Tag: web

Online Privacy and the Commerce Clause

I fear that with the PATRIOT Act on the brain, I’ve been remiss in continuing the colloquy on behavioral ads and privacy regulation that I’d been having with Jim Harper—who flattered me by responding in a long and thoughtful essay a couple weeks back. Because there’s so much interesting stuff there, I hope he won’t mind if I restrict myself to the first part of his reply here, in the interest of making this all a bit more digestible to those whose fascination with the topic may not be quite as consuming as ours. I’ll consider briefly the constitutional issue Jim raises, and turn to some of the specifics of the issue—and the relative merits of the common law alternative—in another post.

So like every good dorm room bull session, we begin in the weeds of  policy and quickly find ourselves breathing the rarefied air of constitutional theory. Supposing for the moment that we thought it were a good idea on policy grounds, would it be within the power of Congress to set ground rules for online advertisers who gather personal data from Web browsers? Recall that there are two particular rules that I’ve said I’d be tentatively open to, but which Jim rejects: a requirement of notice when information is being collected (say via a small link from the adspace to a privacy policy) and a rule establishing that privacy policies are enforceable, so that individual users can sue for damages if a company knowingly  violates its stated policy (thus far, courts have not generally found these to be binding). Does this fall within the power to “regulate commerce … among the several states”? I think so. I’ll start with what I hope will be some uncontroversial arguments and go from there.

So first, let’s grant that there’s one type of “original intent” that everyone ought to care about, whatever their more general interpretive stance: what Ronald Dworkin calls the linguistic intent of the Framers. That is, if words like “commerce” and “regulate” had narrower meanings in 1787 than they do today, we must, of course, read them now in that light: “Commerce” means actual interstate traffic in goods and services, rather than economic activity more generally, and “regulation” is centrally about establishing uniform rules and procedures.  With these appropriately narrowed readings in mind, I think it’s still a slam-dunk that online ads are covered.

There are, in fact, at least three different senses in which behavioral ads might be classed as interstate commerce. First, the purchase of the ad space itself is obviously a commercial transaction—frequently though not necessarily between entities in different states—and there’s a reasonable question of whether a host site with posted privacy policy is implicitly committed to applying that policy as a condition on ad space sold to third parties. The ads themselves will typically propose a commercial transaction, and in a more direct way than other ads are, can plausibly be seen as the first step in the transaction itself, as clicking on the ad will often bring you directly to a page where you can complete the purchase it recommends. Finally, the personal and behavioral user data collected is itself a valuable commodity, and many sites function with a pretty explicit informational quid pro quo: You will receive access to our content in exchange for registering and providing us with certain data. Since the Internet is borderless, most sites will be getting most of their traffic from people located in different states or countries, and even narrowly state-focused sites are likely to have substantial border-crossing traffic. So on a pretty straight reading of the constitutional language, I find very little reason to doubt that Congress may set uniform default rules for these interstate transactions, rather than leaving it to a patchwork of state rules.

Now, Jim’s reason for questioning this seems to be that the primary concern of the Framers was to prevent states from creating trade barriers. That may be, but if we skip ahead to Article 1, Section 10, we find that Congress knew perfectly well how to enact general and purely prohibitory bans on such shenanigans  using more apt “no state shall” language. Instead, they used precisely the same language for interstate commerce as they did for international commerce, where history suggests that the Framers (many of them steeped in the mercantilist economic theories of the day) had been above all concerned to preserve the ability to erect protectionist trade barriers. So we’re left with a choice between ascribing to the Framers a frankly stunning level of linguistic incompetence or supposing that the Constitution actually does grant the affirmative power that a facial reading suggests.

Needless to say, this does not require us to adopt the post–New Deal reading that places anything with the least potential influence on economic activity under Congressional purview. But we’re pretty close to the core here. Indeed, one of the early cases I know Jim considers a lodestone for the “no trade barriers” reading, Gibbons v. Ogden, involves a congressional grant of a license to operate steamboats. The court found that this superseded the monopoly New York had sought to grant another steamboat operator, which fits Jim’s point to an extent, but it’s crystal clear from that (1824) ruling that the power of Congress here is a broad authority to grant or withhold a privilege to operate interstate vessels, and establish conditions on such vessels, including restrictions on ownership and personnel. It seems to me you’d have to get awfully creative to read the clause in a way that authorizes that kind of authority over an “instrumentality” of commerce (water navigation) but forbids Congress from specifying the kind of notice a merchant must provide when initiating an actual interstate commercial transaction.

A slightly more controversial suggestion: When the specific substantive intent of the Framers is not explicitly embedded in the Constitution’s language—by which I mean, the specific use they thought a wise Congress would make of enumerated powers in light of contemporary economic theories, whether liberal or mercantilist—I am not inclined to give it very great weight. Or more bluntly, when the legal language is abstract, I don’t think we’re bound by an original conception of how or where it applied in specific cases—to the extent such a consideration is even intelligible when we’re talking about Internet advertising. Manifestly, very few people at the time of the passage of the Fourteenth Amendment believed that the abstract guarantee of “equal protection” entailed a substantive right of black children to attend public schools the states restricted to whites. But insofar as what they wrote into law was the abstract guarantee, I don’t think we’re required to care what they believed. Our modern reading should be constrained by the original sense of the words used, and to some extent by the original structural purpose served (translated as necessary). But in specific application—whether privacy rules for online ads are encompassed within “regulation” of “commerce”—then even if you pulled out the Ouija board and got a personal verdict from James Madison, it would just be one more opinion.

Finally, and maybe most controversially: What kind of recommendations should we make in a world where our preferred interpretation of the Constitution lost the fight a long time ago? If the question is what we should recommend to judges, presumably we want to recommend that they start shifting back in the direction of a reading we regard as better justified. But what about when, as Jim imagines, we’re advising legislators? Should we only recommend what we believe to be authorized by what we hold to be the best reading of the Constitution, or will it sometimes make sense to endorse legislation that is plainly allowed by the current regnant interpretation, but that might be outside the scope of the interpretation we regard as superior? I think it will, partly for theoretical, and partly for pragmatic reasons.

At a practical level, both legislators and citizens widely believe Congress to have broader policy discretion than most of the authors here. So very generally speaking, I don’t think it serves limited government to refrain from weighing in on the relative merits of policy options that wouldn’t be on the table at all if our arguments had fared better at the meta-level. (Recall the old joke about the principled pacifist answer to how to respond to World War II: Don’t sign the Treaty of Versailles!) Now, on this particular question it’s not a sure thing that Congress or the FTC will act, and maybe “hands off” is the best advice to give. But there are plenty of areas where there’s no realistic chance that Congress is going to abstain altogether, even if we think that’s what the best interpretation of the Constitution requires. In those cases, I think it’s at least sometimes appropriate to flag the meta objection and then say something about the policy merits. Obviously there are limits—I don’t expect I’ll ever express a view on the “best” way to run a torture chamber—but there are plenty of issues where it seems perverse for the people most concerned with limited government to sit out the day-to-day debates and focus on getting Wickard v. Filburn overturned, glad as I am that there are folks hammering that.

That dovetails with the theoretical reason, which has to do with the broader question of why constitutional principles are binding on us at all. I assume it is not because the Founders, brilliant though they were, enjoyed some divine right of command that the inheritors of their institutions are compelled to obey. Partly it’s that the principles embedded in the Constitution are good ones, but a substantial piece of the answer, I think, is that they provide a stable framework within which we conduct our political and private lives. Judges give weight to stare decisis even when they think the case at the fountainhead of a line of precedent was poorly decided, in part because the legitimacy and authority of law are to a great extent a function of its predictability, of the way it allows us to take actions and make agreements and know pretty much what the legal consequences will be, however much else may remain unpredictable. Constitutional restraints do this one level up, establishing (albeit roughly) a domain of legal variation over the longer term. This is  not, for what it’s worth, wacky postmodern Critical Legal Studies stuff; it’s an extrapolation from Hayek. To imagine that you can remake a society’s institutions wholesale—even if your guide is the best interpretation of a founding document, and even if you’re pretty sure that interpretation held sway a couple centuries ago—is the fallacy of constructivist rationalists.

Now, I think the right account of why we should regard the Constitution as binding starts with considerations along these lines, but this has the (perhaps unfortunate) consequence that even if you had a super-awesome unanswerable argument for why the Constitution mandates libertopia, at least when read properly absent the accretions of precedent, you still wouldn’t have an argument that judges, legislators, and government officials must all start acting on this understanding as of tomorrow. What you’d have is a good starting point for a much more gradual process of paring government back down. Not, to be clear, because I think the Constitution “means whatever the Supreme Court says it does”—that would be incoherent, since the court’s practice is unintelligible, and its legitimacy illusory, unless we assume there’s an independent meaning for them to strive toward.  But an “independent” meaning can be located in a community of interpretation and practice that extends beyond the framing generation. By analogy: If I want to use language “correctly” to communicate, I don’t get to just assign whatever meanings I like to words. It’s even possible to make a strong argument that the majority of speakers at a particular historical moment are using a word—like “decimate” or “hopefully” or “brutalize”—improperly. But neither does it mean that the first person to coin the term gets to specify its legitimate uses forever. And, in fact, anyone who insisted on using “decimate” to mean only “reduce by ten percent” would probably find his attempts at communication misfiring badly. To say that meaning is necessarily public and independent—consult Hayek’s cousin Wittgenstein here—does not require a baptismal view of meaning. Or at any rate, whether it does or not depends on the function your interpretive practice serves.

So yeah, that’s all pretty far removed from our original discussion—and I’m hoping far enough below the fold that it doesn’t put me on the wrong end of another dozen arguments with colleagues. I’ll do another post later this week where I actually get to the policy question, and some potent objections that both Jim and Tim Lee have raised.

Would PASS ID Really Save States Money?

The proposed PASS ID Act is a national ID just like REAL ID, and it threatens privacy just as much. Some argue that a national ID under PASS ID should be palatable, though, because it reduces costs to states.

But savings to states under PASS ID are not at all clear. Let’s take a look at the costs of creating a U.S. national ID.

The REAL ID Act, passed in May 2005, required states to begin implementing a national ID system within three years. In regulations it proposed in March 2007, the Department of Homeland Security extended that draconian deadline. States would have five years, starting in May 2008, to move all driver’s license and ID card holders into REAL ID-compliant cards.

The Department of Homeland Security estimated the costs for this project at $17.2 billion dollars (net present value, 7% discount). Costs to individuals came it at nearly $6 billion – mostly in wasted time. Americans would spend more than 250 million hours filling out forms, finding birth certificates and Social Security cards, and waiting in line at the DMV.

The bulk of the costs fell on state governments, though: nearly $11 billion dollars. The top three expenditures were $5.25 billion for customer service at DMVs, $4 billion for card production, and $1.1 billion for data systems and IT. Getting hundreds of millions of people through DMVs and issuing them new cards in such a short time was the bulk of the cost.

To drive down the cost estimate, DHS pushed the implementation schedule way back. In its final rule of January 2008, it allowed states a deadline extension to December 31, 2009 just for the asking, and a second extension to May 2011 for meeting certain milestones. Then states would have until the end of 2017 to replace all cards with the national ID card. That’s just under ten years.

Then the DHS decided to assume that only 75% of people would actually get the national ID. (Never mind that whatever benefits from having a national ID drop to near zero if it is not actually “national.”)

The result was a total cost estimate of about $6.85 billion (net present value, 7% discount). Individual citizens would still spend $5.2 billion worth of their time (in undiscounted dollars) on paperwork and waiting at the DMV. But states would spend just $1.5 billion on data and interconnectivity systems; $970 million on customer service; and $953 million on card production and issuance—a total of about $2.4 billion. (All undiscounted—DHS didn’t publish estimates for the final rule the same way it published their estimates for the proposed rule.)

Maybe these cost estimates were still too high. Maybe they weren’t believable. Or maybe Americans’ love of privacy and hatred of a national ID explains it. But the lower cost estimate did not slow the “REAL ID Rebellion.” Given the costs, the complexity, the privacy consequences, and the dubious benefits, states rejected REAL ID.

Enter PASS ID, which supposedly alleviates the costs to states of REAL ID. But would it?

At a Senate hearing last week, not one, but two representatives of the National Governors Association testified in favor of PASS ID, citing their internal estimate that implementing PASS ID would cost states just $2 billion.

But there is reason to doubt that figure. PASS ID is a lot more like REAL ID – the original REAL ID – in the way that most affects costs: the implementation schedule.

Under PASS ID, the DHS would have to come up with regulations in just nine months. States would then have just one year to begin complying. All drivers’ licenses would have to be replaced in the five years after that. That’s a total of six years to review the documents of every driver and ID holder, and issue them new cards.

How did the NGA come up with $2 billion? Maybe they took the extended, watered-down, 75%-over-ten-years estimate and subtracted some for reduced IT costs. (The NGA is free to publish its methodology, of course.)

But the costs of implementing PASS ID to states are more likely to be closer to $11 billion than the $2 billion figure that the NGA puts forward. In just six years, PASS ID would send some 245 million people into DMV offices around the country demanding new cards. States will have to hire and train new employees to handle the workload. They will have to acquire new computer systems, documents scanners, data storage facilities, and so on.

There is another source for cost estimates that draws the $2 billion figure into question: the National Governors Association itself. In September 2006, it issued a report with the National Conference of State Legislatures and the American Association of Motor Vehicle Administrators finding that the costs to re-enroll drivers and ID holders over a 5-year period would cost states $8.45 billion (not discounted).

Just as with REAL ID, re-enrollment under PASS ID would undo the cost-savings and convenience that states have gained by allowing online re-issuance for good drivers and long-time residents. As the NGA said:

Efficiencies from alternative renewal processes such as Internet and mail will be lost during the re-enrollment period, and states will face increased costs from the need to hire more employees and expand business hours to meet the five year re-enrollment deadline.

Angry citizens will ask their representatives why they are being investigated like criminals just so they can exercise their right to drive.

PASS ID does reduce some of the information technology costs of REAL ID, such as requirements to use systems that still do not exist, and requirements to pay for driver background checks through the Systematic Alien Verification for Entitlements system and the Social Security Online Verification system.

But PASS ID still requires states to “[e]stablish an effective procedure to confirm that a person [applying] for a driver’s license or identification card is terminating or has terminated any driver’s license or identification card” issued under PASS ID by any other state. How do you do that? By sharing driver information. The language requiring states to provide all other states electronic access to their databases is gone, but the need to share that information is still there.

A last hope for states is that the federal government will come up with money to handle all this. But the federal government is in even tougher financial straights than many states. The federal deficit for this fiscal year is projected to reach $1.84 trillion.

Experienced state leaders recognize that the promise of federal money may not be fulfilled. The weakly funded PASS ID mandate will likely become a fully unfunded mandate.

So, does PASS ID really save states money? I wouldn’t put any money on it … .