Politech mailing list archives
FC: Robert Gellman replies to privacy study critics, more responses
From: Declan McCullagh <declan () well com>
Date: Fri, 29 Mar 2002 00:05:01 -0500
[Robert's initial response was: "Thanks for the offer for a debate. I don't know that a point-counterpoint in e-mail fashion would be particularly enlightening." I'm glad he changed his mind! :) I've combined multiple threads into one for this message. --Declan]
--- Date: Thu, 28 Mar 2002 10:07:17 -0500 From: Robert Gellman <rgellman () cais com> To: Declan McCullagh <declan () well com> CC: wfason () houston rr com Subject: Re: Texas private investigator replies to Robert Gellman on privacy Declan's report of my unwillingness to participate in the discussion here was premature. I am reluctant, but I will respond to Bill Fason's comment on ID Theft. The report says "Identity theft occurs for many reasons, and the routine trafficking in personal information is a significant contributing cause." The report offers no recommendations for regulation or legislation. I don't understand his defense of ChoicePoint and other companies. They are not mentioned in the report. My report cites several independent studies, including one from a private organization operated by a major information company, as stating that Internet accessibility of personal information has contributed to ID Theft. Mr. Fason asserts that "ChoicePoint's online system has been used in zero cases of identity fraud". I would like to know the basis for this statement. Unless there is some independent audit of ChoicePoint, its employees, and its customers, I am not prepared to accept that conclusion. I don't mean to single out ChoicePoint here. Mr. Fason named the company, not me. Most cases of ID theft go uninvestigated so we simply do not know all of the causes or sources of data. There are hundreds of thousands of cases of ID theft annually. To suggest that readily available, online sources of personal information are not a contributing factor in ANY of these cases is not a conclusion that I can reach without evidence. I hear often from information companies that their records are never abused, but when I ask if the company actually looked for evidence, the answer is invariably no. I have never heard of a database that was never misused by by the company (or agency) that runs it or by its customers. Bob + + + + + + + + + + + + + + + + + + + + + + + + Robert Gellman <rgellman () cais com> + + Privacy and Information Policy Consultant + + 419 Fifth Street SE + + Washington, DC 20003 + + 202-543-7923 (phone) 202-547-8287 (fax) + + + + + + + + + + + + + + + + + + + + + + + + --- From: "Singleton, Norman" <Norman.Singleton () mail house gov> To: declan () well com Subject: RE: Free-market economist replies to Robert Gellman privacy paper Date: Thu, 28 Mar 2002 09:52:35 -0500 There are many postal companies (e.g. "Mailboxes Etc.") that will give you a valid looking mailing address that is the same as a post office box.actually, thanks to the Post Office, the privacy value of getting a box from an organization like Mailboxes etc. has been significantly diminished.
Norman Kirk Singleton
Legislative Director
Congressman Ron Paul
US House of Representatives
---
Date: Thu, 28 Mar 2002 09:05:03 -0800
From: lizard <lizard () mrlizard com>
To: declan () well com
CC: politech () politechbot com, gellman-comments () robertgraham com,
rgellman () cais com
Subject: Re: FC: Free-market economist replies to Robert Gellman privacy paper
My own comment on this, several years old, focusing mostly on shopping
cards, as it turns out...
http://www.mrlizard.com/privacy.html --- Date: Thu, 28 Mar 2002 09:25:00 -0500 To: Declan McCullagh <declan () well com> From: Jason Young <jyoung () lexinformatica org> Subject: Harper's view is antiquated Declan,I've worked for the Privacy Commissioners' of Ontario and British Columbia and for Zero-Knowledge Systems have two comments on Mr. Harper's post.
First, since when does having a web site privacy policy equate with consumer empowerment? As anyone who has ever looked at a web site privacy policy knows, most are unintelligible and ambiguously-worded monstrosities written by lawyers who have no interest in consumer privacy. I say this as a law student and a privacy nerd, who actually likes to read these things.
Here are some prominent examples:Amazon's ambiguously-named "Privacy Notice" http://www.amazon.com/exec/obidos/tg/browse/-/468496/103-0217583-3071062 MSN's 5000 word statement on information collection http://privacy.msn.ca/default.asp contrast with MS Canada's easy-to-digest and more strongly-worded "Privacy Policy" http://www.microsoft.com/info/can-en/privacy.htm Yahoo!'s equally vague statement on information collection http://privacy.yahoo.com/privacy/us/ contrast with Yahoo! Canada's much more limited http://privacy.yahoo.com/privacy/ca
Second, the paradigm is not "business vs. consumers" it is "strong privacy = good business". Don't take my word for it. Ask DoubleClick, Disney, RealNetworks, Microsoft, Lotus and Polk, to name only a few businesses that have been subjected to litigation, public and government scrutiny and, in some cases, have seen entire markets vanish in smoke, because they didn't understand the equation.
Best regards, Jason Young --- From: "japgray" <japgray () msn com> To: "Declan McCullagh" <declan () well com> Cc: "Robert Gellman" <rgellman () cais com> Subject: Comment on "Privacy, Consumers and Costs" Date: Thu, 28 Mar 2002 16:22:25 -0500While Bob Gellman's paper is interesting and controversial, he is hardly an unbiased party. Thus, the data and the conclusions of his study are suspect. For example, he underestimates the significant indirect costs to consumers of government enforcement of privacy regulations, business compliance with current and future privacy laws, and litigation costs. All these costs are eventually passed on to consumers by businesses in the form of higher prices, and by governments in the form of higher taxes. To be credible, a fair, unbiased perspective would consider both direct and indirect costs, and weigh such costs against the benefits to society. Unfortunately, this study does not achieve that objective.
--- Date: Thu, 28 Mar 2002 12:29:46 -0800 From: David Brownell <david-b () pacbell net> Subject: Re: Free-market economist replies to Robert Gellman privacy paper To: declan () well com, politech () politechbot com Cc: gellman-comments () robertgraham com, rgellman () cais com > Governments have guns, businesses don't. However, Gellman believes > that businesses have voodoo powers to coerce the population that > are just as powerful as guns. Seems quite evident to me that businesses do have such powers -- which have nothing to do with voodo. In the same way that "brandishing" a gun can achieve coercion without actually needing to kill, so can threats to curtail other aspects of quality-of-life also coerce. Higher prices are exactly such threats/coercions. > The way that "narrow-minded" free-market economists measure > "social consequences" is to put a dollar value on them. The reason > is that every consumer values such consequences differently; you > can't apply a single value for everyone. And the fundamental fallacy of such economists is to assume that dollar values can be placed on everything. You might as well ask how much the social consequences weigh, since you won't get a meaningful answer that way either. > I'm not so much trying to refute Gellman directly so much as > point out that there is nothing to refute. His conclusions are > drawn from his premises; but since he draws his premises from > his conclusions, he has a circular argument. For example, by premising that everything can (and should) be monetized, one is led to the inescapable conclusion (surprise!!) that market analyses apply ... which start by monetizing things. - Dave --- From: "Tony Dye" <tony () bluetree ie> To: <declan () well com> Cc: <gellman-comments () robertgraham com> Subject: RE: Free-market economist replies to Robert Gellman privacy paper Date: Thu, 28 Mar 2002 16:38:47 -0000 Message-ID: <BOEKKKDKGDHMJNHIAAMBKEBHCBAA.tony () bluetree ie> Declan, you are, as always, welcome to repost this if you wish... --- From: myself () robertgraham com Date: Wed, 27 Mar 2002 21:54:40 -0500 (EST) To: Declan McCullagh <declan () well com> Subject: FC: No broad U.S. privacy laws costs "tens of billions," study says [snip] "Coercion" is a strong, value-laden word. Frequent shopper cards are a straightforward business proposition. Due to advanced technology, it costs less to service customers that reveal private information, cost savings that can be passed along to consumers. Gellman asserts, with no proof, that if frequent shopper cards were outlawed, then all customers would get the same low prices. Free-market economists assert the opposite, that all customers would get the same high prices. Gellman concludes: "The higher prices paid by those who reject frequent shopper cards represent a direct financial sacrifice for privacy." A free-market economist might conclude: "The lower prices paid by those who use frequent shopper cards represent a direct financial benefit for disclosing private information." ********** The reality, of course, is that neither of these things are actually true. Let's flog the 'Frequent-Shopper Card' idea a bit further: In Texas (well, in central TX at least... I can't speak for the rest of the state) there are two major grocery chains: H.E.B. and Randall's. Randall's offers a customer card, and the deals you get are significant if you use it. The proposed free-market economist and Gellman both oversimplify this example though; the actual fact is that Randall's artificially inflates the prices on 'Customer Card Discount' items AND other items in their stores. I assume they do this to recover the cost of discounting some items and to make an overall profit from your info, rather than trading you for the real value of the data. If you elect not to sell Randall's your personal info, it is difficult to find a price for any item that is lower than the same item at the H.E.B. across the street. H.E.B. does not offer a customer card, and their prices are generally lower than Randall's on any given item, but rarely lower or even the same as the 'customer card discount' price at Randall's. So, what to make of that? Well, if you live in Austin, you get to choose between a medium-low price on everything and no privacy issues, or artifically high/low prices with a privacy tradeoff and a chance to save quite a bit of cash, assuming you buy the right things at the right time. If you live in East Podunk, where they only have a Randall's, you might have a problem if you like to protect your privacy. IMHO, given the right circumstances, both circular arguments can be equally true. In the real world, neither Gellman nor the free-market economist is particularly accurate with respect to coercion. Sometimes you get a benefit from exchanging your info ($20 off at Amazon.com for consenting to receive targeted spam about your hobbies) and sometimes you get screwed because the industry can coerce you into giving it to them (car insurance companies requiring a credit check for a policy, with no promise to keep the info private and an extra penalty if you have a bad rating). Neither Gellman nor the free-market economist have a realistic philosophy for creating a remedy, either. Privacy should be protected by law in some cases (regulating 3rd party sharing, ambiguous, open-ended 'business partner' clauses in loan applications, and requiring opt-in for some info) but in others, individuals and the market should determine the value of personal information. I know that Mr. Graham's comments are in part an argument to the absurd, but it's counterproductive for him to claim that privacy issues are as cut-and-dried as Gellman claims they are elusive. It seems to me that the free-market approach is best suited for point-of-purchase type situations, where the consumer can make a judgement about the value of his personal data and act accordingly. Regulation is best suited for controllign the 'behind the scenes' exchange of data between 3rd parties. The US personal information market lacks two essential things: consumers lack the ability to make an informed judgement about the value of their information, and they lack the legal declaration that personal data actually belongs to them. Without these two things, it's practically pointless to discuss free-market vs. regulation... both are sometimes right, sometimes wrong, and functionally broken. -Tony Dye ---- From: admin () consumer net (admin) To: <wfason () houston rr com> Cc: <wfason () houston rr com>, <rgellman () cais com>, <declan () well com> Subject: RE: Texas private investigator replies to Robert Gellman on privacy Date: Thu, 28 Mar 2002 11:18:41 -0500 It is clear that you have never dealt with these companies you discuss when the issue involves *your* personal information. Just try to find what kind of information that have about you, try to find out where they got it, try to opt-out of having the information distributed to other parties for marketing purposes, and, if you can do all that, try to correct any mistakes. Just read their privacy policy or listen to their propaganda and then try to actually the directions they give you about access and control over this information and see how far you get. In fact why don't you try contacting the victims of identity fraud who contact these companies in an effort to clear things up. Putting up phony privacy policies and setting up sham "self regulatory" efforts that have no way to file complaints or have any enforcement mechanism is fraud and it is clearly illegal. At least the drug cartels admit what they do is illegal. I have been to a number of meetings where people like you show up and give their spiel. I have found that now a single one has ever actually tried to gain access and control over their own personal information and have no idea what a consumer actually goes through when they try to use the procedures that are discussed at these purely theoretical meetings. So when you have actually done your homework then you can try commenting with some facts behind you rather than your theories about things you have read. Russ Smith http://privacy.net --- From: "Vincent Penquerc'h" <Vincent.Penquerch () artworks co uk> To: gellman-comments () robertgraham com, rgellman () cais com Cc: "'declan () well com'" <declan () well com> Subject: RE: Free-market economist replies to Robert Gellman privacy paper Date: Thu, 28 Mar 2002 15:17:45 -0000 > If Gellman gets his way, he passes laws to adjust for the > imbalance. If Gellman is right, then this isn't bad, but if the > free-market economist was right and if the privacy was really > worth only $1.50, then we have an Orwellian society where guns > coerce people. The problem with this omnipresent need to stick a "dollar value" on everything is that it is not easy to do so. Valueing something implies you assess this thing, and doing so requires thorough knowledge of the thing assessed. Privacy is not something you can look at and assess easily. There is direct value you could stick on a given physical situation, like "I am in my house, and someone is looking at me by the window". Such things are obvious. However, others are much less obvious, because they are things that could be made out of the information someone gleans on you. When you don't know what, eg, a software company can do with the info it amasses about you, you can't really put a "dollar value" on this info, because it's immaterial: it's really "potential". The potentiality is whatever *can* be done with it. This is a rather blurry thing on the horizon, it really seems small and unimportant. Still, the actual concrete results will only appear afterwards. By that time, the "dollar value" one places on privacy might be far higher than before. One of the reasons why is because the original assessment was not founded on thorough knowledge of what could happen. That said, I appreciate the fact that trying to prevent something nefarious happening to someone against one's will is not necessarily a good thing just because the "protector" is genuinely concerned about one's health/integrity/soul/whatever. > By the way, we still haven't left the realm of circular logic. > Gellman is afraid of me because he thinks my policies will lead > to an Orwellian society led by business. I fear Gellman because > I think his policies will lead to an Orwellian society led by > government. Which I'd rather avoid both. This is another rant altogether, but business despotism can be as chilling as goverment one, especially as, at least in the USA, the government is somewhat supposed to be serving citizens, businesses being supposed to gather money, which they have to find somewhere (not everyone is Alan Greenspan). -- Vincent Penquerc'h --- ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- Politech dinner in SF on 4/16: http://www.politechbot.com/events/cfp2002/ -------------------------------------------------------------------------
Current thread:
- FC: Robert Gellman replies to privacy study critics, more responses Declan McCullagh (Mar 28)