Brian Holland, visiting associate professor at the Dickinson School of Law at Penn State University, talks about Voluntary disclosure of personal information to private institutions. At the Conference on Privacy in Social Network Sites: www.privacyinsocialnetworksites.nl

1. Social Distortion: Privacy, Consent, and Social Networks H. Brian Holland Visiting Associate Professor of Law Dickinson School of Law at Penn State University

2. Not talking about covert surveillance Not talking about the government but rather Voluntary disclosure of personal information to private institutions

4. The Paradox of the Privacy “Market”

5. We say one thing. I want my privacy. We do something else. Here’s my data. Take what you want. (just give me my stuff)

6. Examples

7. The claim 43% of online users claim that they are likely to read the privacy policy of an ecommerce site before buying anything

8. The reality 26% actually consulted the privacy policy Even more odd, essentially no difference between privacy fundamentalists, pragmatists, or the unconcerned

9. The claim 71% want to control who can access their personal information

10. The reality ~ 75% have supplied first name last name email street address ~ 50% have supplied phone number birthday credit card information (to e-commerce sites)

11. Why the paradox between professed attitude and actual behavior?

12. Blame it on the market and the law of the market

13. Starting point The current market for transferring personal information (1) revelation (mere disclosure) (2) consent – express or implied

14. Any regulation? some targeted limits on: extremely invasive collection and use (privacy torts) certain kinds of data (e.g. health records) certain subjects of data (e.g. kids)

15. But most data can be collected or given away very cheaply. So, why do we consent so easily? 3 points

16. Lack of legal control over data No property rights in personal data Lack of bargaining power Inability to control downstream rights 1

17. The decline of consent contracting Contracts as standardized commodities Contracts as part of the product 2

18. Market distortions (behavioral economics) Incomplete or asymmetric information Bounded rationality Systemic psychological deviations from rationality 3

19. Creates artificially low prices for personal information consent is cheap

20. Personal information as a commodity.

21. Social Network Sites Market distortions on steroids.

22. A social-tools model of production An effective tool of coordination A plausible promise (the basic “why” to join or contribute) An acceptable bargain with users

23. But is it a bad bargain for users? Capturing users’ personal information Privacy 1.0 – Centralized data collection, storage and aggregation Privacy 2.0 – Peers as both sensors and producers Owning user’s personal information (storage, use, transfer)

24. Why consent to a bad bargain? What do users get?

25. New and powerful market distortions

26. Two integrated points Social network sites are … (1) Altering the basic structure of the information exchange agreement (2) Benefiting from certain social phenomena that are driving us to join the network and to disclose a lot of personal information

27. The structure of the information-exchange agreement consent recedes into the background First point

28. The classic e-commerce model Money Personal information associated with delivery of current goods or services and the provision of future goods or services Merchandise Services Database ?? ?? ??

29. The g-mail model Initial negotiation and transaction (looks like the ecommerce model) A little bit of personal information In exchange for services

30. The g-mail model Lots of personal information Subsequent negotiations and transactions for the exchange of personal information between contacts

31. The g-mail model Lots of personal information Lots of personal information Not holding? Not passing on? Ads Gmail recedes into the background, almost as a third-party beneficiary of these subsequent transactions (info exchange) between contacts

32. The Social Network Site model A little bit of personal information In exchange for services

33. The Social Network Site model Lots of personal information Lots of personal information A little bit of personal information In exchange for services

34. The Social Network Site model A little bit of personal information In exchange for services Lots of personal information Lots of personal information Lots and lots and lots and lots of personal information In exchange for ???

35. The Social Network Site model A little bit of personal information In exchange for services Lots of personal information Lots of personal information Lots and lots and lots and lots of personal information In exchange for ??? Database ?? ?? ?? Ads Ads Ads

36. Certain social phenomena Driving us to join the network and Driving us to disclose a lot of personal information Second point

37. Social phenomena (a) The evolution of social organization toward social networks and networked individualism (b) Online identity performance assertions of digital identity processes of identity formation

38. Glocalized Relationships Networked Individualism Bounded Groups (a) The evolution of social organization (from little boxes to social networks) neighborhoods households workplaces ??

39. Networked individualism Relationship unhinged from location Person-to-person connectivity (replacing place-to-place) Facilitating larger, more fragmented networks

40. Using technology to manage intimacy in larger, more fragmented social networks The email example Asynchronous Flexible Control Contact with multiple people

41. Social network sites Flexible, asynchronous communication + Leveraging our need to build and maintain relationships

42. Need for community Need to remain connected Need to retain and create common experience Need to engage peer opinion and build reputation

43. Personal information is at the heart of relationship This is how we create intimacy

44. Not basic identifiers or contact information Truly personal information Expressions of Self Preferences Graphic representations Affiliations Acts and activities Sexuality Identity

45. (b) Online identity performance Assertions of digital identity (all users) Process of identity formation (younger users)

46. Assertions of digital identity (all users) Traditional identity clues are not available

47. So we compensate Other clues More information More communication time Using networks to triangulate and authenticate (to overcome ease of manipulation)

48. Process of identity formation (younger users) Using digital space to … Work out identity and status Make sense of cultural clues and societal norms Negotiate public life

49. Part of this is taking risks Putting yourself out there Pushing boundaries Gauging reactions What is acceptable and what is not?

50. Just as with intimate relationships Personal information is at the heart of identity performance

51. Acts of articulation Text Images Audio Video Developing a virtual presence or identity.

52. and social networks get it all A little bit of personal information In exchange for services Lots of personal information Lots of personal information Lots and lots and lots and lots of personal information In exchange for ??? Database ?? ?? ??

53. Terms of Service and Privacy Policies * highlights *

58. And users consent to all of this …

59. So, what’s my point?

60. It’s not just immature and irresponsible kids Just say “no” Would you want your grandmother to read it! Would you post it in Times Square?

61. There are real, concrete reasons for posting so much personal information. They won’t simply “grow out of it”

63. Why they won’t work

66. “ If a person consents to most of these activities, there is no privacy violation.” Daniel J. Solove A Taxonomy of Privacy

68. What will work?

69. Goal Regulate privacy and Preserve the benefits of new social spaces (functionality)

70. Is it really a problem? How much of a problem is it? What do users really want?

71. Focus Emerging social norms of “ network” privacy

72. Regulating data-flow between networks Architecture/Design User-controlled partitions Technology Tagging data Contextual data Law Restrictions on downstream use and transfer Restrictions on network-crossing Data portability

73. Regulating data-use within networks The market is more likely to work The “Beacon” example Strengthened by portability Social norms will develop

74. Thank you.