I’m attending a two-day digital meeting of Personvernskommisjonen, the privacy commission tasked with surveying the state of privacy in Norway and recommending policy for the future. We just had professor of ICT and private law, Frederik Zuiderveen Borgesius, visit for a short talk, and he raised some really pertinent points. The discussion was much richer than I’m able to summarise here, but I wanted to capture a few points.
Borgesius argued that there is a fundamental information asymmetry in privacy online today, where consumers don’t know what data is collected about them or how it will be used or what the consequences could be. In economics, information symmetry tends to be bad not just for consumers but for everyone, as described by Nobel-prize winning economist George Akerlof in his analysis of “The Market for Lemons“. The lemons are used cars, and of course typical consumers can’t really tell whether the car is a “lemon” or not.
How do you reduce information asymmetries? Well, in supermarkets, we have systems that make sure all the food is safe to eat. There are also various labelling schemes, showing if food is healthy, organic and so on – but some of these are not very helpful, or are even designed to confuse us. Different countries have different laws. So for instance in Norway, the country that fruit and vegetables comes from has to be marked. But all countries have systems so you can trust that food in the supermarket isn’t poisonous.
So we could imagine legally banning certain kinds of privacy-destroying websites. No collecting personal data for advertising on potentially sensitive sites, for instance, like sites about medical information. But where to draw the line? The articles I choose to read in a newspaper can also be used to infer very sensitive information about my sexuality, mental health or political standpoint, for instance.
Perhaps energy efficiency labelling of fridges and other electrical appliances is a better example? Here the EU has established clear guidelines, and they’re clearly displayed when you buy a new fridge.
Could we imagine something similar for websites? And if so, how would it be implemented?
Arguably, this is what Apple is doing with its privacy labels for apps. I love being able to see this more clearly and in a structured way, and this is a reason I like using Apple products (although I realise that’s a privilege: they’re expensive, which is an issue if only the rich get privacy). But is it a problem that a commercial company is doing this for us, rather than it being democratically defined?
Not all labelling works. You need a lot of basic things in place. (The Norwegian Consumer Council has an overview of labelling in Norway that explains some of the issues.) You also need genuine competition so users have a real choice based on the labelling. That means you need data portability, so users can easily switch to a different social media platform for instance.
We’re not concluding anything yet, and I’m sure there’ll be lots more discussions in the year to come.
