Privacy Commitments

What responsibilities do corporations have with regard to their consumers’ information? Many articles have looked at ways to make personal information the “property” of the consumer. Property approaches attempt to overlay personal information on the legal frameworks of trade secret, trademark, and copyright law. While each approach has its merits, and contributes to the field, none of the proposals generate a concrete way for a consumer to enforce his or her rights against a company. The proposals all suffer from the same fatal flaw, a new system must not just create a consumer right but also balance the inequities in bargaining power between a consumer and a large corporation. In patent law, there are similar conflicts of interest between a private property owner’s (patent holder’s) right to create a successful business and the ability of others (potential patent licensees) to negotiate a reasonable royalty rate. In response to this conflict, the patent field relies upon a self-regulatory system where patent holders agree to be “Reasonable and Non-Discriminatory” in their licensing practices. This system produces two concrete benefits. First, it helps correct the power imbalance between two negotiating parties. Second, it creates a third-party breach of contract right for a party who could not normally bring a case. As a process, a patent holder agrees to Reasonable and Non-Discriminatory practices (“RAND”) with a standards-setting organization. Then, if the patent holder does not reasonably license their patent to a third party who wishes to negotiate for said license, the third party can sue the patent holder, even though the two parties never finalized an agreement. This paper argues a similar system would lend much-needed structure to online data use. Creating a voluntary, quasi-self-regulatory regime would allow greater transparency as to corporate data practices, facilitate the creation of industry standards as to “reasonable” data use, balance the interests of corporation and consumer, and create a legal right for consumers who have had their personal data misused (in a way that could more easily support a classaction). The paper proceeds in four parts. The first part looks at current norms of data use and the issues a proposed system would need to address. The second part reviews and summarizes past intellectual property approaches to privacy, as well as each approach’s respective drawbacks. The third part examines RAND commitments and their operation in the realm of patent law. The fourth part discusses a system for implementing RAND commitments in privacy law, and addresses potential benefits and drawbacks of the approach