Privacy and Data Security : Protecting Consumers in the Modern World

a non-profit, non-partisan think tank that focuses on the economics of innovation, technological change, and related regulation in the United States and around the world. I appreciate the opportunity to testify before you today on privacy and data security. These issues are critically important for innovation in the digital economy, which relies on the flow of large amounts of information. I would like to stress two points in my testimony: first, the importance of having reliable data and analysis for good policymaking in this area; and, second, that privacy and security are different and therefore should be dealt with separately.  The views expressed here are my own and do not necessarily reflect the views of TPI, its board, or its staff. 2 Privacy The privacy debate has engendered strong opinions, but relatively little data or analysis. In some respects, we had better data for policy making 10 years ago than we do now. In 2001, when the last of a series of four studies by researchers at the FTC and elsewhere was completed, we at least had baseline data on the privacy practices of commercial websites. During the period covered by the studies, the privacy practices of commercial websites generally improved. However, to my knowledge there has been no systematic study since 2001, so no one knows what commercial website practices are today and whether they are better or worse than they were a decade ago. Policymakers can't make informed policy decisions without facts about the practices prevalent in the marketplace. In addition to basic data, the benefits and costs of alternative privacy regimes (including the status quo) need to be carefully analyzed in order to identify the policies that will best serve the interests of consumers. The commercial use of information online produces a range of benefits, including advertising targeted to consumers' interests; advertising-supported services and content, such as free email and search engines; and fraud detection and reduction in other threats, such as malware and phishing. More privacy means less information available for the marketplace and, therefore, potentially fewer benefits for consumers. Indeed, most privacy proposals are designed to make it easier for consumers to limit the amount of information firms collect and retain. The principal purpose of cost-benefit analysis is to make the tradeoffs inherent in greater privacy protection explicit and evaluate them. 3 On the cost side, a recent study found that the European Privacy …