Throwing Out the Privacy Policy is a Bad Idea

If nobody really reads the privacy policy, why is it there? And, do we need it?

In today's episode, taken from an article written by Ted Claypoole, we discuss the shortcomings of today's privacy policies and that, despite their flaws, it's still a good idea to keep them.

Read the full article.

About the author
Theodore F. Claypoole

Transcript

Welcome to Womble Perspectives, where we explore a wide range of topics, from the latest legal updates to industry trends to the business of law. Our team of lawyers, professionals and occasional outside guests will take you through the most pressing issues facing businesses today and provide practical and actionable advice to help you navigate the ever changing legal landscape.
 
 With a focus on innovation, collaboration and client service. We are committed to delivering exceptional value to our clients and to the communities we serve. And now our latest episode.

Welcome to Womble Perspective’s Saturday Series. Today, we’re bringing you the third in a series of four episodes regarding cybersecurity and data privacy. 

So far this month, we’ve given you tips on protecting yourself from cyberattacks, what to watch out for, and what to do if you’re the victim.

But, while these might be useful for individuals, what happens to business owners when there’s a data breach?

Over the course of the next few weeks, we’re offering in-person data breach workshops in Washington, D.C., Raleigh, North Carolina, Charlotte, North Carolina, and Atlanta, Georgia.

These workshops will welcome industry leaders to provide answers on what can go wrong during a data breach, what has worked well in response, and steps you can take to mitigate risk.

For those unable to make it to in-person workshops, we’re holding a virtual session on “How to Think Like a Hacker.” During this presentation, we’re focusing on ethical considerations related to information security and welcoming security expert and ethical hacker Jeff Comer.

More information on these presentations can be found in the show notes.

For the rest of today’s episode, we’re talking about privacy policies. To be honest, they kind of seem like a tree falling in the forest – if nobody reads them, do they make a difference?

The public internet has been around for about thirty years and consumers’ browser-based graphic-heavy experience has existed for about twenty-five years. In the early days, commercial websites operated without privacy policies.

Eventually, people started to realize that they were leaving trails of information online. In the early ‘aughts the methods for business capturing and profiting from these trails became clear, even if the actual uses of the data wasn’t. People asked for greater transparency from the sites they visited online, and in response, they received the privacy policy.

A deeply-flawed instrument, the website privacy policy purports to explain how information is gathered and used by a website owner, but most such policies are strangely both imprecise and too long. They tend to lose the average reader in a fog of legalese and marginally relevant facts. 

Some privacy policies are intentionally obtuse because it doesn’t profit the website operator to make its methods obvious. Many are overly general, in part because the website company doesn’t want to change its policy every time it shifts business practices or vendor alliances. 

And the rest? Well, they’re just messy and poorly written.

Part of the reason that privacy policies are confusing is that data privacy is not a precise concept. While many states have passed data privacy laws in the hopes of defining the term, the definition of data is still context dependent. Data can mean the information about a transaction, information gathered from your browser visit, including where you were before and after the visit, information about you or your equipment, or even information derived by analysis of the other information. And we know that de-identified data can be re-identified in many cases, and that even a collection a generic data can lead to one of many ways to identify a person.

The definition of privacy is also untidy. An ecommerce company must capture certain information to fulfill an online order. In this era of connected objects, the company may continue to take information from the item while the consumer is using it. This is true for equipment from televisions to dishwashers, with the company likely using this information to develop its products. 

It may use the data to market more goods or services to the consumer. It may transfer the information to other companies so they can market their products more effectively. The company may even provide the information to the government. 

All of this is difficult to reflect in a privacy policy, even if the company has incentive to provide useful information to its customers.

Last summer, the Washington Post ran an article by Geoffrey Fowler that was subtitled “Let’s abolish reading privacy policies.” The article notes a 2019 Pew survey claiming that only 9 percent of Americans say they always read privacy policies. I would suggest that more than half of those Americans are lying. Almost no one always reads privacy policies upon first entering a website or downloading an app. That’s not even really what privacy policies are for.

And Fowler shows just why people don’t read these policies. He writes, “As an experiment, I tallied up all of the privacy policies just for the apps on my phone. It totaled nearly 1 million words. “War and Peace” is about half as long. And that’s just my phone. Back in 2008, Lorrie Cranor, a professor of engineering and public policy at Carnegie Mellon University, and a colleague estimated that reading and consenting to all the privacy policies on websites Americans visit would take 244 hours per year.”

The length, complexity and opacity of online privacy policies are concerning. The best alleviation for this concern would not be to eliminate privacy policies, but to make them less instrumental in the most important decisions about descriptive data.

Website owners should not be expected to write out privacy policies that are both sufficiently detailed and succinctly readable so that consumers can make meaningful choices about use of the data that describes them. This type of system forces a person to be responsible for her own data protection and takes the onus off the company to limit its use of the data. It’s like our current system of waste recycling – both ineffective and supported by polluters, because rather than forcing manufacturers to use more environmentally friendly packaging, it pushes consumers to deal with the problem at home, shifting the burden from industry to us.  Similarly, if the legislatures provided a set of simple rules for website operators – here is what you are allowed to do with personal data, and here is what you are not allowed to do with it – then no one would read privacy policies to make sure data about our transactions was spared the worst treatment. 

The worst treatment would simply be illegal.

State laws are moving in this direction, providing simpler rules restricting certain uses and transfers of personal data and sensitive data. We are early in the process, but if the trend continues, we can be optimistic and expect full coverage of online privacy rules for all Americans within a decade or so. But we shouldn’t need to wait for all states to comply.

Unlike the data breach disclosure laws which encourage companies to comply only with the laws relevant to their particular loss of data, omnibus privacy laws affect the way companies conduct the normal course of everyday business, so it will only take requirements in a few states before big companies start building their privacy rights recognition functions around the lowest common denominator. It will simply make economic sense for businesses to give every US customer the same rights as most protective state provides its residents. Why build 50 sets of rules when you don’t need to? The cost savings of maintaining only one privacy rights-recognition system will offset the cost of providing privacy rights to people in states who haven’t passed omnibus laws yet.

This won’t make privacy policies any easier to read, but it will become less important to read them. Then privacy policies can return to their core function, providing a record of how a company treats data. In other words, a reference document, rather than a set of choices inset into a pillow of legal terms.

We shouldn’t eliminate the privacy policy. We should reduce the importance of such polices, and limit their functions, reducing customer frustration with the privacy policy’s role in our current process. 

Limit companies’ use of data and we won’t need to fight through their privacy options.

Thank you for listening to Womble Perspectives. If you want to learn more about the topics discussed in this episode, please visit The Show Notes, where you can find links to related resources mentioned today. The Show Notes also have more information about our attorneys who provided today's insights, including ways to reach out to them.
 
 Don't forget to subscribe via your podcast player of choice so that you never miss an episode. Thank you again for listening.