As a denizen of the internet, I’ve always viewed my personal information as a form of currency. If I want to use a service online, my address, e-mail, and phone number are all fair game. However, I’ve always maintained the mindset of, “At least someone is asking me for this information.” Unfortunately, that’s not always the case.
From online tracking mechanisms (such as cookies or spyware) that watch our every step once we enter a website to iPhone applications that download your entire address book , our personal data exchanges hands faster than we can click or dial. While the European Union gives consumers a considerable amount of control over this information (as discussed in last week’s LXBN Roundtable), it wasn’t until last Thursday, February 23rd , that the United States made any sort of steps to provide consumers with rights to their information online.
On Thursday, the White House released a white paper (PDF), built on earlier release of a Department of Commerce “green paper“, which provided a potential blueprint for legislation that would give consumers more control over when they were being tracked on the internet. Included in this white paper, was a “Consumer Privacy Bill of Rights,” which outlined the guiding principles of consumer rights to personal information.
When this story broke on Thursday morning, it was almost as if the entirity of the data privacy and security lawyers on The LexBlog Network jumped on to their computers. Within a few hours there were five or six posts on the topic. By the end of the day, there were 11. Today, the count stands at 18, which includes an LXBN TV interview with Colin Zick, an attorney with Foley Hoag, and one of the many lawyers on the Network that added to the discussion as the story was breaking.
With more on the details of the White House’s report, formally titled, “Consumer Data Privacy in a Networked World, A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy” (the “Framework”), here’s Joseph Rosenbaum of Reed Smith on the firm’s blog Legal Bytes:
“The announcement and privacy blueprint envisions a comprehensive and integrated framework for data protection, rather than the current sector-patchwork-quilt approach, and is comprised of four key pillars: (1) a consumer privacy bill of rights; (2) a multi-stakeholder process and approach dealing with how such a bill of rights would apply in a business context; (3) more effective enforcement; and (4) greater commitment to harmonization and cooperation in the international community.”
In his post, Mr. Rosenbaum lays out the seven principles of the Consumer Bill of Rights. Which, if the White House has its way, will be relied upon heavily when drafting legislation that mirrors the Framework:
- Individual Control Through Choice
- Greater Transparency
- Respect for Context
- Secure Handling
- Access & Correction Rights
- Focused Collection
- Accountability
None of these are particularly groundbreaking measures, or even unexpected, but a few do merit closer inspection. Fortunately, Justine Gottshall, a partner with the Information Law Group, has provided a detailed breakdown of each principle on the InfoLawGroup blog. Of particular interest (in my opinion) were “Respect for Context” and “Access & Correction Rights”; here’s what Ms. Gottshall had to say on both:
“Respect for Context: providing that companies should only collect, use, and disclose personal data in ways that are consistent with the context in which the consumers provided the personal data, unless the law requires otherwise or additional transparency and choice are provided.
Of note: The Framework includes both the company’s relationship with the consumer and the consumer’s age and familiarity with technology as relevant factors in determining the context in which consumers provide personal data and the uses that should therefore be made of that personal data. The Framework calls out children and teenagers as potentially needing greater protections for personal data.”
….
Access and Accuracy: providing that consumers have the right to access and correct personal data, in usable formats, but further providing that the right is subject to what is appropriate given the sensitivity of the data and the risk of adverse consequences – also referred to as “material harm” –to consumers if the data is inaccurate.
Of note: The Framework also calls on companies to use “reasonable measures” to ensure the personal data they maintain is accurate and references providing consumers with the right to delete or suppress information – all subject to “the scale, scope, and sensitivity of the personal data that they collect or maintain and the likelihood that its use may expose consumers to financial, physical, or other material harm.””
Although this Framework is a step in the right direction, it remains to be seen how much of it will be used when Congress begins to create regulations. While white papers can serve as a guiding light for legislators, they certainly don’t have to abide by the sentiments expressed in such reports. Lisa Sotto, a partner in Hunton & Williams‘s New York office, was quoted in Bloomberg’s BNA (The Bureau of National Affairs), which was repurposed on the firm’s blog (Privacy and Information Security Law Blog), pointing out that “the devil is in the details” when it comes to lawmaking. Here’s what she had to say, along with some analysis:
“According to the report, “enacting the Consumer Privacy Bill of Rights through Federal legislation would increase legal certainty for companies, strengthen consumer trust, and bolster the United States’ ability to lead consumer data privacy engagements with our international partners.”
As reported in BNA’s Privacy Law Watch, Lisa J. Sotto, partner and head of Hunton & Williams’ Global Privacy and Data Security practice, said “Members of Congress will certainly see this as an influential document when considering new legislation. Privacy is a bipartisan issue that everyone can agree on, but of course the devil is in the details, and where it goes from here remains to be seen.””
Clearly, there’s a lot of work yet to be done before consumers can stop companies from storing information with ease. Perhaps closer to the truth is the fact that advertising and technology companies profitting from the streams of data they unwittingly get from consumers won’t give up that information without a fight. Although many of these companies have signed on to the idea of a “Do Not Track” mechanism that would stop companies from gathering information on consumer surfing habits, there is a great deal of money involved in maintaining the status quo. Moreover, as this article on the New York Times points out, you can easily extend the list of “interested parties” to various media and publishing companies profiting from the growth of advertising revenues:
“The announcements represent the attempt to satisfy consumer privacy concerns while not stifling the growth of online advertising, which is seen as the savior of media and publishing companies as well as the advertising industry. According to the Interactive Advertising Bureau, digital advertising revenues in the United States were $7.88 billion for the third quarter of 2011, a 22 percent increase over the same period in 2010.
The industry’s compromise on a “Do Not Track” mechanism is one result of continuing negotiations among members of the Federal Trade Commission, which first called for such a mechanism in its initial privacy report; the Commerce Department; the White House; the Digital Advertising Alliance; and consumer privacy advocates.
Until now, methods for opting out of custom advertising varied depending on the privacy settings of a user’s browser or whether a user clicked on the blue triangle icons in the corners of some digital ads. Under the new system, browser vendors will build an option into their browser settings that, when selected, will send a signal to companies collecting data that the user does not want to be tracked.”
As I was researching the White House report, I came across an interesting “advert” on BBC’s website. The advertisement (which you can watch below) is one in a series of newspaper, video, and online ads created by Google to help assuage the privacy concerns of anyone that utilizes Google’s many web-based services. These advertisements, featuring animation that looks like it was done by a 8-year-old, began airing several months ago in Germany and the United Kingdom. In the past few weeks they have begun appearing in the United States, primarily on subway trains or in newspapers. This campaign is obviously in response to a growing fear by consumers that their personal information is being used, and in some cases, taken, without their consent or approval. Clearly, companies understand how it appears when they’re “caught” tracking customers online, and utilizing various bits of data (such as IP addresses, search terms, etc.). What they, and Congress, will do about it, is anyone’s guess at this point, but if the new Consumer Privacy Bill of Rights is any indication of where the Administration wants things heading, we could be in for an interesting and bumpy ride.
If you want to read more detailed coverage on the White House report, check out LXBN’s library of posts on the subject from LexBlog Network authors.