The controversy and ensuing discussion within the realm of privacy and data security has grown at an incredible rate over the past calendar year. As so much of every American’s identity shifts out of reality —instead being virtually stored in any number databases we choose to inform where we live, what we do and which things we like—it’s hard to not pause for a moment and consider just what information we’re putting out there and, more importantly, why businesses and corporations need it.
On Tuesday, Senators John Kerry (D-Mass.) and John McCain (R-Ariz.) took the issue into the national spotlight as they introduced The Commercial Privacy Bill of Rights Act of 2011. What’s grown to be quite the community of superb analysis, the privacy and data security publications on The LexBlog Network put forth a wealth of insight on the subject since yesterday. Let’s take a look around.
On Privacy & Security Matters, the publication put forth by attorneys at Mintz Levin, Cynthia Larose offers some quick bites of commentary while also curating the best content from the mainstream media. An excellent job here.
As we have been saying since the beginning of the new session of Congress, it appears that privacy is the true bipartisan issue. Evidence of that was front and center yesterday as Senators John Kerry (D-MA) and John McCain (R-AZ) introduced their “Commercial Privacy Bill of Rights” requiring businesses that collect, use, store or transfer consumer information to implement data privacy protections when developing products (“Privacy by Design“) and providing consumers with choices about how data are used, collected and shared. […]
Comprehensive privacy legislation at the federal level has been discussed for many years, but this is the first actual legislation to be introduced in the Senate in ten years.
On Foley & Lardner‘s Privacy & Security Source, attorneys Chanley Howell, Daniel Muto, and Andy Serwin dive into breaking down the Act and explaining what everything means.
First, the Act creates a right to security and accountability. Collectors of PII would be required to implement security measures to protect the information they collect and maintain. These measures must be proportional to the size, type, and nature of the information collected. The bill incorporates the increasingly prevalent concept of “privacy by design” requiring companies to develop a comprehensive information privacy program by incorporating necessary development processes and practices throughout the product life cycle that are designed to safeguard PII that is covered information.
In addition, the Act establishes the right to notice, consent, access, and correction of personal information. Specifically, it would impose an obligation on collectors of information to provide clear notice to individuals regarding collection practices, as well as the purpose for such collection. Individuals would have the ability to “opt-out” of any information collection, and must “opt-in” (i.e. provide affirmative express consent) before the entity can collect any “sensitive” PII. Sensitive PII includes PII which can result in significant risk of economic or physical harm, as well as personal health information and religious affiliation.
Erin Egan of Covington & Burling‘s InsidePrivacy also does an excellent job analyzing this one as she distills the Act down into its core components.
The majority of the provisions in the bill apply to a broadly defined set of information that includes traditional kinds of personally identifiable information as well as data such as IP addresses and unique identifiers like cookies. Although the bill is built upon broad and general protections, its requirements are actually quite specific and intricate. We think the bill can be distilled into eight key requirements for companies…
On Legal Bytes, the Reed Smith blog run by Joseph Rosenbaum, you can find some quick tidbits of opinion from the New York lawyer.
the bill clearly intends to require that as little data about an individual is collected as possible, and give individuals a right to know how their information is being used. At first reading, the bill does not provide a private right of action, but does contemplate a self-regulatory program, perhaps a nod to the industry initiative that is highlighted in a recent Legal Bytes posting “OBA Self-Regulatory Initiative Gets Boost from Yahoo! & Google.” You can search for privacy, behavioral advertising and/or self-regulatory on our site and you will find more about this on the Legal Bytes blog.
It may be too early to tell just how much faith Congress has in the industry initiative. That said, it would seem somewhat foolish – given that the FTC and many Congressional leaders have argued for and applauded industry self-regulatory measures – not to afford an industry-sponsored, dynamic, self-regulatory program, a chance to work. As we’ve seen so many times before, along with the technology, consumers’ expectations of privacy, their tastes, commercial needs and sensitivities often change rapidly.
Hogan Lovells lawyer Chris Wolf authors rich in-depth post on Chronicle of Data Protection covering exactly what privacy rights Americans would be afforded. Here’s his take on a couple.
The right to security and accountability: Collectors of information must implement security measures to protect the information they collect and maintain.
The right to notice, consent, access, and correction of information: Collectors of information must provide clear notice to individuals on the collection practices and the purpose for such collection. Additionally, the collector must provide the ability for an individual to opt-out of any information collection that is unauthorized by the Act and provide affirmative consent (opt-in) for the collection of sensitive personally identifiable information. Respecting companies existing relationships with customers and the ability to develop a relationship with a potential customers, the bill would require robust and clear notice to an individual of his or her ability to opt-out of the collection of information for the purpose of transferring it to third parties for behavioral advertising. It would also require collectors to provide individuals either the ability to access and correct their information, or to request cessation of its use and distribution.
Nicole Friess of InformationLawGroup also offered up her take on the Act’s highlights.
With the exception of the FTC’s enforcement actions cracking down on unfair and deceptive practices, the government has favored industry self-regulation over privacy legislation. Between the new draft of the “Commercial Privacy Bill of Rights Act of 2011,” three separate privacy bills pending in the House, and the Obama administration backing a “consumer privacy bill of rights,” it looks like change is in the air (and I’m not just saying that to be clever).
Where many of these authors will tell you what the Act does do, Boston lawyer John Lacey of The McCormack Firm goes in a completely different direction as tells readers what the Act won’t do on his Massachusetts Data Privacy Law Blog.
What this bill doesn’t do is solve the patchwork problem of data breach laws. I believe that Senator Kerry had an opportunity to do just that. Sure, it would have been more complicated, but better for both business and citizens in the long run.
The bill also doesn’t deal with the possibility that one of the soon-to-be regulated companies loses a person’s information. I have to play this out. Company A is on online retailer, they are subject to the new “Privacy Bill of Rights” law and they give the “opt in” “opt out” buttons, they don’t violate the rest of the federal law’s regs… but one day their entire database of “opted in” people is stolen. Oh dear, what now…. What now is Company A’s lawyers better start reading those 46 different state laws, cuz there’s no guidance in the new Federal one.
So, in the end, I was dead wrong. Sure, there will be a bill passed at the Federal level with the word “privacy” in it, just not the one I had envisioned. Apparently Congress is going to take the divide and conquer strategy. Divide up data privacy into as many small laws as possible and then leave it to us lawyers to find, memorize and explain them all.