---
title: "Privacy as a public good: why “I consent” is not enough"
description: "One person's consent can expose people who never agreed. Fairfield and Engel (2015), the Facebook case, and what product teams and small firms can do."
url: "https://staging.khoi.co.uk/en/blog/rieng-tu-la-hang-hoa-cong"
lang: en-GB
author: "Lê Quốc Khôi"
date: 2026-11-03
updated: 2026-11-03
topics: ["Ethics & corporate governance"]
tags: ["Data privacy", "Consent", "Externality", "Data minimisation", "Public goods"]
---

# “I consent” is not enough: privacy as a public good

## Key takeaways

- Fairfield and Engel (2015): one person's data is often data about others too, so if everyone shares for private benefit the overall level of privacy ends up below what is best for all (Fairfield and Engel, 2015, p. 423).
- On 25 October 2018 the UK Information Commissioner's Office (ICO) fined Facebook £500,000: app developers could reach information about people who were merely friends of someone who had downloaded an app, and one developer harvested data on up to 87 million people (Information Commissioner's Office, 2018).
- Notice-and-consent treats the individual as the unit of decision. The authors still support it but want tools for groups as well (Fairfield and Engel, 2015, p. 393).
- What you can do now: collect less, default to closed, separate permissions, frame the choice as protecting others. Most of this is my own reasoning; the bakery is a hypothetical example.

On 25 October 2018 the ICO fined Facebook £500,000. According to the ICO, app developers could get at a user's information even if that person had never downloaded the app, simply because they were a friend of someone who had; one developer harvested data on up to 87 million people without their knowledge (Information Commissioner's Office, 2018). If you run a shop with a loyalty app, the same question applies to you: every customer taps “agree”, so who in your database never did? This post reads Fairfield and Engel (2015) to ask what a product team or a small-business owner can do about it. See also [the Facebook and Cambridge Analytica case](https://staging.khoi.co.uk/en/case/facebook-cambridge-analytica-data-risk).

## Why does one person's “I consent” expose other people?

Because data about one person is often data about the people around them. Fairfield and Engel open with that point: “Your privacy is not yours alone” (Fairfield and Engel, 2015, p. 387).

Writing in 2015, they note that mobile apps routinely scrape users' contact lists and calendars, and that email services parse conversations with third parties who never agreed (Fairfield and Engel, 2015, p. 403). Their sharpest line: by consenting to information gathering, “a user becomes a conduit for gathering information about her entire social network, whether or not they have consented” (Fairfield and Engel, 2015, p. 410). The Facebook case is that sentence in real life: the ICO found that Facebook let developers in without sufficiently clear and informed consent, friends included, and that the personal information of at least one million UK users was among the data harvested (Information Commissioner's Office, 2018).

## What do economists call this?

A public good, or more precisely a “public bad”. A public good is something everyone can share whether or not they pay for it, so each person has a reason to let others pay; a public bad, like polluted air, is its mirror image (Fairfield and Engel, 2015, pp. 387–388).

Applied to data: each time I share, I get a private benefit, such as a free service, and bear a small part of the cost; the rest falls on everyone. If the benefit exceeds my share of the cost, I share, even if everyone values privacy equally (Fairfield and Engel, 2015, p. 423).

A hypothetical example; every number is mine. A hundred people can use a free app. Each gets 6 points of benefit and bears 2 points of private cost, and each user costs every other person 0.1 points.

| Situation | Points per person |
|:--|:--|
| Nobody uses it | 0 |
| Only I use it | Me +4.0; each other person −0.1 |
| All 100 use it | Each person −5.9 |

Whatever others do, using the app beats not using it by 4 points, while my use costs the other 99 people 9.9 points in total. That is the “dominant strategy” the article describes (Fairfield and Engel, 2015, p. 422), in numbers.

> **Figure:** [Privacy as a public-good dilemma](https://staging.khoi.co.uk/en/framework/privacy-public-good-dilemma) The four-step cycle (redrawn after Fairfield and Engel, 2015, via the library's framework)

The article does not stop at tragedy: in experiments, groups cooperate more than theory predicts, especially with communication, sanctions or suitable framing (Fairfield and Engel, 2015, p. 391; Fairfield and Engel, 2015, p. 448). See [Privacy as a public-good dilemma](https://staging.khoi.co.uk/en/framework/privacy-public-good-dilemma) and [negative externality](https://staging.khoi.co.uk/en/glossary#negative-externality).

## Why are notices and consent buttons not enough?

Because they are built for the person tapping, and the person exposed is not in front of that screen. The authors call this an individualism bias: notice and choice give information about a person to that person and leave the decision to her (Fairfield and Engel, 2015, p. 409).

They make two points. Even a fully informed person controls only her own data, not the sea of data that algorithms work from (Fairfield and Engel, 2015, p. 411). And because so much information comes from third parties, “no one can truly opt out” (Fairfield and Engel, 2015, p. 411). They do not say drop notices; they support them, but think approaches that equip groups are worth more (Fairfield and Engel, 2015, p. 393).

The law goes the same way but not further. The [GDPR](https://staging.khoi.co.uk/en/glossary#data-privacy-and-gdpr) says withdrawing consent must be as easy as giving it (European Parliament and Council, 2016, Art. 7(3)). Vietnam's Law No. 91/2025/QH15, in force from 1 January 2026 (as in the text I read on 3 November 2026), requires consent for each purpose, bans tying it to consent for other purposes, and says silence is not consent (Article 9). Both raise the quality of the tapper's consent. In the articles I read, none addresses the person whose number sits in someone else's contact list; the nearest is Article 4(2)(b), which makes it a data subject's duty to respect and protect other people's personal data. That duty falls on the user, not on your product design. I am not a lawyer.

## How many people who never agreed can a small bakery hold?

More than it has customers: in this hypothetical, 126,000 contact rows for 2,000 customer records.

A bakery has a loyalty app with 2,000 customers. An “invite a friend, you both get a cake” feature asks to read the phone's contacts. Suppose 35 per cent of customers, 700 people, say yes, each with 180 contacts. The bakery receives 700 × 180 = 126,000 rows, 63 times its customer records. If the contacts were scattered at random across a town of 100,000, then 1 − (1 − 180/100,000)^700 ≈ 72 per cent: about 72,000 people have their number in the bakery's table, while only 700 (0.7 per cent of the town) ever tapped “agree”. Real address books probably overlap more, which would lower the count, so treat 72 per cent as an upper estimate under this model, not a forecast.

What needs no assumption is the 126,000 rows. The question “who is in the data?” from [Five questions to ask before you trust a chart](https://staging.khoi.co.uk/en/blog/nam-cau-hoi-doc-bieu-do) turns around here: not who is missing from a report, but who is in your table without anyone having asked. An alternative is to send a referral link that the customer passes on to friends themselves, with no need to read contacts.

## What can product teams and shop owners do?

Four things. None solves the group problem; each reduces the number of people you hold who never agreed, or raises the reward for decent behaviour.

| Action | Basis in the readings | At the bakery (my reasoning) |
|:--|:--|:--|
| Do not collect what you do not need | GDPR Article 5(1)(c) (European Parliament and Council, 2016). Law 91/2025, Article 3(2): collect within a specific, clear scope and purpose. Large data pools create an incentive to steal (Fairfield and Engel, 2015, p. 401) | Send a link instead of reading contacts |
| Default to closed, keep it short | GDPR Article 25(2): by default process only data necessary for each purpose, covering amount, storage period and accessibility (European Parliament and Council, 2016) | Location sharing off by default; delete customers who stopped buying after a period you set |
| Separate permissions | Letting people revoke one permission, such as location, helps a little (Fairfield and Engel, 2015, p. 450). Law 91/2025, Article 9(4)(a) | Three switches: promotions, location, photos |
| Talk about protecting others | On the authors' reading of a framing experiment, presenting the choice as protecting others may encourage cooperation more than presenting it as avoiding adding to the common bad (Fairfield and Engel, 2015, pp. 454–455) | Referral screen: “Your friends' numbers are not saved” |

A warning about loyalty-card forms: the authors cite a US study from 2000 in which postcode, gender and date of birth were enough to identify 87 per cent of the population uniquely (Fairfield and Engel, 2015, p. 390). I have not read that study. My inference: a form that asks for all three is close to an identifier already.

On the text of the law I read on 3 November 2026 (implementing decrees not considered), household businesses and micro-enterprises are exempt from impact-assessment dossiers (Articles 21 and 22) and from appointing data-protection staff (Article 33(2)), unless they offer data-processing services or process sensitive data or data on many people (Article 38(3) of Law 91/2025/QH15). Articles 3 and 9 are not on the exemption list.

## When is this view not enough?

When you need evidence that group tools work for privacy. The article is a legal argument built on economic experiments about public goods, not a trial on app users; the authors say they point to what might work and do not claim to have found the best solutions (Fairfield and Engel, 2015, p. 435; Fairfield and Engel, 2015, p. 457).

Group tools such as communication, sanctions and reputations for pseudonyms (Fairfield and Engel, 2015, pp. 451–454) assume users have a group to coordinate. A small shop's loyalty app usually has none; in my view its practical lever is collecting less. The article was written in 2015, before the GDPR (adopted 2016) and Law 91/2025; I do not know how far those laws have changed the picture.

## Going deeper: what did I read, and what did I not?

Fairfield and Engel (2015): I read all 73 pages. Duke's site blocked the file download, so I read [a copy of the same PDF held by the Internet Archive](https://web.archive.org/web/2019id_/https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=3824&context=dlj). I did not read the works the article cites. The authors say they follow the tradition of Coase and Ostrom (p. 421); I have not read Ostrom.

ICO (2018): I read the full statement of 25 October 2018 through the Internet Archive's copy, because the original page blocked my download. I did not read the full penalty notice, the FTC part of the library case, or Facebook's side.

GDPR: I read Articles 5(1), 7 and 25 and some recitals on EUR-Lex. Law 91/2025/QH15: the PDF on the government portal is an image scan; I ran OCR on all 23 pages, read Articles 1–4, 9, 11, 15, 19, 21, 29, 30, 33, 38 and 39 closely, and checked Article 9 against the page image. [The original text](https://datafiles.chinhphu.vn/cpp/files/vbpq/2025/7/91qh.signed.pdf).

I computed the two hypothetical examples directly and ran a 20-run simulation in Python (the bakery example averaged about 71,700 people); no real data was used.

## Frequently asked questions

### Is a customer's uploaded contact list the personal data of the people in it?

Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) defines personal data as digital data or other information that identifies, or helps to identify, a specific individual (Article 2). A name with a phone number helps to identify someone, so in my reading it falls within that definition even if the person has never dealt with you. I am not a lawyer; take legal advice if you need certainty.

### Are “a public good” and “the public good” the same thing?

No. Fairfield and Engel separate the lawyer's usage from the economist's: “the public good” is what benefits the community, while “a public good” is something everyone can enjoy whether or not they contribute, which is why it always comes with a social dilemma (Fairfield and Engel, 2015, pp. 414–415). Saying that privacy is good for society is not enough to call it a public good in the economic sense.

### If my friends do not use a service, can I stay out of it?

Not entirely, according to the authors. Much of the information comes from third parties, so a person who stays off a network gives up the benefit but still bears most of the cost (Fairfield and Engel, 2015, p. 411). For a shop owner the question flips: does your customer table hold people who never used your service?

### Does collecting less data make the product worse?

It can, and the article does not deny it. The authors say they take no position on whether the gains from gathering data outweigh the privacy losses; they argue only that cutting privacy costs is one way to raise net gains (Fairfield and Engel, 2015, p. 398). For a refer-a-friend feature, measure whether a share link brings in enough customers compared with asking for the contact list; I have no result for that.

## References

- European Parliament and Council (2016) *Regulation (EU) 2016/679 (General Data Protection Regulation)*. Official Journal of the European Union. Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj.
- Fairfield, J.A.T. and Engel, C. (2015) ‘Privacy as a public good’, *Duke Law Journal*, 65(3), pp. 385–457. Available at: https://scholarship.law.duke.edu/dlj/vol65/iss3/1/.
- Information Commissioner's Office (2018) *ICO issues maximum £500,000 fine to Facebook for failing to protect users’ personal information*. ICO news and blogs. Available at: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/10/facebook-issued-with-maximum-500-000-fine/ (Accessed: 2 November 2026).

---

Canonical HTML version: https://staging.khoi.co.uk/en/blog/rieng-tu-la-hang-hoa-cong