Can a 'duty of care' help consumers in digital markets?

The UK’s Online Harms bill has raised the profile of a ‘duty of care’ for online consumers - how do these duties work and is digital regulation ready for them?

The UK’s proposed Online Harms bill has raised the profile of a ‘duty of care’ for online consumers. These duties give a clear set of practical expectations for how someone is treated, and give a compelling signal of where responsibility lies. But they are more familiar in established regulated sectors like health or education where providers, governments and consumers alike can agree on who owes care to whom and how.  Has the concept come too soon for digital markets, or does its power lay in its ability to force a decision on responsibility and show that regulation can more than meet the speed and complexity of the digital world?

What is a duty of care?

In most professions where a person has responsibility for another, they owe them a ‘duty of care’ to act in a way that doesn’t cause unreasonable harm. Nurses, teachers or social workers will fulfil this duty by following legal and professional standards that set out what “reasonable” care looks like, and failure to do so is considered negligence. Other professions like UK finance stop short of a statutory duty of care but there are strict rules that provide a similar function. 

There are similar obligations in consumer settings: manufacturers owe a duty of care to anyone using their product that it won’t hurt them; restaurants that the food served won’t make diners sick; and shopkeepers that you won’t fall down a crack in the floor as you browse the aisles.

Duty of care concepts have also been applied to the natural world, where companies might have legal obligations to dispose of waste without polluting the environment.  And there is emerging legislation which includes a duty of care on companies for human rights in their supply chain. In these examples, the duty of care consolidates where responsibility lies for preventing, as opposed to just avoiding, harm.

A little higher up the care scale are ‘fiduciary duties’ from the Latin ‘fiducia’ for trust. These oblige people or businesses to act in a trustworthy manner in the best interests of another - even if it means going against their own interests. This higher level of obligation is often reserved for relationships with a clear power imbalance where the more vulnerable side has little option but to place trust in the other (such as having power of attorney for a relative with dementia). Like duties of care, the fiduciary concept can easily adapt to different settings, and has been used to protect consumers receiving mortgage or investment advice, where a lack of specialist knowledge could leave them exposed. It can also go beyond considering what’s best for a single individual, in Australia for example, superannuation regulation requires companies to act in the best interest of a whole cohort of consumers.

Adapting duties for digital markets

The adaptability of these concepts could be why they are currently being repurposed for the digital era. The UK’s online harms bill is the first ever piece of legislation to propose that social media companies owe users a duty of care, and so failure to identify and prevent exposure to harms like terrorist material, harassment or incitement to violence could result in sanctions (currently up to 10% of a company’s annual global turnover).

Fiduciary responsibility is also being rethought in tech policy circles, with the idea of information fiduciaries gaining traction as a way to protect people’s privacy rights. Balkin and Zittrain have developed the idea that consumers are inherently vulnerable in the digital economy as they have to trust digital companies with their data in order to participate,

“vulnerable to how the companies use their data, to companies’ data security (or lack thereof), and to companies’ choice to share or sell the data to others. Because of the vulnerability and dependence created by information capitalism… the law should treat digital companies that collect and use end user data according to fiduciary principles.”

The Fiduciary Model of Privacy, Harvard Law Review, October 2020

Here, acting in the best interests of people in terms of their data could mean promising not to use personal data to discriminate or expose them to fraud, or sell to with anyone without similar obligations. Such duties shift the burden onto companies to assess and monitor the impact of what they do with people’s data, a reversal of the current situation where it’s the consumer who must constantly assess the risks of data sharing. Fiduciary and duties of care also have built in flexibility as they are concerned with potential outcomes and not on existing use cases.

Both concepts have their sceptics, and not just in the companies facing new liabilities. Practically, fiduciary responsibilities can conflict with other obligations to other beneficiaries, most obviously creating profit for shareholders. While duties can and have been reframed to include environmental and social investment interests, it could prove too much of a stretch for personal data-driven platforms. Reliant on capturing our attention and information, a duty to not exploit data would upend entire business models. Is a fiduciary duty the right tool to tackle the privacy-eroding surveillance economy and the market dominance that goes with it?

In a similar vein, think tank Doteveryone questioned whether a social media duty of care would end up as a “symptomatic treatment of the consequences of tech on one aspect of life”. As compelling as the duty concept is, they recommended a more comprehensive approach. In other words, committing to the long-term, cross party effort of establishing digital regulation.

Looking at the wider context in which a care or fiduciary duty sits makes sense. The offline examples of ‘who owes a duty to whom and how?’ are all located within established regulated sectors, supported by the full suite of professional training standards, redress, transparency, enforcement and monitoring. 

That’s not to say such duties don’t have a place in digital consumer markets, but more that the sequencing might need to be different. The corporate duty of care for human rights and the environment all came into play after other mechanisms like disclosure or self-regulation were exhausted and where there was a shift in societal expectation of where responsibility for harms sat.  

In digital markets, we are only just moving out of a self-regulatory regime which has seen companies benefit from grey areas of responsibility, and people become acclimatised to a lack of protection from harm.  We are transitioning to a regulated tech sector and we don’t know yet when duty of care concepts can be employed at their most effective - but the examples here suggest it works best where there is a shift in societal expectations and collective demand.  That said, I think the attention they are getting does two very important things: firstly they bringing us closer to an inevitable showdown about where responsibility for the consequences of widespread personalised technology lies; secondly they show that far from being unable to respond to the frenetic pace of the digital world, regulation has plenty in the tank to apply, adapt and enforce.