Topic: Regulatory Studies

GAO Issues Report on Privacy

This week, for a hearing in the Senate Homeland Security and Government Reform Committee, the Government Accountability Office released a report on privacy titled “Alternatives Exist for Enhancing Protection of Personally Identifiable Information.” (GAO testimony based on the report is here.) I served on a National Academy of Sciences “Expert Panel” that gave the GAO some perspectives on issues related to the Privacy Act.

The report had three main conclusions, with my comments:

The Privacy Act’s definition of a “system of records” (any grouping of records containing personal information retrieved by individual identifier), which sets the scope of the act’s protections, does not always apply whenever personal information is obtained and processed by federal agencies. One alternative to address this concern would be revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government.

The “system of records” definition has indeed fallen out of date. Thanks to the growth of search and other technological developments, records not organized by personal identifier can be accessed and used by the federal government, but they fall outside the purview of the Privacy Act. This should change. The report also highlights the fact that data used by the federal government, but held by information resellers, escapes the purview of the Privacy Act. This should also change.

According to generally accepted privacy principles of purpose specification, collection limitation, and use limitation, the collection of personal information should be limited, and its use should be limited to a specified purpose. Yet, current laws and guidance impose only the modest requirements in these areas… . Alternatives to address this area of concern include requiring agencies to justify the collection and use of key elements of personally identifiable information and to establish agreements before sharing such information with other agencies.

Once they have collected it, federal agencies can do anything they want with personal information simply by declaring their plan to do so in the Federal Register through a “System of Records Notice” or “SORN.” The statements agencies may make when they collect information do not bind them in the slightest. This is wrong and it should change. GAO’s recommendations to limit collection and sharing of information are rather tepid, alas, and they wouldn’t change agencies’ institutional incentives to over-collect and promiscuously share the personal information of the citizenry.

Privacy Act notices may not effectively inform the public about government uses of personal information. For example, system-of-records notices published in the Federal Register (the government’s official vehicle for issuing public notices) may be difficult for the general public to fully understand. Layered notices, which provide only the most important summary facts up front, have been used as a solution in the private sector. In addition, publishing such notices at a central location on the Web would help make them more accessible.

It’s true that Privacy Act notices don’t inform the public well. They are obscurely written documents in an obscure publication. But I’m not sure that the publication of “layered notices” would be an improvement. Sure, there’s a consensus among government types that layered notices are the next big thing, but I don’t believe that they will change citizen understanding or behavior in any significant respect. Notices are also not terribly relevant in the government environment because a person can’t decline to do business with a government based on its privacy practices or promises.

There’s more to learn on “notice” and its importance or relevance for getting people more privacy. The thing we know is that reducing data collection and use leads directly to privacy. Getting policymakers to understand the privacy costs they’re imposing on the public would be as effective, if not more, than notifying the public about what’s been done to them after a policy is made and the horse is out of the barn.

Privacy Legislation vs. Google’s Homepage

Google stands accused of violating the California Online Privacy Protection Act of 2003, which requires Web sites and online services to “conspicuously post” their privacy policies.

It’s obvious to some that this requires Google to have a link on its homepage to its privacy policy, but the law says that online service providers can use “any other reasonably accessible means of making the privacy policy available for consumers of the online service.” In the case of Google, one might consider … a search?

But I think this little episode has a deeper lesson. It reveals the thoroughgoing incapacity of lawmakers and advocates to be social engineers. Linking to privacy policies on home pages was an experiment that failed long ago. People don’t read them. People who are interested in reading them can find them so long as they’re placed sensibly somewhere on a Web site.

In their voluntary transactions, if people want privacy, they’re gonna seek it (and, though it’s tough, often get it); if they’re indifferent, they’re not. Mandated privacy notices – especially the placement of them – are a sideshow.

Only in England

Bureaucrats in the United Kingdom must be getting jealous that their French counterparts are getting all the attention, so they have gone above and beyond the call of duty to demonstrate unparalleled government stupidty. Security officials at Heathrow Airport barred a man from flying until he removed a t-shirt with an image of an armed robot. The Evening Standard (not The Onion) reports:

An airline passenger claimed that a security guard threatened to arrest him because he was wearing a T-shirt showing a cartoon robot with a gun. Brad Jayakody, 30, from London, said he was stopped from passing through security at Heathrow’s Terminal 5 after his Transformers T-shirt was deemed ‘offensive.’ …Mr Jayakody said the first guard started joking with him about the Transformers character depicted on his French Connection T-shirt. ‘ “Then he explains that since Megatron is holding a gun, I’m not allowed to fly,’ he said. ‘It’s a 40ft tall cartoon robot with a gun as an arm. There is no way this shirt is offensive in any way, and what I’m going to use the shirt to pretend I have a gun?

Travelers in the United States, needless to say, have no reason to be smug. The keystone cops at the Transportation Security Administration, after all, have become experts at confiscating such well-known terrrorist weapons as fingernail clippers and bottles of shampoo.

Is Climate Change the World’s Most Important Problem?

A 2005 review article in Nature on the health impacts of climate change provided an estimate of 166,000 deaths as the annual global death toll “attributable” to climate change. This estimate, based on global vital statistics for the year 2000, was derived from a study sponsored by the World Health Organization (WHO) that even the study’s authors acknowledge may not “accord with the canons of empirical science” (see here). Let’s, nevertheless, accept this flawed estimate as gospel, for the sake of argument.

Where would this rank climate change in the list of global threats to mortality?

In the year 2000, there were a total of 55.8 million deaths worldwide. Thus, climate change may be responsible for less than 0.3% of all deaths globally (based on data for the year 2000). In fact, it would place climate change no higher than 13th among mortality risk factors related to food, nutrition and environment, as shown in the following table taken from pages 355-356 of the book, The Improving State of the World.

[Notably, all extreme weather events (whether due to climate change or the normally abnormal climatic variability) contribute all of 0.03% of global deaths on average. See Table 2, here.]

Specifically, climate change is easily outranked by threats such as hunger, malnutrition and other nutrition-related problems, lack of access to safe water and sanitation, indoor air pollution, malaria, urban air pollution.

With respect biodiversity and ecosystems, today the greatest threat is what it always has been – the conversion of land and water habitat to human uses, i.e., agriculture, forestry, and human habitation and infrastructure. See,e.g., here.

Climate change, contrary to claims, is clearly not the most important environmental, let alone public health, problem facing the world today.

But is it possible that in the foreseeable future, the impact of climate change on public health could outweigh that of other factors?

I’ll get to this question in subsequent blogs over the next couple of weeks, but for those who can’t wait, the answer can be found here.

Only in France

At first, I thought this story must be a joke, but it apparently is true that France wants to regulate and subsidize country dancing. No further comment is necessary:

…country and western has become so big in France that the country’s bureaucrats have decided to bring the craze under state control. The French administration has moved to create an official country dancing diploma as part of a drive to regulate the fad. Authorised instructors who have been on publicly funded training courses will be put in charge of line dancing lessons and balls. …In a peculiarly Gallic approach to the phenomenon, French civil servants say line dancing should be submitted to the same rules as sports such as football and rugby. This means imposing training courses for line dancing teachers and a state-approved diploma for anyone who wants to give lessons or run clubs. Amateur instructors will have to take 200 hours of training under the new rules. Professionals will get 600 hours, including such subjects as line dancing techniques, “the mechanics of the human body” and the English (or at least Texan) language. They will also learn how to teach line dancing to the elderly. The cost of the courses, about €2,000 (£1,570) for the professionals and €500 for the amateurs, will be largely met by taxpayers. Mr Chauveau said the regulations highlighted the French state’s obsessive desire to organise all public activity.

High Wire

I recently received a complimentary copy of Peter Gosselin’s new book,  High Wire: The Precarious Financial Lives of American Families.   Mr. Gosselin is the national economics correspondent for the Los Angeles Times.  Here is an excerpt from the book jacket:

 The recent downturn seems to have brought an end to some of the strongest, smoothest growth in American history–a performance that economists found so sweet they dubbed it the “Great Moderation.”  Yet even in boom times, the economy was caught in a cross-current. … [T]he cross-current was neither the product of a misapprehension nor the nation’s normal ups and downs.  Instead, it was the result of a quarter-century long conversion of the nation’s economy from one of checks and balances to barely tempered free markets.

Interesting.  Query: What baseline (pdf) is Mr. Gosselin using?

Why Is The ACLU Joining Media Ownership Hysteria?

Cato has long had a strong relationship with the ACLU, an organization that has been on the forefront of efforts to protect civil liberties and constitutional government. But every once in a while, the venerable public interest organization wanders off the reservation and takes a position that’s unrelated to—if not outright at odds with—civil liberties. We saw a good example of this last week when the group threw its weight behind efforts to repeal the FCC’s absurdly timid deregulation of media ownership rules.

The proposal would allow a newspaper in one of the 20 largest cities to purchase a TV or radio station—but not one of the metro area’s four largest TV stations.  None of the FCC’s other media ownership rules would be changed. In other words, a newspaper would be allowed to buy an also-ran TV station in a cacophonous media market like New York or LA, but the vast majority of cities would see no changes at all.

Yet even that is too much for the ACLU, which issued a press release condemning the changes and urging Congress to roll them back. Unfortunately, the ACLU doesn’t appear to have done its homework, claiming that “Six major companies control most of the media in the country, including the most popular sites on the Internet.” Over at Techdirt, I point out how silly this is:

There’s just no way you can argue that these six companies own “the most popular sites on the Internet.” According to Alexa, most of the top 10 sites are owned by Google, Yahoo, and Microsoft, all independent companies. Only MySpace, recently acquired by News Corp., is in the top 10. But maybe she meant the top 10 media companies? Well, a good source for the sites most discussed in the blogosphere is the Memeorandum Leaderboard. Three of the top 10 are controlled by the “Big Six”: CNN at #3, the Wall Street Journal at #9 and MSNBC at #10. Four others – the Associated Press, New York Times, the Washington Post, and the Atlantic, – are mainstream media outlets not controlled by the “Big Six.” The final three slots are held by the Huffington Post and the Politico (twice), pure Internet publications not owned by the “Big Six.”

Indeed, the whole idea that “six major companies” are gaining monopolistic control over the media marketplace doesn’t make sense. There are, in fact, a ton of independent media companies. In addition to the New York Times and Washington Post companies, there are other big, independent newspaper chains like the Tribune Company (owner of the LA Times and Chicago Tribune) and Gannett (owner of USA Today and numerous other papers). There are foreign outlets like the BBC and the Guardian. There are magazine publishers like Conde Nast, book publishers like Pearson, and music publishers like EMI. The “Big Six” own a lot of media outlets, to be sure, but it’s a big world, and there is no shortage of prominent media outlets that aren’t controlled by these major players. And as media critic Ben Compaine has documented, the media marketplace has barely gotten more concentrated at all in the last couple of decades. For example, between the mid-1980s and the late 1990s, the market share of the top ten media companies increased from 38 percent to just 41 percent. More importantly, there’s been a lot of turnover. The list of top media companies in 1988 would look very different from today’s top ten list. In short, there’s no real problem here.

The ACLU is a key ally in the fight to hold the Bush administration accountable for trampling civil liberties and the rule of law. Given the enormity of that fight, it’s troubling to see them divert scarce resources away from civil liberties—supposedly their raison d’être—to advocate more government regulation of private media outlets.