanipulation”and


26

testified,listshavebeencompiled–listsofrealpeoplewhosufferfromdepression,impotence,

sexuallytransmitteddiseases,Alzheimer’sdiseaseanddementia,peoplewhoarevictimsof

sexualassault.125Suchlistsmaybeusedtoexploitpeopleintheirmostvulnerablemomentsfor

financialgain.Dataanalyticshavealsobeenusedtomanipulateindividualsforthepurposeof

research,withouttheirknowledgeorconsent.126

Calohasexplainedtheharmcausedby“vulnerability-basedmarketing”builtonthesepractices,

whichexploitstheparticularvulnerabilitiesofconsumers,asrevealedbytheirpersonal

information.127Somefirmsaretakingthisfurther,deliberatingengineeringmomentsof

vulnerabilitytailoredtotheindividualandexploitingthesevulnerabilitiesforfinancialgain.128

“Amanufacturerofhighlyaddictivepainkillershasbeenusingdata-matchingtechniquesto

trackpeople’sGooglehealthsearchesandtargetthemwithadsthatincreaseinintensityuntil

theyrespond.…Itwascontinuingtopromotetheuseofopioidstotreatchronicpaineven

thoughcurrentscienceandmedicalguidelinessuggesttheyshouldbeavoidedandcan

potentiallymakechronicpainworse.”

AlisonBranley,‘GoogleSearchDataUsedbyPharmaGianttoBombardUserswithAdsfor

AddictiveOpioids’(ABCOnline,13July2019)

interferencewithautonomywith“theabilitytotargetindividualsonthebasisoftheiremotionalstatusandpersonalisethenatureoftheappealtomatch”).125FrankPasquale,WrittenTestimonyBeforetheUnitedStatesHouseofRepresentativesCommitteeonEnergyandCommerce:SubcommitteeonDigitalCommerceandConsumerProtection,‘Algorithms:HowCompanies’DecisionsAboutDataandContentImpactConsumers’(29November2016)3-4.126SeeHull,aboven32,92.127RyanCalo,“DigitalMarketManipulation”(2014)82GeorgeWashingtonLawReview995;RyanCaloandAlexRosenblat,“TheTakingEconomy:Uber,InformationandPower”(2017)117ColumbiaLawReview1623.SeealsoSeeStiglerCenterDigitalPlatformsReport,aboven6,22-23,35-36.128Ibid.SeealsoSusser,RoesslerandNissenbaum,aboven5(onthelargerthreatstoindividualautonomy).


27

“AtWoolworthsRewards,wehaveabigmemberdatabase.Wealsohavebigdata.Everytime

someoneshops,scansandsaves,wecollectdatatolearnalittlebitmoreaboutthem.

…we’vedevelopedastateoftheart“personalisationengine”thatanalysesourdata…

Tomatchourofferstoeachmember,weaskedtheirshoppingdataaseriesofquestions–Have

theyboughtitbefore?Howoften?Andatwhatprice?Dotheyevencareaboutprice?…Our

engineessentiallyaskseachmember70millionquestionseachandeveryweek.”

“WOWPersonalisation”,YouTubevideo,https://www.quantium.com/media/accessed5

August2019

4. Areconcealeddatapracticesacompetitionlawissue?

Concealeddatapracticespotentiallygiverisetoclaimsunderprivacylaw(althoughthe

prospectsofredressarelimitedinAustralia),129orconsumerlaw,includingmisleadingor

deceptiveconduct,unconscionableconductand/orunfaircontractterms.130Theyalso

demonstrateaneedforconsumerprotectionand/orprivacyregulationtobestrengthenedto

provideconsumerswithgreaterprotection,informationandchoices.131

Butdotheeffectsofconcealeddatapracticesalsowarrantconsiderationundercompetition

law?Thissectionoutlinesthetwomainresponsestothisquestionandproposesathird.

129SeeAustralianPrivacyFoundation,SubmissiontoACCCDigitalPlatformsInquiry(February2019)5-10.AndintheUnitedStates:StiglerCenterDigitalPlatformsReport,aboven6,6.130See,eg,CarmenLanghankeandMartinSchmidt-Kessel,‘ConsumerDataasConsideration’(2015)6EuCML218;MarkBriedis,JaneWebbandMichaelFraser,‘ImprovingtheCommunicationofPrivacyInformationforConsumers:Issues,OptionsandRecommendations’(Report,February2016).131SeeACCCDigitalPlatformsReport,aboven3,Chap7(regardingtheACCC’srecommendationstoamendthePrivacyAct1988(Cth)andtheAustralianConsumerLawtoaddressthesemarketfailures).


28

4.1 Dataprivacyisanon-economicobjectiveoutsidethetruegoalsofcompetitionlaw

Somecommentatorsclaimthequalityofprivacyprotectionsofferedinthecourseofdigital

servicesisamatterofindividualpreference,whichshouldbelefttotheindividualconsumer.132

Accordingtotheseviews,certainconsumersmayhaveasubjectivesensitivitytoprivacyissues,

butthereisnosatisfactorywayoftakingthisintoaccountintheobjective,economic

assessmentsofcompetitionlaw.133Evenifprivacyprotectionisaworthysocialgoal,the

argumentgoes,itisagoalthatfallsoutsidetheobjectivesofcompetitionlaw.134

Onthisview,antitrustisconcernedwithimprovingconsumerwelfareintheformofeconomic

efficiency.Itdoessobyprotectingthecompetitiveprocess,whichgenerallyimprovesthat

efficiency,measuredintermsofpriceandoutputlevelsoftherelevantproduct.Dataprivacyis

seenasanon-economicobjectivewhichdoesnotsitcomfortablywitheconomicassessments

ofcompetition.135

Somecontinuetoassertthatthereis,inanycase,a“privacyparadox”atwork.136Thatis,while

consumersrepeatedlyclaiminsurveysthattheyareincreasinglyconcernedabouttheironline

privacy,theirbehaviourincontinuingtodealwithsuppliersthatofferprivacy-intrusiveterms

indicatesthatprivacyisnotinfactahighpriorityforconsumersinthesetransactions.

Accordingly,theremaybenorealneedforregulatoryinterventionofanykind.

132SeeAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,4,citingEMNoam,‘PrivacyandSelf-Regulation:MarketsforElectronicPrivacy’inUSDepartmentofCommerce,‘PrivacyandSelf-RegulationintheInformationAge’(1997);ManneandSperry,aboven8,5-6.133SokolandComerford,aboven7,1156-1161;ManneandSperry,aboven8,3,5-6.134SokolandComerford,aboven7,1156-1161.135SeeGeoffreyManneandBenSperry,‘DebunkingtheMythofaDataBarriertoEntryforOnlineServices’(TruthontheMarketBlog,26March2015).136SeePatriciaANorberg,DanielRHorneandDavidAHorne,‘ThePrivacyParadox:PersonalInformationDisclosureIntentionsversusBehaviours’(2007)41JournalofConsumerAffairs100(explainingtheconceptofa“privacyparadox”andresearchtoexplainthephenomenon);SusanAthey,ChristianCataliniandCatherineTucker,‘TheDigitalPrivacyParadox:SmallMoney,SmallCosts,SmallTalk’(NBERWorkingPaperNo23488,2017).


29

4.2 Dataprivacyisrelevanttocompetitionpolicyandweshouldplaceavalueon

consumerdata

Othershavechallengedtheviewthatconsumersareengaginginaninformedbargaininrespect

oftheirdataprivacy.Recognisingthatpersonalinformationiscollectedaboutconsumersand

usedtofundtheprovisionofzero-orlow-pricedservices,somescholarshavesuggestedthat

consumersareinfact“paying”orbarteringfortheseserviceswiththeirpersonal

information.137Thatis,whilethemarketedpriceisatornearzero,thetruepriceoftheservices

isrepresentedbythevalueofthepersonalinformationcollectedaboutthatconsumerandthe

valueofthepermittedusesofthatinformation.138Ifthevalueoftheconsumer’sinformation

wereknown,itmaybecomeapparentthatacompetitivepricewouldnotbezerobuta

negativeprice:thesupplierwouldpaytheconsumerinmoneyorotherbenefitstousethe

serviceandpermitcollectionoftheirpersonalinformation.139However,inreality,neitherthe

preciseextentofthedatacollectionanduse,northevalueoftheconsumer’sinformation(in

absolutetermsorrelativetothevalueoftheservice),aregenerallyknownbytheconsumer.140

Bywayofanalogy,wemightsupposethat,althoughtheservicestoconsumersappeartobe

free,thereisactuallyanundeclaredchargeofanindeterminateamountagainsttheconsumer’s

bankaccounteachtimetheyusetheservice.Theconsumerhaslostsomeofhisorher

informationprivacyandthesupplierhasgainedaccessto,anduseof,personalinformation,but

137SeeHoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,625;GianclaudioMalgieriandBartCusters,‘PricingPrivacy:TheRighttoKnowtheValueofYourPersonalData’(2018)34ComputerLaw&SecurityReview289.Consumersalsoprovidetheirattention(toadvertisements)inexchangeforonlinecontent:JohnMNewman,‘TheMythofFree’(2018)86GeorgeWashingtonLawReview513,551-555;Evans,‘AttentionPlatforms’,aboven7.138SeeOECD,‘ExploringtheEconomicsofPersonalData:ASurveyofMethodologiesforMeasuringMonetaryValue’(WhitePaper,2013)18-33.SeeStiglerCenterDigitalPlatformsReport,aboven6,32-33.139SeeStiglerCenterDigitalPlatformsReport,aboven6,32-33;UKCompetitionandMarketsAuthority,‘TheCommercialUseofConsumerData:ReportontheCMA’sCallforInformation’(Report,June2015)paras2.106-2.107.140HoofnagleandWhittington,‘Free:AccountingfortheCosts’,aboven14,610;StiglerCenterDigitalPlatformsReport,aboven6,45;Acquisti,TaylorandWagman,‘TheEconomicsofPrivacy’,aboven14,447-448(onattemptstovalue,andpermitconsumerstotradein,personalinformation).


30

thevaluerespectivelylostandgainedcannotbequantified.Thedebatehasoftenbeenframed

alongtheselines.Inthiscontext,manypointoutthatthevalueofthepersonalinformation

divulgedpertransactionmaybeverylowforsupplier.141Thetruevalueforthesupplierliesin

accumulatingvastquantitiesofhighqualitypersonaldataandapplyingproprietaryalgorithms

tothatdata.Further,thevalueofthesametypeandamountofpersonalinformationmayvary

greatlyfromconsumertoconsumer,dependingontheirpersonalprivacypreferences.142One

cannotputapricetagonthepersonaldatadisclosedtoreceivethefreeservice.

4.3 Degradeddataprivacycreatesobjectiveconsumerdetrimentandunderminesthe

competitiveprocess

Thereisamoreaptwaytoconceptualisetheseusesofconsumerdata.Byanalternative

analogy,wemightsupposethat,aspartofthetermsofservice,theconsumerisrequiredto

installcertainsoftwareontheircomputerwhichfacilitatestheserviceandcreatesvalueforthe

supplier,butalsomakestheconsumer’scomputermuchmorevulnerabletohacking.Formost

consumers,thecreationofthisvulnerabilityiscompletelyinvisibleandtheywillneverlearnthe

causeoftheriskortheactualharm.Whatwedoknowistheoverallqualityoftheserviceis

reducedbythisrequirementbecauseofthecostsitcreatesforconsumers.143Thevalueofthe

servicecouldevenbereducedtotheextentthattheserviceis,onbalance,detrimentaltothe

consumer.144

141SeeKörber,aboven8,3,9-10.142Körber,aboven8,10.143CfKatherineStrandburg,‘FreeFall:TheOnlineMarket’sConsumerPreferenceDisconnect’[2013]UniversityofChicagoLegalForum95,151(proposingtheanalogyof“obtainingfreemedicalcareinexchangeforparticipatinginatrialofanewmedicaltreatment”,consideringhowdifficultitisforuserstomeasurethedisutilityassociatedwiththetransaction).SeeGalandRubinfield,aboven16,fn65.144The“HealthEngine”appappearedtoprovideAustralianpatientswithasimplemeansofbookingappointmentswithmultiplehealthcareproviders,but,withoutpatients’knowledge,wasalsosellinginformationconcerningpatients’medicalconditionsandsymptomstolawfirmsthatintrusivelyandpersistentlypursuedpatientswithofferstorepresenttheminpersonalinjuriesclaims:PatMcGrath,ClareBlumerandJeremyStoryCarter,‘MedicalAppointmentBookingAppHealthEngineSharingClients’PersonalInformationwithLawyers’(ABCNewsOnline,26June2018).The“We-Vibe”“smart”vibratorcollected“extraordinarilyintimateandpersonal”usageinformationwithouttheknowledgeofitsusersandwasabletobeaccessedsothathackerscouldtakecontrolofthevibratorandactivateitremotely,accordingtoaclassactionbroughtagainstStandardInnovation:KimikodeFreytas-


31

Inasimilarway,weakprivacyprotectionscauseobjectivedetrimenttoconsumers.This

detrimentisnotamatterofpersonalpreference.Objectivelyspeaking,degradeddataprivacy

imposesfuturecostsonconsumers,145includingincreasedrisksofdatabreach,identitytheft,

hackingandfraud;exposureofsensitiveinformationtheconsumerwouldnotwishtodisclose

throughunanticipatedcollectionandtracking,and/orre-identificationofde-identified

information;andexposuretomanipulation-basedmarketing,profiling,segmentingorscoring

whichcanleadtodiscrimination,146exclusionordisadvantagemoregenerallyfortheconsumer.

Theexistenceofthesedetrimentsdoesnotmeanconsumersshouldnotdisclosetheirpersonal

information.Itdoesmean,intheantitrustcontext,thattermsrequiringthecollectionand

disclosureofpersonalinformationimposeobjectivecostsonconsumerswhichshouldbetaken

intoaccount,alongwiththebenefitsprovidedbytheserviceorplatforminquestion,when

assessingcompetitioninagivenmarket.

Concealeddatapracticesunderminethecompetitiveprocess

Thesepracticesdonotonlyimposecostsontheindividualconcerned.Theyalsounderminethe

competitiveprocesswhichcompetitionlawaimstoprotect.Thisweakeningofthecompetitive

processoccursbothintheinitialmarket–themarketinwhichthepersonalinformationis

collected–andinmarketswherethatpersonalinformationissubsequentlyusedcontraryto

thereasonableexpectationsoftheconsumer.

Tamura,‘Makerof“Smart”VibratorsSettlesDataCollectionLawsuitfor$3.75Million’(TheNewYorkTimes,14March2017).The“BrightestFlashlightFree”appappearedtoprovideafreeflashlightonmobilephones,withoutrevealingtousersthatitalsotransmitteddevicedata“includingprecisegeolocationalongwithpersistentdeviceidentifiers,tothirdparties,includingadvertisingnetworks”:GoldenShoresTechnologiesLLC(USFederalTradeCommission)<https://www.ftc.gov/sites/default/files/documents/cases/131205goldenshorescmpt.pdf>.145SeeAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,5;Acquisti,TaylorandWagman,‘TheEconomicsofPrivacy’,aboven14,483-484.146FederalTradeCommission,‘BigData:AToolforInclusionorExclusion?’(Report,January2016).


32

Raisingthequality-adjustedpriceandchillingcompetitiononprivacyquality

Decreasingprivacyquality/raisingthequality-adjustedprice

Intheinitialmarket,concealeddatapracticesbothreducethequalityoftheservicesto

consumersandstiflecompetitionbyrivalsonprivacyquality.

Thedegradationofconsumerdataprivacycanbeseenasareductioninthequalityofthe

service,or,toexpressitanotherway,anincreaseinthequality-adjustedpriceoftheservice.147

Theextenttowhichafirmcanretaincustomerswhiledegradingitscustomers’dataprivacy

withoutoffsettingbenefitsisonemeasureofmarketpower.148Whereadominantfirmimposes

weakprivacyprotectionsonconsumers(effectivelychargingahigherquality-adjustedprice),

thismaybeseenasexploitativeconduct:conductthattakesadvantageofthefirm’sdominant

positionandfreedomfromcompetitiveconstraintstothedetrimentofconsumers.149

IntheEuropeanUnion,suchexploitativeconductmaybecapturedbythelawagainstabuseof

dominanceunderArticle102oftheTreatyontheFunctioningoftheEuropeanUnionand

similarnationallaws.150Forexample,inGermany,theBundeskartellamtimposedfar-reaching

restrictionsonFacebook’sdatapracticesonthegroundthatFacebookhaduseditspositionof

dominance,andparticularlyitsindispensabilitytoconsumers,toimpose“exploitativebusiness

terms”onitsusers.TheseincludedtermspermittingFacebooktoaggregatepersonal

informationregardingitsusersacrossdifferentservicesownedbyFacebook(including

WhatsAppandInstagram)andtotrackusersacrossdifferentwebsitesandappsoutsidethe

147StiglerCenterDigitalPlatformsReport,aboven6,34.148HowardAShelanski,‘Information,Innovation,andCompetitionPolicyfortheInternet’(2013)161UniversityofPennsylvaniaLawReview1663,1689.149SeeShelanski,aboven148,1687,ontheexerciseofmarketpowerbyreductionsinquality.150SeeViktoriaHSERobertson,‘ExcessiveDataCollection:PrivacyConsiderationsandAbuseofDominanceinanEraofBigData’(WorkingPaper,June2019)9-11(arguingthatexcessivedatacollectionmightbeseenasanalogoustoexcessivepricingunderArt102TFEU);KatharineKemp,MisuseofMarketPower:RationaleandReform(CambridgeUniversityPress,2018)60(onexploitativeabuses).


33

Facebookplatforms,evenwhenusershad“blockedwebtrackingintheirbrowserordevice

settings”.151

Requirementforexclusionaryconduct

Inanumberofjurisdictions,however,purelyexploitativeconductdoesnotcontravene

unilateralanticompetitiveconductlaws.152Rather,adominantfirmwillonlycontraveneifit

engagesinexclusionaryconduct:thatis,conductwhichexcludesorsuppressesrivalryonthe

partofitscompetitorsorpotentialcompetitors.Thisisthecaseunderthelawagainst

monopolizationintheUnitedStatesandarguablyunderAustralia’smisuseofmarketpower

law.Inthesejurisdictions,thelawisnotconcernedwiththemerepossessionofadominant

positionorsubstantialmarketpower,butwithfirmspreservingorentrenchingthatsubstantial

marketpowerbymeansotherthansuperiorefficiency.153Ifrivalfirmsarefreetooutcompete

theincumbentwithasuperioroffer,themarketitselfwillproducethemostefficientoutcome.

Accordingtothisapproach,ifadominantfirmengagesinpurelyexploitativeconduct,other

firmswillbeattractedtothemarkettoofferalowerpriceorhigherqualityserviceto

consumers.Intheabsenceofexclusionaryconduct,themarketwillself-correct.154Someargue

thatthismarketcorrectionwilloccurinrespectoftheprivacyqualityofdigitalservicesif

consumersactuallyvalueprivacyquality.However,concealeddatapracticescombinewitha

numberoffeaturesofdigitalmarketstoexplainwhyitishighlyunlikelythatdigitalmarketswill

self-correcttoacompetitivelevelofprivacyquality.155

151Bundeskartellamt,Germany,‘BundeskartellamtprohibitsFacebookfromcombininguserdatafromdifferentsources:BackgroundinformationontheBundeskartellamt’sFacebookproceeding’(7February2019).152SeeKatharineKemp,MisuseofMarketPower:RationaleandReform(CambridgeUniversityPress,2018)60.153ExplainedfurtherinKatharineKemp,MisuseofMarketPower:RationaleandReform(CambridgeUniversityPress,2018)58,64.154Ibid52-55.155FurmanReport,aboven4,42-45,60;StuckeandGrunes,aboven45,52-57.


34

Barrierstoentryandcompetitiveadvantagesindigitalmarkets

Attheoutset,digitalmarketstendtoexhibitseveralfeatureswhichmakeitverydifficultfor

newrivalstochallengedominantincumbents.Digitalmarketsoftenhavehighbarrierstoentry

wheresuccessfulentryreliesonachievinglargescaletobenefitfromdirectnetworkeffects

(thatis,theserviceismorevaluabletousersifitcapturesalargenumberofotherusers),156

increasingreturnstoscale(theserviceproduceshigherreturnsperuserasthenumberofusers

increase)157andeconomiesofscope.158Networkeffectscanbesuchthat,beyondacertain

levelofpenetration,thesemarketsareproneto“tip”tooneplayerthatsucceedsincompeting

forthemarketasawhole.159Newentrymayalsobehinderedbytheeconomiesofscope

enjoyedbyincumbentsoperatingovermultiplemarkets.160Thesefeaturesofdigitalmarkets

cancontributetomarketdominance,andhelptoexplaintheincreasinglyenduringmarket

powerenjoyedbyfirmsinanumberofdigitalmarkets,includingonlinesearch(Google),social

media(Facebook),e-commerce(Amazon),digitaladvertising(GoogleandFacebook),and

mobileappdownloads(AppleandGoogle).161

Barrierstoentryandcompetitiveadvantagesincreasedbyconcealeddatapractices

Arivalattemptingtoofferaproductwithenhancedprivacyqualityinadigitalmarketislikelyto

facethesesubstantialbarrierstoentryattheoutset.Butwhereconcealeddatapracticesexist,

successfortheprivacy-enhancingrivalismuchlesslikely,bothduetothecompetitive

156StiglerCenterDigitalPlatformsReport,aboven6,15.SeealsoCrémer,DeMontjoyeandSchweitzer,aboven4,Chap2;FurmanReport,aboven4,32-38;Bundeskartellamt,aboven2,4.SeefurtherMichaelLKatzandCarlShapiro,‘NetworkExternalities,Competition,andCompatibility’(1985)75AmericanEconomicReview424.157StiglerCenterDigitalPlatformsReport,aboven6,13-14.158StuckeandEzrachi,‘DigitalAssistants’,aboven53,1289-1290.159Shelanski,aboven148,1682;StiglerCenterDigitalPlatformsReport,aboven6,6-9,12;Novell,IncvMicrosoftCorp,505F3d302,308(4thCir2007)(“oncedominanceisachieved,threatscomelargelyfromoutsidethedominatedmarket,becausethedegreeofdominanceofsuchamarkettendstobecomesoextreme”).160StiglerCenterDigitalPlatformsReport,aboven6,14.161FurmanReport,aboven4,31.


35

advantagesenjoyedbytheincumbentasaresultofweakdataprotectionsandtheconcealed

natureofdatapractices.

Importantly,suppliersinthesemarketsareoftenmultisidedplatforms:thatis,theservice

bringstogethertwoormoredistinctcommunitiesofusers,forexample,socialmediausersand

advertisers,shoppersandmerchants,oronlinesearchusersandadvertisers.162Multisided

platformsexhibitindirectnetworkeffects:one(ormore)categoryofusersvaluestheservice

morehighly(andwillthereforepayhigherpricestousetheplatform)themoremembersof

anothercategoryofusersmakeuseoftheplatform.163Advertisersvalueanonlinesearch

enginemorehighly,forexample,themoreconsumersusethatsearchengine.164

Consumers’personaldataplaysacriticalroleinthesemultisidedplatformsandthe

preservationofanincumbent’sdominantposition.165Forexample,asocialmediaplatformhas

anincentiveharvestincreasinglybroadanddeeppersonaldataonitsusers.166Thiswillcause

theplatform’sadvertisingcustomerstovaluetheplatformmorehighlyandpayhigher

advertisingfeestobenefitfromhighlydetailedprofilingandsegmentingoftheplatform’susers

aswellastheusers’attentiontotheiradvertising.167Thesocialmediaplatformmaythenuse

162SeeJean-CharlesRochetandJeanTirole,‘PlatformCompetitioninTwo-SidedMarkets’(2003)4JournaloftheEuropeanEconomicAssociation1;JeanTirole,EconomicsfortheCommonGood(PrincetonUniversityPress,2017)378-385;‘CommonUnderstandingofG7CompetitionAuthoritieson“CompetitionandtheDigitalEconomy”’(July2019)5.163SeeBundeskartellamt,aboven2,4-5;UnitedStatesvMicrosoft,253F3d34,55(DCCir2001).164WhittingtonandHoofnagle,‘UnpackingPrivacy’sPrice’,aboven13,1353-1354.Commentatorspointoutthatthedynamicsofmultisidedsidedplatformshaveaparticulareffectonoptimalpricingondifferentsidesoftheplatform.Eg,advertisersmaybewillingtopayadvertisingfeeswellabovethecompetitivelevelinreturnforaccesstomoresearchengineusersandtheirdata,whilethatadvertisingrevenuesubsidisestheprovisionofservicesonthesearchengineusersideoftheplatformatzeromonetaryprice.SeeDavidSEvansandRichardSchmalensee,‘Matchmakers:TheNewEconomicsofMultisidedPlatforms’(HarvardBusinessReviewPress,2016)93-100.165StiglerCenterDigitalPlatformsReport,aboven6,16.166SeePart2above.StuckeandEzrachi,‘DigitalAssistants’,aboven53,1288(“Thesuperplatformsalreadypossessfarmorepersonaldatathananystartupcouldreadilyandaffordablyobtain.”).167CfManneandSperry,aboven8,5-6(arguingthereis“noobviousreasonwhymonopolistswouldhaveanincentivetodegradeprivacy”).SeeexplanationofindirectnetworkeffectsinBundeskartellamt,aboven2,4-5.


36

theincreasedadvertisingrevenue,the‘learningbydoing’effectsofaccesstoahugevariety

anddepthofpersonaldata,168anditsownin-depthknowledgeofitsusers’personaltraits,

interestsandbiasestomaketheplatformmoreattractive,andtieitsuserstoitsservice.169This

resultsinmoreconsumersusingtheservice.Ifthesocialmediaplatformcontinuestoadopt

concealeddatapracticesinrespectofthisincreasingnumberofconsumers,ithasevengreater

breadthanddepthofpersonaldatawithwhichtoattractadvertisingrevenueandinformation

aboutcustomerstoincreasetheattractivenessandstickinessofitsplatform,170without

deterringconsumersfromusingtheplatformonthebasisofitsdatapractices,andsothecycle

continues.

Intheprocess,userssufferobjectivecostsanddetrimentsasaresultoftheconcealeddata

practices,whichmakeconsumersmoresusceptibletocriminalactivity,discrimination,

exclusion,manipulationandhumiliation.Inthisway,concealeddatapracticescanaidin

creatingorextendingmarketpower,bymeansotherthansuperiorefficiency.171

Concealeddatapracticeshinderprivacy-enhancingrivals.Consumerscannotplaceavalueon

theimprovedprivacyqualityofferedbyarivalwhentheycannotmakeanyrealcomparison

betweentheprivacytermsandpracticesoftheincumbentanditsrivals.Further,takinginto

accountotherfeaturesoftheincumbentservice,therivalwouldhavetoofferconsumersan

apparentlylowerquality,orhigherpriced,servicesincetherivalcouldnotpayforother

168StuckeandGrunes,aboven45,170-181;StuckeandEzrachi,‘DigitalAssistants’,aboven53,1249-1251,1286-1287.169StuckeandEzrachi,‘DigitalAssistants’,aboven53,1251-1254.170SeeStuckeandEzrachi,‘DigitalAssistants’,aboven53,1255-1266.SeealsoShelanski,aboven148,1678-1682(oncustomerdataasaninputofproduction,asastrategicassetwhichcanhelptoentrenchmarketpower,andasacommoditywhichprovidesavaluablerevenuestream).171StiglerCenterDigitalPlatformsReport,aboven6,12-13,60.SeealsoFurmanReport,aboven4,59(explainingtheconceptofplatformswith“strategicmarketstatus”orenduringpoweroverastrategicmarketbottleneck:“Platformsthatachievedominancecanholdahighdegreeofpoweroverhowtheirusersaccessthemarket,andeachother.Thisdominancecanresultinharmtoconsumersdirectly,withclearevidenceofissuesrelatingtoquality,suchaswiththerankingofsearchresults,anddataprivacy.”);StuckeandEzrachi,‘DigitalAssistants’,aboven53,1243(raisingthepossibilitythatdigitalassistants’“criticalgatekeeperpositioninamulti-sidedmarket”mightreduceconsumerwelfare,increasemarketpowerandlimitcompetition).


37

attractionswithadvertisingrevenuegainedbymonetisingconsumers’personalinformation.172

Consumerswillnotpaymoretoavoidacostwhichcannotbeassessed.173Privacy-enhancing

rivalsarethereforeimpededintheirabilitytocompeteonprivacyqualitybecausethenature

andextentofthedetrimentcausedbytheirrivals’privacy-degradingpracticesishidden.174

Intheabsenceofthiscompetitivepressurefromrivals,dominantfirmsmayimposeexploitative

privacytermsonconsumers.175Thedatadynamicsofonlinemarketsmayinfactspura“raceto

thebottom”inprivacyqualityasprivacy-enhancingcompetitionisnotrewarded,whileall

suppliersareincentivisedtodegradeconsumerdataprivacyintheinterestsofincreased

advertisingrevenueandothermeansofmonetisingconsumerdata.176Thecentralproblemis

notthatconsumersfailtoreadprivacypolicies,butthatconcealeddatapracticescurrently

preventthisfrombeinganeffectivemeansofcomparingtheprivacyqualityofferedby

differentsuppliers.

172SeeEvans,‘AttentionPlatforms’,aboven7,20-21(onsuppliers’reducedabilitytoinvestintheproductintheabsenceofgreateraccesstoconsumerdataandthereforeadvertisingrevenue).173StiglerCenterDigitalPlatformsReport,aboven6,21,45(“Whenfacingazero-moneyprice,andwhenqualityisdifficulttoobserve,consumersarenotreceivingsalientsignalsaboutthesocialvalueoftheirconsumptionbecausethepricetheybelievetheyfacedoesnotreflecttheeconomicsofthetransaction,andtheyareignorantofthosenumbers.”).174SeeShelanski,aboven148,1690(onthefactthatdatapracticesarenotgenerallyobservableforconsumers).175StiglerCenterDigitalPlatformsReport,aboven6,21,emphasisinoriginal(“Surmountingtheexistingbarrierstoentrycreatedbyconsumerbehavior,coststructure,publicpolicy,andanypastanticompetitiveconductisextremelydifficult.Thisfacthasdirecteffectsonconsumers:withoutentryorthecrediblethreatofentry,digitalplatformsneednotworkhardtoserveconsumersbecausetheydonotrisklosingtheirconsumerstoarival.”).176SeeStuckeandGrunes,aboven45,56;ACCC,‘DigitalPlatformsInquiry:PreliminaryReport’(December2018)217-218(ondecreasedcompetitiononprivacyqualityasrivalscompetebyadoptingmoreinvasivedatapractices);ACCCDigitalPlatformsReport,aboven3,423-424;Shelanski,aboven148,1690(onthepotentiallackofincentivesfor“comparativelypro-consumer[privacy]policies”).SeealsoBruceSchneier,DataandGoliath(Norton,2015)242-243(ontheneedforincentivestocreatenewbusinessmodelsthatdonotdependonconsumersurveillance).


38

“[A]few“gatekeeper”firmsareinapositiontocontrolthetrackingandlinkingofthose

behaviorsacrossplatforms,onlineservices,andsites—forbillionsofusers.Asaresult,

chroniclesofpeoples’actions,desires,interests,andmereintentionsarecollectedbythird

parties,oftenwithoutindividuals’knowledgeorexplicitconsent,withascope,breadth,and

detailthatarearguablywithoutprecedentinhumanhistory.”AlessandroAcquisti,CurtisTaylor

andLiadWagman,‘TheEconomicsofPrivacy’(2016)54JournalofEconomicLiterature442,

444.

Increasinginequalityofbargainingpowerandinformationasymmetriesinothermarkets

Concealeddatapracticesmakeconsumersincreasinglytransparentwhileobscuringan

increasinglyopaqueuniverseofsuppliers.177Inthisway,concealeddatapractices

alsocauseharmtothecompetitiveprocessbyunderminingthevitalroleplayedbyconsumers,

bothintheinitialmarketwheretheinformationiscollectedandinmarketsforotherproducts

(indimensionsotherthanprivacyquality)wherethepersonalinformationissubsequentlyused

contrarytothereasonableexpectationsoftheconsumer.Aconsumer’spersonalinformation

maybeusedbysuppliersinanumberofmarkets,whotakeadvantageoftheseinformation

asymmetriestofocusonconsumermanipulation178attheexpenseofcompetitiononthe

merits.

Effectivecompetitioniscompetitionwhichdrivessuperiorefficiencyandinnovationandis

responsivetoconsumers.Effectivecompetitiondependsonconsumershavingaccessto

accurateinformationandtheabilitytobargainfor,andswitchto,abetterdeal.Concealeddata

practicessubstantiallyreduceconsumers’bargainingpowerbyincreasinginformation

asymmetriesbetweensuppliersandconsumersinthebargainingprocess,179andallowing

177SeefurtherAcquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,17.178Seethedefinitionof“onlinemanipulation”bySusser,RoesslerandNissenbaum,aboven123.179Concealeddatapracticesalsoimposeimmediatecostonconsumershavingregardtothetimerequiredtoattempttointerpretvagueandlengthyprivacytermsandtheirconsequences,andthedifficultyandcomplexityof


39

supplierstoengageinmanipulation-basedmarketinginawaytraditionaladvertisingdoesnot

permit.180Thisweakensthecompetitiveprocessbyreducingthelikelihoodthatwellinformed,

empoweredconsumerswillselectthemostefficientsuppliers;thosethatbestmeettheneeds

andwantsofconsumersinrespectoftherelevantproduct.

Inshort,wherethecollectedinformationisusedbysuppliersagainsttheconsumerin

subsequenttransactions,thesuppliermayfocusonaggregatingpersonalinformationaboutthe

individualconsumerandmanipulatingtheindividualpurchasingenvironmentinaneffortto

extractmaximumconsumersurplusandcreateobstaclestocomparisonandswitching,rather

thanpresentingthebestvaluepropositiontotheconsumer.181

“[T]heplatform’sdetailed,personalized,minute-by-minutecontrolovertheirinterface…

enablesplatformstocreateafaçadeofcompetition,choice,andautonomywheninfactusers

arebeingdirectedwithbehavioraltechniques.”StiglerCenterDigitalPlatformsReport,above

n6,37.

5. Thesignificanceofconcealeddatapracticesforcompetitionauthorities

Concealeddatapracticesthereforecreateobjectivecostsanddetrimentsforconsumers,and

underminethecompetitiveprocess,includingbychillingprivacy-enhancingcompetition.This

weakeningofcompetitionmaynotamounttoacontraventionofantitrustlegislationinitself.

However,theeffectofconcealeddatapracticesonthecompetitiveprocessshouldbetaken

exercisingcontrolovertheirprivacy.SeeGillianKHadfield,RobertHowseandMichaelJTrebilcock,‘Information-BasedPrinciplesforRethinkingConsumerProtectionPolicy’(1998)21JournalofConsumerPolicy131,141,144-146,152;Acquisti,‘TheEconomicsofPersonalDataandPrivacy’,aboven7,18.180SeeStiglerCenterDigitalPlatformsReport,aboven6,22-23,35-36.181“Aplatformcananalyzeauser’sdatainrealtimetodeterminewhensheisinanemotional“hotstate”andthenoffertargetedsales”:StiglerCenterDigitalPlatformsReport,aboven6,7,36-37.SeealsoSusser,RoesslerandNissenbaum,aboven5.


40

intoaccountbycompetitionregulatorsinthefollowingrespects.

First,whereconcealeddatapracticesarepresent,itshouldnotbeassumedthatconsumers

havedemonstratedapreferenceforthedataprivacytermsonwhichtherelevantproductsare

provided.182Itisnotappropriatetorelyon“revealedpreferences”aboutprivacytermswhere

consumershavegrosslyinadequateinformationaboutthetermsofferedandtheir

consequences,andoftennorealchoiceinprivacyterms.183

Aconsumer’ssupposedacceptanceofprivacytermsinthepresenceofconcealeddata

practiceshasseveralfeatureswhichmakeitunlikelythatthisacceptancerepresentsthe

consumer’strueinterests,or“normativepreference”.Thesefeaturesincludethefactthatthe

choiceispassive(intheformofimpliedconsentordefaultsettings);thecomplexityofthe

decisionanditseffects;limitedpersonalexperienceoftheconsequencesofthischoice(data

practicesandtheirconsequencesaregenerallynotrevealed);andthird-partymarketingofthe

choiceinquestion(particularlywhereprivacypoliciesareframedtomanipulateconsumersto

accedetoprivacyintrusivepractices).184

Itisalsoinappropriatetodiscountexpressedconsumerpreferencesbyreferencetothe

“privacyparadox”.185Thedifferencebetweenconsumers’explicitconcernsandtheirsupposed

acceptanceofprivacy-intrusivetermsmaybereadilyexplainedbythemanipulativeand/or

coerciveeffectsofconcealeddatapractices,aswellastheirtendencytohinderprivacy-

enhancingcompetition.

182CfProductivityCommission,AustralianGovernment,‘DataAvailabilityandUse’(InquiryReportNo82,31March2017)91(arguinginthecaseof“largesocialmediaproviders”,“largefirmswilltendtoself-regulate…accordingtoprevailingpublicattitudes”).183SeeStiglerCenterDigitalPlatformsReport,aboven6,45.CfManneandSperry,aboven8,5-6.SeeJohnBeshears,JamesJChoi,DavidLaibsonandBrigitteCMadrian,‘HowArePreferencesRevealed?’(2008)92JournalofPublicEconomics1787(“Economistsusuallyassumethattheserevealedpreferencesarealsonormativepreferences–preferencesthatrepresenttheeconomicactor’strueinterests.”).184Beshearsetal,aboven183,1788-1789.185Seefn136above.


41

Second,diminishedcompetitiononprivacyqualityasaresultofconcealeddatapractices

shouldbetakenintoaccountinanyassessmentofthestateofcompetition,andmarket

power,186intherelevantmarket.Inmarketswhereservicesareofferedatzeromonetaryprice,

itisvitaltoconsiderotheraspectsofcompetitionincludinginnovationandthequalityof

servicesprovidedinanycompetitionassessment.187

Commentatorshavearguedinfavourofcompetitionauthoritiestakingintoaccountthe

benefitsconsumersgainfromzero-pricedservices–thepositiveimpactsofcompetitionon

innovationandquality.188Competitionauthoritiesshouldequallytakeintoaccountthe

negativeimpactsonqualitycompetition,whichcriticallyincludesthequalityofprivacyterms

offeredandprivacy-enhancinginnovation.189

Thesedetrimentsshouldnotbeoverlookedonthebasisthattheycannotbeprecisely

quantifiedindollarterms.190“[T]helackofexplicitpricesdoesnotmeantheharmsareanyless

real.”191Inthecontextofmarketswithzeromonetaryprices,consumerbenefitsarenot

186StuckeandEzrachi,‘DigitalAssistants’,aboven53,1294(“Competitionofficialsoftenadoptaprice-centricapproachtoassessmarketpower,namelywhetherthefirmcanchargesupracompetitiveprices.Rarelydotheyassessmarketpowerprimarilyintheformofnon-priceeffectssuchasquality.”).187FurmanReport,aboven4,42-45;EuropeanCommission,‘Mergers:CommissionApprovesAcquisitionofLinkedlnbyMicrosoft,SubjecttoConditions’(PressRelease,6December2016)<https://europa.eu/rapid/press-release_IP-16-4284_en.htm>(“Privacyrelatedconcerns…canbetakenintoaccountinthecompetitionassessmenttotheextentthatconsumersseeitasasignificantfactorofquality,andthemergingpartiescompetewitheachotheronthisfactor.”);DissentingStatementofCommissionerPamelaJonesHarbour,IntheMatterofGoogle/DoubleClick,FTCFileNo071-0170.188See,eg,Evans,‘AttentionPlatforms’,aboven7.189StuckeandEzrachi,‘DigitalAssistants’,aboven53,1284-1285,1293(“Interventionswillhavetobalancethebenefitswhichflowfromadvancedtechnologyandartificialintelligenceagainstthewelfarerisks…”).190SeePamelaJonesHarbourandTaraIsaKoslov,‘Section2inaWeb2.0World:AnExpandedVisionofRelevantProductMarkets’(2010)76AntitrustLawJournal769,792-793(arguingthat“[i]twouldbeentirelyinappropriatetoignoreconsumers’concernsaboutprivacy-basedcompetition,simplybecauseproductmarketdefinitionmightprovedifficult”).191BenjaminEdelmanandDamienGeradin,‘AnIntroductiontotheCompetitionLawandEconomicsof“Free”’(2018)CompetitionPolicyInternationalAntitrustChronicle1,10.


42

generallyquantifiableeither.192Butcompetitionauthoritiesshouldtakebothintoaccount,and

considertheproportionalityofanyplausibledetrimentsagainsttheplausiblebenefits.193

Inthisrespect,competitionauthoritieswillneedtofurtherdevelopandbecomemorefamiliar

withanalyticaltoolswhichcantakeaccountofimpactsonquality,particularlywherepriceis

notthekeyindicatorofthehealthofcompetition.194

Third,wherethereislimitedcompetitiononprivacyqualityinamarketasaresultofconcealed

datapractices,afurtherrestrictiononprivacycompetitionmaymorereadilyamounttoa

substantiallesseningofcompetition(SLC).195VariousprovisionsofPartIVoftheCompetition

andConsumerAct2010(Cth)maybeinfringedwhereconductoranacquisitionhastheeffect

orlikelyeffectofSLC.196Allegedcontraventionsoftheseprovisionsmaybebasedonreduced

competitiononprivacyquality.Forexample,ifadominantfirmengagesinconductwhich

excludesprivacy-enhancingappsfromitsplatform,thismaygiverisetoaclaimofmisuseof

marketpowerundersection46(1).197Whereafirmwithmarketpoweracquiresanewrivalthat

hasbeeninnovatingonprivacyqualityorarivalthatofferssuperiorprivacyquality,theremay

beaclaimthatthemergerresultsinSLCundersection50.198

192CfEvans,‘AttentionPlatforms’,aboven7(arguingforanestimateofthevalueofcontentonattentionplatformsbasedontheopportunitycostsofthetimeusersspendinfrontofthatad-supportedcontent).193CfManneandSperry,aboven8,3,(arguingthat“[a]non-priceeffectsanalysisinvolvingproductqualityacrossmultipledimensionsbecomesexceedinglydifficultifthereisatradeoffinconsumerwelfarebetweenthedimensions.…Anysuchanalysiswouldnecessarilyinvolveacomplexandimprecisecomparisonoftherelativemagnitudesofharm/benefittoconsumerswhopreferonetypeofqualitytoanother.”).194See‘CommonUnderstandingofG7CompetitionAuthoritieson“CompetitionandtheDigitalEconomy”’(July2019)4;StiglerCenterDigitalPlatformsReport,aboven6,8,45,66-67.SeealsoFurmanReport,aboven4,42-45.Onthedifficultyofassessingthecounterfactualinsuchscenarios,seeStuckeandEzrachi,‘DigitalAssistants’,aboven53,1296.195SeeHarbourandKoslov,aboven190,794-795(arguingthat,inunilateralconductinvestigations,thecompetitionauthorityshouldconsiderwhetherachievingadominantmarketpositionmightreducethefirm’sincentivestocompeteonprivacydimensionsortoinnovateonnewprivacy-protectivetechnologies).196See,eg,CompetitionandConsumerAct2010(Cth),ss45(1),46(1),47(10),50.197SeeStuckeandEzrachi,‘DigitalAssistants’,aboven53,1256-1263(onthegatekeeperroledigitalassistantsperforminrespectofupstreamservices).Ordowngradinginteroperability:StuckeandEzrachi,‘DigitalAssistants’,aboven53,1295.198MikeIsaac,ZuckerbergPlanstoIntegrateWhatsApp,InstagramandFacebookMessenger,(NewYorkTimes,25


43

Theexistenceofconcealeddatapracticesonthepartoffirmswithmarketpowerinthese

scenarioswouldindicatethatthereisalreadyweakenedcompetitiononprivacyquality.A

furtherreductioninthisprivacycompetitionshouldbetreatedasmoresubstantialinthe

presenceofexistingconcealeddatapracticesthanthesameconductinamarketwherethereis

healthycompetitiononprivacyquality.199

Fourth,investigationsofconductwhichisallegedtosuppressprivacycompetitionmayhavethe

beneficialsideeffectthatthecompetitionregulatoractsessentiallyasanexpertintermediary,

interpretingthestateofprivacycompetitionforthebenefitofconsumers.

OhlhausenandOkuliarhavearguedthatantitrustlawsandantitrustregulatorsarenotwell-

adaptedtoaddressingprivacyconcerns.200Thepointsoutlinedaboveindicateseveralways

competitionregulatorscansensiblytakeaccountofprivacyissuesincompetitionlaw

assessments.Further,Ben-ShaharandSchneiderhaveexplainedthat,whereconsumershave

littleprospectofinterpretingspecialistinformation,andparticularlythatwhichisrevealedasa

resultofmandateddisclosure,expertintermediariesmaybenecessarytointerpretthe

January2019)<https://www.nytimes.com/2019/01/25/technology/facebook-instagram-whatsapp-messenger.html>.SeeRobertHLande,‘TheMicrosoft-YahooMerger:Yes,PrivacyIsanAntitrustConcern’,FTC:Watch(25February2008)1(“Antitrustisactuallyaboutconsumerchoice,andpriceisonlyonetypeofchoice.Theultimatepurposeoftheantitrustlawsistohelpensurethatthefreemarketwillbringtoconsumerseverythingtheywantfromcompetition.Thisstartswithcompetitiveprices,ofcourse,butconsumersalsowantanoptimallevelofvariety,innovation,quality,andotherformsofnonpricecompetition.Includingprivacyprotection.”).SeefurtherArgentesietal,Lear,‘Ex-postAssessmentofMergerControlDecisionsinDigitalMarkets:FinalReport’(ReportbyLearforUKCompetitionandMarketsAuthority,9May2019)(providingcasereviewsofUKmergerdecisionsindigitalmarketsandconsideringwhethertoomuchweighthasbeenputontheriskofincorrectinterventioncomparedtotheriskofincorrectclearance).199SeefurtherCrémer,DeMontjoyeandSchweitzer,aboven4,51(“[I]nthecontextofhighlyconcentratedmarketscharacterisedbystrongnetworkeffectsandsubsequentlyhighbarrierstoentry(asettingwhereimpedimentstoentrywhichwillnotbeeasilycorrectedbymarkets),onemaywanttoerronthesideofdisallowingtypesofconductthatarepotentiallyanti-competitive,andtoimposetheburdenofproofforshowingpro-competitivenessontheincumbent.Thismaybeevenmoretruewhereplatformsdisplayatendencytoexpandtheirdominantpositionsinevermoreneighbouringmarkets,growingintodigitalecosystemswhichbecomeevermoredifficultforuserstoleave.”).200SeeMaureenKOhlhausenandAlexanderPOkuliar,‘Competition,ConsumerProtection,andtheRight[Approach]toPrivacy’(2015)80AntitrustLawJournal121.


44

availableinformationandempowerconsumersintheirdecision-making.201

Incertaincircumstances,competitionregulatorsmayactasoneformoflearnedintermediary,

whereconsumersareseverelydisadvantagedintheirabilitytointerpretthequalityofprivacy

termsandtheirconsequencesasaresultofconcealeddatapractices.Legitimatecomplaints

underPartIVoftheCompetitionandConsumerAct,forexample,provideanopportunityfor

theACCCtouseitsresourcesandinformationgatheringpowerstointerpretthestateof

competitiononprivacyquality,improvetransparencyandinterveneintheinterestsof

competitionwherenecessary.

Conclusion

Data-drivenbusinessesarealteringthefrontiersofinfluence,bytheirubiquity,scaleand

subtlety.Inaworldofdigitalassistants,pervasivesocialmedia,wearabledevicesandlocation-

basedmarketing,thisinfluencenowstretchestoourhomes,ourfamilies,ourbodiesandour

movements.Inevitably,increasedsurveillanceandmanipulationofconsumersforcommercial

purposesraisesissuesforconsumerprotectionandprivacyregulation.Theconcealeddata

practicesdescribedinthispaperalsocauseobjectivedetrimenttoconsumersandundermine

thecompetitiveprocessonprivacyqualityandbeyond.Competitionauthoritiesshouldhave

regardtotheseconcealeddatapracticesinrejectingclaimsof“revealedpreferences”;

assessingthequalityofcompetitiononprivacy,inzero-priceddigitalmarketsinparticular;and

assessingthesignificanceofanylesseningofcompetitionbytheexclusionorabsorptionof

privacy-enhancingrivals.Theseconsiderationsfallsquarelywithintheestablishedobjectivesof

competitionlaw,inprotectingthecompetitiveprocessintheinterestsofconsumerwelfare.

201OmriBen-ShaharandCarlESchneider,MoreThanYouWantedtoKnow:TheFailureofMandatedDisclosure(PrincetonUniversityPress)3-5,185-190.SeealsoGillianKHadfield,RobertHowseandMichaelJTrebilcock,‘Information-BasedPrinciplesforRethinkingConsumerProtectionPolicy’(1998)21JournalofConsumerPolicy,131,159.


CONCEALED DATA PRACTICES AND COMPETITION LAW: WHY … Kemp.pdf · Algorithms that Control Money and...

Documents

Transcript of CONCEALED DATA PRACTICES AND COMPETITION LAW: WHY … Kemp.pdf · Algorithms that Control Money and...