Benjamin Wittes and Wells Bennett grapple with difficult legal questions surrounding personal privacy and “databuse,” (negligent handling, collection, or misuse of personal information) in the era of big data. Wittes and Bennett seek to define the data protection obligations of for-profit companies, with respect to the handling of individual data, when they receive that data in the course of providing services to consumers without financial charge. These scholars attempt to identify core user data protections.
The paper has four key sections:
- A summary of reasons for why “privacy” is too broad a vocabulary for discussing corporate responsibilities and consumer protection when it comes to personal data.
- An attempt to redefine the concept of privacy, by focusing on the effects of “databuse” – the malicious, reckless, negligent, or unjustified handling, collection, or use of a person’s data in a fashion adverse to that person’s interests and in the absence of that person’s knowing consent – and how corporations should play a trustee role in managing their customer’s data.
- A description of what trusteeship ought to look like in a first-party, services-in-exchange-for-data setting. Here Wittes and Bennett envision three categories of corporate uses of consumer data—one in which the interests of the corporation and that of the consumer are congruent, one in which the corporation benefits but the consumer does not suffer, and one in which the corporation benefits at the expense of the consumer’s interests—and argue that private and public sanctions are best reserved for the third category.
- An analysis of current enforcement methods.
Consumers, governments and companies need more guidance than the broad concept of privacy—which incorporates such a huge range of potential obligations—often can meaningfully furnish, these scholars argue. At the same time, the costs of a sweeping “privacy” approach may well be to stifle and impede the delivery of services large numbers of people actually want. Wittes and Bennett conclude that the concept of databuse can be a useful tool to sharpen the focus of corporate obligations and the reach of government regulation.