Proposed: A Choice-Based Approach to Controlling the Commercial Exploitation of Personal Data

By Dennis D. McDonald

Today significant commercial trafficking occurs in personal information. Credit bureaus, research companies, insurance firms, and corporations regularly buy and sell personal information. While much of this trafficking may be benign, most is either unknown to, or beyond the control of, the individuals this personal information describes.

Such information derives its value through its association with individuals who are of interest to these organizations. Individuals may not share directly in the commercial value associated with such transactions. This can happen when personal data are sold by data vendors to marketers intent on selling to individuals with specific demographic, medical, purchase history, or financial profiles. In addition, the danger of unauthorized or unwarranted "spills" of this information is a constant concern, as was shown recently by revelations that personal data being sold by one company had been unwittingly sold to crooks.

Privacy advocates and others are concerned about the lack of control individuals have over how their personal information is bought and sold. At the same time, legitimate arguments can be made that some businesses require access to certain types of personal information in order to operate and thereby provide value to their customers and stockholders.

This and subsequent documents describe a proposal to address this lack of control. The basis for this proposal is that significant benefits would accrue to both individuals and society were systems and processes available that provide the following features:

1. Recognition that individuals own and/or have the right to control certain types of personal identification and behavioral information
   
2. Availability of a mechanism for individuals to decide and legally state what, if any, of their information can be made commercially available
   
3. Availability of a mechanism for commercial entities to discover what personal information is available for commercial use
   
4. Availability of a mechanism for companies to pay individuals when commercial benefit is derived from the commercial exploitation of personal information
   

Understandably there are practical, legal, ethical, technical, and social issues that such an approach to controlling access to personal data would raise. I shall attempt to address these issues in subsequent documents.

Comments

[Shashi Bellamkonda]

I agree with this totally "Availability of a mechanism for companies to pay individuals when commercial benefit is derived from the commercial exploitation of personal information"

if my info is sold I want to get a piece of it :)

Thanks,

Shashi