Transcript
Speaker: Welcome back, everyone, to the A-Tech Philosophy Podcast. Today, i am joined by Daniel Solove. Daniel is a professor of intellectual property and technology law at the George Washington University Law School and one of the leading scholars of privacy law.
Speaker: Today, we'll be discussing his recent book on privacy and technology, which argues that many of our most pressing privacy problems stem not simply from new technologies, but from the ways our laws have responded or failed to respond to them.
Speaker: Daniel J. Solove, it is my pleasure to welcome you to the show. Thanks so much for having me. So I want to give listeners an overview of of your book on privacy and technology to kind of you know give them a ah lay of the land for the rest of the conversation. So I'm trying to summarize this ah in my words, and you just kind of tell me if I'm right or wrong here. But what I really enjoy about the book is that it's not that technology is the bad guy. That that story is sort of too simple.
Speaker: It's more so that there's pernicious ways of thinking about privacy and our courts have actually sort of dropped the ball a couple of different times. And that creates an environment where technology companies sort of tend to behave ah in ways that go against our privacy. that how How is that?
Speaker: I think that's great. I think you really captured it. I think the the big theme is, yes, technology is not the enemy. Technology can be wonderful and great. What the big problem is, is that the law treats technology, especially digital technology, differently than everything else.
Speaker: And it gives ah tech companies and users of the technology a pass to do certain things that otherwise they wouldn't be able to do.
Speaker: And i often think that when you look at ah the things that these companies are doing, the harms they're causing, and then blaming it on the technology as if the technology has agency itself,
Speaker: ah that the law will often look the other way or not really address the situation and treat it very differently than almost anything else. That's why we have the problems that we have.
Speaker: That's why the companies are doing what they're doing, because the law lets them get away with it. Right. As Sam and I, my co-host Sam, prepared for this conversation, i have to admit, we were we we chatted about how we were sort of, ah you know, I was aghast at some of the rulings of the court that as philosophers, we were simply not familiar with. So I definitely want to make sure that we get to to some of those because ah ah there they really are jaw-dropping, in my opinion.
Speaker: um One thing I also really enjoyed about your book is that you are not shy about getting into philosophical issues. And so that's actually where I think we we should begin the conversation proper.
Speaker: um Privacy is, of course, a construct. And it seems to be, in fact, a sort of recent construct in in our social evolutionary history.
Speaker: ah We had someone on the show about a year ago who mentioned that in a big chunk of our evolutionary history, privacy didn't even make any sense as a construct. We were all just in big groups.
Speaker: But As a a ah natural construct, one that emerges kind of ah through conversation as as society evolves, you discovered that it doesn't actually quite have ah necessary and sufficient conditions for defining. It's actually quite a slippery fish.
Speaker: So you bring in ah one of my favorite philosophers, Ludwig Wittgenstein. So let's begin there. What exactly, i guess what I can't say exactly, but what is privacy?
Speaker: and your conception of it, and and where does Wittgenstein come into this? This goes all the way back to when I started thinking about privacy and reading about privacy, which is in the late 90s.
Speaker: and I got into interested in the issue and I really wanted to write about modern digital technologies, the rise of the internet and its impact on privacy. ah But, you know, I have a philosophical background. i'm very into philosophy and literature, ah kind of very deeply ensconced in the humanities. And so um i the first thing I do when I start tackling an issue or thinking about something is, well, you know, I really want to understand philosophically what I'm talking about, what I'm going to be analyzing. So I think the first question, if I'm going to talk about how do we protect privacy in a digital age,
Speaker: well, what's privacy? ah And so ah that exploration ah led me to read all of the ah writings on the philosophy of privacy ah that were out there. And there there there were some, but but it was manageable back then when there wasn't as much literature about privacy.
Speaker: ah So I read all this and there were all sorts of definitions of privacy that were proposed, ah but I found all of them lacking. And they were lacking in one of two broad ways I've had to categorize it.
Speaker: ah Some were very narrow. And so when you tried to apply their conception of privacy to other things, it didn't fit. ah So a popular one was that privacy is about protecting intimate information.
Speaker: information that's very intimate. um But there's a lot of data in the digital age that is not intimate, ah that is pretty mundane and pretty routine, and yet ah all these pieces of data can be combined, not necessarily to you know expose your darkest secret, but they could be used to ah still invade your privacy and that they might try to shape your behavior or influence how you think.
Speaker: There are a lot of other dimensions of privacy that just didn't seem to be captured in a lot of the definitions. Another one was keeping secrets. Privacy is about secrecy.
Speaker: But there's a lot of things that aren't secret, and yet we still provide protection from them. So an example is ah that... um You can't take my image and put it into your own advertisement and you know stick it up on a bulletin board in or a big screen in the center of Times Square, right? Or you can't put me on a cereal box advertising your product, that I have rights to my identity, right? There is actually a ah right in tort law recognized by all 50 states in the United States that protects ah my right against the commercial appropriation of my identity. So you can't just use me in an ad without my consent.
Speaker: Now, this is not about privacy. This is not about secrecy. It's not like my my name or likeness secret. It's about my ability, my right to have some control over my identity and how it's used and to...
Speaker: you know, reject its commercialization for someone else's aims ah without my consent. And so that's very different interest. And so when you look at all this, these definitions are too narrow.
Speaker: And then ah the other on the flip side, there were those who were trying to define it very broadly. ah So a lot of these definitions got so broad, like privacy is about protecting personhood.
Speaker: But that's so broad, it's almost meaningless. Everything is about personhood. Everything I do might be about personhood, but that doesn't mean it's it's about privacy. Or the right to be let alone is a common definition of privacy that's used by a lot of people, was used by people.
Speaker: Warren and Brandeis in their very famous article, The Right to Privacy, an article written in 1890 that became very influential in the law. The problem with the right to be let alone is if you bump me on the subway, you violated my right to be let alone. If you call on me in a class, if I'm a student in class, and you call on cold call on me, you violated my right to be let alone. There's so many ways that you your right to be let alone could be violated that don't seem to be about privacy.
Speaker: And this is the problem. Like the the definitions get so broad and vague that they are meaningless if they can be violated in billions of different ways ah or they're too narrow.
Speaker: And ultimately that led me to Wittgenstein. ah And Wittgenstein teaches us that ah there's a different way to conceptualize things beyond looking for the common denominator, that not all things have a common denominator, but they're still related.
Speaker: And so he likened it to a concept of family resemblances, that you might ah be in a family with you family members, but you might not all have the same trait in common. So, you know, I might have, you know, my father's hair or lack thereof.
Speaker: I might have my mother's eyes. I might have my, know, sister's ears or something like that. But we we might share traits, but we might not all have one common through line.
Speaker: But we're all related in this kind of web of interconnected relationships. And so it's betty better to kind of study that web ah in defining something than to just try to keep looking for the common denominator. Because when you look for the common denominator, either it's going to be too narrow and exclude a lot of things, or if you find a common denominator that's so broad and vague to capture everything, then it's too broad and vague.
Speaker: Once we abandon this old style of defining things and go with the Wittgensteinian approach, it really opens our minds up to, i think, a really important aspect of privacy. And that is privacy is not just one thing.
Speaker: It's many different related things. And so I advance a pluralistic understanding of privacy. Privacy actually protects many different interests. They have certain things in common. They have certain things that are different. And what's important is less to try to come up with some kind of...
Speaker: um ah meaning of privacy in the sky, like as if there's some inherent meaning to it, and look more at the various things that are going on and understanding how they're related and how they're different.
Speaker: And what in a way like to have a more of a pragmatic understanding of it is that it, you know, privacy as a word is a kind of useful umbrella term and terms of uses. So, you know, not inherent meanings. And so,
Speaker: The term privacy can be useful as an umbrella to say, hey you know, there are a bunch of things that look close enough that are kind of related that can be useful in certain contexts to call the same thing and to see that they're related. That's why we call them privacy, because there's a helpful understanding. We might see something that's useful in the similarities that helps us solve the problems together. It's helpful to see them together, but it's also, you know, unhelpful to to sort of say they're all the same thing.
Speaker: And that we, you know just as it's helpful to recognize similarities, it's also useful to understand where they're different and where they might need a slightly different solution or different treatment in law and policy.
Speaker: And so ultimately what i proceeded to do then to really understand privacy is to ah taxonomize it to kind of, okay, what does the landscape look like? What are these different things? And why are they, how are they related? How are they different? Let's map it out.
Speaker: Let's map out this web of family resemblances. And so I did that in some of my early work, was to try to really sketch all this out. And I think once that um that project was done, it helped me understand, okay, what exactly is wrong under these different things?
Speaker: And what is the best way to intervene to address these problems. And those interventions share commonalities with with some of the other interventions, but they also share some differences.
Speaker: ah But to really understand something and to really ah solve a problem, it's incredibly important to understand what the problem is. And so I take this from one of my favorite philosophers, John Dewey, who said that, you know a problem well put is a problem half solved.
Speaker: And I think that's really important. How we understand the problems and really looking at them and understanding them ah is essential to having the appropriate types of legal interventions that we want.
Speaker: Right. So this is a good place to mention ah something that I ah that i found. ah I'm not sure that you're the first person I've heard say this, but you've definitely emphasized this a lot, right? So once you conceptualize privacy,
Speaker: admittedly as ah as a fuzzy category, right? but But once you do that, you can actually more easily, it seems to me, sort of argue for its social value. So often, ah you know, I've seen in the literature, someone might argue for privacy as as a primarily an individualistic concern. So maybe um maybe everyone cares about privacy, but it's really their own privacy that they care about.
Speaker: But once you have this... um this this notion of privacy as a social construct that is maybe, you know, a bit of a fuzzy category and applies in different ways and in in different contexts. um You can recognize that it has social utility in that not only should we be concerned about our own privacy, but we sort of want a society where privacy is protected for everyone. So maybe you can just tell us more about why it is that privacy
Speaker: ah is and has a social value, why you want to live in a society that has privacy protections? This is really an essential point. And I'm really glad you brought this up because I think this is incredibly important to discussions and policymaking about privacy.
Speaker: I think far too often privacy is understood as an individualistic right. It's all about just protecting the individual and what the individual wants. And it's all at the behest of the individual.
Speaker: ah But I actually think that that is a does a great disservice to privacy and undermines privacy protection in law and policy. And it undermines it because the interests that ah come into contact into conflict with privacy are often defined socially. So if we look at privacy versus protecting national security, well, you know privacy is just protecting an individual and protecting national security is protecting us all.
Speaker: it seems that you know national security wins over protecting the individual or an individual you know doesn't want ah you have certain types of information shared, but ah yeah it's good for economic efficiency and ah you know innovation and economic prosperity and keeping you know big companies in business. And so that that's a more social, a broader interest. ah privacy when it conflicts with speech speech is defined as the interest of society in free speech ah but privacy is just some individual's preference ah but that's i think the wrong way to define the value of privacy think about if we did that with speech but we you know we look at each individual speech case you know
Speaker: adjust an individual's right to say something the way they want to say it, okay, big deal. It's one person speaking, but we don't define it that way. We define it as as the importance of free speech to society. It just so happens that we're protecting each individual in their each individual case, but we're really protecting the a society premised on freedom of speech and all of the social values that a free speech society gives us.
Speaker: And I think that we need to see privacy in the same way. it's not It protects the individual to protect society. A society that provides space and protection to privacy is a society that is a ah more free, ah more open, more creative, a society that is that can flourish, ah where people can flourish in it better.
Speaker: And so that's why we protect privacy. ah Certainly the individual matters because the individual freedom is a key component of the good.
Speaker: ah But ah privacy is it's not just what we yeah what's just of interest only to the individual, and that's how we should weigh it. We should see what providing privacy to people contributes to society.
Speaker: And it fosters freedom of thought, freedom of speech. It actually can actually enhance freedom of speech if we're we have freedom to explore ideas, freedom to form relationships with other people without interference of of others, without worrying about how we're judged, freedom to have ah some autonomy and control over identity.
Speaker: ah a whole host of different values that ah contribute to the overall ah good of society. We can add one to the list. Intellectual breakthroughs are facilitated by open societies. I remember I read a history of logic where they noted that logic was actually sort of developed in in several um regions around the world.
Speaker: But in Greece, because they had more access to waterways, um people could sort of explore more radical and controversial ideas. And if things got too hot for them, they could leave.
Speaker: But that ability to explore these more controversial ideas actually allowed people to, or or, you know, especially Aristotle, to develop what we now call logic, right? So, yes, fascinating. And i think it really is important to highlight the ah the the role of privacy as as improving our society.
Speaker: you know just say Just add too that if you read most dystopian literature and you look at what is the common through line of most of the dystopias ah from Huxley to Orwell to ah the the book Calicane to a lot of others, you look across the ah spectrum of the the the tower the the dystopias, we find that the most ah frequent thing is that they squash individuality through the lack of privacy.
Speaker: Now, the people don't have privacy and they cannot, you know, flourish as unique individuals. And that is stifling to society and enables ah authoritarian control.
Speaker: And that's just a common element. And so to me, it's a lesson that yeah privacy is really central to you know the functioning of a free society where we have individual flourishing and creativity.
Speaker: Right. So it is um in contrast to this conception of privacy as a social value that we have some other ways of thinking about privacy.
Speaker: And I want to talk about those now. And I'm calling them pernicious. Now, maybe you might not call them pernicious, but it seems to be the case that If one thinks in these ways, there's sort of there is sort of a um you know a limit to how robust you would want to make privacy protections. So ah the first one I want to talk about is the privacy self-management model.
Speaker: And this is sort of, you know, there's there's a lots of threats that go into this, but it's sort of the idea that um individuals, if the onus is on them to to protect their privacy and they ought to be rational enough to make decisions about when they want to give up some of that privacy for for some good or for some to do business with some company. but ah Maybe tell us a little bit about this ah self-management model and and you can also maybe discuss the privacy paradox.
Speaker: Sure. Well, privacy self-management is is a term I've used to describe what a lot of privacy laws do when they seek to protect privacy, which is essentially to put the onus on us, the onus on each individual to protect their privacy.
Speaker: And so um the laws will give people ah individual rights, ah rights to access their data, to correct their data, to have their data deleted, and so on.
Speaker: And that is the primary way a lot of the laws protect privacy is they basically rely on individuals. And it's ah I think it's a it's it's a it's a good impulse. I don't think there's anything wrong about people having these rights. The problem, though, is that it's not an adequate way to protect privacy overall ah for a number of reasons.
Speaker: ah One is that, you know, a lot of... privacy issues and and problems that affect society occur in mass. And so each individual can't really address those kind of mass ah uses of ah of data um through the exercise of these rights. It's a larger thing affecting society. It's not just the individual.
Speaker: um The other problem is that ah people are just ill-equipped to be able to engage in the self-management that the system wants.
Speaker: ah And that is that there's just too many companies that are gathering our data, most of which we don't even know about. So how do we do anything or exercise rights when we don't even know what the companies are?
Speaker: ah There's so many of them that ah it doesn't scale. So it's really difficult to scale. ah The choices that people are given are often not very helpful.
Speaker: you know, it's not very helpful to say, okay, so this company has this data about me. um Okay, but now what? Like, yeah that doesn't tell me what I really want to know, which is, I think, what most people want to know. When they use a technology or when they share their data, they're basically engaging in a risk calculation.
Speaker: What are the benefits? What are the costs? What are the risks? ah Are the benefits better than the risks? ah The benefits are very easy to see. you know Technology offers great convenience and a lot of razzle-dazzle. So, yeah, cool. I get to do these cool things. ah Oftentimes, it becomes so necessary just to function in society that, hey, we need a phone. We need we need to use a lot of these technologies. if we want to live in the modern world.
Speaker: ah And we see the benefits. They're right in front of us. They're immediate. Privacy is this kind of abstract concern about what some might happen in the future, and it's a risk, and how do we really assess that? How do we really know what that risk is going to be? Because we really can't know. What what could it be used for in the future?
Speaker: and And this is really exacerbated by ai I might say, okay, I don't think it's very risky to share like what I bought at at at ah at a store.
Speaker: I go to a store and I buy, let's say I hand soap and I buy cotton balls and I buy a few other products. It's like, yeah. what are What are they going to... Who cares? like I don't care that some company knows that I bought cotton balls or that I bought hand soap or that I bought lotion. Big deal.
Speaker: But with ai ah these very sophisticated algorithms can crunch massive amounts of data. ah Not just my data, but they're this is how privacy affects everyone. They're they're they're looking at data across all shoppers.
Speaker: Millions, billions. And... seeing patterns in the data that I'm not aware of. And from the patterns, ah like humans can't figure out the patterns, that's why we need AI. AI figures out the patterns, and AI can then determine, make inferences about other information about me.
Speaker: So the example I gave is actually a real case ah the Target case where Target but wanted to figure out who among its customers was pregnant based on ah buying habits. And so these people, when they bought some of these items like unscented soap and cotton balls, that was a trigger for this pattern that the algorithm figured out by looking at massive amounts of data and would say they're pregnant. and now we've inferred sensitive health information from these relatively innocuous purposes.
Speaker: But how is the person who goes to Target and just decides to buy a couple of products supposed to make a decision about the risk? ah for disclosing that. And and that risk is going to vary a lot from person to person. Now we're living in a post-Roe versus Wade world, a world where ah now reproductive choices are being criminalized. So there's some very big implications for ah the disclosure of this data and the risks of this data.
Speaker: But how are people really going to know? And for most things, ah how are people really going to be able to assess how good the protection of privacy is for a company. These vague statements in privacy notices that people don't even read. People don't read these notices. They take forever to read. they've getting They're getting longer and longer and longer ah with more fine print.
Speaker: No one reads them. And they say all sorts of things, but they have very vague uses. but Like, you we want to use it to improve our products. We want to use it to share with our trusted partners. ah In the event we go bankrupt, we want to be able to sell the the data to people that we like and so on and so forth. So it's very vague what they might do with it or what might happen in the future or how the data might be combined with other data that they collect to make inferences about us to then do other uses. ah How am I supposed to figure this out?
Speaker: And then they'll say, we protect it with reasonable security. But what does that mean? What's reasonable security? ah I want to know like what kind of encryption do you use? When do you encrypt? And ah do you train your workforce on that? What are your vendor agreements look like? On the privacy side, I want to see i want to speak to the privacy officer because I...
Speaker: Nothing in the notice tells me what I really would need to know. I would need to have a big conversation with the privacy officer for at least like several hours.
Speaker: I would probably want to go in there to ah see what's going on inside because I would probably want to do a ah risk assessment myself to really under, because I know where the risks are and they're they're not in the privacy notice. You have to really see it and see what's going on inside to understand it.
Speaker: ah Talk to the engineer, see what the see their actual privacy impact assessments and how they mitigate these problems to really get at what the risks are or what their plans are for using this information.
Speaker: And I can just go on and on with like a thousand things that I think as I would need to know to make this risk calculation. And I've been studying this for 25 to 30 years.
Speaker: ah I dont can't imagine how like the average individual is going to be able to figure this all out. And when it comes to the way AI algorithms work, um okay, so let's say that this I need to know, well, what's the logic behind the algorithms? How do they work? Well, the algorithms are constantly evolving. So if I learn about the algorithm today, it's not what it's going to be a few weeks from now, but just the algorithm's logic isn't enough because it depends on the data that they're being trained on.
Speaker: So I need access to all the trading data. And that's like, could be millions or billions of data points. And that's the case. Okay. They give me, let's say some, they can give me all the training data without violating everybody's privacy.
Speaker: Now I get the algorithm, but okay, I need to see how the algorithm interacts with the training data to what it's going to actually do and how it's going to be used about me. So I need to borrow a team of expert computer scientists. I need a data center devoted to me to crunch all the data to actually figure out this so that I can actually determine what the risks ridiculous. It's ridiculous.
Speaker: And so it's all a fiction. It's all basically complete BS that the individual is is really in any kind of control. It's all an illusion. It's just an illusion. And that brings me to the privacy paradox that you mentioned.
Speaker: um This is this notion that, um well, it's a real phenomenon that, you know, when people people will say in polls, they really care about privacy, they're very concerned about privacy. But then when you look at their actions, their actions don't seem to match up with that. They share a lot of information.
Speaker: ah They don't go and exercise all their privacy rights. ah And then they're blamed. It's like, ha ha, you didn't really care about privacy. Yeah, talk is cheap. You said you care about it, but you really don't.
Speaker: People really don't care about privacy. So let's ignore all the polls. Let's ignore everyone's stated concerns because if you look at their behavior, they're not caring. And I think that is actually, it's basically used as a way to stave off regulation and stave off ah legal protections of privacy. ah But I think it's actually quite rational for people to say they really value privacy and not do anything because the privacy rights are meaningless. It's theater. Right.
Speaker: it's It's just pretend it's rearranging deck chairs on the Titanic. It's just for show. It's not something that people can meaningfully do. People don't meaningfully consent to anything.
Speaker: ah that That they're doing. um it's all ah It's all a farce. And so when people don't do these actions, I don't think that indicates they don't care about privacy.
Speaker: I think that just indicates that, you know, the the things that the law gives people to do is a lot of busy work. meaningless busy work in most cases that amounts to nothing, doesn't solve the problem, but then gives companies an out to say, hey, yeah, you know, well, we gave them these rights. You know, yeah, we we allowed them to to find out this stuff um and they didn't do it. So what we're doing is okay.
Speaker: It's just a convenient way to blame the victim. And that's why i i find it ah very problematic the way the law goes about addressing these problems. Right. So you you're bringing up power here and and I definitely want to go and in that direction. Companies have too much power. And of course, we can also talk about state power.
Speaker: Let me see if I can sort of summarize the the argument thus far, though, ah just to make sure that all reader or or sorry listeners are on board here.
Speaker: ah so We want, ah you think it's more profitable to think of um privacy as, I'm going to you know use a term here, collectivist, right? It's a social value. it's ah It's a general value, not so much individualistic.
Speaker: But the individualistic model is sort of the pervasive way that people think about it. And it is dangerously flawed. um And the word that or the phrase that I would kind of put on this is that it is psychologically unrealistic at multiple levels.
Speaker: First of all, when I get my flashy new phone, I'm not going to read through the actual and what it was called notice and choice ah ah you know form there. to give my I'm not really going to read through it. I'm going to just give consent in you know in quotes because I want to use the technology. The same goes when I sign up for some fancy AI platform that is going to use my data This technology is very powerful and it's very alluring and you want to use it. And so you aren't really, it's a tough um ask psychologically to tell people to really protect their privacy's privacy when the technology is so alluring.
Speaker: The really interesting part, though, is how ah complicated the modern data ecosystem is, because it's the case that I might give a little bit of my data to one um company and a little bit more to a second and a little bit more to a third and so on and so forth.
Speaker: but they can aggregate all this data and identify me. And that is only done with artificial intelligence. My puny human brain would have never been able to do that, right? So all of this makes it so that the actual calculations that I would have to engage in to to you know know when my privacy is at risk isn't really possible for me.
Speaker: So I think that's sort of um where we are so far. Did I did i capture most of it there? Yeah, absolutely. I think you got it very, you know, really well stated, yes. um and and i'll I'll add too that you know i think of it like um you know when you get on a plane, um you don't need to know how to fly the plane.
Speaker: ah You don't have to become an expert on plane safety or do your own safety check of a plane. um You go on and you fly. Right. And and ah but with a lot of digital technology, you know, the safety checks on you.
Speaker: You're like, OK, here's our here's all our safety data. You figure it out. um ah Or when you go to the supermarket and you buy milk, um you can choose on taste and price.
Speaker: ah Do you have to go and research the farms where the milk came from? do you have to become an expert on pasteurization? No. um There are two key things when you buy these products that are there. One is that there's a pre-inspection, there's a regulatory regime that makes sure that, you know, the milk is going to be safe to drink and that there' there's auditing and there's standards and and and inspections, which I think these days are are kind of sadly going away when you hear the government fire all these inspectors and now we're seeing all these food recalls.
Speaker: um and people dying ah from from all this. ah That's really an important part of the equation. And then the other part of the equation is after the fact, is that if something goes wrong, if I drink the milk and it's tainted, ah the milk manufacturer is going to be responsible for that harm.
Speaker: ah They're going to get sued. If I make a car, yeah know There's choice. you know cars Some cars are safer and less safe, but I can't make a car that's just going to blow up.
Speaker: ah I have to have minimum safety standards. And then a consumer can kind of make choices. ah But if something goes wrong with the car after the fact, you know it's not too bad, so sad, there's liability.
Speaker: The problem with technology, ah digital technology today, is that we lack both the pre and post protections. There is no inspection of anything.
Speaker: There's no auditing. There's no nothing. Come and just spit it out there. Come what may. And it can do drastic harm to people. And they're like, oops, yeah you know sorry. So we're we're all guinea pigs. They just throw it out there. I mean, if ah think of if car did that a car manufacturer did this or a plane ah manufacturer did this or or food or drugs or any other thing outside of digital technology, we'd say it's outrageous, right? It couldn't happen.
Speaker: um But they do. And then after the fact, ah you know courts and legislatures bend over backwards to give the companies a pass. So courts will say, oh, well, I'm not sure there's a real harm here ah to a ridiculous extent.
Speaker: ah So the Supreme Court in one case where a credit reporting agency was recklessly ah labeling people as terrorists based on a mere name match.
Speaker: And nobody argued that that was not terrible and and and just negligent reckless. It was just totally inappropriate to to label someone a terrorist just because their name matched someone on a terrorist list. that You have to do a lot more than that.
Speaker: And everyone knew it. So no one was disputing that. But the Supreme Court said, oh well, if it's disclosed in your report, somehow you're not harmed. If it's just in your report, no harm. So therefore, the companies go free.
Speaker: on no liability. And that's why these problems persist because the companies know that, hey, you know, something goes wrong. The courts will have their back. They'll bury their heads in the sand and just say, oh, well, people weren't really hard.
Speaker: ah And that's the problem with a lot of the harms for privacy that we experience is that courts don't see a harm. Legislatures do not provide you know sufficient ways that people can get redress for these harms.
Speaker: ah And so, you know, the enforcement is way ah yeah know under-resourced for the kinds of problems that you're dealing with.
Speaker: and And so that's that's why we have what we have in the system, both before and after we lack adequate protections. And so companies know that they can do whatever they want.
Speaker: And then if something goes wrong, they can probably get away with it and not... pay that much. ah So the incentive is, you know, move as fast as you can, ah do whatever you can do to get ahead and grow, ah even if it's going to harm people and cause other harm because they're not going to have to internalize those costs.
Speaker: And that's what we're seeing with AI, right? We're seeing like the companies with this ethos that Okay, everything they do, let's build a data center and we can slough off the costs on the community. We can take all their water, we can hog all the electricity, we can build these ridiculously hideous, ugly buildings right in their backyard, and we have to pay anything for it. So, great. you know All the costs are borne by everybody else. We'll spit out our AI as fast as we can, use it however you want. um People are using it in ways that harm other people or their...
Speaker: talking to a chat bot that know encourages them to commit suicide and the companies say, oops, you know, and and this is, i think the biggest problem that we face is that we have companies that have learned that, you know, they can get away with stuff that everybody else can't get away with.
Speaker: And I always ask the following question, you know, for everything that we see with technology doing today, if a person did it, what would be the implication?
Speaker: So now we have the AI companies saying, oh my gosh, we have these AI companies bots that are are are, that's like we can't contain it. We're testing it, but now it's breaking out and hacking everybody's site and and and it's getting out and it's going to do all, it's doing all this terrible stuff. ah But if it's the AI, it's all their fault. It's the AI's. We're just trying to hold it in.
Speaker: um imagine if a person said, okay, I'm going to, I'm going to have a tiger. I'm going to have a tiger. I'm going to put the tiger in a, it in a little, in in a little pen with like a flimsy wood fence that the tiger like jumps off over the fence and starts mauling people.
Speaker: And I say, know, oops, I shouldn't be responsible for that. You know, not my fault. um You know, the tiger just got out. You know, I i i tried to hold it in, but, you know, innovation.
Speaker: And, you know, I have a big chunk of the economy, so, you know, you shouldn't stop me. ah Too bad that it mauled people, but, you know, it look how powerful it is, investors. Look how powerful that tiger is.
Speaker: Look how how viciously it mauled people. So give me more money. Yeah. regulators, you know, yeah, I'm on top of that. I'm going to keep testing it. Uh, this is what we're seeing. And there's no, and then the courts are like, Oh, the people were really harmed. You know? Oh yeah. You know, it's not a big deal.
Speaker: know, what's a little blood flesh wound. Um, right. This is how ridiculous it is. And, and it's hard to even, um, you do it with satire because it it's so outrageous to me. yeah,
Speaker: How with digital technologies, it's like policymakers have just totally lost their mind and have forgotten hundreds of years of ah things that we learned in the law about the appropriate regulation of things.
Speaker: So that was ah an excellent example of of companies kind of going rogue. And of course, ah both pre and post, you know, there's no basically no consequences and no regulation. i do, while we're on the topic of um asymmetries and power, I want to bring up the example that you brought about...
Speaker: think it's an algorithmic system that a judge used ah to figure out the the likelihood of residivism. So maybe you can tell us um how some of these AI algorithms are being used in the courts. And obviously, I think it's Wisconsin Loomis, but you're the expert. So I'll let you go with whichever one you you want.
Speaker: Yeah, you got the case right. It's Wisconsin versus Loomis, and it's a case involving ah what's called a a predictive AI algorithm, an algorithmic, I mean, ah an AI prediction.
Speaker: And basically, this is an example of how AI algorithms are being used to make predictions about human behavior. And it's one thing if we're going to say, okay, I'm going to use AI to try to predict the weather.
Speaker: that Okay, so fine. they They try to predict the weather based on past weather data. It's much more problematic when AI tries to make predictions about human behavior ah because these predictions are actually not really predictions.
Speaker: ah They are looking at past patterns. And so what happened in in the Loomis case is that, ah and this is across the country, many courts are using ai algorithms to predict whether or not a person will commit a crime in the future.
Speaker: ah So this is stuff out of like the movie Minority Report where there's a prediction, are you going to commit a crime in the future? And if the prediction is yes, you're likely to commit a crime in the future, then you're deemed you know a riskier a risk and your sentence is increased.
Speaker: And so Loomis was predicted as one who would commit crimes in the future. you know have a high recidivism rate. And therefore, ah he was sentenced to a higher sentence.
Speaker: He challenged this and said, this is a problem. It's a violation of my due process rights. ah I have a right when sentencing, you sentence me.
Speaker: You punish me for what I've done and been convicted of. But here, you're punishing me not based on me, you're punishing me based on some AI's prediction that I'm going to commit a crime in the future.
Speaker: And that's very problematic, just generally. Shouldn't we punish anyone for some guess about what they're going to do in the future? And what makes AI predictions even worse is that this is actually not a prediction. It's not even based on him.
Speaker: It's based on the aggregation of data about other people with similar characteristics that he had that then says that based on what they did in the past, they committed crimes again in the past. And so there's an assumption that because he matches them in certain things, that he is going to do what they did.
Speaker: So it's actually using past data about other people. But this is very problematic because one, it's not dated about him. So he's being punished based on what other people like him did. That's wrong.
Speaker: It's also wrong because you should never be punished based on something that is predicted that you haven't done yet. and you haven't been convicted of yet. It's something in the future.
Speaker: And it's also problematic because um you know the the past the future might not necessarily, it reifies the past. Just because something happened in the past doesn't mean it's always going to happen in the future. That's just the assumption that the algorithms make. ah But that's not necessarily always going to be the case. The other problem is that the data used in the algorithm ah was biased.
Speaker: Almost all data is biased because humans are biased. And so the bias in the data comes across in, ah you know, in through the, because they're trained on this data. And so problem with recidivism data is it's biased because ah there's bias in society and there's a disproportionate number of minorities who are,
Speaker: targeted and arrested for crimes more than other groups. And so that those characteristics or being in those groups now correlates to, because of the bias, a higher recidivism rate because that's where the police are looking for the crime.
Speaker: ah And so, um studies actually showed the algorithm was biased. And he said, you know, I should have a right to understand what the algorithm, how it works, and and really ah be able to test it.
Speaker: And the court said, no, know, that's a trade secret of the company. And we need to protect the company's trade secrets so we can't let you see it. ah But trust it it's okay because the judge can just weigh it.
Speaker: ah in everything else. And so the judge will just sort of cure it. There's a human in the loop and the human will cure it. And this is how a lot of the laws do. Oh, well, just it's okay if we just have human review. The problem is that ah we know from looking at many, many studies that you know humans reviewing AI and automated decisions ah it does not work very well.
Speaker: Humans defer to decisions ah often too much. They often ah challenge decisions in the wrong instances and actually make things worse. So adding a human loop doesn't actually make the problem better.
Speaker: ah A lot of times it makes it even worse. and with no standards for how the humans to weigh this, with no real guidance, with no real solution to fixing the problems of human review, human kind of mix with with algorithmic decision making.
Speaker: um ah Just saying, oh, human review, or throwing it to the… saying, oh it's oh, it's cured by human washing it, by just having a human look it over, is basically not really a solution. It's burying your head in the sand and ignoring the problem and and probably even making it worse.
Speaker: And that's what the court did here. ah and And these algorithms continue to be used, ah and they're used in all sorts of other sort situations, hiring and ah um ah all sorts of other things that implicate, ah that have important consequences for people's lives and i think this is an incredibly problematic practice uh the law you know permits it embraces it uh even funds it because it's governments that are in fact uh you know
Speaker: hiring this company to to do this kind of thing it's actually you know like a study a group of uh researchers uh kind of reverse engineered the algorithm uh looked at it and uh analyzed how it would work in a bunch of cases and figured out it was biased uh this happened after the case uh so um this is a big problem right if if we don't have adequate way to to study it and to learn it um It violates due process. It punishes people for for things that they have no control over ah based on a faulty AI washing of something. And i think and and then it's like held out to be somehow more fair and neutral, but but it's not.
Speaker: Uh, you know, it, it's all an illusion. and I think these things are, you know, the case to me is an abomination. um it is so flawed on so many fronts.
Speaker: Uh, it, it's terrible, but, but this is just, you par for the course. This is what the law is doing. And this is why I'm so critical of the law. Uh, because I think that the law has, allowed ah digital technologies and and governments to use it in these incredibly irresponsible ways that are causing real harm to people and letting them off with impunity without any ah accountability whatsoever.
Speaker: So this is one of the jaw-dropping cases that I had mentioned earlier. and And what's wild about your book is that there's multiple of these cases. I mean, you know, so this is this is just one. um I do want to make ah two comments here.
Speaker: ah one of them is that we just had a guest on the show, the very last episode. who found evidence that AI influences decisions um outside of conscious awareness, right? So the the you know the very presence of the ah of of the algorithm there probably influenced the judge and in ways that the judge could not subjectively recognize.
Speaker: And the other thing is that that you also mentioned here that this is, ah of course, a you know, a violation of ah of due process. But even if you were to abstract this sort of situation and put it in some other context, maybe um an algorithm that predicts how successful one will be, you know, in their at their job performance, that's that's still very problematic, morally speaking, because that's a violation of of autonomy.
Speaker: If someone... create ah has an AI model that predicts how I will do at some job and I don't get some promotion based off this algorithm, even if you were to base that algorithm on my past behavior, that denies my ability to sort of, you know, ah become a different person, to change, you know, past behaviors and move in a different direction. So this should be worrisome to, i mean, essentially everyone, this this isn't tied necessarily just to recidivism or or whatever, right?
Speaker: in The criminal justice system. This sort of practice is is just, you know, morally abhorrent on at any ah in any domain. Exactly. Yeah. And another case that I talk about in the book is the case with Amazon ah wanted an algorithm to figure out who it should hire.
Speaker: And so it trained the algorithm on its successful hires in the past to say, kind of find people like this. And they thought the algorithm was going to do be less biased than their hiring. It was going to be neutral.
Speaker: In fact, the algorithm systematically favored male candidates. And they were like, oh what's going on? We don't get it. Well, in fact, ah the problem was that the algorithm was trained on the people that were hired in the past, which were disproportionately male, and the ones that they were deemed successful that got promoted and so on, which were disproportionately male. And so the algorithm learned from the bias that was in the data and then replicated the bias, only did so even more systematically.
Speaker: And that's the problem is that, you know the algorithms are always going to find a way. they're They're always going to find a way to discriminate.
Speaker: They can either discriminate on legally protected categories like race and religion and gender. Or if they can't do that, you can try to bar them from doing that. Then they'll look for proxies. So, you know, where you live is a proxy for, know, your race. And you can, other data points you put together, you start to see, you know, the same things. Oh, it just so happens that, you know, people in this area ah correlate to the same thing they're they're correlating with race or they're correlating with something else. ah So let's say you can eliminate all the proxies.
Speaker: Then the algorithms will find another way to discriminate. They'll look for something else. And they can look for either one of two things. One thing they could look for either immutable characteristics. So they might say, okay, people who are bald tend to not get hired or promoted as much as people who are not bald. So the algorithm says, oh, well, there must be something bad about baldness. So yeah we're going to we werere go to say if you're bald, You're not going to be good. ah Or it could be short or something else.
Speaker: ah People who are left-handed, who knows, what whatever it might be. It might be, they'll find something to show some kind of correlation and then it's going to see the pattern. Or you could say okay, let's try to, we could cure for all of these things and we might we might never know it um you know, it's going to find all these different things. But anything it finds is either going to be an immutable thing or it's going to be something tied to our behavior.
Speaker: But there's a lot of things with our behaviors that are perfectly fine, but that could possibly correlate to something that would be discriminatory against us. So it could be like everyone who reads a certain book, who likes a certain movie, who likes it as a fan of a certain sport, or has a certain set of interests, or who said a certain thing, or who posts a certain amount of posts on social media, whatever it might be, the algorithm is going to look for a pattern. And then do we really want the algorithm to start chilling lawful behavior, lawful speech, lawful reading, lawful anything?
Speaker: uh or punishing people for something that is totally lawful to do the algorithm is always going to look for a pattern that pattern's always going to discriminate in some way or other and what's problematic about it it's done systematically it's done by a machine and machines do things consistently and systematically net then leads to people who are systematically excluded treated than less than ah you know and And singled out for longer sentences, not being hired, not getting a loan, higher interest rates, and so on.
Speaker: That is the big problem that ah happens when you start using these kinds of algorithms and making trying to make these kinds of predictions. And of course, these ah these predictive algorithms, they're all based on data and that data is collected because of extremely lax privacy laws. So let's pivot here to hopefully some solutions. Now,
Speaker: yeah Maybe I'm reading ah too much into this, but it it sounds a little bit like you're hopeful, like you believe there is a chance, right? So I'm i'm really curious about this.
Speaker: um You suggest that maybe privacy laws, we should make them, of course, more robust, but it should also be flexible. and And maybe I might be using the wrong word here, but even ambiguous, I think you said, So ah I'll just ask it this way. What would a better privacy law look like?
Speaker: Yeah, I mean, i i'm I vacillate between being optimistic and pessimistic. I'm optimistic in that I do think there are solutions out there. I do think that the public really cares about privacy.
Speaker: ah So I think the public, yeah I think the polls are accurate, that people really care and people are angry. And we see that with the backlash against the flock cameras. We see that against ah the backlash against data centers. I mean, people and and and people are upset about this. People don't like the world that's being built.
Speaker: ah People care about privacy. And I think that's that's the good news. we we we have Because people don't care about it. It's hard to imagine ah anything happening. ah The problem is that it's not being translated ah into effective policy by policymakers.
Speaker: And ah that yeah it does it's very, very hard for that to happen and happen effectively. um ah But I'm hopeful that you know at least it there's there's the general will of the people for this to happen. And it's possible.
Speaker: There are real solutions. And then the question is, is how do we get the policymakers to actually implement those solutions. So one set of solutions is I think the key is you have to hold the companies accountable. That's the biggest larger lesson. If you hold them accountable, ah you create the right incentives. Companies are very good at responding to incentives.
Speaker: They're machines at responding to incentives. If you look at their behavior, it's all because of incentives. They do something bad because the incentives are wrong. you know, because there's not enough, but you, you know, you set the incentives right. And, you the companies are actually remarkably good at actually following the incentives. And and that gives me hope that that but their behavior is actually totally rational and controlled by the incentives.
Speaker: ah The law's job is to get those incentives right. And so we need that accountability. There needs to be risk. And technology changes ah yeah a law that's kind of too simplistic, ah too easy to kind of do compliance with in a thoughtless, rote way.
Speaker: ah Companies will just throw a little bit of money at it and do it rotely it it in ah in a very cursory way. And that's not very effective. what's What's effective is the company has to sweat it.
Speaker: And companies hate that. Companies don't like risk. They really hate it. And if you yeah if you talk to companies, they're like, we don't like regulation because we don't like uncertainty. We don't like not knowing what is going to happen and and possibly having a big ah punch in the gut to our business, all this liability ah or a big regulatory penalty that you know we didn't expect.
Speaker: And I think, yeah, I think that's certainly rational to have that concern. I feel their pain. ah But this is the same thing that they're imposing on us.
Speaker: When they put out their technology, you know, we're at risk. We're the ones who can't sleep at night. We're the ones who their data our data can be used in all these different ways. and And we're absorbing all this risk. So maybe they should absorb some of the risk.
Speaker: I don't want them to sleep at night. I don't think the CEOs of the big tech companies should be sleeping soundly at night. They should be worried. And they should be worried that if they make a misstep, if they release technology that does cause a lot of harm, that there's going to be hell to pay, that their business will suffer.
Speaker: And possibly they could go out of business. There would be a big risk. They have to have skin in the game. Because yes, if they know that they screw it up and they could be out of business, they're going to be safer.
Speaker: They're going to do more testing. They're going to be more careful. They're there. know, but the only reason why they aren't is because the law finds every which way to give them a pass. And so they know, OK, we do something wrong. Oh, they're not going to put us out of business. They'll find some way to say there's no harm. They'll find some way to say, oh, well, we still want them to innovate. And so we really don't want to hit them too hard.
Speaker: um So we'll just give them a little slap, a small fine, of something like that. It'll look like we did something, but at the end of the day, they'll just be able to keep on doing business without missing a beat.
Speaker: Maybe it's just a very slight little bump or or kind of shove, ah but it's nothing really, it doesn't really set them back. It doesn't really hurt that much ah because they don't, so they have nothing at risk.
Speaker: We all have the risk. all the people have the risk and society has the risk and they have nothing. And so I think that lot needs to change that equation.
Speaker: They need to have the risk. They need to sweat it. And if that's the case, they'll be more careful. They will respond to those incentives. If they know that, you know, something goes wrong, they're going to get in big trouble and it's going to hurt.
Speaker: ah And it's risky. And there's a lot of questions we don't know. Like, you know, what could happen if you use data in certain ways? What could go wrong? um We might not know that. There's a risk there.
Speaker: And I think ah that, you know, they yeah if you make the law so easy that they don't have to, oh, well, we didn't realize there's a risk, so therefore we shouldn't be responsible if something happens,
Speaker: that lets them take the risks with impunity. And they shouldn't. ah They should always be risky because using data and using these technologies is a risky endeavor.
Speaker: You're playing with fire. You're kind of playing with like very powerful material, like nuclear material or something. And if you're handling something that is really dangerous, that could cause a lot of harm, both individually and socially, then ah You should be worried and and uncertain, like, oh, wow, yeah a lot could bad could happen. And ah you should know that if that happens, you're going to feel it.
Speaker: um They just don't want to feel it themselves. And I think if the law changes that, that's the best thing the law can do as just a general trend. And we can just carry it out how it worked in other industries. There actually is a roadmap here. You know, we have laws to protect the food supply. We have laws to protect drugs and the development of drugs. Companies can still innovate, ah but we have protections. You just can't spit out whatever drug you want without testing and protections. And if something goes wrong,
Speaker: you're going to have hell to pay and and it's going to be devastating. You know, look at the the the opioid problems. I think there was not enough pre-vetting there.
Speaker: um But aftermath, you know, these companies are are done for. Good. You know, that's that should be the lesson. You screw this up, you should suffer. And I think in some certain cases, you know, there should be jail.
Speaker: ah Because if if if a person were to do certain things, ah they'd be thrown into jail ah for the things that they did. ah But if a bot does it, no. if if yeah If I keep the tiger and the tiger gets out and mauls someone, there are cases in criminal law that say, you know, with someone who had like a ah tiger or a very, you know, vicious dog, they they were in trouble. they They went to jail for these things, for for the harm that that caused.
Speaker: why shouldn't the company, or even if we're not going to throw people in jail, I would say maybe the company should get a timeout, ah be temporarily suspended ah from doing business. That would freak them out. You you'd tell like a tech company, by the way, know, for three months, we're going to shut you down and then you can start back up in three months. They will freak out.
Speaker: you you watch and you you would be you wouldn't believe how safe their products would suddenly become. How like the AI suddenly wouldn't escape the confinement and things would would be a lot better, right? If they knew like, oh my gosh, if the consequences were, you know, we we have to stop the AI race for for for three months.
Speaker: Wow. ah You'd see a dramatic change. I hadn't thought of that. That's very interesting. Dan, I want to be mindful of the time here, but um i I just do want to ask one final thing. What can listeners either, how can they either inform themselves further or or even you know become active in in something relating to this ah this goal of getting better privacy protections?
Speaker: Yeah. So um I encourage folks, if you're if you're interested in more of these issues, you know, you can ah check out my book. Also, um I have a sub stack that you can subscribe to for free. ah So if you're interested in reading up on, you know, kind of my latest thinking about different things, ah I recommend that. um Also in my Substack, I ah post every month ah some articles being written by some great scholars and commenters who have some really interesting thoughts about what can be done.
Speaker: I think the biggest thing is yeah for ah folks to keep the pressure on policymakers. Don't accept their half measures that are being given, ah keep demanding that something be done.
Speaker: I think that you know what we're seeing now with the backlash against Flock, ah these ah you know license plate readers and and some of these technologies, this backlash, this public uh, outrage about it. That is really, really helpful. That really does make a difference. It really does, uh, show policymakers that they need to do something better and more.
Speaker: And that's, I think the most effective thing that people can do. You be, be, uh, inform yourself about these issues and, uh, uh, yeah make noise so that the policymakers will recognize that this matters. And I think there's just a lot of really smart people who are thinking really interesting, creative thoughts about what to do about this. um I'm very fortunate to work in a field with some really great scholars who are are thoughtful, ah philosophical, but also practical.
Speaker: ah And they have some really good solutions. If only the policymakers were to listen, they only looked at this literature. ah There's a lot of stuff out there.
Speaker: Most of it's free and accessible to be read. And it's great stuff. That's why i write about it on my Substack, because I think there's so much good stuff being out there, so much stuff out there.
Speaker: And it just ah we just need the political will to ah get people to look for these solutions. ah It's not like they're not there, they're there.
Speaker: ah It's really getting the political will to do it. And so I think the best thing people can do is help that effort to try to get policymakers to realize like they're ah their half measure that they passed is just not going to cut it. is not They're not going to be happy with it and keep demanding more.
Speaker: We've been in conversation with Daniel J. Solove. Dan, thanks for your time. Thanks so much for having me.
