Protecting the Inner Environment : What Privacy Regulation Can Learn from Environmental Law

The Information Economy produces a host of new injuries to personal privacy. These include damage from data mining, data spills, identity theft, the tracking of online activity, and spam. Policymakers are currently searching for a framework with which to think about the governance of these pressing problems. This article argues that environmental law can serve as a useful model. Environmental law is promising for two reasons. First, privacy injuries and environmental damage share a common conceptual structure. Both are negative externalities. Moreover, in the absence of regulation, both will produce a tragedy of the commons - privacy injuries will create such a tragedy in the online environment, while environmental damage will produce one in the natural world. These structural similarities suggest that environmental policy has been dealing with problems that are comparable to those that privacy regulation now faces, and so may be an appropriate model for it. Second, environmental law and policy has been the focal point of a decades-long, highly productive discussion about governance. The intensity of this debate, and the regulatory innovations that it has produced, have made environmental policy the hub of creative thinking about regulation. The article identifies four contemporary regulatory strategies, pioneered in the environmental field, that could serve as particularly good models for privacy regulation. They are: emission fees, pollution transfer and release registries, regulatory covenants, and government support for environmental management systems. The article describes each of these environmental policies in some detail. It then explains how policymakers might productively adapt them for use in protecting privacy. The author initially discussed these ideas in a brief book chapter that he posted on SSRN. This article explores the topic in far greater depth than that earlier publication