Photo

The White House published two lengthy reports on big data and privacy last Thursday. The one that got all the attention, understandably, was the review led by John D. Podesta, a senior adviser to the White House. It was the more general report and concluded with a handful of policy recommendations, including developing government limits on how companies use the vast amounts of information they collect about people.

The second report was billed as a technical assessment and was produced by the President’s Council of Advisors on Science and Technology, or PCAST. The group consists of academics, government scientists and industry representatives. The working group for last week’s report had a large dose of members from the big data business — Eric Schmidt, executive chairman of Google; Craig Mundie, senior adviser to the chief executive of Microsoft; and Mark Gorenberg, head of Zetta Venture Partners, which invests in data start-ups.

Privacy groups, including the Electronic Privacy Information Center and the Center for Digital Democracy, were critical of the science and technology advisers’ report for recommending that policy should focus mainly on the use of data rather than in the collection of data. Privacy advocates say that allowing companies to collect all kinds of data — from web browsing to buying habits — opens the door to abuses like discriminating against the poor, older people or minorities, or deploying marketing tactics that exploit them. Industry executives and others who prefer regulating the use of data say there is so much of it out there already, and more all the time, that trying to curb data collection is impractical and not likely to be effective. Besides, they add, there is a fast-growing economy fueled by data, generating jobs and wealth for America.

The appropriate target for policy is a reasonable subject of debate. But I was struck by the candor and clarity on certain critical issues in the PCAST report, especially given its membership. The current approach to online privacy is built around the notion that informed consumers can make reasonable choices; in legal terms it is called “notice and consent.” This concept — or myth — of the empowered consumer means individuals have to fend for themselves in the bewildering, opaque arena of online privacy and marketing practices. “It fundamentally places the burden of privacy protection on the individual,” the PCAST report states. “Notice and consent creates a nonlevel playing field in the implicit privacy negotiation between provider and user.”

The report went on to explain with the example of a person browsing through a website, seeking information or goods to buy, and being confronted with a “terms of service” page. “The provider,” the report states, “offers a complex, take-it-leave-it set of terms, while the user, in practice, can allocate only a few seconds to evaluating the offer. This is a kind of market failure.”

That is hardly the only way the market for online privacy is tilted against the individual. In an interview last week, Mr. Podesta repeatedly used the term “asymmetry” to describe the present state of affairs, in which consumers have little idea of how data about their online behavior is collected, traded and analyzed, or for what purposes. To simplify for the purpose of explanation: On one side of the screen is grandma looking for information on arthritis treatments and for gifts for her grandchildren, while on the other side of that screen is a Ph.D. quant from Google, a Silicon Valley start-up or some other company, looking to maximize grandma’s value.

The answer, the PCAST report suggests, is to change the market, shifting the responsibility for privacy. “The primary burden,” the report states, “must fall on the commercial user of big data and not on the consumer.”

If that occurred, it would be a big change indeed. The challenge is how to make that happen. In broad strokes, the answer is some combination of rules and tools.

The PCAST report surveys the recent technological progress in data tagging, so-called accountable systems, and automated personal profiles that contain a person’s privacy preferences. Outside groups, the report states, could offer competing privacy-preference profiles. The report suggested a few hypothetical examples. A profile supplied by the American Civil Liberties Union might give particular weight to individual rights, while a profile offered by Consumer Reports might be weighted toward economic value for the consumer.

Technology can help, the report states, but it is not the whole answer. “Rules and regulations provide both deterrence of harmful actions and incentives to deploy privacy-protecting technologies,” the report states. “Privacy protection cannot be achieved by technical measures alone.”

The concept of changing market incentives and responsibilities has a lot of appeal. That’s what happened in consumer finance. A few rules were set in place, including a $50 limit on individual liability for fraudulent changes on a credit card that was lost or stolen. So it fell to the banking industry to make credit card fraud a small, manageable problem to protect their profits. The banking industry made huge investments in computing technology to do just that. And the credit card industry flourished.

Online privacy is a different market, but the principle is the same.