Unilateral Invasions of Privacy

ABSTRACT Most people seem to agree that individuals have too little privacy, and most proposals to address that problem focus on ways to give those users more information about, and more control over, how information about them is used. Yet in nearly all cases, information subjects are not the parties who make decisions about how information is collected, used, and disseminated; instead, outsiders make unilateral decisions to collect, use, and disseminate information about others. These potential privacy invaders, acting without input from information subjects, are the parties to whom proposals to protect privacy must be directed. This Article develops a theory of unilateral invasions of privacy rooted in the incentives of potential outside invaders. It first briefly describes the different kinds of information flows that can result in losses of privacy and the private costs and benefits to the participants in these information flows. It argues that in many cases the relevant costs and benefits are those of an outsider deciding whether certain information flows occur. These outside invaders are more likely to act when their own private costs and benefits make particular information flows worthwhile, regardless of the effects on information subjects or on social welfare. And potential privacy invaders are quite sensitive to changes in these costs and benefits, unlike information subjects, for whom transaction costs can overwhelm incentives to make information more or less private. The Article then turns to privacy regulation, arguing that this unilateral-invasion theory sheds light on how effective privacy regulations should be designed. Effective regulations are those that help match the costs and benefits faced by a potential privacy invader with the costs and benefits to society of a given information flow. Law can help do so by raising or lowering the costs or benefits of a privacy invasion, but only after taking account of other costs and benefits faced by the potential privacy invader. INTRODUCTION Shortly before Thanksgiving in 2011, shopping mall operator Forest City Commercial Management announced that it would begin tracking shoppers' movements in two of their malls, using the signals from cell phones to trace individual paths from store to store. (1) The malls would use a technology called FootPath that, as its maker, Path Intelligence, explained, could help an operator understand shoppers' behavior and use this information to make "[d]ecisions that optimize tenant performance, protect and drive lease values, maximize operating income, and ultimately, drive asset value." (2) Tracking shoppers' movements was not a new phenomenon; malls and other retailers have long looked to see where customers linger, what areas they avoid, and what stores attract like-minded shoppers. (3) Nor was the FootPath system itself new; even before the Thanksgiving announcement, the Path Intelligence technology was used by malls in Australia and the United Kingdom. (4) Yet Forest City's tracking lasted just one day before the backlash from regulators and others raising privacy concerns. (5) In letters to Path Intelligence and to the Federal Trade Commission, Senator Charles Schumer objected that shoppers would be tracked without their consent and could only opt out by turning off their cell phones or avoiding shopping malls, burdens he argued were unreasonable. (6) Faced with this scrutiny, Forest City pulled the plug on the automated tracking. (7) So rather than tracking shoppers via cell phone, the Forest City malls will have to adopt more costly means of tracking shoppers or forswear the benefits that FootPath promised. (8) The FootPath story is typical of a recurring scenario in information-privacy law: a new practice that seems creepy and invasive, even though it results in many of the same information flows that existed before the practice. Privacy law has struggled with such developments. …