5 Va. J.L. & Tech. 8 - Personalization, Privacy, and the First Amendment: A Look at the Law and Policy Behind Electronic Databases

“If you give me your medical history, I can give you more life. If you tell me what books you read, I can guarantee you, you will never read the wrong book. …[I]f you tell me what plane you’re booked on, I can guarantee you won’t show up two hours early to the airport…If I promise to call you if your daughter checks in the emergency room at midnight, you might give me your daughter’s Social Security number.”[2]

1. Personalization is the latest darling of the business world.[3] Companies are directing considerable energy and resources to the goal of knowing and serving customers on an individual basis. By pooling the data they collect with that of other companies and the United States government, companies can create highly-detailed “personality profiles” on individual consumers that they store in computer databases for use in marketing and advertising.[4] Ironically, the more sophisticated these database personalization programs become, the more uncomfortable they make many consumers. Individuals can scarcely make a move these days without it being scrutinized and recorded by watchful companies. To many privacy advocates, the use of personality profiles for direct marketing invades consumers’ privacy rights. Yet, companies compiling and using the databases also have rights. One such right is the First Amendment’s Protection of commercial speech.

2. This paper explores companies’ First Amendment claims associated with electronic databases and direct marketing. The topic is particularly timely because the Supreme Court may soon hear several cases that could give it an opportunity to clarify aspects of the database conflict.[5] Part II of the paper details what companies are currently doing by way of targeted database marketing on the Internet and in traditional retail spheres. Part III looks at the Constitutional right of companies to use an individual’s personal data for marketing purposes. Part IV examines the conflicting claim of a right to informational privacy. Part V examines the validity of legislative efforts to protect consumer privacy by regulating uses of data. Part VI looks at private sources of relief for consumers.

II. Current Practices in Database Marketing

3. As consumers go through their everyday lives, they shed little bits of information about their preferences, purchases, and histories that, unbeknownst to many, are reassembled by powerful corporate computers.[6] Everything an individual does—every trip to the store, telephone call made, prescription filled, travel arrangements booked, website visited, or financial service requested—yields data.[7] Companies go through the pains of collecting this data for one reason alone: knowledge pays. The more a company knows about its target customer base, the better it can retain existing customers, convince them to buy goods or services they do not already have, or target promising new customers.[8] Database marketers can focus their solicitations to the people most likely to respond favorably, thereby cutting costs and increasing returns.[9] In addition, the ability to pinpoint and reach specific individuals can foster increased customer loyalty and retention.[10]

4. When companies pool their data with that of other companies and the government, the resulting personality profiles become all the richer, and often yield new opportunities for profit. For example, large-size clothing stores, health clubs, and diet food companies often exchange their data in the hopes of mining new sources of customer.[11] CVS and Giant Food give patient prescription records to a direct mail and pharmaceutical company, which tracks customers who fail to refill their prescriptions and sends a reminder letter.[12] Companies even make money from renting or selling their databases outright. Over ten thousand lists of data about individuals are available for rent.[13] The annual market for mailing lists alone, before factoring in sales attributable to their use, is approximately $3 billion.[14]

5. As sophisticated as traditional database marketing techniques have become, they pale in comparison to the ease and effectiveness of data collection and marketing over the Internet. Companies can collect a great deal of information by requiring visitors on their site to register, making goods available for electronic commerce, or by sponsoring contests and surveys.[15] They do not even have to do the data entry because visitors key in all the information themselves. In addition, websites can automatically capture data that visitors are not even aware is being collected. If the company utilizes a “cookie”[16] or tracks the user’s “clickstream,”[17] it can learn a visitor’s email address, type of computer, what information the user accesses on the Internet, and how long he or she stays on any one site.[18] If the user is using products made by Microsoft Corporation and Intel Corporation, unique identifying serial numbers contained in the products allow third parties to track individual computer users.[19]

6. Like their traditional non-electronic counterparts, online merchants benefit from the data they collect because it helps them target their solicitations, which leads to lower overhead, and, some say, lower prices for consumers.[20] They can use the data they collect about their visitors to glean general patterns about where visitors gravitate, or to learn more about the particular preferences of individual consumers.[21] The unique characteristics of the Internet make it ideal for one-to-one marketing. At websites where online merchants collect data about their visitors, no two people need see the same display of information and advertisements.[22] The company will utilize technology to customize its site according to what it knows about the visitor.[23] Companies can also send personalized, interactive email messages, urging individuals to reconsider a product they lingered over during their last visit to a website.[24]

7. Entirely new business models are emerging to capitalize on companies’ interest in learning more intimate details about consumers, and on consumers’ desire for personalization. For example, when online retail stores are popular, it is often not because of what they sell, but because of the personalization services surrounding their goods. Amazon.com, the online purveyor of books, music, and other products, provides an excellent example.[25] In addition to selling its wares, Amazon.com offers personal recommendations, based on books the viewer or people like the viewer have purchased in the past.[26] The company also makes its data available to the public, revealing patterns among different groups of customers to satisfy other customers’ curiosity or intellectual edification.[27]

8. Beyond offering personalization services to augment product offerings, many Internet entrepreneurs have realized that they can make a lot of money bypassing the consumer retail aspect of the business model altogether. They are creating companies premised upon the single goal of collecting, repackaging, and selling data about consumers to other companies.[28] Indeed, some enthusiasts suggest that the real-time information contained in databases has become the new currency.[29] In the coming years, this emphasis on information will take personalization to new extremes. Companies like MicroStrategy will transform the world to a place where individuals can be instantly alerted when certain events occur, including a traffic jam on their route to work, the availability of a better mortgage rate, a crime committed in their neighborhood, or the firing of the CEO of a company in which the person has stock.[30] This is the world toward which database owners are striving. Underlying their efforts and predictions for the future is their fundamental assumption that they have a right to the data they collect and use about individual consumers. Is this assumption constitutionally valid?

III. Companies’ Rights in Commercial Databases

A. The Broad Right to Collect and Use Data about Individual Citizens

9. The question of whether companies have a right to collect and use personal information about individuals’ buying habits and preferences must be considered in the context of the United States’ larger cultural heritage. The Founding Fathers and authors of the United States Constitution viewed freedom to receive and disseminate ideas as nothing less than a bulwark against the tyranny from which they had so recently fled.[31] This faith in free expression is embodied in the First Amendment.[32] Although the traditional ambit of First Amendment protection was political speech,[33] over the years the United States Supreme Court has made it clear that the rights contained in the First Amendment also extend to cruder forms of information.[34] Collections of raw facts contained in databases may not at first glance seem the stuff of Constitutional freedoms and democratic revolutions. Yet, the Constitution does stoop to protect mere facts about the government and its citizens, and to guarantee that these facts may be freely disseminated by both.[35]

10. In Whalen, the Supreme Court explicitly recognized that the government has a right to collect and use data about individual citizens.[36] At issue was a New York statute that required physicians to disclose information about patients who obtained narcotics with both legal and illegal markets.[37] The information was compiled into a centralized computer database maintained by the state. A group of patients who needed such drugs for medical purposes challenged the statute on the grounds that the database violated their privacy.[38] The Supreme Court held that a state has a vital interest in controlling the distribution of dangerous drugs.[39] Even if the database was not strictly necessary for controlling that distribution, the database was not unconstitutional.[40] States have broad latitude to experiment with possible solutions for matters of local concern.[41] The instant experiment did not invade any constitutional right just because of the remote possibility that even with adequate security measures there might be an unwarranted disclosure.[42]

11. Assuming such safeguards, the government has a right to collect and use data that can trump an individual’s right to privacy.[43] Private parties have no guarantee of access to this information,[44] but the government has broad discretion regarding to whom it can disclose the data.[45] The government can even sell its data to private commercial entities.[46] The private sector is often the happy beneficiary of government’s prerogative to freely disseminate data.[47]

B. Commercial Speech

12. The government has a right to collect, use, and distribute data to the private sector. But does the private sector itself have a right to collect and use its own data about private citizens? Precedent surrounding database cases would suggest that it does, and that the right emanates from the First Amendment’s protection of commercial speech.[48] In Virginia Board of Pharmacy v. Virginia Citizens Consumer Council, Inc., the United State Supreme Court unequivocally stated that commercial speech deserves protection under the First Amendment.[49] In this case, a Virginia statute prohibited pharmacists from advertising prescription drug prices out of fear that the practice would harm the profession and cause the important relationship between pharmacist and consumer to weaken.[50] The Court held that the state’s fears, while feasible, did not justify its suppression of the pharmacists’ truthful, lawful speech, nor keeping the public in ignorance.[51] Virginia would be better served by granting consumers access to the information, but developing laws to regulate the professionalism of pharmacists.[52] The Court offered a four-part rationale for extending the protection of the First Amendment to commercial speech. First, protecting commercial speech protects the economic interest of the speaker.[53] Second, such speech should be protected because it serves consumers’ interests in the free flow of commercial information.[54] Third, society in general has an interest in the free flow of commercial information because of its particular content.[55] Finally, society has a vital interest in the free flow of commercial information because a free enterprise system cannot work unless consumers can make informed buying decisions.[56] In sum, commercial speech protection is warranted because peoples’ economic decisions are just as important to the functioning of a free enterprise economy as their political decisions are to the functioning of a free representative democracy.[57]

13. The Virginia State Board of Pharmacy court extended First Amendment protection to commercial speech, but it was not willing to grant it the same status of protection as that granted to other forms of speech.[58] Further, the government’s interest in preventing commercial harm is legitimate and could outweigh a company’s interest in free speech.[59] Consequently, some government regulation of commercial speech is permissible that would not be tolerated with other forms of speech.[60]

C. Are Databases Commercial Speech?

14. The conventional definition of commercial speech is “speech that proposes merely a commercial transaction.”[61] In Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, the Supreme Court employed broader terms, defining commercial speech as an “expression related solely to the economic interests of the speaker and its audience.”[62] Beyond these basic definitions, the Supreme Court has purposefully declined to create a universal meaning to guide litigation in this area.[63] Not surprisingly, therefore, the specific question of whether databases fit into the scope of commercial speech has never been firmly resolved. One could certainly argue that the Court’s early definitions leave no room for databases. Data by itself is not intuitively speech. The act of collecting data is not expressive, and it does not propose a commercial transaction.[64] If anything, consumers request a commercial transaction, as with electronic commerce-enabled websites.[65]

15. The inquiry does not end there, however. Speech that proposes merely a commercial transaction “does not constitute the universe of commercial speech.”[66] In Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., the Supreme Court expressly declined to decide whether credit reports, one particular form of databases, qualified as commercial speech.[67] However, a plurality of the Justices noted that credit reports and commercial speech share many of the same characteristics.[68] Both are solely motivated by the desire for profit, which is a force less likely to be deterred than other types of speech.[69]

16. Database marketers, for their part, argue that the activities they conduct surrounding their databases are not commercial speech, but traditional speech.[70] As such, it would deserve the full protection of the First Amendment against suppression by the government or private actors. Circuit courts assigned with the task of deciding whether data reports constitute commercial speech have come out on both sides of the issue.[71] The Supreme Court will soon have an opportunity to make its intentions in this area known because it has granted certiorari to one case involving databases,[72] and could potentially have an opportunity to hear another that is directly on point and currently working its way through the judicial system.[73]

17. In the first case, United Reporting (a private publishing company) received lists of recently arrested individuals from the Los Angeles Police Department pursuant to California Government Code § 6254, which required state and local law enforcement agencies to make such information public.[74] United Publishing turned around and sold the lists to attorneys, insurance companies, religious counselors, and other parties, who would use the information to solicit business.[75] In 1996, however, California amended the Code to prohibit the release of arrest information to people who intended to use it for commercial purposes.[76] United Reporting challenged this law as a violation of its right to free speech.[77] Specifically, United Reporting argued that because the activity engaged in was not commercial speech, but noncommercial speech, the statute is subject to strict scrutiny under the United States and California Constitutions.[78] According to United Reporting, it never proposed a commercial transaction, it simply provides its clients with the raw material they need to propose their own commercial transactions with the recently arrested individuals.[79] The Appeals Court disagreed, finding that United Reporting did propose a commercial transaction, and thus participates in commercial speech.[80] Nevertheless, even under the reduced level of scrutiny afforded to commercial speech, California’s law violated the company’s rights under the First Amendment.[81]

18. The second case that the Supreme Court could hear, if the Federal Communications Commission is successful in its appeal, is U.S. West, Inc. v. Federal Communications Commission.[82] U.S. West challenged a FCC regulation prohibiting it from using personal data for marketing purposes unless the company received express permission from the customers.[83] Specifically, the regulation sought to protect Consumer Proprietary network Information (CPNI) from undue disclosure by allowing the company to only use CPNI data from customers who “opt-in” to the program in advance.[84] The government argued that its regulations did not infringe U.S. West’s right of commercial speech because it only banned the use of one type of data—CPNI.[85] Further, it did not prevent U.S. West or other telecommunications companies from otherwise communicating with customers or limit what the companies could say to them.[86] U.S. West took the position that the regulation curtailed its internal business communication, which is not commercial speech, but traditional speech.[87] The regulation, U.S. West argued, must be held up to the more stringent level of First Amendment scrutiny, although this type of speech is generally afforded less protection than noncommercial speech.[88]

19. The Tenth Circuit rejected both the government and U.S. West’s arguments.[89] It held that U.S. West’s targeted speech falls solidly within the definition of commercial speech because the purpose behind the CPNI is to encourage customers to purchase more or different telecommunications services.[90] The company’s internal communications about the data were also commercial speech because they were conducted for the sole purpose of facilitating marketing of telecommunications services to individual customers.[91] In sum, “the speech [is] integral to and inseparable from the ultimate commercial solicitation. Therefore, the speech is properly categorized as commercial speech.”[92]

20. Until the U.S. Supreme Court has a chance to tighten its definitions regarding First Amendment protection of commercial database use, the most competent way to predict its inclinations may be to examine database use in light of the four rationales for the protection of commercial speech, enumerated in Virginia State Board of Pharmacy.[93] If the characteristics of databases fit these notions of commercial speech, it would seem more likely to be protected. As discussed above, the first rationale for protecting commercial speech is to protect the economic interest of the speaker.[94] There can be no doubt that this interest is served by calling commercial databases a form of free speech.[95] Database marketing enables companies to refine their marketing techniques to get better returns at lower costs.[96] Direct marketing enables companies to realize billions of dollars in sales of goods and services.[97]

21. The second purpose behind commercial speech protection is to ensure that consumers have access to information about new products and prices.[98] Critics argue that databases in fact are a disservice to consumers because they enable companies with sophisticated marketing programs to entice consumers to buy products they do not need or even want.[99] The stronger argument, however, is that databases do serve the interests of individual consumers. The commercial speech doctrine is premised upon the idea that individuals fare better when armed with information than when kept in ignorance by paternalistic governmental policies.[100] The more information people have at their disposal about a wide range of products, the better able they are to decide what they need and how much they should pay for it.[101] Databases simply help companies get their message out to the right people at a fraction of the cost of blanket advertisements.[102] Consumers have a strong interest in ensuring that merchants continue to have access to data about their pasts. For example, if companies did not have access to reliable data about individuals’ credit worthiness, consumers would have to wait much longer for their purchases to be approved,[103] or shoulder the burden of a premium for the company’s financial risk in dealing with an unknown quantity.[104]

22. The third Virginia State Board of Pharmacy rationale for protecting commercial speech is that society in general has an interest in the free flow of commercial information because of its content.[105] The content in personality profiles does not constitute content in which society has an interest.[106] Yet, that fact does not necessarily mean that databases fail to satisfy the entire Virginia State Board of Pharmacy test. First, the third prong requirement of a public interest in the content is ancillary to the other three, so its inapplicability to data arguably should not exclude data from being protected as commercial speech.[107] Second, while the personality profile data does not meet the third criterion, the uses to which it is put do. That is, data about consumers is utilized to improve the system of transmitting content that does matter to society—namely, availability of goods and their prices.[108] The data underlying personality profiles is the raw material from which direct marketing and advertising are derived.

23. Finally, the fourth rationale is that society has an interest in the free flow of commercial information to ensure the proper functioning of the free market economy.[109] The system cannot work unless consumers are informed purchasers.[110] Electronic databases are simply a more efficient way for this goal to be realized.[111] Critics argue that the societal interest rationale is not met by extending the free speech domain to databases because the database-marketing regime actually harms the delicate balance of the enterprise economy.[112] Companies know way more about consumers than consumers do about them. As database marketers become comparatively omniscient, they turn into “unaccountable Frankensteins” shielded from law enforcement and any sort of accountability for their actions.[113] Yet, these arguments are flawed in two crucial respects. First, they reek of paternalism and protection through forced ignorance and suppression of commercial speech. The Virginia State Board of Pharmacy court made it clear that it does not look favorably upon such justifications.[114] Secondly, these arguments underestimate the power of public opinion. Even casual glances at the scandals that have rocked the media in recent years show the dire consequences of database marketers overstepping their bounds.[115] When enough people are sufficiently galvanized by privacy infringements, Congress responds with legislation to enforce fair data use procedures.[116] The power individuals exert on companies through their ability to switch their business, raise a public uproar, or attract the attention of legislatures is formidable, and serves as an effective balance to the power differential.[117]

24. Thus, calling databases commercial speech does not offend the goals of the commercial speech regime laid out by the U.S. Supreme Court in Virginia State Board of Pharmacy.[118] The free flow of personal data permits companies to maximize their effectiveness by targeting the right customers with the least amount of resources expended, and assists consumers in becoming intelligent decision-makers in our free enterprise system. Increasingly, data is the epoxy that holds our enterprise economy together.

D. Data Applications and the First Amendment

25. While the Supreme Court has not yet been heard on the issue of whether data itself is a form of commercial speech, it has consistently held that the uses to which such data is put do constitute commercial speech. For instance, exploiting databases for solicitation or direct mail purposes is constitutionally protected commercial speech.[119] Direct mail solicitation places only a negligible burden on consumers because it imposes no “captive quality.”[120]

The mail box, however noxious its advertising contents often seem to judges as well as other people, is hardly the kind of enclave that requires constitutional defense to protect ‘the privacies of life.’ The short, though regular, journey from mailbox to trash can…is an acceptable burden, at least so far as the Constitution is concerned.[121]

26. Courts have remained faithful to these beliefs, in spite of the emergence of powerful new data storage and mining technologies that enable companies to conduct more sophisticated, and some might say intrusive, direct marketing efforts.[122] In Shapero, for instance, the Court expressly validated the Constitutionality of targeted marketing.[123] The case arose from a challenge to a Kentucky statute, which prohibited lawyers from soliciting legal business for pecuniary gain by sending letters to potential clients facing particular legal problems.[124] Shapero was a lawyer who, on the basis of public information, identified people in danger of losing their homes from foreclosure and sent personalized letters urging them to seek his legal assistance.[125] The Court held that it made no difference whether Shapero was able to send his message to specifically targeted individuals, rather than to the general public.[126] Admittedly, a personalized letter to a specific recipient presents an increased risk of deception.[127] Intentionally or not, the letter could mislead the recipient about the nature or seriousness of her legal problem, or lead the recipient to think the lawyer is more familiar with her case than he really is.[128] Nonetheless, these dangers do not justify a total ban on that mode of protected speech.[129] Lawyers have a right to solicit business from potential clients using all the technological tools available.[130]

IV. The Right to Privacy

27. The benefits that consumers enjoy from personalization do not come without a price. That price is a growing feeling of exposure and vulnerability. Many people are left cold at the impertinence and arrogance of some database marketers. Stories of insensitive and egregious privacy violations abound.[131] In addition to the annoyance or alarm of getting unsolicited calls or mail, the potential applications for personal data can be downright disturbing. For instance, one could envision a health insurance company charging a premium for subscribers whose grocery purchases indicate they eat too much junk-food, or an cult leader posting a list of individuals who bought items the group found offensive, along with incendiary messages. Even seemingly innocuous data about one’s buying habits could be dangerous if the wrong people get hold of it. For example, an opposing party in a civil or criminal case could use data held by companies to demonstrate liability or guilt. This possibility is not as far-fetched as it may seem, as illustrated by Independent Counsel Kenneth’s Starr attempt to subpoena Monica Lewinsky’s book purchases during his investigation of President Clinton.[132]

28. In complaining about actual and imagined transgressions by over-zealous database marketers, consumer advocates generally refer to an abstract, natural right to privacy. Does such a right exist? The right of privacy delineated in Griswold v. Connecticut and its progeny is, of course, well established by now.[133] Yet, many argue that it does not extend beyond the realms of procreation, reproduction, marriage, and privacy of the marital bed.[134] The type of privacy implicated in electronic databases—“informational privacy”—is of an entirely different sort.[135] “Informational privacy” expresses the desire of persons to choose freely under what circumstances and to what extent they will expose themselves, their attitudes, and their behavior to others.[136] The Court has never been willing to find either a general Constitutional right to privacy,[137] or a specific right of informational privacy.[138] There are indications, however, that courts are not totally adverse to the notion of an individual right against government disclosure of personal information.[139] In Whalen, the U.S. Supreme Court said in dicta that it was “not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks.”[140] The government or other party’s right to collect and use personal and potentially embarrassing data is typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures.[141] The particular application challenged in Whalen was not problematic because it had appropriate limits and safeguards. If the databases did not have adequate measures to protect individual privacy, “the central potential for abuse of that information [would render the Court] not prepared to say that future developments will not demonstrate the necessity of some curb on such technology.”[142]

29. In United States Department of Justice v. Reporter’s Committee for Freedom of the Press, the Court seemed even more sympathetic to the possibility of a right of informational privacy against the government.[143] This case centered on a statutory exemption in the Freedom of Information Act that prohibited disclosure to a reporter of an individual’s criminal records held by the Federal Bureau of Investigation.[144] Of course, “the question of the statutory meaning of privacy under the FOIA is…not the same as…the question whether an individual’s interest in privacy is protected by the Constitution.”[145] Nevertheless, the Court asserted as a general proposition that “both the common law and literal understandings of privacy encompass the individual’s control of information concerning his or her person.”[146] Disclosure of FBI rap sheets violates an individual’s privacy because it reveals too much information, even though all of the information is public.[147] There is a huge difference between “scattered bits of criminal history” that may be publicly available in various sources and “a federal compilation” that presents it together in one easy package.[148]

30. Some people, including Washington attorney Robert Belair, believe that the decision in Reporters Committee confirms that individuals have a right to informational privacy, separate from an FOIA exemption.[149]

Previously, the court had resisted finding a privacy interest in records unless the records contained intimate, personal information, such as health or family information, and unless the records had been held in more or less strict confidence…What the court found in Reporters Committee is that there is an expectation of privacy in a computerized, comprehensive record of all of an individual’s activities – but not necessarily an expectation of privacy in a single criminal event.[150]

31. Not all Courts share Belair’s conviction. In fact, the situation in regard to informational privacy in the various judicial districts can be summed up in one word: inconsistent. Some districts refuse to hold that a right of information privacy exists,[151] while others expressly accept that Whalen establishes that right.[152] This confusion is the contextual background for Condon v. Reno, a case currently before the Supreme Court.[153] At issue in Condon is the constitutionality of Congress’ Driver Privacy Protection Act of 1994 (DPPA), which regulates the dissemination and use of certain information contained in State Motor Vehicle Records, and prohibits any person from knowingly obtaining or disclosing personal information from motor vehicle records.[154] The Act was upheld in two Federal Circuits, and struck down in two others.[155] In Condon, the Fourth Circuit District Court began its analysis by confirming that the Constitution protects informational privacy.[156] The Court then balanced the interests of an individual’s reasonable right to privacy in the Constitution against the government’s interest in disclosure, concluding that information contained in drivers’ records that is otherwise freely available in public records is not protected from disclosure.[157] The Court of Appeals affirmed the judgment, holding that the sort of information found in motor vehicles records is not the sort to which people have a reasonable expectation of privacy. [158]

32. The Supreme Court’s decision in Condon could finally dispel all doubts about the existence of a Constitutional right to informational privacy against the government, or it could restrict its decision to the narrow facts of the instant case. Privacy advocates will of course, eagerly welcome a positive affirmation of a right to informational privacy. Yet, in reality such a finding would not offer much solace to individuals concerned about private-sector use of their personal data. Any finding of a Constitutional right to informational privacy will only apply against the government, not private entities.[159] Private actors are immune from restrictions imposed by the Fourteenth Amendment.[160] In short, the Constitution does not appear to provide consumers with a remedy for the collection and use of their personal information against database marketers.[161] Consumers must look elsewhere if they wish to block companies from gathering their information.

33. In fact, it may not even be in consumers’ best interest for the Court to find a right to informational privacy. For all it offers, privacy imposes many costs on society.[162] Institutionalized privacy would facilitate the dissemination of false information by making it more difficult for individuals to discover falsities.[163] It could also interfere with the collection, organization, and storage of information needed by companies to make rapid, informed decisions, and to efficiently market their products and services.[164] In addition, privacy protects the withholding of relevant true information, such as when an employee fails to disclose a medical condition that would affect his or her job performance.[165] As a result, a regime of ultimate privacy could reduce productivity, and result in higher prices for products and services.[166] Privacy rights could also threaten physical safety by blocking access to records, such as information about an individual’s child abuse or molestation, sexual offenses, or communicable diseases.[167] Finally, privacy can impede upon healthy individual voyeuristic curiosity which “opens people’s eyes to opportunities and dangers.”[168]

V. Statutory Attempts to Protect Privacy

A. American Attitudes Toward Regulation

34. American consumers may feel discomfort over their increasing loss of privacy but as a whole they have not pushed for legislative solutions. Instead, they appear to prefer leaving businesses alone to work out satisfactory self-regulation techniques, especially in the Internet industry.[169] This preference can be explained by Americans’ basic faith in the private sector and their recognition that regulation of it can have unintended and harmful consequences.[170] Mandatory rules could chill further technological innovation.[171] Furthermore, Americans believe in the power of mass media and popular opinion to hold private sector abuses in check.[172] They also tend to be disinclined to impose regulations until problems actually occur.[173] Finally, American consumers believe that problems caused by new technologies can be solved using newer technologies.[174] For instance, consumers can use anonymizer services to mask their identity on the Internet[175] or filter technologies to keep their children away from unsavory websites.

35. The approach of the federal government mirrors consumer ambivalence about privacy and innovation. In the traditional retail sphere, privacy protection is a popular cause—within the first three months of the 1999 congressional term, 50 different privacy bills were introduced.[176] Over all, however, the popular appeal of privacy protection has not translated into strong informational privacy laws.