Shortly after giving the keynote address at the U.S. Chamber of Commerce on Thursday, Alastair Mactaggart, the driving force behind the ballot initiative that become CCPA (California Consumer Privacy Act), sat down with me to answer a few questions. We discussed his speech, titled “The California Privacy Experience,” and other points related to the data privacy debate. Here is a summary of our discussion below:
Some research has shown that a generational difference exists regarding attitudes about data privacy. Why do you think younger generations are more comfortable exchanging their data for content and other services? Or are they even aware of this exchange?
AT: I’m not sure I agree with the findings of that research. If you look at who’s downloading adblockers — which work to block ads as well as keep a ton of personal information out of marketing databases — they are mainly installed by younger people who understand how to use them. When we did our focus groups at Californians for Consumer Privacy in preparation for the ballot initiative, we segregated by age and found no difference in attitude between younger and older people. Now, if you’re talking about someone who’s 12 or 13 years old, tweens and adolescents are not really aware of any exchange, and parents would really need to step in to monitor usage. But I don’t at all agree that a 20-something has any less concern about privacy than older generations.
Why do you think consumers choose to stay on platforms that they don’t trust to safeguard their data? At what point do you think they will decide to start leave those platforms?
AT: As I discussed in my keynote, Facebook offers a free internet service in many parts of the developing world in which mobile users are able to access the site free of data charges. As a result, two-thirds of the people in Nigeria think Facebook is the internet. Over 60% of people in India do too. So, if you have market dominance and your service is free, people are going to go with free.
In this country most people don’t understand that Instagram and WhatsApp are owned by Facebook, so if they think they are leaving Facebook, they aren’t. There also is a winner-take-all dynamic in the digital economy — the more people use the service, the better it gets. The more people search on Google, the more efficient Google gets. Facebook is good at connecting people because so many of us are all in the same place.
Now, we haven’t yet seen the full implications of GDPR going into effect in the EU, particularly regarding data portability. When it does, the ability for individuals to transfer information electronically may start to change this dynamic a bit and spur more competition. But right now, it’s difficult to enter the market and compete with these large platforms.
How should businesses and governments address the issue of public education about data privacy? How do we empower people to make educated decisions, and what role must consumers to play to make CCPA workable and effective?
AT: This is the whole conundrum when people talk about privacy — they say that people don’t take advantage of the tools given to them to take a more active role in managing their choices and that it’s an educational problem.
But right now, it’s so incredibly difficult for consumers to truly manage their privacy, which is why we are supportive of the development of a clear and simple opt-out button that works across platforms and publishers. We think consumers should have the right to opt out from all third-party data-sharing once and forget it. If consumers theoretically have a right to opt out, but it’s too difficult to execute, it doesn’t work. I’m a fan of making it easy and I believe the technology is available today to make that possible.
Data has the potential to improve the lives of the American public at large, as well as create economic opportunities and positive social impact. For example, beneficial uses of data for health care, logistics, urban planning, and more. Critics of CCPA have said it may potentially slow down or prevent such developments. How should lawmakers balance responsible stewardship and responsible innovation?
AT: I think this is a convenient sound bite. There’s nothing about innovation and data privacy that isn’t compatible. If you follow this argument through to the extreme, you’re basically saying that if consumers actually know what we are doing with data, they won’t give us permission — so don’t make us tell them and let us keep doing what we want.
Typically, if people have a relationship with a brand that they trust, they will allow more data use. If people understand what is happening with the data and are okay with it, then that’s fine. I just don’t believe this whole premise that you can’t have innovation and data privacy. Consumers understand a lot, and it’s disingenuous to say that if you give people the right to opt out, they will, so therefore we can’t give them the right. This logic is based on deception and reminds me of when food labeling was introduced in the early ‘90s. The packaged food industry said that if they were forced to put the ingredients on products, consumers wouldn’t buy them. What happened is that many either changed the ingredients (for the better), or consumers read the labels and decided to buy the processed foods anyway.
The tech industry, and the immense wealth created by a handful of companies, has monopolized much of the privacy discussion to date. Companies across every industry across the country are developing their own data strategies and data science capabilities to drive their businesses forward. Has the focus on tech become too myopic at this point?
AT: The focus of the privacy discussion has gravitated towards technology because this is where the most examples are – this is where the majority of aggressive digital tracking cases exist. The business of many tech companies is essentially commercial surveillance – they want to find out more and more about you so they can sell more advertising. If Google and Facebook track every visit — that’s clearly more aggressive than, say, what McDonald’s is doing. It’s also safe to say that breakfast cereal companies aren’t doing as much with consumer data right now, although you can argue that the supermarkets where they are sold are.
Everything is certainly moving in a data-driven direction, and as discussed at this event earlier today, many other traditional industries like financial services and insurance have basically become data and analytics companies that happen to sell credit cards and insurance. Which is exactly why CCPA doesn’t just target one industry.
Sure, Facebook and Google get more headlines right now because they are top-of-mind. There’s only limited bandwidth for the media and there’s certainly a lag, but a journey of 1,000 miles still starts with a single step. It’s a free world, and like many of the other businesspeople in attendance at the U.S. Chamber of Commerce today, I am a capitalist at heart. I only want more transparency, control, and accountability around how personal information is collected and used.
The information provided in this blog does not constitute legal advice. Please consult your legal counsel to obtain legal advice.