Consumer privacy is
information privacy
Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data pr ...
as it relates to the consumers of products and services.
A variety of social, legal and political issues arise from the interaction of the public's potential
expectation of privacy
Expectation of privacy is a legal test which is crucial in defining the scope of the applicability of the privacy protections of the Fourth Amendment to the United States Constitution. It is related to, but is not the same as, a ''right to privacy ...
and the collection and dissemination of
data
In the pursuit of knowledge, data (; ) is a collection of discrete values that convey information, describing quantity, quality, fact, statistics, other basic units of meaning, or simply sequences of symbols that may be further interpreted ...
by
business
Business is the practice of making one's living or making money by producing or Trade, buying and selling Product (business), products (such as goods and Service (economics), services). It is also "any activity or enterprise entered into for pr ...
es or
merchant
A merchant is a person who trades in commodities produced by other people, especially one who trades with foreign countries. Historically, a merchant is anyone who is involved in business or trade. Merchants have operated for as long as indust ...
s.
Consumer
A consumer is a person or a group who intends to order, or uses purchased goods, products, or services primarily for personal, social, family, household and similar needs, who is not directly related to entrepreneurial or business activities. T ...
privacy concerns date back to the first commercial
courier
A courier is a person or organisation that delivers a message, package or letter from one place or person to another place or person. Typically, a courier provides their courier service on a commercial contract basis; however, some couriers are ...
s and bankers who enforced strong measures to protect customer privacy. In modern times, the
ethical code
Ethical codes are adopted by organizations to assist members in understanding the difference between right and wrong and in applying that understanding to their decisions. An ethical code generally implies documents at three levels: codes of bus ...
s of various professions specify measures to protect customer privacy, including
medical privacy
Medical privacy or health privacy is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also ...
and
client confidentiality
Client confidentiality is the principle that an institution or individual should not reveal information about their clients to a third party without the consent of the client or a clear legal reason. This concept, sometimes referred to as social s ...
. State interests include matters of
national security
National security, or national defence, is the security and defence of a sovereign state, including its citizens, economy, and institutions, which is regarded as a duty of government. Originally conceived as protection against military atta ...
. Consumer concerned about the invasion of individual information, thus doubtful when thinking about using certain services. Many organizations have a competitive incentive to collect, retain, and use customer data for various purposes, and many companies adopt
security engineering
Security engineering is the process of incorporating security controls into an information system so that the controls become an integral part of the system’s operational capabilities. It is similar to other systems engineering activities in tha ...
measures to control this data and manage customer expectations and legal requirements for consumer privacy.
Consumer privacy protection is the use of laws and regulations to protect individuals from privacy loss due to the failures and limitations of corporate customer privacy measures. Corporations may be inclined to share data for commercial advantage and fail to officially recognize it as sensitive to avoid
legal liability
In law, liable means "responsible or answerable in law; legally obligated". Legal liability concerns both civil law and criminal law and can arise from various areas of law, such as contracts, torts, taxes, or fines given by government agenci ...
in the chance that lapses of security may occur. Modern consumer privacy law originated from telecom regulation when it was recognized that a
telephone company
A telephone company, also known as a telco, telephone service provider, or telecommunications operator, is a kind of communications service provider (CSP), more precisely a telecommunications service provider (TSP), that provides telecommunicat ...
had access to unprecedented levels of information. Customer privacy measures were seen as deficient to deal with the many hazards of corporate
data sharing
Data sharing is the practice of making data used for scholarly research available to other investigators. Many funding agencies, institutions, and publication venues have policies regarding data sharing because transparency and openness are consid ...
,
corporate mergers,
employee turnover
In human resources, turnover is the act of replacing an employee with a new employee. Partings between organizations and employees may consist of termination, retirement, death, interagency transfers, and resignations.Trip, R. (n.d.). Turnover-S ...
, and theft of data storage devices (e.g.,
hard drives
A hard disk drive (HDD), hard disk, hard drive, or fixed disk is an electro-mechanical data storage device that stores and retrieves digital data using magnetic storage with one or more rigid rapidly rotating platters coated with magne ...
) that could store a large amount of data in a portable location.
Businesses have consumer data and information obtained from consumer and client purchases, products, and services. Thus, businesses have the responsibility to keep these data and information safe and confidential. Consumers expect that businesses will take an active stance when protecting consumer privacy issues and supporting confidential agreements. Whether a firm provides services or products to consumers, firms are expected to use methods such as obfuscation or encoding methods to cover up consumer data when analyzing data or trends for example. Firms are also expected to protect consumer privacy both within the organizations themselves and from outside third entities including third party providers of services, suppliers who provide product components and supplies, and government institutions or community partnership organizations. In addition, businesses are sometime required to provide an agreement/contract to service clients or product consumer that states customer or client information and data will be kept confidential and that it will not be used for advertising or promotional purposes for example. The US government, including the FTC, have consumer protection laws like The Telephone Consumer Protection Act and Data Transparency and Privacy Act. Individuals States have laws and regulation that protect consumers as well. One example of this is The California Consumer Privacy Act.
Legislation
Consumer privacy concerns date back to the first commercial
courier
A courier is a person or organisation that delivers a message, package or letter from one place or person to another place or person. Typically, a courier provides their courier service on a commercial contract basis; however, some couriers are ...
s and
bank
A bank is a financial institution that accepts deposits from the public and creates a demand deposit while simultaneously making loans. Lending activities can be directly performed by the bank or indirectly through capital markets.
Because ...
ers who enforced strong measures to protect customer privacy. Harsh punitive measures were passed as the result of failing to keep a customer's information private. In modern times, the
ethical code
Ethical codes are adopted by organizations to assist members in understanding the difference between right and wrong and in applying that understanding to their decisions. An ethical code generally implies documents at three levels: codes of bus ...
s of most professions specify privacy measures for the consumer of any service, including
medical privacy
Medical privacy or health privacy is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also ...
,
client confidentiality
Client confidentiality is the principle that an institution or individual should not reveal information about their clients to a third party without the consent of the client or a clear legal reason. This concept, sometimes referred to as social s ...
, and
national security
National security, or national defence, is the security and defence of a sovereign state, including its citizens, economy, and institutions, which is regarded as a duty of government. Originally conceived as protection against military atta ...
. These codes are particularly important in a
carceral state
The concept of a carceral archipelago was first used by the French historian and philosopher Michel Foucault in his 1975 publication, '' Surveiller et Punir'', to describe the modern penal system of the 1970s, embodied by the well-known penal ins ...
, where no privacy in any form nor limits on
state
State may refer to:
Arts, entertainment, and media Literature
* ''State Magazine'', a monthly magazine published by the U.S. Department of State
* ''The State'' (newspaper), a daily newspaper in Columbia, South Carolina, United States
* ''Our S ...
oversight or data use exists. ''Corporate customer privacy practices'' are approaches taken by commercial organizations to ensure that confidential customer data is not stolen or abused.
Since most organizations have strong competitive incentives to retain exclusive access to customer data, and since customer trust is usually a high priority, most companies take some
security engineering
Security engineering is the process of incorporating security controls into an information system so that the controls become an integral part of the system’s operational capabilities. It is similar to other systems engineering activities in tha ...
measures to protect customer privacy. There is also a concern that companies may sell consumer data if they have to declare bankruptcy, although it often violates their own privacy policies.
[
The measures companies take to protect consumer privacy vary in effectiveness, and would not typically meet the much higher standards of ]client confidentiality
Client confidentiality is the principle that an institution or individual should not reveal information about their clients to a third party without the consent of the client or a clear legal reason. This concept, sometimes referred to as social s ...
applied by ethical code
Ethical codes are adopted by organizations to assist members in understanding the difference between right and wrong and in applying that understanding to their decisions. An ethical code generally implies documents at three levels: codes of bus ...
s or legal code
A code of law, also called a law code or legal code, is a systematic collection of statutes. It is a type of legislation that purports to exhaustively cover a complete system of laws or a particular area of law as it existed at the time the cod ...
s in banking
A bank is a financial institution that accepts deposits from the public and creates a demand deposit while simultaneously making loans. Lending activities can be directly performed by the bank or indirectly through capital markets.
Because ...
or law
Law is a set of rules that are created and are enforceable by social or governmental institutions to regulate behavior,Robertson, ''Crimes against humanity'', 90. with its precise definition a matter of longstanding debate. It has been vario ...
, nor patient privacy
Medical privacy or health privacy is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also ...
measures in medicine, nor rigorous national security
National security, or national defence, is the security and defence of a sovereign state, including its citizens, economy, and institutions, which is regarded as a duty of government. Originally conceived as protection against military atta ...
measures in military and intelligence organizations. The California Consumer Privacy Act, for example, protects the use of consumer privacy data by firms and governments. This act makes it harder for firms to extract personal information from consumers and use it for commercial purposes. Since companies operate to generate a profit, commercial organizations also cannot spend unlimited funds on precautions while remaining competitive; a commercial context tends to limit privacy measures and to motivate organizations to share data when working in partnership. The damage done by privacy loss is not measurable, nor can it be undone, and commercial organizations have little or no interest in taking unprofitable measures to drastically increase the privacy of customers. Corporations may be inclined to share data for commercial advantage and fail to officially recognize it as sensitive to avoid legal liability in the chance that lapses of security may occur. This has led to many moral hazard
In economics, a moral hazard is a situation where an economic actor has an incentive to increase its exposure to risk because it does not bear the full costs of that risk. For example, when a corporation is insured, it may take on higher risk ...
s and customer privacy violation
The right to privacy is an element of various legal traditions that intends to restrain governmental and private actions that threaten the privacy of individuals. Over 150 national constitutions mention the right to privacy. On 10 December 194 ...
incidents.
Some services—notably telecommunications
Telecommunication is the transmission of information by various types of technologies over wire, radio, optical, or other electromagnetic systems. It has its origin in the desire of humans for communication over a distance greater than that fe ...
, including Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
—require collecting a vast array of information about users' activities in the course of business, and may also require consultation of these data to prepare bills. In the US and Canada, telecom data must be kept for seven years to permit dispute and consultation about phone charges. These sensitivities have led telecom regulation to be a leader in consumer privacy regulation, enforcing a high level of confidentiality on the sensitive customer communication records. The focus of consumer rights activists on the telecoms industry has super-sided as other industries also gather sensitive consumer data. Such common commercial measures as software-based customer relationship management
Customer relationship management (CRM) is a process in which a business or other organization administers its interactions with customers, typically using data analysis to study large amounts of information.
CRM systems compile data from a ra ...
, rewards programs, and target market
A target market, also known as serviceable obtainable market (SOM), is a group of customers within a business's serviceable available market at which a business aims its marketing efforts and resources. A target market is a subset of the total ma ...
ing tend to drastically increase the amount of information gathered (and sometimes shared). These very drastically increase privacy risks and have accelerated the shift to regulation, rather than relying on the corporate desire to preserve goodwill.
Concerns have led to consumer privacy laws in most countries, especially in the European Union
The European Union (EU) is a supranational political and economic union of member states that are located primarily in Europe. The union has a total area of and an estimated total population of about 447million. The EU has often been des ...
, Australia
Australia, officially the Commonwealth of Australia, is a Sovereign state, sovereign country comprising the mainland of the Australia (continent), Australian continent, the island of Tasmania, and numerous List of islands of Australia, sma ...
, New Zealand
New Zealand ( mi, Aotearoa ) is an island country in the southwestern Pacific Ocean. It consists of two main landmasses—the North Island () and the South Island ()—and over 700 smaller islands. It is the sixth-largest island count ...
and Canada
Canada is a country in North America. Its ten provinces and three territories extend from the Atlantic Ocean to the Pacific Ocean and northward into the Arctic Ocean, covering over , making it the world's second-largest country by tot ...
. Notably, among developed countries, the United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
has no such law and relies on corporate customer privacy disclosed in privacy policies to ensure consumer privacy in general. Modern privacy law and regulation may be compared to parts of the Hippocratic Oath
The Hippocratic Oath is an oath of ethics historically taken by physicians. It is one of the most widely known of Greek medical texts. In its original form, it requires a new physician to swear, by a number of healing gods, to uphold specific e ...
, which includes a requirement for doctors to avoid mentioning the ills of patients to others—not only to protect them, but to protect their families— and also recognizes that innocent third parties can be harmed by the loss of control of sensitive personal information.
Modern consumer privacy law originated from telecom regulation when it was recognized that a telephone company
A telephone company, also known as a telco, telephone service provider, or telecommunications operator, is a kind of communications service provider (CSP), more precisely a telecommunications service provider (TSP), that provides telecommunicat ...
—especially a monopoly
A monopoly (from Greek language, Greek el, μόνος, mónos, single, alone, label=none and el, πωλεῖν, pōleîn, to sell, label=none), as described by Irving Fisher, is a market with the "absence of competition", creating a situati ...
(known in many nations as a PTT)—had access to unprecedented levels of information: the direct customer's communication habits and correspondents and the data of those who shared the household. Telephone operators could frequently hear conversations—inadvertently or deliberately—and their job required them to dial the exact numbers. The data gathering required for the process of billing began to become a privacy risk as well. Accordingly, strong rules on operator behaviour, customer confidentiality, records keeping and destruction were enforced on telephone companies in every country. Typically only police and military authorities had legal powers to wiretap
Telephone tapping (also wire tapping or wiretapping in American English) is the monitoring of telephone and Internet-based conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitorin ...
or see records. Even stricter requirements emerged for various banks' electronic records. In some countries, financial privacy
Banking secrecy, alternately known as financial privacy, banking discretion, or bank safety,Guex (2000), p. 240 is a conditional agreement between a bank and its clients that all foregoing activities remain secure, confidential, and private. Mos ...
is a major focus of the economy, with severe criminal penalties for violating it.
History
1970s
Through the 1970s, many other organizations in developed nation
A developed country (or industrialized country, high-income country, more economically developed country (MEDC), advanced country) is a sovereign state that has a high quality of life, developed economy and advanced technological infrastruct ...
s began to acquire sensitive data, but there were few or no regulations in place to prevent them from sharing or abusing the data. Customer trust and goodwill were generally thought to be sufficient in first-world countries, notably the United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
, to ensure the protection of truly sensitive data; ''caveat emptor
''Caveat emptor'' (; from ''caveat'', "may he/she beware", a subjunctive form of ''cavēre'', "to beware" + ''ēmptor'', "buyer") is Latin for "Let the buyer beware". It has become a proverb in English. Generally, ''caveat emptor'' is the contrac ...
'' was applied in these situations. But in the 1980s, smaller organizations also began to get access to computer hardware and software, and these simply did not have the procedures or personnel or expertise, nor less the time, to take rigorous measures to protect their customers. Meanwhile, via target marketing
A target market, also known as serviceable obtainable market (SOM), is a group of customers within a business's serviceable available market at which a business aims its marketing efforts and resources. A target market is a subset of the total m ...
and rewards programs
A loyalty program is a marketing strategy designed to encourage customers to continue to shop at or use the services of a business associated with the program. Today, such programs cover most types of commerce, each having varying features and ...
, companies were acquiring ever more data.
Gradually, customer privacy measures were seen as deficient to deal with the many hazards of corporate data sharing, corporate mergers, employee turnover
In human resources, turnover is the act of replacing an employee with a new employee. Partings between organizations and employees may consist of termination, retirement, death, interagency transfers, and resignations.Trip, R. (n.d.). Turnover-S ...
, and theft of data storage devices (e.g. hard drives
A hard disk drive (HDD), hard disk, hard drive, or fixed disk is an electro-mechanical data storage device that stores and retrieves digital data using magnetic storage with one or more rigid rapidly rotating platters coated with magne ...
) that could store a large amount of data in a portable location. Explicit regulation of consumer privacy gained further support, especially in the European Union
The European Union (EU) is a supranational political and economic union of member states that are located primarily in Europe. The union has a total area of and an estimated total population of about 447million. The EU has often been des ...
, where each nation had laws that were incompatible (e.g., some restricted the data collection
Data collection or data gathering is the process of gathering and measuring information on targeted variables in an established system, which then enables one to answer relevant questions and evaluate outcomes. Data collection is a research com ...
, the data compilation and the data dissemination
Data dissemination is the distribution or transmitting of statistical, or other, data to end users. There are many ways organizations can release data to the public, i.e. electronic format, CD-ROM and paper publications such as PDF files based ...
); it was possible to violate privacy within the EU simply doing these things from different places in the European Common Market as it existed before 1992.
1990s
Through the 1990s, the proliferation of mobile telecom, the introduction of customer relationship management
Customer relationship management (CRM) is a process in which a business or other organization administers its interactions with customers, typically using data analysis to study large amounts of information.
CRM systems compile data from a ra ...
, and the use of the Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
in developed nation
A developed country (or industrialized country, high-income country, more economically developed country (MEDC), advanced country) is a sovereign state that has a high quality of life, developed economy and advanced technological infrastruct ...
s brought the situation to the forefront, and most countries had to implement strong consumer privacy laws, often over the objections of business. The European Union
The European Union (EU) is a supranational political and economic union of member states that are located primarily in Europe. The union has a total area of and an estimated total population of about 447million. The EU has often been des ...
and New Zealand
New Zealand ( mi, Aotearoa ) is an island country in the southwestern Pacific Ocean. It consists of two main landmasses—the North Island () and the South Island ()—and over 700 smaller islands. It is the sixth-largest island count ...
passed particularly strong laws that were used as a template for more limited laws in Australia
Australia, officially the Commonwealth of Australia, is a Sovereign state, sovereign country comprising the mainland of the Australia (continent), Australian continent, the island of Tasmania, and numerous List of islands of Australia, sma ...
and Canada
Canada is a country in North America. Its ten provinces and three territories extend from the Atlantic Ocean to the Pacific Ocean and northward into the Arctic Ocean, covering over , making it the world's second-largest country by tot ...
and some states of the United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
(where no federal law for consumer privacy exists, although there are requirements specific to banking and telecom privacy). In Austria
Austria, , bar, Östareich officially the Republic of Austria, is a country in the southern part of Central Europe, lying in the Eastern Alps. It is a federation of nine states, one of which is the capital, Vienna, the most populous ...
around the 1990s, the mere mention of a client's name in a semi-public social setting was enough to earn a junior bank executive a stiff jail sentence.
2000s
After the terrorist attacks
The following is a list of terrorist incidents that have not been carried out by a state or its forces (see state terrorism and state-sponsored terrorism). Assassinations are listed at List of assassinated people.
Definitions of terrori ...
against the United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
on September 11, 2001
The September 11 attacks, commonly known as 9/11, were four coordinated suicide terrorist attacks carried out by al-Qaeda against the United States on Tuesday, September 11, 2001. That morning, nineteen terrorists hijacked four commerc ...
, privacy took a back-seat to national security
National security, or national defence, is the security and defence of a sovereign state, including its citizens, economy, and institutions, which is regarded as a duty of government. Originally conceived as protection against military atta ...
in legislators' minds. Accordingly, concerns of consumer privacy in the United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
have tended to go unheard of as questions of citizen privacy versus the state, and the development of a police state
A police state describes a state where its government institutions exercise an extreme level of control over civil society and liberties. There is typically little or no distinction between the law and the exercise of political power by the exe ...
or carceral state
The concept of a carceral archipelago was first used by the French historian and philosopher Michel Foucault in his 1975 publication, '' Surveiller et Punir'', to describe the modern penal system of the 1970s, embodied by the well-known penal ins ...
, have occupied advocates of strong privacy measures. Whereas it may have appeared prior to 2002 that commercial organizations and the consumer data they gathered were of primary concern, it has appeared since then in most developed nation
A developed country (or industrialized country, high-income country, more economically developed country (MEDC), advanced country) is a sovereign state that has a high quality of life, developed economy and advanced technological infrastruct ...
s to be much less of a concern than political privacy
The secret ballot, also known as the Australian ballot, is a voting method in which a voter's identity in an election or a referendum is anonymous. This forestalls attempts to influence the voter by intimidation, blackmailing, and potential vote ...
and medical privacy
Medical privacy or health privacy is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also ...
(e.g., as violated by biometrics
Biometrics are body measurements and calculations related to human characteristics. Biometric authentication (or realistic authentication) is used in computer science as a form of identification and access control. It is also used to identify in ...
). Indeed, people have recently been stopped at airports solely due to their political views, and there appears to be minimal public will to stop practices of this nature. The need for stricter laws is more pronounced after the American web service provider, Yahoo admitted that sensitive information (including email addresses and passwords) of half a billion users was stolen by hackers in 2014. The data breach was a massive setback for the company and raised several questions about the revelation of the news after two years of the hacking incident.
See also
* Big data
Though used sometimes loosely partly because of a lack of formal definition, the interpretation that seems to best describe Big data is the one associated with large body of information that we could not comprehend when used only in smaller am ...
* Information privacy
Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data pr ...
* Information technology management
Information technology management or IT management is the discipline whereby all of the information technology resources of a firm are managed in accordance with its needs and priorities. Managing the responsibility within a company entails many o ...
* Management information systems
A management information system (MIS) is an information system used for decision-making, and for the coordination, control, analysis, and visualization of information in an organization. The study of the management information systems involves peop ...
* Privacy
Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.
The domain of privacy partially overlaps with security, which can include the concepts of a ...
* Privacy law
Privacy law is the body of law that deals with the regulating, storing, and using of personally identifiable information, personal healthcare information, and financial information of individuals, which can be Personally identifiable information ...
* Privacy policy
A privacy policy is a statement or legal document (in privacy law) that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Personal information can be anything that can be used to identif ...
* Personally identifiable information
Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person.
The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates ha ...
References
{{Reflist
Consumer
E-commerce
Privacy