From Individual Control to Social Protection: New Paradigms for Privacy Law In The Age of Predictive Analytics

Dennis D. Hirsch

What comes after the control paradigm? For decades, privacy law has sought to provide individuals with notice and choice and so give them control over their personal data. But what happens when this regulatory paradigm breaks down?

Predictive analytics forces us to confront this challenge. Individuals cannot understand how predictive analytics uses their surface data to infer latent, far more sensitive data about them, and so they can no longer make meaningful choices about whether to share their surface data in the first place. Predictive analytics also creates threats (such as harmful bias, manipulation, and procedural unfairness) that go well beyond privacy. Taken together, these two features make it difficult, if not impossible, for traditional privacy law to protect people in the algorithmic economy. If privacy law is to offer meaningful protection, it must shift from a liberalist focus on individual control, to a social protection model in which public authorities set substantive standards that defend people against algorithmic threats.

Leading scholars have recognized the need for such a shift and have proposed ways to achieve it. This Article will argue that, while they move the ball forward, these proposals do not provide an adequate solution. It will propose that the Federal Trade Commission (“FTC”) use its unfairness authority to draw substantive lines between data analytics practices that are socially appropriate and fair, and those that are inappropriate and unfair, and will examine how the FTC would make such determinations. It will argue that this existing authority, which requires no new legislation, provides a comprehensive and politically legitimate way to create much needed societal boundaries around corporate use of predictive analytics. It will conclude that the FTC could use its unfairness authority to address the threats that the algorithmic economy creates. Were the FTC to do so, that would move us past the liberalist paradigm of privacy law and towards a legal system that can protect people in the age of predictive analytics and artificial intelligence.