understand how individuals and organizations make decisions about the protection and usage of individuals' data, and what are the consequences of those decisions.
In this document, we report on the economic implications of the protection and revelation of personal data. In particular, we present the evolution of the economic theory of privacy
(Section 2), we examine current privacy-related trade-os for data subjects and data holders
(Section 3), and we highlight the current economic debate on privacy protection (Section 4).
1.1 The Boundaries of the Economics of Privacy
Before commencing our analysis, we alert the reader of the boundaries inherent to an eco- nomic approach to the privacy debate. First of all, in the rest of the document our focus will be, primarily, on information privacy
- that is, on the issues associated with the collection and usage of individuals' personal information (Westin, 1970). We take this approach be- cause, while privacy is a multi-faceted concept, most of the relevant contemporary economic research focuses on consumers' data
. Our focus on informational privacy and consumer data, however, should not be construed as a denial of the existence of other dimensions to the pri- vacy debate, which may be more dicult to capture in economic terms (Solove (2006), for instance, distinguishes between privacy issues associated with the collection, processing, or dissemination of personal data, and privacy issues associated with personal invasions , such intrusion and decisional interference).
Second, the existence of such trade-os does not imply that the economic agents are always aware of them as they take decisions that will impact their privacy.
Third, the analysis of trade-os associated with the protection or revelation of individuals' data does not presume that all privacy trade-os have an explicit monetary dimension.
Rather, the economics of privacy tries to understand trade-os associated with the balancing of one's public and private spheres. Even a broader denition of privacy than the one we use in this report (for instance: a person's interest to keep certain activities, interests, or
4
thoughts to herself), can still be given an economic dimension: such interest protects the individual's psychological and physical well-being; psychological and physical well-being, in turn, can be interpreted in economic terms as sources of individual utility.
Fourth, there may be privacy dimensions that aect individuals' well-being and are not merely intangible, but in fact immeasurable: for instance, whereas the US legislator has taken an utilitarian approach to data protection, the European legislator has tended to dene privacy as a fundamental human right. As Samuelson (2000) notes, those who conceive of personal data protection as a fundamental civil liberty, see it as an interest essential to
\individual autonomy, dignity, and freedom in a democratic civil society," independently of the economic considerations we discuss in this report.
2 The Economic Theory of Privacy
In this section we highlight recent economic theories of privacy. We distinguish between theories that stress the welfare-diminishing impact of interrupting the ow of personal in- formation, and studies that arrive at opposite conclusions.
2.1 Privacy as Source of Economic Ineciencies
Economists have been writing about privacy since, at least, the 1970s. Within the neo- classical economic theory of perfectly competitive markets, \complete" information (the availability of relevant information to all market participants) leads to economic eciency: for instance, when all consumers know the prices at which every rm is selling its product, competition will drive those prices down to the lowest possible level made possible by the production technology, and will increase consumers' welfare.
Consequently, according to Chicago School's scholar Posner (1978, 1981), the protec- tion of privacy creates ineciencies in the marketplace, since it conceals potentially relevant information from other economic agents. Consider a job seeker who misrepresents her back-
5
ground and expertise to an hiring rm: Protecting the applicant's personal information will negatively aect the rm's hiring decision. Therefore, the protection of the former's privacy comes at the cost of the latter's protability. Hence, removing individuals' personal informa- tion from the marketplace through privacy regulation ultimately transfers the cost of that person's possible negative traits on other market players.
Another Chicago School economist, Stigler (1980), believes that governmental interfer- ence in the market of personal information is destined, at best, to remain ineective: since individuals have an interest in publicly disclosing favorable personal information and hid- ing negative traits, those who decide to protect their personal information (for instance, a debtor who does not want to reveal her credit history) are de facto signalling a negative trait. In this case, regulatory interventions blocking the ow of personal information would be redistributive and inecient: economic resources and productive factors would end up being used ineciently, or rewarded unfairly, because information about their quality has been removed from the marketplace.
More recently, Calzolari and Pavan (2006) nd that the unrestricted sharing of consumers' personal data between two rms may in fact reduce market distortions and increase social welfare, including the consumers'.
Along similar lines, Varian (1996) observes that consumers may suer privacy costs when too little personal information about them is being shared with third parties, rather than too much. The consumer, Varian notes, may rationally want certain information about herself known to other parties: for instance, a consumer may want her vacation preferences to be known by telemarketers, in order to receive from them oers and deals she may be actually interested in.
Also building upon a Chicago School's argument (the so-called Coase theorem), Noam
(1997) argues that whether or not a consumer's data will remain protected does not depend on the initial allocation of rights on personal information protection (such as whether or
6
not that consumer's data is protected by law). Instead, whether data will eventually get disclosed or protected ultimately depends on the relative valuations of the parties interested in that data. If the consumer values her privacy more than the data marketing rm values acquiring that consumer's data, the data will remain protected, because { even in absence of a law regulating that protection { the consumer would willingly pay for the right to protect her data.
2.2 Critiques of the Chicago School Arguments
Not all economists, however, have taken the stance that privacy protection inherently causes market ineciencies, or that consumers who value privacy can simply secure it in the mar- ketplace (Murphy, 1996). Hirshleifer (1980), for instance, criticizing Posner and Stigler's positions on privacy, notes that the assumptions of rational behavior underlying the Chicago
School's privacy models fail to capture the complexity of consumers' privacy decision making.
In fact, while the early Chicago School studies of privacy originated in what may be de ned a pre-ICT (modern Information and Communication Technologies) era, the develop- ment of new information technologies, and Internet in particular, led researchers to formulate more nuanced and granular views of the trade-os associated with privacy protection and data sharing.
Varian (1996), for instance, notes that the secondary usage of personal data raises par- ticular economic concerns: a consumer may rationally decide to share personal information with a rm because she expects to receive a net benet from that transaction; however, she has little knowledge or control upon how the rm will later use that data. The rm may sell the consumer's data to third parties at prot, but the consumer may not share any of that pro t, or may even bear a cost when the third party abuses her data (for instance, for spam, adverse price discrimination, and so forth; see Odlyzko (2003)). Such negative externality on the consumer is not internalized by the rm (Swire and Litan, 1998). Noam (1997) also
7
acknowledges that transaction costs, poverty, and other hurdles may not allow consumers to acquire privacy protection under standard market conditions.
Hermalin and Katz (2006) criticize the Chicago School's argument that privacy protection is inherently welfare-diminishing. They note that data protection may have ex ante positive eects on economic welfare. For instance, the protection of privacy can make it possible to support insurance schemes that otherwise would not exist. If all potential policy holders had to be tested for potentially fatal health condition, life insurance companies would adjust insurance prices according to the results of those tests. While the outcome would be ex post economically ecient (consumers would purchase insurances at actuarially fair rates), from ex ante the individual would bear the risks associated with the outcomes of their test results. However, if testing were banned, \then the competitive equilibrium would entail all risk-averse individuals buying full insurance at a common rate." Therefore, \[w]elfare would be greater than under the testing equilibrium both because the (socially wasteful) costs of testing would be avoided and because risk-averse individuals would bear less risk"
(Hermalin and Katz, 2006, p. 6). Furthermore, Hermalin and Katz (2006) note that markets may fail to adjust eciently to additional information, lowering the eciency of the resulting equilibrium. In their model, two rational agents engage in a transaction in which both are interested in collecting information about the other; privacy protection may actually lead to ecient allocation equilibria, and explicit prohibition of information transmission may be necessary for economic eciency (as the mere allocation of informational property rights may not suce).
Similarly, models by Hirshleifer (1971) and Taylor (2003) show that rational economic agents may end up ineciently over-investing in collecting personal information about other parties (for instance, in order to increase private revenues from sales based on knowledge of the buyer's willingness to pay). Taylor (2004) also nds that, in the presence of tracking technologies that allow merchants to infer consumers' preferences (and then engage in price
8
discrimination), whether or not the presence of privacy regulatory protection enhances con- sumer and aggregate welfare depends on the consumers' sophistication. Naive consumers do not anticipate the seller's ability to use past consumer information for price discrimination; therefore, in equilibrium all their surplus is taken away by the rms, unless privacy protection is enforced through regulation. Regulation, however, would not be necessary if consumers were aware of how merchants will exploit their data, and strategic enough to adapt their behavior accordingly. We discuss below (Section 4) why there are reasons to believe that consumers, in fact, act myopically when trading o the short term benets and long term costs of information revelation and privacy invasions.
Similar conclusions are reached by Acquisti and Varian (2005), who study a two-period model in which merchants have access to \tracking" technologies and consumers have access to \hiding" technologies. Internet commerce oers an example: merchants can use cookies to track consumer behavior (in particular, past purchases), and consumers have access to
\anonymizing" technologies (deleting cookies, using anonymous browsing or payment tools) that hide that behavior. Consumer tracking will enhance the merchant's prots only if the tracking is also used to provide consumers with enhanced, personalized services.
Other models, in addition to the privacy costs associated with price discrimination and the social welfare implications of sharing of consumer data with third parties, nd that the exploitation of personal information for unsolicited marketing can constitute a negative consumer externality (Hui and Png, 2003).
The majority of the theoretical economic work on privacy takes a micro-economic per- spective (see also Hui and Png (2005)). However, as we shall discuss further below (Section
3), signicant macro -economic costs and benets arise from the protection or trade of indi- vidual information. Furthermore, the possibility that Privacy Enhancing Technologies (or
PETs) may lead to non-zero sum market outcomes only recently has started being discussed in economic research: the usage of PETs may allow certain personal information to be shared
9
while other is protected, with common satisfaction of both data subjects and data holders
(see Acquisti (2008) and Section 4.4).
3 Benets and Costs of Disclosed and Protected Data
In this section, we discuss the economic value of personal data and personal privacy by analyzing the individual and social costs and benets associated with disclosed and protected.
In the context of our analysis, data subjects are consumers, and data holders are rms.
We will frame the analysis by presenting the market for personal data and the market for privacy as two sides of a same coin, wherein protected data may carry benets and costs that are dual, or specular, to the costs and benets associated with disclosed data for both data subjects and data holders. However, we do not attempt to provide a complete list and exhaustive taxonomy of all the possible types of costs and benets associated with protected and disclosed data.
By
disclosed data, we refer, rather loosely, to states in which the data subject may have knowingly or unknowingly shared data with other parties (the data holders), or states in which other parties may have entered in possession of the subject's data, independently of her knowledge or even consent.
1
By protected data, we similarly refer to situations in which such disclosures have not take place, independently of whether this may be due to the data subject's intentional protection of personal information, or the potential data holder being unable, or uninterested in, accessing the latter.
Primarily, we are interested in costs and benets trade-os that arise as a consequence of data having been disclosed or protected. Secondarily, we also consider the trade-os
1
In other words, we use the term \disclosed data" to include situations where the data has been collected by the data subject even without data subject's explicit action. Therefore, \disclosed" refers to a state of the data (its being known to the other party), rather than to the act of disclosing. Since our goal is not to create a rigorous taxonomy, but rather highlight exemplary trade-os, we will be somewhat loose about distinguishing the costs and benets associated with the collection, processing, dissemination, or further usage of personal data.
10
associated with the actual acts of disclosing (or collecting) data and protecting (or not disclosing) data.
Our approach is dual : disclosed personal information (that is, in our terminology, the lack of data protection) can result in economic benets for both data holders (savings, eciency gains, surplus extraction, increased revenues through consumer tracking) and data subjects
(personalization, targeted oers, and so forth); at the same time, such disclosures (that is, the lack of protection of personal data) can be costly for both rms (costs borne when that data is breached or misused, or collected in ways that consumers deem too intrusive) and consumers (identity theft, price discrimination, stigma or other psychological costs; see also
Stone and Stone (1990)). Furthermore, the act of collecting data can be costly for data holders (such as the investments necessary to build Customer Relationship Management systems). Similarly, protected data (that is, lack of data disclosure) can be associated with both bene ts and costs for data subjects and potential data holders; such benets and costs are often dual (i.e., the inverse) of the benets and costs highlighted above: for instance, data subjects and data holders incur opportunity costs when useful data is not disclosed (for in- stance, they may miss out on opportunities for increased eciency or increased convenience), although both parties may also benet in various ways (consumers, for instance, by reducing the expect costs of future identity theft; rms, for instance, by exploiting privacy-friendly stances for competitive advantage). Furthermore, there are costs associated with the act of protecting data (investments necessary to encrypt data for the data holders to prevent further disclosures; costs of using Privacy Enhancing Technologies for the data subject).
In the rest of this section, we provide examples of some of these trade-os for both data subjects and data holders.
11
3.1 Benets and Positive Externalities from Disclosed Data
Our analysis starts with the economic benets of disclosed data. We will focus on a) the potential benets of disclosed data for both data holders and data subjects. However, we will also mention b) the opportunity costs that may be suered when valuable information is not disclosed, as well as c) the costs of investments necessary to collect and process personal data. 3.1.1 Data Holders
The Benets of Disclosed Data.
In a prescient article published before the advent of the commercial Internet, Blattberg and Deighton (1991) wrote:
It's a marketer's dream - the ability to develop interactive relationships with individual customers. Technology, in the form of the database, is making this dream a reality. Now companies can keep track of customer preferences and tailor advertising and promotions to those needs. For instance, a grocery store system could note that you recently purchased a sample size of dishwashing detergent and could oer you a coupon to buy the large size.
What Blattberg and Deighton (1991) twenty years ago described as the future of in- teractive marketing in an age of adddressability has, today, become reality. Online, the combination of IP addresses, cookies, click-stream data, and deep packet inspection makes it possible to create accurate pictures of consumers' demographic traits and behavior. Of-

ine, credit reporting agencies and data aggregators purchase consumer data from private and public organizations, sanitize it, and combine it, in order to compile rich dossiers of consumers' information - credit and health histories, individual preferences, purchasing pat- terns - later sold (in both aggregate and individual forms) back to the public and private sectors. Combinations of online and oine individual data have also become possible - and
12
so has the tracking of online behavior across dierent websites or advertising networks, and the combination of online browsing and behavioral information together with self-disclosed personal information harvested from social media used by consumers. We live in a consumer data-driven and consumer data-focused commercial revolution, in which individuals are at the same time consumers and producers of a most valuable asset: their personal information.
Firms can signicantly benet from the ability to learn so much about their current, or potential, customers. Rich datasets of consumers can improve rms' marketing capabil- ities, boosting their ability to address specic target markets or customers, and lowering their advertising costs (Blattberg and Deighton, 1991). Firms can therefore increase rev- enues through targeted oers (Acquisti and Varian, 2005), innovative coupon strategies such
(consider, for instance, the recent success of initiatives such as
Groupon.com
(Pitta, 2010)), and improved CRM (Richards and Jones, 2008), as well as increased consumer loyalty (con- sumers' switching costs increase when a rm is able to use her information for personalized services; Ball et al. (2006)).
By analyzing large amounts of consumer data, rms are able to predict aggregate trends
(such as variations in consumer demand) as well as individuals' preferences (Linden et al.,
2003), thus minimizing inventory risks and maximizing returns on marketing investment.
They can improve their ability to oer useful recommendations to consumers (Bennett and
Lanning, 2007), as well as their ability to enforce prot-enhancing price discrimination (Var- ian, 1985). Furthermore, by observing individual behavior, rms can learn how to improve their services, or re-design it in order to take advantage of the observed behavior.
An example of how consumer information can be leveraged for higher prot is online advertising. E-commerce and online advertising now amount to $300 billion per year in the
US, providing employment to 3.1 million Americans (Deighton and Quelch, 2009). More than their oine counterparts, online ads can be targeted at each individual based on her online behavior (such as her searches, sites visited, clickstream data on a given site) and
13