Privacy Policy or Miranda Warning? Big Data and the Age of Self-Incrimination

The Right to Silence protects us against self-incrimination: the use of statements that we make against our own interests, in court and under interrogation. Yet data brokers package the statements we make about ourselves, gathered from our transactions online and in real life, to deliver a profile that can be used against us in commercial transactions. Should there be a “5th Amendment” for consumers?

Everyone loves the 5th Amendment. Relied upon by screenwriters and suspected mob bosses, it’s the only one of our fundamental rights to be reduced to a handy, greeting-card sized sentiment for police to use in the field (the mighty Miranda warning). And why not? The Framers put the 5th Amendment in the Bill of Rights as a defense against tyranny and mob rule, by forcing the government to overcome the presumption of innocence without using compelled testimony from the accused.

The idea that a citizen is “innocent until proven guilty” is one of the oldest and most durable expressions in our shared social code, cited back into Roman times, and reiterated in constitutions and civil codes around the world. Presumption of innocence means that the burden is on the government to prove guilt, rather than on the accused to prove innocence. The 5th amendment enforces this obligation on the government by explicitly enumerating the right to not speak against your own interests, so that a confession that is extracted through torture or compulsion is useless in the government’s case (the exclusionary rule, aka “fruit of the poisonous tree”).

This right against self-incrimination is so urgent, so fundamental, that we require police not only to remind you of it by reading aloud from a card so they get the words exactly right, but also to verbally confirm that you understand your rights before proceeding with questioning. If the police fail to make sure that you understand your rights, they can’t use your own self-incriminating statements against you.

For a right that is so enshrined in our social norms – even that notorious old softie, Justice Rehnquist, said in 2000 that Miranda warnings had become part of our popular culture – we’re shockingly generous about letting data brokers and marketers use our daily transactions and activities to build profiles that will most certainly be used against us in commercial transactions, and could easily be used against us in legal or governmental settings.

We’re not just talking about the personal information that you (more or less) knowingly provide in exchange for “free” services like Facebook – rather, this is the information that is quietly harvested when you tweet a political opinion, purchase a fatty snack or a bottle of bourbon, or drive in a bad neighborhood late at night, in addition to the raft of personal demographics already in your file. Much has been written elsewhere about the staggering quantity of data being collected, the security risks of its aggregation and storage, and the ill uses to which it might be put. And in May 2014, the Federal Trade Commission came out with its own massive report on the state of the industry, with a sobering list of the data being collected and a comprehensive legislative agenda to bolster consumer protection, including the creation of a centralized “opt-out” portal.

Of course, data brokers are not themselves subject to the constraints of the 5th amendment. That would fly in the face of another beloved American principle, Freedom of Contract, which says that you can enter into any damn fool agreement you like so long as it’s not unconscionable, illegal, or agreed to under misrepresentation or duress. So if you want to deliver yourself unto the data brokers for dissection and repackaging, you probably ought to be able to. If you think the incentives offered by marketers match up with how much you love your privacy, you’re free to make the deal. But when the incentives are earned and spent by the data broker instead of the data subject, that’s a bad deal and you should be able to opt out.

The FTC has taken a step in the right direction with its recent efforts to shine a light on this opaque and largely unregulated industry, and the call for a means for consumers to opt-out of personal data collection. But Miranda requires us to affirmatively, knowingly opt-in before we offer up incriminating information about ourselves – shouldn’t we be able to make the same informed decision about delivering our most sensitive and potentially compromising personal information to the data collection industry?

The California Attorney General has published excellent guidance on the list of elements that must be present in a Privacy Notice for it to be effective. Perhaps as a final touch, the Policy should remind us that “the information you enter, provide, or imply by your mere presence on this site can and will be used against you in future transactions and in countless perturbing ways from here forward. Do you still wish to proceed?”