Costs and Benefits

In considering the costs and benefits of access and security the Subgroup decided that each should be examined independently for businesses and consumers. In addition to the considerations listed below, the Subgroup believes that secondary costs that may attach to access should be considered. While difficult to quantify, benefits to (individuals) society and (business) commerce due to openness and accountability should be considered. Similarly, while difficult to directly correlate, the costs to businesses and consumers of improper decision-making due to poor data quality should be considered. Such costs may include the failure of the market to offer consumers relevant services and the lost revenue or perhaps even liability costs to businesses of decisions based on data of poor quality.

Where possible, we believe the Advisory Committee, and the Commission, should examine existing data. Online businesses that currently provide access may have information about the benefits and costs of providing it and their experiences with consumers. Other businesses that interact with consumers, and other countries where access is provided, may have information regarding the benefits and costs of providing access.

Many companies have had direct experience with providing access. This includes companies in Europe. Cable companies also provide access. The Advisory committee should gather the experience of these companies to determine what proportion of consumers actually exercise their rights of access. In assessing costs and benefits the Committee should consider whether the costs are justified by the use of the ability to obtain access. In making this assessment, the Committee should try to determine how difficult it may be for consumers to access their personal information held by these companies. The Committee should also evaluate the extent of consumers' knowledge of their right to access such personal information.

Finally , the Committee may need to independently seek out data.

The Subgroup believes that the use of information is an important factor in considering the relative importance of access. For instance, the Committee may consider it more important to ensure that individuals have access to information used to make important decisions, such as the granting of credit, than for data that while retained is not used to make decisions about the individual, such as Web traffic logs.

Business Costs: in assessing the cost to businesses the following variables merit consideration.

• Methods of access - online, offline, etc.
• The kind of system
• The function of the system
• The time period for access - realtime, other time periods
• Scope of access - what information?
• Sensitivity of the information - more sensitive data may require enhanced security
• Volume of information
• Volume of requests that may be reasonably anticipated
• Type of information
• Required modifications, or design requirements, placed on system
• Personnel additions and training
• Storage costs
• Costs of correction or deletion of personal information
• Costs of resolving accuracy disputes
• Potential legal exposure

Consumer Costs: in assessing the cost to consumers the following variables merit consideration.

• Pass through costs for system upgrades, personnel etc.
• Security - perhaps the need for enhanced authentication to ensure appropriate access
• Opportunity costs - businesses not investing in additional products, lessening competition, fewer goods and services
• Loss of privacy due to inappropriate access due to bad actors
• Loss of privacy do to the centralization and linking of information that may not be centralized or linked for any other purpose
• Training for new tools to provide access
• Equipment costs (in some instances)
• Any access fee

Business Benefits: in assessing the benefits to businesses the following variables merit consideration.

• Increased customer market - online differentiator
• Increased reliability and accuracy of data
• Confidence - building consumer trust
• Streamlining and increasing efficiency - requirement to provide access may act as a check on collection and retention, design systems with a "need to know" (how is this a cost benefit issue)
• Public relations benefit
• Deeper customer relationships
• Enhanced decisions - better data = better decisions
• Limit the proliferation of bad data
• Competitive advantage versus companies with poor access policies

Consumer Benefits: in assessing the benefits to consumers the following variables merit consideration.

• Accountability - ability to act as a check on business adherence to policies
• Confidence - increased confidence in online environment
• Appropriate decisions - right offers, right products
• Control over the accuracy of personal information
• Ability to identify inaccurate data and correct before it harms them, particularly important where we have an important life decision
• Enriched understanding of data collection
• Knowledge of data source/ right to modify, delete
• Ability to make better privacy decisions in the marketplace - including decisions to protect anonymity
• Check on over-collection of personal information
• Ability to police businesses for compliance with policies