From: <njh2102@columbia.edu>
  To  : <cpc@emoglen.law.columbia.edu>
  Date: Thu, 12 May 2005 17:01:31 -0400

Paper 2

Paper 2: Increasing Data Protection through Arbitration

Throughout this class, we’ve discussed a multitude of
constitutional, statutory and regulatory models for mitigating the
damages caused by data surveillance.  All of them have real merit
and provide a foundation for battling the problems created by data
warehouses and data tracking technology.  We probably need some
form of constitutional provision establishing that privacy is in
fact a right.  This may come in the form of a new amendment
(though, I think that’s unlikely for quite some time), or the same
principles that governed Roe and Griswold could apply in this
context as well.  Beyond this, we would need a statutory model that
ideally would include a registration system, a duty to report theft
of data, a low threshold (maybe strict) for liability and an agency
to regulate the day to day business of these data brokers.  In
addition, it would be nice to have a personalized reporting
requirement on every sale of data (given that individuals are
positively identified in the data), and an opt-out provisions for
individuals who wish that their personal information not be sold at
all (although, this might well become as “voluntary” as loyal
customer cards at supermarkets if costs of opting out are too
high).  After all of these mechanisms, and whatever else is
required to go along with them, are in place, there will be a
possibility for regulating the management of personal information. 
However, for this regulation to be successful, data brokers need to
feel the impact of the harms created by their business, and
requiring/allowing arbitration of claims could be a very useful way
to accomplish this.

A major problem with the regulation of the data industry, even in
progressive states like California, is the litigation of claims
against data brokers.  The monetary harms against individuals from
misappropriated data are usually small and speculative, which would
negate any damages award even from a meritorious claim.  [1]  Most
courts won’t recognize a significant damages award for merely
losing someone’s data, because the potential for harm is merely
speculative, and the chances of it occurring are probably low. 
Plus, even if the claims have some monetary value, it isn’t likely
to be high in most cases and given the length and cost of
litigation, many people would be dissuaded from ever bringing a
claim.  Class actions are a possible alternative in this case, but
these would be mostly lawyer driven and created cases, since it’s
not likely that a community of strangers could act collectively on
their own.  If it’s possible, it would be better put the power to
bring claims in the hands of the injured, since that would ensure
that a higher number of claims would be filed.  A statutorily
created right to file a claim against a data broker in arbitration
would mitigate some of the costs associated with litigation.

First, the claims would be adjudicated much more quickly in
arbitration than in litigation, which would definitely increase the
number of claims being filed.  Second, the overhead costs of
arbitration are generally much lower than that of litigation.  In
particular, legal fees of claimants would be significantly less
than those in litigation.  This would give victims with a small
damages claim the incentive to bring their claims.  Furthermore, in
the creation of this right to arbitration, Congress could require
fee shifting for successful claimants, thus giving attorneys the
incentives to take cases with small damages.  Now, the problem with
speculative damages isn’t remedied, but I don’t see a problem with
Congress enacting a statutory minimum damages award when data
misappropriation is sufficiently proven.  I’m not sure what that
statutory award would look like, but it should be enough for the
company to feel the impact but at the same time not crippling the
business.  (The award should not preclude future
arbitration/litigation when a potential harm is realized.  The
award could serve as a presumption of liability against the company
in a future claim, in which the company could employ an affirmative
defense.)

The benefits of arbitration in this setting are that more people
will be encouraged to file their claims, and the data brokers will
feel the impact of their actions soon and in relative proportion to
the harm caused.  This latter point is particularly important
because the data brokering industry is analogous to inherently
dangerous industries that use explosives and toxic materials.  In
both types of industries, the harm caused by reckless or negligent
actions affect third parties not associated with the business,
thereby effectively removing the external costs of the business.  
If this was a case of a product harming its customers, then the
company would feel the brunt of the impact through loss of
business, which would give it an incentive to take care in the
first place.  Allowing arbitration of claims can force that impact
back on the data companies, thus raising their level of care.  And,
if arbitration in this context behaves anything like employment
arbitration, then claimants could end up winning a higher
percentage of their claims than if they had litigated them.  Thus,
data brokers would internalize even more of the costs of their
activities.

Now, there are drawbacks to litigation, such as limited discovery
rules (this could be mitigated by a strict liability rule) and lack
of binding precedent.  However, I think those disadvantages are
outweighed by the benefits of having a cheap and easily accessible
venue for filing a claim.  Encouraging people to bring small claims
consistently should induce data brokers to take the right level of
care in protecting and disseminating personal information.  We
(myself anyway) don’t want to cripple these data industries (which
large litigation awards could do) because they do provide
significant economic benefits to society, but we do want them to
take more care with our data.  Arbitration could provide a small
step in that direction.

Note: I do not intend to have arbitration preclude litigation, I
just want it as an option to litigation.


Nikhil Hodarkar


[1] Theresa Baldas, “Lawyers See Data ‘Fear Factor’ Rising,” The
National Law Journal, 05-12-2005.  Available at
http://www.law.com/jsp/article.jsp?id=1115802311951.

-----------------------------------------------------------------
Computers, Privacy, and the Constitution mailing list