Some lawmakers, seeking to hold companies accountable for the way they collect and profit from our personal information, are pushing a new idea: requiring companies to report a dollar value for the data they collect from us.
Some frame this reporting as a first step towards requiring companies to share with consumers the wealth our personal information generates for these companies. Yet knowing how much your personal information is worth to a company doesn’t actually protect your privacy—and the “pay for privacy” schemes that would probably follow from valuation reporting would actually harm it. What we need instead are strong laws to safeguard our privacy and prevent the reckless collection, use, and disclosure of our information.
Proposals to place a concrete dollar value on data and, by extension, on our privacy, have popped up across the country this year. Sens. Mark Warner (D-Va.) and Josh Hawley (R-Mo.) last month introduced the “Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data,” or DASHBOARD Act. It would require larger companies to report the value of customer data. Rep. Doug Collins (R-Ga.) recently proposed a bill to recognize consumer data as property. Companies pushed a bill with a similar concept in Oregon, which the ACLU of Oregon and EFF opposed, to directly pay people for the “value” of their health data as calculated by companies.
Assigning a value to your personal information might appear attractive, at first blush. Companies have grown rich off the insatiable collection of our personal information. It is tempting to demand a cut of the money they make from our clicks, our likes, and our networks of contacts.
But this is a mistake. If anything, assigning a dollar value may give the false impression that, at a value of $5, $30, or $200 for your personal information, the data collection companies’ conduct is no big deal. But a specific piece of information can be priceless in a particular context. Your location data may cost a company less than a penny to buy, yet cost you your physical safety if it falls into the wrong hands. Companies advertised lists of 1,000 people with different conditions such as anorexia, depression and erectile dysfunction for $79 per list. Such embarrassing information in the wrong hands could cost someone their job or their reputation.
Our information should not be thought of as our property this way, to be bought and sold like a widget. Privacy is a fundamental human right. It has no price tag. No person should be coerced or encouraged to barter it away. And it is definitely not a good deal for people to receive a handful of dollars in exchange for allowing companies’ invasive data collection to remain unchecked.
Privacy is a fundamental human right. It has no price tag.
No doubt companies that collect data should be more forthcoming about how they collect, share, sell, and use personal information. That’s why EFF supports laws requiring transparency about data collection, including the right to know the specific items of personal information companies have collected on you, and the specific third parties who received it—not just categorical descriptions of the general kinds of data and recipients. Users should have a legal right to obtain a copy of the data they have provided to an online service provider.
But while knowing the supposed value of your data itself is not harmful to consumers, it is difficult—if not completely impossible—to assess the true individual cost of losing control of that information.
Individuals are also poorly situated to understand the impact their single sale could have as part of a large-scale business practice—for themselves and our broader society. You may think nothing of sharing where you went to high school with a company. But the University of California-Berkeley has found that mortgage lenders, using proxy variables such as their high school, charge African American and Latinx homebuyers higher interest rates as compared with whites in similar financial situations. This research suggests the way companies use this information overcharges minority homeowners up to $500 million per year—and comes with the further social cost of dashing the dreams of between 74,000 and 1.3 million creditworthy minority applicants to own a home at all.
Associating the sale of personal information with income is also particularly dangerous for low-income families. Proponents of the Oregon pay-for-privacy bill suggested that that this would provide a new income stream for lower-income people. The truth is that pay-for-privacy creates a world where privacy is a luxury afforded only to those who can afford to protect their fundamental rights. EFF strongly opposes “pay-for-privacy” schemes, which discourage all people from exercising their right to privacy and creates classes of privacy “haves” and “have-nots.” Corporations should not be allowed to require a consumer to pay a premium, or waive a discount, in order to stop the corporation from vacuuming up and profiting from, the consumer’s personal information.
Some advocates of assigning data a monetary value also push the idea that privacy is dead—and that a “dividend” is the only way for consumers to claw back any benefit from a system designed to exploit them. In truth, we are seeing more momentum behind strong privacy legislation nationally and internationally than we have in years. We at EFF are nowhere near ready to give up on stronger privacy legislation. Nor should our country’s lawmakers.
Simply knowing the arbitrary “value” of our personal information to companies won’t fix our privacy problems. Requiring companies to respect everyone’s privacy rights—and giving individuals the power to hold those companies accountable when they don’t—will do much more. If lawmakers are serious about confronting the erosion of our privacy rights, they should set the idea of valuing data aside and instead pass strong privacy legislation.