Problems with the California Consumer Privacy Act

At the beginning of Aaron Sorkin and David Fincher's 2010 masterpiece "The Social Network," Mark Zuckerberg hacks a number of Harvard University face books, steals the female students' profile pictures, and creates Facemash, an attractiveness-ranking aggregator. This invasion of privacy lands Zuckerberg on academic probation but also hastens his creation of Facebook.

Part of Facebook's appeal, back when it was "The" Facebook, was its exclusivity. You needed an email account from one of a small group of universities to join. More than that, you needed to have heard of it. "There was nothing to hack," the website's defenestrated co-founder Eduardo Severin explains in the film; "people were going to provide their own pictures, their own information. And people had the ability to invite -- or not invite -- their friends to join. See, in a world where social structure was everything, that was the thing."

Actually, the thing is time. And it is long. Today, 14 years after its founding, anyone can join Facebook, everyone is on Facebook, and no one, it seems, likes Facebook. Judging from the breathless talk about how it violates our privacy -- we who provide our own pictures, our own information -- Facebook is no better than Facemash.

Enter the marplots.

Proponents of the California Consumer Privacy Act of 2018 have likely collected enough signatures to place the measure on the ballot this November. The act would penalize a company for suffering a preventable data breach; entitle a consumer to learn what data a company has collected about her; and empower a consumer to demand, at no cost, that a company not sell her data to third parties.

This is not all bad. It makes sense to place the onus of data protection on the holder of the data (i.e., the least cost avoider). And an argument can be made that a company's having to disclose what data it collects lowers transaction costs by clarifying the implicit price of the company's product.

Letting a consumer simply decline to allow data sharing is harder to defend. If the price of a product is consumer data used for targeted advertising, a right to opt out of data collection is a right to a free ride. Faced with swarms of free riders, some companies will ditch their data-driven business models. The act if passed will result in fewer free products on the internet.

Facebook's and Google's being configured as they are suggests that this is not what people want. It appears that marketers value data more than consumers value content, and that consumers would rather purchase content with data than with money. It appears, in brief, that people value digital privacy less than they say they do.

At any rate, the act's fatal defect is its enforcement mechanism. A consumer may sue even if she is uninjured. She may obtain $1,000 for each violation. A whistleblower, too, may sue. She may obtain up to $7,500 for each violation (if willful). "Violation" is not defined -- it could mean each category of data collected, each record revealed in a breach, or each day a company is out of compliance. These are not implausible constructions, given that the act says it "shall be liberally construed." A broad reading of "violation" will produce logarithmic damage awards. Meanwhile, the act contains no safe harbor for a company that commits a good-faith mistake.

The act's main backer, real-estate developer Alastair Mactaggart, asserts that Facebook may not claim to value consumer privacy yet oppose his ballot measure. Seeing that the act exposes tech companies to a vast and volatile liability scheme, this is a quixotic thing to say.

From a business' perspective, California has arguably the worst courts and the worst regulations in the country. The state is beset by no-injury class-action lawsuits. Although the price of this rent-seeking is admittedly difficult to calculate, the U.S. Chamber Institute for Legal Reform estimates that an efficient tort system would add around 1.2 percent to the state's employment rate. That's more than 200,000 jobs lost, under the current structure, to lawsuits over clothing labels, bathroom sink heights, paystub address stamps, and coffee-shop carcinogen notices.

The California Consumer Privacy Act of 2018 would add to the problem. It would be exploited to the full by technologically illiterate billboard lawyers.

"The Social Network" closes as Zuckerberg prepares to pay $65 million to settle a weak idea-theft lawsuit brought by Cameron and Tyler Winklevoss. "It wasn't justice that gave the twins $65 million," argues Lawrence Lessig in his review of the film, "it was the fear of a random and inefficient system of law. That system is a tax on innovation and creativity. That tax is the real villain here, not the innovator it burdened." Indeed. But the Winklevii are bridge-toll agents compared to the plaintiffs' bar.