Rebecca Perlman, Regulating Risk: How Private Information Shapes Global Safety Standards Cambridge University Press, 2023

Gary Winslett

DOI: https://doi.org/10.1017/s1474745624000454

IF: 1.7082

2024-10-10

World Trade Review

Abstract://static.cambridge.org/content/id/urn%3Acambridge.org%3Aid%3Aarticle%3AS1474745624000454/resource/name/firstPage-pdf-S1474745624000454a.jpg

economics,international relations,law

What problem does this paper attempt to address?

The Public Life of Private Law: Tort Law as a Risk Regulation Mechanism

Douglas A KYSAR

DOI: https://doi.org/10.1017/err.2017.79

2018-03-01

European Journal of Risk Regulation

Abstract:Abstract Against the backdrop of contemporary climate change lawsuits, this article presents preliminary research findings regarding a remarkable and underappreciated moment in the common law pre-history of modern environmental, health, and safety regulation. The findings complicate the conventional academic story about the limited capabilities of tort law and its inevitable displacement by more institutionally robust and sophisticated forms of regulation. Section I offers a brief introduction, followed in Section II by a review of existing academic literature on the pros and cons of utilising tort law as a regulatory device. As will be seen, the consensus view seems to be that tort law is a clumsy and imperfect mechanism for addressing most environmental, health, and safety risks. Section III argues that the debate over tort law’s potential as a risk regulation mechanism ignores the distinctively private law history and character of that body of law, essentially asking tort to serve a purpose for which it was neither intended nor designed. Section IV then presents a case study of nuisance litigation in which the tort system achieves a remarkable and underappreciated risk regulation effect precisely by focusing narrowly on the traditional task of adjudicating alleged wrongs between private parties. Section V concludes.
Friction Matters: Balancing the Pursuit of Perfect Protection With Target Hardening

Elissa M. Redmiles

DOI: https://doi.org/10.1109/msec.2023.3333972

IF: 3.105

2024-02-03

IEEE Security & Privacy

Abstract:It is my great pleasure to share a guest "Last Word" column by Dr. Elissa Redmiles, Clare Luce Boothe Assistant Professor at Georgetown University, with IEEE Security & Privacy (S&P) readers. Prof. Redmiles has gained particular attention due to her highly lauded work in security and privacy inequities in marginalized and at-risk communities. This column gives a flavor of the real-world practical insights that have resulted from this work, which I hope will also lead S&P readers to want to delve further into the terrific set of references provided.

computer science, information systems, software engineering
Mobilizing Risk: Explaining Policy Transfer in Food and Occupational Safety Regulation in the UK

David Demeritt,Henry Rothstein,Anne-Laure Beaussier,Michael Howard

DOI: https://doi.org/10.1068/a140085p

2015-01-01

Abstract:Using comparative methods of policy analysis, this paper explores the institutional factors shaping the transfer and adaptation of risk-based approaches to regulation within and between the regimes for occupational health and safety (OHS) and food safety in the UK. Over the past two decades successive governments have enthusiastically promoted risk as a key concept for regulatory reform and ‘better regulation’. Rather than trying to prevent all possible harms, ‘risk-based’ approaches promise to make regulation more proportionate and effective by using various risk-based metrics and policy instruments to focus regulatory standard-setting and enforcement activity on the highest priority risks, as determined through formal assessments of their probability and consequences. But despite facing similar external pressures and sharing many historical and structural features as OHS, food safety regulation has proven much less receptive to risk-based reforms of its organizing principles and practices. To explain that anomaly, we consider a range of explanations highlighted in the policy transfer and mobilities literatures. We find that coercive drivers for the adoption of risk, in the form of top-down political pressure for deregulation or hard EU mandates, are much less influential than voluntary ones, which reflect both normative (ie, shared commitments to proportionality, resource prioritization, and blame deflection) and mimetic (ie, imitation of private sector corporate governance models) isomorphism. We conclude with wider reflections about the significance of our cases for policy transfer and mobilities research and for the limits to risk as a universal principle for organizing, and accounting for, governance activity.
Reputational Risk as a Logic of Organizing in Late Modernity

Michael Power,Tobias Scheytt,Kim Soin,Kerstin Sahlin

DOI: https://doi.org/10.1177/0170840608101482

2009-02-01

Organization Studies

Abstract:This paper argues that it is useful to regard `reputational risk' as a pervasive logic of organizing and organizational attention. First, we suggest that the risk management agenda has expanded from its roots in technical analysis to become a cornerstone of good governance and responsible actorhood. We illustrate this claim in the context of English universities. Second, we suggest that this expansion in the reach and significance of risk management has increased organizational orientations to reputational risk and to more defensively and legalistically framed forms of asset management. Specifically, organizations are responding to the growth of external bodies which evaluate and rank, and thereby generate reputational risk. In the context of universities, we argue that this leads both to specific transformations in organizational practices in response to ranking systems, and also to an increased generalized concern with reputational risk, which is a symptom of late modern insecurity.

management
Anu Bradford, Digital Empires: The Global Battle to Regulate Technology Oxford University Press, 2023, 599 pages

Patrick Leblond

DOI: https://doi.org/10.1017/s1474745624000259

IF: 1.7082

2024-09-27

World Trade Review

Abstract://static.cambridge.org/content/id/urn%3Acambridge.org%3Aid%3Aarticle%3AS1474745624000259/resource/name/firstPage-pdf-S1474745624000259a.jpg

economics,international relations,law
Risks and Risk Regulation: Personal Reflections

Francis Snyder

DOI: https://doi.org/10.1017/err.2016.2

2017-01-01

European Journal of Risk Regulation

Abstract:An abstract is not available for this content so a preview has been provided. Please use the Get access link above for information on how to access this content.
Privacy regulations and economic efficiency: a dynamic perspective

Francesc Dilme

DOI: https://doi.org/10.12688/openreseurope.16103.1

2023-08-31

Abstract:There are important public debates on how-or even whether-to regulate information about previous transactions in different markets. Examples are the regulation of cookies in online markets, secrecy laws in financial markets, and transparency directives in government purchases. In these debates, considerations of economic efficiency and fairness are central. Do more lenient information policies increase market efficiency? Do internet users benefit from cookies? Does more secrecy increase trade volume in financial markets? Does transparency on previous agreements deteriorate the bargaining power of public agencies? This essay sheds light on the answers to these questions using insights from economic theory. We do so by analyzing a simple, stylized setting where the incentives of different agents in the market will be clear. Our focus is on the dynamic effects of information regulations, as a trader's incentive to reveal or conceal information is driven by its future use by other traders. We use our setting to assess the implications of information regulations on behavior, trade efficiency, or social welfare.
Better Business Regulation in a Risk Society

DOI: https://doi.org/10.1007/978-1-4614-4406-0

2013-01-01

Abstract:The premise of this volume is that business regulations are expected to grow in the near future as a consequence of the emergence of a “(world) risk society.” Risks related to terrorism, climate change, and financial crises, for example, will penetrate all conditions of life. Increasingly, the decisions and actions of some bring about risks for many in this era of globalization. Controlling these risks implies managing the world through high-quality regulation, with a particular emphasis on businesses and financial institutions. Central to this approach is the argument that a major, if not the primary, aim of regulation is to internalize externalities, or in a broader context, to repair market failure. Such repair can only be accomplished when the costs are smaller than the welfare gains. Featuring contributions from researchers and policy analysts from the fields of economics, management, law, sociology, political science, and environmental policy, this book focuses on three major topics: Social risks and business regulation Preconditions for better business regulation Theoretical issues related to better business regulation Collectively, the authors demonstrate that the easier it is for regulated businesses to comply at the lowest costs possible—without jeopardizing the related public goals—the greater the degree of compliance. When successful, the net result is a balance of individual and collective net benefits, and by further implication, sustainable business practice and economic growth.
Beyond the Privacy Paradox: Objective versus Relative Risk in Privacy Decision Making

Idris Adjerid,Eyal Peer,Alessandro Acquisti

DOI: https://doi.org/10.2139/ssrn.2765097

2016-01-01

SSRN Electronic Journal

Abstract:Privacy decision making has been examined from various perspectives. A dominant “normative” perspective has focused on rational processes by which consumers with stable preferences for privacy weigh the expected benefits of privacy choices against their potential costs. More recently, an alternate “behavioral” perspective has leveraged theories from behavioral decision research to construe privacy decision making as a process in which cognitive heuristics and biases predictably occur. In a series of experiments, we compare the predictive power of these two perspectives by evaluating the impact of changes in objective risk of disclosure and the impact of changes in relative perceptions of risk of disclosure on both hypothetical and actual consumer privacy choices. We find that both relative and objective risks can, in fact, impact consumer privacy decisions. However, and surprisingly, the impact of objective changes in risk diminishes between hypothetical and actual choice settings. Vice versa, the impact of relative risk is more pronounced going from hypothetical to actual choice settings. Our results suggest a way to integrate diverse streams of IS literature on privacy decision making: consumers may both over-estimate their response to normative factors and under-estimate their response to behavioral factors in hypothetical choice contexts relative to actual choice contexts.
Data Privacy and Risk Management, Collaboration is Key on Tackling Privacy Risks/Issues

Pranith Shetty,

DOI: https://doi.org/10.47363/jaicc/2023(2)224

2023-12-31

Abstract:Data Privacy is relevant for majority of the firms conducting businesses in the international market today. Better privacy safeguards and implementations are one of the key contributors in driving business output, companies are reporting direct and indirect benefits as a result of privacy project related investments. To be compliant with the Privacy regulation landscape globally is the need of the hour, there have been significant business impacts in terms of both financial and reputational, as a result of noncompliance to privacy regulations. To manage these risks, it is imperative for the Privacy assessment teams, Legal teams and Risk management teams to work together and tackle these challenges. This paper firstly aims at giving a perspective on global risk landscape and how the privacy regulations are gaining more traction every passing day, bringing in more states and countries into the fold. This article also narrates the approach or solution explaining how Risk management teams can partner with the relevant stakeholders in legal and privacy teams and guide the data privacy risks across firms, across business sectors. Through the risk management lifecycle thus remediating these risks, helping businesses prosper and at the same time safeguard individual interests.
Privacy Rights and Data Security: GDPR and Personal Data Markets

T. Tony Ke,K. Sudhir

DOI: https://doi.org/10.1287/mnsc.2022.4614

IF: 5.4

2022-12-04

Management Science

Abstract:General Data Protection Regulation (GDPR)—the European Union’s data protection regulation—has two key principles. It recognizes that individuals own and control their personal (but not contractual) data in perpetuity, leading to three critical privacy rights, namely, the rights to (i) explicit consent (data opt-in), (ii) to be forgotten (data erasure), and (iii) portability (data transfer). It also includes data security mandates against privacy breaches through unauthorized access. We study GDPR’s equilibrium impact by including these features in a dynamic two-period model of forward-looking firms and consumers. Firms collect consumer data for personalization and price discrimination. Consumers trade off gains from personalization relative to potential losses from privacy breaches and price discrimination in their purchase, data opt-in, erasure, and transfer decisions. Though data security mandates impose fines on firms for privacy breaches, firms can benefit from higher opt-in given lower breach risk. Surprisingly, data security mandates can hurt consumers. The effect of privacy rights is nuanced. Since the right to opt in separates goods exchange from the provision of personal data, it prevents market failure under high breach risk. But it also reduces consumer opt-in and personal data availability. Erasure and portability rights reduce consumers’ hold-up concerns by disciplining firms to provide ongoing value by limiting price discrimination and not slacking off on data security; but they also reduce the incentive to offer lower initial prices that encourages opt-in. Overall, privacy rights always benefit consumers in competitive markets, but they can surprisingly hurt consumers under monopoly, as monopolists have less incentives to subsidize consumer opt-in. They raise (reduce) firm profit and social welfare when breach risk is high (low). Finally, privacy rights increase firm profit most at moderate levels of data transferability. This paper was accepted by Dmitri Kuksov, marketing. Funding: T. T. Ke acknowledges financial support from the General Research Fund of the Hong Kong Research Grants Council [Grant 14500421]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/mnsc.2022.4614 .

management,operations research & management science
The Social Construction of Risk in Digital Preservation

Rebecca D. Frank

DOI: https://doi.org/10.1002/asi.24247

2019-05-15

Journal of the Association for Information Science and Technology

Abstract:<p>Digital information is fragile, yet access to digital information over time is a critical underpinning of core values and functions in our society, from open government to research and scholarship. Digital preservation research has focused on identifying technical, economic, and organizational sources of risk and has relied on an assumption that individuals will behave in rational and predictable ways in response to the same information. This article asserts that viewing digital preservation as a process that takes place in complex social contexts is just as important as thinking about digital preservation in terms of technological or economic issues. This is particularly important for understanding how individuals involved in digital preservation construct their understanding of risk because social factors influence how people construct their understanding of, and behave in response to, risk information. The author proposes an eight‐factor model for the social construction of risk, which includes: communication, complexity, expertise, organizations, political culture, trust, uncertainty, and vulnerability. The article demonstrates how these factors influence individuals as they construct their understanding of risk in the context of digital preservation and how this in turn affects digital preservation decisions.</p>

information science & library science,computer science, information systems
SoK: Technical Implementation and Human Impact of Internet Privacy Regulations

Eleanor Birrell,Jay Rodolitz,Angel Ding,Jenna Lee,Emily McReynolds,Jevan Hutson,Ada Lerner

DOI: https://doi.org/10.48550/arXiv.2312.15383

2023-12-24

Abstract:Growing recognition of the potential for exploitation of personal data and of the shortcomings of prior privacy regimes has led to the passage of a multitude of new online privacy regulations. Some of these laws -- notably the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) -- have been the focus of large bodies of research by the computer science community, while others have received less attention. In this work, we analyze a set of Internet privacy and data protection regulations drawn from around the world -- both those that have frequently been studied by computer scientists and those that have not -- and develop a taxonomy of rights granted and obligations imposed by these laws. We then leverage this taxonomy to systematize 270 technical research papers published in computer science venues that investigate the impact of these laws and explore how technical solutions can complement legal protections. Finally, we analyze the results in this space through an interdisciplinary lens and make recommendations for future work at the intersection of computer science and legal privacy.

Computers and Society
Regulatory compliance as defense in risk society

Zining Jin

DOI: https://doi.org/10.1080/20517483.2015.1048999

2015-01-01

Peking University Law Journal

Abstract:In risk society, damages caused by activities in compliance with various regulations are very common. The issue of whether regulatory compliance can be a defense to tort liability acquires significance both in theory and practice. Falling into the twilight zone between private law and public law, however, this issue has yet been under-researched amongst China's legal academics. Beginning by analyzing a widely-cited environmental tort lawsuit in China, this article reconsiders the issue by examining the related prevailing opinion and positive law in China, and drawing on the Endurance Limitation Theory from Japanese environmental law. Ultimately, it is proposed that in general the regulatory compliance shall be considered in deciding tort liability, and in specific cases the regulatory compliance shall be assigned different weight according to the specific category of the regulatory norms involved.
Risk Regulation and the " Faces " of Uncertainty

Vern R. Walker

1998-01-01

Abstract:Introduction The problem of “decision making in the face of uncertainty” is how to regulate on the basis of incomplete information that has significant potential to be inaccurate. My primary goal is to clarify some aspects of such decisionmaking through surveying types of uncertainty inherent in information. I present a taxonomy for kinds of inherent uncertainty — a classification and description of the “faces”of uncertainty. A second goal is to identify which kinds of uncertainty can and cannot now be measured quantitatively. A contextual assumption is that we need to evaluate decision rules for dealing with faces of uncertainty. As a social enterprise, risk regulation, whatever its substantive objectives, should be as effective, efficient and equitable as practically possible. These “three E’s” form a set of “process objectives” or “meta-goals.” First, risk regulation should be as effective as possible to maximize the likelihood of achieving a selected balance of risk taking and avoidance. Second, with regard to efficiency, we may, e.g., try to minimize adverse collateral consequences, maximize net benefits after accounting for costs, or use available resources cost-effectively. Third, the goal of equitable results is partly a concern for affected parties’ appropriate distribution of costs and benefits, and partly a respect for the potentially affected parties’ substantive and procedural rights. While these three meta-goals are distinct and complementary, they are also sometimes in tension. The optimal and most achievable blend of all three meta-goals depends upon circumstances surrounding each regulatory action. These meta-goals form an evaluative context for risk regulation and derivatively for regulatory factfinding. A necessary condition for
Properties of Effective Information Anonymity Regulations

Aloni Cohen,Micah Altman,Francesca Falzon,Evangelina Anna Markatou,Kobbi Nissim

2024-08-27

Abstract:A firm seeks to analyze a dataset and to release the results. The dataset contains information about individual people, and the firm is subject to some regulation that forbids the release of the dataset itself. The regulation also imposes conditions on the release of the results. What properties should the regulation satisfy? We restrict our attention to regulations tailored to controlling the downstream effects of the release specifically on the individuals to whom the data relate. A particular example of interest is an anonymization rule, where a data protection regulation limiting the disclosure of personally identifiable information does not restrict the distribution of data that has been sufficiently anonymized. In this paper, we develop a set of technical requirements for anonymization rules and related regulations. The requirements are derived by situating within a simple abstract model of data processing a set of guiding general principles put forth in prior work. We describe an approach to evaluating such regulations using these requirements -- thus enabling the application of the general principles for the design of mechanisms. As an exemplar, we evaluate competing interpretations of regulatory requirements from the EU's General Data Protection Regulation.

Computers and Society
An institutional perspective on governance, power, and politics of financial risk

W. Travis Selmier

DOI: https://doi.org/10.1017/bap.2017.8

IF: 2.457

2017-06-01

Business and Politics

Abstract:Abstract Avoidance of risk and increasing returns are the two main motivators in finance. Returns are better understood and perhaps more easily regulated than financial risk, which is a complex and slippery concept. Financial risk may be best conceived of as a complementary good, but the nature of this good varies as the size of the investment position scales up. That is, the effects of financial risk may be conceived of as a private good for a small financial actor, but becomes a club good, then a common pool, and occasionally a public good as the impact of the investment position's financial risk spreads to affect more of society. Examining banking history shows us that banks and bankers have offset risk while retaining returns through structuring financial products and investment vehicles as club goods, thereby enabling financial actors to jointly benefit from ownership while harming those outside the club walls. Not surprisingly, this capacity to push risk outside club walls has grown commensurate with the political influence of banks and bankers. Laying out governance strategies and concepts, I suggest that in some circumstances pervasive club good structures in finance may be employed to gather regulation-enhancing information, to better understand the networked nature of financial risk and to craft self-governance structures.
Liability Design with Information Acquisition

Francisco Poggi,Bruno Strulovici

DOI: https://doi.org/10.48550/arXiv.2012.05066

2020-12-09

Theoretical Economics

Abstract:How to guarantee that firms perform due diligence before launching potentially dangerous products? We study the design of liability rules when (i) limited liability prevents firms from internalizing the full damage they may cause, (ii) penalties are paid only if damage occurs, regardless of the product's inherent riskiness, (iii) firms have private information about their products' riskiness before performing due diligence. We show that (i) any liability mechanism can be implemented by a tariff that depends only on the evidence acquired by the firm if a damage occurs, not on any initial report by the firm about its private information, (ii) firms that assign a higher prior to product riskiness always perform more due diligence but less than is socially optimal, and (iii) under a simple and intuitive condition, any type-specific launch thresholds can be implemented by a monotonic tariff.
Impossible, unknowable, accountable: Dramas and dilemmas of data law

Alison Cool

DOI: https://doi.org/10.1177/0306312719846557

2019-05-06

Social Studies of Science

Abstract:On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) came into force. EU citizens are granted more control over personal data while companies and organizations are charged with increased responsibility enshrined in broad principles like transparency and accountability. Given the scope of the regulation, which aims to harmonize data practices across 28 member states with different concerns about data collection, the GDPR has significant consequences for individuals in the EU and globally. While the GDPR is primarily intended to regulate tech companies, it also has important implications for data use in scientific research. Drawing on ethnographic fieldwork with researchers, lawyers and legal scholars in Sweden, I argue that the GDPR’s flexible accountability principle effectively encourages researchers to reflect on their ethical responsibility but can also become a source of anxiety and produce unexpected results. Many researchers I spoke with expressed profound uncertainty about ‘impossible’ legal requirements for research data use. Despite the availability of legal texts and interpretations, I suggest we should take researchers’ concerns about ‘unknowable’ data law seriously. Many researchers’ sense of legal ambiguity led them to rethink their data practices and themselves as ethical subjects through an orientation to what they imagined as the ‘real people behind the data’, variously formulated as a Swedish population desiring data use for social benefit or a transnational public eager for research results. The intentions attributed to people, populations and publics – whom researchers only encountered in the abstract form of data – lent ethical weight to various and sometimes conflicting decisions about data security and sharing. Ultimately, researchers’ anxieties about their inability to discern the desires of the ‘real people’ lent new appeal to solutions, however flawed, that promised to alleviate the ethical burden of personal data.

history & philosophy of science
Privacy Risk is a Function of Information Type: Learnings for the Surveillance Capitalism Age.

Ranjan Pal,Junhui Li,Jon Crowcroft,Yong Li,Mingyan Liu,Nishanth Sastry

DOI: https://doi.org/10.1109/tnsm.2020.3046704

2020-01-01

IEEE Transactions on Network and Service Management

Abstract:ln-app advertising is a multi-billion dollar industry that is an essential part of the current digital ecosystem, and is amenable to sensitive consumer information often being sold downstream without the knowledge of consumers, and in many cases to their annoyance. While this practice, in cases, may result in long-term benefits for the consumers, it can result in serious information privacy (IP) breaches of very significant impact (e.g., breach of genetic data) in the short term. The question we raise through this article is: does the type of information being traded downstream play a role in the degree of IP risks generated? We investigate two general (one-many) information trading market structures between a single data aggregating seller (e.g., enterprise app) and multiple competing buyers (e.g., ad-networks, retailers), distinguished by mutually exclusive and privacy sanitized aggregated consumer data (information) types: (i) data entailing strategically complementary actions among buyers and (ii) data entailing strategically substituting actions among buyers. Our primary question of interest here is: trading which type of data might pose less information privacy risks for society? To this end, we show that at market equilibrium IP trading markets exhibiting strategic substitutes between buying firms pose lesser risks for IP in society, primarily because the 'substitutes' setting, in contrast to the 'complements' setting, economically incentivizes appropriate consumer data distortion by the seller in addition to restricting the proportion of buyers to which it sells. Moreover, we also show that irrespective of the data type traded by the seller, the likelihood of improved IP in society is higher if there is purposeful or free-riding based transfer/leakage of data between buying firms. This is because the seller finds itself economically incentivized to restrict the release of sanitized consumer data with respect to the span of its buyer space, as well as in improved data quality.

Rebecca Perlman, Regulating Risk: How Private Information Shapes Global Safety Standards Cambridge University Press, 2023

The Public Life of Private Law: Tort Law as a Risk Regulation Mechanism

Friction Matters: Balancing the Pursuit of Perfect Protection With Target Hardening

Mobilizing Risk: Explaining Policy Transfer in Food and Occupational Safety Regulation in the UK

Reputational Risk as a Logic of Organizing in Late Modernity

Anu Bradford, Digital Empires: The Global Battle to Regulate Technology Oxford University Press, 2023, 599 pages

Risks and Risk Regulation: Personal Reflections

Privacy regulations and economic efficiency: a dynamic perspective

Better Business Regulation in a Risk Society

Beyond the Privacy Paradox: Objective versus Relative Risk in Privacy Decision Making

Data Privacy and Risk Management, Collaboration is Key on Tackling Privacy Risks/Issues

Privacy Rights and Data Security: GDPR and Personal Data Markets

The Social Construction of Risk in Digital Preservation

SoK: Technical Implementation and Human Impact of Internet Privacy Regulations

Regulatory compliance as defense in risk society

Risk Regulation and the " Faces " of Uncertainty

Properties of Effective Information Anonymity Regulations

An institutional perspective on governance, power, and politics of financial risk

Liability Design with Information Acquisition

Impossible, unknowable, accountable: Dramas and dilemmas of data law

Privacy Risk is a Function of Information Type: Learnings for the Surveillance Capitalism Age.