Privacy in an Information Age

People should be given property rights to their own confidential information

Nearly every World Wide Web user now realizes that personal data is routinely captured and sold by companies maintaining Web sites. Recent efforts by the Federal Trade Commission to monitor and discourage such activity are no match for forces determined to commercialize personal data. The concept of privacy, pessimists say, is virtually an anachronism in today's "information society."

The Web is just one of the one of countless settings where aggressive buyers are rounding up formerly confidential data on ordinary Americans. A vast array of interests and institutions is involved. Contexts range from the Internet to your nearest supermarket, where use of discount cards generates further personal data for commercialization. Ironically, those with the least say in the marketing of personal information are the "private citizens" portrayed by this data.

American Express, for example, recently announced a joint "data mining" venture with KnowledgeBase, a database marketer that keeps tabs on some 175 million Americans. The aim is to sell reports on cardholders' buying habits to merchants, enabling them to target their marketing even more relentlessly.

Add to this long-attested accounts of appropriation of prescription data by pharmaceutical marketers, or the electronic collection of information on callers to 800 and 888 numbers. Then there's the widespread circulation of information from citizens' contracts with law-enforcement agencies, from their driving records, their medical care consumption, and their credit usage.

In a particularly shocking case, employees who protested sexual harassment in a California workplace found themselves under pressure by an employer who collected embarrassing data on them from credit reports. In a sense, all such activities involve data "mining" - the extraction of value from routine, but increasingly comprehensive record-keeping on ordinary Americans.

The costs of this commercial erosion of personal privacy are anything but trivial. They range from the chronic to the acute - from family dinners shattered by junk phone calls to the chilling of the right to legal redress.

Against these historic tides of privacy invasion, legislative and policy responses have mostly been inconclusive. Unlike other Western democracies, the United States has no comprehensive national legislation protecting personal privacy. Existing protections are equivocal and uneven. Particularly uninspiring among these half-hearted efforts are attempts to make it easier for privacy-minded citizens to request that their names not be circulated commercially. Why, we should ask, should commercialization of personal data be the "default condition" - with the burden of resisting this practice resting on aggrieved citizens?

A simple but far-reaching legal innovation could dramatically redress this situation. Legislators should simply create a property right covering the commercial use of personal information. With such a right in place, no one could sell personal information for any commercial purpose without express permission from the individual concerned. The new principle would not prevent any organization to whom one entrusted one's information from keeping it. But it would outlaw any release of such data without permission.

Establishing personal data as property would create all sorts of desirable tensions and incentives. Institutions now engaged in personal data commerce - from charities to junk-call artists - would have to make their activities acceptable to the people whose data they sought. If not, they would find themselves deprived of their essential "raw material." On the other hand, individuals would have to weigh the value that they ascribe to withholding their data. Do consumers really want to keep their data from direct marketers? From credit grantors? What would be gained and what would be lost by opting for privacy?

Existing approaches to privacy protection have either been too weak in their constraints on data-devouring organizations or too bureaucratically cumbersome. By contrast, creating property rights to personal data would protect privacy without any new government agency - and without any further misplaced trust in industry self-restraint. "Private" citizens would have the power to make their own judgments about the use of their data and to assert their rights. Ownership of one's own data would place a powerful tool for privacy protection in the hands of those in the best position to use it.

* James B. Rule, a professor of sociology at the State University of New York, Stonybrook, has written and consulted widely on privacy and information matters.