Peer-produced Privacy Protection A Common-pool Approach

Privacy risks have been addressed through technical solutions such as privacy-enhancing technologies (PETs) as well as regulatory measures including Do Not Track. These approaches are inherently limited as they are grounded in the paradigm of a rational end user who can determine, articulate, and manage consistent privacy preferences. This implies that self-serving efforts to implement individual privacy preferences lead to socially optimal outcomes with regard to information sharing. Consequently, solutions to specific risks are developed, and even mandated, without effective reduction in the overall harm of privacy breaches. We present a systematic framework to examine the limitations of current technical and policy solutions. To address the shortcomings of existing privacy solutions, we argue for considering information sharing to be transactions within a community. Outcomes of privacy management can be improved at a lower overall cost if peers, as a community, are empowered by appropriate technical and policy mechanisms. Designing for a community requires encouraging dialogue, enabling transparency, and supporting enforcement of community norms. In this paper we show how peer production of privacy is possible through PETs that are grounded in the notion of information as a common-pool resource and community governance. Keywords-privacy, computer supported collaborative work, economics.