John A. Rothchild
[email protected] November 6, 2018 VIA EMAIL:
[email protected] National Telecommunications and Information Administration U.S. Department of Commerce 1401 Constitution Avenue, NW Room 4725 Attn: Privacy RFC Washington, DC 20230 Re: Docket No. 180821780-8780-01 Dear Sir or Madam: Summary I write to make two principal points. First, when addressing the element of choice in a privacy regime based on notice and choice, policymakers should not limit their view to procedural considerations (whether choice should be implemented through an opt-in rather than an opt-out mechanism) but should also consider whether users are being presented with real choices. Given the current market structure consumers are offered choices in name only; in reality, they have no choice when it comes to giving up their PII. Second, under current conditions it is impossible for the notice element to serve its intended purpose. This is because the complexity of the ecosystem in which personally identifiable information (“PII”) is handled makes it impossible for the consumer (and even for the collector of PII) to know what the impact on the consumer will be if she chooses to release her PII to a commercial requestor. Introduction As the Request for Comments notes, the goal of most legal regimes aimed at protecting information privacy, both in the United States and abroad, is to assure that consumers are able to make rational choices about the disposition of their personal information after becoming informed about the consequences to them of either granting access to their information or declining to do so.1 In most such regimes, the mechanism that is relied upon to achieve this goal is called “notice and choice”: the consumer receives notice of how the entity seeking to collect personally identifiable information (“PII”) intends to use that PII, on the basis of which the consumer makes a choice about whether to allow collection of her PII.