It is no surprise that the 97 comments filed in response to the Department of Commerce’s Green Paper on “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework” take a range of positions on issues such as the need for federal privacy legislation, the relevance of the Fair Information Practice Principles (FIPPs), the efficacy of Privacy Impact Assessments (PIAs), and the value of voluntary codes of conduct. But there is a prevalent theme echoed in several of the comments: individuals’ privacy expectations depend on context. Privacy notices should be clearer and shorter but there is not likely a one-size-fits-all approach to the structure or content of such notices. Individuals should be given greater control over the use of their data but the level of control should depend on the type of data at issue, the type of use involved and the relationship between the individuals and the entities that use their data.
This recognition that context matters has led to the sector-specific and practice-specific privacy laws in the US, which include laws governing kids privacy, email marketing, telemarketing, financial privacy, cable privacy, and health privacy. It certainly is possible to draft comprehensive baseline federal privacy legislation. But any such legislation will need to appreciate that not all of the rules can or should apply in the same way all of the time. Just like data security rules (which are tailored to the risks at issue), privacy rules around issues such as transparency, individual control, and access will need to be tailored to account for individuals’ different expectations in different circumstances.
Commenters appear to agree that both government and industry have a role to play in developing a meaningful privacy framework that protects individuals’ varied privacy interests and allows for innovation to flourish. The debate centers around how to balance these important interests. But there seems to be a growing consensus that any privacy framework — whether codified or not — will need to recognize the importance of context.