Personal Privacy in an Information Society. The Cost of Privacy

07/12/1997

The fourth competing interest the Commission identified is cost. In maximizing fairness, this is the most compelling competing interest. Whether an organization is public or private, to make changes in record keeping practices can increase its cost of operation and thus make the product or service it provides either more expensive or less accessible, or both. When this happens, both the record-keeping organization and some if not all of its customers or clients suffer. Adoption of the Commission's recommendations means that a great many organizations will have to make some changes in their record keeping. The costs of compliance will be higher or lower depending on how well an organization's current practices reflect the recommended balance between organizational interests and the individual's interest. The Commission has tried to keep compliance costs to a minimum by not recommending that organizations be required to report periodically to Federal or State government agencies, and also by not recommending inflexible procedural requirements.

The Commission's recommendations are, aimed at getting results. Thus, they try to take advantage of the shared` interest of individuals and organizations in keeping records accurate, timely, and complete. As previously noted, one reason for giving an individual a right of access to records about him is that doing so affords an organization the free help of an expert the individual himself on the accuracy of the information the organization uses to make decisions about him. Organizations, however, need some assurance before they are will mg to enlist such help that it will not turn out to be unduly or undeservedly expensive.

To open an insurance company's underwriting files to inspection by applicants and policyholders, for example, gives the company a powerful motive to record oily accurate, pertinent information about them and to keep its records as timely and complete as necessary. To encourage applicants and policyholders to look for information in underwriting files that could serve as the basis for defamation actions and windfall recoveries, however, would be contrary to the Commission's cost minimizing objective and also an impediment to systemic reform. The Commission wants organizations to invest in improving their record keeping practices, not to spend their money in costly litigation over past practices and honest mistakes. Hence the Commission's recommendation is to limit the liability of a record keeper that responds to an individual's request for access to a record it maintains about him.

Organizations in the private sector have a strong interest in keeping their decisions about customers, clients, applicants, or employees free of unreasonable government interference. The Commission's recommendations recognize this interest by concentrating on the quality of the information an organization uses as the basis for making a decision about an individual, rather than on the decision itself. For private sector organizations the adverse decision requirements the Commission recommends will expose the records used in arriving at a decision to reject an applicant, but the Commission relies on the incentives of the marketplace to prompt reconsideration of a rejection if it turns out to have been made on the basis of inaccurate or otherwise defective information.

For public sector organizations, the Commission recommends no affirmative requirement that they reverse an adverse decision made on the basis of faulty information. For educational institutions, where the procedures for correcting or amending records are likely to be divorced from decision making procedures, and where the individual has no easily envocable due process protections, the Commission proposes an affirmative requirement to reconsider but not a requirement to reverse. The Commission strongly believes that to mix concern about the outcome of individual decisions with concern about the quality of the information used in arriving at them not only risks undesirable interference with organizational prerogatives but also invites confusion as to the nature and extent of the individual's privacy interest, possibly to its detriment in the long run.