Data Privacy and the Tragedy of the Commons

Forced data hygiene

GDPR is a recent form of European regulation requiring that companies which collect data from European citizens provide the means for their customers to both view and remove the data that is associated with them. This is a major change for companies and the penalties for non-compliance are harsh: 4% of annual global revenue. Customer data is incredibly valuable for companies as it allows for efficient monetization. However, as we've seen too frequently companies cannot be trusted to safely protect their customers' data (see Home Depot ²⁰¹⁴, Facebook ²⁰¹⁴, Equifax ²⁰¹⁷).

Something is broken

In a free market economy, customer demand will shape the market. This means that if consumers really prefer GDPR-level control over their data, companies would be incentivized to build this into their product and we'd see this feature arise naturally. So why haven't companies provided better data control if consumers really care about their data? The sad truth is that a majority of people don't value their data privacy enough to shape the products we use. If both consumers and corporations aren't interested in protecting data privacy, who exactly is GDPR for?

Tragedy of the Commons

Yesterday, the city of Seattle enacted a ban on plastic straws to help protect the environment. As I sat there drinking my smoothie through a half-soggy paper straw, I realized that GDPR is a similar solution to the tragedy of the commons problem. A tragedy of the commons scenario occurs when a shared resource is exploited for profit to the detriment of all. Certain economic systems have hidden costs that affect more than just the immediate parties involved. In economics, this is called a negative externality. For this reason we see taxes and regulation on consumption of fossil fuels, fishing, and cigarettes as a way to recoup some of those costs and "internalize the externality". The pollution of plastic straws is just another example of the tragedy of the commons. Plastic straws are heavily used because the alternative environmentally-friendly paper straws cost three times more for corporations and plastic straws are preferred by consumers. As a result our oceans have become more polluted; an externality cost that all of us are forced to pay.

Consumer privacy is also a scarce resource that suffers from the tragedy of the commons. Driven by advertisement revenue, corporations became increasingly efficient at collecting and using consumer data to shape consumer behavior. In 2016, we saw this data used to manipulate individuals with the goal of influencing political decisions. Cambridge Analytica leveraged the Facebook data of millions of citizens to affect the result of Brexit vote and US presidential election. This lack of data privacy has now begun to impact all of us.

Results of tragedy of the commons

Possible Solutions

Taxation and regulations are the best known solution to the tragedy of the commons problem. These mechanisms work by forcing the parties who are exploiting the commons to compensate the public for the gains they receive through the exploitation. GDPR is a step in this direction. Further regulation may include taxes or penalties for businesses who accept any form of customer privacy data. Critics of this approach state that the impact of externalities are often difficult to quantify and the taxes/penalties don't always go to benefit those who are affected (in some cases those who will be most affected haven't yet been born).

The Decentralized Identity Foundation is an effort to help consumers own their identity and private data. With a decentralized identity each individual creates a collection of their personal data that can be shared to businesses on a per-need basis. Businesses in turn can contribute to the identity of their users. This doesn't solve the externality problem, but it provides a viable way for companies to provide meaningful services that doesn't involve collecting and housing consumer data. With this technology, regulators can enact stricter data-custody laws as companies will now have the means to abide by them. Additionally, since the data of each individual is not located in a centralized store, it becomes exponentially more difficult to compromise.

As cryptocurrency and blockchain systems experiment with new forms of economics, we've seen the emergence of elegant solutions to the tragedy of the commons. Bitcoin has empirically proven that through carefully balanced incentives a common, open ledger can be shared across the world without abuse or top-down regulation. There's hope that this same technology may hold the key to solving a wide range of externality problems, including data privacy.