On Monday, Tom Lenard filed comments with the National Telecommunications and Information Administration (NTIA) regarding the proposed multistakeholder (MSH) process for developing a code of conduct.

Among the 80 comments filed with NTIA, many referenced the need to ensure both firms and Internet users were represented in the process.  In his comments, Tom identified one way to ensure the needs of all involved parties are taken into account: requiring a cost-benefit analysis of any proposed code of conduct.

Since the code will apply to many more consumers and firms than can be directly involved in the process, code provisions should be analyzed in much the same way as a regulation in order to assure that they produce benefits in excess of costs.  Tom also described the proposed code of conduct as similar to agency guidance, which is subjected to the regulatory review requirements of Executive Order 12866, including “a reasoned determination that its benefits justify its costs.”

In addition to urging a cost-benefit analysis of any proposed codes, Tom also warns of the need to try to protect against anticompetitive behavior.  NTIA and the MSH process should ensure any privacy code is neutral with respect to technology, business models and organizational structures.  In addition, procedures should guard against the process and resulting code being dominated by incumbents, which could raise the costs of entry and inhibit innovation in the Internet space.

Read more of Tom’s comments here.

Senators Kerry and McCain released their long-awaited privacy bill yesterday afternoon – the Commercial Privacy Bill of Rights Act of 2011. After scanning through the bill summary and text, I thought I would add my initial thoughts to the mountain of reaction the bill is sure to produce.

First of all, it is clear that the Senators made an attempt at addressing calls for privacy regulation while acknowledging the importance of the free-flow of information in the marketplace.  Specifically, the Senators cite the importance of online advertising in funding the “free” online content and services we all enjoy.  Also encouraging is the bill’s call for opt-out consent requirement for behavior advertising or marketing, which would have much less impact on commerce than mandatory opt-in consent.

Still, the bill does raise some concerns, which I touch upon below.

The bill requires that firms provide individuals access to information collected and mechanisms to correct the information.  This has the potential to create a host of issues.  First of all, anytime an individual accesses such information, it is an opportunity for a security breach or even fraud, which runs counter to the bill’s intention to improve information security.  Second, it is unclear if an individual is allowed to change any and all information a firm may have collected.  What about in instances where an individual may want to remove something they deem as negative, but still accurate?  Because of the vagueness of the language, these concerns are not addressed in the bill but they should be considered.  CORRECTION: It was just pointed out to me that the bill does allow a firm to deny access and correction, as long as they allow an individual to request that the firm stop using or distributing that information. 

Also of concern is the bill’s requirement to only collect information that is needed to deliver a specific service, but allow the use of this information to research and development for a “reasonable amount of time.”  There are real trade-offs when the flow of information is restricted.  In this case, restriction of information, including the length of time information can be held, will result in hindering innovation, especially in online services.  It is unclear if consumers value this restriction of information more than innovation in services, but their actual behavior in the marketplace suggests a willingness to give up information in return for services and content. 

Finally, the bill raises an overarching concern that has been reiterated many times by TPI’s esteemed leader, Tom Lenard: “Where’s the data?“  Indeed, the influx of privacy bills and reports of late seem to be based much on feeling and opinions – with not a real analysis of costs and benefits among them.  Without a cost-benefit analysis of these proposed regulations and identification of the actual harms the regulation is trying to address, it’s impossible to tell if any of these proposals will actually make consumers better off.   Since the commercial use of information has been a vital component of the wide array of services offered on the internet, it is imperative that any policy regulating the use of this information is supported by real data and analysis going forward.

TPI President Tom Lenard filed comments with the Department of Commerce today regarding its proposed privacy framework.  His take: the Green Paper contains little data or analysis to show whether its framework will improve or reduce consumer welfare.  Moreover, the proposal “violates the spirit, if not the letter, of President Obama’s recent executive order on regulation, which stresses the need to evaluate both benefits and costs.”

Lenard strongly urges the agency to:

• Collect current data on the privacy and data management practices of major web sites.  It is impossible to make an informed policy decision without an accurate understanding of current privacy practices.  The most recent available data appear to be from 2001.
• Produce evidence showing that current practices are harming consumers. The agency’s privacy framework will only produce benefits to the extent it alleviates identified harms. 
• Review what we know about how consumers value privacy. In addition to referring to current studies, the agency should also perform additional studies as a basis for estimating the benefits of a new privacy framework.
• Estimate the costs of its privacy framework and alternative proposals. These estimates should include direct pecuniary costs to firms from devoting more resources to privacy and the indirect costs of having less information available.
• Produce sufficient evidence of a reasonable expectation that the benefits of its proposal are greater than the costs.  Otherwise the proposal should not be adopted.

Tom’s brief comments can be found here.