Privacy Before Profits - Is it Time for Data Fiduciaries?
Privacy Plus+
Privacy, Technology and Perspective
Privacy Before Profits - Is it Time for Data Fiduciaries? This week, we consider the idea of data fiduciaries introduced in the last legislative session in New York by State Senator Kevin Thomas, chair of the New York Senate's Committee on Consumer Protection. A link to NY Senate Bill S5642, entitled the “New York Privacy Act,” follows:
https://legislation.nysenate.gov/pdf/bills/2019/S5642
In its relevant part, the proposed New York Privacy Act provides:
§ 1102. Data fiduciary. Personal data of consumers shall not be used, processed or transferred to a third party, unless the consumer provides express and documented consent. Every legal entity, or any affiliate of such entity, and every controller and data broker, which collects, sells or licenses personal information of consumers, shall exercise the duty of care, loyalty and confidentiality expected of a fiduciary with respect to securing the personal data of a consumer against a privacy risk; and shall act in the best interests of the consumer, without regard to the interests of the entity, controller or data broker, in a manner expected by a reasonable consumer under the circumstances.
Privacy before profits – it’s a novel and potentially transformative concept. It recognizes the disparity of power between consumers who cede their personal information and the companies that process it for profit. It moves beyond the regular “notice and consent” privacy law model, and, we think, properly recognizes that consumers cannot meaningfully consent to how many of these companies are using algorithms to gain a competitive advantage or to shape consumers’ lives.
Indeed, algorithms shape our lives in previously unimaginable ways—personally tailoring our search results and our newsfeeds, and influencing our votes and social circles. Once we give up our personal information to companies, therefore, those companies take control. The imposition of fiduciary obligations on those companies to “act in the best interests of the consumer” would place primacy on privacy over profit. This is especially important because as we have previously written, we believe that privacy itself is foundational to a free society. You can read our post here:
https://www.hoschmorris.com/privacy-plus-news/the-true-value-of-privacy
If correctly applied, the concept of data fiduciaries could redress the risks to free society posed by information asymmetry between companies and “data subjects”, and ultimately reduce abuses associated predictive technologies and surveillance, among other things.
What we wonder, however, is whether the protection of privacy requires that the recognition of a fiduciary relationship extend beyond data controllers and data brokers to all major data processors, like cloud-based software, platform, and infrastructure providers. If it did, privacy would collide with the antitrust concerns that have been raised in relation to Facebook, Amazon, and others. You can read our post about privacy and antitrust by clicking on the following link, and then taking a deeper dive by clicking on the links in that post:
https://www.hoschmorris.com/privacy-plus-news/privacy-plus-may-11-2019
Facebook and Amazon Web Services as fiduciaries — it is a funny idea, isn’t it? However, it does make us question whether the targeted-advertising practices of the AdTech industry would be adequately addressed under the proposed New York Privacy Act.
More on that next week…
---
Hosch & Morris, PLLC is a Dallas-based boutique law firm dedicated to data protection, privacy, the Internet and technology. Open the Future℠.