Abstract:In the online and offline worlds, the value of personal information – especially information about commercial purchases and preferences – has long been recognised. Exchanges and uses of personal information have also long sparked concerns about privacy. Public opinion surveys consistently indicate that overwhelming majorities of the American public are concerned that they have lost all control over information about themselves and do not trust organisations to protect the privacy of their information. Somewhat smaller majorities favour federal legislation to protect privacy. Despite public support for stronger privacy protection, the prevailing policy stance for over thirty years has been one of reluctance to legislate and a preference for self‐regulation by business to protect privacy. Although some privacy legislation has been adopted, policy debates about the commercial uses of personal information have been dominated largely by business concerns about intrusive government regulation, free speech and the flow of commercial information, costs, and effectiveness. Public concerns about privacy, reflected in public opinion surveys and voiced by a number of public interest groups, are often discredited because individuals seem to behave as though privacy is not important. Although people express concern about privacy, they routinely disclose personal information because of convenience, discounts and other incentives, or a lack of understanding of the consequences. This disconnect between public opinion and public behaviour has been interpreted to support a self‐regulatory approach to privacy protections with emphasis on giving individuals notice and choice about information practices. In theory the self‐regulatory approach also entails some enforcement mechanism to ensure that organisations are doing what they claim, and a redress mechanism by which individuals can seek compensation if they are wronged. This article analyses the course of policy formulation over the last twenty years with particular attention on how policymakers and stakeholders have used public opinion about the commercial use of personal information in formulating policy to protect privacy. The article considers policy activities in both Congress and the Federal Trade Commission that have resulted in an emphasis on “notice and consent.” The article concludes that both individual behaviour and organisational behaviour are skewed in a privacy invasive direction. People are less likely to make choices to protect their privacy unless these choices are relatively easy, obvious, and low cost. If a privacy protection choice entails additional steps, most rational people will not take those steps. This appears logically to be true and to be supported by behaviour in the physical world. Organisations are unlikely to act unilaterally to make their practices less privacy invasive because such actions will impose costs on them that are not imposed on their competitors. Overall then, the privacy level available is less than what the norms of society and the stated preferences of people require. A consent scheme that is most protective of privacy imposes the largest burden on the individual, as well as costs to the individual, while a consent scheme that is least protective of privacy imposes the least burden on the individual, as well as fewer costs to the individual. Recent experience with privacy notices that resulted from the financial privacy provisions in Gramm‐Leach‐Bliley supports this conclusion. Finally, the article will consider whether the terrorist attacks of 11 September have changed public opinion about privacy and what the policy implications of any changes in public opinion are likely to be.

A decade after the Personal Data Protection Act 2010 (PDPA): Compliance of communications companies with the notice and choice principle

Compliance with Malaysian Personal Data Protection Act 2010 by banking and financial institutions, a legal survey on privacy policies

Compliance to personal data protection principles: A study of how organizations frame privacy policy notices

Comparative Review of Personal Data Protection Policy in Indonesia and The European Union General Data Protection Regulation

Penal Provisions in the Personal Data Protection Law: A Comparative Legal Study between Indonesia and Singapore

E-Commerce and Privacy Issues: An Analysis of the Personal Data Protection Bill

Strengthening Personal Data Protection, Cyber Security, and Improving Public Awareness in Indonesia: Progressive Legal Perspective

Personal Data Protection in Private Sector Electronic Systems for Businesses: Indonesia vs. South Korea

The Personal Data Protection of Internet Users in Indonesia

A examination on personal data protection in metaverse technology in Indonesia: a human rights perspective

Legal Protection of Telecommunication Service Customers' Personal Data as Trade Secrets in Merger And Acquisition Processes Based on Positive Law in Indonesia

Perception of Digital Privacy Protection: An Empirical Study using GDPR Framework

Exploring the Relationships between Privacy by Design Schemes and Privacy Laws: A Comparative Analysis

Examining Personal Data Protection Law of Indonesia and South Korea: The Privacy Rights Fulfilment

Privacy and Commercial Use of Personal Data: Policy Developments in the United States

Compliance to GDPR Data Protection and Privacy in Artificial Intelligence Technology: Legal and Ethical Ramifications in Malaysia

Cybersecurity Law Exploration: Personal Data Protection in 2023

CYBER SECURITY AND DATA PRIVACY LAW IN PAKISTAN: PROTECTING INFORMATION AND PRIVACY IN THE DIGITAL AGE

Addressing the 'Failure' of Informed Consent in Online Data Protection: Learning the Lessons from Behaviour-Aware Regulation

Detecting Compliance of Privacy Policies with Data Protection Laws

Protection of personal data in China: Legislation in the digital age