Online Data Present A Privacy Minefield Is privacy still possible? For a lot of people, the answer is no, as companies collect personal data in ever-increasing volumes. It flows from online sources — everything from gambling sites to dating services. Even some of your medical information is fair game.
NPR logo

Online Data Present A Privacy Minefield

  • Download
  • <iframe src="" width="100%" height="290" frameborder="0" scrolling="no" title="NPR embedded audio player">
  • Transcript
Online Data Present A Privacy Minefield

Online Data Present A Privacy Minefield

  • Download
  • <iframe src="" width="100%" height="290" frameborder="0" scrolling="no" title="NPR embedded audio player">
  • Transcript


This is ALL THINGS CONSIDERED from NPR News. I'm Robert Siegel.


And I'm Melissa Block.

Today, we're starting a series of stories about privacy, or as we're calling the series, The End of Privacy.

NPR's Martin Kaste is here with us at NPR West. Martin, that title is your idea. You're calling it The End of Privacy. So, the message there: Forget about privacy, it's over.

MARTIN KASTE: Well, it's not necessarily what I'm saying, but what struck me over the last couple of years as I've done stories about privacy is how many people say this to me. They say they've given up. The technologies have become too fast, they're too good at collecting data. And in some ways I'm hearing a lot of people say that they've sort of succumbed to what I'm calling privacy fatalism.

BLOCK: Privacy fatalism sounds like a pretty gloomy future to me.

KASTE: Well, it's what we're going to try to look at in this series to see if that fatalism is justified. And I think a good place for us to start today is just looking at what kind of information is really out there. So, for instance, you've got a computer in front of you here in the studio.

BLOCK: Yeah.

KASTE: Take a look at this Web site, type in

(Soundbite of typing)


KASTE: And when you look there, you'll see that it's a searchable site. It's sort of the Google of mailing lists. Put in a search term. Let's say something medical, because that's what people care about - bladder perhaps.

BLOCK: Bladder, okay.

KASTE: That might lead to...

BLOCK: Searching all mailing lists for bladder, coming up with bladder leakage database, bladder sufferers, all kinds of...

KASTE: Now, these are not just statistics. These are lists of people's names, their addresses, their phone number sometimes tied in with their medical conditions. Sometimes medical conditions that I would assume they would not want necessarily for sale, yet here they are for sale. This has always happened in the past, of course. There's always been ways for marketers to get information about, say, our medical conditions from warranty cards for things we fill out or magazine subscriptions. But all of that is accelerating and what we have now is sort of a switch from dial up speeds to broadband speeds for the flow of this information into this vast data pool.

BLOCK: We should say, I don't see the names popping up here. I would have to pay money to have that...

KASTE: You'd have to pay money. You can pay - you can buy per thousand and so forth. It's definitely a commodity.

BLOCK: Are there regulations, Martin, on how much information these companies can collect, what kind of information they can gather?

KASTE: Not really. This kind of data is pretty much unregulated in the United States. It's not legal for your doctor or your hospital to sell your medical data, of course. That is prohibited by federal law, but if you voluntarily give up your information, all the law cares about is where the information came from. Now, the industry, of course, is very adamant that it's careful that the reputable firms aren't selling this information to just anybody. Yes, you can look at the Web site and see that it's for sale, but they still want to know more about you before they sell it to you.

I actually called the founder and CEO of Nextmark, the site you were looking at there. His name is Joe Pych. And he said that consumers should also keep in mind that there are some benefits to companies knowing more about us.

Mr. JOE PYCH (CEO, Nextmark): I think when it's done right, just as with a good friend, sharing personal information makes for a much relevant, meaningful relationship and without that, you're really just a number.

KASTE: And this is really the crux of the issue because people do use their personal information to get stuff, to get good relationships with companies, to get coupons, bonuses, that sort of thing. They trade their personal information and they do it to the point where it's actually becoming a subject for economists.

Professor ALESSANDRO ACQUISTI (Economist, Carnegie Mellon University): Those exchanges happen daily, constantly.

KASTE: That's Alessandro Acquisti. He's an Italian economist who specializes in privacy. And the way he sees things, personal information is almost a kind of currency. It's something we spend. But there's a problem.

Prof. ACQUISTI: We don't have infinite cognitive power and processing power to consider all the different options, and we take shortcuts.

KASTE: Acquisti studies these shortcuts that we take. He studies how people make gut decisions about which information to disclose about themselves - for example, online. It turns out that, according to his experiments, we're influenced by Web site design.

Prof. ACQUISTI: People admit more sensitive, even embarrassing or illegal behaviors to a Web site which has been designed to look kind of cheesy.

KASTE: In his experiments he's found that subjects are more likely to admit to, say, cheating on their girlfriend or something, when the questions are on this cheesy, fun-looking Web site. But a more formal-looking Web site asking the same questions gets a lot more caution and a lot more self-censorship.

BLOCK: So, Martin, you're saying that people sometimes will decide whether they want to share their information based on a gut instinct, but you could also be pretty rational about this, I suppose. You could read a company privacy policy and make an informed decision about what you're disclosing.

KASTE: That's very true. And some people make that effort. They read the fine print. But even the experts, the people who are privacy gurus, say that's becoming harder to do because you may see a privacy policy there, but it's pretty much impossible in most situations to know where your data is going if they are sending it anywhere. It's hard to follow it through the system. Chris Hoofnagle is the head of privacy programs at Berkeley Law and he explained some of this to me.

Mr. CHRIS HOOFNAGLE (Privacy Programs, University of California, Berkeley School of Law): As there's been growing awareness of how commercial data brokers operate, they become more secretive.

KASTE: We were talking at a park in San Francisco a few weeks ago. And when we met, Chris immediately opened up his laptop because he wanted to show me something.

Mr. HOOFNAGLE: This is an archive�

KASTE: He's been saving screenshots of the Web sites of the big data companies over time. He's been saving screenshots of what they say about where their data is coming from. The formal term for this is data provenance. As recently as 2002 in his screenshots, there you can see that this particular data company still disclosed some details about the commercial sources of the data. It listed things like call centers or pizza delivery companies that sold information to them. But lately that's changed.

Mr. HOOFNAGLE: As time goes on, this gets thinner and thinner. So, pizza companies falls off the list. And then by 2006, the provenance is gone.

KASTE: Nothing listed for provenance?

Mr. HOOFNAGLE: They basically say things like the process includes proprietary files. That essentially means it's sources that they've gathered, but they won't tell you what the sources are.

KASTE: Now, it should be noted that data brokers have good business reasons to keep their sources secret. They may be trade secrets or something the other guy hasn't discovered. But Hoofnagle also believes that there is some political motivation behind this.

Mr. HOOFNAGLE: If consumers knew the extent to which this information was being collected and repackaged, there would be riots in the streets.

BLOCK: Riots in the street, Martin.

KASTE: Yeah, it's a bit of an overstatement and, you know, he cares deeply about these things. But there is some truth to the fact that American privacy laws have traditionally been driven by scandals. That's why, for example, we have federal protections for our video rental records just because there was a dus-up in the '80s because someone published the lineup for Judge Robert Bork's personal movie nights.

BLOCK: Oh, right.

KASTE: So, that's why we have that protection. It's always about a scandal. And now as data companies are beginning to extend their reach into interesting new areas, like social networks, it's probably a smart thing to keep some of those new sources below the radar.

BLOCK: You're talking about social networks like Facebook, for example. How valuable would that kind of data be?

KASTE: Well, you remember how Alessandro Acquisti was talking about the cheese factor?

BLOCK: Yeah.

KASTE: Well, the fact is that people are less inhibited about themselves on informal Web sites and that's true on social sites especially. And data companies now know that. They want that information that you're sharing so freely about yourself on social sites. And that's what tomorrow's story is all about.

BLOCK: Okay, NPR's Martin Kaste, thanks so much.

KASTE: My pleasure.

Copyright © 2009 NPR. All rights reserved. Visit our website terms of use and permissions pages at for further information.

NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.