« Law Professor Duties | Main | Younger Professors are Less Ideological »
July 03, 2008
The Privacy Paradox
Over at the New York Times's Bits blog, Brad Stone writes:
Researchers call this the privacy paradox: normally sane people have inconsistent and contradictory impulses and opinions when it comes to their safeguarding their own private information.Now some new research is beginning to document and quantify the privacy paradox. In a talk presented at the Security and Human Behavior Workshop here in Boston this week, Carnegie Mellon behavioral economist George Loewenstein previewed a soon-to-be-published research study he conducted with two colleagues.
Their findings: Our privacy principles are wobbly. We are more or less likely to open up depending on who is asking, how they ask and in what context.
In one interesting experiment, students who were provided strong promises of confidentiality were less forthcoming about personal details than students who weren't provided such promises. The researchers explained this behavior as based on the fact that when an issue is raised in people's minds, they think about it more and are likely to be more concerned about it. Ironically, promising people that their privacy will be protected actually makes them think more about the dangers of their privacy being breached.
There is indeed a growing body of research that examines why people frequently state in polls that they value privacy highly yet in practice trade their privacy away for trinkets or minor increases in convenience. The work of Professor Alessandro Acquisti explores some of the reasons why people might not make rational decisions regarding privacy despite their desire to protect it.
I have also written about this in my new book, UNDERSTANDING PRIVACY (Harvard University Press, May 2008). In particular, I argue that looking at expectations of privacy is the wrong approach toward understanding privacy:
If a more empirical approach to determining reasonable expectations of privacy were employed, how should the analysis be carried out? Reasonable expectations could be established by taking a poll. But there are several difficulties with such an approach. First, should the poll be local or national or worldwide? Different communities will likely differ in their expectations of privacy. Second, people’s stated preferences often differ from their actions. Economists Alessandro Acquisti and Jens Grossklags observe that “recent surveys, anecdotal evidence, and experiments have highlighted an apparent dichotomy between privacy attitudes and actual behavior. . . . [I]ndividuals are willing to trade privacy for convenience or to bargain the release of personal information in exchange for relatively small rewards.” This disjunction leads Strahilevitz to argue that what people say means less than what they do. “Behavioral data,” he contends, “is thus preferable to survey data in privacy.”But care must be used in interpreting behavior because several factors can affect people’s decisions about privacy. Acquisti and Grossklags point to the problem of information asymmetries, when people lack adequate knowledge of how their personal information will be used, and bounded rationality, when people have difficulty applying what they know to complex situations. Some privacy problems shape behavior. People often surrender personal data to companies because they perceive that they do not have much choice. They might also do so because they lack knowledge about the potential future uses of the information. Part of the privacy problem in these cases involves people’s limited bargaining power respecting privacy and inability to assess the privacy risks. Thus looking at people’s behavior might present a skewed picture of societal expectations of privacy.
Posted by Daniel J. Solove at July 3, 2008 01:04 PM
Trackback Pings
TrackBack URL for this entry:
http://www.concurringopinions.com/movabletype/mt-tb.cgi/3844.
Comments
One thing that puzzles me is why people are so utterly paranoid about privacy when it comes to their medical records, but not when it comes to information far more useful to those with nefarious purposes. Unless you have an STD, have had an abortion, or are otherwise concerned about blackmail, what could a criminal really do with your medical records?
Posted by: Justinian Lane at July 3, 2008 02:51 PM
@ Justinian, criminals getting medical records (or DNA) are probably less of a worry to most folks than insurance companies and other commercial entities that could potentially use health information to make decisions negatively affecting them, even without their knowledge.
Posted by: Logical Extremes at July 3, 2008 03:54 PM
I agree that people may discount the value of privacy, but I'd take the critique even further. Given that many new uses of data are unforeseeable, and that we may not even be able to find them out due to trade secrecy shields wielded by data warehousers, how is anyone supposed to assess the threat?
Moreover, even if we make the heroic assumption that the costs and benefits can be evaluated rationally, we still face the problem that the "value" of one's decision is also relative, depending on what others have done. I've explored that idea a bit more here:
http://www.concurringopinions.com/archives/2008/02/siva_vaidhyanat.html
As Sunstein and Frank suggested in their work on cost benefit analysis and relative position, given the importance of positional goods in today's society, people who trade off safety and privacy will likely "outcompete" peers who won't do so. They will have more money and time, and can thereby purchase better homes, send their children to better schools, afford better health insurance, and generally enjoy a higher standard of living than those who take the monetary and time-wasting sacrifices entailed by demanding greater privacy.
Therefore, I think it's unhelpful to model privacy as something we should "buy and sell," or even as something we currently do "trade off" for one or another good or service. As David Grewal notes in his Network Power, most of the decisions we make in a networked society are simultaneously forced and free, and only the most doctrinaire libertarian would grant these tradeoffs the imprimatur of "freedom" because they were not "forced" in the technical sense of that word.
Posted by: Frank at July 3, 2008 07:16 PM
The experiment Solove discussed above seems very revealing about how individuals make privacy decisions and how much value they place upon their privacy. Think of it like a form of informed consent. Of course individuals are less forthcoming about revealing personal information when they are reminded of the risks of revealing such information by assurance that the information will be kept confidential. Perhaps individuals about to undergo invasive surgery who were assured that the physicians performing the procedure would not maim them would be less likely to consent to the operation than those who were just whisked away to the operating room. But would it be reasonable to infer from this that people place little importance on their lives or physical well-being when seeking medical care? So while I agree with Strahilevitz that behavioral data is probably a better indicator than survey data for evaluating how strongly individuals value privacy, I think we have to be very cautious about how we interpret individual behavior.
Posted by: Shane Hartman at July 4, 2008 09:47 PM
The experiment Solove discussed above seems very revealing about how individuals make privacy decisions and how much value they place upon their privacy. Think of it like a form of informed consent. Of course individuals are less forthcoming about personal information when they are reminded of the risks of revealing such information by an assurance that the information will be kept confidential. Perhaps individuals about to undergo invasive surgery who were assured that the physicians performing the procedure would not maim them would be less likely to consent to the operation than those who were just whisked away to the operating room. But would it be reasonable to infer from this that people place little importance on their lives or physical well-being when seeking medical care? So, while I agree with Strahilevitz that behavioral data is probably a better indicator than survey data for evaluating how strongly individuals value privacy, I think we have to be very cautious about how we interpret individual behavior.
Posted by: Shane Hartman at July 5, 2008 02:45 AM
