April 7, 2015 – We’ve all heard people say that privacy is dead. Given the number of data breaches over the past few years, and the abysmal record of the federal court system when it comes to giving consumers the right to file suit over data breaches, the saying may be correct; at least at the present time. But there is absolutely nothing to say that so called death of privacy isn’t reversible. And a proposed consumer bill of rights being floated by the White House may be just enough to resuscitate it. 

Tweet

Frankly, congress and the white house… meaning multiple administrations, multiple congresses, and both parties… have made a complete mess out of consumer privacy rights. For example, as the White House is floating this new bill of rights, both the White House and congress are pushing a national standard for data breach notifications that would usurp much stronger state laws. Apparently, the information contained in data breaches shouldn’t be considered private. There is obviously a lack of understanding on the part of lawmakers. There is absolutely no difference between “private information” and the “personally identifiable information” in a data breach.

As bad as lawmakers have been in formulating the law, the federal courts have made matters worse. A number of recent judicial rulings make it almost impossible for anyone to sue any organization involved in a data breach unless it can be proven that the person filing the suit has been injured as a result of the breach. Never mind the fact that consumers whose information is breached must be prepared to regularly scour their credit reports, their credit card statements, and may be forced to pay for identity theft protection for the rest of their lives.

Because of this, we’re reluctant to back some new initiative coming out of Washington, DC. And what the White House is proposing is too complex. But we are happy to see the discussion being pushed.

Instead of making privacy complex for businesses or consumers, we would propose a much simpler standard. That standard would state that your personal information is your property and that it may not be used by anyone without your permission. Further, no business would have the ability to exclude you as a customer simply because you refuse to allow them to use your information for anything other than why you provided them with that information in the first place.

On the flip side, businesses would be able to incentivize consumers to allow their information to be used for other purposes. For instance, a business could offer you discounts in return for your permission to use your information. Or they could agree to pay you directly for that permission. To protect the business, if you agree to “opt in” to such a relationship, you wouldn’t be able to sue the businesses for a data breach unless gross negligence was involved. That’s a pretty high standard.

And to top off the proposal, if you were to give a business the ability to sell or share your information with others, any business buying that information would be barred from reselling your data without getting your permission first.

Some might say that such a proposal is far-fetched. But we don’t really think it is.

Prior to the 1980’s, very few businesses would sell their customer lists. They put too much time into developing them and they didn’t want them in the hands of their competitors. There are very good reasons for businesses to return to this type of model; not the least of which is liability protection under our proposal.

From a consumer standpoint, such a proposal should also be considered a win. American’s love a deal. And if you can get one by selling your information, allowing you to determine the risk-reward tradeoffs - that’s a real win. Businesses that don’t provide you with a proper incentive wouldn’t have the ability to reuse your information.  And if you have given permission and you information is sold, any company buying it would be forced to make you some sort of incentive offer if they wanted to sell, share or reuse your data.

The big problem that we see with all of the current laws and those that are being proposed is that they all fail to recognize that my information belongs to me and that I should have the ability to control how it is used. If I give someone my information so that they can make a delivery, that isn’t carte blanche to resell my info. And they shouldn’t be able to refuse me service, or have me sign a ten page privacy policy, just because I don’t want my data sold.

byJim Malmberg

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Follow me on Twitter:

Follow ACCESS