[Senate Hearing 106-815]
[From the U.S. Government Publishing Office]
S. Hrg. 106-815
PRIVACY IN THE DIGITAL AGE: DISCUSSION OF ISSUES SURROUNDING THE
INTERNET
=======================================================================
HEARING
before the
COMMITTEE ON THE JUDICIARY
UNITED STATES SENATE
ONE HUNDRED SIXTH CONGRESS
FIRST SESSION
on
PRIVACY ISSUES SURROUNDING THE INTERNET, FOCUSING ON INTERNET INDUSTRY
POLICY, SECURITY, DATA PROTECTION, LAW ENFORCEMENT, TECHNOLOGY
DEVELOPMENT, AND ELECTRONIC COMMERCE
__________
APRIL 21, 1999
__________
Serial No. J-106-19
__________
Printed for the use of the Committee on the Judiciary
U.S. GOVERNMENT PRINTING OFFICE
68-199 CC WASHINGTON : 2001
COMMITTEE ON THE JUDICIARY
ORRIN G. HATCH, Utah, Chairman
STROM THURMOND, South Carolina PATRICK J. LEAHY, Vermont
CHARLES E. GRASSLEY, Iowa EDWARD M. KENNEDY, Massachusetts
ARLEN SPECTER, Pennsylvania JOSEPH R. BIDEN, Jr., Delaware
JON KYL, Arizona HERBERT KOHL, Wisconsin
MIKE DeWINE, Ohio DIANNE FEINSTEIN, California
JOHN ASHCROFT, Missouri RUSSELL D. FEINGOLD, Wisconsin
SPENCER ABRAHAM, Michigan ROBERT G. TORRICELLI, New Jersey
JEFF SESSIONS, Alabama CHARLES E. SCHUMER, New York
BOB SMITH, New Hampshire
Manus Cooney, Chief Counsel and Staff Director
Bruce A. Cohen, Minority Chief Counsel
(ii)
C O N T E N T S
----------
STATEMENTS OF COMMITTEE MEMBERS
Page
Hatch, Hon. Orrin G., U.S. Senator from the State of Utah........ 1
Kohl, Hon. Herbert, U.S. Senator from the State of Wisconsin..... 3, 4
Leahy, Hon. Patrick J., U.S. Senator from the State of Vermont...16, 18
CHRONOLOGICAL LIST OF WITNESSES
Panel consisting of Katherine Borsecnik, senior vice president,
Strategic Businesses, America Online, Inc., Dulles, VA; Michael
Sheridan, vice president, Strategic Businesses, Novell, Inc.,
Orem, UT; Irving Wladawsky-Berger, general manager, Internet
Division, IBM Corp., Washington, DC; Jerry Berman, executive
director, Center For Democracy and Technology, Washington, DC;
Russell T. Bodoff, senior vice president and chief operating
officer, BBBOnline, Inc., Arlington, VA; and Gregory Fischbach,
chairman and chief executive officer, Acclaim Entertainment,
Glen Cove, NY.................................................. 7
ALPHABETICAL LIST AND MATERIALS SUBMITTED
Berman, Jerry:
Testimony.................................................... 65
Prepared statement........................................... 67
Bodoff, Russell, T.:
Testimony.................................................... 71
Prepared statement........................................... 73
Appendix: BBBOnline Privacy Programs, Compliance
Assessment Questionnaires and Flow Charts.............. 79
Borsecnik, Katherine:
Testimony.................................................... 7
Prepared statement........................................... 9
AOL's, Certified Merchants Program....................... 13
Fischbach, Gregory:
Testimony.................................................... 171
Prepared statement........................................... 172
Sheridan, Michael:
Testimony.................................................... 20
Prepared statement........................................... 21
Wladawsky-Berger, Irving:
Testimony.................................................... 25
Prepared statement........................................... 26
Exhibits: IBM's Privacy Practices on the Web............. 34
OPA Whitepaper: Online Consumer Data Privacy in the
United States.......................................... 48
APPENDIX
Additional Submissions for the Record
Letter to Senators Hatch, Feinstein and Leahy, accompanied by
AOL's Terms of Service (which includes the AOL Member
Agreement, the AOL Community Guidelines, and the AOL Privacy
Policy), as well as a copy of AOL's guidelines for using
``parental controls'' to protect children online, submitted by
Jill Lesser, vice president Domestic Public Policy, America
Online, Inc., dated April 23, 1999............................. 207
PRIVACY IN THE DIGITAL AGE: DISCUSSION OF ISSUES SURROUNDING THE
INTERNET
----------
WEDNESDAY, APRIL 21, 1999
U.S. Senate,
Committee on the Judiciary,
Washington, DC.
The committee met, pursuant to notice, at 10:03 a.m., in
room SD-226, Dirksen Senate Office Building, Hon. Orrin G.
Hatch (chairman of the committee) presiding.
Also present: Senators Thurmond, Leahy, Kohl, Feinstein,
and Schumer.
OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM
THE STATE OF UTAH
The Chairman. Good morning, and welcome to today's hearing
addressing the important and increasingly complicated issue of
privacy on the Internet.
It has been no secret that throughout my career in the U.S.
Senate, I have advocated and sought policies that encourage and
foster the development of new and better technologies. Included
among them are medical technologies that help to improve the
health of Americans and information technologies that bring
distance learning to many who live in rural areas in Utah and
across the Nation. The Internet's explosive growth promises to
impact every aspect of our daily life, as it provides the
public with useful and often vital information and literary
content immediately at the mere click of a mouse.
Internet technology will play an important role in
educating the population through distance learning and through
the general delivery of information. The Internet will also
continue to play an increasingly larger role in our daily
entertainment, whether it is through the delivery of movies and
music over the Internet or through the ability to play video
games with a network of literally millions of players across
the globe.
During the last session of Congress, I worked with my
colleagues on this committee in a bipartisan manner to act on a
number of matters aimed at fostering the growth of the Internet
and promoting a competitive environment in this new digital
environment.
First, this committee won passage of the Digital Millennium
Copyright Act, which put in place the most significant
revisions to the U.S. copyright law since the enactment of the
1976 Copyright Act. I consider that one of the most important
bills of the whole last session.
Second, the Judiciary Committee initiated the still
ongoing, thorough public examination of important issues
affecting competition and innovation in the digital
marketplace. In addition, the committee also provided
legislative assistance to industry in our national effort to
prepare for the Y2K problem by crafting and passing legislation
to allow businesses and local governments to share Y2K
remediation information with limited fear of liability.
During this session of Congress, I intend to continue
working on legislative and oversight efforts that address new
policy changes of the Internet and the new digital revolution.
Today's hearing is the first this committee has held on the
issue of consumer privacy on the Internet. Given the complex
nature of this issue and all of the various policy
considerations involved, I do not expect this to be our last
hearing on this issue.
Any revolutionary, paradigm-shifting technology presents
government with new and significant policy changes and
challenges. The Internet is no exception. I recently read that
earlier in this century there were concerns about the sale of
automobiles to the public as it provided crooks with a tool to
escape the police. Luckily, we found a way to address this
automobile, ``concern.'' It is my hope that we can do the same
for any concerns that surround the Internet.
As Americans spend more of their lives on the Internet,
they are more concerned about the ability of Web sites, both
government and commercial, to track their, ``digital steps.''
There is no question that in order for the Internet to reach
its maximum potential as a viable avenue for transacting
commerce, consumers must be assured that personally
identifiable information that is collected online is afforded
adequate levels of protection. But the question remains how do
we best do that. How do we do it without chilling the
development of new technologies or the expansion of the
marketplace?
There have already been over 50 legislative proposals
offered this session addressing privacy. I have been skeptical
of most proposals to date, as they require increased regulation
of the Internet by government. As I have expressed in the past,
we must be careful not to stymie the growth of new technologies
with broad government regulations.
The purpose of today's hearing is two-fold. First, it is
intended to educate the public and the members of this
committee about what the privacy issues are that surround
consumer use of the Internet and what industry is doing to
correct these problems.
Second, it will allow us to begin a dialogue with those
with an interest in the privacy issue in order to develop a
meaningful and balanced policy that takes into consideration
the needs of consumers, law enforcement and industry, one that
would ensure continued technology development in this important
area and that ensures electronic commerce is able to reach its
full potential.
Now, I believe that it is in the best interests of the
industry to develop meaningful privacy policies and to provide
adequate protections for consumer privacy. After all,
individual consumers will demand that the electronic
marketplace provide adequate and effective privacy protections.
Indeed, I have been very encouraged to see, in over the
past 6 months, the development of a productive and meaningful
effort by industry to ensure such privacy protection. We will
hear testimony from some of those involved in that effort
today. However, I am still concerned about reports that there
might still remain certain fringe operators of Web sites who
might not abide by the standards that the industry has set for
itself. Any successful self-regulatory model needs to have
adequate resources to enforce the rules that it sets for
itself.
To date, the discussions surrounding Internet privacy have
revolved around two mutually exclusive models as possible
solutions to this issue. The first, advocated by certain
consumer rights groups, would give government regulatory bodies
the authority to regulate conduct on the Internet. And the
second, advocated by most members of the industry, would
entrust the industry to regulate itself without any role for
the government. For the past several months, I have been
examining different self-enforcement systems that have proven
successful in other industries and that might serve as a useful
model for the protection of privacy on the Internet.
I believe we should explore whether another solution
exists, one that aims to respect both the need to foster
continued growth of the electronic marketplace and the need to
enforce any rules for the protection of consumer privacy. I
hope we could develop a solution that respects this dynamic and
diverse Internet industry, a solution that would give the
industry appropriate power to establish a code of conduct for
its online presence, while providing for a limited and proper
government oversight role, which, frankly, given the interest
received to date in Congress, appears inevitable. This solution
possibly could be based on the self-regulatory, quasi-
governmental model successfully employed in the securities
industry.
Now, I know that can bring a chill over anybody's body in
just a few seconds, when you look at how bureaucratically over-
regulated in some respects the securities industry is. Yet,
still, we have probably the most effective securities industry
regulations of any nation and of history itself.
As we continue to examine this issue, I invite any
interested person or persons to work with me and other members
of this committee to develop a reasonable policy for Internet
privacy, one that provides adequate privacy protections for
consumers, and at the same time allows the industry to regulate
itself in a manner that would allow them to bring new
innovations to the marketplace. So I am hopeful that we can do
that.
Herb, shall we turn to you at this time to represent the
minority?
STATEMENT OF HON. HERBERT KOHL, A U.S. SENATOR FROM THE STATE
OF WISCONSIN
Senator Kohl. Thank you, Mr. Chairman. I would like to
commend you for holding this hearing today on the very critical
issue of privacy, which is enormously important in the
information age that we live in. Public worry over privacy is
real. A recent survey found that 92 percent of consumers are,
``concerned'' about threats to their personal privacy, and that
is a startling figure.
Today, new technologies, including the Internet, facilitate
the free flow of vast quantities of information around the
world. The benefit of this technology is both real and
tangible. But as with many other things, there is a downside,
especially when this technology allows sensitive personal
information, such as medical and credit histories, to be
collected and often used by third parties.
Not even the local supermarket is insulated from the
information age. Nowadays, stores issue cards that can track
information regarding customer purchases right at the check-out
counter. Granted, these cards are helpful to consumers who want
discounts, but they are not so convenient when the cashier
notifies folks in the check-out line that you need to refill
your prescription of Prozac.
In much the same way, the Internet can track and store
personal data and preferences, oftentimes without the consumer
even knowing it. When this information is then shopped around
for a profit, privacy is lost and the problems begin.
Certainly, self-regulation is preferable to government
regulation, and many in the computer industry have made
important strides in this direction. However, striking the
right balance between access to information and protection of
personal privacy is a complicated matter. While these hearings
will help, it is not clear that Congress is equipped to look at
this issue with the sort of altitude or distance necessary to
resolve these issues. Nor is it clear that the best actors in
the private sector will set the standards for the worst.
So, Mr. Chairman, to my mind the time has come to step back
and assess privacy concerns from a broader perspective. With
Senator DeWine, I am considering legislation to create a
privacy study commission which would provide us with a
comprehensive overview of the privacy issues we need to focus
on today and suggestions of how to ensure privacy tomorrow.
This is not a new idea. In fact, 25 years ago a Privacy
Study Commission was established by the Privacy Act of 1974.
The work of that commission is legendary. It led to laws
protecting financial privacy and credit reporting. But times
and technology have changed. In light of the new privacy
challenges facing us today and into the next century, which are
of a vastly greater magnitude, we need to once again consider a
commission approach.
That said, Mr. Chairman, I applaud you and Senator Leahy
for holding this important hearing, and I look forward to
working with you in the future to address the real privacy
concerns of all Americans.
Thank you.
The Chairman. Well, thank you, Senator Kohl. We appreciate
it.
[The prepared statement of Senator Kohl follows:]
Prepared Statement of Senator Herbert Kohl
Thank you Mr. Chairman. I would like to commend you for holding
this hearing today on the very critical issue of privacy--which is
enormously important in the ``information age'' of today. Public worry
over privacy is real. A recent survey found that 92 percent of
consumers are ``concerned'' about threats to their personal privacy--
that's a startling figure. Another poll reported that 83 percent
believe they no longer have control over how companies collect and use
their personal information. No wonder that privacy has caught our
attention.
Today, new technologies, including the Internet, facilitate the
free flow of vast quantities of information around the world. We've
heard time and time again about the benefits of this ``Internet
Revolution,'' and these benefits are both real and tangible. But, as
with many things, there is a downside. For example, newer and faster
computers make it easier than ever to retrieve medical information in
an emergency; but, this technology also allows potentially sensitive
personal information, such as medical and credit histories, to be
collected and often used by third parties.
Not even the local supermarket is insulated from the information
age. Nowadays, stores issue cards that can track information regarding
customer purchases right at the checkout counter. Granted, these cards
are helpful to consumers who want discounts. But they are not so
convenient when the cashier notifies folks in the checkout line that
you need to refill your prescription for Prozac. [LAUGHTER]
In much the same way, the Internet can track and store personal
data and preferences, oftentimes without the consumer even knowing it.
When this information is then shopped around for a profit, privacy is
lost and the problems begin.
These are just some of the privacy concerns of Americans, and they
are not without consequence. Suspicions regarding Internet privacy, or
the lack thereof, have limited the growth of electronic commerce. Many
consumers hesitate to participate in on-line activities for fear of
having their personal data tracked and stored by unknown parties. There
is also the very real problem of harmonizing our privacy laws with the
generally stricter--and often less thoughtful--privacy laws of other
nations, most notably, the European Union.
Certainly, self-regulation is preferable to government regulation,
and many in the computer industry have made important strides in this
direction. However, striking the right balance between access to
information and protection of personal privacy is a complicated matter.
While these hearings will help, it is not clear that Congress is
equipped to look at this issue with a sort of ``altitude'' or
``distance'' necessary to resolve these issues. Nor is it clear to me
that the best actors in the private sector will set the standards for
the worst.
So Mr. Chairman, to my mind the time has come to step back and
assess privacy concerns from a broader perspective. With Senator
DeWine, I am considering legislation to create a Privacy Study
Commission, which would provide us with a comprehensive overview of the
privacy issues we need to focus on today, and suggestions of how to
ensure privacy tomorrow.
This is not a new idea. In fact, twenty-five years ago a Privacy
Study Commission was established by the Privacy Act of 1974. The work
of that Commission is legendary--it led to laws protecting financial
privacy and credit reporting. But times and technology have changed. In
light of the new privacy challenges facing us today and into the next
century--which are of a vastly greater magnitude--we need to once again
consider a Commission approach.
That said Mr. Chairman, I applaud you and Senator Leahy for holding
this important hearing, and I look forward to working with all of you
in the future to address the very real privacy concerns of all
Americans. Thank you.
The Chairman. Senator Leahy is going to be here. So when he
arrives, I will probably interrupt to permit him to make
whatever statement he desires.
In order to achieve today's dual goal of educating the
public and the members of this committee on Internet privacy
issues, we are fortunate to have with us six experts in the
field of Internet privacy and technology who will testify
today.
We will first hear from Ms. Katherine Borsecnik, Senior
Vice President of Strategic Businesses at America Online. Ms.
Borsecnik has been with AOL for more than 7 years and has
played an integral role in developing and implementing AOL's
online privacy and safety policies. We are delighted to have
you here.
Then we will hear from Mr. Michael Sheridan, Vice President
for Strategic Businesses at Novell, headquartered in my home
State of Utah. Prior to joining Novell, Mr. Sheridan previously
worked at Sun Microsystems, where he was co-creator of the
computer programming language Java. Mr. Sheridan is one of the
developers of Novell's recently announced digitalme technology.
Are you living in Utah, Michael, or are you down in
California?
Mr. Sheridan. I am actually out here.
The Chairman. You are out here?
Mr. Sheridan. Yes.
The Chairman. Also testifying today will be Dr. Irving
Wladawsky-Berger, General Manager of IBM's Internet Division.
Dr. Wladawsky-Berger has been affiliated with IBM since 1970
and is currently in charge of IBM's Internet and network
computing strategy, and is referred to at IBM as ``Dr.
Internet.'' I am not sure that that is good.
Mr. Wladawsky-Berger. I am not sure either. [Laughter.]
The Chairman. I would also like to note that Dr. Wladawsky-
Berger is a member of the President's Information Technology
Advisory Committee, or PITAC.
Then we will hear from Mr. Jerry Berman, Executive Director
of the Center for Democracy and Technology. As its mission
states, CDT works to promote democratic values and
constitutional liberties in the digital age. Mr. Berman has
worked tirelessly with free speech and privacy policy working
groups focusing on Internet policy issues.
We are certainly glad to have all of you here.
Next, we will hear testimony from Mr. Russell Bodoff,
Senior Vice President and Chief Operating Officer of BBBOnLine,
an independent subsidiary of the Council of Better Business
Bureaus. Mr. Bodoff is in charge of directing and supervising
the creation of BBBOnLine's new Privacy Seal Program, which we
are very interested to hear more about today.
Our final witness will be Mr. Greg Fischbach, Chairman and
CEO of Acclaim Entertainment, which develops and distributes
interactive entertainment software for the Internet and home
entertainment systems. Mr. Fischbach is also the Vice Chair of
the Board of Directors of the Interactive Digital Software
Association.
So we are really happy to have you here, Greg, Mr. Bodoff,
Mr. Berman, Mr. Wladawsky-Berger, Mr. Sheridan and Ms.
Borsecnik. We think this is a terrific panel and I am looking
forward to hearing what you have to say. I would like to thank
each of you for taking time out of your busy schedules and
appearing before the committee. We expect you, as experts, to
shed light on the issues inherent in the protection of privacy
on the Internet.
I feel confident that you share my view that Internet
privacy issues are too important not to be addressed, and that
growth of this new medium and its problems must be addressed
carefully. So I have looked forward to today's hearing as a
careful and considered first step toward opening a meaningful
dialogue between Congress and the interested public on the
issue of Internet privacy.
So with that, we will begin with you, Ms. Borsecnik, and we
will look forward to hearing what you have to say. I would like
you to limit your remarks to five minutes, if you can. I am not
going to be a stickler on that, but I would appreciate it if
you can because we do have some questions.
PANEL CONSISTING OF KATHERINE BORSECNIK, SENIOR VICE PRESIDENT,
STRATEGIC BUSINESSES, AMERICA ONLINE, INC., DULLES, VA; MICHAEL
SHERIDAN, VICE PRESIDENT, STRATEGIC BUSINESSES, NOVELL, INC.,
OREM, UT; IRVING WLADAWSKY-BERGER, GENERAL MANAGER, INTERNET
DIVISION, IBM CORP., WASHINGTON, DC; JERRY BERMAN, EXECUTIVE
DIRECTOR, CENTER FOR DEMOCRACY AND TECHNOLOGY, WASHINGTON, DC;
RUSSELL T. BODOFF, SENIOR VICE PRESIDENT AND CHIEF OPERATING
OFFICER, BBBONLINE, INC., ARLINGTON, VA; AND GREGORY FISCHBACH,
CHAIRMAN AND CHIEF EXECUTIVE OFFICER, ACCLAIM ENTERTAINMENT,
GLEN COVE, NY
STATEMENT OF KATHERINE BORSECNIK
Ms. Borsecnik. Thank you. I would like to thank you for the
opportunity to discuss online privacy with you here today. My
name is Katherine Borsecnik. I am Senior Vice President of
Strategic Businesses for America Online.
The online medium is quickly revolutionizing the way we
learn, communicate and do business. It impacts industries
fundamentally as diverse as booksellers to brokerage, and
offers consumers unprecedented convenience. Our customers can
sign onto AOL and instantaneously do research, send a letter,
find the best price on an airline ticket--tasks that just a few
short years ago would have taken them far more time.
But the technology of the Internet offers users even
something more unique--the ability to customize or personalize
their online experience. Consumers can communicate specific
preferences online that will allow them to receive services or
information that is targeted to their needs. For example, an
AOL member can set her online preferences to get the weather
forecast in her local area, to read news stories about her
professional interests, or to get a notice about the
availability of a new CD from her favorite musician.
But the power of the Internet can only be fully realized if
consumers feel very confident that their online privacy is
protected. For me, protecting my customers' privacy is
essential to earning their trust, without which I cannot
sustain a business. AOL learned this important lesson through
our own mistakes not too long ago when an AOL employee
wrongfully disclosed information to the government about a
member's screen name.
AOL has recognized that consumer trust is essential to
building our business and building the online medium, and we
have taken a number of important steps to create a privacy-
friendly environment for our customers. Building on the online
lessons we have learned, and from the information and opinions
we receive from our members on a daily basis, we have adopted
privacy policies that clearly explain to our users what
information we collect, why we collect it, and how they can
exercise choice about how that information is used.
We have based our policies on core principles that reflect
consumer needs and expectations. For example, we never read
members' private e-mail. We will not disclose to anyone any
information about where a member goes online, and we will not
give out a member's phone number, screen name, or credit card
information unless he expressly agrees.
We give consumers clear choices about how their personal
information is used, and we make sure that our members are
well-informed about what those choices are. For example, if a
customer decides that he does not want to receive targeted
marketing materials from us, all he needs to do is check a box
online that tells us not to send him such information.
We also make sure that our policies are well-understood and
implemented by our employees. We provide training about our
privacy policies and we require all employees to agree to abide
by our privacy policies as a condition of their employment at
America Online. We continually review state-of-the-art
technology to ensure that we use the most advanced technologies
to defend our customers' data security.
AOL takes extra steps to protect the safety and privacy of
children online. We do not collect personal information from
children without their parents' knowledge or consent. We have
created a secure environment for children, our Kids Only area,
and we carefully monitor all the activity in that area,
including chat rooms and message board posts, to ensure the
safest possible environment for children, and to ensure that a
child does not post personal information online that could
allow them to be identified or contacted offline. Furthermore,
America Online's parental controls technology enables parents
to safeguard their children online by allowing them to set
preferences and limits on who their children may talk to online
and where they may go and what they may see.
In addition to adopting and implementing our own policies,
AOL is committed to fostering best practices among our business
partners and industry colleagues. One of the strongest examples
of this effort is our Certified Merchant program, which
guarantees that our members will be protected and satisfied
when they are within the AOL environment. Through this program,
which currently includes over 150 of our merchant partners, we
offer a money-back guarantee to dispel consumer concerns about
shopping security and increased consumer trust in this powerful
new medium.
We believe that the more we are able to work with our
business partners and require high standards of them, the more
likely it is that these standards will become the marketplace
norm. In fact, we believe that the online industry as a whole
is taking positive steps toward protecting online privacy. To
strengthen industry's commitments to online privacy, AOL joined
with other companies and associations last year to form the
Online Privacy Alliance, which has grown to include more than
85 recognized industry leaders.
AOL believes that companies are responding to the
increasing marketplace demand for online privacy, and that the
tremendous growth of e-commerce reflects positive trends on a
variety of consumer issues, including privacy. In part, we
think that technology holds the key to ensuring a safe and
secure online environment. We believe it is critical for us to
provide the most sophisticated security technologies to our
customers so they can take steps to secure their own privacy.
That is why we continue to advocate the widespread availability
and use of strong encryption, both in this country and abroad.
Challenges that lie ahead will give us the opportunity to
prove that the industry and government can work together to
promote effective online privacy. But ultimately for me at the
end of the day, it is the consumer who will be the judge of our
efforts in these areas and whether they are adequate because no
matter how extraordinary the opportunities for electronic
commerce are, we know our business will fail if we cannot earn
the trust of our customers and meet the consumer demands for
privacy protection.
We at AOL are committed to doing our part in this effort.
Our consumers demand it, our business demands it, and we
appreciate the opportunity to discuss these important issues
with you and to work with you further on the issues of Internet
electronic commerce and privacy.
Thank you.
The Chairman. Thank you, Ms. Borsecnik. That was great.
[The prepared statement of Ms. Borsecnik follows:]
Prepared Statement of Katherine Borsecnik
Chairman Hatch, Senator Leahy, and Members of the Committee, I
would like to thank you, on behalf of America Online, for the
opportunity to discuss online privacy with you today. I am the Senior
Vice President for Strategic Businesses at AOL, and in that capacity a
significant amount of my work for the company is devoted to addressing
issues of online privacy, security, and data protection.
The online medium is quickly revolutionizing the way we learn,
communicate, and do business. People are migrating to the Internet to
meet their commerce and communications needs at an extraordinary rate
because it is convenient and fast, and offers an ever-growing selection
of information, goods and services. AOL subscribers can sign on to our
service and do research, shop for clothes, and buy airline tickets all
in a matter of minutes.
In addition, the online environment offers users unique benefits of
customization and personalization. Consumers can communicate specific
preferences online that will allow them to receive information targeted
to their own interests. For instance, AOL members can set their online
preferences to get the weather forecast for their own zip code, read
news stories about their own hometown, or receive notices about special
discounts on their favorite CDs. No other commercial or educational
medium has ever afforded such tremendous potential for personalization.
But the power of the Internet can only be fully realized if
consumers feel confident that their privacy is properly protected when
they take advantage of these benefits. We know very well that if
consumers do not feel secure online, they will not engage in online
commerce or communication--and without this confidence, our business
cannot grow. For AOL, therefore, protecting our members' privacy is
essential to earning their trust, and this trust is in turn essential
to building the online medium. We learned this important lesson through
our own mistakes not too long ago, when an AOL employee wrongly
revealed the screen name of one of our members to the government.
Recognizing the importance of this issue, AOL has taken a number of
steps to create an environment where our members can be certain that
their personal information and their choices regarding the use of that
information are being respected: from creating and implementing our own
privacy policies and educating our members about them, to promoting
best practices among our business partners, to engaging in self-
regulatory initiatives and enforcement mechanisms that will raise the
bar for all companies who do business online.
setting an example
Building on the lessons we have learned and the input we have
received from our members, we have created privacy policies that
clearly explain to our users what information we collect, why we
collect it, and how they can exercise choice about the use and
disclosure of that information. To that end, the AOL privacy policy is
organized around 8 core principles:
(1) We do not read your private online communications.
(2) We do not use any information about where you personally go on
AOL or the Web, and we do not give it out to others.
(3) We do not give out your telephone number, credit card
information or screen names, unless you authorize us to do so. And we
give you the opportunity to correct your personal contact and billing
information at any time.
(4) We may use information about the kinds of products you buy from
AOL to make other marketing offers to you, unless you tell us not to.
We do not give out this purchase data to others.
(5) We give you choices about how AOL uses your personal
information.
(6) We take extra steps to protect the safety and privacy of
children.
(7) We use secure technology, privacy protection controls and
restrictions on employee access in order to safeguard your personal
information.
(8) We will keep you informed, clearly and prominently, about what
we do with your personal information, and we will advise you if we
change our policy.
We give consumers clear choices about how their personal
information is used, and we make sure that our users are well informed
about what those choices are. For instance, if an AOL subscriber
decides that he does not want to receive any targeted marketing notices
from us based on his personal information or preferences, he can simply
check a box on our service that will let us know not to use his data
for this purpose. Because we know this issue is so critically important
to our members and users, we make every effort to ensure that our
privacy policies are clearly communicated to our customers from the
start of their online experience.
We also make sure that our policies are well understood and
properly implemented by our employees. We require all employees to sign
and agree to abide by our privacy policy, and we provide our managers
with training in how to ensure privacy compliance. We are committed to
using state-of-the-art technology to ensure that the choices
individuals make about their data online are honored.
Finally, we try to keep users informed about the steps they can
take to protect their own privacy online. For instance, we emphasize to
our members that they must be careful not to give out their personal
information unless they specifically know the entity or person with
whom they are dealing, and we encourage them to check to see whether
the sites they visit on the Web have posted privacy policies.
protecting children online
AOL takes extra steps to protect the safety and privacy of children
online. One of our highest priorities has always been to ensure that
the children who use our service can enjoy a safe and rewarding online
experience, and we believe that privacy is a critical element of
children's online safety.
We have created a secure environment just for children--our ``Kids
Only'' area--where extra protections are in place to ensure that our
children are in the safest possible environment. In order to safeguard
kids' privacy, AOL does not collect personal information from children
without their parents' knowledge and consent, and we carefully monitor
all of the Kids Only chat rooms and message boards to make sure that a
child does not post personal information that could allow a stranger to
contact the child offline. Furthermore, through AOL's ``parental
controls,'' our members are able to protect their children's privacy by
setting strict limits on whom their children may interact with online.
Because of the unique concerns relating to child safety in the
online environment, AOL supported legislation in the 105th Congress to
set baseline standards for protecting kids' privacy online. We worked
with Senator Bryan, the FTC, and key industry and public interest
groups to help bring the Child Online Privacy Protection Act (COPPA) to
fruition last year. We believe the enactment of this bill was a major
step in the ongoing effort to make the Internet safe for children.
fostering best practices
In addition to adopting and implementing our own policies, AOL is
committed to fostering best practices among our business partners and
industry colleagues. One of the strongest examples of this effort is
our ``Certified Merchant'' program, through which we work with our
business partners to guarantee our members the highest standards of
privacy and customer satisfaction when they are within the AOL
environment. AOL carefully selects the merchants we allow in the
program (currently there are 152 participants), and requires all
participants to adhere to strict consumer protection standards and
privacy policies. The Certified Merchant principles are posted clearly
in all of our online shopping areas, thereby ensuring that both
consumers and merchants have notice of the rules involved and the
details of the enforcement mechanisms, which help to foster consumer
trust and merchant responsiveness.
Here are the criteria that our merchants have to meet in order to
become certified and to display the America Online Seal of Approval
(some screen shots that show how these criteria appear to subscribers
on our service are attached to this testimony):
1. Post complete details of their Customer Service policies,
including: Contact Information, Shipping Information, Returns Policies,
and Money-Back Satisfaction Guarantee Information.
2. Receive and respond to e-mails within one business day of
receipt.
3. Monitor online store to minimize/eliminate out-of-stock
merchandise available.
4. Receive orders electronically to process orders within one
business day of receipt.
5. Provide the customer with an order confirmation within one
business day of receipt.
6. Deliver all merchandise in professional packaging. All packages
should arrive undamaged, well packed, and neat, barring any shipping
disasters.
7. Ship the displayed product at the price displayed without
substituting.
8. Agree to abide by AOL's privacy policy.
Through our Certified Merchant program, we commit to our members
that they will be satisfied with their online experience, and we have
developed a money-back guarantee program to dispel consumer concerns
about shopping online and increase consumer trust in this powerful new
medium. We believe that these high standards for consumer protection
and fair information practices will help bolster consumer confidence
and encourage our members to engage in electronic commerce.
helping to promote industry efforts
The online industry as a whole is taking positive steps toward
protecting consumer privacy. In fact, to improve industry's commitment
to online privacy, AOL joined with other companies and associations
last year to form the Online Privacy Alliance (OPA), a group dedicated
to promoting privacy online.
Since we began our efforts just a few months ago, the OPA has grown
to include more than 85 recognized industry leaders, and industry
efforts to protect consumer privacy online have blossomed. The OPA has
worked hard to develop a set of core privacy principles--centered
around the key concepts of notice, choice, data security, and access--
and its members are committed to posting and implementing privacy
policies that embody these principles. Furthermore, the OPA is
continuing to reach out to businesses nationwide to explain the
importance of protecting online privacy and posting meaningful privacy
policies.
We believe that the OPA member companies are setting a new standard
for online privacy, and that as consumers become more aware of the
choices available to them, the marketplace will begin to demand robust
privacy polices of all companies that do business online. But we also
understand the need for meaningful enforcement of self-regulation.
That's why we abide by the OPA requirement to participate in robust
enforcement mechanisms through our involvement in the TrustE and
BBBOnline privacy seal programs. We are key sponsors of both the TrustE
and BBBOnline privacy seal programs, and have worked closely with
industry representatives and members of the academic community to help
formulate strict standards for seal eligibility.
the challenges ahead
We believe that companies are responding to the increasing
marketplace demand for online privacy, and that the tremendous growth
of e-commerce reflects positive trends on a variety of consumer
protection issues, including privacy. But our work has only just begun.
As technology makes it easier for companies to collect and use personal
information, the adoption and implementation of robust privacy policies
will become even more important.
In part, we believe that technology holds the key to ensuring a
safe and secure online environment. As an online service provider, we
believe it is critical for us to be able to provide the most
sophisticated security technologies to our members so that they can
take steps to protect their own privacy online. That's why we will
continue to advocate the widespread availability and use of strong
encryption, both in this country and abroad.
The challenges that lie ahead will give us the chance to prove that
industry and government can work together to promote meaningful self-
regulation of online privacy. But ultimately, it is the consumer who
will be the judge of whether these efforts are adequate. Because no
matter how extraordinary the opportunities for electronic commerce may
be, the marketplace will fail if we cannot meet consumers' demands for
privacy protection and gain their trust.
We at AOL are committed to doing our part to protecting personal
privacy online. Our customers demand it, and our business requires it--
but most importantly, the growth and success of the online medium
depend on it. We appreciate the opportunity to discuss these important
issues before the Committee, and look forward to continuing to work
with you on other matters relating to the Internet and electronic
commerce.
[GRAPHIC] [TIFF OMITTED] T8199.001
[GRAPHIC] [TIFF OMITTED] T8199.002
[GRAPHIC] [TIFF OMITTED] T8199.003
The Chairman. Mr. Sheridan, before we turn to you, let me
turn to our Democrat leader on the committee for his statement.
Senator Leahy.
STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR FROM THE
STATE OF VERMONT
Senator Leahy. Thank you, Mr. Chairman. As it often
happens, I am running between two different committees, and I
apologize for going back and forth because this is an area of
great interest to me.
I have told this story before. Since I have been in public
office, I have clipped and saved and actually framed only about
two news items about myself, and I will tell you about one of
the two just to give you an idea of why I think this issue is
so important.
I live on a dirt road in Vermont. Our nearest neighbors are
a mile or so in either direction. One of the neighbors, a
farmer, who has known me since I was a teenager, prompted a
whole article in the New York Times. An out-of-State car with
New York plates pulls up to the farmer. The reporter says, does
Senator Leahy live up this road? The farmer says, are you a
relative of his? The man says no. The farmer says, are you a
friend of his? The reporter says, well, not really. He says, is
he expecting you? The reporter says no. The farmer looks him
right in the eye and says, never heard of him. [Laughter.]
And I have often thought that probably reflects as much as
anything the sense of privacy we have in Vermont, and so I come
to this naturally.
The concern over privacy is reaching an all-time high. In
1978, 64 percent of Americans reported they were very concerned
or somewhat concerned about threats to their privacy. As Mr.
Berman knows, by 1998 this number had skyrocketed. According to
the Center for Social and Legal Research, 88 percent of
Americans reported being very or somewhat concerned about
threats to their personal privacy. So, Mr. Chairman, I thank
you and Senator Kohl and others for having this hearing.
Good privacy policies make good business policies. If you
have new technologies--and those on the panel know the new
technologies as well as anybody in this country--you know that
it brings new opportunities for business and consumers. But it
doesn't do any good if consumers hesitate to use a particular
technology because they are concerned about what it might do to
their privacy. That is why privacy policy is good business
policy.
Ensuring that we have adequate privacy laws has a more
significant and important role in our democracy than just
fostering high-tech businesses. We have to defend online
freedom from heavy-handed content regulation. The
Communications Decency Act in 1996 which was found
unconstitutional--I voted against that because of that.
Stopping efforts to create government censors is critical
to allow our First Amendment rights to flourish, but it is not
enough. For people to feel comfortable in exercising their
First Amendment rights, they have to be able to keep their
activities confidential and private. If Big Brother is
watching, then First Amendment rights are chilled as if
government is censoring it.
We have a long tradition of keeping our identities private.
The Federalist Papers, for example, the most important
political document written about our Constitution, was authored
anonymously initially by James Madison, John Jay and Alexander
Hamilton, and published under a pseudonym. The Supreme Court, I
believe, said ``anonymity is a shield from the tyranny of the
majority.''
The report that I released last month on Vermont Internet
commerce is telling on this point. The strongest obstacle among
consumers from shopping and doing business online was their
fear of the online security risk. This is important because in
my State, a rural State like mine, the commercial potential of
the Internet is enormous. We have seen businesses that are
using it--we have seen their businesses skyrocket, but it is
still held back by people who fear the security risks, right or
wrong. That is why promoting the use of encryption is so
important, so that businesses and consumers can use this
technology to provide the privacy and security they need.
I am going to introduce privacy legislation to ensure that
Americans' Fourth Amendment rights to be secure in their
persons, houses, papers and effects against unreasonable
government searches and seizures are given ample protection in
a networked computer environment. In addition, several
provisions of the bill will address the concern Americans have
about the use of their personally identifiable records and
information by businesses, satellite carriers, libraries and
book sellers.
Online businesses are engaging in serious efforts to make
available to consumers information on privacy policies, and I
commend and applaud those efforts. But in our current laws, we
don't apply privacy principles in an even-handed manner. Video
rental stores and cable operators are subject to privacy laws
to protect our rights to keep our viewing habits private, but
no protections exist for the books we borrow from the library
or buy from a bookstore, or the shows we watch via satellite.
We should have more privacy for that. For that matter, we
should have more privacy on our medical records, which can be
moved all over the country without any restrictions.
Telephone companies and cable operators are subject to
legal restrictions on how they may use personally identifiable
information about their Internet subscribers, but other
Internet and online service providers are not. The E-RIGHTS
bill I am introducing would promote a more level playing field
in terms of the privacy protections available to Internet
users, no matter whether they obtain their Internet access from
AOL, their cable company, or their local phone company.
So we have to look at a number of things. When should the
FBI be allowed to use cell phones to track a user's movements?
Should a Kosovo human rights organization that uses a Web site
to correct government misinformation be able to get a domain
name without having their names publicly available on a
database?
Should we allow Federal prosecutors to act like Special
Prosecutor Kenneth Starr did and go on fishing expeditions with
subpoenas issued to bookstores to find out what we are reading?
That was one of the most chilling things I ever saw, a
prosecutor going to a bookstore to find out what I was reading.
And this is not George Orwell; this is the United States of
America. I mean, of all of Mr. Starr's excesses, this was as
bad a one as any I saw.
Should we protect our choices of reading and viewing
materials the same way we protect our choice of videotapes that
we rent from our local Blockbuster? You may recall that when a
Supreme Court nominee was before this committee, somebody had
found out what videos he was renting. And Senator Alan Simpson
and I were so outraged by that, we introduced legislation
saying you can't go into the video stores to find out what they
are renting. That was probably the only thing that stopped Mr.
Starr on that. If you maintain your calendar on Yahoo,
shouldn't you get the same privacy protections as those who
keep their calendars on their desks or in their PCs' hard
drive?
So these are some of the questions. Mr. Chairman, I know we
have witnesses here, and you have been more than gracious with
the time. I will put the whole statement in the record, but
these are significant privacy issues--and I suspect that you
get people in Utah who are very concerned about their privacy,
and every State that is represented here. In the electronic
world, we have to be more concerned.
The Chairman. Thank you, Senator.
[The prepared statement of Senator Leahy follows:]
Prepared Statement of Senator Patrick Leahy
Concern over privacy is reaching an all time high. In 1978, 64
percent of Americans reported that they were ``very concerned'' or
``somewhat concerned'' about threats to their personal privacy. By
1998, this number had skyrocketed. According to the Center for Social
and Legal Research, 88 percent of Americans reported being ``very'' or
``somewhat concerned'' about threats to their personal privacy. I am
pleased the Senate Judiciary Committee is taking this concern seriously
and beginning an examination of new Internet-related privacy issues.
good privacy policies make good business policies
New technologies bring with them new opportunities, both for the
businesses that develop and market them, and for consumers. It does not
do anyone any good for consumers to hesitate to use any particular
technology because they have concerns over privacy. That is why I
believe that good privacy policies make good business policies.
protecting privacy plays an important role in the exercise of
first amendment rights
Ensuring that we have adequate privacy laws has a more significant
and important role in our democracy than just fostering high-tech
businesses. We also must defend on-line freedom from heavy-handed
content regulation. That was my purpose in voting against the
unconstitutional Communications Decency Act that became law in 1996.
Stopping efforts to create government censors is critical to allow
our First Amendment rights to flourish, but it is not enough. For
people to feel comfortable in exercising their First Amendment rights--
by speaking, traveling and associating freely online or in physical
space--they must be able to keep their activities confidential and
private. When Big Brother is watching, the exercise of First Amendment
rights is chilled no less than the threat of a government censor.
It is therefore not surprising that our country has a long and
honorable tradition of keeping our identities private when we exercise
our First Amendment rights. ``The Federalist Papers,'' which is
probably the most important political document ever written about our
Constitution, was authored anonymously by James Madison, John Jay and
Alexander Hamilton and published under a pseudonym.
Healthy advocacy and debate often rests on the ability of
participants to keep their identities private and to act anonymously.
Indeed, the Supreme Court has said, ``Anonymity is a shield from the
tyranny of the majority.''
Healthy commerce also depends on satisfying consumers' desire to
keep their business affairs private and secure. A report I released
last month on Vermont Internet commerce is telling on this point. The
strongest obstacle among consumers from shopping and doing business
online was their fear of the online security risks. This is why
promoting the use of encryption is so important, so that businesses and
consumers can use this technology to provide the privacy and security
they want and that best suits their needs.
I plan to introduce privacy legislation to ensure that Americans'
Fourth Amendment rights to be secure in their persons, houses, papers
and effects against unreasonable government searches and seizures are
given ample protection in a networked computer environment. In
addition, several provisions in the bill will address the concern
Americans have about the use of their personally identifiable records
and information by businesses, satellite carriers, libraries and book
sellers.
industry self-regulation efforts should be encouraged
In contrast to a citizen's relationship with his or her government,
consumers have a choice of whether they want to deal or interact with
those in the private sector. In my view, this choice should be
generally recognized in the law by allowing consumers and businesses in
the marketplace to set the terms of their interaction. This is an area
where the Congress should tread cautiously before regulating. Online
businesses are engaging in serious efforts to make available to
consumers information on privacy policies so that consumers are able to
make more educated choices on whether they want to deal. I commend and
applaud those efforts.
That being said, however, current laws do not apply privacy
principles in an even-handed manner. Video rental stores and cable
operators are subject to privacy laws to protect our right to keep our
viewing habits private, but no protections exist for the books we
borrow from the library or buy from a bookstore, or the shows we watch
via satellite. I am introducing a bill to provide more uniform privacy
protection for both books and videos, no matter the medium of delivery.
Similarly, telephone companies and cable operators are subject to
legal restrictions on how they may use personally identifiable
information about their Internet subscribers, while other Internet and
online service providers are not. The E-RIGHTS bill I am introducing
would promote a more level playing field in terms of the privacy
protections available to Internet users, no matter whether they obtain
their Internet access from AOL, their cable company or their local
phone company.
this legislation addresses a broad range of emerging
high-tech privacy issues
For example:
When should the FBI be allowed to use cell phones to track a
user's movements?
Should Kosovo human rights organizations that use Web sites
to correct government misinformation be able to get domain
names without having their names publicly available on a
database? Should we have the same ability to get an
``unlisted'' domain name (or Internet address) as we are able
to get an ``unlisted'' phone number?
Should we allow other federal prosecutors to act like
Special Prosecutor Kenneth Starr and go on fishing expeditions
with subpoenas issued to bookstores to find out what we are
reading? Should we protect our choices of reading and viewing
materials the same way we protect our choice of videotapes that
we rent from our local Blockbuster?
Should people who maintain their calendars on Yahoo! get the
same privacy protection as those who keep their calendars on
their desk or on their PC's hard-drive? Will people avoid
certain network services offered by Netscape or new Internet
start-ups because they get less privacy protection for the
information stored on the network than on their own PC's?
These are all important issues, and I have worked to propose
solutions to each of these and to other questions, as well, in the E-
RIGHTS bill I am introducing. I invite each of the witnesses and others
with interests in these matters to exchange ideas on these topics.
There are few matters more important than privacy in maintaining our
core democratic values.
The Chairman. We will turn to you now, Mr. Sheridan. We
respect all the things that you have done to cause angst
throughout the operating platform community.
STATEMENT OF MICHAEL SHERIDAN
Mr. Sheridan. Good.
The Chairman. Yes, it is good, and we are delighted to have
you here.
Senator Leahy. Good word, ``angst.''
The Chairman. Yes. We have had a lot of that expressed here
before this committee, by the way.
Mr. Sheridan. I can feel it.
The Chairman. Yes.
Mr. Sheridan. Mr. Chairman and members of the committee,
good morning, and thank you very much for giving me this
opportunity to testify on this important issue.
My name is Mike Sheridan. I am Vice President of Strategic
Businesses and a member of the Executive Committee of Novell,
Inc., which is the world's largest provider of directory-
enabled network software, and which is located in the great
State of Utah. Prior to coming to Novell in 1988, I worked at
Sun Microsystems, where I was one of the original members of
the team that created the Java programming language. I testify
before the committee today not as an expert in privacy policy,
but as a technologist who is building software products that
are relevant to the online privacy debate.
At Novell, we view online privacy as an extension of
Internet identity, since it is all about empowering users to
make decisions about how much information they want to share
and with whom. It will come as no surprise to you that I
believe that the first line of defense for online privacy is
commercial technology. The genius of Net culture is the
immediacy with which it funnels resources to new areas and the
furious pace, known as Internet time, at which it develops new
products. Several new firms have already been established to
address privacy on the Web and are attracting significant
amounts of venture capital. To the extent possible, we should
let the marketplace address privacy concerns, since it will
deliver the fastest, most flexible and most cost-efficient
solutions.
The second line of defense is industry self-regulation.
Before we regulate the Net, we must let the private sector
attempt to develop best practices and industry norms that
satisfy consumers' needs. The Online Privacy Alliance, TRUSTe,
BBBOnLine and the Platform for Privacy Preferences exemplify
this effort. We are making steady progress, as witnessed by the
rather dramatic increase in the number of privacy policies
posted across the Net. Only after we have given commercial
technology and self-regulation a chance to work should we turn
to government intervention and regulation, and even then we
must be sure that it supports America's leadership of the
networked economy and needs of consumers.
The first phase of the Internet was really all about
getting connected, and companies like AOL made it easy to do
this and led the way. For the past years, we have focused on
connecting individuals, schools, government and businesses to
the Net. The next phase, which is just beginning, will be about
creating and managing digital identities. Novell believes that
the best way to build the world of Internet identities is to
develop products that let individual users create, manage and
secure them. The directory, a sort of network white pages, is
at the center of our efforts to do so. Identities and
directories are two sides of the same coin. Identities describe
who you are on the Net. Directories process this information so
that you can connect to the right people, applications and
services.
An example of the new technologies that will allow
individual choice to govern individual privacy is a product
called digitalme. This product reflects Novell's belief that
the best way to resolve privacy concerns is to address the
larger identity issue. Digitalme allows users to enter and
modify personal data in the directory themselves, and to
control who has access to it. In other words, it lets people
specify the personal information they want to reveal, if any.
By providing such tools that allow users to manage their
Internet identity, we can educate them about their online
privacy.
Because no one technology or company can guarantee privacy
on the Web, Novell is also working to promote industry self-
regulation. We are currently in discussion with BBBOnLine and
are already a member of the Online Privacy Alliance and a
premier sponsor and licensee of TRUSTe. Our privacy policy,
which is posted on our Web site, was created in accordance with
the guidelines of these two groups, as well as the U.S. Federal
Trade Commission and EU Directive on Data Protection.
Mr. Chairman, the privacy debate has at times been
difficult for the Internet industry. But it has also been very
constructive, since it has helped reveal consumer preferences,
industry responsibilities, and the new landscape of e-commerce.
We should not cut off this debate by pretending that Internet
privacy concerns don't exist. Nor should we pass premature
legislation that assumes we know all of the answers.
For now, government should encourage private sector
solutions, investigate and prosecute deceptive business
practices, and monitor privacy abuses to determine the actual
harm to consumers. Only after we are satisfied that the private
sector cannot meet consumers' needs through commercial
technologies and self-regulation should we consider government
intervention.
Thank you very much.
The Chairman. Thank you, Mr. Sheridan.
[The prepared statement of Mr. Sheridan follows:]
Prepared Statement of Michael Sheridan
Mr. Chairman and Members of the Committee: I am Mike Sheridan, Vice
President for Strategic Businesses and a member of the Executive
Committee of Novell, Inc., which is the world's largest provider of
directory enabled network software. Prior to joining Novell in 1997, I
worked at Sun Microsystems where I was one of the original members of
the team that created Java. I testify before the Committee today not as
an expert on privacy policy, but as a technologist who is building
software products that are relevant to the online privacy debate.
What do we mean by online privacy? At Novell, we view it as an
extension of Internet identity. It is about empowering users to make
decisions about how much information they wish to share and with whom.
With all the press attention that online privacy is getting has
come a chorus of calls for government legislation and regulations. We
should exercise great caution in responding to them. We are in the
early stages of the next big phase of the Internet--a phase that will
focus on the creation and management of digital identities and
relationships. It would be a mistake to pass legislation regulating
privacy on the Net before we fully understand the commercial products
and services that will be available to us in this new environment.
The first line of defense for online privacy is commercial
technology. The genius of Net culture is the immediacy with which it
funnels talent and resources to new areas--like protection of personal
privacy--and the furious pace at which it develops new products.
Entrepreneurs have already established several new firms to address
privacy on the web, and they are attracting significant amounts of
venture capital. We must allow the market to address privacy concerns
to the greatest extent possible since it will deliver solutions that
are the most flexible, speedy and cost-efficient.
The second line of defense is industry self-regulation. Before we
regulate the Net, we must allow the private sector to attempt to
develop best practices and industry norms that satisfy consumers needs.
The work of TRUSTe, the Online Privacy Alliance (OPA), BBBOnline and
the World Wide Web Consortium's Platform for Privacy Preferences (P3P)
exemplify this effort. Only after we have given commercial technology
and self-regulation a chance to work should we turn to government
intervention, and even then we must be sure that they support America's
leadership in the networked economy and the needs of consumers.
In my comments today, I will examine three issues that are central
to the privacy debate: (1) The next phase of the Internet; (2) The
promise of commercial technology; and (3) The principles for future
progress.
1. the next phase of the internet: the identity wave
The Internet began as a Department of Defense research project and
for many years was used primarily by scientists at national
laboratories and research universities. The first big wave of the
Internet occurred in the mid-1990's with the advent of the world wide
web and the browser. Suddenly, it was easy to surf the Net, and there
was a scramble to connect. Companies like Netscape and AOL led the way.
Businesses wanted to connect to improve their communications and
productivity. Schools wanted to connect to improve educational
opportunities; government at all levels wanted to connect to enhance
their operations; and individuals wanted to connect to the new world of
digital information. Today, US Internet users number about 80 million.
The Internet is having an economic impact that is on the scale of the
industrial revolution, and it is occurring much faster.
The connection phase will continue for several years as we build
out the infrastructure of the web, but it is about to be supplanted by
something else--the identity wave. Now that the problems of getting
online, getting a browser and using the Net have been largely overcome,
we are faced with massive scale issues. These scale issues are really
identity problems. How do I find what I want? How do I control my
identity when it is scattered over dozens of different sites? How do I
keep track of all my passwords? How do I authenticate my digital
relationships? How to manage a system this complex in ways that create
trust?
Questions about Internet identity are closely related to privacy,
but they are not synonymous. Privacy is only one aspect of this
identity, albeit a very important one. The best way to resolve privacy
concerns is to address the larger issue of how to manage Internet
identities.
The transition from the connection phase of the Internet to the
identity phase should carry a red flag for public policymakers. Instead
of being well along a road we already know we are moving into
unfamiliar terrain. Decentralized decision-making and market solutions
will serve us better during this transition than centralized government
policy since they can respond more quickly and more flexibly to
consumers' needs.
2. the promise of commercial technology: directories and digitalme
TM
Entire new companies are being formed and many technologies are
being developed to deal with different aspects of online privacy. I
cite Novell's approach, not as a panacea, but to illustrate the
innovative ways that industry is beginning to respond. Novell believes
that online privacy is an extension of Internet identity and that by
addressing the broader issue of identity we can resolve many privacy
concerns.
The key to building a world of Internet identities is to develop
products that let individual users create, manage and secure them. The
directory is at the center of our efforts to do so. A true Internet
directory is an integrating layer of software that cuts across
operating systems to provide a platform for network services. Without a
directory, you cannot find, manage or use your network. Directories are
what allow network administrators to keep networks up and ready for the
user, regardless of where he is or what device he has.
Perhaps the simplest way to think of directories is to compare them
to the white pages of a telephone book. Just as white pages contain the
information for telephone identities, directories contain the
information for Internet identities. But while the white pages are
nothing more than a reference guide, a directory is a dynamic database
that makes it easy to manage networks, maintain digital interactions
and, ultimately, enable widespread electronic commerce.
Digital identities and network directories are two sides of the
same coin. Identities describe who you are on the Net; directories
process this information so that you can connect to the right people,
applications, services and devices.
Novell recently announced a new identity product called digitalme
TM that leverages Novell Directory Services so that
consumers and businesses can manage their digital identities. Consumers
are looking for secure ways to manage and protect their personal
information (such as bookmarks, cookies, preferences, user IDs, credit
cards and contact information) since these attributes define what they
can do, where they can go, and who they are on the web. Companies are
looking for opportunities to differentiate their business by creating
secure, personalized services that are beneficial to customers.
digitalme TM has a flexible interface built around
digital ``cards.'' These virtual meCards can be customized so that
users share different information about themselves with different sites
based on their personal preferences. For example, a user may want a
card for their favorite airline to hold information about their
frequent flyer number, their e-mail address, their telephone number,
their business travel patterns and their favorite vacation
destinations. Voluntarily providing this information would allow the
airline to customize its interactions with the user so that if low
fares to the users favorite vacation spot are available, for example,
the airline can alert them. The same user would provide an entirely
different set of personal information to his bank or local hospital.
Since the user knows what information he shares, who he shares it with,
and when he shares it, he is in more control of his identity on the Net
and more aware of his Internet privacy.
digitalme TM is all about user choice. It is downloaded
voluntarily from the Net, and is designed so users can enter only the
information that they want to share. If they choose to include highly
sensitive information a trusted third-party can hold it for them. It
puts users in control. By giving users control of their identities, it
allows them to create customized solutions that meet their individual
needs.
3. principles for future progress
Some seem to have already come to the conclusion that prompt
government intervention is necessary to address concerns about online
privacy. Surveys show the protection of personal privacy is the number-
one concern many people have about the Internet. And advocates of this
view note that it is easier than ever for businesses to gather digital
information about consumers without their knowledge or consent and to
use this data to market products, or worse, in discriminatory and
invasive ways. There is no doubt that the issue of Internet privacy
raises legitimate questions about the rights of web users. To the
extent that it leads to the erosion of consumer confidence in the Net,
it could even retard the growth of electronic commerce.
Nonetheless, it is too early to make a judgement about the need for
privacy legislation. Just like the Internet, our understanding of
digital privacy is still evolving. The success of Free-PC shows that
many consumers are only too happy to trade their privacy rights given
the right incentives. And although Internet identifiers can create an
invasion of privacy, they are also what allowed the FBI to find the
perpetrator of the Melissa virus and to discover who posted the
fraudulent Internet articles that artificially inflated the stock price
of Pairgain Technologies.
In order to balance these competing concerns, many companies have
created privacy policies that share a common set of guidelines. Among
the most important are giving consumers notice before gathering any
personal data, disclosing how any information that is collected will be
used, and letting users choose to opt out of personal data transfers
that are not necessary to complete a transaction.
Novell's policy, which is posted on our web site at www.novell.com,
was created in accordance with the guidelines set forth by TRUSTe, the
Online Privacy Alliance (OPA), the US Federal Trade Commission, and the
EU Directive on Data Protection. It consists of the following
guidelines:
1. In general, people may visit Novell web sites while remaining
anonymous and not revealing any personal information. Novell will at
times request basic data--such as name, address and e-mail--in order to
respond to visitors queries about our products or services, but we will
not contact you with additional marketing information unless you
indicate that you want to receive it.
2. Novell will not disclose your personal information for marketing
purposes to any third-party company without your consent.
3. Novell will not collect information from people who identify
themselves as being younger than 18 years of age.
4. Novell may use cookie technology only to obtain non-personal
information from its on-line visitors to improve their on-line
experience. If you do not wish to have a cookie set when visiting the
Novell web sites, you may alter the settings on your browser to prevent
them.
5. Novell will take appropriate steps to respect and protect the
information you share with us. Whenever you give Novell sensitive
information (e.g., credit card numbers), Novell will take commercially
reasonable steps to establish a secure connection with your web
browser. Credit card numbers are used only for payment processing and
are not retained for marketing purposes.
6. All of the information Novell gathers will be available to you
at the Novell Identity web page. From this site you can see what kind
of information Novell has collected from your visit to our web site and
update the information you have provided us in your personal profile.
From this site you can also indicate that you would rather be anonymous
and provide no information about yourself or your visit to our web
site.
As the debate about Internet privacy evolves, we should look to the
following principles to guide our efforts:
1. Rely on market-inspired solutions as much as possible
The private sector still has a lot of work to do, but we should not
let the highly publicized privacy problems of the past few months
distract us from the real progress that has been made. Many
organizations have invested a lot of time, effort and money to create a
self-regulatory system in which business takes real steps to protect
online privacy. OPA, TRUSTe and BBBOnline have educated industry about
the issue. Novell and several other companies have developed
technologies that hold promise. AOL has made a huge effort to educate
consumers. AT&T has funded studies to better understand consumer
demand. And IBM has withheld advertising dollars from sites that do not
have privacy policies. As a result of these actions, new products are
beginning to emerge and privacy policies are steadily proliferating
across the Net. If the government decides to take legislative or
regulatory action, it should persist in its role as champion of best
commercial practice. The private sector is likely to develop faster,
more flexible and more cost-efficient solutions than the government and
should be encouraged to do so.
2. Refrain from a one-size-fits-all policy approach
Just as no one technology or company can solve the privacy issue,
neither can any one policy. Not all information is equal. Some data--
such as medical and financial data, and information about children--is
especially sensitive. Other types of data can be quite mundane.
Moreover, different users have different privacy preferences.
Aggressive legislation that treats privacy as a uniform problem could
create more problems than it solves.
3. Keep government intervention consistent with the Internet
Where government involvement is needed, it should support and
enforce a predictable, minimalist, transparent and simple legal
environment. Government should follow a decentralized, technology-
neutral approach to policy that encourages private sector innovation.
It should refrain from picking technology winners or implementing
policies that undermine America's leadership of the networked economy.
4. Enforce existing laws and self-regulation
The government already has an extensive mandate to protect consumer
welfare and should vigilantly enforce laws that prevent deceptive trade
practices on the Net. Preventing fraud and false advertising are as
essential to consumer confidence and the growth of e-commerce as they
are to ordinary commerce.
4. conclusion
Mr. Chairman, the privacy debate has at times been difficult for
the Internet industry, but it has also been very constructive since it
has helped reveal consumer preferences and the new landscape of e-
commerce. Just as importantly, it has highlighted industry
responsibilities and made us think hard about the appropriate role for
public policy. We should not cut off this debate by pretending that
Internet privacy concerns don't exist. Nor should we pass premature
legislation that assumes we know all the answers. For now, government's
role is to encourage private sector solutions, investigate and
prosecute deceptive business practices, and monitor privacy abuses to
determine the actual harm to consumers. Only after we are convinced
that the private-sector cannot meet consumers needs through commercial
products and self-regulation should we consider government
intervention.
The Chairman. Mr. Wladawsky-Berger.
STATEMENT OF IRVING WLADAWSKY-BERGER
Mr. Wladawsky-Berger. Mr. Chairman, Senator Leahy, and
members of the committee, thank you for the opportunity to
comment on the question of privacy in the emerging digital age.
My name is Irving Wladawsky-Berger and I am the General Manager
of IBM's Internet Division.
Let me begin by reiterating that all of us, individuals and
businesses alike, derive incredible benefit from the free flow
of information over the Internet. At any hour, day or night,
people can check the status of a shipment, analyze their
investment portfolios, or compare prices over a whole universe
of suppliers. Likewise, businesses gain efficiencies they could
only dream of before the Internet, efficiencies that restrain
prices and bring them closer to their customers.
All this requires information, lots of it. So, clearly, it
is in everyone's interest that the privacy of information be
protected. After all, the consumer's embrace of the Internet
and the electronic marketplace it makes possible will only last
as long as they try us and all the other participants in that
marketplace to respect their privacy.
IBM is no stranger to this issue, and we have been working
on privacy issues ever since the 1960's. Not surprisingly,
then, in 1997 we adopted a worldwide privacy policy for our
thousands of Web pages, and at the same time recognized the
need for industry to unite on some basic principles and
actions. In fact, we have played key roles in the establishment
of the Online Privacy Alliance and the TRUSTe and BBBOnLine
Privacy Seal programs. We actively support Call for Action,
which is an educational program to educate consumers on what
they should look for, for privacy on the Web sites.
Most recently, IBM announced that, effective June 1, we
would no longer advertise on United States and Canadian Web
sites that did not post privacy policies. And as the second
largest advertiser on the Web, our action, we hope, should
influence the practices of others. That commitment to privacy,
and our experience in making the promise of the Net real for
thousands of customers, gives us an excellent vantage point
from which to view this issue.
It seems to us at IBM that the key question to be answered
at this point is how can our society strike the right balance
between the value of a free flow of information and privacy.
How can that flow of information be not just free, but fair as
well?
In our opinion, a broad new statute is not the answer. The
Internet is too global, too instantaneous and too decentralized
for a fixed, rigid statute to regulate it. The Net and its
related technologies simply change too quickly to be amenable
to centralized control. We strongly believe that the best way
to strike the balance between the free flow of information on
the Net and privacy protection is through market forces, which
are invariably the product of consumer preferences.
This self-regulation would ride atop a broad base of
consumer protection laws and targeted sectoral regulation. This
approach envisions a mix of business involvement and
commitment, government support and targeted action,
international cooperation among businesses and governments, as
well as individual responsibility.
Government should defer to private sector leadership for
any number of reasons. Number one, the private sector has many
incentives to respect privacy, not the least of which is self-
interest. The members of the business community simply have too
much to gain from the freest possible flow of information and
too much to lose if concerns over privacy limit the growth of
the networked economy.
Second, excessive regulation can exclude many small and
medium firms from the e-business marketplace. We believe that
one of the most important opportunities in electronic commerce
is to level the playing field, to allow not just the large
companies but the smaller companies to participate. We want e-
business to benefit Main Street, not just Wall Street.
Third, private sector self-regulation can adapt and change
much more quickly and responsibly than government regulation.
Fourth, the Internet and the e-business marketplace are fresh,
new phenomena and should be regulated very, very carefully and
only with good cause. And, finally, the fifth reason for
deferring to market forces is the fact that on the Internet
information is borderless and the Web itself decentralized,
complicating immeasurably all efforts to impose traditional
regulation.
The last few years have seen any number of promising
marketplace privacy initiatives, and I believe a lot of
progress is being made. As my colleague from AOL said, one of
the most promising efforts is the Online Privacy Alliance, a
cross-industry group established in 1998 to agree on a basic
framework for privacy policies tailored to individual
industries.
My written statement goes more into detail about the
practices of the Alliance. Let me just very quickly talk about
what is it based on. Number one, each company should adopt and
implement a privacy and post it at its Web site. Two, each
visitor to a site should be informed of what personal
information is collected at its site, its use, and whether it
will be disclosed to others.
Third, visitors to a site should have a choice in whether
information will be disclosed to others. Fourth, the Web site
owner should take reasonable steps to keep the information
secure. And, fifth, the owner should take reasonable steps to
keep data accurate and to provide individuals as much access to
their identifiable data as is possible.
Let me just conclude by thanking you for the opportunity to
appear before you, and afterwards I will be pleased to answer
any questions.
The Chairman. Thank you very much.
[The prepared statement of Mr. Wladawsky-Berger follows:]
Prepared Statement of Dr. Irving Wladawsky-Berger
Mr. Chairman, Senator Leahy, and Members of the Committee, thank
you for giving me the opportunity to comment on the question of privacy
in the emerging Digital Age.
My name is Irving Wladawsky-Berger and I am the General Manager of
IBM's Internet Division. In that capacity I am responsible for IBM's
Internet strategy, and for driving its implementation across the
company. I am also privileged to serve on the President's Information
Technology Advisory Committee.
As you may know, IBM is the largest information technology company
in the world, with over $81 billion in 1998 revenue and over 290,000
employees worldwide.
We believe this gives us a unique vantage point from which to
comment on privacy in the digital age, working as we do with leaders of
large, medium and small companies and with governments worldwide,
helping them navigate the historic shift to a networked world, and
offering them business solutions in the form of expertise, services and
technology.
i. the value of information in the information age
With every passing day it becomes more certain that the Internet
will take its place alongside the other great transformational
technologies that first challenged, and then fundamentally changed, the
way things are done in this world. But with all respect, let me begin
my comments by suggesting that, while technological advances in our
industry continue at an amazing pace, it is information not technology,
that is at the heart of this revolution.
Information has never been more important than today, when we are
engaged in a fundamental transformation of commerce, education, health
care, and government--indeed, just about every institution in society
that serves individual Americans either as consumers or citizens. For
every business, information has assumed an increasingly strategic role.
Information is their competitive advantage. It is what allows them to
differentiate themselves from all the others in the marketplace who are
trying to serve the public.
Leveraging the Internet and other networks so that businesses can
better work for all their constituents is what we in IBM call e-
business. Indeed e-business is our key market strategy.
We have worked in the marketplace with many thousands of our
customers around the world to help them implement e-business
strategies. And, one of the things we have learned in the process is
that the more information is available to business, government and
other institutions, and the more intelligently it is used, the better
the job they do serving their customers, dealing with business
partners, and running an effective organization. The cumulative effects
of all these improvements are greater convenience for consumers, more
satisfied constituents, and lower costs that can be passed on to
customers in the form of price reductions.
For example, customer self-service applications let consumers
obtain whatever information they need anytime of the day or night,
whether it is locating a package they have shipped, analyzing the
status of their investments, or getting expert advice about a purchase
they are contemplating. Moreover, with the amount of information in the
World Wide Web growing at a prodigious rate, businesses are
increasingly capable of using automated ``personalization'' techniques,
leading questions based on the customer's known needs and wants, to
help consumers better navigate through the growing sea of information.
Similar personalization techniques permit retailers to cement
relationships with customers by offering promotions on items shoppers
are most likely to want. In fact, the Safeway supermarket chain in the
United Kingdom typically gets a remarkable fifty percent-plus response
rate to their direct promotions based on this simple premise: offering
discounts on items they know customers are likely to buy anyway--and
Safeway knows what they are likely to buy because of the information
people have entrusted to them.
This same retailer, in devising additional customer loyalty
programs, discovered that people hate to write shopping lists and
invariably forget certain items. So, in cooperation with our research
labs, they are piloting a program in which customers get shopping lists
matched to their buying patterns. The lists are downloaded to a
portable device the customer picks up as he or she enters the
supermarket. This same device scans the items as the customer selects
them, thus significantly reducing the time spent checking out.
Health care is an area of enormous promise as well. We are working
with practitioners around the world to establish high-security health
information networks that connect physicians, laboratories and
hospitals. With much more timely health information available, patients
can receive faster, more effective treatment, and the significantly
lower administrative expenses could help restrain medical costs.
But the real promise of these health care networks is the
possibility of subjecting all that information to highly sophisticated
supercomputing analysis--what we call Deep Computing, since it is
similar to that developed in our research labs for our Deep Blue chess
playing application--and developing a truly ``intelligent'' assistant
able to deliver expert medical advice to health care professionals.
Such expert assistance could be available over networks to
practitioners everywhere, in a famous urban medical center or a small
rural practice.
In addition, such sophisticated information analysis can infuse far
better forecasting and planning into business processes of all sorts.
For example, our research laboratories are working with an airline to
apply Deep Computing techniques to the scheduling of crew assignments.
That improves not only the airline's efficiency, but working conditions
as well by matching assignments as much as possible with the
preferences of their flight personnel.
That's a great convenience for the flight crews certainly, but it
also saves the airline over $80 million annually, costs that would
otherwise find their way into airline fare schedules to be paid by the
consumer.
In the final analysis, if the digital age is about anything, it is
about using information to empower individuals, be they consumers or
citizens.
ii. addressing privacy expectations: ibm's longstanding commitment
Incredible prospects exist for enriching the lives of customers,
patients, citizens, or just plain individuals by using their
information for their benefit, not for their exploitation. And the
opportunity to obtain and use that information constitutes a
competitive advantage for business. With all that at stake, it stands
to reason that the business community has keen incentive to meet
people's privacy needs.
This is why IBM takes people's concern for the privacy of their
information very, very seriously. IBM understands that consumers will
continue to embrace the Internet, and the electronic marketplace it
makes possible, only to the degree that they trust those who use the
technology to respect the privacy of their personal information.
Equipping consumers with knowledge and choice about how their personal
information is used is key to building such confidence and trust.
We strive to lead by example via our own policies and behaviors.
And we have done so for three decades--a long term commitment to
individual privacy, one that predates, in many ways, the policies of
industry and government.
1960's
IBM adopted our first formalized and global privacy policy, on
handling of employee data, establishing employee access to their
personnel folder, well before the practice became common in the
workplace.
1970's and 1980's
We formulated specific guidelines and principles, applicable
worldwide, on the handling of employee and other data (such as medical
records). We instituted management training to ensure compliance. IBM
also participated via business groups in the formulation in 1980 of the
Organization for Economic Cooperation and Development (OECD) Guidelines
on the Protection of Privacy and the Transborder Flow of Personal Data.
These Guidelines underlie much of the international community's
thinking about privacy protection and IBM supports the spirit and
intent of the OECD Guidelines.
1990's
As the decade of the Internet began, it was characterized by much
hype and a lot of trial and error, but now by the end of the decade the
Net emerged as a new mass medium that is transforming how we work, buy,
sell, play and learn. As use of the Internet and other networked
technologies grew, the need for IBM to renew and refocus its commitment
on today's privacy issues became clear.
Therefore, in 1997 we adopted and implemented a worldwide privacy
policy for our thousands of web pages operating as part of ibm.com. A
copy of our corporate privacy policy statement from www.ibm.com is
attached as an Exhibit. Within IBM, we supported adoption of our Web
privacy policy with executive communications and the establishment of a
new executive position responsible for our internal privacy practices,
reporting to IBM's Chief Information Officer.
And we recognized the need for independent third-party backups to
company policies, and thus sponsored the formation and launch of both
the TRUSTe and BBBOnline privacy seal programs. We also played a key
role in the organization and launch of the cross-industry Online
Privacy Alliance, the principles of which I describe below. TRUSTe and
BBBOnline are independent non-profit groups that can provide consumer
assistance and dispute handling for privacy-related questions, and in
the case of BBBOnline can respond to any and all consumer queries or
complaints. We backed up our own policy by enrolling in the TRUSTe
program last year.
IBM also organized or sponsored a number of customer briefings on
the issue. In 1998 alone, for example, we hosted a conference in New
York City for over 100 senior executives from various business and
government organizations. We hosted Secretary of Commerce Bill Daley
for a roundtable with over 30 senior executives. With the Software
Publishers Association (now the Software and Information Industry
Association) we co-sponsored a series of a dozen workshops on web
privacy policies.
Recognizing the needs some businesses will have in this area for
expert assistance, we also formed a dedicated consulting team in our
IBM Global Services division to guide organizations (large and small)
through the process of creating and implementing practices that comply
with applicable privacy policies or regulations. This team relies on
the concept of a ``Privacy Architecture'' to help organizations adopt
the appropriate mix of policies and technologies to manage the privacy
and security commitments they make.
We also supported efforts to educate consumers on how to protect
their privacy online, most notably funding an effort by Call for
Action, a consumer assistance organization, to publicize its ``ABCs of
Privacy.'' I've included a sample sticker pamphlet as an Exhibit, and
you can find more of their information on www.callforaction.org. To
their credit, Circuit City supported Call for Action's efforts during
the 1998 Holiday season by allowing the organization to distribute this
material through their 500-plus stores in the United States.
And most recently, IBM last month stepped forward and announced
that, effective June 1, we would no longer advertise on U.S. and
Canadian Web sites that did not post privacy policies. As the second
largest advertiser on the Web, we believe that our action will
influence the practices of other market players. Attached as an Exhibit
is the letter sent by our advertising agency, OgilvyOne, to over 350
Web site owners, informing them of our policy.
iii. spreading the adoption of online fair information practices
The key question before all of us at this point is how our society
as a whole--business, government and individuals--will strike the right
balance between the free and fair flow of information and the
reasonable expectations of privacy. In particular, what is the right
balance between legitimate government action and the rewards and
sanctions of the marketplace?
IBM, led by our CEO Lou Gerstner, has thought about this question a
great deal, drawing on our decades of experience with privacy,
technology, and business practices. Frankly, we want rapid progress in
adoption of ``fair information practices'' by organizations that handle
personal data--so that the e-business marketplace, and consumer
acceptance of it--will continue to grow at double-digit rates. We also
appreciate that U.S. policy makers and other important stakeholders
also want rapid progress--especially since electronic commerce has been
recognized as a major economic driver of the U.S. economy's success
entering the 21st century.
A new statute is not the answer. It would be relatively easy, I
suspect, for some to fall into the trap of thinking that enacting a
simple statute that tries to make those who operate on the Internet,
through whatever means, ``respect privacy.'' But that would give a
false guarantee to our citizens--a single ``one size fits all''
approach could never really meet their expectations for privacy
protection, especially in such a complex and fast moving medium as the
Internet.
The Internet presents some special challenges that stem from its
wonderful and unique attributes. All at once it is: global,
instantaneous, and decentralized. Information flows through many
packets in order to get routed to its final destination, relying on a
very international distribution system that is by its nature
decentralized and under no one's ultimate control. The Net and its
related technologies change quickly as well. For example, the Internet2
and Next Generation Internet initiatives, under development now in the
United States, will soon make it possible to share richer stores of
data, much more quickly than before. New technologies and new online
startups are challenging us all with their continual changes and new
business models.
We strongly believe, therefore, that given these attributes the
best way to strike the balance between information flow and privacy
protection on the Net is through private sector leadership--what many
call ``self-regulation''--built atop a base of broad consumer
protection laws and targeted sectoral regulation. In order to succeed,
we need a mix of business involvement and commitment; government
support and targeted action; international cooperation among businesses
and governments; and individual responsibility.
IBM strongly supports such a ``layered'' approach to privacy
protection. Where specific, sectoral concerns are identified and are
not adequately addressed by self-regulation, some amount of legislation
or regulation may be needed. For example, IBM has for several years
supported the enactment of medical records privacy legislation--medical
data are among the most sensitive data an individual can share, and for
that type of data we support a comprehensive statutory framework.
But with respect to the Internet and electronic commerce generally,
we believe that self-regulatory efforts should be given more time to
address the reasonable privacy expectations of consumers. There are a
number of reasons to defer to private-sector leadership:
The private sector has many incentives to respect privacy
Frankly, since businesses have so much to gain, and so much
to lose, if privacy concerns limit the growth of the networked
economy, I believe that the members of the business community
need to establish themselves as worthy stewards of privacy. We
should be encouraged by business' efforts in the last year or
so (which I describe below) and we should also recognize that
it takes time to grow any movement.
The great majority of the business community recognizes that
its real interests lies in maintaining the trust and confidence
of their customers--and therefore it is smart business to
respect the privacy of personal information.
A number of high-profile examples from the last few years
illustrate my point--ranging from AOL, to Geocities, and to the
rapid actions taken by Intel and PC makers (including IBM) to
address consumer concerns about privacy implication of the new
Pentium III chip.
An appropriate role of government vis a vis the private
sector in this context would be for all levels of government to
lead by example and adopt fair information practices as much as
possible. Recent examples involving the reported sale of
drivers' license records are good reminders of the importance
of providing individuals with ``notice'' and ``choice'' over
what is done with information they disclose to others. Clearly,
the nature of government's responsibilities carries with it
duties to secure public safety and investigate potentially
harmful actions--but those investigations ought to be executed
within our Constitutional protective framework.
Excessive regulation can deter Main Street and others from joining the
e-business marketplace
While we agree that the government has a role in protecting
the privacy of its citizens, we worry that a pervasive
regulatory regime would be cumbersome and stifling, especially
for mid-size and small businesses. We want e-commerce to
benefit Main Street as well as Wall Street. We want to make
sure that businesses of all sizes, from the largest to the very
smallest, participate in the networked economy. And, we worry
that excessive regulation, with its increased costs, could
exclude many from the opportunity represented by the Internet.
Private-sector self-regulation can adapt and change much more quickly
and responsively than government regulation
The genius of our nation's Founders produced a political
system in which legislation usually develops deliberately and
slowly, while policy makers weigh the concerns of opposing
factions and competing interest groups. Self-regulation, on the
other hand, has the advantage of speed, and the benefit of
being able to adapt more quickly to technological changes and
consumer and other expectations.
The core forces driving the Internet and e-businesses, of
themselves, enable more flexibility in addressing privacy
concerns. Empowering technologies such as the Platform for
Privacy Preferences, under development as an industry standard
by the World Wide Web Consortium, will continue to put in the
hands of consumers the power to control their information.
Simple technology-related tools one can use today, such as
anonymizers and cookie cutters--while not perfect--can be used
by all who want to use them. And finally, new business models
are springing up that allow people who freely choose to provide
information, to get something of value in return. Do you want a
free PC today? Or a coupon for products? You decide.
In my view, the best example of private sector responsiveness
is the TRUSTe web privacy program. Just launched in 1997, the
program has already comprehensively updated its privacy
policies and practices in order to be consistent with the
fundamental principles espoused by the Online Privacy
Alliance--the latest ``best practices'' in online privacy. A
regulatory agency would not have been able to accomplish such
significant change in that time frame.
The Internet--and the e-business marketplace--are new phenomena and
should be regulated very, very carefully and only with good
cause
One school of thought says that a new mass medium has been
born when it's used by 50 million people. Radio took nearly 40
years to cross that threshold. TV took 13 years; cable TV, 10
years. The Internet did it in less than five. By one very
conservative estimate the number of Internet users worldwide
will surge to 210 million in 1999. Internet commerce will more
than double, to $68 billion in 1999. And spending on online
advertising grew to nearly $1.6 billion in 1998, an annual
growth rate of 83 percent.
Clearly, the Internet is taking off, but so are self-
regulatory efforts. I'll turn to a description of these efforts
next, but my point is: the U.S. private sector came together in
mid-1998, in consultation with government, to agree on robust
self-regulation for online commerce. Barely one short year
later, we are seeing encouraging early returns, that should
elicit additional support for these efforts from policy makers.
IBM urges the Committee to encourage such efforts, while being
extremely suspect of imposing additional regulation.
Where additional government involvement is deemed necessary,
it should address a specific, identified harm or concern--e.g.
so called ``identify theft'' or the rights of citizens against
government seizure of online information. An additional role
for government, as called for in the recently issued
recommendations of the President's Information Technology
Advisory Committee, is to support research on fundamental
attitudes and technologies related to privacy.
On the Internet, information flows freely across borders; the
decentralized nature of the medium complicates efforts to
address privacy via traditional regulation. It also highlights
the importance of U.S. government actions
National borders do not reflect the basic fabric of the
Internet, where information flows freely across borders. Its
distributed, decentralized nature means that traditional
regulation will have a hard time succeeding in meeting the
expectations of citizens that their data will be protected and
keep as private as they specify.
The United States today leads all other nations in our use
and development of the Net--I can confirm that personally,
based on my dealings with people all over the world. It is
clear--based on a number of measures--that we lead in the
technology, attitudes and practices that are key to succeeding
in the New Economy. Other nations watch what we do in this
space, and whatever steps our government takes in regulating
Internet-related, activity will be carefully studied and
potentially copied. To date, our government's willingness to
allow the medium to grow led primarily by market forces and
technological advances has been a very important precedent
abroad, leading governments that are more inclined to impose
pervasive regulation to hesitate and in some instances refrain.
Of course, I do not believe that there is no role for
government regulation. But I do believe that the best approach
involves careful, tailored legislation that allows maximum time
and flexibility for self-regulatory efforts to work.
iv. responding to the self-regulation challenge
In line with the U.S. system of private-sector leadership supported
by statutory requirements, we are seeing a number of promising
initiatives.
A number of industry-specific groups have developed privacy
principles and initiatives. In the information technology industry, for
example, groups such as the Computer Systems Policy Project, the
Information Technology Industry Council, and the Software and
Information Industry Association have all adopted privacy principles
for their members' use and guidance. Attached as an Exhibit are
examples from the CSPP and ITI principles--for example, the CSPP
developed a full-page ad for USA Today that explained their principles,
and mailed the information with a letter from eight CEOs to the Fortune
1000 companies of the United States.
One of the most promising examples of self-regulation, and one
which IBM strongly supports, is a cross-industry group that came
together in 1998 to agree on what constitutes a basic framework of
privacy policies that could be tailored to the needs of individual
industries. These eighty-plus companies and major trade groups of the
Online Privacy Alliance have created guidelines for privacy policies
and an enforcement framework with real teeth that each of the Alliance
companies (including IBM) has pledged to implement. In doing so we
consulted with privacy experts, government and advocacy groups, and
arrived at a framework that received generally positive support.
Attached as an Exhibit for the Committee's reference are the Alliance
Mission, Members, and Guidelines, also found at
www.privacyalliance.org.
The basic principles that the Alliance companies support for online
commerce are, in abridged form:
1. Adoption and Implementation of a Privacy Policy--every Web
site should post such a policy statement.
2. Notice and Disclosure of Information Practices--the
statement should give the Web site visitor notice of what
personally identifiable information is collected at the site,
the use of that information and whether it will be disclosed to
third parties.
3. Choice/Consent--over whether information is shared or
disclosed to others--the individual generally should have a
choice, at least the ability to opt out, about whether
information about them is disclosed or used for other purposes.
4. Data Security--reasonable steps should be taken to keep
data secure from unauthorized users or access.
5. Data Quality and Appropriate Access--reasonable steps
should be taken to keep data accurate and up-to-date, and as
appropriate and feasible access to personally identifiable data
should be given to the Web site visitor.
6. Enforcement of the Guidelines by an Easily Available and
Usable Mechanism--all Alliance companies pledge to employ self-
enforcement mechanisms that provide consumers with easily
understood and used recourse.
Many Alliance companies are working with ``seal programs''--
independent third parties like the Better Business Bureau's BBBOnLine,
and TRUSTe--that monitor a company's compliance with its privacy policy
and confer, as it were, a seal of approval. These seals are not empty
standards--both BBBOnline and TRUSTe aim to impose requirements that
are consistent with the Online Privacy Alliance's standards.
Industry has made real progress in the last year. According to
Media Metrix, the independent Web ratings agency, when someone visits a
Web site this month chances are over 90 percent that it will be
operating under the guidelines of the Online Privacy Alliance. More
data will soon be available about industry's progress, when Georgetown
University releases a new survey of Web practices next month. I don't
know what all of those data will show, but one thing is clear to me:
for the large majority of Web users in the United States visiting
commercial web sites, they will click on sites that post privacy
policies. And if that's not a good test of the successful start of
self-regulation, then what is?
iv. conclusions
The ``layered'' approach that I've advocated in this testimony is
nothing new for the United States: Attached as an Exhibit is a White
Paper and legal analysis prepared by the Online Privacy Alliance that
explains the ``layered approach'' to protecting data privacy in the
United States.
As this White Paper states:
The layered approach to data privacy protection--in which
publicly announced corporate policies and industry codes of
conduct are backed by
(a) the enforcement authority of the Federal Trade Commission
and state and local agencies;
(b) specific sectoral laws that protect the privacy of
particular types of information, enforceable by state and
federal agencies; and
(c) private civil actions for injunctive or monetary relief
brought by individuals or classes of consumers
--differs from the comprehensive government regulatory schemes
typically used in Europe. Notwithstanding the absence of any
regulatory agency dedicated to the enforcement of privacy
standards, however, the ``layered'' public-private enforcement
approach has a long and successful history in the United
States.
For example, many professions that traditionally have been
trusted to safeguard the confidentiality of personal data--
lawyers, doctors and accountants, for example--abide by self-
regulatory codes backed up by government or judicial
enforcement mechanisms, and the result has been a high level of
protection that has stood the test of time.
The framework of self-regulation in the United States,
buttressed by the threat of governmental or private
enforcement, has succeeded both in protecting personal
information and in affording adequate redress to those
individuals whose privacy has been invaded. Accordingly, a
layered approach--as adapted to address the unique conditions
of the Internet--should achieve a level of data privacy
protection online that satisfies the principles of the
[European Union Data Privacy] Directive.
Online Privacy Alliance, Legal Framework White Paper at 2 (Nov. 1998).
In an economy as networked, global, and competitive as the one we
are building, customers usually can impose sanctions and punish a
company much faster and more effectively than government. In a free and
competitive marketplace, customers will gravitate toward those brands
that provide them the best possible service, and whose brand they can
trust. By the same token, with our free and ever-increasing flow of
information, empowered people will quickly realize who they should
avoid.
Clearly, the less government obtrudes into the marketplace the
greater will be the flow of Web transactions delivering goods and
services, health care, government services, financial services * * *
indeed everything that depends on trust. And flowing from that will
come new opportunities, new businesses, and new jobs in all sectors of
the economy.
Privacy is not a cut and dried issue. What is and is not private
changes from person to person. For one person the scope of privacy is
very narrow, for another very broad. For some people privacy is
negotiable and they may be willing to trade information about
themselves in return for something of value.
Certainly a pervasive regulatory regime could assure the public
that nothing improper would happen to their personal information by
making sure that nothing at all would happen to their personal
information * * * nothing bad certainly but nothing good either.
At the other extreme is the laissez-faire solution which might
suffice in a perfect world, but as the Founders knew, human nature is
far from perfect. Somewhere between those two poles lies the answer * *
* some balance between legitimate government action and the rewards and
sanctions of the marketplace.
Frankly, I am inclined to find the balance much closer to the
marketplace.
After all the great majority of the business community recognizes
that its real interests lie in maintaining the trust and confidence of
their customers--and therefore in respecting the privacy of personal
information. That's why any government privacy policy should provide
maximum latitude for stringent self-regulation * * * the kind of
discipline that business is already adopting.
Thank you again for the opportunity to appear before you. I would
be pleased to answer any questions you may have.
[GRAPHIC] [TIFF OMITTED] T8199.004
[GRAPHIC] [TIFF OMITTED] T8199.005
[GRAPHIC] [TIFF OMITTED] T8199.006
[GRAPHIC] [TIFF OMITTED] T8199.007
[GRAPHIC] [TIFF OMITTED] T8199.008
[GRAPHIC] [TIFF OMITTED] T8199.009
[GRAPHIC] [TIFF OMITTED] T8199.010
[GRAPHIC] [TIFF OMITTED] T8199.011
[GRAPHIC] [TIFF OMITTED] T8199.012
[GRAPHIC] [TIFF OMITTED] T8199.013
[GRAPHIC] [TIFF OMITTED] T8199.014
[GRAPHIC] [TIFF OMITTED] T8199.015
[GRAPHIC] [TIFF OMITTED] T8199.016
[GRAPHIC] [TIFF OMITTED] T8199.017
Legal Framework White Paper: Submitted with the Comments of the Online
Privacy Alliance On the Draft International Safe Harbor Principles
[November 19, 1998]
OPA White Paper: Online Consumer Data Privacy in the United States
Introduction
This autumn marks the entry into force of the European Union's
Directive 95/46/EC, which establishes minimum requirements for the
protection of personal data across the Community and requires member
states to prohibit the transfer of personal data to countries where
such data is not subject to adequate safeguards. The Directive takes a
broad legislative approach to data protection that is not mirrored in
federal and state statutes in the United States. Nevertheless, similar
concerns about personal privacy in the digital age affect consumer
choices, corporate practices, and, ultimately, legal policies--
governmental, self-regulatory, and judicial--in the United States. This
paper, submitted by the Online Privacy Alliance (``OPA''), illustrates
how the collective effect of ``layered'' regulatory and self-regulatory
measures creates ``adequate'' safeguards for the protection of personal
information collected online in the United States.
The OPA is a cross-industry coalition of more than 70 global
companies and associations concerned with protecting the privacy of
individuals online. As described below, the OPA and its members have
adopted standards of conduct tailored to the online environment and
intended to ensure that personal information collected online by OPA
members receives the level of protection contemplated by the Directive.
The OPA has grappled with the unique challenges to and opportunities
for data privacy protection that are presented by the enormous and
constant data flow in the online environment and has addressed these in
a way designed to reflect the realities of the Internet while
satisfying the principles of the Directive and U.S. data privacy
policies. The OPA has set forth guidelines for online privacy policies,
a framework for self-regulatory enforcement, and a special policy
concerning collection of information from children. OPA requires its
members to adhere to these guidelines and policies, which are available
on OPA's website at http://www.privacyalliance.org.
The layered approach to data privacy protection--in which publicly
announced corporate policies and industry codes of conduct are backed
by (a) the enforcement authority of the Federal Trade Commission and
state and local agencies; (b) specific sectoral laws that protect the
privacy of particular types of information, enforceable by state and
federal agencies; and (c) private civil actions for injunctive or
monetary relief brought by individuals or classes of consumers--differs
from the comprehensive government regulatory schemes typically used in
Europe. Notwithstanding the absence of any regulatory agency dedicated
to the enforcement of data privacy standards, however, the ``layered''
public-private enforcement approach has a long and successful history
in the United States. For example, many professions that traditionally
have been trusted to safeguard the confidentiality of personal data--
lawyers, doctors, and accountants, for example--abide by self-
regulatory codes backed up by government or judicial enforcement
mechanisms, and the result has been a high level of protection that has
stood the test of time. The framework of self-regulation in the United
States, buttressed by the threat of governmental or private
enforcement, has succeeded both in protecting personal information and
in affording adequate redress to those individuals whose privacy has
been invaded. Accordingly, a layered approach--as adapted to address
the unique conditions of the Internet--should achieve a level of data
privacy protection online that satisfies the principles of the
Directive.
In recent years the U.S. government has been increasingly concerned
about ensuring protection of personal information both online and off.
The U.S. government has embraced the layered approach to online data
protection and consistently has advocated that self-regulatory
efforts--in the form of industry codes of conduct and self-policing
trade groups and associations--serve as the primary safeguard to
protect the electronic privacy of personal information.\1\ This belief
in the efficacy of self-regulation reflects U.S. confidence that
industry standards will rise to meet the challenge of meaningful data
protection, rather than become watered down by a ``race to the
bottom.'' Indeed, as discussed below in Part I, the Federal Trade
Commission and the U.S. Department of Commerce have identified five key
elements of a successful regime for data privacy protection in order to
define for U.S. industry the standards the government expects industry
to meet.
---------------------------------------------------------------------------
\1\ See White House Task Force, Framework for Global Electronic
Commerce (July 1, 1997).
(1) notice of the ways in which information will be used;
(2) consent to the use or third-party distribution of
information;
(3) access to data collected about oneself;
(4) security and accuracy of collected data; and
(5) enforcement mechanisms to ensure compliance and obtain
redress.\2\
---------------------------------------------------------------------------
\2\ See Privacy Online at 7-11 (describing principles in detail);
U.S. Department of Commerce, Privacy and Electronic Commerce (June
1998); see also White House Task Force, Framedwork for Global
Electronic Commerce (July 1, 1997). The FTC's core privacy principles
represent the most recent and comprehensive U.S. effort to identify the
fundamental elements of data protection. The FTC framework does not
exist in a vacuum, however. The National Telecommunications and
Information Agency (``NTIA''), the U.S. Information Infrastructure Task
Force, and the Commerce Department each have addressed issues related
to the protection of personal information and have all reached similar
conclusions as to what constitutes effective data protection. See
Framework for Global Electronic Commerce (describing results of various
studies). The core principles announced by the FTC represent a
synthesis of these earlier efforts and the OECD Guidelines. See Federal
Trade Commission, Privacy Online: A Report to Congress 7 & nn. 27, 28
(FTC June 1998), available at http://www.ftc.gov/reports/privacy3.
Thus, the U.S. commitment to self-regulation presumes--and will
encourage--the development through industry initiatives of meaningful
privacy measures that generally adhere to these core privacy
principles.
The U.S. government, furthermore, has made clear that the failure
of a company to abide by privacy standards to which it professes to
adhere can subject the company to the enforcement authority of the
Federal Trade Commission (or of state and local agencies) and
consequent legal penalties. This possibility of government enforcement
should provide ample incentives for companies to live up to their
guarantees of privacy. See Part I infra. Moreover, as demonstrated in
Part II, both federal and state laws provide an additional layer of
privacy protection: They establish numerous types of safeguards for
data privacy in various sectors of the economy by imposing legal
restrictions on the collection and use of particular types of
information. These various laws demonstrate the commitment of both the
federal and state governments to intervene and protect privacy if self-
regulatory efforts in a particular sector need reinforcement.
The OPA privacy guidelines and attendant enforcement mechanisms
(discussed in Part III) are designed to work with this regulatory
backdrop to protect the privacy of consumers' online data consistent
with the principles set forth in the Directive. OPA-prescribed
enforcement mechanisms, such as seal programs, provide a means to
guarantee that members comply with clearly identified self-regulatory
standards. Companies that identify themselves as adhering to the OPA
self-regulatory scheme also may be at risk of FTC (as well as state and
local) enforcement actions if they fail to follow the OPA privacy
principles; many of these companies also will be obligated to comply
with various sectoral data protection laws at the federal and state
levels. Thus, compliance with the OPA guidelines should provide
assurance to EU data protection authorities that personal information
collected online will be adequately protected within the United States,
and that such protection is enforceable.
OPA and its members have every incentive to adopt strong standards
for data protection and privacy. Political, technological, and economic
trends are all driving companies to the high end, not the low end, of
privacy protection. Recent polls indicate that public concern about
online privacy is the number one reason that consumers not currently
using the Internet--still a substantial majority of U.S. consumers--do
not go online,\3\ and a substantial number of consumers who do use the
Internet choose not to purchase goods sold through websites that do not
disclose their privacy policies.\4\ Congress and the Administration are
well aware of the tide of public opinion, and recent events--most
notably, the rapid passage by the U.S. Congress of the Children's
Online Privacy Protection Act--leave no doubt that the U.S. government
will take action if the online industry does not uphold its
responsibility to impose meaningful standards for the use and
protection of online customer data.
---------------------------------------------------------------------------
\3\ See Business Week/Harris Poll: Online Insecurity, Business
Week, Mar. 16, 1998, at 102.
\4\ See Prepared Statement of the Federal Trade Commission on
``Consumer Privacy on the World Wide Web,'' before the Subcommittee on
Telecommunications, Trade and Consumer Protection of the House
Committee on Commerce, July 21, 1998; Privacy Online at 3-4.
---------------------------------------------------------------------------
U.S. advocacy of a layered self-regulatory approach to data privacy
protection is therefore both a carrot and a stick. Private industry has
been given an opportunity to preserve Internet commerce from government
regulation--the carrot. However, if self-regulation does not work, or
if industry contents itself with meaningless or self-serving standards,
the U.S. government stands ready to impose whatever statutory
guidelines are necessary for the successful protection of information
gathered online--the stick.
This emphasis on meaningful self-regulation has produced real
progress in the promulgation of substantive guidelines to govern the
use of personal information in certain industries. For example, the
major players in the growing market for individual reference services
(``IRS'')--companies that, for a fee, provide financial and other
personal information about individuals--have worked with the Federal
Trade Commission to adopt a code of conduct that imposes strict
limitations on the use and sale of personal information by those
companies. Similarly, the OPA privacy guidelines demonstrate that the
self-regulatory framework outlined by the FTC offers a viable method of
protecting personal data collected over the Internet.
OPA strongly believes that the interests of its members will best
be served by working within that self-regulatory framework to assure
the public that personal data will be adequately protected. Online
markets are expected to expand dramatically in the coming years, and
consumers--particularly those who have yet to buy products or services
online--have demonstrated that they in fact care a great deal about the
privacy policies of the online companies with whom they do business.
New technologies, which will allow a consumer to bargain explicitly for
a desired degree of privacy protection, will only heighten public
awareness of privacy concerns and reinforce the public's expectation
that responsible companies will adhere to the privacy principles
espoused by OPA today.\5\ Internet markets will not reach their full
potential until and unless consumers trust that online businesses will
not misuse personal data that must be collected to consummate
commercial transactions (e.g., shipping addresses, contact information,
credit card numbers). Thus, every commercial online business has an
incentive to win that trust by safeguarding the privacy of its
customer's personal information, and those forward-looking companies
that set the standard for data protection on the Internet--companies
like OPA's members--will earn a competitive advantage in the
marketplace.
---------------------------------------------------------------------------
\5\ Even today, web browsers can be set to decline ``cookies'' so
as to prevent a website from writing files to a user's disk that permit
the site owner to track usage of the website by that user, and
filtering programs permit users to prevent access to specified sites,
which may include those with unacceptable privacy policies. In the
future, automatic protocols like P3P will allow Internet users to
negotiate desired levels of privacy protection or to avoid altogether
those sites that do not provide sufficient protection for personal
information.
---------------------------------------------------------------------------
i. the federal trade commission: enforcing self-regulation
Private self-regulatory bodies like the OPA--which establish a
framework of self-imposed data protection rules to govern the conduct
of all entities in a given industry that agree to operate according to
those standards--can effectively regulate the behavior of their members
and thereby safeguard the private information of consumers. Rather than
having to investigate the idiosyncratic information practices of a
given company, consumers will learn to associate a prominently
displayed seal or notice with a well-known standard of data
protection--much as U.S. consumers today know that the ``UL''
(Underwriters Laboratories) symbol on electronic appliances \6\
guarantees that a device's design meets a time-tested safety threshold.
Thus, companies that agree to abide by a recognized self-regulatory
standard gain the reputational advantage of being able to advertise a
consumer-trusted seal of approval--and those that do not bear a stigma
that can be expected to affect their performance in the marketplace.
Internal enforcement mechanisms guarantee that members live up to their
promises by threatening violators with the penalty of losing the
organization's stamp of approval.
---------------------------------------------------------------------------
\6\ The ``UL'' symbol serves a function similar to the ``CE''
symbol on products sold in Europe.
---------------------------------------------------------------------------
But the efficacy of collective self-regulation in the United States
does not depend on the private sector alone. The Federal Trade
Commission (``FTC'') may use its enforcement authority under section 5
of the Federal Trade Commission Act, which prohibits ``unfair or
deceptive trade practices'' in interstate commerce, to prosecute
companies that do not uphold the standards of a privacy seal or notice
that they display for customers. The FTC has broad jurisdiction over
companies doing business in the United States as well as substantial
enforcement powers. FTC remedies include injunctive relief and other
forms of redress and compensation, and thus impose an independent,
objective incentive on companies to take industry standards
seriously.\7\ State and local consumer protection agencies and consumer
advocates, as well as state attorneys general (the latter analogous to
the federal Department of Justice), complement the FTC's authority by
keeping a watchful eye on regional industries and smaller businesses.
---------------------------------------------------------------------------
\7\ See Federal Trade Commission, Individual Reference Services: A
Report to Congress 29 & n.297 (FTC Dec. 1997).
---------------------------------------------------------------------------
A. The Federal Trade Commission
1. FTC enforcement authority
The FTC is an independent administrative agency that has been
delegated broad enforcement authority under a variety of statutes
designed to promote fair competition and protect the interests of
consumers. Certain of these statutes--like the Fair Credit Reporting
Act (discussed below)--specifically empower the FTC to investigate and
prosecute violations of U.S. law governing the treatment of specific
types of information relating to an individual's credit and finances.
Others--like the recently passed Children's Online Privacy Protection
Act of 1998 (also discussed below)--grant the FTC authority to regulate
certain data protection practices and dictate minimum standards for the
collection and distribution of discrete types of personal information
(e.g., data relating to children). More generally, the FTC possesses
broad authority under section 5 of the Federal Trade Commission Act to
investigate and halt any ``unfair or deceptive'' conduct in almost all
industries affecting interstate commerce.\8\ This authority includes
the right to investigate a company's compliance with its own asserted
data privacy protection policies. Pursuant to section 5, the FTC may
issue cease and desist orders and may also order other equitable
relief, including redress of damages.
---------------------------------------------------------------------------
\8\ Industries exempt from the FTC's enforcement authority under
section 5 are in general subject to specific regulatory schemes that
tend to be both comprehensive and rigorous. See, e.g., 47 U.S.C.
Sec. 45(a)(2) (exempting banks and savings and loan institutions).
---------------------------------------------------------------------------
While the FTC possesses only limited authority to prescribe
regulations that have the force of positive law, it can determine
(subject to judicial review) that a given practice is unfair or
deceptive and therefore contrary to the public interest. Furthermore,
if the agency through its adjudicatory procedures determines that a
given practice constitutes unfair or deceptive conduct (usually in the
form of issuing a ``cease and desist order''), other parties who engage
in similar conduct are subject to civil penalties if they have actual
knowledge of the FTC's determination.\9\ Typically, a company will
choose not to run the risk of a full-scale FTC investigation and
prosecution and will instead enter into a ``consent order'' with the
agency in which a company agrees to comply with objective, judicially
enforceable requirements. Thus, the agency often can set a de facto
minimum standard of behavior through vigorous investigation of
companies that engage in questionable conduct, exercising considerable
influence over a wide variety of industry practices that the agency
deems important to consumers and the public interest. The FTC's recent
policy statements and reports leave no doubt that one such area of
special concern for the agency is the commercial collection and
distribution of personal information.
---------------------------------------------------------------------------
\9\ See 47 U.S.C. Sec. 45(m)(1)(B).
---------------------------------------------------------------------------
2. The FTC's core privacy principles
As noted above, in a June 1998 report to Congress, the FTC
identified five core principles of privacy protection that it will deem
to represent fair and adequate information practices: \10\
---------------------------------------------------------------------------
\10\ See Federal Trade Commission, Privacy Online: A Report to
Congress (FTC June 1998), available at http://www.ftc.gov/reports/
privacy3.
(1) Notice: Consumers must be given notice at the time data
is collected of (a) what kinds of information are being
gathered, (b) whether requests for information may be refused,
(c) the uses that will be made of that data, (d) the persons or
entities who will receive or have access to that data, (e) the
measures taken to ensure confidentiality and accuracy of the
data, and (f) whether an individual may limit the dissemination
or use of collected personal information.
(2) Consent: Individuals should be afforded a choice about
the ways in which collected information may be used and whether
that information may be distributed to third parties.
(3) Access: Individuals should have access to the data that
is collected about them and should have some means to correct
inaccurate or incomplete information.
(4) Security: Companies that collect personal information
should take reasonable steps to ensure the security and
accuracy of that information; in particular, measures should be
adopted to prevent unauthorized access to any personal data.
(5) Enforcement: Individuals must have some mechanism to
enforce compliance with an objective code of personal
information practices and to obtain redress for violations of
that standard.
As demonstrated by the GeoCities case (discussed below), the FTC
has taken enforcement action to ensure that a company complies with its
stated data protection standards.\11\ As companies increasingly adopt
and announce privacy policies, therefore, their practices become
subject to FTC enforcement. Even where a company has not publicly
embraced privacy standards, the FTC has cautioned that ``in certain
circumstances, information practices may be inherently deceptive or
unfair, regardless of whether the entity has publicly adopted any fair
information practice policies,'' leading to the possibility of an FTC
enforcement action under section 5 of the FTC Act.\12\ For example,
prior to the recent adoption of the Children's Online Privacy
Protection Act, the FTC issued an opinion letter concluding that ``it
is likely to be an unfair practice'' to collect personal identifying
information from children without a parent's prior consent.\13\ As
principles of data privacy protection become more ingrained and
accepted, other privacy practices similarly could become sufficiently
widespread and expected that a company's failure to comply with such
practices--at least absent notice to consumers--might be deemed unfair
by the FTC.\14\
---------------------------------------------------------------------------
\11\ See Privacy Online at 40 (``[F]ailure to comply with stated
information practices may constitute a deceptive practice * * * and the
Commission would have authority to pursue the remedies available under
the [FTC] Act for such violations.'').
\12\ Privacy Online at 40 (emphasis added).
\13\ See Letter from Jodie Bernstein, Director, Bureau of Consumer
Protection, Federal Trade Commission, to Center for Media Education,
July 15, 1997, available at http://www.ftc.gov/os/9707/cenmed.htm.
\14\ State and local consumer protection agencies also scrutinize
the extent to which companies engage in deceptive or misleading
practices by failing to adhere to announced codes of conduct, and thus
provide additional oversight. See, e.g., Cal. Bus. & Prof. Code
Sec. Sec. 17200, 17500 (West 1998) (revised in 1998 to apply explicitly
to Internet commerce); N.Y. Gen. Bus. Law Sec. Sec. 349, 350 (Consol.
1998); People v. Lipsitz, 663 N.Y.S.2d 468 (N.Y. Sup. Ct. 1997)
(applying N.Y. consumer protection statute to false advertising on
Internet); Andrew Countryman, ``America Online Deal Reached with 44
Attorneys General,'' Chicago Tribune, May 29, 1998 (describing deal
reached between AOL and state attorneys general regarding AOL business
practices). In particular, state and local agencies may be better
positioned than the FTC to examine the behavior of smaller and regional
companies and to respond to the complaints of individual consumers. See
John Borland, ``States Prepare To Examine New Internet Legislation,''
CMP TechWIRE, Jan. 12, 1998 (describing anticipated state legislation
to protect Internet consumers). Thus, the enforcement powers and
activities of local and state officials and agencies supplements the
authority of the FTC and provides an additional layer of protection for
personal information.
---------------------------------------------------------------------------
B. Enforcing Privacy Protection under Section 5 of the FTC Act
A recently settled FTC enforcement action against a website
operator demonstrates the FTC's use of section 5 of the FTC Act to
assure that companies operate in accordance with their announced
information protection practices--thereby putting teeth in self-
regulatory programs.\15\ This represents the FTC's first resolution of
a privacy action in the Internet context by way of a consent order, and
illustrates the flexibility of existing U.S. law to adapt to new
industry sectors in a timely way.
---------------------------------------------------------------------------
\15\ See In the Matter of GeoCities, File No. 9823015 (FTC 1998);
see also Michael D. Scott, GeoCities Targeted by FTC in Internet
Privacy Enforcement Action, Cyberspace Lawyer 5-11 (Sept. 1998).
---------------------------------------------------------------------------
In the GeoCities case, the FTC challenged the accuracy of certain
representations in the website operator's privacy notice regarding the
use of marketing information collected from persons registering at the
site. The FTC's complaint further alleged that GeoCities implied that
it operated a website for children without disclosing to the children
or their parents that the website was in fact operated by an
independent third party. The company denied these allegations but
promptly instituted information policies and procedures in accord with
standards proposed by the FTC, as ultimately reflected in a proposed
consent order.
Under the terms of the consent order, the company agreed to provide
clear and prominent notice to consumers of its actual information
practices, including what information is collected through its website,
the intended uses for that information, any third parties to whom that
information will be disclosed, the means by which a consumer may access
information collected from herself or himself, and the means by which a
consumer may have that information removed from the company's
databases.\16\ The company agreed that it would not misrepresent the
identity of any third party that collects data from a website promoted
or sponsored by the company. The company agreed to contact all
consumers from whom it previously collected personal information and
afford those individuals an opportunity to have data removed from the
databases both of the company and any third parties.\17\
---------------------------------------------------------------------------
\16\ At all points at which information is collected, the company
must post either this notice or a link informing consumers that data is
being collected and directing them to a complete explanation of the
company's information practices.
\17\ The company agreed as well to cease doing business with any
third party that refuses to agree to comply with the data removal
provisions of the consent order.
---------------------------------------------------------------------------
Finally, the company agreed to implement procedures to obtain a
parent's express consent prior to collecting and using a child's
identifying information; moreover, the company may not collect or use a
child's identifying information if it has actual knowledge that the
child does not have the permission of a parent (or guardian) to
disclose that information. The consent order's provisions concerning
information gathered from children are virtually identical to those
found in the more recently enacted Children's Online Privacy Protection
Act.
As a result of this enforcement action, the company must comply on
an ongoing basis with the binding rules of conduct specified in the
consent order. Beyond that, this highly publicized FTC enforcement
action concerning a prominent website operator serves as a benchmark
for other companies establishing information practices for their
websites.
C. An Industry Model for Facilitating FTC Enforcement of Core Privacy:
The IRSG Principles
FTC enforcement is also a powerful tool with respect to enforcement
of industry-wide codes of conduct as opposed to company-specific
standards or practices. Collective self-regulatory groups can use
marketplace dynamics to encourage (or coerce) adherence to a common set
of industry ``best practices''--no company can afford to be tarred as a
recalcitrant that is unconcerned with the privacy concerns of the
public (as illustrated on several occasions in recent years when
companies withdrew commercial offerings or practices that were publicly
criticized as overly intrusive \18\). Moreover, in contrast to the
self-regulatory efforts of individual companies, self-regulatory groups
can adopt joint mechanisms to investigate and resolve consumer
complaints and thus collectively can enforce each company's compliance
with a given industry's best practices. FTC oversight--in conjunction
with that of state and local authorities--complements such self-
regulatory enforcement mechanisms by providing an independent legal
incentive for each member company, and the group as a whole, to live up
to its promised standard of behavior. The FTC has made clear that, in
signing on to an industry group's data protection principles, ``a
signatory represents that its information practices are consistent
with'' those principles and that action inconsistent with them subjects
a company to liability ``under the FTC Act (or similar state statutes)
as a deceptive act or practice.'' \19\
---------------------------------------------------------------------------
\18\ See, e.g., Individual Reference Services at 1, 13 & n.1
(describing consumer outrage at Lexis-Nexis's ``P-Trak'' service, which
allowed subscribers to identify an individual's social security number;
Lexis quickly changed its policies).
\19\ Id. at 29 & n.297.
---------------------------------------------------------------------------
The data privacy standards announced by the Individual Reference
Services Group (``IRSG'')--an association of fourteen major companies
in the individual reference services industry--exemplify a self-
regulatory approach emphasizing an industry group's seal of approval.
The individual reference services industry gathers personal information
about individuals from a number of sources, both public (e.g., state
driving records) and private (e.g., credit information) and provides
that information for a fee to private parties and the government. To
protect the often sensitive personal data with which IRSG members deal
on a day-to-day basis, the group has adopted binding standards for the
protection of personal information. The IRSG developed these rules with
the advice and participation of the FTC, and the agency has endorsed
them as a promising mechanism to ``lessen the risk that information
made available through [individual reference] services is misused * * *
[and] address consumers' concerns about the privacy of non-public
information in the services' databases.'' \20\ The FTC further
recommended that the IRSG's self-regulatory efforts be given an
opportunity to demonstrate their effectiveness in conjunction with the
FTC's own enforcement activities (and those of sectoral regulatory
authorities).\21\
---------------------------------------------------------------------------
\20\ Id. at 31.
\21\ See id.
---------------------------------------------------------------------------
ii. sectoral regulation of privacy interests
In addition to the umbrella authority of the FCC over data privacy,
the United States has extensive laws regulating the collection and use
of consumer data in particular sectors of the economy. This sectoral
approach demonstrates the commitment of the U.S. government--at both
the federal and state level--to regulate the privacy of sensitive data
and to step in and provide governmental support for self-regulatory
regimes.
A. Principal Federal Statutes
1. Fair Credit Reporting Act
One of the primary federal statutes that protects consumer privacy
is the Fair Credit Reporting Act (``FCRA''), which regulates the
collection and dissemination of a wide range of information about
consumers. The purpose of the FCRA, as articulated by Congress, is ``to
require that consumer reporting agencies adopt reasonable procedures
for meeting the needs of commerce for consumer credit, personnel,
insurance, and other information in a manner which is fair and
equitable to the consumer, with regard to the confidentiality,
accuracy, relevancy, and proper utilization of such information.'' \22\
---------------------------------------------------------------------------
\22\ U.S.C. Sec. 1681(b) (emphasis added).
---------------------------------------------------------------------------
In general, the Act regulates the collection and dissemination of
``consumer reports,'' which include information concerning topics such
as a consumer's credit worthiness and other personal characteristics,
by ``consumer reporting agencies''--any person (or entity) who
regularly engages in assembling or evaluating these types of
information. Such agencies may disseminate consumer report information
only to third parties having a specifically delineated permissible
purpose for the information, such as a credit transaction or a
determination whether to issue an insurance policy. The FCRA also
provides further protections, such as the right of consumers to access
and obtain correction of data collected and maintained by consumer
reporting agencies. On the other hand, the FCRA also provides certain
exceptions to its reach, including, for example, situations in which a
merchant makes use of data it obtains based on first-hand experience
with a consumer.
The scope of the FCRA's privacy protections is dependent primarily
on the definitions of ``consumer reports'' and ``consumer reporting
agencies.'' The FCRA defines ``consumer reports'' broadly to include
``any written, oral, or other communication'' to a third party of
information ``bearing on a consumer's credit worthiness, credit
standing, credit capacity, character, general reputation, personal
characteristics, or mode of living which is used or expected to be used
or collected in whole or in part'' for one of several general
purposes.\23\ In particular, information bearing on one of the
specified characteristics is a consumer report if it is collected,
used, or even expected to be used for purposes including credit,
employment, insurance, or a legitimate business need in connection with
a business transaction with the consumer.\24\ Moreover, the collection
or use of the information does not have to be only or even primarily
for one of these purposes--it is enough that the information is used,
collected, or expected to be used only in part for one of the specified
purposes.\25\
---------------------------------------------------------------------------
\23\ Id. Sec. 1681a(d).
\24\ Id. Sec. Sec. 1681a(d), 1681b(a)(3)(F).
\25\ See, e.g., Comeaux v. Brown & Williamson Tobacco Co., 915 F.2d
1264 (9th Cir. 1990).
---------------------------------------------------------------------------
This definition of ``consumer reports'' sweeps a variety of
different types of information under the protective umbrella of the
FCRA. Data that is collected or used for the purpose of determining
credit eligibility or for deciding whether to provide insurance
coverage is included.\26\ So are reports that are compiled or used to
ascertain whether a particular individual is eligible for
employment.\27\ A list of consumers who have passed bad checks that is
supplied to merchants also falls within the category of ``consumer
reports.'' \28\ The FTC has taken the position that targeted marketing
lists also can constitute ``consumer reports'' within the meaning of
the FCRA.\29\
---------------------------------------------------------------------------
\26\ FTC Official Staff Commentary, 16 C.F.R. Pt. 600 app. Sec. 603
item 6.
\27\ Id.
\28\ See Estiverne v. Saks Fifth Avenue & JBS, 9 F.3d 1171 (5th
Cir. 1993).
\29\ See Trans Union Corp. v. FTC, 81 F.3d 228 (D.C. Cir. 1996)
(noting the FFC's position but remanding for further factual
development).
---------------------------------------------------------------------------
At the same time, the FCRA does provide certain limitations on the
definition of a consumer report. As noted above, information does not
fall within this category if it is based solely on the disclosing
party's first-hand experience with the consumer.\30\ Thus, a merchant
who discloses the amount and type of its transaction with a consumer is
not disseminating a ``consumer report'' for purposes of the FCRA. This
exception may allow dissemination of information without FCRA
protection in some circumstances; however, if the recipient of the
merchant's firsthand information then sought to pass it on to a third
party, the information would be protected as a consumer report
(assuming, of course, that it met the other requirements of the
definition).\31\ Recent amendments to the FCRA also provide that
information communicated to an affiliated entity is not a consumer
report if it was ``clearly and conspicuously disclosed'' to the
consumer that such disclosure might occur and the consumer had the
opportunity to ``opt out'' beforehand.\32\
---------------------------------------------------------------------------
\30\ 15 U.S.C. Sec. 1681a(d)(2)(A)(i).
\31\ FTC, Compliance with the Fair Credit Reporting Act 42 (1977).
\32\ 15 U.S.C. Sec. 1681a(d)(2)(A)(iii).
---------------------------------------------------------------------------
The FCRA generally regulates the collection and dissemination of
``consumer reports'' only when done by a ``consumer reporting agency.''
The latter term encompasses any person who for money or on a
cooperative nonprofit basis ``regularly engages in whole or in part in
the practice of assembling or evaluating consumer credit information or
other information on consumers for the purpose of furnishing consumer
reports to third parties.'' \33\ Examples of consumer reporting
agencies include credit bureaus such as Equifax, employment agencies
that routinely obtain information on job applicants from former
employers, tenant screening companies that assist landlords in checking
prospective tenants, and check approval companies that guarantee checks
for merchants.\34\ On the other hand, an entity that gathers or
evaluates consumer data on a one-time or other infrequent basis is not
subject to the FCRA.
---------------------------------------------------------------------------
\33\ Id. Sec. 1681a(f).
\34\ FTC Official Staff Commentary, 16 C.F.R. Pt. 600 app.
Sec. 603(f) items 4, 6(f).
---------------------------------------------------------------------------
A consumer reporting agency may legally furnish a consumer report
to third parties (in the absence of consent \35\) only if it has reason
to believe that the third party has one of the permissible purposes
listed in the statute. This generally includes someone who requests
information in connection with (1) a credit transaction, review or
collection of a credit account, or evaluation of a credit application
\36\; (2) a determination whether to issue or cancel an insurance
policy or how to set the rates and terms of such a policy \37\; (3) a
response to a court order \38\; or (4) a legitimate business need in
connection with a business transaction involving the consumer (such as
renting an apartment or a consumer's offer to pay by check).\39\ In
addition, a consumer report may be disclosed to a third party for
purposes of an employment decision relating to promotion, reassignment
or retention, but only if the consumer authorizes such disclosure in
writing beforehand.\40\ Marketing is not a permissible purpose. The
consumer reporting agency must maintain reasonable procedures designed
to ensure that consumer reports are furnished only for the listed
purposes.\41\
---------------------------------------------------------------------------
\35\ 15 U.S.C. Sec. 1681b(a)(2).
\36\ Id. Sec. 1681b(a)(3)(A).
\37\ Id. Sec. 1681b(a)(3)(C).
\38\ Id. Sec. 1681b(a)(1).
\39\ Id. Sec. 1681b(a)(3)(E); FTC Official Staff Commentary, 16
C.F.R. Pt. 600 app. Sec. 604(3)(E) item 3.
\40\ 15 U.S.C. Sec. Sec. 1681b(a)(3)(B), 1681b(b).
\41\ 15 U.S.C. Sec. 1681e(a).
---------------------------------------------------------------------------
The FCRA also provides further restrictions on the dissemination of
``consumer reports.'' For example, a consumer must consent ahead of
time to the release of a consumer report for purposes of employment,
credit, or insurance if the report contains medical information.\42\
The consumer must have the option to opt out of being included in any
lists for unsolicited credit and insurance offers.\43\ The FCRA
additionally prohibits the reporting of ``obsolete information''; the
Act sets forth specific time frames after which particular types of
data are deemed obsolete.\44\
---------------------------------------------------------------------------
\42\ Id. Sec. 1681b(g).
\43\ Id. Sec. 1681b(e).
\44\ Id. Sec. 1681c(a).
---------------------------------------------------------------------------
The Act further mandates that consumer reporting agencies establish
``reasonable procedures to assure maximum possible accuracy.'' \45\ The
Act seeks to promote accuracy and reliability in part by creating a
framework under which a consumer has the right to obtain the
information maintained about him or her and require the consumer
reporting agency to correct inaccurate information. Specifically, the
FCRA requires that every consumer reporting agency disclose upon
request to a consumer the ``nature and substance'' of the information
about the consumer in the agency's files, the sources of that
information, and the identity of those who have obtained a report about
the consumer in the past year.\46\ A consumer may dispute the
completeness or accuracy of any information maintained by the agency
and require the agency to ``reinvestigate'' the accuracy of the
information at no charge to the consumer.\47\ The consumer reporting
agency generally must complete such reinvestigations within 30
days.\48\ If the agency concludes that the disputed information is
inaccurate or unverifiable, it must modify or delete the
information.\49\ If, on the other hand, the agency decides that the
information is accurate, but the consumer continues to dispute that
conclusion, the agency must include the consumer's statement of dispute
in any subsequent consumer report.\50\
---------------------------------------------------------------------------
\45\ Id. Sec. 1681e(b).
\46\ Id. Sec. 1681g(a).
\47\ Id. Sec. 1681i(a)(1).
\48\ Id.
\49\ Id. Sec. 1681i(a)(5).
\50\ Id. Sec. 1681i(c).
---------------------------------------------------------------------------
The Act provides a robust enforcement scheme. Consumers can bring
civil actions for damages and attorneys fees for negligent or willful
violations of the Act.\51\ Punitive damages are also available in the
case of willful violations.\52\ The Act provides for parallel
enforcement at the federal level by the FTC, which can bring actions to
enjoin further violations and/or to impose civil penalties.\53\ Knowing
and willful violations of the Act also can lead to criminal penalties,
including imprisonment.\54\ Finally, most states have analogous credit
reporting statutes giving rise to private rights of actions and
providing enforcement powers to the state attorney general.\55\
---------------------------------------------------------------------------
\51\ Id. Sec. Sec. 1681n, 1681o.
\52\ Id. Sec. 1681n(a)(2).
\53\ Id. Sec. 1681s.
\54\ Id. Sec. Sec. 1681q, 1681r.
\55\ See, e.g., Cal Civ. Code Sec. 1785 et seq.; Conn. Gen. Stat.
36-432 to 435.
---------------------------------------------------------------------------
2. Children's Online Privacy Protection Act of 1998
Recently, in response to a study by the FTC concluding that
additional regulation was needed to protect the privacy of children,
the U.S. Congress enacted the Children's Online Privacy Protection Act
of 1998. The Act directs the FTC to promulgate regulations that govern
the collection, use, and disclosure of ``personal information''
obtained online from a child (defined as anyone under the age of 13) by
an operator of a commercial website or online service directed to
children, as well as any operator with actual knowledge that it is
collecting personal information from a child.\56\ ``Personal
information'' is defined to include ``individually identifiable
information,'' such as a child's name, address, phone number, social
security number, e-mail address, or any other ``identifier that * * *
permits the physical or online contacting of a specific individual.''
\57\ The Act further reaches any other information collected online
that is combined with any of the above identifiers.\58\ For example, if
a website were to assemble a file including a child's name, address,
and a list of past purchases, the information about purchases would be
deemed subject to the Act.
---------------------------------------------------------------------------
\56\ Children's Online Privacy Protection Act of 1998,
Sec. Sec. 1302(l), 1303(b)(1).
\57\ Id. Sec. 1302(8).
\58\ Id. Sec. 1302(8)(G).
---------------------------------------------------------------------------
Congress directed the FTC to promulgate regulations concerning the
collection, use, and disclosure of this personal information about
children. These regulations must require, inter alia, that website and
online service providers subject to the Act
(1) provide notice on the website of what information is
collected, how the operator uses the information, and if/when
it discloses the information;
(2) obtain verifiable parental consent for the collection,
use, or disclosure of such information;
(3) permit a parent to obtain any data his/her child has
provided to the operator;
(4) allow the parent to require the operator to delete such
data and/or not to collect further data; and
(5) ``establish and maintain reasonable procedures to protect
the confidentiality, security, and integrity of personal
information collected from children.'' \59\
---------------------------------------------------------------------------
\59\ Id. Sec. 1303(b)(1).
The Act establishes several narrow exceptions to its reach. For
example, its requirements do not apply either to information collected
from a child online that is used on a one-time basis to respond to a
request and is not maintained in retrievable form or to a request for
the name of a parent when made for the sole purpose of obtaining
consent to collect information about the child.\60\ The Act also
contains a ``safe harbor'' provision under which an operator is deemed
to comply with the FTC regulations if it follows a set of self-
regulatory guidelines approved in advance by the FTC (after an
opportunity for the public to comment) as meeting the requirements of
the FTC regulations.\61\
---------------------------------------------------------------------------
\60\ Id. Sec. 1303(b)(2).
\61\ Id. Sec. 1304.
---------------------------------------------------------------------------
A violation of the regulations promulgated by the FTC under the Act
is deemed to be a violation of Section 5 of the FTC Act,\62\ the
penalties for which are described above. Moreover, the Act provides
that certain other specified agencies also shall enforce the Act and
the FTC regulations against companies that those agencies regulate; for
example, the Department of Transportation must enforce the Act with
respect to airlines, and the Federal Reserve Board is charged with
enforcement against its member banks.\63\ In addition to these forms of
federal enforcement, the Act authorizes state attorneys general to
bring enforcement actions for injunctive and/or monetary relief for any
violation of the FTC regulations.\64\
---------------------------------------------------------------------------
\62\ Id. Sec. 1303(c).
\63\ Id. Sec. 1306(b).
\64\ Id. Sec. 1305.
---------------------------------------------------------------------------
3. Other federal statutes that protect the privacy of consumer
information
Numerous other federal statutes also protect the privacy of
particular types of information and provide regulatory and/or judicial
enforcement mechanisms:
Electronic Funds Transfer Act, 15 U.S.C. Sec. 1693 et seq.--
This Act requires institutions that provide electronic banking
services to inform consumers of the circumstances under which
automated bank account information will be disclosed to third
parties in the ordinary course of business. The Act is enforced
by the Federal Reserve Board, and violations can result in
civil and/or criminal penalties.
Electronic Communications Privacy Act, 18 U.S.C. Sec. 2510
et seq.--This statute prohibits the unauthorized interception
or disclosure of many types of electronic communications,
including telephone conversations and electronic mail, although
disclosure by one of the parties to the communication is
permitted. Violators of this statute are subject to criminal
penalties and civil liability.
Video Privacy Protection Act, 18 U.S.C. Sec. 2710--This
statute forbids a video rental or sales outlet from disclosing
information concerning what tapes a person borrows/buys or
releasing other personally-identifiable information. The Act
further requires such outlets to provide consumers with the
opportunity to opt out from any sale of mailing lists. The Act
is enforced through civil liability actions.
Telephone Consumer Protection Act of 1991, 47 U.S.C.
Sec. 227--This provision mandates that any company making a
telephone sales call first consult its list of those who have
elected not to receive such calls. The statute grants the
Federal Communications Commission (``FCC'') the authority to
prescribe regulations necessary to protect residential
subscribers' privacy rights. The Act also bans unsolicited fax
messages. It is enforced by the FCC and through civil suits
that can give rise to substantial penalties.
The Cable Communications Policy Act of 1984, 47 U.S.C.
Sec. 551 et seq., as amended by The Cable Television Consumer
Protection and Competition Act of 1992--This Act establishes
written disclosure requirements regarding the collection and
use of personally identifiable information by cable television
service providers and prohibits the sharing of such information
without prior consent. The Act also provides consumers with the
right to access cable company records for purposes of
inspection and error correction. The statutory provisions are
enforceable through private rights of action for damages.
Communications Act, 47 U.S.C. Sec. 222--This provision
requires telecommunications carriers to protect the
confidentiality of customer proprietary network information,
such as the destinations and numbers of calls made by
customers, except as required to provide the customer's
telecommunications service or pursuant to customer consent.
These requirements are enforced by the FCC.
Federal Aviation Act, 49 U.S.C. Sec. 40101, et seq.--
Department of Transportation regulations promulgated under
authority of this Act generally require airlines to keep
passenger manifest information, such as the names and
destinations of passengers, confidential and prohibit use of
this data for commercial or marketing purposes.\65\ These
regulations are enforced by the Department of Transportation.
---------------------------------------------------------------------------
\65\ See 14 C.F.R. Sec. Sec. 243.7, 243.9.
---------------------------------------------------------------------------
Health Insurance Portability and Accountability Act of 1996,
42 U.S.C. Sec. 1301, et seq.--This Act provides that the
Secretary of Health and Human Services must promulgate
regulations regulating the privacy of individually identifiable
health information if Congress itself does not enact
legislation on this subject by August 1999. The Secretary has
already issued a set of recommendations to Congress that
include provisions such as restricting the disclosure of
patient identifiable information and providing patients with
notice about how such information will be used and to whom it
will be disclosed.
Office of Thrift Supervision Policy Statement on Privacy
\66\--This policy statement advises savings associations on how
to best protect consumer privacy. Among other things, the
statement urges savings associations to provide notice to
consumers as to how personal information will be used and in
what circumstances such information may be disclosed to third
parties.
---------------------------------------------------------------------------
\66\ Office of Thrift Supervision, Statement of Privacy and
Accuracy of Personal Customer Information (Nov. 1998).
---------------------------------------------------------------------------
Right to Financial Privacy Act of 1978, 12 U.S.C. Sec. 3401,
et seq.--This Act mandates that the federal government present
proper legal process or ``formal written request'' to inspect
an individual's financial records kept by a financial
institution (including a credit card company) and give
simultaneous notice to the consumer to provide him/her with the
opportunity to object. Both government agencies and financial
institutions that violate this Act are subject to civil court
actions.
B. State Law Protection
In addition to sectoral privacy protection at the federal level,
states provide both statutory and common law privacy protection with
respect to numerous types of data, particularly in the financial and
credit sectors. These state laws sometimes complement similar
safeguards at the federal level by providing alternative remedies and
enforcement schemes. In other cases, the state laws provide protection
for types of data that federal laws do not reach.
1. State statutes
A number of states have statutes that generally concern privacy of
financial data. Illinois, for example, regulates the circumstances in
which a bank may disclose a customer's financial records, including any
information ``pertaining to any relationship established in the
ordinary course of a bank's business.'' \67\ In addition to the state
analogues to the FCRA discussed above, a number of state statutes
specifically address the use of consumer credit information,
particularly for marketing purposes. Maine, for example, generally
forbids any sale or disclosure of mailing lists or account information
of credit card holders to a third party without an explicit opt-in by
the consumer.\68\ Florida and Hawaii also have opt-in schemes for
dissemination of credit card lists, except that they allow disclosures
to a third party as long as that party is prohibited from divulging
consumer information except to carry out the purpose for which the
cardholder provided the information.\69\ California requires that,
before a credit card issuer discloses marketing information to any
person, the issuer must inform the cardholder of such disclosure by
written notice that provides an opportunity to opt out of the
program.\70\
---------------------------------------------------------------------------
\67\ Ill. Rev. Stat. ch. 202, Sec. 5/48.1; see, e.g., Minn. Stat.
Sec. 13A.01; N.J. Stat. Ann. Sec. 17:16K-3.
\68\ Me. Rev. Stat. Ann. tit. 9-A, Sec. 8-304.
\69\ Fla. Stat. ch. 817.646; Haw. Rev. Stat. Sec. 708-8105.
\70\ Calif. Civ. Code Sec. 1748.12(b).
---------------------------------------------------------------------------
State statutes also extend privacy protections to other sectors of
the economy. A number of states, for example, restrict the collection
and disclosure of information gathered by insurance companies. These
statutes, based on the Insurance Information and Privacy Protection
Model Act promulgated by the National Association of Insurance
Commissioners, often require insurance companies and agents to provide
a policyholder or applicant notice concerning the types of personal
information that may be collected about him or her from a third party
and the individual's rights to access and correct information in the
company's files.\71\ Many state statutes also protect the privacy of
medical information by, for example, providing patients a general right
of access to their medical records \72\ and protection from disclosure
of medical records by licensed health-care providers.\73\
---------------------------------------------------------------------------
\71\ See, e.g., Cal. Ins. Code Sec. 791; Conn. Gen. Stat. Ann.
Sec. 38-501; Ill. Rev. St. ch. 215, Sec. 5/1001.
\72\ See, e.g., Cal. Health & Safety Code Sec. 1795; Colo. Rev.
Stat. Sec. 25-1-801.
\73\ See, e.g., Fla. Stat. chs. 455.241, 395.017.
---------------------------------------------------------------------------
2. State common law
States also provide privacy protection through a number of common
law doctrines. On a general level, virtually all states recognize a
tort of invasion of privacy. This tort is generally divided into four
categories: intrusion upon seclusion of another, appropriation of
another's name or likeness, unreasonable publicity given to another's
private life, and publicity placing another in a ``false light'' before
the public.\74\ The most relevant form of this tort in the context of
protecting an individual's private data is giving unreasonable
publicity to another's private life. Although this tort is unlikely to
apply to the disclosure of arguably public information such as names
and addresses, release of more private information such as transaction
histories might trigger this tort.\75\
---------------------------------------------------------------------------
\74\ Restatement (Second) of Torts Sec. 652A (1977).
\75\ But see Dwyer v. American Express, 652 N.E.2d 1351 (Ill. App.
1995) (rejecting invasion of privacy claim based on alleged sale of
card member lists sorted by buying patterns because customers
voluntarily used card and company had ownership interest in data).
---------------------------------------------------------------------------
In certain cases, the relationship between the consumer and the
holder of consumer data gives rise to a legally cognizable duty not to
disclose consumer information or to do so only in particular
circumstances. A number of states, for example, have recognized an
implied contractual duty on the part of banks not to disclose
information about a depositor's account.\76\ A similar duty arguably
arises in the context of a creditor-debtor relationship \77\ and a
security firm-customer relationship.\78\
---------------------------------------------------------------------------
\76\ See, e.g., Barnett Bank of West Florida v. Hooper, 498 So.2d
923, 935 (Fla. 1986); Twiss v. State Dept. of Treasury, 591 A.2d 913,
919-20 (N.J. 1990).
\77\ See, e.g., Pigg v. Robertson, 549 S.W.2d 597, 600 (Mo. Ct.
App. 1977).
\78\ See, e.g., Barnsdall Oil Co. v. Willis, 152 F.2d 824, 828 (5th
Cir. 1946).
---------------------------------------------------------------------------
Finally, state regulation of professionals, such as accountants,
doctors, lawyers, and psychologists, often impose restrictions on the
use and disclosure of personal information such professionals obtain
from their clients. Often the state code simply enforces or supports
the self-regulatory code adopted by the profession. For example, many
states protect communications between doctors and psychiatrists and
patients, recognizing those professions' commitment to safeguarding
such communications. Some states also have recognized that accountants
have a general duty to maintain the confidentiality of client
information.\79\ State laws often provide additional protections by
determining that these professional codes of conduct create fiduciary
duties on the part of professionals and permitting civil suits for
breach of those duties.
---------------------------------------------------------------------------
\79\ See, e.g., Alaska Sta. Sec. 8.04.662; Ariz. Rev. Stat.
Sec. 32-749; Conn. Gen. Stat. Sec. 20-281j.
---------------------------------------------------------------------------
iii. the online privacy alliance: using self regulation to safeguard
consumer privacy online
In keeping with the traditional commitment to self regulation in
the United States and in response to the FTC's and the Clinton
administration's call for responsible self-enforcement of privacy
protection by U.S. industry, many U.S. businesses have come together to
begin exploring the creation of self-regulatory programs. One
particularly successful example of this effort has been the OPA, which
brought together over 70 leading global companies and associations
beginning in 1998 to address growing public concern over online privacy
issues.
The online medium creates particular challenges for privacy
protection while simultaneously creating significant opportunities for
consumer privacy education and empowerment. The challenges are
manifold: Use of the Internet necessarily involves a tremendous flow of
information, much of it personal in nature, in a wide variety of
contexts. Some information flows involve the consumer actively
providing information. For example, commercial Internet transactions
require consumers to provide credit card or other payment and contact
information, and in certain more sensitive contexts, some transactions
may require other identifying data. Some sites may seek data in order
to satisfy the consumer's request for information or services, such as
where a consumer is asked about family size or smoking habits in
response to an inquiry about hotel accommodations. Other sites may
request data simply to use for marketing purposes. Consumers also may
provide a great deal of data in order to obtain personalized services,
such as targeted clipping services or personalized Internet service
offerings. In some cases, consumers provide data without necessarily
realizing they are doing so. For example, simply visiting or
subscribing to certain online sites or services may itself create a
footprint that conveys data about the individual's interests. But
regardless of the context, all data collected online is already in
digital format, which makes it easy to manipulate, store, and process,
and in turn provides massive capabilities for use and transfer of data.
Meanwhile, unless effective security measures are used, collection of
data online is susceptible to computer ``hacking'' by unauthorized
users, and also to fraud by consumers posing as a third party.
These challenges place a special obligation on the online industry
to educate consumers about the Internet's privacy risks and to enhance
consumers' ability to make educated choices about how to protect their
privacy rights. And indeed, the online medium provides tremendous
opportunities for consumer data protection. Online merchants have an
unmatched ability to provide consumers with information online quickly,
efficiently, and cheaply. Unlike offline merchants who must rely on a
one-time mailing or a small print notice in a catalogue, online
merchants (or other site owners) interact directly with the consumer
each time the consumer visits the merchant's site and therefore have
the opportunity to educate and interact with the consumer concerning
the site's privacy policies before any data collection takes place.
Where appropriate, therefore, consumer consent can be requested at the
point where a consumer interacts with a site or inquires about a
product or service. Moreover, the merchant's ability to control what
the consumer sees on any page of its site provides the merchant with a
unique ability to educate the consumer about the site's privacy policy.
The site can emphasize its participation in a privacy seal program, for
example, or provide a link to the site's privacy policy from any page
of the site. This in turn can empower consumers to make educated
choices about whether they wish to deal with the particular online
service based, at least in part, on the level of privacy protection the
online operator provides.
The online environment also permits a site to be designed to permit
different levels of participation (or provide different types of
benefits) based on the consumer's willingness to provide information,
or to provide different levels of protection based on consumer demand.
Online services also may provide the ability to make data anonymous
easily, or to do so selectively upon consumer request. In addition, new
technologies, such as P3P and filtering programs, provide consumers
with the means to exercise independent control over the level of
privacy they obtain while online. Finally, consumers have the ability
to vary the level of privacy protection they desire each time they
visit an online service or site: The process for providing or
withdrawing consent is accessible and can be executed immediately and
repeatedly to personalize the level of privacy protection.
Thus, if the online industry takes seriously its obligation to
educate and inform consumers, the medium presents enormous
opportunities for consumer choice and self-determination. Accordingly,
a central pillar of OPA's self-regulatory program is the requirement
that an online site notify consumers about the site's data collection
and dissemination policies. OPA members are committed to providing
consumers with the information and tools they need to make informed
choices. A second pillar of OPA's program is ensuring that consumers
have the opportunity to make choices: consumers must be able to consent
or withhold consent to the use of their data by the site they visit.
Lack of consent may manifest itself in the consumer's refusal to use
the particular service or continued interaction with the site on a
limited level. In some cases, consent or opt-out may be more explicit
and permit consumers to participate in the site while blocking only
certain secondary uses of the consumer's data.
OPA's program is designed to address the challenges and
opportunities provided by the online medium while addressing the U.S.
government's and the Directive's data privacy concerns. OPA has adapted
these privacy principles to address the Internet industry's enormous,
ongoing data flows. In order to enforce the OPA's privacy program and
policies, the OPA encourages participation in a seal program that will
ensure and enforce a minimum standard level of privacy protection. The
seal program must also be easy for consumers to recognize and
understand. Seal programs provide the added benefit of being backed up
by the FTC's umbrella enforcement authority, state and local consumer
protection agencies, and applicable sectoral data privacy regulation.
A. OPA's Privacy Policy Guidelines
In keeping with the key substantive requirements of the Directive
and the FTC's privacy principles, the OPA's privacy program addresses
notice to data subjects, limitations on use of data, data security and
quality, the right to correct personal data, and onward transfers of
data. The OPA's program for online data privacy protection is compared
with the key requirements of the Directive below.
Notice to Consumers. Because of the rapidly growing ability to
collect data about online consumers and the increasing demand for a
personalized browsing experience, OPA strongly believes that website
operators have a heightened responsibility to make available to online
consumers the information necessary to make informed decisions about
data privacy. The OPA believes that properly informed consumers should
then be allowed to choose the level of privacy that they desire. The
OPA therefore requires its members to post a privacy policy that online
consumers can view before or at the time that personal data is
collected or requested. The privacy policy must, among other things,
notify consumers about the online site's data collection practices. The
OPA's privacy policy requirement thus is similar to Article 10 of the
Directive, which requires data controllers to provide data subjects
with information about the controller's identity, the purposes of data
processing, and other information necessary to guarantee fair
processing. In addition, the privacy policy must be easy to find, read
and understand; it also must clearly describe the information that is
being collected, any possible onward transfers of personal data, and
any options that consumers have to refuse to provide data or to block
certain uses or transfers of data. OPA further encourages its members
to disclose in their privacy policy any consequences of a consumer's
refusal to provide information, the accountability or enforcement
mechanism(s) used by the organization, and information about how to
contact the organization with privacy concerns. By requiring members to
provide comprehensive online privacy policies that are easy to find and
read, OPA ensures that all online consumers have the information
necessary to make an informed decision about whether or not to provide
personal information to particular websites, how much information to
provide, or whether to even visit certain sites.
Limitations on purposes and onward transfers. Consistent with the
OPA's principles regarding notice and consent, the OPA advocates
allowing data subjects to opt out of any uses or processing unrelated
to the original purpose for which the data are collected. Like Article
6 of the Directive, which requires that personal data not be further
processed in a way incompatible with the original purpose for
collecting the data, the OPA privacy guidelines limit the extent to
which data can be processed for purposes unrelated to the original
disclosed purposes in the absence of proper consent. The OPA guidelines
similarly limit transfers to third parties for marketing purposes or
for other purposes unrelated to the original purposes for collecting
the data, much like Articles 10 and 11 of the Directive, which require
notifying data subjects of onward transfers of data to third parties
where notification is necessary to ensure fair processing of the data.
With respect to disclosure of data for marketing purposes, OPA requires
its members to disclose in their privacy policies possible onward
transfers of personal data and any marketing uses of data. These
requirements, and the consumer's ability to leave the site or, in some
cases, to opt out of a specific data use on the site, address the
principles in Article 14 of the Directive, which provides data subjects
with the right to notice prior to disclosure of their personal data for
direct marketing purposes and the right to object to direct marketing
uses of their data. OPA also encourages its members to take reasonable
steps to ensure that third party transferees take reasonable
precautions to protect transferred data.
Data quality, access to data, and correction. The OPA supports the
Directive's principles of assuring that (1) data are accurate,
complete, and timely for their intended purposes, and (2) consumers can
access data about them and correct that data where appropriate.
However, the extraordinarily wide range of online data processing
activities makes it difficult and costly to require all websites to
provide consumers with unrestricted access to personal data without
regard for its intended purposes or alternative means of ensuring that
individuals are informed of data collection and that data quality is
maintained as appropriate to those purposes.
Consistent with the spirit of Article 12 of the Directive, which
guarantees data subjects the right to access personal data and have
that data corrected where necessary, the OPA requires its members to
provide ``easy mechanisms'' for consumers to make inquiries and lodge
complaints or objections. The precise mechanisms for such inquiries and
the nature and scope of information provided to the consumer on request
will necessarily vary according to the data at issue and the costs and
benefits associated with furnishing access to the raw data or a summary
of the data, given the context of the specific intended uses of the
data. For example, some data collected online may be used for
electronic commerce transactions or decisions to provide or terminate a
service. OPA anticipates that its members would routinely provide
access to transaction records and an opportunity to lodge corrections,
as these have a substantive impact on the consumer. By contrast, a
website may automatically record navigational or ``clickstream'' data
as an individual moves from page to page on a site, either for
statistical purposes (to better design and manage the site) or to
automatically personalize the initial pages presented to the visitor
based on the visitor's historical use of the site. Such information is
processed automatically and changes over time. There is little benefit,
and much cost, in accumulating this data in a form that could be
reviewed intelligibly by the individual at any moment. Moreover, doing
so raises additional privacy risks, since it means that more data is
readily retrievable by name, and more identifying data must be
collected to ensure that the person requesting access is indeed the
data subject. Similarly, the use of website data to determine
automatically whether to send an individual a product solicitation
involves no substantive decision that affects significant consumer
interests and does not warrant the cost (and sometimes the increased
privacy risks) of storing and providing subsequent access to the data
that prompted the solicitation.
Because the online medium entails the possibility of tracking and
recording enormous amounts of data on the use of a website, the costs
of furnishing unlimited consumer access to all such data would often be
prohibitive. The data may not be maintained in a manner conducive to
consumer-specific access: marketing data, for example, is often coded
and stored by categories of merchants or purchases rather than by
consumer. Before imposing on website operators (and ultimately on
consumers) the costs of providing access to all data resulting from a
site visit, the nature and uses of that data must be taken into
account. Where data is not used for a purpose that in any way affects
the consumer's ``fundamental rights or freedoms,'' or that does not
even involve denial of a more mundane benefit to the consumer, the cost
and difficulty of access must be given particular weight.
Access by the individual to all data generated online is not the
only means of ensuring that consumers (and the relevant enforcement
bodies) are aware of the operator's data collection practices and can
assess their potential impact. This can often be accomplished, for
example, by appropriate notices, consumer education, and monitoring
techniques such as the use of ``decoys'' (pseudonymous registrations to
check the manner in which an online service or website uses personal
data), rather than by individualized access to vast amounts of non-
sensitive data. It is in the nature of online services and websites
that it is easy to display notices at the point where information is
collected and to give visitors an opportunity at any stage to seek
clarification, opt out, or simply leave a site if they are not
satisfied with its privacy practices. This offers an efficient means of
protecting privacy and should suffice where the data collection is not
used for substantive decisionmaking.
Security. Like Article 17 of the Directive, the OPA advocates
taking appropriate measures to protect personal data from destruction,
loss, misuse or alteration.
Collection of data from children. Well before the passage of the
Children's Online Privacy Protection Act, discussed above, the OPA
thought it necessary to provide special protection for young Internet
users. Out of this concern, the OPA was among the first organizations
to adopt principles specifically addressing collection of data from
children under the age of 13. These specific principles require OPA
members to obtain prior parental consent before collecting any
individually identifiable offline contact information from children
under the age of 13. Members may collect online contact information
from children without obtaining prior parental consent only if they
notify parents and allow them to prevent use of the data. Other special
protections provided by these OPA principles include requiring members
to prevent children from being able to publicly post individually
identifiable contact information without prior parental consent;
prohibiting members from using special games, prizes or activities to
entice children to reveal more information than necessary to
participate in the activity; and prohibiting members from distributing
to third parties any individually identifiable information collected
from a child without obtaining prior parental consent.
B. Enforcement Mechanisms
Although membership in the OPA, standing alone, itself denotes a
commitment to privacy protection that arguably could be enforced by the
FTC, OPA also advocates that its members commit to an independent
enforcement mechanism intended to back up that commitment. OPA promotes
participation in a ``seal program'' by its members as a means of
enforcing the OPA privacy guidelines and the member's privacy policies.
Seal programs provide participants the right to use an identifiable
symbol or logo (``seal'') to alert consumers that the participant's
online service complies with the seal program's standards; that the
participant has procedures to ensure compliance; and that the
participant participates in a program designed to resolve consumer
complaints.
Seal programs are ideal enforcement mechanisms in the online
environment for two reasons. First, seal programs take advantage of the
visual nature of websites to alert consumers' attention to privacy
policies and practices through the use of visible and easily
recognizable graphic seals that can, if desired, be displayed on every
page of a site. Second, to some extent seal programs standardize the
terms and terminology of privacy practices, making them easier for
consumers to comprehend. They give consumers a relatively simple, user-
friendly means of identifying websites that have made privacy
commitments, linked to greater detail about the site's particular
practices.
In many seal programs, participants cede a degree of investigative
or complaint resolution authority to the seal program's enforcement
entity. The entity often is permitted to disclose complaints to the
public and government agencies, and the entity can drop a company that
fails to conform with the required conduct. Moreover, seal programs may
provide government agencies with a hook to mix self-enforcement with
government regulation: as discussed in Part I above, a company's public
affirmation of participation in a seal program would provide the FTC
(or other consumer protection entity on the state or local level) with
the grounds to prosecute a company's failure to in fact uphold the
standards articulated by the seal program.
A seal program meeting OPA's criteria would enhance data privacy
protection by requiring that seal participants live up to the types of
privacy guidelines advocated by OPA, as well as any additional policies
the seal program adopts. OPA does not, at least currently, intend to
operate its own seal program, and it has not endorsed a specific
program to date. In reviewing seal programs, however, OPA would expect
a commitment to at least the same degree of privacy protection espoused
by the OPA, as well as the following enforcement practices and
policies:
Participation from outside the business community. OPA suggests
that the seal program obtain input from representatives of consumer
advocate groups and academia, in addition to representatives of the
business community.
Verification and monitoring. Prior to awarding the seal to an
organization, the seal program must require participants to submit to a
compliance review by the seal program or provide a self-assessment
verifying that the organization is in compliance with the program's
standards. Once the seal has been awarded, participants must consent to
periodic verification in the form of auditing, periodic reviews, or use
of pseudonymous ``decoys'' or other technological monitoring.
Complaint resolution. The seal program must require participants to
provide an easy-to-use consumer complaint resolution process that will
serve as the consumer's first remedy. If the participant and consumer
are unable to resolve a complaint through the participant's internal
dispute resolution process, the participant must then submit to the
seal program's complaint resolution mechanism. In addition to these
mechanisms, consumers must not be prohibited from pursuing any other
legal remedies that may be available to them under federal or state
law.
Penalties or noncompliance. Failure to comply with the requirements
of the seal program (and in particular, failure to follow the program's
dispute resolution requirements) should result in placing the
participant on probation or instituting proceedings to revoke the
participant's right to use the seal.
Monitoring for misuse or misappropriation. The seal program should
monitor use of the seal and if necessary, bring litigation to prevent
unauthorized use of the seal. In addition, the seal program must refer
non-complying companies to appropriate government agencies, including
the FTC.
Education and outreach. The seal program must educate consumers and
businesses about the seal program and online privacy issues. These
education and outreach efforts should include providing publicity for
participants, publicly disclosing seal revocation and material non-
compliance, and periodically publishing verification and monitoring
procedures.
To date, two major seal program initiatives are underway or about
to be launched that may embody the policies and practices advocated by
the OPA: TRUSTe and BBBOnLine. The OPA is monitoring the development of
those programs and others to determine whether they meet OPA's
requirements for privacy protection and effective enforcement.
The TRUSTe program, which began as a collaboration between the
Electronic Frontier Foundation and CommerceNet, has been administering
its online privacy seal program since June of 1997. This program
requires participants to post an online privacy policy that meets
TRUSTe guidelines, to submit to TRUSTe oversight, and to cooperate with
TRUSTe's dispute resolution efforts. In return, participants are given
the right to display TRUSTe's seal on their home page. This seal serves
as a link to the company's privacy policy, and consumers can also
verify the authenticity of the seal online.
The privacy policy required of TRUSTe participants must explain
what data are being collected, the purposes of data collection and
processing, with whom the data will be shared, the consumer's options
concerning processing and onward transfers, data security procedures
that are in place, and how consumers can update or correct data.
Licensees who join or renew after October 1998 must also give consumers
the opportunity to opt out of secondary or third-party uses of data
provided by the consumer. Also in October 1998, TRUSTe introduced a
Children's Privacy Seal Program that applies to websites directed
specifically at children under the age of 13, as well as sites that
collect age-specific information. The children's program requires site
operators to notify parents and obtain their consent before collecting
and using a child's online or offline contact information. Sites aimed
specifically at children must post the unique ``kid's seal.''
TRUSTe utilizes a variety of verification and enforcement
techniques. In cases where TRUSTe suspects that a participant is not
complying with program guidelines or with the participant's own privacy
policy, the participant may be subject to on-site compliance reviews by
TRUSTe's official auditors, revocation of the right to use the TRUSTe
seal, termination from the TRUSTe program, and referral to appropriate
government agencies.
The Better Business Bureau (``BBB'') runs the largest and most
recognized retail, service and national advertising self-regulation and
consumer dispute resolution programs in the United States. Using its
self-regulatory models as a starting point, the BBB has been operating
an online seal program (with more than 2000 participants) through
BBBOnLine since mid-1997. BBBOnLine assists consumers in finding
reliable online merchants that have agreed to BBB standards for
truthful advertising and customer satisfaction. BBBOnLine has proposed
a privacy program that likely will be similar in many ways to the
TRUSTe program and will utilize BBBOnLine's existing self-regulatory
framework.
BBBOnLine is still in the process of developing its privacy
principles. These principles are expected to be similar to those of the
OPA and TRUSTe programs, although they may in some respects provide
additional privacy protections not currently required by the OPA and
TRUSTe. The BBBOnLine enforcement framework will consist of use of a
recognizable seal to assert compliance with BBBOnLine principles and
the company's privacy policy, a comprehensive annual compliance
assessment, additional independent verification measures, consumer
dispute resolution, and appropriate referrals by BBBOnLine to the FTC
and other government authorities. BBBOnLine participants will have to
respond promptly to all consumer complaints, submit to BBBOnLine's
dispute resolution process, and maintain a satisfactory complaint
handling record with the BBB. BBBOnLine will refer eligible complaints
to a free, informal dispute resolution process patterned after BBB's
national advertising review program, and BBB will make that process
available for complaints about non-seal participants as well as seal
participants. BBBOnLine also will refer uncooperative or non-compliant
companies to the FTC or other appropriate federal or state regulatory
agencies.
iv. conclusion
As Articles 25(2) and 27 of the Directive make clear, the EU has
recognized that industry and professional standards can be powerful
tools for protecting data privacy. In the United States, industry-wide
self-regulation of data privacy can be an especially effective means of
ensuring that consumer data receives the level of protection embodied
in the EU Directive where such self-regulation combines private sector
standards with FTC enforcement, regulation by federal and state
agencies and, where appropriate, enforcement by the courts.
In the online environment, OPA has established principles--
principles its members must publicly embrace--that are consistent with
the policies of the U.S. government and with the Directive. OPA members
must submit to dispute-resolution procedures, and, by publicly
embracing OPA's principles, members are also subject to potential
enforcement by the FTC and other government agencies. The emergence of
two online privacy seal programs demonstrates that the enforcement
element of OPA's self- regulatory framework is not just hypothetical,
but is quickly developing. Moreover, these seal programs are not
engaging in a ``race to the bottom,'' but rather, in keeping with the
recent initiatives and pronouncements of the U.S. government, they are
embracing meaningful principles embodying a significant degree of
privacy protection. In addition, OPA members frequently will be subject
to additional regulation of various types of data protection on both
the state and federal level, enforced by government agencies and the
courts. Self-regulatory programs such as OPA's, which are designed to
operate in the context of the United States' layered approach of self-
regulation backed by government enforcement, should be recognized as
effective by the EU in its effort to protect privacy while promoting
the uninterrupted flow of global commerce.
W. Scott Blackmer
([email protected]),
Lynn Charytan
([email protected]),
Wilmer, Cutler & Pickering,
Washington, DC.
The Chairman. Mr. Berman.
STATEMENT OF JERRY BERMAN
Mr. Berman. Thank you, Senator. Mr. Chairman, Senator
Leahy, Senator Kohl, Senator Schumer, I appreciate the
opportunity to be here to talk about privacy on the Internet.
While I agree with the caution and concerns of the previous
witnesses, I want to endorse them, but also try and reposition
the issue somewhat. I think we have to step back and say what
are we doing here. The Internet is not just a commercial forum;
it is the future community for many of us and for many of our
transactions going into the 21st century. There are 160 million
people on the Internet. It is eventually going to be all of us
because we are moving our transactions. We are going to do
business there; our libraries are there, medical records are
there. We are putting entertainment there. We are building new
communities.
In all due respect, and it is true, without all the hype,
we are building a ``virtual me'' and virtual communities, and
that means that we are now looking at developing the
fundamental rules for this Internet. It is almost like
constitution-building, in my view. It is a global Internet, and
that makes it difficult. We are not just all sitting in
Philadelphia writing the rules for the world, but we are trying
to figure out what the fundamental law is.
My organization wants to ensure that there is a commerce
clause, but that there is also a bill of rights, and that means
that we have to look at the Internet from several perspectives.
First, the key thing to understand about the Internet is that
it is a different architecture. It is global, decentralized,
interactive, which changes the characteristics.
It is very important for Congress to understand its
architecture. Not understanding the architecture in the
Communications Decency Act--it is 0 for 2 in terms of writing
legislation, so a careful look at how the Internet works and
why it is different than other media is very important.
Second, the goal has to be privacy. It is not legislation
or self-regulation; it is privacy. And what do we mean by
privacy? Privacy is not just protection against commercial
users of information misusing my information. The government is
also on the Internet. Law enforcement is also on the Internet.
We just published a study of government Web sites. Two-thirds
of all government sites haven't got a privacy policy up. They
are doing business on the Internet.
Senator Leahy's E-RIGHTS bill deals with how do we balance
law enforcement needs and privacy in this new community. How is
law enforcement going to be done? How are they going to relate
to these new databases that are at AOL or on the Net, the
digitalme that Novell talks about? So it is both privacy
expectations against the government and the private sector. And
self-regulation may work a great deal in the private sector up
to a point, but I don't know how you solve the government
problem without drawing law to limit and define the rights of
citizens as against the government.
When we talk about privacy, we have to break it down into
several expectations. The first expectation that we have when
we go on the Internet or into any community is that we have a
certain amount of autonomy, what Senator Leahy talked about in
Vermont, the right to be let alone, not to be identified, to
shop, to browse. The Internet can afford that, but also the
technologies like the Intel chip, which is an identity chip
which may identify each one of us as we go through the
Internet, cookies. You have heard of the technologies that are
tracking and collecting information about citizens, not for bad
purposes, but to make the Net more efficient, to sell commerce,
to get people to the sites that they want to go to. But there
is a rich, new source of information on the Internet, and the
question is will citizens have the autonomy to be left alone.
Second, the key to that is at least fair information
practices. We go on the Net and we want to know when
information is collected about us, where it is going, how is it
going to be used, and do we have choices about that. That is
fair information practices and it is the key. It helps us to
know whether we have any autonomy. We have to ensure that those
fair information practices are on the Net.
The bad news is that we are very far behind. Only 14
percent of all Web sites post what their privacy policies or
information policies are. The good news is that the business
community and everyone understands that it is good for business
and commerce, and that consumers will not trust the Internet
until those policies are there.
Third, consumers want confidentiality. They want
confidentiality in their communications. This committee, in
1986--Senator Hatch, Senator Leahy--wrote the Electronic
Communications Privacy Act which created new privacy rights for
e-mail. The whole issue of encryption--because of the
decentralized nature, that debate over encryption and
technology policy is critical. There are new databases that are
being created on the Internet, like digitalme, which are as
sensitive as our wallet that is still there, but we are now
shopping with on the Net. What are the protections against
government for that?
So we have to come back and say, well, what are the
solutions? There are a bundle of solutions. Partly, it is
technology, the Platform for Policy Preferences which allows
people to express privacy policies on the Net. Partly, it is
self-regulation, like BBBOnLine and TRUSTe, which is telling
consumers and getting sites to disclose what their policies
are. That will work up to a point.
And I think that IBM and AOL and the Privacy Alliance are
in the lead of establishing what the baseline rules are for
fair information practices on the Net, but it will only go up
to a point. At some point, you are going to have to deal with
the bad actor on the Net, define what is a violation of privacy
on the Net. In other words, you can't just say, well, this is
what I am going to promise you about your information, but if I
don't do it, what are the remedies? There may be some private
sector remedies, but what is the role of the FTC there?
You have to go very carefully here because you are dealing
with information, and information raises First Amendment
issues. The remedies have to be clear, concise and not vague,
so that a lot of thinking has to go into what is the remedy for
someone misusing your address and personal information in a
commercial transaction versus a medical transaction. One size
does not fit all. And then we are going to need legislation.
To conclude, it is a series of things that we have to look
at. We are at the beginning of trying to define the
constitution for cyberspace. I think that there are several
ways that you can go. One, Senator Hatch and Senator Leahy
participated a decade ago in bringing the private sector and
the privacy community and industry and policymakers together to
define the Electronic Communications Privacy Act. That was a
dialogue reaching consensus. No privacy legislation has ever
been done without consensus between the private sector and the
privacy community. It just never happened. So, that consensus
is important. Senator Kohl's idea of a commission 25 years
after the last commission, with the whole Internet, is a good
idea for trying to sort out some of these problems.
So I think we are at the beginning. We are anxious to work
with all of you to try and define these issues. We think that
this is a critical part of the new society that we are moving
into, and I appreciate the opportunity to testify here today.
Thank you.
The Chairman. Thank you, Mr. Berman.
[The prepared statement of Mr. Berman follows:]
Prepared Statement of Jerry Berman
i. overview
The Center for Democracy and Technology (CDT) is pleased to have
this opportunity to testify on the issue of individual privacy in the
online environment. CDT is a non-profit, public interest organization
dedicated to developing and implementing public policies to protect and
advance civil liberties and democratic values on the Internet. One of
our core goals is to enhance privacy protections for individuals in the
development and use of new communications technologies.
CDT focuses much of its work on the Internet because we believe
that it more than any other media has characteristics--architectural,
economic, and social--that are uniquely supportive of First Amendment
values. Because of its decentralized, open, and interactive nature, the
Internet is the first electronic medium to allow every user to
``publish'' and engage in commerce. Users can reach and create
communities of interest despite geographic, social, and political
barriers. As the World Wide Web grows to fully support voice, data, and
video, it will become in many respects a virtual ``face-to-face''
social and political milieu.
But while the First Amendment potential of the Internet is clear,
and recognized by the Court, the impact of the Internet on individual
privacy is less certain. Will the online environment erode individual
privacy-building in national identifiers, tracking devices, and limits
on autonomy? Or will it breathe new life into privacy--providing
protections for individuals' long held expectations of privacy?
As we move swiftly toward a world of electronic democracy,
electronic commerce and indeed electronic living, the need to construct
a framework of privacy protection that fits with the unique
opportunities and risks posed by the Internet is critical. But as
Congress has discovered in its attempts to regulate speech, this medium
deserves its own analysis. Laws developed to protect interests in other
media should not be blindly imported. To create rules that map onto the
Internet we must fully understand the characteristics of the Internet
and their implications for privacy protection. We must also have a
shared understanding of what we mean by privacy. Finally we must assess
how to best use the various tools we have for implementing policy--law,
computer code, industry practices, and public education--to achieve the
protections we seek.
ii. what makes the internet different?
As Congress considers crafting rules to protect privacy on the
Internet, it must first understand the specific challenges to privacy
posed by the Internets' functions and use.
A. Increased data creation and collection
The Internet accelerates the trend toward increased information
collection that is already evident in our offline world. The data
trail, known as transactional data, left behind as individuals use the
Internet is a rich source of information about their habits of
association, speech, and commerce. When aggregated, these digital
fingerprints reveal a great deal about an individual's life. This
increasingly detailed information is bought and sold as a commodity by
a growing assortment of players and often sought by government.
B. The globalization of information and communications
On the Internet, information and communications flow unimpeded
across national borders. The Internet places the corner store, and a
store three continents away, equally at the individual's fingertips.
Just as the flow of personal information across national borders poses
a risk to individual privacy, citizens' ability to transact with
entities in other countries places individual privacy at risk in
countries that lack privacy protections. Whether protecting citizens
from fraud, limiting the availability of inappropriate content, or
protecting privacy, governments are finding their traditional ability
to make and effectively enforce policies challenged by the global
communications medium.
C. Lack of centralized control mechanisms
The Internet's distributed architecture presents challenges for the
implementation of policies. The Internet was designed without
gatekeepers--there is no single entity that controls the flow of
information. And as individuals and governments continually discover,
the Internet offers users an unequalled ability to route around
unwanted attempts to control activities and communications.
iii. what do we mean by privacy, and how is it being eroded?
There are several core ``privacy expectations'' that individuals
have long held vis-a-vis both the government and the private sector,
the protection of which should carry over to interactions on the
Internet.
A. The expectation of autonomy
Imagine walking through a mall where every store, unbeknownst to
you, placed a sign on your back. The signs tell every other store you
visit exactly where you have been, what you looked at, and what you
purchased. Something very close to this is possible on the Internet.
When individuals surf the World Wide Web, they have a general
expectation of anonymity, more so than in the physical world where an
individual may be observed by others. Individuals believe that if they
have not affirmatively disclosed information about themselves, then no
one knows who they are or what they are doing. But, counter to this
belief, the Internet generates an elaborate trail of data detailing
every stop a person makes on the Web. The individual's employer may
capture this data trail if she logged on at work, and it is captured by
the Web sites the individual visits. Transactional data, click stream
data, or ``mouse-droppings'' can provide a ``profile'' of an
individual's online life.
Two recent examples highlight the manner in which individuals'
expectation of autonomy is challenged. (1) The introduction of the
Pentium III processor equipped with a unique identifier (Processor
Serial Number) threatens to greatly expand the ability of Web sites to
surreptitiously track and monitor online behavior. The PSN could become
something akin to the Social Security Number of the online world--a
number tied inextricably to the individual and used to validate one's
identity throughout a range of interactions with the government and the
private sector. (2) The Child Online Protection Act (COPA), passed in
October, requires Web sites to prohibit minors' access to material
considered ``harmful to minors.'' Today when an individual walks into a
convenience store to purchase an adult magazine they may flash their
id. Under the COPA an individual will instead be asked to not only
flash their id, but also to leave a record of it and their purchase
with the online store. Reliance on such systems will create records of
individuals' First Amendment activities, thereby conditioning adult
access to constitutionally protected speech on a disclosure of
identity. The defenses pose a Faustian choice to individuals seeking
access to information--protect privacy and lose access or exercise
First Amendment freedoms and forego privacy.
B. The expectation of fairness and control over personal information
When individuals provide information to a doctor, a merchant, or a
bank, they expect that those professionals/companies will collect only
information necessary to perform the service and use it only for that
purpose. The doctor will use it to tend to their health, the merchant
will use it to process the bill and ship the product, and the bank will
use it to manage their account--end of story. Unfortunately, current
practices, both offline and online, foil this expectation of privacy.
Whether it is medical information, or a record of a book purchased at
the bookstore, or information left behind during a Web site visit
information is routinely collected without the individual's knowledge
and used for a variety of other purposes without the individual's
knowledge--let alone consent.
The Federal Trade Commission report from last June, ``Privacy
Online: A Report to Congress,'' found that despite increased pressure
businesses operating online continue to collect personal information on
the World Wide Web without providing even a minimum of consumer
protection. The report looked only at whether Web sites provided users
with notice about how their data was to be used; there was no
discussion of whether the stated privacy policies provided adequate
protection. The survey found that while 92 percent of the sites
surveyed were collecting personally identifiable information only 14
percent had some kind of disclosure of what they were doing with
personal data.
In a CDT study of federal agency Web sites, last week, we found
that just over one-third of federal agencies had a ``privacy notice''
link from the agency's home page. Eight other sites had privacy
policies that could be found after following a link or two and on 22 of
the sites surveyed we could not find a privacy policy at all.
C. The expectation of confidentiality
When individuals send e-mail they expect that only the intended
recipient will read it. In passing the Electronic Communications
Privacy Act in 1986, Congress reaffirmed this expectation.
Unfortunately, it is once again in danger.
While United States law provides e-mail the same legal protection
as a first class letter, the technology leaves unencrypted e-mail as
vulnerable as a postcard. Compared to a letter, an e-mail message is
handled by many independent entities and travels in a relatively
unpredictable and unregulated environment. To further complicate
matters, the e-mail message may be routed, depending upon traffic
patterns, overseas and back, even if it is a purely domestic
communication. While the message may effortlessly flow from nation to
nation, the privacy protections are likely to stop at the border.
E-mail is just one example. Today our diaries, medical records, and
confidential documents are more likely to be out in the network than
stored in our homes. As our wallets become ``e-wallets'' housed
somewhere out on the Internet rather than in our back-pockets, the
confidentiality of our personal information is at risk.
The advent of online datebooks, and products such as Novell's
``Digital Me'', which invite individuals to take advantage of the
convenience of the Internet to manage their lives, raise increasingly
complex privacy questions. While the real ``me'' has Fourth and Fifth
Amendment protections from the government, the ``Digital Me'' is
increasingly naked in cyberspace.
iv. where do we go from here?
It is clear that our policy framework did not envision the Internet
as we know it today, nor did it foresee the pervasive role information
technology would play in our daily lives. Our legal framework for
protecting individual privacy in electronic communications, while built
upon constitutional principles buttressed by statutory protections,
reflects the technical and social ``givens'' of specific moments in
history. Crafting privacy protections in the electronic realm has
always been a complex endeavor. Reestablishing protections for
individuals' privacy in this new environment requires us to focus on
both the technical aspects of the Internet and on the practices and
policies of those who operate in the online environment.
A. The importance of architecture
Understanding the context is central to all effective efforts to
protect privacy. While the global, distributed network environment of
the Internet raises challenges to our traditional methods of
implementing policies, the specifications, standards, and technical
protocols that support the operation of the Internet offer a new way to
implement policy decisions. By building privacy into the architecture
of the Internet, we have the opportunity to advance public policies in
a manner that scales with the global and decentralized character of the
network. As Larry Lessig repeatedly reminds us, ``(computer) code is
law.''
Accordingly, we must promote specifications, standards and products
that protect privacy. A privacy-enhancing architecture must
incorporate, in its design and function, individuals' expectations of
privacy. For example a privacy-protective architecture would provide
individuals the ability to ``walk'' through the digital world, browse,
and even purchase without disclosing information about their identity,
thereby preserving their autonomy and ensuring the expectations of
privacy. A privacy-protective architecture would enable individuals to
control when, how, and to whom personal information is revealed. It
would also provide individuals with the ability to exercise control
over how information once disclosed is, if at all, subsequently used.
Finally, a privacy-protective Internet architecture would provide
individuals with assurance that communications and data will be
technically protected from prying eyes.
While there is much work to be done in the designing of a privacy-
enhancing architecture, some substantial steps toward privacy
protection have occurred. Positive steps to leverage the power of
technology to protect privacy can be witnessed in efforts like the
Anonymizer, Crowds, and Onion Routing that shield individuals' identity
during online interactions, and encryption tools such as Pretty Good
Privacy that allow individuals to protect their private communications
during transit. The World Wide Web Consortium's Platform for Privacy
Preferences (``P3P'') is also a promising development. The P3P
specification will allow individuals to query Web sites for their
policies on handling personal information and to allow Web sites to
easily respond. While P3P does not drive the specific practices, it is
a standard designed to drive openness about information practices to
encourage Web sites to post privacy policies and to provide individuals
with a simple automated method to make informed decisions. Through
settings on their Web browsers, or through other software programs,
users will be able to exercise greater control over the use of their
personal information.
Technologies must be a central part of our privacy protection
framework, for they can provide protection across the global and
decentralized Internet where law or self-regulation alone may prove
insufficient.
B. Protecting the privacy of communications and information
Increasingly, our most important records are not ``papers'' in our
``houses'' but ``bytes'' stored electronically at distant ``virtual''
locations for indefinite periods of time and held by third parties. The
Internet, and digital technology generally, accelerate the collection
of information about individuals' actions and communications. Our
communications, rather than disappearing, are captured and stored on
servers controlled by third parties. Daily interactions such as our
choice of articles at a news Web site, our search and purchase of an
airline ticket, and our use of an online date book to manage our
schedule such as Yahoo's calendar leave detailed information in the
hands of third-parties. With the rise of networking and the reduction
of physical boundaries for privacy, we must ensure that privacy
protections apply regardless of where information is stored.
Under our existing law, there are now essentially four legal
regimes for access to electronic data: (1) the traditional Fourth
Amendment standard for records stored on an individual's hard drive or
floppy disks; (2) the Title III-Electronic Communications Privacy Act
standard for records in transmission; (3) the standard for business
records held by third parties, available on a mere subpoena to the
third party with no notice to the individual subject of the record; and
(4) a statutory standard allowing subpoena access and delayed notice
for records stored on a remote server such as the diary of a student
stored on a university server, or personal correspondence.
As the third and fourth categories of records expand because the
wealth of transactional data collected in the private sector grows and
people find it more convenient to store records remotely, the legal
ambiguity and lack of strong protection grows more significant and
poses grave threats to privacy in the digital environment.
While Congress took the first small step towards recognizing the
changing nature of transactional data with amendments to the Electronic
Communications Privacy Act enacted as part of the Communications
Assistance for Law Enforcement Act of 1994 (``CALEA''), the increase in
transactional data and the increasing detail it reveals about
individuals' lives suggests that these changes are insufficient to
protect privacy.
Moreover, the Electronic Communications Privacy Act must be updated
to provide a consistent level of protection to communications and
information regardless of where they are stored and how long they have
been kept. Technologies that invite us to live online will quickly
create a pool of personal data with the capacity to reveal an
individual's travels, thoughts, purchases, associations, and
communications. We must raise the legal protections afforded to this
growing detailed data regardless of where it resides on the network.
C. Establish rules that give individuals control over personal
information during commercial interactions
We must adopt enforceable standards, both self-regulatory and
regulatory, to ensure that information provided for one purpose is not
used or redisclosed for other purposes without the individual's
consent. All such efforts should focus on the Code of Fair Information
Practices developed by the Department of Health, Education and Welfare
in 1973. The challenge of implementing privacy practices on the
Internet is ensuring that they build upon the medium's real-time and
interactive nature to foster privacy and that they do not
unintentionally impede other beneficial aspects of the medium.
Historically, for privacy legislation to be successful, it must
garner the support of at least a section of the industry. To do so, it
must build upon the work of some industry members--typically binding
bad actors to the rules being followed by industry leaders--or be
critically tied to the viability of a business service or product as
with the Video Privacy Protection Act and the Electronic Communications
Privacy Act.
Today, the dialogue over assuring privacy on the Internet and in
electronic commerce is well situated for a successful legislative
effort. Consensus exists around at least four general principles:
notice of data practices; individual control over the secondary use of
data; access to personal information; and, security for data. However,
the specifics of their implementation and the remedies for their
violation are just beginning to be explored by all interested parties.
When is information identifiable? How is it accessed? How do we create
meaningful and proportionate remedies that address the disclosure of
sensitive medical information as well as the disclosure of inaccurate
marketing data? These hard issues must be more fully resolved before
the policy process will successfully move forward. The leadership of
Internet-savvy members of this Committee and others will be critical if
we are to provide workable privacy protections for the Internet.
D. A privacy protection entity to provide expertise and institutional
memory, a forum for privacy research, and a source of policy
recommendations on privacy issues
The work outlined above, and the state of privacy today, all weighs
in favor of creating a privacy entity within the federal government.
The existing approach has hindered the development of sound policy and
failed to keep pace with changes in technology. While we are pleased
with the Administration's recent appointment of Peter Swire to the
Office of Information and Regulatory Affairs as the federal ``privacy
czar,'' we believe that OIRA is incapable, due to institutional
constraints and a lack of autonomy, of addressing several key privacy
issues. The United States needs an independent voice empowered with the
scope, expertise, and authority to guide public policy. Such an entity
has important roles to play on both domestic and international fronts.
It would serve as the forum for collaboration with other governments,
the public interest community, and the business community.
v. conclusion
No doubt, privacy on the Internet is in a fragile state. However,
there is new hope for its resuscitation. There is a special need now
for dialogue. Providing a web of privacy protection to data and
communications as they flow along networks requires a unique
combination of tools--legal, policy, technical, and self-regulatory.
Cooperation among the business community and the nonprofit community is
crucial. Whether it is setting limits on government access to personal
information, ensuring that a new technology protects privacy, or
developing legislation--none will happen without a forum for
discussion, debate, and deliberation. We thank the Committee for
providing this initial forum and look forward to working with the
members and staff and other interested parties to foster privacy
protections for the Digital Age.
The Chairman. Mr. Bodoff.
STATEMENT OF RUSSELL T. BODOFF
Mr. Bodoff. Thank you. Mr. Chairman and members of the
committee, I am pleased to present to you our BBBOnLine Privacy
Seal program and to share the experience of our first month of
operation, after our official launch of the program which took
place on March 17.
BBBOnLine is a subsidiary of the Council of Better Business
Bureaus, with the start-up of our BBBOnLine privacy initiative
supported by 24 leading-edge sponsoring companies. The program
benefits from the Better Business Bureau's 100-percent name
recognition, as well as the BBB's 86 years' experience in
voluntary self-regulation and consumer dispute resolution.
Our privacy program awards an easily recognizable seal to
businesses that post online privacy policies meeting rigorous
principles, including notice to consumers, disclosure, choice
and consent, access, and security. It offers a separate and
distinct seal for sites directed at children. It provides a
thorough and consumer-friendly dispute resolution system. It
monitors compliance through a comprehensive assessment of a
company's online privacy practices, and it takes specific
actions for non-compliance, such as seal withdrawal, publicity
and referral to government enforcement agencies.
To qualify for a privacy seal, companies must submit an
application and successfully complete a comprehensive
assessment process that investigates over 170 different aspects
of an applicant's information practices. The founding principle
of our privacy program is that it requires privacy seal
participants to say what they do, to do what they say, and have
it verified.
This begins with an easy to find and easy to understand
privacy notice. Privacy notices must be one click away from a
Web site's home page and from every other page where personally
identifiable information is collected. Depending on the
information practices of the participant, this privacy notice
may contain as many as 16 required disclosures, but it will
always describe who is collecting the information, what type of
information is being collected, and how that information is
used and shared. It will always disclose how an individual can
access and correct their information, how to contact the
company, and how to contact BBBOnLine.
While evaluating the privacy notice is critically
important, the BBBOnLine assessment does not stop there, but
looks further into the actual information practices of a
company. Participants must have in place reasonable security
measures to prevent unauthorized access to both stored and
transmitted data. This includes doors and locks, adequate
training for employees, adequate logs and recordkeeping, and a
mandatory use of encryption when there is a receipt or
transmission of sensitive information, such as credit card
numbers, health care data or Social Security numbers.
Seal participants must provide a means by which individuals
can gain reasonable access to all the maintained and
retrievable personally identifiable information they submit
online. Seal participants that operate Web sites or online
services that are directed to children under the age of 13 must
also complete an additional children's assessment process.
BBBOnLine's privacy program's free, convenient and speedy
dispute resolution service offers the assistance of trained
professionals to ensure that consumers have a simple and
effective way to have their concerns addressed. Consumers can
contact the BBBOnLine dispute resolution intake center via e-
mail, toll-free telephone call, or by following the
instructions on our Web sites.
As remedies, consumers can seek to have the information
which was submitted online used only in a manner consistent
with the company's published privacy policy and/or the consumer
can seek to have inaccurate information corrected. BBBOnLine
may also require corrective action in the form of a change in
the seal participant's online privacy policies or practices if,
based on evidence in the case, it finds such action to be
required to avoid return to the same complaint.
The program will also monitor compliance through a system
of random audits to ensure that program participants remain in
compliance. We have designed our program to have serious and
effective consequences for non-compliance. In our dispute
resolution process, we will publish decisions so the public
will be able to monitor resolution of complaints about
violations of privacy policies.
The Privacy Seal program has been officially open now for
about 1 month. Since the launch, we have already processed over
240 formal applications. We have awarded 14 seals and have many
other companies ready and close to approval. The response has
been impressive and more applications are coming in everyday.
Companies are reporting to us that the assessment process is so
thorough that it requires them to carefully evaluate and in
some cases change their entire data-collecting and processing
practices.
Now that we are open for business, we are engaging in an
aggressive outreach program to educate businesses on good
privacy practices. For example, we recently entered into an
agreement with the American Electronics Association to educate
their 3,000 members about good privacy principles. Similar
business outreach will be announced shortly with other major
trade associations, as well as our Better Business Bureaus.
Next on our agenda will be developing a major outreach to
consumers and children to help them better understand how to
protect their privacy while they are online.
In closing, let me say how excited we are that the
BBBOnLine privacy program, which was created in less than 9
months, is already being described as the most comprehensive
privacy self-regulation anywhere in the world. Consumers have a
high level of trust in our organization. A study released last
week by AT&T Research Labs indicated that a privacy notice on a
Web site, along with the Better Business Bureau seal, gave a
consumer a higher level of confidence than even privacy
regulation.
I want to thank the committee members for their attention,
and I hope that you share our enthusiasm about the tremendous
progress that has been made.
The Chairman. Thank you, Mr. Bodoff.
[The prepared statement of Mr. Bodoff follows:]
Prepared Statement of Russell T. Bodoff
Mr. Chairman and members of the Committee, my name is Russell
Bodoff, I am Senior Vice President and Chief Operating Officer of
BBBOnLine, an independent subsidiary of the Council of Better Business
Bureaus. I am pleased to present to you the BBBOnLine Privacy Seal
program and to share the experience of our first month of operation
after the official launch of the program on March 17, 1999.
The Council of Better Business Bureaus (CBBB) is the umbrella
organization for the nation's Better Business Bureau system, which
consists of over 130 local BBB's and branches and 270,000 member
businesses across the United States. The CBBB is a nonprofit business
membership organization tax exempt under section 501(c)(6) of the
Internal Revenue Code. More than 325 leading edge companies nationwide
belong to the CBBB and provide support for its mission of promoting
ethical business practices through voluntary self-regulation and
consumer and business education.
Each year, millions of consumers contact the Better Business Bureau
for pre-purchase information or for assistance in resolving marketplace
disputes. In large part, they are drawn to the BBB by its enormous name
recognition. The BBB trademark is one of the country's most widely
recognized by both business and consumers (100 percent business and 98
percent consumer brand recognition according to a 1996 Gallup Poll).
The public looks to the Better Business Bureau for impartial and
reliable information on a broad range of companies, products and
services. We. provide reliability reports on individual businesses
(members and non-members), issue reports on publicly soliciting
charitable organizations and provide consumer advisories on a host of
offers, promotions and scams. We offer consumers and businesses a means
to resolve disputes through conciliation, mediation and, when
necessary, arbitration. In fact, the BBB operates one of the, if not
the, largest out-of-court consumer/business dispute settlement program
in North America.
Through its partnership with the major advertising trade
associations, the American Association of Advertising Agencies (AAAA),
the Association of National Advertisers (ANA), and the American
Advertising Federation (AAF), the CBBB also operates a highly
successful and much praised advertising self-regulation program that
helps assure truthful advertising and appropriate advertising directed
to children.
Our name recognition, the extremely high level of trust we have
earned from the public, and our experience in operating self-regulation
and dispute settlement programs, including our previous experience with
offering another seal program in the BBBOnLine Reliability Program, are
some of the reasons the business community and the Administration asked
BBBOnLine once again to provide a framework for self-regulation in the
major issue of concern in online commerce--personal privacy protection.
BBBOnLine is a 501(c)(6) tax exempt organization, supported by
leading online marketing and technology companies in the United States.
A wholly owned subsidiary of the CBBB, BBBOnLine was established by the
CBBB and its member sponsors as a means to promote the highest ethical
business practices online through self-regulation and consumer
education and self-help measures, and thereby help to foster consumer
trust and confidence in this new market. The online marketplace has
vast potential for consumers and business alike. However, it presents
risks to consumers who can not easily determine the reliability of any
given company by simply looking at its website, and it makes it
difficult for an ethical business to distinguish itself from a fly-by-
night operator.
To help online companies distinguish themselves, BBBOnLine provides
two separate seal programs for online businesses--the Reliability Seal
Program and the Privacy Seal Program--and provides consumer information
through our website, www.bbbonline.org.
The BBBOnLine Reliability Program was launched in April of 1997
with the support of 11 major corporate sponsors. The objective was to
provide a resource for consumers seeking trustworthy businesses on the
Internet; to help legitimate businesses distinguish themselves from
fly-by-night operators; and to demonstrate that self-regulation of the
online marketplace can succeed. To participate in the Reliability
Program a company must be a BBB member, cooperate with CBBB's National
Advertising Division (NAD), Children's Advertising Review Unit (CARU)
and National Advertising Review Board (NARB) and commit to third-party
dispute resolution. Over 2,900 companies from various sectors and of
various sizes have been approved to date for the Reliability Seal and
we are currently approving 200 new participants each month. Some of the
largest marketing sites on the Internet participate in the program.
Posting the Reliability Seal on a website provides consumers with an
easy means to check a company's history, obtain contact information,
and be assured that the company stands behind its advertising claims. A
BBB representative visits, in person, the physical office of each and
every Reliability Seal applicant, to ensure that they are who and
where, they say they are.
Launched in March 1999, the BBBOnLine Privacy Program is the only
privacy seal program that is rooted in 86 years of experience in
voluntary self-regulation and consumer dispute resolution. The
BBBOnLine Privacy Program awards seals to online businesses verified as
meeting our high standards including: the posting of online privacy
policies meeting rigorous privacy principles, completion of a
comprehensive evaluation, monitoring and review by a trusted
organization, and participation in a consumer dispute resolution
system. For further detail, please visit www.bbbonline.org/businesses/
privacy/eligibility.html.
After the successful creation and implementation of the BBBOnLine
Reliability Program, it was a natural progression for BBBOnLine to
address the significant issues pertaining to privacy in electronic
commerce. BBBOnLine agreed to design a new BBBOnLine privacy self-
regulation program in June of 1998. There was tremendous industry
support for this effort. Twenty-four major companies provided start up
funds of $2.3 million to develop the program design. Currently
seventeen companies serve as full corporate sponsors: Ameritech, AT&T,
Bank of America, Dun & Bradstreet, Eastman Kodak, GTE, Hewlett-Packard,
Microsoft, Netscape, Procter & Gamble, Reed Elsevier (LEXIS-NEXIS),
Road Runner Group, Sony Electronics, US WEST, Visa and Xerox. Plus,
twenty-four companies support and participate in our privacy steering
committee: America Online, American Express, AMR Corporation (American
Airlines and Travelocity), AT&T, Bank of America, Dell, Dun &
Bradstreet, Eastman Kodak, Equifax, Experian, Ford, Hewlett-Packard,
IBM, Intel, J.C. Penney, MCI WorldCom, Microsoft, New York Times
Electronic Media, Nickelodeon, Procter & Gamble, Reed Elsevier (LEXIS-
NEXIS), Sony Electronics, US WEST, and Xerox. In addition to the
financial support provided by our founding sponsors, a steering
committee of supporting companies was formed to assist BBBOnLine in
developing a self-regulatory program that was substantive, realistic,
and workable. Contributing to this effort were privacy experts such as
Professor Alan Westin of Columbia University and Dr. Mary Culnan of
Georgetown University. We also created a separate dispute resolution
committee to help design a dispute resolution component to the program
to deal with the specialized area of privacy disputes.
The Privacy Program is designed to be a user-friendly tool that
helps foster trust and confidence on the Net. It is also designed to be
a valuable resource for business as a simple, one-stop, non-intrusive
way to demonstrate compliance with credible online privacy principles.
The core of the BBBOnLine Privacy Program:
Awards an easily recognizable and affordable ``seal'' to
businesses that post online privacy policies meeting rigorous
principles, including notice to consumer, disclosure, choice
and consent, access, and security;
Offers a separate and distinct seal for sites directed at
children;
Provides a thorough and consumer-friendly dispute resolution
system;
Monitors compliance through requirements that participating
companies undertake, at a minimum annually, assessments of
their online privacy practices; and,
Takes specific actions for non-compliance, such as seal
withdrawal, publicity and referral to government enforcement
agencies.
Applicants eligible to participate in the BBBOnLine Privacy program
must post a clear and easy to find privacy notice and operate a website
or online service that is directed to U.S. residents. To reach broadly,
BBB membership is not required to participate in the privacy program,
although applicants can not have an unsatisfactory BBB record.
To ultimately qualify for a privacy seal, applicants must submit an
application and successfully complete a comprehensive assessment
process that investigates over 170 different aspects of an applicant's
information practices, including privacy notice content and placement,
corporate structure, security measures, transfer and merger of
information, access, correction; and (if the website or online service
falls within our children's guidelines) a comprehensive set of
additional children's requirements. For more information, please visit
www.bbbonline.org/businesses/privacy/assess-html.html or see Appendix
A.
The assessment process itself was field tested with a diverse group
of companies to make sure that its objective of performing an in-depth
evaluation of information practices was user friendly for business and
workable in performing an effective analysis of the way a seal
applicant collects and uses personal information. The assessment
process offers companies an excellent benchmark for evaluation and
implementation of sound privacy policies and practices.
After successfully completing the assessment process, applicants
must then have a company officer sign a participation agreement that
obligates them to submit to random and independent third party
verification, to utilize the BBBOnLine Dispute Resolution process, and
to notify BBBOnLine whenever there is a material change in either (1)
their privacy notice, (2) their information practices, and/or (3) the
scope of the privacy seal.
The essence of the BBBOnLine Privacy Program is that it requires
privacy seal participants to ``Say What You Do, Do What You Say, and
Have It Verified.'' SM This begins with a clear and easy to
find privacy notice. Privacy notices must be ``one click away'', from a
website's homepage and every other page where personally identifiable
information is collected. Depending on the information practices of the
participant, this privacy notice may contain as many as 16 required
disclosures, but it will always describe who is collecting information,
what types of information is being collected, and how that information
is used and shared. It will always disclose how an individual can
access and correct their information, how to contact the participant,
and how to contact BBBOnLine. Mandatory opt-outs are required whenever
information will be transferred to third parties for marketing, and
whenever information is used in a way not described in the privacy
notice.
While evaluating the privacy notice is critically important, the
BBBOnLine assessment does not stop there, but looks further into the
actual information practices of an applicant.
Seal participants must have in place reasonable security measures
to prevent unauthorized access to both stored and transmitted data.
This includes doors and locks, adequate training for employees,
adequate logs and record keeping, and a mandatory use of encryption
when there is a receipt or transmission of sensitive information such
as credit card numbers, health care data, and social security numbers.
In addition to disclosing information transfer practices and
providing opt-outs if such transfers are for marketing purposes, seal
participants must also take steps to ensure that transferred
information continues to be used only in the ways disclosed in the
privacy notice and according to the choices made by an individual. Seal
participants must also follow special rules when information is
submitted online by one person about someone else, such as with gift
recipients.
Seal participants must provide a means by which individuals can
gain reasonable access to all the maintained and retrievable personally
identifiable information they submit online, and establish a reasonable
process by which seal participants can verify the identity of those
requesting access.
Seal participants that operate websites or online services, or
portions thereof, that are directed to children under 13, or at which
information is collected from visitors actually known to be children
under 13, must also complete a children's supplemental assessment
questionnaire and assessment process based upon the requirements of the
Children's Online Privacy Protection Act of 1998, and the guidance set
forth by both the Online Privacy Alliance, and the Council of Better
Business Bureaus' Children's Advertising Review Unit.
Such children's websites must acquire prior verifiable parental
consent before a child's information can be collected and before
children are given the ability to post identifying information.
Reasonable efforts must be taken to prevent children from posting
contact information. In certain circumstances and at certain locations,
additional warnings and reminders to children must be placed within the
website or online service. The participation in games or other online
activities may not be conditioned on the disclosure of more information
than is necessary. Special limitations are placed on e-mail and the
creation of hyperlinks to other websites. Finally, seal participants
who e-mail children must also take proactive steps to remind and
encourage parents to check and monitor their children's online
activities.
In the month that the BBBOnLine Privacy program has been in
operation, we have already gained much valuable experience. The
assessment process involves a lengthy dialog between ourselves and our
applicants, and often. we find ourselves learning from each other. For
instance, in the process of evaluating the information practices of
applicants, we find that we are also educating them on the importance
of drafting clear privacy policies that disclose with sufficient
specificity what is being collected and how that information is being
used. We are talking with applicants about the necessity of providing
access to and correction of information, and simultaneously, the
importance of having in place verification methods for providing access
to only those individuals authorized to obtain it. We are educating
applicants on security measures, the many issues that arise in clearly
defining the scope of the privacy seal protections, and the best way to
protect children's privacy. In this way, we believe we are not only
certifying websites that follow the BBBOnLine criteria, but also
greatly raising the bar by giving applicants the time and guidance
needed to make them knowledgeable about the issues surrounding online
privacy.
In addition to the assessment process, BBBOnLine offers consumers
and businesses significant experience in resolving disputes. The BBB
system currently runs what is probably the nation's largest consumer-
business dispute resolution program, primarily for most of the
automobile industry, for whom we are certified as operating state-
compliant lemon law programs in those states allowing for state
certification; BBB dispute settlement efforts also include 60,000 local
business participants; our programs handle more than 30,000 cases a
year, using the services of about 5,000 trained volunteer arbitrators,
not to mention the hundreds of thousands of informal complaint
resolution cases handled by the BBB's every day.
Using BBB's dispute settlement experience, we stand ready to
provide consumers with a specialized forum to air and resolve privacy-
related disputes (Appendix B). We will accept complaints from both U.S.
residents and non-U.S. residents about companies and organizations with
posted privacy notices, whose websites or online services are intended
to be directed at U.S. residents, that misuse information. Complaints
can be about the actions of seal participants and non-seal
participants. Companies or organizations that do not cooperate with us
in a dispute resolution proceeding can, in turn, be subject to public
withdrawal of our seal and/or referral to the appropriate government
agency.
Free, convenient, and speedy dispute resolution by trained
professionals ensures that consumers have a simple and effective way to
have their concerns addressed. Consumers can contact the BBBOnLine
Dispute Resolution Intake Center via e-mail, telephone call or by
simply following our online complaint directions located on our web
site at www.bbbonline.org/consumers/drguide.html. As remedies,
consumers can seek to have the information which was submitted online
used only in a manner consistent with the company's published privacy
policy and/or the consumer can seek to have inaccurate information
corrected. BBBOnLine may also require corrective action in the form of
a change in a seal participant's online privacy policies or practices
if, based on the evidence in the case, it finds such action to be
required to avoid recurrences of the same complaint.
The BBBOnLine dispute resolution process is designed to deliver
consumer satisfaction. The first step will be to encourage a business
and the consumer to resolve a complaint between the two parties. If
this fails, BBBOnLine will step in to help, providing a consumer-
friendly process to resolve the complaint. An appeal process to an
impartial panel is also available providing neutral expertise in the
privacy arena. Indeed, we have been fortunate to recruit Andrew
Strenio, a former Commissioner of the Federal Trade Commission, to be
Chair of our appeals board. Businesses that repeatedly violate their
own policies will have their seal revoked, and as previously mentioned,
they will be publicly identified and the most serious or frequent
offenders will have the violations reported to the proper government
authority. The Better Business Bureau system has a long history of
cooperation with regulatory authorities and the BBBOnLine Privacy
Program will continue this collaboration to promote trust and
confidence on the Internet.
Seal participants are required to provide information within their
privacy policy on how to contact BBBOnLine in order to ensure ease of
access to the complaint resolution system.
Each participant in the BBBOnLine Privacy Program agrees to
cooperate with BBBOnLine in verification of their compliance with
eligibility requirements. BBBOnLine may itself, or through an
independent third party designated by BBBOnLine, conduct random
compliance reviews (online, onsite, or otherwise) of one or more
eligibility requirements on BBBOnLine's own initiative or in response
to complaints from individuals or other third parties. By conducting
surprise audits on program participants, we will be able to keep the
importance of privacy issues at the forefront of online business
practices and create a significant deterrence to noncompliance.
If, as a result of a random review or other third party
information, BBBOnLine finds the organization not to be in compliance
with any of our eligibility requirements, we may decide to pursue a
complete review of all of the eligibility requirements in order to
allow BBBOnLine to retain confidence in the organization's continued
eligibility to participate in the program. In addition, if the
organization is merged, acquired by or consolidated with another
company, it must inform BBBOnLine, which will require review of the
circumstances surrounding the merger, consolidation or acquisition to
determine whether the organization must requalify or provide additional
information for use of the seal.
We have designed our program to have serious and effective
consequences for non-compliance. In our dispute resolution process we
will publish decisions so that the public will be able to monitor
resolution of complaints about violations of privacy policies. Our
complaint resolution process will also keep statistics which will help
us identify patterns of improper information practices and instances of
non-compliance which we can use to monitor and enforce our program
requirements. Of course we will only publish the name of the company
complained about, protecting the consumer complainant's identity from
disclosure. An important feature of our dispute resolution process is
that it will not be binding on the consumer, so consumers will be free
to exercise available judicial remedies in addition to the remedies
offered by BBBOnLine.
The Privacy Seal Program has been officially ``open for business''
for only one month. In this brief period of time we have already
received over 240 applications and have awarded 13 seals. The response
has been impressive and more applications are coming in everyday. The
assessment process is a very thorough process that forces companies to
carefully evaluate, and in some cases change, their entire data
collecting and processing practices, online and off-line. The process
goes well beyond the posting of a privacy policy.
A study led by AT&T Research Labs released last week came to the
conclusion that the combination of a privacy policy and a seal from a
well known organization, like the Better Business Bureau, significantly
raised people's confidence when they were asked to provide personal
information online (www.research.att.com/projects/privacystudy/). In
fact, of the respondents that were unsure or said that they would not
provide personal information to receive free pamphlets and coupons at a
site related to a favorite hobby:
48 percent said they would be more likely to provide it if
there was a law that prevented the site from using the
information for any purpose other than processing the request,
28 percent said they would be more likely to provide it if
the site only had a privacy policy,
and 58 percent said they would be more likely to provide it
if the site had both a privacy policy and a seal of approval
from a well known organization such as the Better Business
Bureau
BBB's 100 percent brand name recognition and its 86 year history in
self-regulation allows us to provide a program that can make a
difference.
Online privacy is often mentioned as one of the biggest concerns
keeping consumers from engaging in e-commerce. The online privacy issue
has become such a hot issue that many businesses are now starting to
respond. As evidenced in our program, it is not only the large
businesses that are exercising self-regulation.
Many of the applications we have received have come from small to
medium sized businesses. The BBBOnLine Privacy Seal Program was
intentionally priced so that all companies could apply (Appendix C).
The only item keeping a company from participating in the program
should be its inability to meet the eligibility requirements; price
should not be a factor. The World Wide Web is made up of hundreds of
thousands of websites, most of which are not large companies. In order
for self-regulation to work it must be accessable to the majority of
web marketers, large and small companies alike. Indeed, now that we are
open for business we are engaging in an aggressive outreach effort to
reach as wide a business audience as possible. For example, we recently
entered into a co-marketing arrangement with the American Electronic
Association to educate their 3,000 plus members about good privacy
principles and the BBBOnLine Privacy Program.
BBBOnLine plans a comprehensive outreach effort for consumer
education. We have approached consumer advocacy groups about joint
efforts and hope to use our website to provide educational materials on
helping consumers protect their privacy online.
Though we just launched the Privacy Seal Program, it is our hope
that as the program grows and as consumer awareness and education
increases we will have been able to make the online marketplace a safer
place to negotiate for all. We want to thank the Committee for your
attention and hope that you share in our enthusiasm for the tremendous
progress already made.
I am available to answer any questions you may have.
[GRAPHIC] [TIFF OMITTED] T8199.018
[GRAPHIC] [TIFF OMITTED] T8199.019
[GRAPHIC] [TIFF OMITTED] T8199.020
[GRAPHIC] [TIFF OMITTED] T8199.021
[GRAPHIC] [TIFF OMITTED] T8199.022
[GRAPHIC] [TIFF OMITTED] T8199.023
[GRAPHIC] [TIFF OMITTED] T8199.024
[GRAPHIC] [TIFF OMITTED] T8199.025
[GRAPHIC] [TIFF OMITTED] T8199.026
[GRAPHIC] [TIFF OMITTED] T8199.027
[GRAPHIC] [TIFF OMITTED] T8199.028
[GRAPHIC] [TIFF OMITTED] T8199.029
[GRAPHIC] [TIFF OMITTED] T8199.030
[GRAPHIC] [TIFF OMITTED] T8199.031
[GRAPHIC] [TIFF OMITTED] T8199.032
[GRAPHIC] [TIFF OMITTED] T8199.033
[GRAPHIC] [TIFF OMITTED] T8199.034
[GRAPHIC] [TIFF OMITTED] T8199.035
[GRAPHIC] [TIFF OMITTED] T8199.036
[GRAPHIC] [TIFF OMITTED] T8199.037
[GRAPHIC] [TIFF OMITTED] T8199.038
[GRAPHIC] [TIFF OMITTED] T8199.039
[GRAPHIC] [TIFF OMITTED] T8199.040
[GRAPHIC] [TIFF OMITTED] T8199.041
[GRAPHIC] [TIFF OMITTED] T8199.042
[GRAPHIC] [TIFF OMITTED] T8199.043
[GRAPHIC] [TIFF OMITTED] T8199.044
[GRAPHIC] [TIFF OMITTED] T8199.045
[GRAPHIC] [TIFF OMITTED] T8199.046
[GRAPHIC] [TIFF OMITTED] T8199.047
[GRAPHIC] [TIFF OMITTED] T8199.048
[GRAPHIC] [TIFF OMITTED] T8199.049
[GRAPHIC] [TIFF OMITTED] T8199.050
[GRAPHIC] [TIFF OMITTED] T8199.051
[GRAPHIC] [TIFF OMITTED] T8199.052
[GRAPHIC] [TIFF OMITTED] T8199.053
[GRAPHIC] [TIFF OMITTED] T8199.054
[GRAPHIC] [TIFF OMITTED] T8199.055
[GRAPHIC] [TIFF OMITTED] T8199.056
[GRAPHIC] [TIFF OMITTED] T8199.057
[GRAPHIC] [TIFF OMITTED] T8199.058
[GRAPHIC] [TIFF OMITTED] T8199.059
[GRAPHIC] [TIFF OMITTED] T8199.060
[GRAPHIC] [TIFF OMITTED] T8199.061
[GRAPHIC] [TIFF OMITTED] T8199.062
[GRAPHIC] [TIFF OMITTED] T8199.063
[GRAPHIC] [TIFF OMITTED] T8199.064
[GRAPHIC] [TIFF OMITTED] T8199.065
[GRAPHIC] [TIFF OMITTED] T8199.066
[GRAPHIC] [TIFF OMITTED] T8199.067
[GRAPHIC] [TIFF OMITTED] T8199.068
[GRAPHIC] [TIFF OMITTED] T8199.069
[GRAPHIC] [TIFF OMITTED] T8199.070
[GRAPHIC] [TIFF OMITTED] T8199.071
[GRAPHIC] [TIFF OMITTED] T8199.072
[GRAPHIC] [TIFF OMITTED] T8199.073
[GRAPHIC] [TIFF OMITTED] T8199.074
[GRAPHIC] [TIFF OMITTED] T8199.075
[GRAPHIC] [TIFF OMITTED] T8199.076
[GRAPHIC] [TIFF OMITTED] T8199.077
[GRAPHIC] [TIFF OMITTED] T8199.078
[GRAPHIC] [TIFF OMITTED] T8199.079
[GRAPHIC] [TIFF OMITTED] T8199.080
[GRAPHIC] [TIFF OMITTED] T8199.081
[GRAPHIC] [TIFF OMITTED] T8199.082
[GRAPHIC] [TIFF OMITTED] T8199.083
[GRAPHIC] [TIFF OMITTED] T8199.084
[GRAPHIC] [TIFF OMITTED] T8199.085
[GRAPHIC] [TIFF OMITTED] T8199.086
[GRAPHIC] [TIFF OMITTED] T8199.087
[GRAPHIC] [TIFF OMITTED] T8199.088
[GRAPHIC] [TIFF OMITTED] T8199.089
[GRAPHIC] [TIFF OMITTED] T8199.090
[GRAPHIC] [TIFF OMITTED] T8199.091
[GRAPHIC] [TIFF OMITTED] T8199.092
[GRAPHIC] [TIFF OMITTED] T8199.093
[GRAPHIC] [TIFF OMITTED] T8199.094
[GRAPHIC] [TIFF OMITTED] T8199.095
[GRAPHIC] [TIFF OMITTED] T8199.096
[GRAPHIC] [TIFF OMITTED] T8199.097
[GRAPHIC] [TIFF OMITTED] T8199.098
[GRAPHIC] [TIFF OMITTED] T8199.099
[GRAPHIC] [TIFF OMITTED] T8199.100
[GRAPHIC] [TIFF OMITTED] T8199.101
[GRAPHIC] [TIFF OMITTED] T8199.102
[GRAPHIC] [TIFF OMITTED] T8199.103
[GRAPHIC] [TIFF OMITTED] T8199.104
[GRAPHIC] [TIFF OMITTED] T8199.105
[GRAPHIC] [TIFF OMITTED] T8199.106
[GRAPHIC] [TIFF OMITTED] T8199.107
[GRAPHIC] [TIFF OMITTED] T8199.108
[GRAPHIC] [TIFF OMITTED] T8199.109
The Chairman. Mr. Fischbach.
STATEMENT OF GREGORY FISCHBACH
Mr. Fischbach. Thank you, Mr. Chairman, Senator Kohl and
Senator Schumer, for the opportunity to testify before the
committee today regarding the protection of personal
information on the Internet. I applaud you for your leadership
in seeking to strike the right admittedly delicate balance
between industry self-regulation and the appropriate role, if
any, of government.
I testify today wearing two hats. I am the Chairman and
Chief Executive Officer of Acclaim Entertainment, a leading
maker of video and PC games. Though headquartered in New York,
Acclaim's flagship develop studio is Iguana Studios in Salt
Lake City, which employs 90 software professionals.
Senator Schumer. Excuse me, sir. Are you bragging about
that? [Laughter.]
The Chairman. Let's not have interruptions from New York.
[Laughter.]
We ought to be grateful here for the link-up, you know.
Mr. Fischbach. Well, it works for both of you.
I am here as Vice Chair of the Interactive Digital Software
Association, the trade body representing the $6.3 billion U.S.
entertainment software industry.
Maintaining communication with our customers is fundamental
to our success as a business. Unlike many other businesses
where the essential interaction with consumers involves a one-
time transaction, entertainment software consumers expect and
even rely on a continuous dialogue with their publishers. For
example, buyers of our games expect us to provide them with
software bug fixes, game tips, virus warnings and software
upgrades.
The Internet has become a major vehicle for talking to our
customers. We use it to provide online product registrations,
direct download of bug fixes and updates, new product
information, and online gaming services. We recognize that
using the Internet to communicate with customers means we must
appropriately safeguard the personal information we collect and
use online.
In October 1998, the IDSA officially adopted voluntary
principles and guidelines for fair information practices
online. The guidelines generally conform to privacy principles
proposed by the Department of Commerce and the OECD. While
consistent with guidelines issued by other industry groups, the
IDSA guidelines go further in three areas--access, information
and children.
On access, the IDSA guidelines direct that companies give
consumers the opportunity for reasonable, appropriate access to
personal identity information and the opportunity to correct or
amend that information. In the area of enforcement, the
guidelines direct the IDSA to make publicly accessible a status
report on IDSA member implementation of privacy practices, and
they require that members utilize certification seals provided
by third-party entities.
Finally, in the children's area the IDSA guidelines require
that companies provide parents of children ages 13 to 17 with
notice of online information collection and the opportunity to
remove the information from the site's database. To date, 16
IDSA members, who together accounted for almost 60 percent of
all games sold in the U.S. in 1998, have posted online privacy
policies as required by our guidelines or are in the process of
doing so.
For our company, compliance has required fundamental
changes in the way that we do business and relate to our
customers. This is an important point. Business does have a
responsibility to protect privacy, but government must
understand that these changes often touch on the most basic and
important business asset we have, our consumer relationships.
Let me tell you that overhauling our business model in this
area is not as easy as it might seem when rules are first put
on paper. In fact, we at Acclaim have opted to significantly
limit how much information we collect on our Web site.
Acclaim.net only collects and stores e-mail addressed, and only
does so in three circumstances.
When a Web site visitor is subscribing to our newsletter,
downloading software, or ordering something from our online
store, we make it clear that we may use these e-mail addresses
for a variety of internal marketing purposes, but do not sell
or distribute them to any outside person or organization. We
also offer our customers the ability to have Acclaim delete
their e-mail addresses.
Finally, we expressly forbid children 12 and under from
submitting information to us, and we will implement whatever
consent and notice procedures the FTC identifies as appropriate
regulations that are promulgated under this law. Our policy is
posted and we hope to have a certification seal from the ESRB
as soon as it is open for business, which we would anticipate
by the end of this May.
Mr. Chairman, I believe our industry and my company have
made important strides toward protecting privacy. But my
experience in these last few months tells me that one size does
not fit all. A legislative or regulatory approach probably
creates great confusion. I understand the appeal of a Federal
mandate, but as someone working in the trenches I suggest to
you that industry self-regulation, while perhaps imperfect, is
ultimately the best and swiftest way to protect consumer
privacy on the Internet, while allowing Internet creativity and
experimentation to flourish.
Thank you for this opportunity and I would be glad to
answer any questions.
The Chairman. Thank you, Mr. Fischbach.
[The prepared statement of Mr. Fischbach follows:]
Prepared Statement of Gregory Fischbach
Thank you, Mr. Chairman, for the opportunity to testify before the
Committee today regarding the protection of personal information on the
Internet. I applaud you for your leadership in seeking to strike the
right, admittedly delicate balance, between industry self-regulation
and the appropriate role, if any, for government.
I testify today wearing two hats. I am the Chairman and Co-Chief
Executive Officer of Acclaim Entertainment. I am also here as the Vice-
Chair of the Board of Directors of the Interactive Digital Software
Association.
Acclaim Entertainment, Inc. is a leading worldwide developer,
publisher and mass marketer of software for use with interactive
entertainment platforms including Nintendo, Sony and Sega hardware
systems, and PCs. Acclaim owns and operates five studios located in the
United States and the United Kingdom, and publishes and distributes its
software directly in North America, the United Kingdom, Germany, France
and Australia. Acclaim posted 1998 revenues of over $325 million. Our
headquarters are located in Glen Cove, New York and Acclaim's common
stock is publicly traded on NASDAQ under the symbol AKLM.
You may know some of our key internally developed brands, Acclaim
Sports, Turok, and WWF Warzone. WWF Warzone, developed by our flagship
studio, Iguana Salt Lake City, was Acclaim's best selling product in
1998. Our Salt Lake City Studio employs over 90 software professionals
and generates several products annually.
All of our company brands are supported by significant marketing
campaigns including on-line promotion. Over the last year we have
allocated significant resources to Acclaim On-Line, in an effort to
better service our consumers. Consumers visit our site, Acclaim.Net for
product information, release dates, free demo software, Ecommerce, tips
and hints and company information. Last year traffic on Acclaim.Net
grew by 325 percent. In calendar 1999, we expect to generate over 50
million page impressions. In the future we plan to continue to serve
our consumers on-line by offering new features including on-line game
play through Acclaim.Net.
The IDSA represents the U.S. publishers of entertainment software
games for video game consoles, PCs, and the Internet. IDSA members
collectively account for more than 85 percent of the $6.3 billion in
entertainment software sold and rented in the U.S. in 1998, and
billions more in export sales of U.S.-made entertainment software. The
entertainment software industry is now the fastest growing of all U.S.
entertainment industries, selling nearly 200 million units of PC and
video games in the U.S. alone, or almost two per household.
I want to spend my time sharing with you some of the lessons that
Acclaim and the IDSA have learned as a result of the steps that we have
taken to protect the personal information of entertainment software
consumers online.
Let me start with a little context: maintaining communication with
our customers is at the core of what we do. It is fundamental to our
success as a business. Unlike many other businesses where the
transaction with consumers is a one-time event, our consumers expect
and even rely on this continuous dialogue.
Consumers expect us to provide them with software patches, game
tips, and software upgrades and enhancements. They want information
from us on sequels, they want technical support, they want to tell us
what they think of our products, they want to volunteer to test
products, and more. Consumers of online games, a growing part of the
entertainment software industry, also increasingly expect us to provide
online game services so they can participate in tournaments, find
playing partners, or play massive multi-player games. Without personal
information from those consumers, such as email address, name, and
snail mail address, we cannot meet these needs; moreover, in an
industry which is besieged by piracy, we need registration information
to ensure that the consumer owns a legitimate, rather than pirated,
copy and we need personal information from online game players to
prevent players from abusing the game service or harassing other
players.
The Internet has become the major vehicle through which we meet
many of these consumer demands. The Internet allows us to provide
online product registrations, direct downloads of bug fixes and
updates, new product information, and online game services.
We recognize that our use of the Internet to communicate with our
customers imposes a burden on us to put in place appropriate safeguards
to ensure that the personal information we do collect is protected.
This leads me to the actions that both Acclaim and the IDSA have taken
to protect the personal information of consumers online.
In March 1998 the IDSA convened a Privacy Working Group to create
appropriate standards for protecting the privacy of consumers on the
Internet. This Privacy Working Group consisted of General Counsels,
Marketing Directors, and Webmasters from nine IDSA member companies,
bringing legal, business, and technical expertise to the issue. Over
the ensuing eight months, this Working Group and the IDSA Board
hammered out Principles and Guidelines for Fair Information Practices.
The Board officially adopted these Guidelines at its October 1998
meeting, and IDSA members are expected to be in compliance by May 31,
1999. Copies have been provided to the Committee.
Developing these guidelines was not simple. It's easy to lose sight
of the fact that we are talking about redefining how we relate to our
consumers. From a business standpoint, this is not something we take
lightly, especially not after spending years to build a sense of
loyalty and trust with those who play our games. While some believe
developing guidelines is a simple matter, we know from experience that
even using the very valuable templates developed by such groups as the
Online Privacy Alliance, the Organization for Economic Cooperation and
Development (OECD), and the Department of Commerce, an enormous amount
of thought must still be applied to ensure that the guidelines we've
adopted for this industry take into account its unique qualities.
We believe that the Guidelines we eventually developed represent an
appropriate balance between protecting the online privacy of our
customers while also preserving the interactive relationship that our
customers expect. As their longer title indicates, the guidelines have
two elements. First, they establish a core principle to which companies
adopting the guidelines must adhere. Second, they provide guidance on
ways to comply with each core principle, recognizing that companies
may, depending on size, practices, and resources, choose different
paths to complying with the principles.
As these elements are widely recognized to be essential, the IDSA
Guidelines contain principles on Notice, Choice, Data Collection
Limitation, Security, Access, Enforcement, and special rules for
children. With regard to Notice, Choice, Data Collection Limitation,
and Security, the IDSA Guidelines are in conformance with those
suggested by the OECD and the Department of Commerce, and consistent
with those adopted by other industries and companies. However, the IDSA
Guidelines go farther than other industries with regard to Access,
Enforcement, and Children.
With respect to Notice, Choice, and Data Collection Limitation, and
Security, the IDSA guidelines (1) direct each IDSA member to implement
and publish online a ``privacy policy'' that informs consumers about
its online collection and use of personal information, (2) direct that
each IDSA member give consumers the choice to exercise reasonable
control over the collection and use of their personal data, generally
establishing ``opt-out'' choice as the minimum acceptable tool; (3)
direct IDSA members to only collect and retain personal data of
consumers that is needed for valid business reasons, and give guidance
as to the breadth of personal data that should be collected and when
personal data should no longer be retained; and (4) direct that IDSA
members take reasonable measures to assure the reliability of personal
data they collect and take reasonable precautions to protect that data
from loss, misuse, or alteration, and recommend that IDSA members take
reasonable steps to assure that third parties to whom they transfer the
personal data of consumers will provide sufficient protection to that
personal data.
As an industry which is both highly sensitive to our customer
relationships, and which has a significant following among children, we
spent considerable time crafting guidelines in the Access, Enforcement,
and Children's areas. The result is that our guidelines in these areas,
in some instances, go beyond recently enacted law and other voluntary
approaches.
For example, the IDSA guidelines with regard to access do not
restrict consumer access to instances of ensuring data quality.
Instead, they direct that IDSA members give consumers the opportunity
for reasonable, appropriate access to personal identifying information
about them that an IDSA member holds, and the opportunity to correct or
amend that information when necessary.
In the enforcement area, the IDSA guidelines create a detailed
scheme for ensuring that IDSA members comply with their data privacy
policies and provide appropriate means of recourse for consumers. They
give explicit direction on internal mechanisms that should be followed,
including establishment of clear procedures and specific time frames
for resolution of complaints, identification and training of personnel
that will ensure compliance and provide recourse to consumers, and
appeals structures. IDSA members are also directed to create a system
of incentives and/or sanctions, which might include bonuses, to
encourage adherence to privacy policies. I believe that the vast
majority of consumer complaints will be adequately and effectively
addressed through these mechanisms.
But, in order to provide consumers with additional confidence that
they can rely on a privacy policy, the IDSA guidelines also establish
two external mechanisms for ensuring member compliance with the IDSA
guidelines. First, they direct the IDSA to make publicly accessible,
both on its Web site and in its files, a report on the status of IDSA
member adoption and implementation of privacy practices. After the May
31, 1999 deadline for compliance, this status report will, among other
things, identify the certification seal provider used by each member,
include links to the privacy policies of IDSA members, and inform
consumers how to access privacy practice compliance information about
each IDSA member from the relevant seal provider.
Second, the IDSA guidelines require that members utilize
certification seals provided by third party entities. Such third party
seal providers must be empowered to investigate and verify compliance
with privacy policies, and to mediate or arbitrate consumer complaints.
You are familiar with the BBB Online program, one prominent third party
seal provider. In a few months, the Entertainment Software Ratings
Board (ESRB) will launch its own seal program for entertainment
software companies. Since 1994, the ESRB has been rating entertainment
software titles for age and content appropriateness. Senators Kohl and
Lieberman have called the ESRB the best and most credible entertainment
ratings system in the U.S. More recently, the ESRB has begun rating
entertainment software web sites along similar lines. In rating more
than 5,000 products and web sites, the ESRB has developed a depth of
ratings experience as well as terrific brand recognition and confidence
among entertainment software consumers. The ESRB therefore decided it
was a natural progression to build on that consumer trust by expanding
into the privacy ratings arena. I'm sure the ESRB would be happy to
share with this Committee details about its new seal service.
The last area of the IDSA guidelines I would like to discuss are
its rules regarding children. While 56 percent of video gamers and more
than 70 percent of computer gamers are over 18, the IDSA recognizes
that many children use our products, and that the online collection and
use of personal data from children raises a different set of concerns
than exist with adults. Therefore, the IDSA has adopted a more rigorous
set of guidelines with respect to IDSA members that collect information
from children.
With respect to children age twelve and under, the IDSA guidelines
mirror the recently enacted Children's Online Privacy Protection Act,
but we go beyond the Act to create special rules with regards to
children over twelve and under eighteen. If IDSA members engage in
collection of personal information from these older children, the IDSA
guidelines direct them to provide parents with notice of the collection
and an opportunity to remove the information from the site's database.
To date, sixteen IDSA members, who together accounted for almost 60
percent of all games sold in the U.S. in 1998, have posted online
privacy policies as required by the Guidelines or are in the process of
doing so. IDSA is actively reaching out to others in the industry, and
plans to meet face-to-face with the remaining members at our annual
industry trade show next month. The IDSA also plans a series of
regional seminars to help its members work through implementation
issues.
Once the IDSA adopted these guidelines in October 1998, the really
tough work began. While drafting guidelines to cover companies of
assorted sizes, resources, practices, business structures, and
sensitivity was challenging, it is an even greater challenge to
implement them. I tell you that based on real world experience. Think
tanks, interest groups, government agencies, and congressional
committees are laboratories; what might seem workable in the lab is not
always practical outside of it.
Acclaim has been actively trying to implement the IDSA guidelines
for several months. If there is any one message I would like to leave
you with today, it is that even modest rules on online collection and
use of personal information often require fundamental changes in the
ways companies do business and in their customer relationships. It is
important to remember that for entertainment software companies this is
an area vital, as folks in DC like to say, ``to our national
interest.'' Anything we do which affects our interaction with customers
is a significant business issue. As I noted earlier, our customers
expect an ongoing relationship, and the effort to meet these
expectations and protect their privacy is not an overnight process.
In the last few months, Acclaim has conducted an internal review of
our Web sites and the way they collect and use personal information
from Web site visitors. We then worked with the IDSA to understand the
guidelines and the changes we would have to make in our business
practices to comply with the guidelines. We have posted a privacy
policy on our Web site, and hope that the ESRB Privacy Program will
soon be operational and thus able to review our policy and practices.
If the ESRB requires further changes to our privacy policy and
practices, we will have to devise ways to implement these changes.
The privacy practices that Acclaim developed as a result of these
efforts are, I think, pretty straightforward: we have opted to
significantly limit how much information we collect on our Web site. We
only collect and store email addresses and only do so in three
circumstances: when a Web site visitor is subscribing to our
Newsletter, downloading software, or ordering something from our online
store. We make it clear that we may use these email addresses for a
variety of internal marketing purposes, but will not sell or distribute
these email addresses in any way to any outside person or organization.
We do offer customers the ability to have Acclaim delete their email
addresses from our databases by emailing our Webmaster with the word
``remove'' in the subject header of the email. Finally, we expressly
forbid children twelve and under from submitting information to us, and
will implement whatever consent and notice procedures the Federal Trade
Commission identifies as appropriate in regulations promulgated under
the Children's Online Privacy Protection Act.
As I stated, this ``simple'' Acclaim policy resulted from a very
difficult process of figuring out how to apply the IDSA Guidelines to
Acclaim. I will just to throw out a few scenarios to demonstrate the
difficulties we faced when we tried to implement information collection
and use limitations.
The words ``provide reasonable, appropriate access'' seem simple.
But what do they mean in practice? Suppose a consumer calls Acclaim in
New York and asks for all information that all our operating units have
on them? Acclaim New York and Iguana Salt Lake City have separate
databases. Is it reasonable to give the consumer the information we
have in New York and direct them to make other calls to ascertain the
information held by other units? I'm sure the consumer would regard
that as a nuisance. But the alternative would be for Acclaim to
centralize all its databases. That is a very costly and complicated
undertaking. Moreover, it raises privacy issues of its own since we
would now have greater ability to develop profiles of individuals by
aggregating all the data held by our individual companies.
In the children's area, implementing the requirements for parental
consent and notice are extremely difficult. For example, what does
Acclaim do about the personal information it has collected from
consumers for several years through offline registration of different
products, such as our NFL Quarterback Club series? We collected
information from registrants of NFL Quarterback Club '98 so that we
might send them software bug fixes or information on the 1999 version.
However, we never collected information on the age of these
registrants, so now we are in a bind. What if some of these registrants
are twelve and under? Are we breaking the new federal law, because we
do not have parental consent to do so, by contacting them via email to
inform them that their software is buggy? Alternatively, are we
violating the IDSA guidelines by sending the same email to a seventeen-
year-old registrant because we do not send his parent notice of this
contact? This could be solved by grandfathering in previous collected
information, but for now it remains a troubling area of uncertainty.
I mention these challenges not as an excuse for inaction, but a
warning that what seems simple in principle can be devilishly
complicated in reality. I believe IDSA's guidelines do protect consumer
privacy while allowing entertainment software companies to maintain an
interactive relationship with customers and to continue to experiment
with business models on the Internet. But they may not be for everyone
in the private sector. They are specifically crafted to meet the
privacy expectations of entertainment software customers and the
business needs of entertainment software companies. So our industry has
made important strides toward protecting privacy. But my experience
these last few months developing a privacy policy which works for
Acclaim tells me that a `one size fits all' legislative or regulatory
approach is a recipe for confusion. Industry self-regulation, while
imperfect, is ultimately the best and swiftest way to protect consumer
privacy on the Internet while allowing Internet creativity and
experimentation to flourish. Thank you.
The Chairman. This has been an extremely interesting panel.
I have to momentarily go meet with the Russian foreign minister
on a very important matter and so I may have to leave before I
can finish my questions, but I am going to try and come back.
Let me begin with you, Mr. Sheridan. It is no secret that
the Internet provides a new, valuable medium for merchants, as
they are able to use the network to collect personal
information about consumers. Some of the obvious methods by
which commercial Web sites collect personal information include
online surveys, registration pages, contests, and application
forms.
However, it is my understanding that sites also collect
personal information, using technologies that are not obvious
to the particular Web surfer. There has been a lot of confusion
as to exactly what some of these technologies are and how they
work.
Could you please explain to us what a, ``cookie,'' is and
how it works?
Mr. Sheridan. It is fattening.
The Chairman. It is fattening.
Mr. Sheridan. Well, a cookie, as Mr. Berman mentioned
earlier, is not an evil thing in and of itself. When you go to
a page and fill out a form and you have put in what you are
interested in, and magically next time you reappear at that
page your preferences are known on what kind of news you would
like, what has been set there is some data about you and what
you are interested in and that is a cookie, in a simple way.
It is also used when you go to buy a book at one of the
online bookstores, for example. It has your credit card,
shipping and all kinds of other information, and the nice thing
is you can click there and just buy the book. The potential
downside is that information is being used to help you and
sometimes it is not clear how it is being used once it is in
the system.
The Chairman. If I understand you correctly, basically, a
cookie is the technology that extracts information without the
consumer knowing about that information.
Mr. Sheridan. Generally, the cookie is set through
information gotten by the consumer. Of course, it could also
just log the fact that you were there and your address, too. It
is a two-edged sword.
The Chairman. Does this allow the Web sites to track which
pages a consumer views and for how long?
Mr. Sheridan. Well, the cookie doesn't necessarily do that,
but inside of their system, depending on the site, there are
ways in which the user can be essentially followed. They would
know what they had clicked on and what their preferences were,
then use that often to recommend something positive, such as a
recommendation for a book that they think you would be
interested in, based on what you had clicked on.
The Chairman. Is there technology available, or do Web
browsers allow a consumer to set his or her computer to prevent
cookies from being placed, or at the very least give the Web
surfer notice before it is placed in the computer?
Mr. Sheridan. Web browsers from early on in the development
of this technology have allowed the user to turn off cookies or
to ask for notification when one is being asked for.
The Chairman. I see. I want to thank you for this because
it is helpful in educating the public in two ways. First, by
letting them know how information could be extracted from them
and, second, by informing them that they do have the power to
control how some of these technologies are used through the use
of technologies that they may already have on their laptops. So
I think that is important that we establish that.
Mr. Sheridan. Yes, it is.
The Chairman. Now, Ms. Borsecnik, as an Internet service
provider and a portal, you may have an interesting perspective
to add. Does AOL use cookies on its Web sites?
Ms. Borsecnik. AOL does use cookies on its Web sites. We
use cookies to identify whether a customer has been there
before. What we do is we can personalize a page someone sees
based on the fact of whether they have been there before. So,
for example, the first time they come we may offer a degree of
help, a degree of explanation about the site that is not
required on subsequent visits, things like that.
Our system automatically collects a lot of data, some of
which is required for us to run our business and some of which
isn't in a personally identified way. So when we collect data
of where people go online, we store and use that data in a way
that anonymizes it and doesn't allow for us to connect that
data with a specific user and we review it in aggregate. So we
may know, for example, that ``x'' number of people have visited
the personal finance area, but we couldn't say that you were a
visitor to the area that day.
The Chairman. I see. Mr. Berman, I need to run and I am
appreciative that Senator Thurmond is here to spell me off, but
it appears that some uses of cookies are legitimate and help to
create a more efficient Internet. However, it also seems that
these cookies could be used by some bad actors for purposes
that certainly would be suspect. Maybe you could shed some
light on what some of these less desirable uses of cookies are
and what type of Web operators use cookies in these improper
manners.
Mr. Berman. Well, it is very difficult to make a judgment
like that. Anyone who is using information in a way which I did
not consent to--I go to a site, I think I am just browsing.
They collect information about me. Then they may have marketing
information and they are selling something to me. I don't like
it. So it is a relative judgment by the consumer.
I think that you are onto the right answer, which is that
consumers ought to know that a cookie is being placed, in other
words that information is being collected. There are mechanisms
now in the browser which allow you turn a cookie off. There is
even more advanced technology, such as the P3P platform, which
the World Wide Web Consortium is working on with other industry
and privacy organizations which will allow you to set your
browser and state your preferences about what you want
collected or not collected about you, and that will help to
turn a cookie off or keep you away from sites that are
collecting that information. The consumer can be put into a
position to know what is going on.
The Chairman. Mr. Wladawsky-Berger.
Mr. Wladawsky-Berger. Yes. If I may add, Mr. Chairman, I
think that all of the self-regulation concepts have at their
heart an empowered consumer, and that is why what we always
want is three key principles--notification, choice and
recourse.
Notification means that the consumer, the person that you
are interacting with, always knows what is happening, what
information you are collecting, what it is going to be used
for. Choice means that if they are happy that it will be used
for good things, they are happy to let you have it; otherwise,
if they don't know or choose for whatever reason not to give it
to you. And recourse means that there is a way, if you feel
that you have been wronged, to take recourse, like contact
BBBOnLine or some other mechanism, or in some cases the Federal
Trade Commission.
So I think those are the key principles, and then within
those principles there are a lot of technologies that can do a
lot of good, but if misused, then they can be used wrongly.
The Chairman. Well, thank you.
Mr. Berger. I just wanted to add one point, which is the
most difficult issue to resolve is the recourse issue. One,
getting everyone to put those notices up and tell you what is
happening with information, but with the millions and millions
of Web sites and the new ones coming online, the self-
regulatory efforts that are going on are really important. And
AOL and Microsoft are doing a good job in terms of trying to
move along toward self-regulation. We do have to raise the
issue of the bad actor and the small Web site and what the
recourse is there. That is not clear, but it is not easy to
write because the violations have to be spelled out.
The Chairman. Senator Kohl, let's turn to you. I apologize
to you that I have to leave for that meeting, and I am not sure
I can get back. But if not, Senator Thurmond will finish the
hearing. Thanks so much.
Senator Kohl. Thank you, Senator Hatch. I have a single
two-part question for the panel, starting with Ms. Borsecnik.
Are you all worried that the worst actors in your industry, the
people who do not respect privacy, will undermine your efforts
at self-regulation, and that Congress will legislate on the
basis of anecdote in a way that neither makes good sense nor
good public policy? And if you are worried about this, doesn't
it make sense to consider a commission which may preempt some
of the worst legislation and, even better, bring together
industry, government and privacy experts to establish a
balanced approach to privacy protection?
Ms. Borsecnik.
Ms. Borsecnik. Do we worry about it? Yes. Privacy is a real
concern to our customers; we hear it on a daily basis from
them. And we do worry that there are bad apples out
there,tentially, just like in the days when the Senator was
talking about being afraid that criminals would use cars to get
away from the scene of the crime.
But we worry more about legislation activity that is too
quick to put a stake in the ground at a time when--you have
heard from us all that this is a nascent industry; things are
moving so quickly. Maybe I am just a poor predictor, but at any
point in time I have a hard time knowing what my business is
going to look like in 6 months, much less 6 years.
And not only is the technology moving so quickly, I have
found that customers' demands are progressing along with it. So
to take a snapshot at any point in time when the industry is in
its infancy and say this is the right solution, this technology
is the right solution, I think I worry that that will be viewed
as short-sighted in retrospect.
In terms of a commission, we believe that an open and
public dialogue is an enormous help on this issue. Even
incidents that have happened, I believe, in the end have helped
the industry realize that more attention needs to be focused on
it and have resulted in some of the activities you have heard
about here today. So we are very much in support of that kind
of dialogue, particularly in areas that need particular
attention, like kids' privacy and health care and things like
that. A one-size-fits-all solution is definitely something that
we would be concerned about that could stymie our business.
Senator Kohl. Mr. Sheridan.
Mr. Sheridan. Well, to address the first part of your
question, yes, I think we all worry about it, both
individually, those with kids who have to deal with it
everyday, and also because frankly it hurts our business if
this trust is broken down.
We believe that the right approach is one that does not try
to do everything at once; again, as my colleague here had said,
a snapshot in time. And the time frames on the Internet are
very compressed; things happen very quickly. And what we would
be concerned about is any piecemeal, in-time solution that
doesn't take into account the fast-moving nature of the Silicon
Valleys of this country, and there are many of them, which are
really an American miracle of competitiveness, job creation and
wealth creation. It would be our concern that that would be
derailed by government intervention.
On the second part of the issue, we would welcome an open,
balanced approach that is structured to represent this
position. And if that were to occur, I think we would support
it.
Mr. Wladawsky-Berger. Senator Kohl, I agree with my
colleagues that the Internet and all the applications that it
is helping bring about--it is too young, too complicated and
too fast to know at this time what to regulate. It is just very
hard when we don't have enough information because it has only
really been around, in this explosive way it has taken off, for
the last few years. And it feels like every month, something
brand new happens. The fear we all have is we can regulate
something now that 2 years from now will just look quaint. Why
did we do that when technology went way beyond that, or the
marketplace?
Now, when things are moving so fast, definitely research
and dialogue are more important than ever. Chairman Hatch
mentioned when he introduced me that I am a member of the
President's Information Advisory Technology Committee. We just
submitted a report; it was just printed last week. And we
recommended a doubling of IT research over the next 5 years,
especially research on long-term strategic issues, and we
called out specifically privacy issues as areas that should be
aggressively funded because the more we understand the problem,
the more we study it, the more we can then have the right
approaches to getting privacy to happen. I think your idea of a
commission is a very sound one. It is in the spirit of
understanding and getting more information, and we would be
very happy to work with you to see how best to make it happen.
Senator Kohl. Mr. Berman.
Mr. Berman. I certainly support the idea, particularly if
it has a time frame and some very specific questions about
remedies. The last privacy commission 20 years ago really did
get out of the one-size-fits-all and looked at the particulars
of different industries and the technology. In the absence of
OTA and all of that background, this would be very helpful.
In the CDA legislation on child decency, Congress passed a
second statute. It is now being enjoined in the courts, and
they added to that statute a commission to study the issue
about what was the best way to do it. They passed the
legislation before they finished their commission work. Now,
the commission is going to start. I think the better way to do
it is to have the commission and then pass the legislation. So
that would get it right for once.
Senator Kohl. Thank you. Mr. Bodoff.
Mr. Bodoff. I think there is a variety of ways of answering
that question, and let me take two approaches. First of all,
when we deal with bad apples, the first concern always has to
be companies who don't post any privacy notice at all. If we do
our job correctly in the self-regulatory area and we get out
there and we educate consumers to look for privacy policies,
the marketplace is going to drive companies to put privacy
notices on their Web sites.
If a company has a privacy notice and violates it, through
a self-regulation process and working closely with the Federal
Trade Commission and other regulatory organizations, those can
be acted upon as deceptive trade practices. But a lot of talk
is on the bad apples, and in our extensive experience looking
at the Internet, our greater challenge is a lot of the new,
smaller businesses coming online that we wouldn't describe at
all as bad apples, but they are coming online with lack of
sophistication and experience of how to operate on the
Internet.
And it really is critical for business organizations to
come together and educate these businesses on good practices
because our experience is when we reach out to these companies,
we have very, very good compliance with companies responding
and wanting to do the right thing.
Senator Kohl. Mr. Fischbach.
Mr. Fischbach. Our business has really changed and will
change dramatically over the next 4 to 5 years. I mean, we
started writing software that was costing us $25,000, and some
of the people in the back of the room probably played some of
those games. But, today, we will spend anywhere between $3 and
$6 million to write a title. We will spend over $100 million on
R&D.
The competitive nature of our industry--it is the fastest
growing portion of the entertainment business--puts everybody
up to a much higher standard and really does eliminate a lot of
the bad apples just because they can't afford to compete or
they can't afford to participate in the organization or the
association.
The industry itself is a relatively new industry. Our
association is relatively new, but the steps that we have taken
in order to self-regulate, I think, are to be looked at and
commended. When it was asked by Congress whether we should
create a rating system for our organization or not, as you
know, Senator Kohl, we went ahead and did that, and we have
done it very effectively and we have virtually 100 percent
compliance within our industry.
We have taken the same steps with respect to our Internet
sites and our Internet activities. We do think it is an issue.
We are being very proactive. The companies in our industry
participate on one side from Sony, which is a multi-billion-
dollar company, to some very small companies. So the way that
those rules will become enforced and how quickly we can have
them adopted by our members may be different. It may not be
quite as quick as Congress would like, but we are all moving in
the right direction.
Virtually all of the companies in our association that have
any kind of public presence at all, whether they be public
entities or just basically marketing their products to the
public as a whole, have taken an aggressive action with respect
to this. So I think with respect to our industry self-
regulation will work and has worked.
Mr. Berman. May I just add to my comment?
Senator Kohl. Mr. Berman.
Mr. Berman. A commission should be tracking ongoing efforts
to see whether they are effective. In other words, it should
not be let's all stop and study this, because there are some
very important efforts in technology and self-regulation, and
even legislation at the State level that ought to be looked at
in terms of whether they are effective, and if they are not,
what are the alternatives, and report back to Congress and to
the administration.
Senator Kohl. Ms. Borsecnik.
Ms. Borsecnik. One follow-up point is that represented here
today are some of the more influential companies in the
Internet industry. And as such, we have a great deal of
responsibility and influence on other players. We have
mentioned a couple programs today, including AOL's Certified
Merchant program, IBM's advertising program, in which we have
the ability to influence that sphere of business contacts and
partners by only engaging in business contracts that require
our business partners to follow our privacy policies or privacy
policies of a standard set by BBBOnLine, or only allocate
advertising dollars to those sites that agree to comply with
that. I think that that is having an enormous impact, also, on
the proliferation of privacy policy sites on the Web.
Senator Kohl. Thank you all.
Senator Thurmond [presiding]. Senator Leahy.
Senator Leahy. Thank you, Mr. Chairman. One of the things I
have been concerned about is the different privacy policies of
different companies. I look at Web sites and while many various
companies have policies, it gets kind of confusing because they
are so different. Some sites reserve the right to change their
policy, but only a few explicitly state that a change in policy
will not affect what they have already gathered. And the fact
that they may just suddenly change their mind is a little bit
puzzling.
I looked at one I have got here from Polaroid. It says,
``we reserve the right to change this statement at any time''
on what they do. It says that they collect aggregate and user-
specific information on what pages consumers access or visit. I
consider myself somewhat Web-savvy, and I am sure that the Web
master finds this perfectly clear, but I am not quite sure what
it is they are finding out. In any event, they say they can
change that any time they want anyway, so it probably doesn't
make any difference what it is they are finding out.
In fact, I saw one, Purina, which goes on at great, great
length about it. It is very specific, very legalistic. It looks
like a corporate merger proposal. Then we have another one,
though, that I do kind of like, Super Stats. They give you the
legal line and then they put in parenthesis, ``translation: we
don't see or give your info to jerks who want to send you a
bunch of junk mail.'' That, I like. [Laughter.]
You know, I am a lawyer, but that one I can understand and
I think it is kind of nice.
I am not suggesting we sit here and impose a uniform
privacy policy, but how do we reduce the confusion for
consumers without us standing up here and saying here is what
it is going to be? I mean, how do you do it in such a way that
I go from company A to company B, to a travel agency, to this,
to that and the other thing, and have some idea what the
consistency is?
Mr. Wladawsky-Berger. Senator, that is one of the reasons
to make it very simple for a potential customer to see the
practices that we all support so strongly--the seal programs
like BBBOnLine or TRUSTe. The hope is that when you go to a
site and you see a seal program that you trust, it is like
buying, let's say, an electric hair dryer, seeing that
Underwriters Laboratory----
Senator Leahy. I don't use a hair dryer with my hairline,
but I understand what you are saying.
Mr. Wladawsky-Berger [continuing]. Or some other electric
appliance, and it has Underwriters Laboratory. They have a good
reputation. At least a base level of good practices has been
followed.
Now, it is all very new. TRUSTe has been in operation about
a year, 2 years now, and BBBOnLine just started. So we don't
have enough information whether that will be enough. That is
certainly the hope we have for the seal programs, to make life
much easier.
Senator Leahy. I have said this to your company up in
Vermont: I feel, as I said earlier today, too, that good
privacy policies are good business policies. I think what IBM
did in your decision not to ship the Pentium III chip with the
built-in serial number activated and in your decision not to
advertise IBM on Web sites without posted privacy policies is
very good and I hope that produces results. But I also hope
that what it might do is be a kind of a corporate example that
others will follow.
Mr. Berman. Senator.
Senator Leahy. Mr. Berman.
Mr. Berman. I think that the seal programs are attempting
to make some consistency across the Net in terms of
expectations so that if it is a Good Housekeeping seal of
approval or BBB, you will have some sense of what the
parameters of those privacy policies are.
We are very much in favor of a technology step, which is
the development of what is called a Platform for Privacy
Preferences, which would allow you, every consumer, to set what
your preferences or your expectations of privacy are as you go
shopping and going around the Net. And it will only go to sites
that are consistent with your preferences. And if it is
inconsistent with your preferences, that side would have to
negotiate with you. If they want more information from you and
you don't want to give it to them in your browser, they would
have to explain what the big deal is and why they are giving it
to you.
I think that is absolutely essential because there is no
way that the consumer is going to be able to read, let alone
offline, but online, all of these policies. They need ways to
make it seamless as part of their Web experience.
Senator Leahy. Well, I know if I get my Internet through
the phone company or the cable company, either under 47 U.S.C.
Section 222 or Section 551, they have to give me a very clear
understanding of how the information might be used. But if you
are going outside that, AOL, for example, works very hard at
protecting it, but that is still going to be a corporate
policy, not a legal policy.
Mr. Bodoff, you were trying to say something there. I mean,
what I am saying is I want to know, if I have a certain
expectation under one way of having it provided, how do I get a
similar expectation under another one, because most people have
an expectation of privacy and may not realize that it may vary
considerably where they are.
Mr. Bodoff. Well, I think one of the most important aspects
of the program that we have just launched was the development,
through the effort of many companies and privacy experts
working together, of what we would call a series of best
practices. In a sense, it is a road map, and any company who is
applying for our seal and they go through their process, they
have to evaluate their privacy policy against these best
practices.
So the issue that you started with, Senator Leahy, would be
addressed in the criteria in our program. Each of the companies
that have been approved to date in our program have had to make
adjustments to the processes. So what is going to happen is as
more and more companies go through these self-regulatory
processes and match their own efforts against best practices
that have been developed, we are going to see improvements in
privacy policies throughout companies, and that is small,
medium and large. And I think it is going to be very positive
for the Internet and very positive for consumers.
Senator Leahy. But are you saying that it should be done by
policy and not by law?
Mr. Bodoff. We are a self-regulation organization. We
believe we have laid out models that have been developed in
consensus environments that really point to excellent practices
that should be included in a privacy policy, and we have given
the road map for companies to follow.
Senator Leahy. But the industry seemed to say they weren't
good enough or fast enough last year when they supported the
Children's Online Privacy Protection Act. They said we had to
have a law. The Federal Trade Commission, I think, yesterday
proposed the rules for implementing that new law which
prohibits Web sites and online services from collecting, using
or disclosing children's personal information.
Why shouldn't industry support for the Children's Online
Privacy Protection Act be taken as an admission that self-
regulation has serious limitations? Ms. Borsecnik.
Ms. Borsecnik. I think there is an obvious and real concern
about children that requires even more sensitivity, perhaps not
the patience to wait as the policies evolve. Therefore, we were
very supportive of those efforts in the area of children
because there is just a certain extra added degree of concern
that you need to apply to kids under the age of 18.
In terms of the privacy seals----
Senator Leahy. But let me just stop just for a moment. I do
Internet chats almost once a week for the different schools
around my State. I find it very exciting, especially when I see
the quality of what the kids are asking, oftentimes better than
the quality of some of the questions that we get in debate
around here.
But I have no way of knowing what their age is. I mean, the
school will tell us when they come on, but I wouldn't know
otherwise. I don't know whether they are under the age of 13
and subject to the new law or not. I mean, how can you possibly
do that?
Ms. Borsecnik. How do we know that? Well, at AOL we
encourage parents to set up separate accounts for kids that are
set up specifically with controls in place for children that
limit their ability to interact online in adult areas. And, in
fact, that effort has been very successful. At this point, over
75 percent of households with children in them that are AOL
users use parental controls for their kids' accounts. So we
have worked really aggressively in that area because we do
believe that added care and protection is required for kids
online, and added supervision.
Senator Leahy. I cut you earlier in your answer.
Ms. Borsecnik. I am sorry. I was referring back to the
point someone made earlier about these Good Housekeeping-
equivalent seals. They are very helpful, we have found, among
our members in helping convey that sense of security. What we
found when we started looking at our privacy policy and
rewriting it a year ago was we are throwing around terms that
we assume other people are comfortable with, even things as
simple as ``notice'' and ``choice.'' You know, we are drinking
our own bath water.
When you talk to customers, they want to know, are you
giving out my phone number? Are you giving out my screen name?
Are you following me around where I am going online? You know,
really basic questions that anybody would be concerned about,
and so we found that it is absolutely essential that privacy
policies need to be stated in very plain English.
Furthermore, they need to be available in an area that is
easy to find online. When a customer first joins AOL, they see
the privacy policy right when they are signing up to become a
member and giving us their credit card. So everything that we
can do and require our business partners to do that educates
consumers at a really very basic level is necessary, and I
believe the seal programs help in that regard, too.
The Chairman. Mr. Berman.
Mr. Berman. Senator, I think that the Child Protection Act,
which we supported and worked on, and your mention of the Cable
Act, is a very good example of what we are facing here. It
would be great to just pass the Cable Act for the Internet, but
as you know from the CDA experience, this is not just a cable
network. It is very different. It is cable, television and
everything all piled together. So trying to figure a one-size-
fits-all across the Internet is very difficult to do.
What happened in the children's area is there was a clear
set of concerns. It was an agreement on what was wrong, that it
was inappropriate to collect that information on children.
There was an effort to define what was a kid's site versus an
adult site to hone in on that, and giving the FTC the
flexibility to try and implement it in a way that balanced
commerce, privacy and First Amendment rights. It had the
element so that it was over-burdensome.
I think that the real worry of Congress stepping in is not
that they couldn't set the right rules, but that the privacy
rhetoric and the demands could be counterproductive by passing
an overall one-size-fits-all statute. I think that is the
concern, not whether legislation ultimately is needed.
Mr. Fischbach. In our industry, I mean we will move to
electronic distribution of software. I mean, that is evident.
In the next 4 to 5 years, 30 to 40 percent of our revenues will
come from electronic distribution. Our consumer expects us to
talk to him, whether he be 12 or he be 24 or he be 36. And
unless he tells us what his age is, we won't know that.
But we have a real issue with how to communicate, how to
give him patches, how to tell him how to handle certain issues,
because they will come and they will talk to us on the
Internet. We have a Web master that goes back and forth. You
can come to the site and you can find out about the products
that we have or about the forthcoming products. We will
sometimes send a notice and we will announce new products to
him.
But the basic information we are collecting is just an e-
mail address, at most, and very, very limited use of it. But it
does create a question of how we deal with the child under 12.
And I think in our industry, about 30 percent of the software
is sold to children under 12 years old, and the balance is sold
to adults or those over 12. So it is a real issue for us, and
not one that I think legislation----
Senator Leahy. It is also one where parents have got to
start paying a lot more attention. You can't just simply say
the companies and the Congress are going to do it. I mean,
parents are going to start spending some time in finding what
their kids are looking at off the computer, where they are
going and how they are doing it.
Mr. Fischbach. And we came together as an industry and we
spent about 6 months trying to hammer out a policy that we have
agreed to as an association, and then giving that policy to
another board to enforce what works with the seal. So there is
a check and a balance that exists within the system, with
penalties that go along with it, and a way for people to become
notified if a particular company isn't following the particular
protocols.
The Chairman. Thank you.
Senator Thurmond.
Senator Thurmond. Thank you, Mr. Chairman. I am pleased
that we are holding this important hearing today on privacy and
the Internet. I commend Senator Hatch for his leadership in
this matter.
Consumers are concerned about privacy. A Business Week
magazine poll has said privacy is a major reason many consumers
who are not using the Internet have stayed off. Therefore, this
is an important issue. At the same time, I am concerned about
government regulation being the solution. I am pleased that we
have many industry representatives here to discuss their
efforts to advance Internet privacy. I share the view of
Senator Hatch that self-regulation is better than a detailed
legislation mandate, and I am glad to have all of you with us
today.
Now, I have a question I would like to ask, and any one of
you can answer it if you want to volunteer. When we talk about
Internet privacy, there are a number of different consumer
concerns that people talk about. We hear that consumers are
concerned about the collection of personal data and that this
affects their participation in electronic commerce.
Based on the information you receive from your customers,
and based on your experience in this business, I would like to
hear from you what you believe to be some of the leading
privacy concerns of consumers. What is it that consumers are
concerned about that is keeping them off the Internet?
Let's start with you, Mr. Fischbach, I think, and I would
like to hear from any of you that care to express yourselves.
Mr. Fischbach. I think the principal concern of the
consumer is how is the information used; what do you know about
me, and how can I stop you from using it from time to time if I
don't want you to use it. In that regard, we have been pretty
proactive in explaining to the consumer how we use the little
information that we collect and how he can take his information
off our list and how we clean our list from time to time so
that we can basically deal with his issues.
Senator Thurmond. Does anybody else care to comment?
Ms. Borsecnik. I would like to comment. Our customers tell
us three major concerns, as well as others, but the three major
ones are, first of all, I am concerned about the security of my
data online. One of the obstacles to e-commerce is concern
about whether or not, when I enter my credit card and transmit
it across this unknown network, whether it is safe and secure.
And our customers tend to associate those security issues and
privacy issues all together. To them, it is just one sort of
vague concern.
The second area we get a lot of concern about is are you
tracking where I go and what I do online. Specifically, it is
none of your business whether I am researching some health care
issue for my family. So there is a lot of sensitivity there.
And then, finally, the question we get a lot is what of
this information do you share with anyone else. As our members
establish a business relationship with us, they know and agree
that certain information we collect we need to use for business
purposes. We need their credit card information, we need their
mailing information. But they are very concerned about our
practices in regard to how we share that with third parties,
whether they be private industry or the government. So those
are issues that we address very specifically in our privacy
policy and give our customers choices about opting out of.
Senator Thurmond. With all the recent media attention to
online privacy, many groups are advocating that we develop
legislation imposing privacy standards for the Internet. In
your written testimonies, most of you believe that broad
Federal legislation to regulate the Internet at this time is
premature.
As someone who has been dealing with both the policy and
business implications of privacy in the real world, can you
tell us what problems would occur if broad Government
regulation were imposed for privacy on the Internet? I call for
a volunteer. Go ahead.
Mr. Wladawsky-Berger. Senator Thurmond, the biggest concern
we have is that it would make it very cumbersome especially for
the smaller businesses we all have a hope to attract into the
networked economy to get on. The larger companies--IBM, AOL and
others--could adapt to it, and we can afford the expenses of
what it takes.
But for all of us, the biggest promise of this information
revolution is reaching out, connecting everything, reaching
everybody, businesses of all sizes. And we want to make it as
easy for the businesses to get on and participate. As one of my
colleagues at the table said before, the vast majority of small
businesses want to do the right thing. They just don't know
because they haven't used these technologies before. And we
worry that if we have excessive regulation at this time, before
we know what is needed, it will detract quite a number of them
and that will not be good for them.
Senator Thurmond. Mr. Berman, do you want to comment?
Mr. Berman. Yes. I think that on one extreme is self-
regulation will solve this whole problem. That is just not
going to happen. On the other side is there is something called
excessive legislation, and I think that I would agree with you.
You were talking about the European model of a big data
protection board sitting on top of the Internet.
But I also think that it is possible, and it is not a one-
size-fits all. But within those parameters, there is something
less than excessive legislation and more than self-regulation
which Congress ought to look at it, which is to try and figure
out what the differences are between the different sectors on
the Internet, create safe harbors there, create remedies that
work, bring that down to concreteness. That is not an
impossible task; it is absolutely an essential task that
Congress do it and move.
And I think that the IBM's and the AOL's and the IDSA's
will be the flagship and set, I think, the good safe harbor
standards about what is good behavior on the Net. But for the
millions of Web sites that are not going to comply with
BBBOnLine, are not going to join any seal program, have no
incentive to do privacy, I think public policy requires that
Congress address that issue.
Senator Thurmond. Thank you.
Ms. Borsecnik. One other point. We keep referring to the
Internet industry, and the truth of the matter is the Internet
is not an industry. The Internet is a medium and the Internet
touches every single industry. So when you think of it that
way, everything from A to Z--the travel industry, the personal
finance industry--you know, every piece of commerce, every
business is moving online in one way or another. It gives a
good perspective of the complexity of regulating an environment
in which clearly one size can't fit all.
Mr. Sheridan. From our point of view, the issue is how is
it that it is not immediately out of date in something that is
moving this fast. The Government isn't known for its own speed,
and our concern would be that a proper balance would absolutely
have to be struck. And our concern is it is a snapshot in time
again.
And the other one is just plain old confusion; it would be
a different kind of confusion. How do we avoid confusing people
additionally with a great deal of new regulations? That would
be another one of our concerns. How does this not turn into a
mess and a slippery slope if we do this and then all kinds of
regulations follow and build on it, because once it is written
in, it is very unlikely to ever go out.
Senator Thurmond. Thank you.
Mr. Berman. May I respond to that?
Senator Thurmond. Mr. Berman, did you want to say
something?
Mr. Berman. I just want to respond to that. I think that,
yes, there are very serious concerns that you could, you know,
bollux up the Internet, and my organization shares those
concerns. And a rule could be obsolete tomorrow, but there is
no reason why you cannot have the flexibility to try and figure
out a process which recognizes the flexibility, the changing
nature of the Internet, and tries to get going on these
problems.
I think that one of the confusions out there now is that no
one knows what the rules are, whether they are simple or
complex. And I think that consumers are staying off the
Internet because they don't know whether there is any privacy
out there, and there are a lot of companies that don't know
what their liability or exposure is, or what is coming down the
pike. So it is very difficult to plan for privacy. Getting some
simple rules and simple remedies, not complex and excessive,
might help the Internet so that it would know where it is.
Senator Thurmond. Mr. Fischbach, in your testimony you
address some practical problems with implementing effective
privacy practices. I think it would be very helpful to us as
policymakers if you could share with us some specific examples
of the problems that have occurred.
Mr. Fischbach. Well, databases are probably the easiest one
to point a finger at. In terms of where we have collected
information in the past, we have been in business for a dozen
years or so and we have collected information from our
consumers based on registration and warranty cards that we
compile on a database and from time to time sift through. We
also have operated several different sites from time to time
where we collected information from consumers, for whatever the
reasons were, that would talk to us.
When it came to the question of how we deal with the term
``access'' and how we define what we are supposed to do with
the consumer who comes to us and says, OK, I would like to know
what kind of information sits in your database about myself,
does that mean as a company that we have to go through the
simple record of the site that we now operate and say, OK, we
can sift through that pretty quickly?
Does it mean that we have to go through the other databases
that we kept and say, OK, now we have to collect that
information to find out what we know about you? Or do we go
even to a third place where we have collected these warranty
cards from our consumers who registered with us for products?
And we ship about 15 million boxes a year, so we have lots of
cards that we have been dealing with over the last 12 years or
so.
And the question is how do we interpret that. We
interpreted that language to say that we would use reasonable
efforts to come back and provide whatever information the
consumer was asking for to tell him what we knew about him that
sat in our database.
Senator Thurmond. Mr. Bodoff, some----
Mr. Bodoff. Well, I probably could share some of these--I
am sorry.
Senator Thurmond. I just started to ask another question.
Did you want to comment on this?
Mr. Bodoff. The only thing I was going to add to that from
our experience and in the development of our process and
hearing many companies going through it is that having the
opportunity to revisit and look at what is identified as good
practices, large companies with multiple divisions are finding
surprises. That is going to happen. The positive thing is
moving to address them. Having information being maintained on
a Web site by a lot of different business units, it has to
filter down to these large, diversified organizations. So as
they move to improve their privacy policies, I think
organizations are finding challenges in front of them, and the
positive thing is the way that they are responding to them.
Senator Thurmond. Mr. Bodoff, some of the witnesses have
noted the industry seal programs, such as BBBOnLine and TRUSTe,
to address self-enforcement. Can you explain how BBBOnLine
works and how BBBOnLine is different from other seal programs?
Mr. Bodoff. Well, as I mentioned earlier in my testimony,
we have an 86-year history in self-regulatory activities. Our
program, we believe, goes much further than any other privacy
seal effort on the Internet. It is extremely comprehensive in
that it does not look at just the privacy notice. It looks at
the entire information practices within the company and it
evaluates whether the company has the processes in place to be
able to live by the privacy notice. And that is very, very
important because that is where we are getting feedback from
the companies.
Now, when they are asked to measure their processes against
the policy statements that they are making is where the rubber
hits the road and when they really realize whether indeed they
do have the processes in place. So I think it is the
comprehensiveness, the way our program has been described, the
name recognition. One of the things that we bring to the table
is very quick public confidence levels in a seal associated
with the Better Business Bureau name because of the public
trust level associated with our organization.
Senator Thurmond. I now have to leave for another
engagement. I wish to thank all of you people for coming here
and testifying and giving us the benefit of your good advice.
I thank you, Senator Hatch, for the good job you are doing.
The Chairman. Thank you, Senator Thurmond.
Senator Schumer.
Senator Schumer. Thank you very much, Mr. Chairman, and
thank you for having these timely hearings. I think it is so
good that we are having hearings before any proposals are
before us on an important issue. I am new to this issue and am
glad we are also trying to make it a good, strong judiciary
issue.
So I have some questions, I guess. My first question deals
with my experience with privacy issues and with other kinds of
issues in the House. And one of you mentioned this, but no one
focuses on it. Usually, when government is importuned to act,
it is because there are bad actors. There are not the IBM's or
the AOL's, but others who do things that horrify people. And
sure as we are sitting here, there are going to be bad actors
who do something. They will sell private medical records that
they get hold of or something like that.
What do any of you suggest we do, just say, well, you know,
relying on the marketplace? That won't work. These are market-
driven decisions. Self-regulation? That doesn't work. By
definition, a bad actor doesn't submit to self or industry
regulation. How do we deal with bad actors, and if we don't
deal with them, isn't it likely that they will just grow and
grow and grow, and actually hurt you folks who are trying to
do--I respected the statements that everyone has done here
because you are trying to do the best work.
So that, to me, is the fundamental question here, not the
95 percent of those involved who would find a balance. Left to
your own devices, you will find a balance between freedom of
speech and privacy rights, but there are some who won't.
Yes, the gentleman from IBM.
Mr. Wladawsky-Berger. Senator Schumer, first of all, as my
colleague from AOL said before, the Internet is a medium, and
it is a wonderful, mysterious, very flexible medium. But what
is happening more and more is that the technology is now
disappearing into the woodwork and enabling lots of
applications.
Now, for a lot of bad things that would happen on the
Internet, there are probably already laws to handle those bad
things because people are doing things over the Internet that
have been done for many, many years. And so one thing for sure
is to have a good understanding whether existing practices
protect that, and if so, apply those protections. And then when
they don't, then one can look at incremental changes to the
protection. So I would say that is point No. 1.
Senator Schumer. If I might, I agree with you, and
certainly in an ideal world you could apply the--the Internet
basically just speeds information up.
Mr. Wladawsky-Berger. Right.
Senator Schumer. It doesn't change the transaction of
information. However, because things are so quick, there are
detection problems; there are problems that are different than
non-Internet problems, in actuality.
Go ahead.
Mr. Wladawsky-Berger. I agree totally with you. It is not
identical; it is an extension. I mean, the reason it has
exploded in the marketplace, and the reason there is so much
activity is that it is such a phenomenal extension. But for
lots of problems, there are probably already recourses. That is
the only point we should understand.
I think point No. 2 is I would say that massive education
is needed so that consumers, businesses, everybody knows sort
of the rules of the road. This is what is expected, this is
what you should do, this is what shouldn't happen. And we are
all pretty comfortable that the more education there is, the
better things will get. Maybe it is a little bit naive, but we
have seen already----
Senator Schumer. The more education, the better the good
people can be and the worse the bad people can be.
Mr. Wladawsky-Berger. I realize that, but lots of things
can happen also if consumers realize this is what you should
expect from Web sites you deal with. So it is not just that
there won't be bad Web sites, it is that the invisible hand in
the sense of they lose all their customers will take care of
that.
And then when that doesn't work, then we are not against
legislation. We are not against the Government acting. We are
saying let's not do it on a broad basis; let's do it for highly
targeted problems when we find them. And protection of minors,
protection of very sensitive information like medical records,
might be in that category where we do need legislation. And
when we find those highly targeted categories, by all means we
should take action.
Senator Schumer. Yes, Mr. Berman.
Mr. Berman. There is a lot of truth in what he says. We
have a very weak privacy regime for data in this country. We
talk about privacy, but it is pretty thin in terms of
legislation. There is no medical privacy. There is higher
protection for video records than for medical records, and
higher for video records than financial records.
So there is a whole set of sectors where we have stopped
doing any work or haven't been able to break the logjam between
the different sides which need to be resolved because that
information is moving on the Internet. So there are specific
problems that need to be resolved.
I think the difficult issue, and I think it is worth
working on, is what are the remedies for violations in the
commercial transaction world. When I talk about medical records
and the big database, I understand someone ought to go to jail
for that. There is a problem when you get down to when L.L.
Bean takes--and forget their name--without my permission, gives
my name and my address to REA, and they did it intentionally.
There is a harm there, but what is it, and what do we impose on
REA?
If we don't figure that out and make it clear and specific
and proportional, a lot of little companies aren't going to go
into business. IBM can figure that out and go to court, but the
vagueness, due process, and First Amendment issues that are
raised by privacy remedies have not been addressed.
Senator Schumer. I agree with you. I mean, we have had this
in credit cards in the Banking Committee and we still haven't
come to a good solution. But in reference to what Mr. Wladawsky
said, you are right, we haven't come to this, but the
Internet--I mean, hospital records; 20 years ago, the damage
that would occur to your privacy would be maybe if someone who
had access to those records gave them to a friend and somehow
you heard about it. When it happens, the damage is limited and
it doesn't happen that often.
With the Internet, the chances of those records being
spread to everyone in the world is much greater. That is the
quantum difference here, which is a serious difference, and
that is why we are having these hearings and we never had
hearings on these privacy issues before.
Yes, Mr. Sheridan.
Mr. Sheridan. I think the context is what we are talking
about. The Internet is in many places simply replacing certain
processes, and there is no real protection for medical
information bureaus for what they do. And they have been
selling our information, and it may be even worse than not
having it in the Internet because at least on the Internet, I
am on that network. Before, there was a network between the
insurance company who is checking my application for health
insurance or life insurance and I have no idea what is going
on.
So what I am trying to say is this is in the context of the
Internet is an attractive target for it, but it is actually a
much broader problem than that.
Senator Schumer. It is, but the Internet is bringing it to
a head. That is the bottom line here, and I still think we are
going to have to figure out, whether we do anything or not,
some way to deal with bad actors. It may be as simple as what
Mr. Berman said, increased penalties for those who do. Maybe
there needs to be a greater prophylactic measure. I don't know.
I am just getting into this. All I can tell you is I think the
problem is not going to go away. I think it is going to get
worse because the bad actors have more clout and more ability
to do things, and we have to deal with it.
I just had one other question. Did you want to say
something, Ms. Borsecnik?
Ms. Borsecnik. The only other comment I would add to that
is they are also more highly visible and more exposed in this
medium, which is a good thing for everyone. I think an enormous
amount of attention is paid when these things happen. So I
think rather than them proliferating like mushrooms in the dark
somewhere, they will be further exposed in our industry because
it is so open.
Senator Schumer. Yes, and you will have a greater--I mean,
there is a privacy issue and there is an accuracy issue, and
the accuracy issue will--as I think Mr. Sheridan mentioned,
that will be better because it will be out in the open, as you
say. But the privacy issue is still one that hasn't been dealt
with.
Mr. Sheridan. It is like Mr. Berman is saying that there is
a very fine line between our other freedoms.
Mr. Berman. One point. We have worked on privacy issues
before, particularly the law enforcement and privacy balance.
Senator Schumer. Yes.
Mr. Berman. And I said at the start of my testimony that
Senator Leahy's effort to look at the Fourth Amendment issues
on the Net are incredibly important because these companies are
creating new kinds of data that make the Monica Lewinsky book
purchase subpoena a piece of cake; I mean, just incredibly
sensitive data being put away from your home and on the
Internet. And we have got to figure out the standards of access
for that for government agencies as against----
Senator Schumer. This is one other point that I would like
to make, a separate point, as somebody who is not as proficient
as my children on this, but I am sort of learning. So I usually
late at night read a national publication on the Internet, and
I was wondering why they did it because I don't have to buy it
the next day. And, you know, they got smart and last week they
changed the whole system where you can only read parts of it
now.
But they also made me register and they just said, you
know, they wanted my name and all that, but they wanted my
phone number. Well, I didn't want to give them my phone number
to get this, only because I wanted to make sure that they
wouldn't give it to 30 people who would keep interrupting us at
dinner.
And I, who is probably middle-level proficient, but
assuming from everything you say that everyone is going to be
using this service, so I will probably move to a higher-level
of proficiency over the next few years--I couldn't find out
what they were going to use my phone number for. I punched
around, I went to ``Help,'' I did everything I could. I could
not find out why they wanted to use my phone number, so I
didn't register.
So there is a long way even on the things--forgetting the
bad actor for a minute, this related to what you said, Ms.
Borsecnik, that those of us who are not as proficient as you
have very sort of elementary questions that for a semi-literate
person in this area is very hard to figure out the answers to.
Ms. Borsecnik. And you didn't register and they lost a
customer, so they are going to realize that pretty quickly that
they are losing people.
Senator Schumer. But they have no idea why I didn't
register.
Ms. Borsecnik. Well, it will become obvious.
Mr. Berman. Yes, they will figure it out.
Senator Schumer. They will?
Ms. Borsecnik. Oh, yes.
The Chairman. Or you can type in 11111.
Senator Schumer. Well, you know what? I thought about that.
[Laughter.]
I thought of doing 1234567, and then I said, well, you
know, maybe I better check if I am violating some kind of rule
or something like that. [Laughter.]
The Chairman. Well, that is why I said 11111, because some
poor slob could have that 1234567.
Senator Schumer. That is true, that is true. Good point.
You know what, Mr. Chairman? This is a pretty good political
opportunity.
Mr. Berman. It might have been his phone number.
Senator Schumer. I would never do that to my Chairman, for
whom I have tremendous esteem and respect.
Mr. Sheridan. We are actually developing a product that
will, if you choose to as your own personal policy, fill that
in with random information that will appear correct, and it
will be different every time.
Senator Schumer. Ms. Borsecnik wasn't so happy with that
idea. [Laughter.]
Well, Mr. Sheridan, if you want to establish a branch
office in New York that has 80 or 90 people to do that, I would
be all for it.
Mr. Sheridan. We have quite a few people in New York.
Senator Schumer. Anyway, please.
Ms. Borsecnik. My point was my view is that companies
shouldn't be collecting information that is not necessary to
run their business, or they should make it very obvious what is
optional, what is not optional, and how you can exercise choice
about how that information is used.
Senator Schumer. By the way, I wouldn't have even minded if
this company wanted my phone number to solicit me for them. But
I was worried they would sell it to somebody or to a lot of
somebodys.
Ms. Borsecnik. Right.
Senator Schumer. Thank you, Mr. Chairman.
The Chairman. You are welcome.
Senator Feinstein.
Senator Feinstein. Thank you very much, Mr. Chairman. My
concerns, in a sense, parallel Senator Schumer's. I, like him,
am somewhat a newcomer to the Internet. I am the proud
possessor of a new Think Pad which I enjoy very much.
Mr. Wladawsky-Berger. Thank you.
Senator Feinstein. You are welcome. [Laughter.]
However, I have watched this privacy issue two-fold. The
first has to do with the giving out of personal financial and
medical information, some of it the most intimate details. And
I have noticed then people begin to bring it in the public
arena, and slowly the industry begins to respond by some form
of self-regulation.
I also have concerns on the other element of privacy and,
of course, that is the pedophile looking for a victim. That is
the drug cartel using highly encrypted computer technology to
conspire to move tons of cocaine into this country, and that is
the terrorist, as we found in the Philippines, using the
privacy that encryption provides to conspire to blow up
airliners.
I am as heartened by anything, frankly, as Mr. Berman's
comments this morning that the industry is beginning to realize
that it has to be more vigilant with respect to self-
regulation. I mean, I know of no excessive legislation being
proposed anywhere, certainly in this body, with respect to
regulation. I do, however, think the jury is out with respect
to self-regulation. And there are many of us with respect to
children and crime that are really watching very carefully.
I, for example, will look to see where the youngsters from
the incident yesterday in Denver got the information to put
together the 30 explosive devices that they put at that school
and whether it came, in fact, from the Terrorist Handbook,
something that I have been trying to get off the Internet for 5
years now. It gets passed in the Senate and it gets deleted in
the conference. So I have a little bit of frustration when I
see somebody advertising, if you want to learn how to build a
bomb that is bigger than the one at Oklahoma City, just read
this.
There was a cartoon in a California newspaper that showed a
mother talking on the phone to a friend who said, I am so
pleased with Johnny, he is learning so much from the Internet.
And there is Johnny over at his computer stringing together
sticks of dynamite. And so I only say that because it is a
problem out there and children have blown themselves up, and I
have enough testimony to know that that is an accurate
statement.
The question is really what we do about the abuses. Now, I
am not talking about the companies, but the real abuses. And I
would be interested, Mr. Berman, if you would be willing to
expand a little bit on your comments in this direction.
Mr. Berman. Well, it depends on the case we are dealing
with. Certainly, in the real abuses, the pedophile, the people
collecting information from children, and even the marketer
who, under false pretenses, collects information and sells it,
to my detriment, there needs to be a set of penalties, both
civil and criminal, that make it clear that that is
unacceptable behavior.
Senator Feinstein. Is your organization willing to work in
this direction?
Mr. Berman. Absolutely.
Senator Feinstein. I would like to work with you.
Mr. Berman. As you know, we have had a debate about where
to draw these lines, and I just got appointed by Senator
Daschle, for good or for evil, to the COPA commission to again
look at the issue of indecent communications on the Internet
and what to do about that. I want to try and find solutions to
keep that information away from children, but to try and do it
consistent with this technology and the First Amendment.
Two times I have said to the Congress I agree with your
goals, but it is not going to work legally, so why don't we
work a little more closely together to try and fine-tune this?
And I think that solutions are possible, both in the First
Amendment area and the privacy area, but it requires everyone
taking a deep breath both on the privacy front and the law
enforcement front, and even on the pornography front, and
saying these are hard questions. We know it when we see it, but
someone's Spam is someone else's First Amendment leaflet. How
do we sit down and craft remedies? I am glad to work on that.
It is just not a fast train.
Senator Feinstein. It is very interesting. As a newcomer to
this, I am so amazed by the power of it and the speed with
which the technology is improving. I mean, just to keep up, I
have had to buy two new computers in 4 years. Things change so
fast.
And I think none of us want to impinge on the First
Amendment. On the other hand, one of the things I have been
very concerned about is drugs coming into this country, and
cocaine literally coming in by the ton and the inability to do
anything about it. And we are told constantly that intelligence
intercepts are way down because the telephone isn't being used
anymore. Therefore, they can't get court orders to tap a phone
because the phone isn't being used. But another vehicle is
being used, and that, of course, is the computer. So how we get
at this to prevent these kinds of major conspiracies also I
think is something I would like very much to work on. I don't
know the answers.
Mr. Berman. Well, my experience has been that whether it is
passing the Foreign Intelligence Surveillance Act or the
Electronics Communications Act--that tells how long I have been
around here--in all of these statutes, where law enforcement
issues and privacy issues have been on the table, it ultimately
requires some consensus and tradeoffs on both sides.
Law enforcement may need ``A'' and clarification of its
authority to do something, but at the same time Congress needs
to be looking at the need for adjustments on the privacy side
so that there is an increase in privacy as well as law
enforcement and national security. Every time you have been
able to find that kind of balance so that everyone has
something to gain from it, you have a chance to craft
meaningful legislation.
Senator Feinstein. I am really heartened to hear that. Your
testimony today, for me, was a major step forward from what I
have been hearing for the last 6 years, and I just want to
thank you and commend you for it.
If anybody has any other comments to make on that, I would
like to hear them, but I would like to ask Ms. Borsecnik
something about your written statement just very quickly. You
implied that AOL doesn't read private online communications,
but you said that you carefully monitor your children's chat
rooms and message boards.
Ms. Borsecnik. Right.
Senator Feinstein. How do you do this?
Ms. Borsecnik. Well, there is a difference between private
and public communications online. Private communications are e-
mail and instant messages. They are one-to-one. They are sent
in privacy. There are also public areas online. Chat rooms are
public areas and message board areas are public areas. That is
very clear to users.
In our policies, we set forth our policy, as you
reiterated, on private communication. We also say that we hold
our members to a certain conduct standard online, particularly
in the areas that are targeted at kids and teens, and that we
monitor what goes on in that area. Typically, the kind of
transgressions we act against are your pretty typical profanity
or threatening other members, the things that go on just sort
of on a normal basis among----
Senator Feinstein. Do you send this to all members?
Ms. Borsecnik. Members review that all----
Senator Feinstein. You have never sent it to me. I am a
member.
Ms. Borsecnik. When you first registered with America
Online and we talked to you about what we call our terms of
service, that information is included in that. And you are
required as part of the registration process to click a button
that said I have read this and I agree to the terms of service.
Senator Feinstein. I never did.
Ms. Borsecnik. It is also available online in a number of
places where you can find it easily. I can send you a link or
whatever. But, clearly, ensuring that people are aware of what
those policies are is important for a variety of reasons, not
the least of which is ensuring an enjoyable experience online,
not only a safe and privacy-secure one, but an enjoyable
experience for the rest of our customers.
So we have rules of the road just like any other community,
and in an online environment it is a little harder to convey
what those rules are because people are anonymous. You wouldn't
tend to stand up in a public forum and be profane. In an online
environment where there is anonymity, we take extra efforts to
explain to people what those community guidelines are. And that
is even more true in the public arenas, as you mention, but we
do have strict policies against private arenas, which are e-
mail, for example.
Senator Feinstein. Could you send me some of that
information that everybody gets? I would love to see it.
The Chairman. I wouldn't mind receiving it, also.
Ms. Borsecnik. I will send it to all of you.
Senator Feinstein. Thank you.
The Chairman. That would be great.
Senator Feinstein. Thank you very much. Let me just ask one
other question about children. I think we all agree that
children present certain distinctive privacy issues due to
their greater vulnerability. So I think it follows that
children should be treated differently by Web sites operators
and online service providers. The tricky issue, I think, is how
do you determine when one actually is a child and when one
isn't a child.
I would be interested in hearing from each of you as to how
a Web site operator or an online service provider could go
about determining whether an individual is really a child or
not.
Ms. Borsecnik. I will answer that first. It is a little
easier for AOL because to use AOL, you become a member. You
need to use a credit card to become a member, and so it is not
typical for children to have credit cards. We make it very
clear in the registration process that to register as a member,
you need to have a credit card and you need to be 18 years or
older.
Then, furthermore, we very aggressively encourage parents
with children in the household to set up separate screen names
for those children and designate them in certain age categories
so that we can block certain functionality or areas on the
Internet or our service from those kids.
Senator Feinstein. Could you send me that information as
well?
Ms. Borsecnik. Yes, that will all be included and it is all
explained in that document.
Senator Feinstein. Thanks. I appreciate it. Thank you.
Anybody else on that? Yes, sir.
Mr. Fischbach. We are in the video game business and it is
a real, ever-present question to us as to how we determine who
a child is because it is certainly easy for them to say that
they are not a child, or they just come onto the site and look
around or they drop their e-mail address.
The guidelines that we have chosen to follow are pretty
clear in terms of what we use that information for, so we don't
ask for his address. We don't ask for financial data, we don't
ask for medical records, we don't ask for credit cards. The
most that we ask for is an e-mail address at that juncture.
What we are trying to determine as an organization and also as
a company is how much further should we go in order to
determine whether he or she is or is not a child.
Should we ask them to give us her parent's address or e-
mail address? Should we ask for a telephone number for them?
The more information that we attempt to extract, the more
information we then have available to us and we are not
interested in that information. We are not interested in
somebody coming back. So it is really a question, and we as an
industry organization are trying to look at how to best handle
that situation. There is not a 100 percent answer.
One of the ways that we just attempted to look at it was
just to limit the amount of information because kids will come
online and play games. They will ask for information about our
next products. They will want to know if we have got a bug--if
there is a bug in a game, and all software has bugs, if there
is a fix for it. If I can't get from level 12 to level 13, how
do I do it? And they will come and ask that information and we
will pass information back to them. So it is a difficult issue
and I don't know how we do it. There is not a 100-percent pure
answer for it.
Senator Feinstein. Please, anybody that wants to comment.
Mr. Bodoff. I was going to say the answer is easy to say we
require parental verification before you can collect
information from a child. What is difficult is determining what
is parental verification, and we are really looking forward to
some new technology approaches and new ideas. What we are using
now is basically what the Federal Trade Commission has
referenced, and we use as examples credit cards or e-mail
information from the parents before you can actually accept
personally identifiable information from the child.
But we all know children are creative, and that is a
challenge. And we all, I think, in the business community are
going to be looking for different ways of trying to improve
upon that, but we definitely have a criteria that you cannot
collect information from a child under the age of 13 without
parental verification.
Senator Feinstein. Could I ask a question? Why was 13 set
as the age?
Mr. Bodoff. We are modeling after the Online Privacy Act,
the Children's Online Privacy Act, the Online Privacy Alliance.
It is the feeling that I think--and I am not an expert in the
children's area, but below 13 children do not have enough
cognitive sense to be able to make the right decision when
somebody is asking them to solicit information and how that is
being used. And above that age, children start having that
capability and there is a higher confidence level with that.
Senator Feinstein. Anybody else on that?
[No response.]
Senator Feinstein. I think that is it. Thank you very much,
Mr. Chairman.
The Chairman. Thank you, Senator Feinstein.
Let me just finish with one or two. Mr. Fischbach, I know
you did not come here to testify about the nature of the
products you sell and make available over your Web site, but
many in America are trying to come to grips with the terrible
tragedy that occurred yesterday in Colorado, and really in Salt
Lake City as well, but especially in Colorado, where two
dysfunctional young men murdered as many as 14 fellow students
and a teacher, and then turned the guns on themselves.
I predict that we will learn over the coming days that
those Trenchcoat Mafia boys were obsessed with death and
killing, and that much of what fueled their obsession came from
the Internet and other media sources. In my opinion, our young
people are exposed to too much violence and killing in our
popular culture. You turn on a television set and you have got
murder happening all the time. You flip through any number of
the channels and it is hard to find a show where somebody is
not being killed. You listen to today's music and its obsession
with death and distress, groups like Marilyn Manson, which
apparently these Trenchcoat Mafia members idolized.
Another source for violence and death, of course, is video
games. And I am not meaning to pick on you, but I would like to
have you answer this because I think it is important for all
people in this industry to realize that we watch stuff like
this. Take, for example, Acclaim's ``Shadow Man.'' Now, I would
note that Acclaim has many games on the Web site that are
totally all right and that are not violent.
This morning, however, we went to your Web site and took a
look at some of the other games your company offers and
stumbled across ``Shadow Man.'' Now, here is how your game
information Web page reads, ``A killer is coming walking
between worlds, trailing death from live side to dead side. A
dead man is coming, scull in one hand, gun in the other, a
voodoo mask in his chest and lines of power in his back. A
possessed man is coming, stalking killers in tenements and
deserts, subways and swamps, spirit world and real world.
Shadow Man is coming, voodoo slave and hero, hitman and dead
man. Sometimes, it takes a killer to stop a killer. Uniquely
terrifying third-person adventure. Enter the dark world of Mike
Leroy, hitman, dead man, Shadow Man. Blow your enemies away
body and soul. Go in armed with voodoo power and gunpowder.
Pack weapons like the 50-magnum Desert Eagle, the Violator, the
Flambeau, the Calabash, and many more. Unravel the dark
mysteries or die trying. More than just another blood-drenched
shootout.''
Now, could you tell us how many people access ``Shadow
Man'' on your Web site daily? Do you have that kind of
information.
Mr. Fischbach. We can provide that to the committee if the
committee was interested in that.
The Chairman. OK.
Mr. Fischbach. I can say we are equally as appalled with
what happened in the schoolyard as you and everybody else.
The Chairman. No, I don't mean to blame you for that, but I
just cite this because it seems to me this is one of the
illustrations of what is happening in our society.
Mr. Fischbach. I think, in part, there are lots of factors
that take place in what goes through young people's minds--what
kinds of homes they come from, how they are dependent on other
people, whether their families are really dysfunctional.
We also have a very open gun environment in our society,
where anybody can go buy weapons and anybody can buy ammunition
to do what they please with. Yet, we don't sometimes point at
those issues and say maybe that is part of the problem as well.
There have been lots of studies that have been done with
respect to violence and video games or violence and television
or violence and motion pictures, most of which conclude that
that is not the cause, especially of people like these young
men here, as to why they become dysfunctional in our own
society and do acts that we are all appalled by. So it is very,
very difficult, and it is an issue that we all are confronted
with. I mean, Kosovo is on the front page, as well as this
other one, and we deal in a society that is very violence-
oriented.
The products are a fantasy, and the products are a fantasy
no different than a book or a film or a television show. And
both of us know that you can't go from life side to dead side,
which is the fantasy to begin with. And the game is really an
adventure game that is very suspenseful as you go through. It
is based on a comic book, not unlike many of the films or many
of the books that have already been turned into films or video
games. It is part of our culture.
The Chairman. Well, as you can see, you are making a pretty
good case that we have got a culture that seems to foster this.
I remember the Tupac Shakur matters and how he was calling for
killing police people and a lot of other things like that.
For our information, it would be interesting for me to know
how many people access ``Shadow Man'' on your Web site daily,
whether or not you know how many of them are children, and how
many video-depicted killings they engage in in a typical round
and, in addition, if you could tell me whether you share my
view that there is a collective dumbing-down of young people's
attitudes toward violence. And I am not blaming you or the
Internet solely. There is no question that the Internet has its
bad side.
Mr. Fischbach. With respect to ``Shadow Man'' or the sports
games that sit on our Web site at this point in time, that is
mere publicity and I don't believe there is a downloadable
function from that, except they can take a visual if they want
to take a visual from it. But there is no game-play that is up
on our Web site that we have released at this juncture. So all
it is is a statement about what the game contains, and I think
some pictures about what the game contains.
The Chairman. OK.
Mr. Fischbach. And in terms of the number of people or
whether they are children or not, we don't ask them. So you can
access our Web site without asking our permission, whether you
are a child or not.
The Chairman. But even if you did, you may not be able to
know. These kids are very clever.
Mr. Fischbach. The game also carries an ``M'' rating on it,
so the game is identified for a mature audience. It is not
identified for children.
The Chairman. I see. You know, I held a hearing on Internet
sales of alcohol and I figured that would be an interesting
hearing. You can't believe the fur that has been stirred up
because of that, and you can't believe the arguments on all
sides of that issue. I mean, it was really amazing how complex
and difficult it was, as certainly exists with this.
I didn't mean to pick on you, but I thought I would bring
that out because we all know that there are problems with the
Internet. We all know there are things that are wrong about the
Internet. We all know there are many, many wonderful things
that are right about it, too, and I would like to accentuate
the ``rights'' and see what we can do to alleviate the
``wrongs.''
Senator Feinstein. Mr. Chairman, would you let me ask just
one quick question?
The Chairman. Sure.
Senator Feinstein. Would you agree that this adds to the
culture of violence that is being promoted in the United
States?
Mr. Fischbach. I can't answer that question because--I
personally don't think so. I think the culture that we live in
is reflective of lots of other environments, and I think with
respect to the culture that we live in today with respect to
how we use guns and ammunition, which I am highly opposed to, I
think we are wrong. I think there is no legislation that deals
with guns that is really effective.
When we talk about what should exist and what shouldn't
exist, and you say we are going to point it toward a film or we
are going to point it toward a book and we are going to say,
OK, that is the answer, I think that is a real simple approach.
I mean, it is like a check mark, and if you looked at some of
the other things that exist in our society, because we have
access to all kinds of information, just not what sits on our
Web site, but what sits in public records and what sits in
libraries, what sits in films, it all has an influence.
So you either take a paint brush and eradicate it all or
you deal with it as a society through education. But there are
elements in our society that can be dealt with, such as
weapons, because there is no reason why anybody, especially a
17-year-old kid, should walk around with a gun or be able to go
buy ammunition.
Senator Feinstein. Of course, I happen to agree with that.
Mr. Fischbach. Thank you.
Senator Feinstein. And I have tried very hard, which is not
an easy thing to do around here.
The Chairman. I give her an opportunity every chance I get.
[Laughter.]
Let me tell you, we already have a law that forbids selling
of guns to minors. It isn't perhaps working, and there is no
easy solution because we have people all over this country who
value their right to keep and bear arms. We have those who
abuse that right. But again, as Senator Feinstein has said,
there is a culture here that no one individual, no one
business, no one entity is to blame for all of it. But I think
we all need to work on it and that is the only reason I raised
that.
Let me just say one last thing here. As I noted in my
opening statement today, much of the discussion about possible
solutions revolve around two exclusive models, either
Government regulation by the FTC, the FCC, or some other
regulatory body, or sole industry self-regulation. Mr. Berman,
you have indicated we ought to go as far as we can on self-
regulation, but there is going to have to be some aspect of
regulation.
As many argue against the merits of either one of these
solutions, I think it would be productive to explore whether
another solution possibly exists; for example, examining quasi-
governmental self-regulatory models that have been successful
in other industries. That is what we need to do, it seems to
me. I think it is important to not establish rigid rules in
this area, and instead have a flexible system in place that can
respond quickly to changing consumer preferences and new
technologies, like digitalme, perhaps, designed to give
consumers more control over personal identifiable information.
I don't know whether we have enough information about what
it is exactly that consumers expect in terms of privacy
protection, or even how this is effected. A flexible system
would best be accomplished through self-regulation by members
of the electronic community who are aware of consumer demands
and expectations, it seems to me.
I would like to get your views on whether a model similar
to the one in the securities industry could be useful to
address privacy on the Internet, a model where the basic codes
of conduct are established by the industry with limited
Government oversight to provide for a level of consumer
confidence in the process.
Now, if you believe it could be a useful model, I would
kind of like to conclude this hearing by asking you to work
with me over the coming days and weeks to develop a reasonable
but limited legislative proposal that might help to solve some
of the problems that all of you recognize exist in ways that
don't stifle the industry and don't stifle innovation and
creativity.
I think that is a pretty big assignment, but that is one
reason why we are holding this hearing to see if we can find
some methodologies or some ways of solving these problems that
will protect society, and yet make sure that we continue to go
forward as the leaders in the world in this area.
So why don't I start with you, Mr. Wladawsky-Berger, and
then maybe you, Mr. Sheridan; you, Borsecnik; and Messrs.
Berman, Bodoff and Fischbach. You don't all have to comment,
but if you would like to.
Mr. Wladawsky-Berger. Mr. Chairman, clearly, what should
unite us here is the fact that we want the potential of the
networked economy for the Nation to be fulfilled and all the
positive things to happen and eliminate the negatives. And what
that really means is that it is all very pragmatic. We are
after a common objective, and if there are things that are
highly targeted that can help us better achieve that objective
within a self-regulatory mechanism, we would be very happy to
work with you and investigate what those things might be.
As I said in my testimony, and as we have discussed through
the hearing, the only concern, or the main concern we have is,
because things are moving so fast in such a complicated area,
that we have regulations that will not work and that will make
it harder for the objectives to be accomplished.
However, if we can find highly selected areas where we can
do some good, and we talked about protection of minors as one;
protection of very sensitive information like medical records
might be another that can help start setting the right
mechanisms. And as we learn more, we learn more of what else to
do. We will be very happy to work with you and see what makes
sense.
The Chairman. Well, as you know, one reason we held the
Microsoft hearings was not just to try and resolve some
problems that exist, but basically, I am a firm believer that
unless we attack these problems now, you are going to have an
over-regulatory nature, and that would be very detrimental to
the Internet and to our future and to our future governance of
these innovative and creative matters.
So I think those hearings have proven to be the beginning
of something very important. And I don't wish my friends at
Microsoft any harm. I think the world of what they have been
able to do, but there were some things that needed to be
corrected and I think they are going to be corrected in the
end.
And it is important that we move in these directions
because the last thing on Earth I want is an over-regulation of
the Internet. But at least I have seen from the shaking of
heads that all of you kind of indicate that there needs to be
something here. And I don't want these wonderful, genius
Members of Congress to just come up with it themselves. My
experience has been that they may have a genius of sorts, but
without an awful lot of help, we could really screw up the
Internet, and I don't want to see that happen.
Mr. Sheridan, do you have any comments about that?
Mr. Sheridan. Yes. We would, Mr. Chairman, be more than
happy to work with you on a middle way, something in between.
The Chairman. Put some time into it because, you know, you
have been right in the middle of all this. And, you know, my
experience with the Internet creators is that they just love to
burrow in and solve the engineering problems, but they are not
really concerned about the legal problems or the statutory
problems.
Mr. Sheridan. Social problems.
The Chairman. Social problems, yes, and I think you are
going to have to be because the last thing on Earth you want is
to have us come in here with a heavy hand.
Mr. Sheridan. We agree.
The Chairman. That is where it is headed, I can tell you,
and I am trying to stop it with everything I can. And I think
in the end, Microsoft may not thank me, but the fact of the
matter is I think they will be better off in the end as well.
Mr. Sheridan. We would be very happy to explore new models
and look at what has worked, how can it be simple and flexible
around a model that, as you were saying, is a hybrid. We would
be glad to participate in that, and we would also like to see
what laws could be better enforced, say, around medical issues
and things that are----
The Chairman. Right. Well, see, that is another big issue.
I am very, very concerned. People say, well, we should be able
to disclose people with emotional illness so they can't get
guns. Well, there are a myriad set of problems there,
everything from litigation and malpractice to--I mean, it is
mind-boggling. And I would like to do that. I mean, I would
like to be able to find some way that we could prevent that
without destroying people's lives or their privacy, and it is
pretty hard to do. But you folks, I think, may have the keys to
do that.
Ms. Borsecnik, as you know, I have tremendous respect for
AOL and I have been very impressed with you here today, but do
you have any comments on this?
Ms. Borsecnik. Well, I think the issue you just brought
up--we keep using the example in the health care industry--
conveys the concern of the one-size-fits-all issue. And I think
Senator Kohl's suggestion of a commission that looks further
into all the various sectors that are affected by privacy----
The Chairman. A commission that might be supervised by the
Government, you are saying?
Ms. Borsecnik. Yes, because I think, as you said at the
beginning, we are in the first inning on this discussion and
the debate because of the myriad of complicated issues and
industries involved. And we encourage that kind of discourse
because only through that will we be able to focus on a
solution that provides a standard that is acceptable, but is
workable across a variety of businesses and a variety of
consumer concerns.
The Chairman. I am going to come to you last, Mr. Berman,
since you have been the one who has been so crass as to
recommend this process.
Mr. Bodoff.
Mr. Bodoff. The only thing I would add--and I have heard
from two of our sponsors, AOL and IBM at the table here with
me, and that is probably reflective of the other companies who
have been instrumental in building our program--is that
whatever happens, we don't do anything that discourages
companies from joining self-regulatory activities.
We have a great challenge in front of us now. We have got
to get out and educate businesses and we have got to get
businesses to make a commitment. And we are only open a month
and we have some very aggressive plans, and I think if we were
talking at the end of the year, we would see some very
interesting results, the danger being in any activity that
holds out something else and lots of companies who may be
moving toward a self-regulatory approach right now hold off
because they are waiting for something else. They are fearful
of something else or something else is happening. So I would
only ask that that be given consideration in any action that
takes place.
The Chairman. Thank you. Mr. Fischbach.
Mr. Fischbach. Well, I think that as we continue moving
forward, I put down in my notes paint brush as opposed to a
small, thin brush, because each particular sector is going to
have its own particular issues. And if we are too broad in
whatever we attempt to do from a congressional standpoint, I
think that the answer will probably harm us as oppose to help
us with respect to the economics that can come from the
Internet, plus the fact that it is really a worldwide issue. It
is not just a local issue as to what takes place in the United
States because of the access of information and where you can
set your sites up.
We would be happy to participate in some sort of a body
which would study and make recommendations in terms of how to
handle this, the suggestion of a commission to work on what
kinds of legislation or rules should be passed. The problem, I
think, is we know where we are today; we are not sure where we
are going to be in 3 to 4 years from today and what changes
will take place in technology and how we will move information
back and forth. Some of it we can anticipate, but it will
change the way that all of us do business and it will change
the way that we access information.
The Chairman. Thank you. Now, Mr. Berman, we will let you
sum up for everybody.
Mr. Berman. I think that we are all committed to the growth
and dynamism of the Internet, and we want to make sure that it
has the right fundamental law, and that commerce goes on and
privacy is protected, and the free flow of information. And I
think that the right approach is somewhere between these
extremes, which is to really hone in and work together to bring
the industry and the privacy advocates and policy experts
together and try and work through these issues, to find the
flexible--it doesn't have to be one-size-fits-all, but to work
toward resolving some very hard issues of how to get fair
information practices out on the Net. So we are pleased to work
with you and the committee. We have done it before and we will
do it again.
The Chairman. Well, let me just challenge all of you to
really live up to that because I would like to have the very
best ideas you have. This committee has been doing some pretty
good things in this area, in my opinion, and we are capable of
doing many more good things, but we have got to have the right
advice and the right counsel to be able to do them right.
You know, there are so many problems, but I cite this
problem. Since yesterday's murders in the Colorado school, I
have been hit all over the place by people saying, well, we
have got to have disclosure, at least from a weapons
standpoint, of people's mental illness. The mental illness
societies are going berserk over this because they know that
once that starts, they are going to be discriminated against if
it isn't handled absolutely right.
Can it be handled absolutely right? Can we do something
that really is a privacy type of thing that will work so that
people are not discriminated against who have had an emotional
disturbance at one time in their lives? If the truth is known,
probably every one of us has suffered emotionally from time to
time. Whether it rises to the dignity of having to have special
professional help or not is another matter.
But it is a big problem because everybody comes up with
these broad-brush--you know, we have got to stop all weapons,
or we have got to do this, or we have got to make sure nobody
who has an emotional illness or even emotional distress has
access to weapons. Well, that is just one very small, little
aspect of this whole thing. You get into all the others, credit
cards right on through, and it is almost mind-boggling.
And you are kind of suggesting a private sector commission,
set up maybe by the industry, that is supervised by maybe some
sort of governmental supervision or regulation. My problem with
Government is, once regulation starts, it becomes a stifling
aspect to what really is, in the minds of many, one of, if not
the most important set of opportunities in America's history,
and one of, if not the most important industry in America right
now, because from this industry almost everything we do in the
future is going to be connected.
So we would really like to have some ideas here before some
people want to ram through some idiotic, stupid approach toward
this that creates another Internet IRS, which goes from a few
hundred pages to 6,000 pages overnight. I just don't want to
see that happen.
This has been a very good hearing. We are very grateful to
each and every one of you for coming because each of you has
expressed different aspects of this set of problems, and I
think it has been a very, very good panel. So thank you so
much.
With that, we will adjourn until further notice.
[Whereupon, at 12:51 p.m., the committee was adjourned.]
[GRAPHIC] [TIFF OMITTED] T8199.110
[GRAPHIC] [TIFF OMITTED] T8199.111
[GRAPHIC] [TIFF OMITTED] T8199.112
[GRAPHIC] [TIFF OMITTED] T8199.113
[GRAPHIC] [TIFF OMITTED] T8199.114
[GRAPHIC] [TIFF OMITTED] T8199.115
[GRAPHIC] [TIFF OMITTED] T8199.116
[GRAPHIC] [TIFF OMITTED] T8199.117
[GRAPHIC] [TIFF OMITTED] T8199.118
[GRAPHIC] [TIFF OMITTED] T8199.119
[GRAPHIC] [TIFF OMITTED] T8199.120
[GRAPHIC] [TIFF OMITTED] T8199.121
[GRAPHIC] [TIFF OMITTED] T8199.122
[GRAPHIC] [TIFF OMITTED] T8199.123
[GRAPHIC] [TIFF OMITTED] T8199.124
[GRAPHIC] [TIFF OMITTED] T8199.125
[GRAPHIC] [TIFF OMITTED] T8199.126
[GRAPHIC] [TIFF OMITTED] T8199.127
[GRAPHIC] [TIFF OMITTED] T8199.128
[GRAPHIC] [TIFF OMITTED] T8199.129
[GRAPHIC] [TIFF OMITTED] T8199.130
[GRAPHIC] [TIFF OMITTED] T8199.131
[GRAPHIC] [TIFF OMITTED] T8199.132
[GRAPHIC] [TIFF OMITTED] T8199.133
[GRAPHIC] [TIFF OMITTED] T8199.134
[GRAPHIC] [TIFF OMITTED] T8199.135
[GRAPHIC] [TIFF OMITTED] T8199.136
[GRAPHIC] [TIFF OMITTED] T8199.137