Information Privacy and Marketing: What the U.S. Should (and Shouldn't) Learn from Europe
Information Privacy and Marketing:
WHAT THE U.S. SHOULD (AND
SHOULDN'T) LEARN FROM EUROPE
H. Jeff Smith
A
A few years ago, I spent a week in Sweden meeting with various individuals who were interested in issues of information privacy. After talking for a number of hours with employees at the Data Inspection
Board (DIB), Sweden's federal regulatory agency for privacy, I interviewed several executives in the country's private sector. I soon realized that at least half of each discussion was spent in trying to narrow the gap in our collective understanding of one another's privacy environment. The Swedes simply could not identify with my American tales of data collection regarding consumers' backgrounds, purchases, and histories; the compilation of these data into various sorts of profiles; and the trading of this information between various entities. That most of this was done with little or no governmental oversight was perplexing to them. On more than one occasion, my Swedish compatriot responded along the lines of "you Americans just don't seem to care about privacy, do you?"
At the same time, it was almost impossible for me to identify with the
Swedish approach to privacy regulation, which requires corporations and other entities to register all databases containing personal information with the DIB and to secure advance permission from the DIB before using certain data.' Furthermore, while the frequency with which it has done so has varied greatly over the years, the DIB has the right to inspect the data processing operations of any
Swedish entity to ensure its compliance with privacy regulations. If the DIB
I am grateful to Mark Keil, Sandra Milberg, and the reviewers and editors of California Management
Review for their helpful connments on earlier versions of this article.This research v/as supported by the
Babcock Graduate School of Management, Wake Forest University, Research Fellowship Program. I am indebted to
WHAT THE U.S. SHOULD (AND
SHOULDN'T) LEARN FROM EUROPE
H. Jeff Smith
A
A few years ago, I spent a week in Sweden meeting with various individuals who were interested in issues of information privacy. After talking for a number of hours with employees at the Data Inspection
Board (DIB), Sweden's federal regulatory agency for privacy, I interviewed several executives in the country's private sector. I soon realized that at least half of each discussion was spent in trying to narrow the gap in our collective understanding of one another's privacy environment. The Swedes simply could not identify with my American tales of data collection regarding consumers' backgrounds, purchases, and histories; the compilation of these data into various sorts of profiles; and the trading of this information between various entities. That most of this was done with little or no governmental oversight was perplexing to them. On more than one occasion, my Swedish compatriot responded along the lines of "you Americans just don't seem to care about privacy, do you?"
At the same time, it was almost impossible for me to identify with the
Swedish approach to privacy regulation, which requires corporations and other entities to register all databases containing personal information with the DIB and to secure advance permission from the DIB before using certain data.' Furthermore, while the frequency with which it has done so has varied greatly over the years, the DIB has the right to inspect the data processing operations of any
Swedish entity to ensure its compliance with privacy regulations. If the DIB
I am grateful to Mark Keil, Sandra Milberg, and the reviewers and editors of California Management
Review for their helpful connments on earlier versions of this article.This research v/as supported by the
Babcock Graduate School of Management, Wake Forest University, Research Fellowship Program. I am indebted to