The Opt-in Approach to Choice

Barbara Lawler, Chief Privacy Officer
Scott Cooper, Manager, Technology Policy
Hewlett-Packard

A key issue in the privacy debate has been the manner in which a consumer can make choices about the (secondary) use of their personally identifiable information (PII). By secondary use, we mean sharing/giving that data to another (third party) organization.

Choice is one of the central tenants of the fair information practices. The discussion about choice usually centers on a debate about whether an opt-in or an opt-out approach to choice yields the greater benefit to consumers, business and the growth of the online economy. In an opt-in regime, information a consumer gives to an organization cannot be shared with third parties unless the consumer is offered and expressly makes the choice that their PII can be shared. In contrast, an opt-out regime assumes that it is acceptable to share a consumer's PII unless the consumer expressly states that they do not want their PII shared.

For the most part, business groups have preferred an opt-out approach, because it is easier to capture consumer information based on the assumption that sharing consumers' PII is acceptable (i.e. the consumer expresses no choice). For many organizations, the use of PII beyond the original transaction � sharing, trading or selling personal data � is a part of their business strategy based on the belief is that such uses benefit both the organization and the consumer. This approach poses a dilemma for consumers, for whom the benefits or implications of third party sharing of their PII for other uses may not be well understood, or who may not be aware of any sharing if there is no notice to that effect.

Because consumers may not be aware of their options under an opt-out regime, most privacy bills that have called for opt-out have also required clear and conspicuous notice of consumer choices about data sharing. Most consumer advocates prefer opt-in regimes, as opt-in requires businesses to both inform (give notice) and ask consumers to make an active choice in agreeing to share their PII. Businesses may offer consumers incentives to agree to information sharing, in the form of such things as discounts, coupons, or downloads of additional digital content.

Opt-in Yields Better Quality Data

Historically, opt-out strategies have made it possible for businesses to collect a large amount of consumers' personal data and to use it in a myriad of ways. The corresponding inherent lack of consumer choices and awareness of those choices creates a relationship imbalance between the consumer and the business, driving down trust and overall database and data quality. Opt-out is a high-volume, low-quality approach.

A benefit to businesses of opt-in personal information capture and use strategies is that the quality of the information gathered is usually much higher than that collected through opt-out approaches. A recent Peppers and Rogers survey showed modest decreases in total volume of data collected through opt-in but significantly increased accuracy of the data � yielding a much better return on investment for uses internal to the businesses as well as to potential data sharing.

Consumers giving their PII under opt-out approaches are more likely to give false or incomplete data. This undermines the business' overall businesses effort to serve their customers and maintain high data quality. It undermines one of the basic tenants of a business' Customer Relationship Management (CRM) strategy. Businesses must always clean their databases on a regular basis, but that cleaning is more extensive, more expensive, and unlikely to identify false information. In some cases data quality issues are further compounded in an opt-out regime by the sheer volume of information such a system yields. The amount of information collected may overwhelm and/or dilute the value of further use of the information, reducing the return on investment.

PII given by consumers under opt-in is of higher quality because the decisions are more informed, more engaged and made in an environment of higher trust and equity. Consumers have chosen to share their PII because they believe that the company they are dealing with can be trusted and that they will derive commensurate benefits in exchange for their personal information. The gravitation of some companies � such as Hewlett-Packard (HP) � to opt-in permission-based marketing strategies, is an indicator of business recognition that better data will yield better results and a better return on investment, and that an opt-in regime results in enhanced consumer trust and confidence.

Opt-in Is a Value Proposition that Enhances Brand Loyalty, Trust and Customer Relationships

HP applies a universal, global privacy policy built on the fair information practices: notice, choice, accuracy & access, security and oversight. Whether it is posted in English, French or Japanese, the policy's core commitments are essentially the same, allowing for minimal variations to reflect and comply with the requirements of local country laws. Key elements of HP's policy include (1) a prohibition on the selling of customer data; (2) a prohibition on the sharing of customer data outside HP without customer permission (opt-in); (3) a provision for customer access to core contact data; and (4) a customer feedback mechanism. Through contractual obligations, (privacy clauses, personal data protection amendments and non-disclosure agreements), suppliers working on HP's behalf must also abide by the HP privacy policy. Positive customer feedback to HP validates this approach. It has become a recognized industry best practice.

Conclusion

If the ability to spend is the fuel that propels the economic engine, then consumers' trust and confidence in that engine is the lubricant. That trust would be best served by giving clear, active choices to consumers about the secondary sharing of their personal information � an opt-in approach.

At the same time, the continued free flow of other types of data that is not PII or connected with PII has well-known, documented economic benefits for both consumers and businesses. That free flow of data may be best served by an opt-out mechanism, allowing opportunities for competitive differentiation by businesses. A very constructive discussion can be held in the 108th Congress about where the demarcation should be made between opt-in and opt-out approaches that support both business and consumer needs.