[Senate Hearing 107-852]
[From the U.S. Government Publishing Office]
S. Hrg. 107-852
PRIVACY, IDENTITY THEFT, AND THE PROTECTION OF YOUR PERSONAL
INFORMATION IN THE 21ST CENTURY
=======================================================================
HEARING
before the
SUBCOMMITTEE ON TECHNOLOGY, TERRORISM,
AND GOVERNMENT INFORMATION
of the
COMMITTEE ON THE JUDICIARY
UNITED STATES SENATE
ONE HUNDRED SEVENTH CONGRESS
SECOND SESSION
__________
FEBRUARY 14, 2002
__________
Serial No. J-107-60
__________
Printed for the use of the Committee on the Judiciary
85-061 U.S. GOVERNMENT PRINTING OFFICE
WASHINGTON : 2003
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512-1800
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON THE JUDICIARY
PATRICK J. LEAHY, Vermont, Chairman
EDWARD M. KENNEDY, Massachusetts ORRIN G. HATCH, Utah
JOSEPH R. BIDEN, Jr., Delaware STROM THURMOND, South Carolina
HERBERT KOHL, Wisconsin CHARLES E. GRASSLEY, Iowa
DIANNE FEINSTEIN, California ARLEN SPECTER, Pennsylvania
RUSSELL D. FEINGOLD, Wisconsin JON KYL, Arizona
CHARLES E. SCHUMER, New York MIKE DeWINE, Ohio
RICHARD J. DURBIN, Illinois JEFF SESSIONS, Alabama
MARIA CANTWELL, Washington SAM BROWNBACK, Kansas
JOHN EDWARDS, North Carolina MITCH McCONNELL, Kentucky
Bruce A. Cohen, Majority Chief Counsel and Staff Director
Sharon Prost, Minority Chief Counsel
Makan Delrahim, Minority Staff Director
------
Subcommittee on Technology, Terrorism, and Government Information
DIANNE FEINSTEIN, California, Chairperson
JOSEPH R. BIDEN, Jr., Delaware JON KYL, Arizona
HERBERT KOHL, Wisconsin MIKE DeWINE, Ohio
MARIA CANTWELL, Washington JEFF SESSIONS, Alabama
JOHN EDWARDS, North Carolina MITCH McCONNELL, Kentucky
David Hantman, Majority Chief Counsel
Stephen Higgins, Minority Chief Counsel
C O N T E N T S
----------
STATEMENTS OF COMMITTEE MEMBERS
Page
Cantwell, Hon. Maria, a U.S. Senator from the State of Washington 19
Feinstein, Hon. Dianne, a U.S. Senator from the State of
California..................................................... 1
Grassley, Hon. Charles E., a U.S. Senator from the State of Iowa. 53
Hatch, Hon. Orrin G., a U.S. Senator from the State of Utah...... 54
Kyl, Hon. Jon, a U.S. Senator from the State of Arizona.......... 17
Thurmond, Hon. Strom, a U.S. Senator from the State of South
Carolina....................................................... 63
WITNESSES
Avila, Jonathan D., Executive Counsel, Walt Disney Company,
Burbank, California............................................ 34
Comer, Douglas B., Director of Legal Affairs and Technology
Policy, Intel Corporation, Washington, D.C..................... 30
Fisher, Susan, Executive Director, Doris Tate Crime Victims
Bureau, Carlsbad, California................................... 27
Gregg, Hon. Judd, a U.S. Senator from the State of New Hampshire. 3
Stana, Richard M., Director, Justice Issues, General Accounting
Office, Washington, D.C.; accompanied by Danny R. Burton,
Assistant Director, Dallas Field Office, General Accounting
Office; and Ronald J. Salo, Senior Analyst, Dallas Field
Office, General Accounting Office.............................. 6
Torres, Frank, Legislative Counsel, Consumers Union, Washington,
D.C............................................................ 38
SUBMISSIONS FOR THE RECORD
American Electronics Association, William T. Archey, President
and CEO, Washington, D.C., February 12, 2002, letter and
attachment..................................................... 49
American Medical Association, Division of Legislative Counsel,
Washington, D.C., statement.................................... 50
Intel Corporation, Jeff P. Nicol, Customer Privacy Manager, e-
Business Group, Santa Clara, California, statement............. 55
NCR Corporation, Laura Nyquist, Chief Privacy Officer, Dayton,
Ohio, statement................................................ 59
Privacy Times, Evan Hendricks, Editor/Publisher, Washington,
D.C., statement................................................ 60
PRIVACY, IDENTITY THEFT, AND THE PROTECTION OF YOUR PERSONAL
INFORMATION IN THE 21ST CENTURY
----------
THURSDAY, FEBRUARY 14, 2002
U.S. Senate,
Subcommittee on Technology, Terrorism, and Government
Information,
Committee on the Judiciary,
Washington, DC.
The Subcommittee met, pursuant to notice, at 2:37 p.m., in
room SD-226, Dirksen Senate Office Building, Hon. Dianne
Feinstein, presiding.
Present: Senators Feinstein, Cantwell, and Kyl.
Chairperson Feinstein. In the interest of time, I think we
will probably start. The Ranking Member has been delayed. He
will be along very shortly, but Senator Gregg, we are delighted
to have you here. I know Senator Kyl would like also to hear
your remarks, probably more than my remarks, so why do I not go
ahead and quickly make my remarks, and then in the meantime, he
should be here to hear yours, if that is agreeable with you.
Senator Kyl. I appreciate it. Whatever the Chairman wishes
to do is fine with me.
OPENING STATEMENT OF HON. DIANNE FEINSTEIN, A U.S. SENATOR FROM
THE STATE OF CALIFORNIA
Chairperson Feinstein. All right. Let me just begin then by
thanking you for your work on the Social Security numbers. I
know you are going to speak about that and I will let you do
it, but it has been a great pleasure for us to be able to work
with you and I want you to know that.
In 1928, Supreme Court Justice Louis Brandeis described
privacy, and I quote, as the ``right most valued by civilized
people,'' and he defined it simply as the right to be left
alone. With the advent of instant communication, the
preservation of this right, I very deeply believe, is at risk.
There are ominous signs that we are losing control over our
personal information. Here are just a few examples.
Some websites store and sell data on the most intimate
aspects of our personal lives--where we live, the value of our
homes, the mortgages that we have, our financial histories, and
even our medical conditions. Your Social Security number today
can be purchased for as little as $25 on the Internet. One
medical information service has, and can distribute at will,
data bases containing the phone number, the gender, and the
address of 368,000 people with clinical depression or 3.3
million people with allergies. And according to one privacy
advocate, a typical person's name and address are known to 500
companies or more. So without a doubt, the threat posed by the
misuse of personal information is there and needs to be
addressed.
First, as the General Accounting Office will report today,
identity theft crimes continue to surge. Identity theft occurs
when another person literally steals your identity for profit
or other illicit motive. Recently, the Federal Trade Commission
reported that identity theft was the largest complaint on the
Commission's consumer complaint list last year, representing 42
percent of its 204,000 complaints. Some privacy groups estimate
that as many as 750,000 people a year are victims of this
crime.
Second, stalkers and others with criminal intent can
increase their ability to harm their victims by gaining access
to their personal information. We will hear today from Susan
Fisher, whose brother was killed by an ex-girlfriend who
stalked him by gaining access to his personal records.
Third, many people simply do not want their personal
information, such as the amount of their bank account, the type
of medications they take, or their home address, widely shared
with other people, and I deeply believe that they have that
right to privacy.
Some have suggested that in light of the ongoing war on
terror, privacy needs to take a backseat to issues of safety
and security. I strongly challenge this view. Protecting basic
consumer privacy is compatible with enhanced security. In fact,
the goals of privacy and security are often complementary.
The recent acts of terror show how personal information can
be misused to advance terrorist or other criminal activities.
According to the Social Security Administration, six of the 19
hijackers in the September 11 attack were using Social Security
numbers illegally. Moreover, an al Qaeda associate recently
testified that the organization trained its operatives how to
obtain stolen licenses, credit cards, and Social Security
numbers.
It also must be acknowledged that efforts to protect
privacy must be balanced with the benefits so many Americans
enjoy because of the widespread use of personal information.
Many of us appreciate the ability to get instant credit, locate
long-lost college friends, purchase items swiftly on the
Internet, or be notified of products that might interest us.
Therefore, I believe it is critical that any initiative on
privacy strike a proper balance, and I think we have crafted
legislation to do just that.
Today's hearing will discuss the need for comprehensive
legislation to deter identity theft and protect personal
privacy. It will specifically address S. 1055, the Privacy Act
of 2001. I want to take just a brief moment to describe the
bill because it sets out where I stand on privacy.
The Privacy Act of 2001 creates a two-tiered system of
privacy protection that recognizes that not all information is
equally sensitive. For your most sensitive information, the
bill requires that companies get your consent before they sell
the data. It is called opt-in. For example, under the Privacy
Act, you must give your consent before a bank can sell
information about your account balance, the stocks you own,
your spending habits, or other personal financial data. That is
opt-in.
You must give your consent before a school, university,
life insurer, or any other entity sells or markets your
sensitive health data, such as your mental state, your disease
status, or the prescriptions that you buy. That is opt-in.
You must give your consent before the sensitive information
on your driver's license, such as your driver's license number,
your height, your weight, your sex or birthdate, can be sold.
That is opt-in.
The Privacy Act will also stop the practice of companies
selling Social Security numbers to any member of the public who
wants your number.
However, to reflect the legitimate needs of business, the
Privacy Act proposes a lower threshold for the sale of less-
sensitive information, such as a person's name and address.
Under this lower threshold, businesses must give notice of
their intent. They must give notice of their intent to use this
information. After giving notice, the business can sell this
less-sensitive data unless the individual tells them not to.
That is opt-out.
We have an impressive roster of witnesses at today's
hearing. As I mentioned, Senator Judd Gregg, who has shown a
lot of leadership on this subject, will testify as a first
panel on the privacy of Social Security numbers.
In the second panel, the GAO will give preliminary results
of its year-long study of identity theft.
In the third panel, we will hear testimony on this bill
from Susan Fisher of the Doris Tate Crime Victims Bureau, Frank
Torres of the Consumers Union, Doug Comer of Intel, and John
Avila of the Disney Corporation.
Senator Kyl should be along momentarily, but in the
interim, Senator Gregg, I will turn to you now.
Senator Gregg. Thank you, Senator.
Chairperson Feinstein. Before you do, Senator, if I might
just put in the record the statement of Laura Nyquist, the
Chief Privacy Officer of NCR Corporation.
I would also like to include a statement from the American
Medical Association.
Finally, I will include a statement by the Privacy Times,
the testimony of Evan Hendricks. I would like to add these to
the record.
Please go ahead, Senator.
STATEMENT OF HON. JUDD GREGG, A U.S. SENATOR FROM THE STATE OF
NEW HAMPSHIRE
Senator Gregg. Thank you, Senator. I appreciate the
courtesy of your inviting me to testify at this hearing, which
is an extremely important hearing on a very topical subject,
and I congratulate you for all the work you have put into this
issue as certainly one of the leaders in the Congress and the
country on the issue of how to protect people's privacy. I have
enjoyed very much having a chance to work with you on this
issue.
Chairperson Feinstein. Thank you.
Senator Gregg. I might just start by explaining how I
became involved in this issue. On October 15, 1999, a
constituent of mine, Amy Boyer, who was a young woman who came
from my hometown of Nashua, New Hampshire, was killed by a man
who had gone on the Internet and taken possession of her Social
Security number and other personal information by using access
which he had obtained through the Internet.
Until recently, we had thought that he had only obtained
the Social Security number in order to stalk Amy, but
unfortunately, it now turns out from court documents that he
had paid a $75 fee to a company and that company had then used
what they called a pretexter, who had posed as an insurance
official and had called her and obtained personal information
from her on the pretext that he was going to give her an
insurance award, I guess. As a result of collecting that
information, they then disseminated it to this individual over
the Internet. The whole transaction, it appears, occurred via
the Internet.
Unfortunately, the pretexter's approach worked. Amy Boyer
was stalked and she was killed by this individual.
As a result of this extraordinarily tragic event and
countless others which have come to my attention and which
Senator Feinstein has mentioned have come to her attention, I
believe that we should make some changes in how information,
personal information, is conveyed and used in the marketplace
and specifically relative to Social Security numbers. Senator
Feinstein and I have worked very closely on this issue.
We have developed language, which is S. 848, the Social
Security Number Misuse Prevention Act. This Act is part of the
bill which you are discussing here today, S. 1055, as I
understand, I believe the second title of that Act. Although I
am very interested in the other issues which are raised by your
bill, I want to confine myself to the Social Security issue,
because this is where I have concentrated most of my time, and
I feel a deep personal responsibility as the representative of
the family of Amy Boyer to do something in this area, so I have
committed a considerable amount of time trying to reach
legislation which will accomplish this.
In drafting S. 848, there really is only one primary goal
and that is to ensure that people would not be able to purchase
Social Security numbers and that companies would not be able to
sell Social Security numbers without an individual giving their
consent. In introducing this legislation, Senator Feinstein and
I have worked hard to strike a delicate balance between
legitimate business and other lawful uses of Social Security
numbers, of which there are many, and our shared desire to
limit general public access to Social Security numbers because
of the significant risk of invasion of privacy that comes from
people being able to obtain your Social Security number.
We have to understand that, like it or not, the Social
Security number has become a national identifier, and in many
instances, it is the only way to ensure accurate identification
of people. Health care providers use Social Security numbers to
maintain our health records to ensure we are receiving the
services we need and we have a right to. Banks and financial
institutions use them to prevent fraud against individuals.
Social Security numbers tell them that a loan applicant is
exactly who he or she says she is.
The National Center for Missing and Exploited Children and
the Association for Children, the enforcement of support, use
Social Security numbers to track down kidnappers and deadbeat
dads. Big Brothers/Big Sisters of America uses Social Security
numbers to do background checks on volunteers to make sure they
are not people who might harm the children who they are working
with.
A truly blanket prohibition, therefore, on Social Security
numbers would probably undermine a great deal of legitimate
uses. In reality, nobody wants to do this, so we worked on
striking a balance, myself and Senator Feinstein. I believe
that we have maybe not a perfect product, but we have succeeded
in identifying and responding to the key issues in a thoughtful
and, I believe, constructive way on this matter.
Under the legislation, obtaining a Social Security number
with wrongful intent is illegal. Under the legislation, no
Social Security number may be displayed, sold, purchased
without the individual's consent, except in the cases involving
public health, national security, law enforcement, and certain
limited business-to-business transactions. No individual may be
required to provide a Social Security number when purchasing a
commercial good or services unless the Social Security number
is absolutely necessary as defined by the Act, and the
definition is limited.
Under the legislation, within 1 year, Social Security
numbers may not appear on any driver's license, motor vehicle
registration, or any other document issued to an individual for
the purposes of identification of that individual. The obvious
reason for that is that as you are going through an airport or
something and you have to show your driver's license, you
should not have to disclose your Social Security number.
Under the bill, within 3 years, Social Security numbers may
not appear on checks issued for payment by Federal, State, or
local agencies, Federal Government agencies.
Finally, on the issuance of public records, which was and
remains a very difficult issue, we worked to strike a balance
between maintaining public access and limiting the potential
for harm that comes with that access. To that end, we
considered the impact of possibly having to redact Social
Security numbers from thousands, if not millions, of public
documents. This would be a hugely expensive and labor intensive
task and it is unclear whether we would in any significant way
further reduce the illegal activity we are trying to prevent.
In other words, it is unclear whether the administrative burden
and the cost would outweigh the potential benefit, and this is
a very real concern.
Under our compromise proposal, there is no requirement for
redaction of Social Security numbers until that document is
sold or displayed to the public, and then only where the number
appears on the face of the document or in a highly consistent
and predictable place inside the document.
For example, records which are known to always contain a
Social Security number on a particular page, and in that case,
the number would need to be redacted before that document could
be sold to the public. There is no requirement that the Records
Office would have to screen through documents that might
incidentally contain a Social Security number.
Madam Chairman, every year, as many as 700,000 instances of
identity theft are reported. Limiting availability of Social
Security numbers is one important way we can address this
issue. S. 848 as it is incorporated into your bill is a well
thought out, tightly woven piece of legislation that
effectively recognizes and balances the many concerns
surrounding the issue of Social Security numbers and their
theft and misuse. Passing this legislation is one of the most
important things that the Congress can do this year to reduce
identity theft and protect individual privacy while permitting
the continued legitimate and limited use of Social Security
numbers.
Madam Chairman, I thank you for the chance to testify
today.
Chairperson Feinstein. Thanks very much, Senator Gregg. I
very much appreciate your comments. I think we have got a very
secure and good part of this bill, and perhaps you and I--I
know Senator Kyl was unavoidably detained. He is always here
faithfully on the dot. So perhaps you and I can talk with him a
little bit about it--
Senator Gregg. We will capture him somewhere.
Chairperson Feinstein [continuing]. Because I hope to move
this thing along. But thank you very much for your leadership
and for being here today.
Senator Gregg. I appreciate your courtesy.
Chairperson Feinstein. I very much appreciate it.
As you can probably tell from the buzzer and the beeper,
there is a vote going on, but what I would like to do is begin
the testimony and then perhaps 10 minutes into it, if Senator
Kyl is not able to be here, we will just take a brief break and
I can run down and vote and come back.
Let me begin with panel two and ask Mr. Richard Stana
please to come and have a seat. Mr. Stana is the Director for
Justice Issues at the GAO. During his 25-year career with GAO,
he has directed reviews on a wide variety of complex military
and domestic issues in headquarters, the field, and overseas
offices. Most recently, he has directed the GAO's work relating
to law enforcement, drug control, immigration, corrections,
court administration, and election systems. He has received
numerous awards throughout his career and he has been active in
many civic and community organizations, as well as his work
with the Federal Government.
Mr. Stana, we are delighted to have you here and we welcome
your testimony.
STATEMENT OF RICHARD M. STANA, DIRECTOR, JUSTICE ISSUES,
GENERAL ACCOUNTING OFFICE; ACCOMPANIED BY DANNY R. BURTON,
ASSISTANT DIRECTOR, DALLAS FIELD OFFICE, GENERAL ACCOUNTING
OFFICE; AND RONALD J. SALO, SENIOR ANALYST, DALLAS FIELD
OFFICE, GENERAL ACCOUNTING OFFICE
Mr. Stana. Thank you very much, Madam Chairman. I am
pleased to be here today to discuss the preliminary results of
our study on the extent or prevalence of identity theft and its
cost to the financial services industry, to victims, and to the
Federal justice system.
With me at the table are Dan Burton, Assistant Director on
this assignment, and Ron Salo, the lead analyst. Behind us is
Robert Rivas, who contributed substantially to this product.
As a matter of definition, identity theft involves stealing
another person's personal identifying information, such as
their Social Security number, date of birth, or mother's maiden
name, and then using the information to create a false identity
document to fraudulently establish credit and run up debt or to
take control of existing financial accounts in order to make
unauthorized purchases.
My prepared statement discusses in detail our preliminary
results. I would like to take this opportunity to briefly
summarize a few important points and comment on several facets
of identity theft that are addressed in S. 1055, the Privacy
Act of 2001.
The first point is that although identity theft numbers are
not easily captured and sometimes reflect different viewpoints,
the statistics we compiled indicate that identity theft
continues to rise. Data from national credit bureaus show that
the number of fraud alerts placed on consumer accounts is
increasing. The data ranges from an estimated low of about
30,000 victims annually to an estimated high of about 178,000
victims annually. Although these statistics are significant,
the lower-end figure understates the magnitude of the problem
because it does not take into account both account takeover
victims and identity theft victims. Neither estimate includes
victims whose wallets or purses were stolen but who did not
call the credit bureau.
The most current statistics compiled by the FTC's Identity
Theft Data Clearinghouse show that about 3,000 identity theft
victims call each week. Additionally, the Social Security
Administration's IG Fraud Hotline received over 65,000
allegations of Social Security number misuse in fiscal year
2001. About four of five SSN misuse allegations relate directly
to identity theft.
Statistics on arrests, investigations, and dollar losses
compiled by leading Federal law enforcement agencies, that is,
the Secret Services, the SSA IG, the IRS, the FBI, and the
Postal Inspection Service, all show an increasing trend in
criminal activity, as well as increasing law enforcement and
prosecutorial activity. But these statistics do not indicate
the full magnitude of victimization because not all incidents
of identity theft are reported and investigated, nor do these
statistics reflect activity at the State and local levels,
where most identity theft allegations are reported.
My second point is that the costs of identity theft to the
financial services industry, to victims, and to law enforcement
are substantial. The cost to the financial services industry in
terms of documented bank check fraud and Visa and MasterCard
total payment card fraud is about $1.8 billion from domestic
operations alone. Check fraud losses by banks for individual
accounts, considering both actual losses and loss avoidance,
reached an estimated $2.2 billion in 1999, which was twice the
amount of losses in 1997, according to the ABA. On average,
about $1 in $3 of check fraud losses are identity theft
related.
Visa and MasterCard reported two categories of payment card
fraud, account takeovers and fraudulent applications, which
they associate closely with identity theft. These rose 43
percent, from about $80 million in 1996 to about $114 million
in 2000. In the view of law enforcement, however, virtually all
categories of payment card fraud encompass identity theft.
Under their broader definition, the two associations' combined
total fraud losses from domestic operations alone rose 45
percent from 1996 to 2000. These statistics do not include data
from other firms, such as American Express, Diners Club, and
Discover, that comprise about 25 percent of general purpose
card markets.
It should be noted also that we found no comprehensive data
on direct fraud losses to the retail, insurance, or other
industries.
The cost of identity theft to individual victims can cause
potential severe emotional distress as well as economic harm.
Victims often feel personally violated and report significant
amounts of time trying to resolve the problems caused by
identity theft, problems such as bounced checks, loan denials,
credit card application rejections, and debt collection
harassment.
The most common harm reported to the FTC was denied credit
or other financial services. On the extreme end, victims had
been subjected to criminal investigations, arrest, or even
conviction. In terms of monetary harm, the FTC reported that
about 15 percent of the victims reporting a loss alleged losing
more than $5,000.
The cost to the Federal criminal justice system to
investigate, prosecute, incarcerate, and supervise offenders is
difficult to capture because information systems do not
separately track such costs. Nevertheless, in response to our
request, the FBI and Secret Service indicated the average cost
of an investigative matter was between $15,000 and $20,000. The
average white collar prosecution costs about $11,000. And the
average incarceration costs, about $17,000 per inmate, and
annual supervision, about $3,000 per offender.
Let me turn now--I am sorry?
Chairperson Feinstein. I am going to try to wait, ask them
to keep the vote open. You continue, and then we will recess
when you are finished.
Mr. Stana. Turning now to other aspects of identity theft,
although the scope of our work for the subcommittee did not
include an evaluation of various legislative proposals, we did
compile information that offers perspectives on various
provisions in S. 1055 that are designed to address some aspects
of identity theft.
For example, a major component of identity theft is
acquiring personal identifiers, such as SSNs or drivers'
licenses, to build false identities. According to a 1999 study
by the Sentencing Commission, drivers' licenses and SSNs are
the identification means most frequently used to generate or
breed other fraudulent identifiers. As you know, S. 1055 would
prohibit the use of SSNs and drivers' licenses for motor
vehicle registration documents.
Another potential source of personal identifiers for
identity thieves is the personal financial information sold by
financial institutions to non-affiliated third parties. Gramm-
Leach-Bliley established the opt-out standard which you
discussed before. S. 1055 would amend Gramm-Leach-Bliley to
provide consumers an opt-in standard, whereby a bank would need
prior consent of the consumers before selling personal
financial information to non-affiliated parties.
Resource levels and competing priorities can limit any one
level of government's capacity, including the Federal
Government's capacity, to address identity theft crimes. S.
1055 would empower State attorneys general to enforce the
Privacy Act. Although Gramm-Leach-Bliley does not have a
similar provision, the Act's legislative history indicates that
earlier versions of the House and Senate bills included a
similar State enforcement authority, which was dropped in
conference.
And finally, in a similar vein, resource constraints and
dollar threshold levels have limited the numbers and types of
cases that Federal law enforcement agencies have investigated.
One type of case that has not often been investigated involves
SSN misuse. Currently, the SSA IG devotes the vast majority of
its investigative resources to program integrity priority areas
rather than SSN misuse cases. SSN misuse allegations increased
more than five-fold, to about 65,000, in 2001. S. 1055 would
give SSA the authority to impose civil monetary penalties for
SSN misuse. Now, it is not clear how the SSA IG would carry out
this new authority or how many additional resources it would
require and at what cost.
Madam Chairman, this concludes my oral statement. We would
be pleased to address any questions you or other members of the
subcommittee may have.
[The prepared statement of Mr. Stana follows:]
Statement of Richard M. Stana, Director, Justice Issues, U.S. General
Accounting Office, Washington, D.C.
Madam Chairwoman and Members of the Subcommittee:
I am pleased to be here today to discuss the preliminary results of
our ongoing study requested by the Subcommittee and Senator Charles
Grassley to develop information on the extent or prevalence of identity
theft and its cost to the financial services industry, victims, and the
federal criminal justice system. Generally, identity theft involves
``stealing'' another person's personal identifying information such as
Social Security number (SSN), date of birth, and mother's maiden name
and then using the information to fraudulently establish credit, run up
debt, or to take over existing financial accounts. Although not
specifically or comprehensively quantifiable, the prevalence and cost
of identity theft seem to be increasing, according to the available
data we reviewed and many officials of the public and private sector
entities we contacted. Given such indications, most observers agree
that identity theft certainly warrants continued attention,
encompassing law enforcement as well as prevention efforts. Various
recently introduced bills, including S. 1055 (Privacy Act of 2001),
have provisions designed to enhance such efforts. While the scope of
our work did not include an evaluation of S. 1055, we did compile
information that could be useful in discussing related issues, and my
testimony today will offer perspectives on several identity theft-
related provisions of the bill.
To obtain the most recent statistics on the incidence and societal
cost of identity theft, we interviewed responsible officials and
reviewed documentation obtained from the Department of Justice and its
components, including the Executive Office for U.S. Attorneys (EOUSA)
and the Federal Bureau of Investigation (FBI); the Department of the
Treasury and its components, including the Secret Service and the
Internal Revenue Service (IRS); the Social Security Administration's
(SSA) Office of the Inspector General (OIG); the Postal Inspection
Service; and the Federal Trade Commission (FTC). Also, we contacted
representatives of the three national consumer reporting agencies
(commonly referred to as ``credit bureaus'') and two payment card
associations (MasterCard and Visa). Further, at our request and with
the consent of the victims, FTC provided us with the names and
telephone numbers of 10 victims to interview. According to FTC staff,
the sample of 10 victims was selected to illustrate a range in the
extent and variety of the identity theft activities reported by
victims. The experiences of these 10 victims are not statistically
representative of all victims.
Background
Since our earlier report in May 1998,\1\ various actions
particularly passage of federal and state statutes have been taken to
address identify theft. Later that year, Congress passed the Identity
Theft and Assumption Deterrence Act of 19098 (the ``Identity Theft
Act'').\2\ Enacted in October 1998, the federal statute made identify
theft a separate crime against the person whose identity was stolen,
broadened the scope of the offense to include the misuse of information
as well as documents, and provided punishment generally, a fine or
imprisonment for up to 15 years or both. Under U.S. Sentencing
Commission guidelines even if (1) there is no monetary loss and (2) the
perpetrator has no prior criminal convictions a sentence of from 10 to
16 months incarceration can be imposed. Regarding state statutes, at
the time of our 1998 report, very few states had specific laws to
address identity theft. Now, less than 4 years later, a large majority
of states have enacted identify theft statues.
---------------------------------------------------------------------------
\1\ U.S. General Accounting Office, Identity Fraud: Information on
Prevalence, Cost, and Internet Impact is Limited, GAO/GGD-98-100BR
(Washington, D.C.: May 1, 1998).
\2\ Public Law 105-318 (1998). The relevant section of this
legislation is codified at 18 U.S.C. Sec. 1028(a)(7)(``fraud and
related activity in connection with identification documents and
information'').
---------------------------------------------------------------------------
Prevalence of Identity Theft
As we reported in 1998, there are no comprehensive statistics on
the prevalence of identity theft or identity fraud. Similarly, during
our current review, various officials noted that precise, statistical
measurement of identity theft trends is difficult for number of
reasons. Generally, federal law enforcement agencies do not have
information systems that specifically track identity theft cases. For
example, while the amendments of the Identity Theft Act are included as
subsection (a)(7) of section 1028, Title 18 of the U.S. Code, EOUSA
does not have comprehensive statistics on offenses charged specifically
under that subsection because docketing staff are asked to record cases
under only the U.S. Code section, not the subsection or the sub-
subsection. Also, the FBI and the Secret Service said that identity
theft is not typically a stand-alone crime; rather, it is almost always
a component of one or more white-collar or financial crimes, such as
bank fraud, credit card or access device fraud, or the use of
counterfeit financial instruments.
Nonetheless, a number of data sources can be used as proxies for
gauging the prevalence of identity theft. These sources can include
consumer complaints and hotline allegations, as well as law enforcement
investigations and prosecutions of identity theft-related crimes such
as bank fraud and credit card fraud. Each of these various sources or
measures seems to indicate that the prevalence of identity theft is
growing.
consumer reporting agencies: an increasing number of fraud alerts on
consumer files
According to the consumer reporting agency officials that we talked
with, the most reliable indicator of the incidence of identity theft is
the number of 7-year fraud alerts placed on consumer credit files.
Generally, fraud alerts constitute a warning that someone may be using
the consumer's personal information to fraudulently obtain credit.
Thus, a purpose of the alert is to advise credit grantors to conduct
additional identity verification or contact the consumer directly
before granting credit. One of the three consumer reporting agencies
that we contacted estimated that its 7-year fraud alerts involving
identity theft increased 36 percent over 2 recent years from about
65,600 in 1999 to 89,000 in 2000.\3\ A second agency reported that its
7 year fraud alerts increased about 53 percent in recent comparative
12-month periods; that is, the number increased from 19,347 during one
12-month period (July 1999 through June 2000) to 29,593 during the more
recent period (July 2000 through June 2001). The third agency reported
about 92,000 fraud alerts for 2000 but was unable to provide
information for any earlier year.\4\
---------------------------------------------------------------------------
\3\ These estimates are approximations based on the judgment and
experience of agency officials.
\4\ An aggregate figure totaling the number of fraud alerts
reported by the three consumer reporting agencies may be misleading,
given the likelihood that many consumers may have contacted more than
one agency. During our review, we noted that various Web sites
including those of two of the three national consumer reporting
agencies, as well as the FTC's Web site, advise individuals who believe
they are the victimes of identity theft or fraud to contact all three
national consumer reporting agencies.
---------------------------------------------------------------------------
ftc: an increasing number of calls to the identity theft data
clearinghouse
The Identity Theft Act requires the FTC to ``log and acknowledge
the receipt of complaints by individuals who certify that they have a
reasonable belief'' that one or more of their means of identification
have been assumed, stolen, or otherwise unlawfully acquired. In
response to this requirement, in November 1999, FTC established the
Identity Theft Data Clearinghouse (FTC Clearinghouse) to gather
information from any consumer who wishes to file a complaint or pose an
inquiry concerning identity theft.\5\ In November 1999, the first month
of operation, the FTC Clearinghouse responded to an average of 445
calls per week. By March 2001, the average number of calls answered had
increased to over 2,000 per week. In December 2001, the weekly average
was about 3,000 answered calls.
---------------------------------------------------------------------------
\5\ On November 1, 1999, FTC established a toll-free telephone
hotline (1-877-ID-THEFT) for consumers to report identity theft.
Information from complainants is accumulated in a central database (the
Identity Theft Data Clearinghouse) for use as an aid in law enforcement
and prevention of identity theft.
---------------------------------------------------------------------------
At a congressional hearing in September 2000, an FTC official
testified that Clearinghouse data demonstrate that identity theft is a
``serious and growing problem.'' \6\ More recently, during our review,
FTC staff cautioned that the trend of increased calls to FTC perhaps
could be attributed to a number of factors, including increased
consumer awareness, and may not necessarily be attributed to an
increase in the incidence of identity theft.
---------------------------------------------------------------------------
\6\ FTC, prepared statement on ``Identity Theft,'' hearing before
the Committee on Banking and Financial Services, U.S. House of
Representatives (Sept. 13, 2000).
---------------------------------------------------------------------------
ssa/oig: an increasing number of fraud hotline allegations
SSA/OIG operates a fraud hotline to receive allegations of fraud,
waste, and abuse. In recent years, SSA/OIG has reported a substantial
increase in calls related to identity theft. For example, allegations
involving SSN misuse increased more than fivefold, from about 11,000 in
fiscal year 1998 to about 65,000 in fiscal year 2001. However, the
increased number of allegations may be due partly to additional fraud
hotline staffing, which increased from 11 to over 50 personnel during
this period. SSA/OIG officials attributed the trend in allegations
partly to a greater incidence of identity theft. Also, irrespective of
staffing levels, a review performed by SSA/OIG of a sample of 400
allegations of SSN misuse indicated that up to 81 percent of all
allegations of SSN misuse related directly to identity theft.
federal law enforcement: increasing indications of identity theft-
related crime
Although federal law enforcement agencies do not have information
systems that specifically track identity theft cases, the agencies
provided us with case statistics for identity theft-related crimes.
Regarding bank fraud, for instance, the FBI reported that its arrests
increased from 579 in 1998 to 645 in 2000 and was even higher (691) in
1999. The Secret Service reported that, for recent years, it has
redirected its identity theft-related efforts to focus on high-dollar,
community-impact cases. Thus, even though the total number of identity
theft-related cases closed by the Secret Service decreased from 8,498
in fiscal year 1998 to 7,071 in 2000, the amount of fraud losses
prevented in these cases increased from a reported average of $73,382
in 1998 to an average of $217,696 in 2000.\7\ IRS reported on the
extent of questionable refund schemes involving a ``high frequency'' of
identity fraud, that is, cases very likely to have elements of identity
fraud. Regarding such cases, for a 5-year period (calendar years 1996
to 2000), IRS reporting detecting fraudulent refund claims totaling
$1.76 billion and that 83 percent ($1.47 billion) of this total
occurred in 1999 and 2000. The Postal Inspection Service, in its fiscal
year 2000 annual report, noted that identity theft is a growing trend
and that the agency's investigations of such crime had ``increased by
67 percent since last year.''
---------------------------------------------------------------------------
\7\ In compiling case statistics, the Secret Service defined
``identity theft'' as any case related to the investigation of false,
fraudulent, or counterfeit identification; stolen, counterfeit, or
altered checks or Treasury securities; stolen altered, or counterfeit
credits cards; or financial institution fraud.
---------------------------------------------------------------------------
Cost of Identity Theft to the Financial Services Industry
We found no comprehensive estimates of the cost of identity theft
to the financial services industry.\8\ Some data on identity theft-
related losses such as direct fraud losses reported by the American
Banking Association (ABA) and payment card associations indicated
increasing costs. Other data, such as staffing of the fraud departments
of banks and consumer reporting agencies, presented a mixed and, in
some instances, incomplete picture. For example, one consumer reporting
agency reported that staffing of its fraud department had doubled in
recent years, whereas another agency reported relatively constant
staffing levels. Furthermore, despite concerns about security and
privacy, the use of e-commerce has grown steadily in recent years. Such
growth may indicate greater consumer confidence but may also have
resulted from an increase in the number of people who have access to
Internet technology.
---------------------------------------------------------------------------
\8\ Generally, regarding the financial services industry, the scope
of our work focused primarily on abstaining information from banks, two
payment card associations (MasterCard and Visa), and the three national
consumer reporting agencies.
---------------------------------------------------------------------------
Regarding direct fraud losses, in its 2000 bank industry survey on
check fraud, the ABA reported that total check fraud-related losses
against commercial bank accounts considering both actual losses ($679
million) and loss avoidance ($1.5 billion) reached an estimated $2.2
billion in 1999, which was twice the amount in 1997.\9\ Regarding
actual losses, the report noted that the 1999 figure ($679 million) was
up almost 33 percent from the 1997 estimate ($512 million). However,
not all check fraud-related losses were attributed to identity theft,
which the ABA defined as account takeovers (or true name fraud).
Rather, the ABA reported that, of the total check fraud-related losses
in 1999, the percentages attributable to identity theft ranged from 56
percent for community banks (assets under $500 million) to 5 percent
for superregional/money center banks (assets of $50 billion or more)
and the average for all banks was 29 percent.
---------------------------------------------------------------------------
\9\ ABA, Deposit Account Fraud Survey Report 2000. The ABA defined
``loss avoidance'' as the amount of losses avoided as a result of the
banks' prevention systems and procedures. Because the overall response
rate by banks to the survey was only 11 percent, the ABA's data should
be interpreted with caution.
---------------------------------------------------------------------------
The two major payment card associations, MasterCard and Visa, use
very similar (although not identical) definitions regarding which
categories of fraud constitute identity theft. Generally, the
associations consider identity theft to consist of two fraud categories
account takeovers and fraudulent applications.\10\ On the basis of
these two categories, the associations' aggregated identity theft-
related losses from domestic (U.S. operations) rose from $79.9 million
in 1996 to $114.3 million in 2000, an increase of about 43 percent. The
associations' definitions of identity theft-related fraud are
relatively narrow, in the view of law enforcement, which considers
identity theft as encompassing virtually all categories of payment card
fraud. Under this broader definition, the associations' total fraud
losses from domestic operations rose from about $760 million in 1996 to
about $1.1 billion in 2000, an increase of about 45 percent. However,
according to the associations, the annual total fraud losses
represented about \1/10\th of 1 percent or less of U.S. member banks'
annual sales volume during 1996 through 2000.
---------------------------------------------------------------------------
\10\ Other fraud categories that the associations do not consider
to be identity-theft related include, for example, lost and stolen
cards, never-received cards, counterfeit cards, and mail order/
telephone order fraud.
---------------------------------------------------------------------------
Regarding staffing and cost of fraud departments, in its 2000 bank
industry survey on check fraud, the ABA reported that the amount of
resources that banks devoted to check fraud prevention, detection,
investigation, and prosecution varied according to bank size. For check
fraud-related operating expenses (not including actual losses) in 1999,
the ABA reported that over two-thirds of the 446 community banks that
responded to the survey each spent less than $10,000, and about one-
fourth of the 11 responding superregional/money center banks each spent
$10 million or more for such expenses.
One national consumer reporting agency told us that staffing of its
Fraud Victim Assistance Department doubled in recent years, increasing
from 50 individuals in 1997 to 103 in 2001. The total cost of the
department was reported to be $4.3 million for 2000. Although not as
specific, a second agency reported that the cost of its fraud
assistance staffing was ``several million dollars.'' And, the third
consumer reporting agency said that the number of fraud operators in
its Consumer Services Center had increased in the 1990s but has
remained relatively constant at about 30 to 50 individuals since 1997.
Regarding consumer confidence in online commerce, despite concerns
about security and privacy, the use of e-commerce by consumers has
steadily grown. For example, in the 2000 holiday season, consumers
spent an estimated $10.8 billion online, which represented more than a
50 percent increase over the $7 billion spent during the 1999 holiday
season. Further, in 1995, only one bank had a Web Site capable of
processing financial transactions; but, by 2000, a total of 1,850 banks
and thrifts had Web sites capable of processing financial
transactions.\11\
---------------------------------------------------------------------------
\11\ Federal Deposit Insurance Corporation, Evolving Financial
Products, Services, and Delivery Systems (Washington, D.C.). (Feb. 14,
2001).
---------------------------------------------------------------------------
The growth in e-commerce could indicate greater consumer confidence
but could also result from the increasing number of people who have
access to and are becoming familiar with Internet technology. According
to an October 2000 Department of Commerce report, Internet users
comprised about 44 percent (approximately 116 million people) of the
U.S. population in August 2000. This was an increase of about 38
percent from 20 months prior.\12\ According to Commerce's report, the
fastest growing online activity among Internet users was online
shopping and bill payment, which grew at a rate of 52 percent in 20
months.
---------------------------------------------------------------------------
\12\ Department of Commerce, Falling Through the Net: Toward
Digital Inclusion (Oct. 2000). This report was the fourth in a series
of studies issued by Commerce on the technological growth of U.S.
Households and individuals.
---------------------------------------------------------------------------
Cost of Identity Theft to Victims
Identity theft can cause substantial harm to the lives of
individual citizens potentially severe emotional or other nonmonetary
harm, as well as economic harm. Even though financial institutions may
not hold victims liable for fraudulent debts, victims nonetheless often
feel ``personally violated'' and have reported spending significant
amounts of time trying to resolve the problems caused by identity theft
problems such as bounced checks, loan denials, credit card application
rejections, and debt collection harassment. For the 23-month period
from its establishment in November 1999 through September 2001, the FTC
Identity Theft Data Clearinghouse received 94,100 complaints from
victims, including 16,781 identity theft complaints contributed by SSA/
OIG. The leading types of nonmonetary harm cited by consumers were
``denied credit or other financial services (mentioned in over 7,000
complaints) and ``time lost to resolve problems'' (mentioned in about
3,500 complaints). Also, in nearly 1,300 complaints, identity theft
victims alleged that they had been subjected to ``criminal
investigation, arrest, or conviction.'' Regarding monetary harm, FTC
Clearinghouse data for the 23-month period indicated that 2,633 victims
reported dollar amounts as having been lost or paid as out-of-pocket
expenses as a result of identity theft. Of these 2,633 complaints, 207
each alleged losses above $5,000; another 203 each alleged losses above
$10,000.
From its database of identity theft victims, after obtaining the
individuals' consent, FTC provided us with the names and telephone
numbers of 10 victims. We contacted the victims to obtain an
understanding of their experiences. In addition to the types of harm
mentioned above, several of the victims expressed to us feelings of
``invaded privacy'' and ``continuing trauma.'' In particular, such
``lack of closure'' was cited when elements of the crime involved more
than one jurisdiction and/or if the victim had no awareness of any
arrest being made. Some victims told us of filing police reports in
their home state but not being able to do so in the states where the
perpetrators committed fraudulent activities using the stolen
identities. Only 2 of the 10 victims told us they were aware that the
perpetrator had been arrested.
In a May 2000 report, two nonprofit advocacy entities the
California Public Interest Research Group (CALPIRG) and the Privacy
Rights Clearinghouse presented findings based on a survey (conducted in
spring 2000) of 66 identity theft victims who had contacted these
organizations.\13\ According to the report, the victims spent 175
hours, on average, actively trying to resolve their identity theft-
related problems.
---------------------------------------------------------------------------
\13\ CALPRIG (Sacramento, CA) and Privacy Rights Clearinghouse (San
Diego, CA), ``Nowhere to Turn: Victims Speak Out on Identity Theft''
(May 2000).
---------------------------------------------------------------------------
Also, not counting legal fees, most victims estimated spending $100
for out-of-pocket costs. The May 2000 report stated that these finding
may not be representative of the plight of all victims. Rather, the
report noted that the findings should be viewed as ``preliminary and
representative only of those victims who have contacted our
organizations for further assistance (other victims may have had
simpler cases resolved with only a few calls and felt no need to make
further inquiries).''
Later, at a national conference, the Director of Privacy Rights
Clearinghouse expanded on the results of the May 2000 report. For
instance, regarding the 66 victims surveyed, the Director noted that
one in six (about 15 percent) said that they had been the subject of a
criminal record because of the actions of an impostor.\14\ Further, the
Director provided additional comments substantially as follows:
---------------------------------------------------------------------------
\14\ Beth Givens, Director, Privacy Rights Clearinghouse,
``Identity Theft: Growing Problem of Wrongful Criminal Records,'' paper
presented at the SEARCH National Conference on Privacy, Technology and
Criminal Justices Information, Washington, D.C. (June 2000).
Unlike checking for credit report inaccuracies, there
is no easy way for consumers to determine if they have become
the subject of a criminal record.
Indeed, victims of identity theft may not discover
that they have been burdened with a criminal record until, for
example, they are stopped for a traffic violation and are then
arrested because the officer's checking of the driver's license
number indicated that an arrest warrant was outstanding.
Federal Criminal Justice System Costs
Regarding identity theft and any other type of crime, the federal
criminal justice system incurs costs associated with investigation,
prosecutions, incarceration, and community supervision.\15\ Generally,
we found that federal agencies do not separately maintain statistics on
the person hours, portions of salary, or other distinct costs that are
specifically attributable to cases involving identity theft. As an
alternative, some of the agencies provided us with average cost
estimates based, for example, on work year counts for white-collar
crime cases a category that covers financial crimes, including identity
theft.
---------------------------------------------------------------------------
\15\ As agreed with the requesters, our study focused on the costs
of identify theft to the federal government only and not to state or
local governmental entities; although, since 1998, most states have
enacted laws that criminalize identity theft.
---------------------------------------------------------------------------
In response to our request, the FBI estimated that the average cost
to investigate white-collar crimes handled by the agency's white-collar
crime program was approximately $20,000 during fiscal years 1998 to
2000, based on budget and workload data for the 3 years. However, an
FBI official cautioned that the average cost figure has no practical
significance because it does not capture the wide variance in the scope
and costs of white-collar crime investigations. Also, the official
cautioned that while identity theft is frequently an element of bank
fraud, wire fraud, and other types of white-collar or financial crimes
some cases (including some high-cost cases) do not involve elements of
identity theft.
Similarly, Secret Service officials in responding to our request
for an estimate of the average cost of investigating financial crimes
that included identity theft as a component said that cases vary so
much in their makeup that to put a figure on average cost is not
meaningful. SSA/OIG officials responded that the agency's information
systems do not record time spent by function to permit making an
accurate estimate of what it costs the OIG to investigate cases of SSN
misuse.
Regarding prosecutions, in fiscal year 2000, federal prosecutors
handled approximately 13,700 white- collar crime cases, at an estimated
average cost of about $11,400 per case, according to EOUSA. The total
cases included those that were closed in the year, those that were
opened in the year, and those that were still pending at year end.
EOUSA noted that the $11,400 figure was an estimate and that the actual
cost could be higher or lower.
According to Bureau of Prisons (BOP) officials, federal offenders
convicted of white-collar crimes generally are incarcerated in minimum-
security facilities. For fiscal year 2000, the officials said that the
cost of operating such facilities averaged about $17,400 per inmate.
After being released from BOP custody, offenders are typically
supervised in the community by federal probation officers for a period
of 3 to 5 years. For fiscal year 2000, according to the Administrative
Office of the United States Courts, the cost of community supervision
averaged about $2,900 per offender which is an average for ``regular
supervision'' without special conditions, such as community service,
electronic monitoring, or substance abuse treatment.
Observations on Identity Theft and Legislative Proposals
Given indications that the prevalence and cost of identity theft
have increased in recent years, most observers agree that such crime is
serious and warrants continued attention from law enforcement,
industry, and consumers. Since our May 1998 report, various actions
particularly passage of federal and state statutes have been taken to
address identity theft. A current focus for policymakers and criminal
justice administrators is to ensure that relevant legislation is
effectively enforced. Along these lines, we identified several
initiatives including coordinating committees, multi jurisdictional
task forces, and information clearinghouses that might help define the
dimensions of the problem and help focus limited enforcement resources.
Moreover, there is general agreement that, in addition to
investigating and prosecuting violations of these laws, a multi pronged
approach to combating identity theft must include prevention efforts,
such as limiting access to personal information. As you know, at the
request of this Subcommittee and others, we have ongoing work looking
at government agencies' use of SSNs and whether better safeguards or
protections are needed. Prevention efforts can be particularly
important, given the personal toll that this crime seems to exact on
its victims and how difficult it is to investigate and prosecute
perpetrators.
Although the scope of our work for today's testimony did not
include an evaluation of various legislative proposals designed to
combat identity theft, we did compile information that offers
perspectives on various provisions of S. 1055 that are designed to
address some aspects of the crime. For example, a major component of
identity theft is acquiring personal identifiers such as SSNs, which
are used in some states as driver's license numbers to build false
identities. According to a 1999 study by the U.S. Sentencing
Commission,\16\ driver's licenses and SSNs are two of the most commonly
misused identification means. In fact, the Commission's study reported
that driver's licenses and SSNs are the identification means most
frequently used to generate or ``breed'' other fraudulent identifiers.
A provision (title II, section 205) of S. 1055 would prohibit the use
of SSNs on driver's licenses or motor vehicle registration documents.
In 1992, California enacted a law specifying that the SSN collected on
a driver's license application shall not be displayed on the driver's
license, including any magnetic tape or strip used to store data on the
license. More recently, in November 2001, Ohio passed a law prohibiting
the display of an SSN on a person's driver's license unless the person
requests that the number be displayed. According to the American
Association of Motor Vehicle Administrators, most states either
prohibit display of the SSN on the face of the license or give the
applicant the option to choose whether to display it.
---------------------------------------------------------------------------
\16\ U.S. Sentencing Commissions, Identity Theft Final Report
(Washington, D.C.) (Dec. 15, 1999)
---------------------------------------------------------------------------
Another potential source of personal identifiers for identity
thieves is the personal financial information sold by financial
institutions to non-affiliated third parties. The Gramm-Leach-Bliley
Act of 1999 \17\ (GLBA) established the ``opt-out'' standard currently
in effect. That is, unless an exception applies under the current
standard, a financial institution must give consumers notice and the
opportunity to opt-out before the financial institution can disclose
private financial information to non-affiliated third parties.
Generally, to implement the opt-out standard, financial institutions
are required by law to send consumers an opt-out notice informing them
of their right to prohibit its disclosure. In addition, financial
institutions have to provide consumers an initial notice and customers
an annual notice to inform them of the institution's information
policies and practices. These requirements for federally regulated
financial institutions became effective July 1, 2001. Limited data are
available about the response to and effectiveness of such notices.
However, another provision (title III, section 302) of S. 1055 would
impose a stricter standard if the financial institution seeks to sell
the information. Specifically, that provision would amend GLBA to
provide consumers an ``opt-in'' standard, whereby a bank would need
prior consent of the customers before selling personal financial
information to non-affiliated third parties.
---------------------------------------------------------------------------
\17\ Public Law 106-102 (1999).
---------------------------------------------------------------------------
Resource levels and competing priorities can limit any one level of
government's capacity, including the federal government's capacity, to
address identity theft crimes. Another provision (title VI, section
601) of S. 1055 would empower state attorneys general to enforce this
act. Regarding precedent for such a provision, although GLBA does not
have a similar provision, the act's legislative history indicates that
earlier versions of the House and Senate bills included similar state
enforcement authority, which was dropped in conference. In further
reference to precedent, however, one example of an enacted provision is
in the antitrust context. State attorneys general have the authority to
bring civil actions on behalf of resident consumers who have been
injured as a result of violations of federal antitrust laws.
In a similar vein, resource constraints and dollar threshold levels
have limited the numbers and types of cases that federal law
enforcement agencies have investigated. One type of case that has not
often been investigated involves SSN misuse. Currently, SSA/OIG devotes
its investigative resources to program integrity priority areas rather
than SSN misuse cases. SSN misuse allegations increased more than
fivefold, from about 11,000 in fiscal year 1998 to about 65,000 in
fiscal year 2001. Title II, section 207 of S. 1055 would give SSA the
authority to impose civil monetary penalties for SSN misuse. It is not
clear how the SSA/OIG would carry out this new authority or how many
additional resources it would require and at what cost.
In sum, while legislative and other actions have been taken in
recent years to address identity theft, incidence and cost data
indicate that more can and should be done. The provisions contained in
S. 1055 and other proposed legislation are aimed at enhancing the
prevention and enforcement tools available to law enforcement,
industry, and consumers. These legislative proposals deserve careful
attention and analysis.
Madam Chairwoman, this concludes my prepared statement. I would be
pleased to answer any questions that you or other members of the
subcommittee may have.
Contacts and Acknowledgments
For further information regarding this testimony, please contact
Richard M. Stana at (202) 512-8777 or Danny R. Burton at (214) 777-
5600. Individuals making key contributions to this testimony included
David P. Alexander, Shirley A. Jones, Robert J. Rivas, and Ronald J.
Salo.
Chairperson Feinstein. Thank you very much. I think it is
fair to say that we have got a substantial and rising problem
in the United States. I mean, some law enforcement people have
told me that it is the single largest rising crime in America.
Would you agree with that?
Mr. Stana. I do not know if it is the single largest crime,
but I cannot think of one that is rising faster. It is touching
every facet of our society. It is touching victims, it is
touching businesses, it is touching government, and from that
standpoint alone, it suggests that more needs to be done.
Chairperson Feinstein. I have also been told that the
burden of proof is really on the victim, who has to go and
reestablish their identity, and that the average length of time
that it takes a victim to reestablish their identity is 18
months. Did you do any work in that area?
Mr. Stana. We phoned ten victims that were identified
through the FTC's data clearinghouse and asked them a number of
things, like the impact of their victimization, how long it
took them to unwind their case, and some of the impacts that
they received from being a victim. They told us, on average--of
course, there were some at the low end, some at the high end--
but about 150 to 200 hours it took them of their personal time
to unwind the case.
Oftentimes, they did not lose financially as much as they
just lost their ability to get car loans. Interestingly, in
four cases we identified, the identity theft victim actually
went to jail for some time while they were trying to unwind
their identity.
I might also mention, Senator, that one interesting facet
of this is about three-quarters of the victims have no idea how
their identity was stolen. They do not know if it came from
somebody who stole mail. They do not know if it came from the
Internet. They do not know if it came from a huge data base.
But the 25 percent who did know, about half of those found that
it was somebody who they have a personal relationship with, a
friend, a co-worker, somebody down the street who stole their
identity.
Chairperson Feinstein. I am told that the two major centers
for identity theft are Los Angeles and Oakland, California,
interestingly enough, and some of the testimony that I have
received indicates that, often, obituary columns are good
sources of information that lead to the theft of identity
because mother's name, father's name are listed there, and then
the individual has a basis to go out and get access to the
Social Security number or the driver's license and they can
also look up the financial data, buy the financial data of the
individual.
I am particularly aware of one case where, I think it was
the No. 2 executive at the Cedars of Lebanon Hospital in Los
Angeles, he passed away and the obituary was in the Los Angeles
Times. His widow was essentially bilked of, I think, $300,000
by identity thieves who got what they needed to get the
documents right out of the obituary column. Have you
encountered anything like that in your examination?
Mr. Stana. Well, the key pieces of information that are
used to create an identity, a false identity, are the names,
address, Social Security number, date of birth, and mother's
maiden name, and if you can get a combination of those from
various sources, if you have some from an obituary, for
example, a mother's maiden name and the name and the address,
and go into some research engine on the Internet and pull down
other information, you can easily build a new identity.
This really underscores two things. Not only do we need to
pay attention to the law enforcement needs related to identity
theft, but the prevention needs are tremendous. I know you
addressed some of them in S. 1055, but the need for individuals
to protect their personal identifiers like they would protect
their wallet or their purse is just so important. It cannot be
understated.
Chairperson Feinstein. Mr. Stana, I must go to the vote, so
we will take a brief recess. If you would not mind staying,
Senator Cantwell is going to be here following the vote and she
has indicated that she has some questions she would like to
ask. So if you do not mind------
Mr. Stana. Not at all.
Chairperson Feinstein. and everybody else does not mind, we
will take a brief 10-minute, strict 10-minute, recess.
[Recess.]
Chairperson Feinstein. We will reconvene, and thank you
very much for your forbearance.
I am delighted to be joined by the Ranking Member. He and I
have worked very closely on this committee now for a number of
years, and speaking for myself, I find it most enjoyable to
work with him. Mr. Stana, if it is all right with you, I will
defer to the Ranking Member now for his comments.
STATEMENT OF HON. JON KYL, A U.S. SENATOR FROM THE STATE OF
ARIZONA
Senator Kyl. Thank you, Senator Feinstein. I am not going
to read my entire opening statement. I will ask that be put in
the record. I welcome all of the witnesses. I am sorry I missed
Senator Gregg.
Senator Feinstein is absolutely right. We have worked on
this particular problem for many years now together, and
probably nothing has been more frustrating to either one of us
than the inability to stop this kind of crime. We can diminish
it. We can help the people who have been victims of the crime,
although we are clearly not doing enough to do that. And I
guess one of the biggest frustrations I have and one of the
things that makes me most humble, in other words, to
demonstrate that will all of the great power we are supposed to
have, we still cannot get this problem solved. It is a very
difficult thing and it bothers me a great deal.
I just have a couple of questions to ask of you. I
appreciate your testimony. We reviewed that. My apologies for
not being here right at the very beginning. Senator Feinstein
probably said we have a lot of different commitments. This
week, for the first time ever, all four of my major committees
held hearings at exactly the same time on the same day. It is a
little hard to be in all four places at the same time.
Chairperson Feinstein. Thanks very much, Senator. I am glad
you are here.
[The prepared statement of Senator Kyl follows:]
Statement of Hon. Jon Kyl, a U.S. Senator from the State of Arizona
Thank you Senator Feinstein for convening this important hearing on
the issues of privacy, identity theft, the protection of our personal
information. I am very aware of the American public's continuing
concern about the collection and the distribution of personal
information. For several years Senator Feinstein and I have worked to
prevent criminals from gaining access to a citizen's personal
information to commit identity crimes. In 1998, Congress passed the
Identity Theft and Assumption Deterrence Act which increased protection
for the victims of identity theft. I am very proud that I was able to
introduce that particular piece of legislation; however, I realize that
we need to do more.
Identity theft is escalating at an alarming rate. It is a crime
that is not limited to a particular age, gender, economic, or racial
group, but instead is found in all parts of our society. The Federal
Trade Commission reports that it has processed over 97,000 entries from
consumers and victims regarding identity theft, as of June 2001. I am
eager for today's witnesses to fill us in on the details, and update us
on the severity of the problem we are facing. I also look forward to
their suggestions about where best we can direct our efforts to protect
our citizens.
The collection of and retention of an individual's personal,
financial, and health information has become a highly profitable
industry in today's e-commerce. An entire industry has arisen that
operates solely for the purpose of collecting and brokering private
information. This information is a valuable commodity for companies in
today's competitive consumer marketplace and these industries with
their vast databases should protect the information they contain.
It is also important to note, at this time, that this collection of
information is beneficial to consumers. They are offered products that
are tailored to their specific needs; companies are forced to be more
competitive; and the exchange of information facilitates the growth of
our economy. Therefore, we must carefully balance the restrictions we
place on business. An overly restrictive standard could harm the
nation's economic health. Online retail sales have jumped 67% from the
fourth quarter of 1999 to the fourth quarter of 2000. Retail sales at
the end of 2001 totaled approximately 104 billion dollars. It is clear
that the public, in increasing numbers, continues to have confidence in
the Internet for the purchase of goods and services.
It is the responsibility of the private sector, government, and
consumers to lessen likelihood of this private information will fall
into the wrong hands. It is a common misconception that the increase in
identity fraud and identity theft is caused by the Internet. Although,
e-mail scams and attacks by hackers are increasing, the FTC reports
that the two most common causes of identity theft are, lost or stolen
purses and wallets, and mail theft. Also, that the majority of
identity- theft crimes are committed by individuals we personally
know--for example, family members, friends, or coworkers.
Identity theft is a crime that affects all Americans and
encompasses many different types of fraud. The Federal Trade
Commission's Identity Theft Hotline reports that:
about 43% of complaints involved credit-card fraud
about 21% of complaints involved activation of
telephone, cellular, or other utility service in the victim's
name
about 14% of complaints involved bank accounts that
have been opened in their name, and/or fraudulent checks have
been negotiated in the victim's name
7% of complaints involved consumer loans or mortgages
that were obtained in the victim's name
7% of the victims reported that identity the identity
thief had obtained or forged a government document, filed a
fraudulent document, or obtained government benefits under
their name.
One major area of personal information is personnel medical
records. Access to these records is an extremely sensitive issue facing
Congress. Medical technology is advancing at an exponential rate.
Medical professionals will be able access a patient's medical history;
even his or her genetic profile will be accessible to potentially
arrive at better and more accurate treatments. However, there is a
concern that this data could be used to deny an individual medical
insurance, employment, or even a mortgage. Even the use for marketing
purposes, without an individual's permission, is extremely intrusive.
Senator Feinstein, you have assembled what promises to be a very
interesting and informative group of witnesses here today. I look
forward to their testimony and delving into their privacy concerns and
recommendations. I would like to extend my thanks for the time they
have taken to assist this Subcommittee in grappling with some very
complex issues that will touch the lives of many Americans.
In closing, I look forwarding to working with my esteemed colleague
from California, who has always shared my concern about identity theft
and the protection of our citizens' privacy.
Chairperson Feinstein. I am pleased to welcome Senator
Cantwell. If you have a comment, Senator, or would you like to
make a statement?
STATEMENT OF HON. MARIA CANTWELL, A U.S. SENATOR FROM THE STATE
OF WASHINGTON
Senator Cantwell. Yes. Thank you, Senator Feinstein. I will
be brief and add a longer statement to the record, but I
particularly wanted to thank you and Senator Kyl for your
leadership on this important issue, actually both issues of
consumer privacy and the issue of identity theft. I am
particularly pleased that we are going to hear from the General
Accounting Office who are going to give us some concrete data
about the growing problem of identity theft.
I have introduced a bill that will be considered in this
subcommittee giving victims of identity theft greater tools to
recover their identity and restore their good credit and I
appreciate, too, that Senators Feinstein and Kyl have a bill
that will enhance identity theft prevention which will also be
considered.
These are very critical issues and a growing problem and I
appreciate the committee's attention to them. Thank you.
Chairperson Feinstein. Thanks very much, Senator.
[The prepared statement of Senator Cantwell follows:]
Statement of Hon. Maria Cantwell, a U.S. Senator from the State of
Washington
I want to thank Chairwoman Feinstein for holding this hearing.
Particularly, I want to thank her, and Senator Kyl for their leadership
on the extraordinarily important issues of consumer privacy and
identity theft.
I am particularly pleased that we have the General Accounting
Office here today to give us some good data about the growth and cost
of identity theft. I have introduced a bill that we will be considering
in a few weeks in this Subcommittee that will give victims of identity
theft the tools to recover their identity and restore their good
credit. I appreciate too, that Senators Feinstein and Kyl have a bill
that will enhance identity theft prevention, which we will also
consider. These are critical issues, and as we will hear, it is a
problem growing at an unprecedented rate.
Let me turn to the broader issues of consumer privacy. Consumer
privacy is a complex issue: with the rapidly changing capabilities of
new technologies, and information being collected by a wide range of
entities, I see this as an urgent matter. As new technologies are
developed, new uses of personal information continue to arise. Many
will prove a great benefit to consumers, but all will come with the
concern that privacy be protected. We are only at the tip of the
iceberg on these issues.
I think a lot of people are asking the right questions: The first
question has to be ``what are consumer expectations in regard to their
privacy?"
Consumers and businesses alike need clear, recognizable `rules of
the road' for privacy. Privacy law needs to be as clear to everyone as
the basic rules of driving--you know to drive to the right of the
center divider, you know to stop at the red hexagon--and you know to
yield to a crossing pedestrian.
For me, the bottom line is that we need a federal legal framework
so consumers know their privacy protections and businesses know how to
handle a consumer's information. So expectations can be met. I look
forward to continuing to work with the members of this Committee and
others in Congress to enact the appropriate protections for the good of
the consumer and the good of the economy.
Again, thank you Madam Chairwoman and I look forward to hearing the
testimony today.
Chairperson Feinstein. I have two more quick questions and
then I will turn to the Ranking Member. Mr. Stana, how many
Social Security number misuse cases are being investigated by
the Social Security Administration Office of the IG?
Mr. Stana. The short answer is, less than 2 percent of the
allegations that are given to the Social Security IG are
investigated.
Chairperson Feinstein. Why is that?
Mr. Stana. Well, it boils down to three things, really. It
is threshold, priorities, and resources. Oftentimes, these
allegations involve small amounts of money, or one case as
opposed to a ring, and so it gets pushed off for threshold
reasons.
Priority, the Social Security IG focuses more on program
fraud rather than misuse fraud, so these cases fall through the
cracks. The fact is, they are falling into a hole. Nobody is
investigating them.
And the third reason is there just are not enough resources
to do the whole job.
Chairperson Feinstein. Is the same true for the FTC?
Mr. Stana. It is interesting. You are bringing up a good
point. The infrastructure has been created by the 1998 Act that
I know you all have helped to enact into law, and we have the
FTC creating a clearinghouse of data. More and more calls are
coming in each week, so the public is beginning to become aware
of the potential for having this data in a central place.
The fact of the matter is, we built a library that not many
people are coming to to check out books. There is only one
part-time Secret Service agent that is going there to mine the
data. Nobody else is using it.
Similarly, task forces are being created around the country
to combat white collar crime and part of that is identity fraud
as one of the crimes. But there is not as much action in those
task forces related to identity theft that the growth in this
crime would suggest needs to be.
Chairperson Feinstein. Thank you. I am hopeful that this
bill will be able to set the kind of basis for greater
attention to it.
Senator Kyl?
Senator Kyl. Thank you, Madam Chairman.
With regard to that last question, it is interesting, and
one thing I have been kind of curious about is whether, after
we passed the law, you could identify any change in the
statistics or the behavior in terms of quantification. Have you
been able to factor in, as a result of greater public awareness
or we hope greater public awareness, have you been able to
factor in any effect of that in the crimes reported or the
incidences of theft?
Mr. Stana. The number of crimes reported to the FTC has
increased from about 450 in 1999 when they set up the
clearinghouse to about 3,000 a week now. So you can see that
the public is becoming aware of the FTC being one shop to call
to report identity theft.
The other side of that, though, is that not much seems to
be made of that data. There is some data mining going on by one
Secret Service agent to try to identify trends and put together
rings to help investigate the crime, but not much more than
that.
Senator Kyl. One thing at least that I had hoped we would
do is to create some kind of a matrix, which is probably the
wrong word, but a profile, in effect. Do you have any idea
whether work has been done to determine whether the bulk of
this is just single-shot criminals, whether it is terrorists,
whether it is organized crime or what the matrix of the people
committing this fraud looks like?
Mr. Stana. Well, we know some data and we know some
information about this crime. For example, most victims are of
a certain age. Thirty, I think, is the average age. I think 75
percent fall between 18 and 59. Ron, do you have other
information that you might share with us?
Mr. Salo. Regarding the specific question you had, who are
these perpetrators, there is no data out there to tell us
whether the majority are organized crime rings, ethnic groups,
or whether they are individuals operating as loaners. The
problem in answering that question is you first need good
information and then you need good analysis of that
information. If the analysis is not being done, then individual
victims who call in are not being analyzed in a way so that you
can identify one perpetrator or gang that is actually
victimizing many people who are calling in.
Senator Kyl. You all may not be the best ones to answer
this question, but obviously, given the fact that we found
information tying terrorists to this crime as a way of funding
some of their activities, A) has work been done to try to track
that down and identify the size and scope of that problem, and
B) do you know of anything that has been done to, in effect,
isolate those particular cases?
Mr. Salo. We have one piece of information from the U.S.
Sentencing Commission, a very excellent report on identity
theft. It was performed before September 11 on conviction data
from the courts, so we have solid information, and that report
indicated that one out of three identity theft victim
convictions was from a foreigner, not from an American citizen.
The distribution of countries that made up this sample of
foreign convicted identity thieves is very long, mostly one
from one country, one from another country. There were only two
countries that seemed to be a little bit of a bubble, where
there were more convictions, and that was, firstly, Mexico, and
then Nigeria. After that, it was mostly one each. There was
some distribution that indicated wide dispersion of countries
being represented.
Senator Kyl. Now, were these foreigners in the United
States legally, or do you have any way of knowing that?
Mr. Salo. The information in the report did not reveal
whether they were or not.
Mr. Stana. I might add, though, that INS has a tremendous
problem dealing with illegal aliens using false identities to
seek work authorization documents and so on. So I suspect,
being most of them from Mexico and Nigeria, they were probably
work-related rather than terrorist related.
Senator Kyl. One of the questions we have had, too, relates
to the disparity in the numbers between the reporting from
credit bureaus and the like and your reporting. I did not know
this number. This is what staff wrote down, that you indicated
there were about 750,000 victims, I guess is what the number
ties to. Could you repeat that for me again? I am sorry I was
not here.
Mr. Stana. Let me clarify that. You could probably look at
this as a very conservative figure, a mid-range figure, and a
very high figure. I think the 750,000 would probably be at the
upper end of victims. At the lower end, you would have a range
of 250,000 to 300,000, and then a mid-range of 400,000 to
500,000, and it really depends which data you put into this
estimate and what assumptions you make. The most conservative
is the data available and things you can actually count rather
than estimate, and that is the lower end, 250,000 to 300,000.
Senator Kyl. My red light is on, but I do want to get into
that in just a little bit more detail when we come back.
Chairperson Feinstein. Thanks, Senator Kyl.
Senator Cantwell?
Senator Cantwell. Thank you, Madam Chairman.
Mr. Stana, I know your report covers many things in looking
at this from a perspective of how individuals are being
impacted. Did you get a sense of how long the average identity
theft investigation takes?
Mr. Stana. I do not have that information. I know that the
identity theft victims take between 150 and 200 days to unwind
their case, and I know that sometimes these cases can go on for
months and months and months. I do not have an average figure.
Senator Cantwell. But it is safe to say the maximum length
of the investigation is quite some time?
Mr. Stana. It can be quite some time, and that is because
these cases are not easy to investigate and it is because the
financial transactions that are done illegally often are very
intricate.
Senator Cantwell. So that issue with the statute of
limitations not occurring until--basically occurring at the
time of the crime as opposed to the time that an individual
finds out is a major issue?
Mr. Stana. Well, it is a major issue. Unlike so many other
crimes, by the time the victim knows they have been victimized,
it could be months later and the trail is cold.
Senator Cantwell. I know that this was not the scope of
your report, but through your research, did you get a sense of
how many years after the fact that people are then burdened
with this? I think some people think you might clean this up by
making a few phone calls.
Mr. Stana. We were talking with a victim this morning, in
fact, who told us that her identity was stolen and she did not
know how, but 1 year after her identity was stolen, she was
contacted by a collection agency on a $22,000 cellular phone
bill that she had no idea how it got there and it took many
calls, much effort. She said it probably took in the
neighborhood of 300 days to get this straightened out.
Incidentally, at the time, she was purchasing a house and she
was afraid that the adverse credit rating may sneak into that
transaction, but fortunately, the credit bureaus had put the
flag on things and straightened that out.
Senator Cantwell. So you did not have any information about
what kind of permanent or long-term damage to individuals'
records might--
Mr. Stana. It is interesting. In some cases, there is long-
term damage. In other cases, there is not. We came across four
cases, and it was incredible to listen to the stories, but four
cases where the person whose identity was stolen actually had
to go to jail for some time for the crime until the crime was
unwound.
Senator Cantwell. One of the reasons why I introduced
legislation was because there was someone in our State who had
been convicted of a crime that they did not commit, either,
because of identity theft.
In the process of gathering information for the study, did
you get any sense of the percentage of identity theft crimes
that are State or local investigations or prosecutions as
opposed to Federal investigations, because obviously this is
not exactly a crime that you call 911 about. Oftentimes, it is
very confusing. I know that we have made some changes there and
have a Federal agency involved with a number that people can
call. But did you get any, if not empirical, just a sense of
the magnitude of where the enforcement focus needs to be?
Mr. Stana. When a person's identity is stolen, they are
supposed to do four things. First, they are supposed to call
the credit bureaus to put a flag on their account. Then they
are supposed to call the bank or the vendor and notify them
that their identity is stolen. Third, they are supposed to call
the local police department, not the Federal but the local
police. And finally, they are supposed to call the FTC. So you
are exactly right that this is more of a State and local than a
national crime.
That being the case, despite our efforts, we could not
locate any data which told us the extent of the crime, how much
of it was federally reported and investigated, how much locally
reported and investigated. But there is a frustration among
people who do report locally and that is oftentimes local and
State police departments are not well equipped to handle or to
investigate this crime.
Senator Cantwell. So that would be an important step in the
next process, right?
Mr. Stana. Yes, I think it would, in enforcement. I think
you have to separate what is needed into two buckets, what is
needed from a prevention standpoint and what is needed from an
enforcement standpoint, and certainly the State and locals
factor heavily into what is needed from an enforcement
standpoint.
Senator Cantwell. Giving information to both the victims
and to law enforcement at the local level.
Mr. Stana. Well, and having local police have an
understanding of what to do with the allegation. I think they
full well know how to handle, say, a murder or how to handle
traffic violations. How to handle a financial crime is often
beyond their capability.
Senator Cantwell. Did you hear--
Mr. Stana. Another factor there is, too, you may live in
one jurisdiction and the crime is reported or happens in
another jurisdiction and you get into jurisdictional boundary
issues.
Senator Cantwell. That is another thing that we try to
address in my legislation.
I know my time is in the yellow here, but I wanted to
followup on that in the sense that local law enforcement and
the individual victims need access to the information, and
oftentimes, what I think you are saying verifies this, what
happens is the victim finds out that something is amiss, calls
the credit bureaus to flag something, but then no more
information is given to them or to the crime unit to be able to
prosecute or move on that identity theft.
Mr. Stana. What a victim of identity theft should be sure
to do is every call that is made to a credit bureau or to the
financial institution that may be carrying the card or the
merchant is to ask them to forward to the victim whatever
information they have available in their files, so that in the
course of the investigation if other information is needed or
information that the victim can supply would be helpful, they
would have that information at hand.
Senator Cantwell. Well, I think what happens oftentimes is
calling some of these people that, I think, have been a victim
of any theft, they are not sure who is now the victim. Is it
the person that is calling or the person that created the
transaction? I know our State of Washington and other States
have taken the measure to try to give a document to the person
whose identity has been violated that they can use in
communicating with law enforcement and others to verify that
information. So an actual verification that they are, in fact,
the victim and not somebody who is perpetrating a crime.
Mr. Stana. It would be useful to have a checklist for the
victim. They can go down and say, yes, I contacted this, I
asked for this document, they are going to help me, this office
is going to do this. I ought to caution, though, that there is
not much investigation going on with the credit bureaus on
these individual allegations. So the kinds of information you
are likely to get from a credit bureau or even from a credit
card company or other financial institution is simply the date
of a transaction, where the transaction was made, and for the
amount. You probably would not get much of a description, if
any, of the perpetrator.
Senator Cantwell. Not at this point.
Mr. Stana. Not at this point, but those leads may be useful
for law enforcement.
Senator Cantwell. Thank you. I know my time is expired.
Chairperson Feinstein. Thanks, Senator.
I would like to enter into the record the statement of
Senator Hatch on this issue, without objection.
Senator Kyl, you had other questions?
Senator Kyl. I just had one last question and then we want
to get on to the next panel. I would like to have you help us
resolve the discrepancy between the figures that you have come
up with and figures from the credit industry. I think maybe the
best way to do that is you are probably aware of the figures
they have, but we can give you that information and maybe just
have you write us a note on what your analysis of that is and
why the discrepancy and so on. But I would appreciate hearing
anything you have to say right now.
Mr. Stana. We can quickly walk you through how we get to
the low end, the mid-range, and the high end.
Senator Kyl. Please do, and then if you would just also
look at what their data is and drop us a note about why you
think your data is more reflective of the correct situation
than theirs, or whether theirs is, or whatever you have to say
about it.
Mr. Stana. I think we would be more comfortable saying what
the assumptions and the data were to get it to one level, the
next level, and the next level.
Senator Kyl. All right.
Mr. Stana. Given that the data is very uncertain and given
that there is so much that is not recorded here, it is really
hard to say that this is the correct level or that is the
correct level.
Mr. Salo. As Mr. Stana is saying, the key to this whole
discrepancy issue is the recognition that there is no one place
to go to get a comprehensive statistic on the prevalence of
identity theft. This was true 2 years ago when we were doing
our work on identity theft. It is true today, even though there
is an FTC Identity Theft Data Clearinghouse that is available
to victims to call in.
To explain how we came up--
Senator Kyl. Excuse me 1 second. In that clearinghouse, is
there not a checklist? Senator Cantwell was right on in terms
of a checklist, but is there not some kind of a checklist in
that particular site, the FTC site?
Mr. Salo. There is, and as a matter of fact, the points--
for example, on their webpage, the things that an identity
theft victim should do are actually listed out on the webpage
and Mr. Stana has already articulated those, basically the four
points. We would certainly agree that those are the proper
steps that any identity theft victim ought to take.
Senator Kyl. OK, and one other thing. We have that on my
Senate website and I think what we ought to do is maybe send a
``Dear Colleague'' to our colleagues and suggest that they put
it on their own website or get it out any other way that would
be useful to folks.
Mr. Salo. There are many ways to be useful, not to avoid
the question. I will get exactly to your question. But one
thing that we were looking at very recently was whether the
Social Security Administration in their annual notices to
people about their benefits has anything on identity theft and
I was surprised to notice that on the very top of every notice,
it says that this is an alert to be aware of a misuse of your
Social Security number and there is a report that the Social
Security Administration cites that you could get which, again,
tells you how you can minimize the vulnerability you have to
becoming an identity theft victim.
But coming back again to your original question, how do we
come up with a number, given that we have a patchwork of
sources, we looked at the credit bureaus and we looked at the
FTC Data Clearinghouse and we looked at the Social Security
Administration as three early warning bells up front where
prevalent statistics might be present.
We talked to the three national credit bureaus and asked
them about the telephone hotline statistics that they have and
they more or less came up with a consensus that we agreed with
that a solid figure, a reliable figure would represent fraud
alerts. Fraud alerts represent a notice on individuals'
accounts, basically alerting anyone who is in a retail outlet
who is receiving an application for new credit, that person
would be alerted that perhaps this person is a potential victim
to identity theft and let us call the person at home and make
sure that this is, in fact, not the case.
Fraud alerts look like a good mechanism. The reason why
they thought it would be reliable is because there are people
who call in perhaps to get a free credit report and they may
not, in fact, be a victim and it is a way of culling out--
reducing the statistics down to a reliable number of people who
definitely say, yes, I am an identity theft victim and I want a
fraud alert on my account.
The only drawback of that is that the three credit bureaus
have different business processes for getting to that 7-year--
that is how long the fraud alerts are--seven-year fraud alert
flag, and in the more complicated processes, you start to lose
people as you call through. Our range was 30,000, approximately
30,000 to 178,000. One explanation for that disparity is the
higher number represents the one-time call. The lower number
represents two calls and additional documentation to be
provided to the credit bureau.
Now, who are people calling credit bureaus? They are people
who have either been harassed by a collection agency and been
alerted that there is an expense that they were not aware of
and they are afraid that it might be affecting their
creditworthiness, or they may, in fact, get a bill that they do
not recognize and they want to dispute it and, in fact, it may
be because they were victimized.
But there is a third group out there of people who would
rather be safe than sorry. This historically has always been
part of the statistics built into the credit bureaus'
reporting. In one credit bureau, that proportion of those who
would rather be safe than sorry versus victims has grown over
time from what used to be one out of three calls to now
approximately one out of two calls. We regard that as an
indication that the education and awareness of the consumer is
finally getting out, that people recognize the risk of identity
theft and they are calling in to put on fraud alerts because
they would rather be safe than sorry.
However, not everyone does call a credit bureau.
Consequently, we looked at the sources of data and asked
ourselves, which ones appear not to be duplicative? Could we
then add them up? and I can run down the list very quickly
right now.
The FTC, based on the fact that they are telling us
approximately 3,000 victims call in to their clearinghouse
every week, if we were to annualize that, it would come out to
about 150,000 victims. Additionally, the Social Security
Administration's hotline, Office of Inspector General Hotline,
receives SSN misuse allegations and those are, to a large
degree, not the same people because there is a memorandum of
understanding between the FTC and the SSA OIG to have that
information shared. So the 56,000 calls now that come into
the--on SSN misuse could be added to the 150,000 from the FTC.
Chairperson Feinstein. I would like to move on, if that is
all right.
Senator Kyl. Yes, please.
Chairperson Feinstein. Gentlemen, I would like to move on,
but thank you very much. I just want to add one thing for the
record. For the 23-month period from its establishment in
November 1999 to September 2001, the FTC Identity Theft Data
Clearinghouse received 94,100 complaints. Of these, nearly
1,300 complaints, identity theft victims alleged they had been
subject to criminal investigation, arrest, or conviction. So I
would like the record to reflect that.
Thank you very much, gentlemen. We appreciate it.
If we could call the next panel, please. The next panel
consists of Susan Fisher of the Doris Tate Crime Victims
Bureau, Doug Comer of Intel, and John Avila of the Walt Disney
Company.
Susan Fisher comes to us from my State, from Carlsbad,
California. She is the Executive Director and Vice Chairwoman
of the Doris Tate Crime Victims Bureau. In 1987, her brother
was killed, as I said, by his ex-girlfriend who stalked him by
obtaining his credit card information, phone records, and other
personal information. Since her brother's murder, Susan has
been a relentless advocate for victims' rights. Under her
leadership, the Doris Tate Crime Victims Bureau has received
the San Diego District Attorney's Award for Service to Crime
Victims and she has twice been the recipient of a certificate
of appreciation from the Department of Justice for service to
victims of crime.
Susan Fisher, we welcome you, and if you would like to
proceed. We are going to limit your statement to 5 minutes so
we have some time for questions.
STATEMENT OF SUSAN FISHER, EXECUTIVE DIRECTOR, DORIS TATE CRIME
VICTIMS BUREAU, CARLSBAD, CALIFORNIA
Ms. Fisher. I would like to talk about the crime of
stalking in general and specifically use some examples from the
case that I know best, which was my brother's murder.
Ron, my brother, was murdered after being stalked for over
a year by Linda Ricchio, who was a former girlfriend who had
become obsessed with him. They had actually stopped dating a
few years before the stalking began, but he had had difficulty
extricating himself from the relationship with Ricchio because
his attempts to leave would always be followed by her
manipulation of him with things like staged suicide attempts,
public scenes that were meant to embarrass him, and threats of
violence against his friends and family members, which are all
very typical of stalkers.
From the moment that Ron ended their relationship, she
began to access personal information about him in order to
track his whereabouts and know who he talked to and who he
spent time with. She was easily able to get copies of phone
bills and utility bills. She was able to trace his fiancee and
his fiancee's mother by accessing DMV information.
Since 1987 when that was happening, Congress has passed
legislation to protect drivers' license information, but there
are still some loopholes in the current law and Senator
Feinstein's bill would mandate that you give consent before
your driver's license information could be sold and we feel
that that is a very important piece of legislation to have in
place.
In 1987, in my brother's case, Ricchio quit her job and
stopped going to school in order to stalk my brother, Ron, on a
full-time basis. She actually stalked him so relentlessly that
she locked up her house, left her cats to die of starvation,
and spent every day, all day, stalking him.
In November of that year, he was compelled to get a
restraining order in order to try to protect himself and also
to protect his job. The San Diego County judge who issued the
restraining order at that time told him that he should be
flattered by the attention. Obviously, the crime of stalking is
getting a little more attention now and is being taken a little
more seriously. After being told that he should be flattered by
the attention and really kind of supporting her position in the
case as just attention to an ex-boyfriend, Ricchio left the
courthouse in San Marcus, California, legally bought a gun
after having the restraining order filed against her.
In November, the daily contact stopped. We learned later
that Ricchio had gone to San Francisco during that period to
visit her brother and to enlist his help in developing over 200
surveillance photos that she had taken of my brother. During
that time, my brother moved for the third time that year. He
was trying to buy a little time, trying to decide what to do,
and rapidly coming to the conclusion that there was really
nothing that he could do if she decided to become violent. With
her ability to track him down, he was convinced that even if he
left the State, she would eventually find him using phone
records or one of the other kinds of trails that we all just
leave just by existing in this world.
On December 9, after once again tracing his whereabouts,
she rented the apartment next door to him without his
knowledge. The two-story apartments that he lived in were
separated by--the two apartments, I beg your pardon, were
separated by a privacy wall. Hers was at the back of the
balcony and his was at the front.
On Monday evening on December 14, he came home from work.
He had actually asked to come home a little bit late because it
was getting dark early and his lights in his parking lot did
not come on until about 5:30, so it was about 5:30 in the
evening. He came up the stairs carrying a bag of groceries in
his left arm and his checkbook and his keys in his right hand.
He turned his back to the privacy wall, bent over to put the
key in the door, and at that point, Ricchio stepped out from
behind the wall and she fired a shot into his back. She shot
him twice, once as he ran down the stairs away from her in the
dark.
At the time that Ron was killed, there were no stalking
laws in California. In fact, they did not even use the word
``stalking.'' It was considered harassment or domestic
violence. California was actually the first State to pass
stalking legislation, and in the years since my brother's
murder, I have been very involved in working on anti-stalking
legislation in California and working directly with stalking
victims. In fact, most stalking victims in many parts of
California end up coming to the bureau for the very reason that
we have done so much work on legislation on stalking.
While many things have changed, both in the criminal
justice system and in the way that we view stalkers, since my
brother was murdered in 1987, the pathology of stalking remains
the same. We recently have seen an increased use of Internet
venues, particularly by domestic violence-type stalkers, to
contact and harass their victims. and while we have been able
to legislate many safeguards into avenues of access that
stalkers once used, new avenues are opening up all the time.
Stalkers who often are sociopathic and have borderline
personalities have the intelligence and the drive necessary to
access any information available in order to track their victim
and would most certainly be willing to purchase the
information. Information on the Internet that is not
safeguarded is fair game.
I have a little bit of information here that I actually
found on the airplane on my way here that talks about some
websites that are out there now. There are websites such as one
that is called ``Spy for You'' that sell unlisted phone numbers
and bank account numbers and trace pager numbers to home
addresses. There is a company called DBT Online, which would
match a name with a Social Security number, date of birth, and
telephone number for a small fee. Also, unprofessional private
investigators would have very easy access to this kind of
information through the Internet and many stalkers would be
more than willing to pay them for that information.
We just feel that it is important to mandate the kind of
protection that having to give permission for that information
to be sold is very important and that is why I am here today.
Thank you.
Chairperson Feinstein. Thanks very much. I appreciate your
testimony, Susan Fisher.
[The prepared statement of Ms. Fisher follows:]
Statement of Susan Fisher, Executive Director and Executive Vice-
Chairman, Doris Tate Crime Victims Bureau, Carlsbad, California
In December of 1987, just a days before Christmas, my 28 year-old
brother Ron Ruse was ambushed & shot in the back outside of his
apartment in Carlsbad, CA.
Ron was murdered after being stalked for over a year by Linda
Ricchio, a woman who had become obsessed with him. Ron had stopped
dating Ricchio a few years before the stalking began. He had difficulty
extricating himself from the relationship with Ricchio because his
attempts to leave would always be followed by her manipulation of him
with staged suicide attempts, public scenes meant to embarrass him and
threats of violence against him and his friends and family. From the
moment that Ron ended their relationship, Ricchio began to access
personal information about him in order to track his whereabouts and to
know who he talked to and who he spent time with.
She was easily able to get copies of phone bills and utility bills.
She was able to trace Ron's fiancee and his fiancee' s mother by
accessing DMV information. Since that time, Congress has passed
legislation to protect driver's license information. There are
loopholes in the current law a that still leave people vulnerable.
Senator Feinstein's bill mandates that you must give consent before the
information on your diver's license can be sold.
In mid-1987, Ricchio quit her job and stopped going to school in
order to pursue Ron on a fulltime basis. She stalked him so
relentlessly that she neglected everything else in her life; even
letting her cats die of starvation inside her apartment. In November,
Ron was compelled to get a restraining order in an attempt to protect
himself and save his job. The San Diego County judge who issued the
restraining order told him that he should be flattered by the
attention. Ricchio's response to the order was to legally purchase a
gun and to become proficient in its use, shooting at the head and
crotch of a silhouette target.
In late November the daily contacts stopped. We learned later that
Linda Ricchio had gone to San Francisco during that period, to visit
her brother and to enlist his help in developing over 200 surveillance
photos that she had taken of Ron. During that time Ron moved for the
third time in 1987. He was trying to buy a little time, trying to
decide what to do, and rapidly coming to the conclusion that there was
really nothing that he could do if she decided to become violent. With
her ability to track him down, he was convinced that even if he left
the state, she would eventually find him using phone records or one of
the other kinds of trails that we leave simply by living in the world.
On December 9th, after once again tracing his whereabouts, Ricchio
rented the apartment next door to Ron without his knowledge. The two
second-story apartments were separated by a privacy wall, Linda's at
the back of the balcony and Ron's at the front by the stairs. On
Monday, December 14th Ron went home from work in the dark, carrying a
bag of groceries, keys and a checkbook. He turned his back to the
privacy wall and bent over to put his key in the door. At this point,
Ricchio stepped out from behind the wall and shot Ron in the back two
times, killing him.
At the time that my brother was killed there were no stalking laws
in California. It was not new behavior by any stretch of the
imagination; it was simply referred to as harassment or domestic
violence. California was the first state to pass a law that
specifically made stalking a crime. In the years following my brother's
murder, I have been very involved in advocating anti-stalking
legislation in California and in working directly with stalking
victims; in fact most stalking victims in San Diego County eventually
find their way to the Crime Victims Bureau through referrals from law
enforcement, DA's and counselors. While many things have changed, both
in the criminal justice system and in the way that we view stalkers
since my brother's murder in 1987, the pathology of stalking remains
the same. We have recently an increased use of internet venues being
used, particularly by domestic violence type stalkers to contact and
harrass their victims.
And while we have been able to legislate safeguards into many of
the avenues of access that stalkers once used to obtain personal
information about their victims, new avenues are opening up all the
time. Stalkers often have a narcissistic, sociopathithc, borderline
personality. This type of person has the intelligence and the drive
necessary to access any information available in order to track their
victim, and would most certainly be willing to purchase information.
Information on the internet that is not safeguarded is fair game.
Everyone should have the ability to protect themselves by
protecting personal information about themselves. Senator Feinstein's
Privacy Act of 2001 mandates the kind of informed consent necessary to
do just that by providing that first, you must be notified if a company
intends to sell your personal information, then it provides an avenue
for you to stop that sale and it permits you to sue any company that
misuses your social security number. This legislation gives individuals
increased ability to protect themselves from those who would seek to
harm them
Chairperson Feinstein. And now, Doug Comer of Intel. Mr.
Comer is the Director of Legal Affairs and Technology Policy
for Intel Corporation. He works with the Washington, D.C.
Government Affairs Office on issues of legal reform and
technology policy. Prior to this time, he served as Deputy and
Acting Commissioner of the Patent and Trademark Office for the
Department of Commerce. He has also served as Chief Counsel to
the Senate Judiciary Subcommittee on Courts, where he was
responsible for managing patent, copyright, and trademark
legislation during the chairmanship of the Honorable Robert
Dole, the former Senator from the State of Kansas.
We welcome you, Mr. Comer.
STATEMENT OF DOUGLAS B. COMER, DIRECTOR OF LEGAL AFFAIRS AND
TECHNOLOGY POLICY, INTEL CORPORATION, WASHINGTON, D.C.
Mr. Comer. Thank you, Madam Chairman. I thank you for the
opportunity to testify today.
For over three decades, Intel Corporation has been at the
forefront of the technology revolution. Intel introduced the
world's first microprocessor in 1971 and today we supply the
chips, the boards, the systems, the software, network, and
communications equipment that comprise the ingredients of
computer architecture and the Internet.
We have heard a lot today about a very important subject,
identity theft, and it is precisely because identity theft is
closely related to the proper uses of the Internet and of the
data that is collected through the Internet that I am here
today to express our very strong support for Title I of your
bill, which deals with consumer privacy on the Internet.
Our own experience with privacy concerns for consumers
really began for us in about 1998 with an experience with a
product feature which we introduced in the Pentium III called
the processor serial number, which we saw as a simple,
effective tool by which a network manager could closely track
the performance of computers on a network system. The processor
serial number sent an electronic tag along with any
communication by the computer in a network identifying the
specific machine that that communication was tagged to.
Unfortunately, that feature came to be viewed with great
alarm by many in the public sector at large over the
possibility that it could be used to assess or facilitate the
tracking of the use of computers by the average consumer. We
went through a lot of effort to satisfy the concerns of
consumers about our desire to protect their privacy and
ultimately designed into this processor serial number a feature
by which the consumer could turn it off, and ultimately, this
was phased out of our products.
But going to your point expressed earlier about the proper
balance between privacy and security after the events of 9/11,
we were approached by law enforcement authorities who were very
interested in the possibility of reviving the processor serial
number feature for the very reasons that I have mentioned,
because of the ability to tag specific communications to
specific computers. We are not going to do that, but the whole
experience of the processor serial number drilled a very high
awareness at Intel of the importance of respecting consumer
privacy for users of the Internet, and out of that experience
came a very well-developed program at Intel for managing our
own privacy policy, ensuring compliance to fair privacy
practices, and working with our vendors and suppliers to do the
same.
So identity theft, because of the utility of the Internet,
perhaps the most powerful tool for the collection and
dissemination ever developed, obviously has fed consumer
concerns. The health of the Internet is a core issue for our
company and for the entire information technology industry. We
believe that these consumer concerns surrounding the safety of
online transactions are impeding the growth of e-commerce. We
all hear a lot about how the Internet has grown and e-commerce
has grown and that is true, but we do not hear about how much
more it could grow and be even a more powerful tool of
productivity growth in our economy were it not for these
concerns.
There is a Gartner survey from about a year ago that shows
of 7,000 consumers, 60 percent surveyed said that security and
privacy concerns keep them from doing business online. Now, in
order to ensure that the Internet continues to grow as a tool
of commerce and a driver for productivity, businesses large and
small need to recognize these concerns and respond to them.
So our company has come to the view that Federal privacy
legislation is needed not only to address these concerns and to
provide a stable playing field for businesses, but also to
create an environment where the Internet and the use of the
Internet for proper purposes can continue to develop apace.
We think that legislation would clarify the rights for all
consumers. It would educate and direct businesses toward the
adoption of fair privacy practices. It would create a stable
legal structure for businesses to operate in. It would
strengthen the U.S. industry position in the ongoing
negotiations over the safe harbor agreement with Europe. and it
would encourage businesses to migrate into self-regulatory
organizations, which are proving to be effective tools for
guiding and strengthening businesses in respecting privacy
rights of users of the Internet.
It is important, we think, though, that privacy legislation
should embrace the following principles which have been
subscribed to by all of our major industry associations, such
as AEA, ITI, and the Computer Systems Policy Project and
others: Mandating notice, ensuring consumer choice, the ability
to opt-out of the use of or disclosure of personally
identifiable information for purposes unrelated to the
transaction for which it is provided, a focus on market
solutions--this is where the self-regulatory organizations come
in, and providing a national and uniform standard for privacy
protection.
A Federal Internet privacy policy should be national in
scope and preempt State laws in order to avoid the confusion
that would result for users and for website operators by widely
disparate local laws. It should, as well, ensure that national
standards are not undercut by private litigation case decisions
and enforcement, in our view, should be in the Federal courts,
subject to FTC supervision. And finally, we think that these
principles of legislation should apply to offline data
collection, as well.
In Intel--
Chairperson Feinstein. Would you repeat that last sentence?
Mr. Comer. These principles should apply to offline data
collection, as well. In our view, this can be done efficiently
if data collection materials such as warranty cards and the
like are designed properly. All of this data is ultimately
reduced to electronic form and there is really no reason for
differentiation between online collection and offline
collection.
So taking all of these principles into consideration, we at
Intel commend you, Senator Feinstein, for you focus on the need
for a comprehensive, systematic, national approach to
protecting privacy and we strongly support the provisions of
Title I of your bill addressing consumer privacy on the
Internet because it reflects these principles.
Because we share your objective of comprehensive protection
for the Internet user, we believe that the rules set forth in
S. 1055 should also apply to public sector websites, as well.
We have seen cases where data collected from the public by
government agencies has been transferred without the consent of
the parties supplying the data to private sector entities for
commercial purposes. Again, a consumer should be protected no
matter what websites or type of websites they are going to.
I would like to take this opportunity to submit for the
subcommittee's consideration a letter signed by Mr. Bill
Archey, President of the American Electronic Association, in
support of Title I of your bill and I provided that to your
staff and to the committee, and also ask for inclusion in the
record of a statement of Mr. Jeff Nicol, our Privacy Program
Manager, which was prepared for the original scheduling of this
hearing back last fall.
Chairperson Feinstein. They will be added to the record.
Mr. Comer. Thank you.
In sum, we believe that the continuing viability of the
Internet marketplace depends upon good rules, good practices,
and good policing. Congress should lay down the rules, depend
upon the self-regulatory tools now in the marketplace to
advance the adoption of fair privacy practices, and give
responsibility for the enforcement of these rules to the FTC
and the State attorneys general. In this way, we think that bad
actors will, over time, be driven out of the marketplace and
consumer acceptance of the Internet as a safe place to do
business will be secured. The Internet will then flourish as
one of the most efficient, if not the most efficient, market
tools ever developed.
That concludes my remarks and I will be pleased to answer
questions.
Chairperson Feinstein. Thanks very much, Mr. Comer.
[The prepared statement of Mr. Comer follows:]
Statement of Douglas B. Comer, Director, Legal Affairs and Technology
Policy, Intel Corporation
I thank the Chair for the opportunity to testify this afternoon. My
name is Doug Comer and I am Director of Legal Affairs and technology
policy for Intel Corporation. For over three decades, Intel Corporation
has been at the forefront of the technology revolution. Intel
introduced the world's first microprocessor in 1971. Today, Intel
supplies chips, boards, systems, software, networking and
communications equipment that comprise the ``ingredients'' of computer
architecture and the Internet. The health of the Internet is a core
issue for our company and for the entire Information Technology
industry.
Intel believes that consumer concerns surrounding the safety of
online transactions are impeding the growth of e-commerce. For example,
a Gartner survey of 7,000 consumers found that 60% say that security
and privacy concerns keep them from doing business online.\1\ In order
to ensure that the Internet continues to grow as a tool of commerce and
a driver for productivity in our economy, businesses large and small
need to recognize these concerns and respond to them.
---------------------------------------------------------------------------
\1\ Jeff Sweat, ``Privacy--Can Businesses Build Trust and Exploit
Opportunity?--As the opportunities to use personal data for marketing
grow, companies search for how to strike the right balance between
delivering the service customers want and the privacy they expect,''
Information Week (August 20, 2001) 30.
---------------------------------------------------------------------------
Our company has come to the view that federal privacy legislation
is needed to address these concerns, and provide a stable legal playing
field for business. We believe that such legislation should embrace the
following principles, which have been subscribed to by all of our major
industry associations:
Mandate notice--Websites that collect personally identifiable
information should provide clear and conspicuous notice of their
practices at the time of information collection.
Ensure consumer choice--Internet users should have the ability to
opt-out of the use or disclosure of their personally identifiable
information for purposes unrelated to the transaction for which it is
provided.
Focus on market solutions--Legislation should build upon existing
self-regulatory mechanisms, and back those mechanisms with the
enforcement clout of the Federal Trade Commission.
Provide a national, uniform standard for privacy protection--A
federal Internet privacy policy should be national in scope, and
preempt state laws in order to avoid the confusion that would result
for users and for website operators by widely disparate local laws. It
should, as well, ensure that the national standards are not undercut by
private litigation case decisions. The enforcement should be in federal
court, subject to FTC supervision.
Apply the same principles to Offline data collection--The same
privacy principles should apply regardless of whether the transaction
was conducted online or offline. In Intel's view, this can be done
efficiently if data collection materials--such as warranty cards,
etc.--are designed properly.
We at Intel commend you, Senator Feinstein, for your focus on the
need for a comprehensive, systematic, and national approach to
protecting privacy. We strongly support the provisions of Title I of
your bill, which addresses consumer privacy on the Internet, because it
reflects these principles.
Because we share your objective of comprehensive protection for the
Internet user, we believe that the rules set forth in S. 1055 should
apply to public sector websites as well. We have seen cases where data
collected from the public by government agencies has been transferred,
without the consent of the parties supplying the data, to private
sector entities for commercial purposes.
I would take this opportunity to submit for the Subcommittee's
consideration a letter signed by Mr. Bill Archey, President and CEO of
the American Electronics Association, that expresses the positive views
of that very important organization on the provisions of Title I of
your bill. I also ask for inclusion in the record of the testimony of
Mr. Jeff Nicol, Customer Privacy Manager at Intel, which was previously
provided to the Committee and which I have appended to my statement.
That concludes my remarks. I will be glad to answer any questions
the members of the Subcommittee may have.
Chairperson Feinstein. I would like to introduce John
Avila. Mr. Avila serves as the Executive Counsel for Walt
Disney Company in Burbank, California. His responsibilities
include data privacy law counseling for the domestic and
international operations of Disney's offline and online
businesses. Prior to his time at Disney, Mr. Avila served as
Chief Privacy Officer of a venture capital-funded Internet
company and as litigation counsel to CBS Broadcasting. Mr.
Avila has spoken publicly numerous times on the subjects of
data privacy and First Amendment rights.
Mr. Avila, welcome.
STATEMENT OF JONATHAN D. AVILA, EXECUTIVE COUNSEL, WALT DISNEY
COMPANY, BURBANK, CALIFORNIA
Mr. Avila. Thank you very much, Senator. I am pleased to
appear here today on behalf of the Walt Disney Company to
testify in support of S. 1055, the Privacy Act of 2001.
Protecting the privacy and security of personally identifiable
information is a critical national and international concern
and a matter of high priority at Disney. As one of the most
trusted names in American business, it is vital to us at Disney
that our guests and customers know that we are concerned about
the privacy of the information they give us and that we will
treat their information appropriately.
As a result, we are developing our own statement of privacy
principles, which are largely similar to those set forth in the
Privacy Act of 2001 and which will apply to both our online and
offline activities. Because our primary business is not health
care or finance, my comments today, however, are restricted to
the matters addressed in Title I of the proposed statute and
our suggestion that a provision relating to the security of
consumer data be added to Title I of the statute.
With respect to the matter of notice, we support the
principle found in Section 101(b) that adequate notice requires
a disclosure of the type of information being sought, the
purpose for which the information will be used, and with whom,
if anyone, the information may be shared. We agree, of course,
that to be meaningful, any notice must be clear and
understandable to the consumer and must be given prior to any
marketing use or sharing of the consumer's data.
With respect to the matter of choice, a substantial
argument can be made that consumers should affirmatively give
permission for any use of personally identifiable information,
that is a so-called opt-in consent.
Nonetheless, we believe the bill draws a reasonable
distinction between general information and matters such as
Social Security numbers and information held by financial
institutions and health care providers. These latter types of
information are so sensitive that appropriate protection of
personal privacy requires that the individual providing the
information affirmatively express a willingness to have the
information disclosed to others.
Although there may well be other categories of information
that also deserve this special type of protection, the same
degree of sensitivity is generally not present in the
information sought in a typical commercial transaction and,
hence, an opt-out provision may be sufficient.
Because we believe our guests should have the right to opt-
out of receiving marketing materials from Disney, as well as
having us not share their information with third parties, our
privacy principles will provide multiple choices for our
guests. Thus, a guest may elect to receive marketing or other
information from Disney but opt-out of our sharing of any of
the guest data with third parties. Or the guest may simply opt
not to receive any marketing information at all from Disney and
our related companies.
In this regard, let me now voice some concern about the
scope of Section 101(a) of the Act. There, the Act proposes to
limit its coverage to, one, disclosure of personally
identifiable information to non-affiliated third parties for
marketing purposes, and two, sale of such information to non-
affiliated third parties.
In keeping with our view of consumer privacy, we believe
this subsection should be modified to extend the Act's purview
to all commercial sharing of personally identifiable
information with non-affiliated third parties. In turn, the
exception provided by Subsection (a)(2) should be broadened to
track in appropriately modified form the exceptions provided by
Section 502 of the Gramm-Leach-Bliley Act.
In this manner, consumers would be protected against all
improper and unauthorized disclosure of their personal
information to non-affiliated third parties. At the same time,
non-financial businesses would have the same flexibility that
financial institutions enjoy to disclose information for
legitimate purposes, such as to prevent fraudulent
transactions, comply with governmental regulatory requirements,
and outsource marketing and fulfillment functions to entities
that are contractually obligated to respect the confidentiality
of their customers' data.
Turning to the matter of security, we at Disney believe
that the privacy of personal information is only as strong as
the security measures that protect that information. We
therefore suggest adding to the bill a requirement that
entities that collect consumers' personal information maintain
reasonable security measures to safeguard the confidentiality
of that information. Of course, for general consumer
information, such as that covered by Title I of this
legislation, those security measures need not be as elaborate
as the measures that apply to the sensitive data held by
financial institutions and health care providers.
Perhaps the most important provision of this measure is
Section 105, which provides for preemption of State, common,
and statutory law. Broad Federal preemption is critical to this
or any similar legislation. As we all know, the Internet has
shrunken our world further than we could ever have imagined. As
a result, information given in one jurisdiction can appear in
another in a nanosecond.
While the international implications of this fact are
themselves daunting, the prospect of the several States acting
to address these issues in varying and perhaps conflicting ways
is horrifying. One of the great strengths of our country lies
in the integration of our national economy under Federal
control over interstate commerce. Without broad Federal
preemption in this area, the inevitable patchwork of State laws
will present a formidable barrier to commerce and will, in
essence, cede what should be a Federal mandate to the parochial
interests of the various States.
American business simply cannot operate efficiently under a
myriad of conflicting rules governing national economic
activity. Thus, it is vital that, at least for the United
States, there be a single set of rules on this subject mandated
through Federal legislation and preemption.
In closing, we at the Walt Disney Company congratulate you,
Senator Feinstein, on the bill's approach to balancing the need
for governmental regulation with responsible action through
FTC-approved safe harbor programs. Indeed, as I mentioned at
the outset, we soon will be backing our commitment to our guest
privacy with the adoption of our own voluntary privacy
principles.
Thank you. I would be pleased to answer any questions the
subcommittee may have.
Chairperson Feinstein. We will have some, and thank you
very much.
[The prepared statement of Mr. Avila follows:]
Statement of Jonathan D. Avila, Executive Counsel, The Walt Disney
Company
Good afternoon. My name is Jonathan Avila and I am pleased to
appear here today on behalf of The Walt Disney Company to testify in
support of Senate Bill 1055, the ``Privacy Act of 2001.''
Protecting the privacy and security of personally identifiable
information is a critical national and international concern, and a
matter of high priority at Disney. As one of the most trusted names in
American business, it is vital to us at Disney that our guests and
customers know that we are concerned about the privacy of the
information they give us and that we will treat their information
appropriately.
As a result, we are developing our own Statement of Privacy
Principles, which are largely similar to those set forth in the Privacy
Act of 2001 and which will apply to both our online and offline
activities. Because our primary business is not healthcare or finance,
my comments today, however, are restricted to the matters addressed in
Title I of the proposed statute, and our suggestion that a provision
relating to the security of consumer data be added to Title I of the
statute.
Notice
With respect to the matter of notice, we support the principle
found in Section 101(b) that adequate notice requires a disclosure of
the type of information being sought, the purposes for which the
information will be used and with whom, if anyone, the information may
be shared. We agree, of course, that, to be meaningful, any notice must
be clear and understandable to the consumer, and must be given prior to
any marketing use or sharing of the consumer' s data.
Choice
With respect to the matter of choice, a substantial argument can be
made that consumers should affirmatively give permission for any use of
personally identifiable information (that is, a so-called ``opt-in''
consent). Nonetheless, we believe the Bill draws a reasonable
distinction between general information, and matters such as social
security numbers and information held by financial institutions and
health care providers. These latter types of information are so
sensitive that appropriate protection of personal privacy requires that
the individual providing the information affirmatively express a
willingness to have the information disclosed to others.
Although there may well be other categories of information that
also deserve this special type of protection, the same degree of
sensitivity is generally not present in the information sought in a
typical commercial transaction and hence an opt-out provision may be
sufficient.
Because we believe our guests should have the right to opt out of
receiving marketing materials from Disney, as well as having us not
share their information with third parties, our Privacy Principles will
provide multiple choices for our guests. Thus, a guest may elect to
receive marketing or other information from Disney, but opt out of our
sharing any of the guest's data with third parties. Or, the guest may
simply opt not to receive any marketing information at all from Disney
and our related companies.
In this regard, let me now voice some concern about the scope of
Section 101 (a) of the Act. There, the Act proposes to limit its
coverage to: (1) disclosure of personally identifiable information to
nonaffiliated third parties for marketing purposes; and, (2) sale of
such information to nonaffiliated third parties. In keeping with our
view of consumer privacy, we believe this subsection should be modified
to extend the Act's purview to all commercial sharing of personally
identifiable information with nonaffiliated third parties. In turn, the
exception provided by Subsection (a) (2) should be broadened to track,
in appropriately modified form, the exceptions provided by Section 502
of the Gramm-Leach-Bliley Act. In this manner, consumers would be
protected against all improper and unauthorized disclosure of their
personal information to nonaffiliated third parties. At the same time,
non-financial businesses would have the same flexibility that financial
institutions enjoy to disclose information for legitimate purposes,
such as to prevent fraudulent transactions, comply with governmental
regulatory requirements, and outsource marketing and fulfillment
functions to entities that are contractually obligated to respect the
confidentiality of their customers' data.
Security
Turning to the matter of security, we at Disney believe that the
privacy of personal information is only as strong as the security
measures that protect that information. We therefore suggest adding to
the Bill a requirement that entities that collect consumers' personal
information maintain reasonable security measures to safeguard the
confidentiality of that information. Of course, for general consumer
information, such as that covered by Title I of this legislation, those
security measures need not be as elaborate as the measures that apply
to the sensitive data held by financial institutions and health care
providers.
Preemption
Perhaps the most important provision of this measure is Section
105, which provides for preemption of state common and statutory law.
Broad federal preemption is critical to this or any similar
legislation. As we all know, the Internet has shrunken our world
further than we could ever have imagined. As a result, information
given in one jurisdiction can appear in another in a nanosecond. While
the international implications of this fact are themselves daunting,
the prospect of the several States acting to address these issues in
varying and perhaps conflicting ways is horrifying.
One of the great strengths of our country lies in the integration
of our national economy under federal control over interstate commerce.
Without broad federal preemption in this area, the inevitable patchwork
of state laws will present a formidable barrier to commerce and will,
in essence, cede what should be a federal mandate to the parochial
interests of the various States. American business simply cannot
operate efficiently under a myriad of conflicting rules governing
national economic activity. Thus, it is vital that, at least for the
United States, there be a single set of rules on this subject mandated
through federal legislation and preemption.
In closing, we at The Walt Disney Company congratulate Senator
Feinstein on the Bill's approach to balancing the need for governmental
regulation with responsible private action through FTC-approved Safe
Harbor programs. Indeed, as I mentioned at the outset, we soon will be
backing our commitment to our guests' privacy with the adoption of our
own voluntary Privacy Principles.
Thank you. I would be pleased to answer any questions the sub-
committee may have.
Chairperson Feinstein. Senator Kyl, I understand there is
going to be a vote at 4:20. My suggestion is that we go and
hear Mr. Torres and then we can decide whether we spell each
other or take a recess.
Mr. Torres is the Legislative Counsel in Washington for the
Consumers Union. He is responsible for advocating for consumers
before Congressional agencies and the Federal Reserve Board on
issues related to financial services. Mr. Torres's area of
expertise includes privacy, electronic commerce, and consumer
credit.
We welcome you, Mr. Torres.
STATEMENT OF FRANK TORRES, LEGISLATIVE COUNSEL, CONSUMERS
UNION, WASHINGTON, D.C.
Mr. Torres. Thank you, Madam Chairwoman and Senator Kyl. It
is a pleasure to be here and we appreciate the opportunity to
testify before the committee today and are grateful that you
have once again turned your attention to the serious topic of
consumer privacy.
Before I get into my testimony in earnest, though, I wanted
to respond to an earlier question about where consumers can go,
where can victims of identity theft go for help. In addition to
Consumer Reports magazine, which has written through the years
on the topic of identity theft and how consumers can protect
their privacy, Beth Givens at the Privacy Rights Clearinghouse
is a tremendous source of information for victims of identity
theft and how consumers can prevent it. Her website is at
www.privacyrights.org and she actually has a fact sheet,
``Identity Theft: What To Do If It Happens To You,'' that goes
step by step of all the different areas, all the different
places that you should think about contacting if you are the
victim of identity theft, from the credit bureaus on down.
In addition, I believe that the FTC's website has a new
feature and that is an affidavit, a model affidavit that
consumers can use to submit to the different credit bureaus and
creditors if they are victims of identity theft.
S. 1055 will protect security numbers, prevent identity
theft, and maybe put an end to some of the tragic stories we
have heard here today. Given the severity of identity theft and
its cost to both business and consumers, it is crucial that the
selling and sharing of Social Security numbers be curbed. I
would like to focus my testimony today, however, on some of the
other privacy aspects of this bill. How times have changed when
we have got forward-thinking companies advocating Federal
privacy laws, and we have two of them here today and we
appreciate their efforts on moving the debate on privacy
forward.
Consumers Union has advocated in favor of strong privacy
protections. With other consumer and privacy advocates, we have
pushed for privacy amendments to the Gramm-Leach-Bliley Act. We
fought for strong medical privacy regulations and are part of a
broad coalition that supports online privacy protections. Here
are some of the reasons we believe this bill is good.
First, the comprehensive approach of S. 1055 will provide
both consumers and businesses with clear expectations of how
information will be treated, when it can be shared, and how the
flow of information can be controlled. Those protections will
be in place wherever information is gathered. Whether privacy
is lost because a website places a cookie on a personal
computer or because information is obtained from a warranty
card does not really make a difference to the consumer. Both
are troubling invasions of privacy.
Applying privacy protections in both online and offline
settings is a fresh approach. Up to now, privacy has been
addressed sector by sector. Often, we hear complaints from
businesses that one sector is being treated differently from
another. S. 1055 responds to those concerns.
Second, S. 1055 advances the privacy debate by recognizing
the distinction between sensitive and non-sensitive data. We
have commented that more sensitive personal data, like
financial and medical information, warrant the strongest
possible protections. A business should first obtain a
consumer's consent before collecting or sharing that
information. Where data is used solely for marketing purposes,
a less rigorous approach may be enough. We encourage providing
specific, uniform, and up-front mechanisms for exercising this
opt-out, especially after seeing what happened with the notices
required under the Gramm-Leach-Bliley Act. We also support the
bill's prohibition on denying service to consumers refusing to
grant consent to data sharing.
Third, S. 1055 offers a substantial improvement over the
privacy provisions of the Gramm-Leach-Bliley Act by providing
that financial information cannot be shared with third parties
without express consent of consumers. This discussion about
privacy should also consider other areas.
Consumers Union believes that it is critical to seek input
from the States before deciding to preempt State privacy
efforts. We would not support legislation preempting State laws
where the Federal law is weak. States like California are
moving forward with strong privacy bills similar to some of the
provisions in S. 1055. While Congressional efforts may lag
these State initiatives, sponsors of those bills should take
note that they are on target with Federal proposals.
It should also be clear that S. 1055 will not roll back
existing laws, such as the consumer privacy protections in the
Communications Act. Just yesterday, Comcast, one of the largest
cable TV providers in the country, abandoned collecting data
from their subscribers. This collecting was done in violation
of the law in which Congress placed a high priority on
protecting customer viewing habits.
We also support other efforts to curb identity theft and
assist victims, like the Reclaim Your Identity Act recently
introduced by Senator Cantwell.
Last but not least, the selling and sharing of Social
Security numbers between businesses warrants scrutiny. In some
cases, it may open the door to abuses.
In summary, S. 1055 does not ban the collection and use of
personal data. It merely gives consumers control over their own
information and it places a burden on businesses that want
information to convince consumers to share it. That sounds like
how the marketplace should be working.
Thank you, and I would be happy to answer any questions.
Chairperson Feinstein. Thank you very much, Mr. Torres.
[The prepared statement of Mr. Torres follows:]
Statement of Frank Torres, Legislative Counsel for Consumers Union
Consumers Union \1\ appreciates the opportunity to present this
testimony on the Privacy Act of 2001, S. 1055. This hearing provides a
forum to discuss why American consumers need meaningful and
comprehensive privacy protections.
---------------------------------------------------------------------------
\1\ Consumers Union is a nonprofit membership organization
chartered in 1936 under the laws of the State of New York to provide
consumers with information, education and counsel about goods,
services, health, and personal finance; and to initiate and cooperate
with individual and group efforts to maintain and enhance the quality
of life for consumers. Consumers Union's income is solely derived from
the sale of Consumer Reports, its other publications and from
noncommercial contributions, grants and fees. In addition to reports on
Consumers Union's own product testing, Consumer Reports with
approximately 4.5 million paid circulation, regularly, carries articles
on health, product safety, marketplace economics and legislative,
judicial and regularly, carries articles on health, product safety,
marketplace economics and legislative, judicial and regulatory actions
which affect consumer welfare. Consumers Union's publications carry no
advertising and receive no commercial support.
---------------------------------------------------------------------------
Consumers Union has long been an advocate for strong privacy
protections. Along with other consumer and privacy advocates we pushed
for amendments to the Gramm-Leach-Bliley Act to try to provide
consumers control over how their personal financial information is
collected and whether it could be shared. We fought for strong medical
privacy regulations and continue to push for privacy related to health
like genetic information. Consumers Union is also part of a broad
privacy coalition that has supported online privacy protections.
Stronger laws are needed to give consumers control over the
collection and use of their personal information. Legislative efforts,
such as S. 1055 will help ensure that consumers are told about how and
why information is collected and used, provided access to that data,
and given the ability to choose who gets access to their most intimate
personal data.
There are a number of elements of privacy protection that have
become clearer over the course of our involvement in the privacy debate
which are reflected in S. 1055:
A comprehensive approach to privacy protection, like S.
1055, is warranted. For consumers, the comprehensive approach of S.
1055 has advantages clear expectations of how their information will be
treated, when it can be shared and how the flow of information can be
controlled. The distinctions between privacy intrusions are sometimes
lost on consumers. Whether privacy is lost because of a cookie placed
on a personal computer after visiting a website or because information
obtained from a warranty card is collected and sold it really does not
make a difference. Applying privacy protections in both online and
offline settings is a fresh approach that has merit considering how the
privacy debate has developed. Up to now the approach to privacy has
been sector by sector. There are bills on financial privacy, medical
privacy and online privacy. Often we hear complaints that one sector is
being treated differently than another. S. 1055's comprehensive
approach addresses those concerns. If industry wants fair and clear
rules that treats everyone the same, they should be supportive of S.
1055's comprehensive approach.
A distinction can be made between sensitive and non-
sensitive information. S. 1055 advances the privacy debate by
recognizing the distinction between sensitive and non-sensitive data.
We have commented that more sensitive personal data, like financial and
medical information, warrant the strongest possible protections. For
this type of data we favor an approach that requires a business to
obtain the consumer's consent prior to sharing that data.
Provided other data collected is used solely for marketing
purposes a lessor standard may be appropriate. We support this approach
only if clear notice is given to the consumer prior to the collection
of the data and that the consumer is given the opportunity up front to
choose not to have his or her information shared with others. We
encourage providing specific and uniform mechanisms for exercising an
opt-out. Several states are implementing ``do-not-call'' lists. Even
the Direct Marketing Association maintains such a list. A one-stop
universal opt-out would be a useful tool for consumers. The Federal
Trade Commission has recently published a proposed rule for a national
do-not-call list.
Consumers need a stronger law to protect their personal
financial information. S. 1055 offers a substantial improvement over
the privacy provision of the Gramm-Leach-Bliley Act by providing that
financial information cannot be shared with third parties without the
express consent of the consumers. The Gramm-Leach-Bliley Act falls far
short of providing meaningful privacy protections in the financial
setting. Loopholes in the law and in this draft rule allow personal
financial information to be shared among affiliated companies without
the consumer's consent. In many instances, personal information can
also be shared between financial institutions and unaffiliated third
parties, including marketers, without the consumers consent. Consumers
across the country are receiving privacy notices from their financial
institutions. Unfortunately these opt outs, in reality, will do little
or nothing to prevent the sharing of personal information with others.
Other loopholes allow institutions to avoid having to disclose all of
their information sharing practices to consumers. In addition, the GLB
does not allow consumers to access to the information about them that
an institution collects. While states were given the ability to enact
stronger protections, those efforts have met fierce resistance by the
financial services industry.
Consumers' health information should not be shared without
their express consent. S. 1055 protects personal health information
across the board under the bill health information cannot be shared
without the prior consent of the consumer.
The sale of social security numbers to the public should
be banned. Public disclosure of social security numbers should be
limited. Businesses should be prohibited from denying services if a
consumer does not wish to provide a social security number in certain
circumstances. S. 1055 shuts down many avenues that lead to the release
of social security numbers.
Commercial entities that collect personal information
should be responsible for providing notice to consumers if they intend
to share personal data with others and allow consumers to opt-out of
such data collection and sharing third parties. S. 1055 requires notice
and consent prior to the sharing of personal information with a non-
affiliated entity.
Sound and comprehensive privacy laws will help increase consumer
trust and confidence in the marketplace and also serve to level the
playing field. These laws do not have to ban the collection and use of
personal data, merely give the consumer control over their own
information.
The remainder of these comments provide greater detail on privacy
issues related to marketing, financial data, health data, and identity
theft.
Marketing
Consumers face aggressive intrusions on their private lives. Often
a consumer is forced to provide personal information to obtain products
or services. Many times information that has been provided for one
purpose is then used for another reason, unbeknownst to the consumer.
Financial institutions, Internet companies health providers and
marketers have been caught crossing that line. Meanwhile, identity
theft is at an all time high.
Increasingly, consumers want to choose who does and does not have
access to their medical, financial and other personal information.\2\
If access is needed consumers want to be able to specify for what
purposes and to what extent access will be granted. Consumers want
assurances that the information they consider sensitive will be kept
private by the businesses they use. Often, consumers have no choice in
whether or not information is collected and no choice in how it is
used. Today, any information provided by a consumer for one reason,
such as getting a loan at a bank, can be used for any other purposes
with virtually no restrictions.
---------------------------------------------------------------------------
\2\ Consumers continue to care about their privacy. A recent survey
by Forester Research found that 72% of consumers participating in the
study said that it was an extreme violation of their privacy for
businesses to collect and then supply data about them to other
companies. Another survey by Public Opinion Strategies found that
strengthening privacy laws to assure that medical, financial, or
personal records are kept private is one of the highest-rated issues of
concern to consumers nationwide.
S. 1055 will allow consumers to opt-out of sharing of
information with third parties for marketing purposes. This requirement
should be easy to implement, in most cases consumer choice can be
provided at the point where the information is collected. Consumers are
sometimes given that choice today in both online and offline settings.
The opt-out for marketing purposes is distinguishable from
a stricter regime for the collection and use of sensitive financial and
health information. So long as the information collected is used solely
for marketing purposes, an opt-out approach may be adequate provided
notice and choice is provided up front, prior to the collection of the
data, and that the notice and choice is clear and in plain English. The
opt-out must be easy for consumers, unlike the opt-out under the Gramm-
Leach Bliley Act. The opt-out provided by most financial institutions
have proven difficult for consumers to understand and hard to exercise.
If properly provided the notice and opt-out contemplated in this
legislation could result into a system where consumers may indicate
that they want no calls, then individually choose, on a case-by-case,
merchant -by-merchant basis, to consent to information collection and
use by parties they trust or believe will provide some benefit.
Exceptions to the opt-out requirement should be minimal.
The exceptions provided in the legislation appear to be reasonable and
should not be expanded.
It is appropriate to allow the Federal Trade Commission to
have enforcement authority. The FTC has taken a leadership role in
protecting consumer privacy. The agency was given specific authority
under the GLB to implement those privacy provisions. In addition it has
held numerous workshops and convened advisory committees on the issue
of privacy.
The use of seal programs to provide for a safe harbor
needs strict scrutiny and oversight. Consumers Union, and many other
advocacy organizations remain skeptical of the ability of industry
groups to self-regulate. Seal programs are often dependent on the very
firms they are supposed to scrutinize. If a safe harbor remains in the
bill, there should also be a mechanism to evaluate whether the program
is effective and ensure that the requirements of the program are as
strict as the protections contained in the bill.
Consumers Union believes that it is critical to seek the
input from the states, including state attorneys general and
legislators, before deciding to preempt state privacy efforts.
Financial Privacy
Consumers have reason to be concerned about how their private
financial information is being collected, used, shared and sold. Under
the GLB there are no limits on the ability of a financial institution
to share information about consumers' transactions, including account
balances, who they write checks to, where they use a credit card and
what they purchase, within a financial conglomerate. Because of
loopholes in GLB, in most cases sharing a consumer's sensitive
information with a third party is allowed too. All the exceptions
created by GLB make it difficult to come up with a list of
circumstances where personal financial information cannot be shared.
Financial institutions promised that in exchange for a virtually
unfettered ability to collect and share consumers' personal
information, that consumers would get better quality products and
services and lower prices. This is why, they claimed, consumers
shouldn't have strong privacy protections like the ability to stop the
sharing of their information among affiliates, or access to that
information to make sure its accurate.
Bank fees for many consumers continue to rise. Information about
financial health may actually be used to the consumer's determent if it
is perceived that the consumer will not be as profitable as other
customers. Both Freddie Mac and Fannie Mae say between 30 and 50% of
consumers who get subprime loans, actually qualify for more
conventional products, despite all the information that is available to
lenders today. Credit card issuers continue to issue credit cards to
imposters, thus perpetuating identity theft, even when it seems like a
simple verification of the victim's last known address should be a
warning. Instead of offering affordable loans, banks are partnering
with payday lenders. And when do some lenders choose not to share
information? When sharing that information will benefit the consumer--
like good credit histories that would likely mean less costly loans.
Chase Manhattan Bank, one of the largest financial institutions in
the United States, settled charges brought by the New York attorney
general for sharing sensitive financial information with out-side
marketers in violation of its own privacy policy. In Minnesota, U.S.
Bancorp ended its sales of information about its customers' checking
and credit card information to outside marketing firms. Both of these
were of questionable benefit for the bank's customers. Other
institutions sold data to felons or got caught charging consumers for
products that were never ordered.
Consumers should have the right to be fully and meaningfully
informed about an institution's practices. Consumers should be able to
choose to say ``no'' to the sharing or use of their information for
purposes other than for what the information was originally provided.
Consumers should have access to the information collected about them
and be given a reasonable opportunity to correct it if it is wrong. In
addition to full notice, access, and control, a strong enforcement
provision is needed to ensure that privacy protections are provided.
S. 1055 requires that consumers opt-in before financial
information can be shared with third parties.
S. 1055 also provides that a consumer cannot be denied
service for refusing to consent to the sharing of his or her
information.
The exceptions contained in S. 1055 are limited to
reasonable expectations related to the primary use of personal data.
Legislative efforts in this body, like S. 1055, send a
strong message to those in the states pursuing similar privacy
protections. It is clear that states, like California, are on the right
tract in pushing forward with bills like California Senate Bill 773,
which will provide strong financial privacy protections in that state.
While congressional efforts may lag these state initiatives, sponsors
of those bills should take note that they are on target with what
federal legislators are considering.
Medical Privacy
Medical information has been used for inappropriate purposes. The
medial privacy rule promulgated by the Department of Health and Human
Services highlighted a number of cases where private medical
information was released for profit and marketing purposes completely
unrelated to the treatment of those patients. A USA Today editorial
earlier this year highlighted the consequences of a failure to protect
medical privacy. The editorial cited various privacy intrusions an
employer firing an employee when they got the results of a genetic
test; release of medical records to attack political opponents; and
hackers getting access to health records from a major University
medical center (USA Today, March 20, 2001).
Patients should not be put in the position of withholding
information or even lying about their medical conditions to preserve
their privacy. Those seeking medical treatment are most vulnerable and
should be allowed to focus on their treatment or the treatment of their
loved ones, rather than on trying to maintain their privacy. It is
unfair that those citizens must be concerned that information about
their medical condition could be provided to others who have no
legitimate need to see that information.
S. 1055 requires a customer's affirmative consent before
individually identifiable health information can be shared across the
board. The bill extends the protections of the HHS rules to cover any
setting across the board.
Identity Theft
Beth Givens of the Privacy Rights Clearinghouse estimates that
there were 500,000 to 700,000 victims of identity theft last year. The
number of complaints to the FTC almost doubled from March to December
2001. It is very easy to obtain social security numbers. Non-social
security administration uses of social security numbers have not been
prohibited. As a result, social security numbers are used as
identification and account numbers by many entities.
The Internet provides an easy and cheap way to get personal
information. Web sites sell individuals' social security numbers, some
for as little as $20. Self-regulatory efforts by information brokers
has been in effective in restriction the sale of sensitive personal
information to the general public.
Other elements to consider are the practices of the credit and
credit reporting industries. They must also work to prevent fraud and
help victims recover from identity theft. Many consumers have no idea
how they become victims of identify theft. Often, they do not find out
their personal information has been misused for more than a year, and
sometimes as long as five years. Victims must spend significant amounts
of time contacting creditors and credit reporting agencies in order to
repair the damage done to their credit histories. In the meantime, they
are often unable to obtain credit and financial services,
telecommunication and utility services, and sometimes employment.
The expanded use of the SSN as a national identifier has given rise
to individuals using counterfeit SSNs and SSNs belonging to others for
illegal purposes. Stolen SSNs have been used to gain employment,
establish credit, obtain benefits and services, and hide identity to
commit crimes.
One of the unfortunate results of the events of last September are
reports of identity theft scams. Criminals have tried to obtain data
from the unsuspecting families of victims of that tragedy. This should
remind creditors that they have a responsibility to verify the identity
of individuals prior to issuing lines of credit.
The FTC is taking steps to assist the victims of identity theft,
but it is also important to focus on preventing the theft in the first
place. As an FTC official recently stated, `` in this day of remote
transactions and greater access to publicly available information on
each of us, identity theft has never been easier to commit.''
S. 1055 helps take Social Security numbers out of
circulation. It would prohibit the commercial sale of SSNs. The bill
would also limit uses of SSN s by private sector entities and stop the
display of SSNs by government agencies.
S. 1055 provides civil penalties for misuse of SSNs. We
believe a private right of action provides consumers with a meaningful
safeguard against businesses who should be held accountable for the
misuse of SSNs.
The legislation is a useful step in protecting SSNs and
curbing identity theft. Given the severity of identity theft, and the
cost to both business and consumers, there remains a need to monitor
and assess the effectiveness of any legislation designed to prevent
this problem.
Chairperson Feinstein. I just want to enter into the record
that I am very pleased to also add to the support of this bill
eBay, NCR, the American Medical Association and Pacific Life
Insurance Company. I want to indicate that this bill did not
just emerge. It has been worked on over a substantial period of
time and I wanted to thank everybody at the table who has
helped us with this. It is a new area. I think it does provide
the national floor, so to speak. It preempts State law in that
sense. It does apply to online/offline.
I would like to begin my questions, if I can, with a
question of Mr. Avila because I did not quite understand. I am
reading Section 101 of my bill and also Section 502 of Gramm-
Leach-Bliley and I did not understand the point that you were
making.
Mr. Avila. We are concerned, Senator, that we believe that
privacy protection should be extended to all sharing,
commercial sharing of information with third parties, but if
that is done, then the exception in S. 1055 needs to be
broadened somewhat because it covers--it is now specific to the
limitations on sharing that are in the bill.
Chairperson Feinstein. How would you broaden it? What would
you add to it?
Mr. Avila. We would suggest not restricting the coverage to
sale of personal information to non-affiliated third parties
and leave the statute disclosure for marketing purposes. We
believe it should apply to any purpose for which personal
information is disclosed to a third party.
Chairperson Feinstein. That was the point you were making,
Mr. Comer, is that right?
Mr. Comer. My point was slightly different, which was I was
suggesting that the bill should apply, as well, to public
websites. Perhaps that is what you were thinking of when I was
talking about that there should not be--
Chairperson Feinstein. Right. Do you agree with the point
Mr. Avila is making?
Mr. Comer. I agree in the sense that we think that the
restrictions on disclosure or use or sale should all be
embraced or encompassed within the privacy protections that you
articulate. We can work with your staff on this if there is a
perceived gap.
Chairperson Feinstein. All right. We appreciate that.
Mr. Torres. Senator?
Chairperson Feinstein. Mr. Torres?
Mr. Torres. If I might, I have got some concerns about
extending the--including any more exceptions when we are
talking solely about the use of this information for marketing
purposes. Section 303 of S. 1055 does incorporate for purposes
of the sale of financial information and the use of financial
information the Section 502 exclusions under Gramm-Leach-Bliley
and some of those are reasonable in the context of servicing
accounts and making sure that the consumer is able to
correspond and those types of things.
So we would be happy to work with your staff as to whether
or not any of those types of exceptions might be reasonable,
but at this point, we would be skeptical about opening it up
for marketing, when you are talking about using information for
marketing purposes.
Chairperson Feinstein. Mr. Avila, I tend to come down on
Mr. Torres's side on that and I do not understand why you would
want this.
Mr. Avila. We simply believe that sharing should--that the
coverage of the statute should not be restricted to sharing
with third parties for marketing purposes but it should cover
any purpose for which information is shared.
Chairperson Feinstein. Like what?
Mr. Avila. Well, there may be other purposes that are not
specifically for marketing, but any commercial purpose.
Marketing seems to be, to us, too limited.
Chairperson Feinstein. You do not think that is the barn
door through which the Mack truck can be driven?
Mr. Avila. Well, Senator, we are proposing extending not
the exceptions but the coverage of the statute.
Chairperson Feinstein. Oh, I see. All right.
Mr. Avila. And then, as a consequence of that--
Chairperson Feinstein. I misunderstood, then. I thought you
were--
Mr. Avila. Yes.
Chairperson Feinstein. Then I think we are all on the same
wavelength--
Mr. Avila. Now, naturally--
Chairperson Feinstein [continuing]. So we ought to be able
to work that out.
Mr. Avila. Naturally, if the coverage were extended, the
exceptions would have to conform to the extension of the
coverage, so, for example, fraud prevention and other
reasonable exceptions should follow the extension of the
purview of the covered portions of the Act.
Chairperson Feinstein. Right. I think that is excellent. I
think we can work it out. Perhaps while you are all here, you
can sit down with the staff and do some wordsmithing.
I gather the safe harbor provisions that exempts businesses
with good privacy protections from government regulation, it is
my understanding that Disney is a member of the TRUSTe Privacy
Program, a seal program that sets minimum privacy standards. I
want to ask you, what are your views of the safe harbor
provisions of this bill? I want to ask also this question. Does
Disney regularly review its data collection operations to
ensure compliance with its own privacy standards?
Mr. Avila. As to your first question, Senator, we are
members of the TRUSTe seal program. We believe that TRUSTe has
made important strides in formulating a structure for
protecting consumers' online privacy. The gap in the protection
online is not for seal participants but rather for non-seal
participants, and since the TRUSTe program and the BBB Online
program are not compulsory, they do not cover the actions of
the so-called bad actors who choose not to participate in those
programs and who do not follow the regime of protection that
those programs mandate.
We believe that the safe harbor provisions of the Act are a
highly appropriate way of combining the flexibility of the seal
programs with a mandate that all entities that gather consumer
information must follow appropriate privacy protections and we
are highly supportive of the safe harbor provision.
Chairperson Feinstein. Mr. Comer?
Mr. Comer. I wonder if I might just respond to that, as
well.
Chairperson Feinstein. Certainly.
Mr. Comer. We are not only on the board of TRUSTe, but also
on the board of BBB Online, and so we have had a very strong
voice in working to bring these organizations into existence
and strengthen them over the last few years.
I would say we view the safe harbor provisions as not only
very well written, but extremely important to the whole schema
of the bill, and the reason for that is because you want an
incentive that will bring, if you will, the startups, the small
businesses, the others that are just learning about privacy
responsibility into the self-regulatory organizations because
they do an enforcement role which the FTC will never be able to
duplicate. They do random checks. They do periodic audits and
so forth and that enables the safe harbor programs, the seal
programs, excuse me, to be kind of an extended arm of
enforcement and compliance.
The way your bill is structured, we think the good players
will migrate naturally to those programs in order to benefit
from the safe harbor, and in that way, their privacy practices
will be sharpened, improved, and better supervised.
Chairperson Feinstein. Mr. Torres? Thank you.
Mr. Torres. Senator, consumer advocates in general are
somewhat wary of the industry's regulating itself. I know that
there are some seal programs that are out there today and they
were mentioned here today--
Chairperson Feinstein. It seems to me I have heard that
before.
Mr. Torres [continuing]. That are really trying to do the
right thing. We fear lack of enforcement as one thing. The
other thing is sometimes that you could have a seal program
that simply says, if you have a privacy policy, that is what we
require, and we know from experience that a company's privacy
policy can be fairly horrible and we just want to make sure
that those types of seal programs do not get included as part
of the program. We would be more than happy to work with your
staff on how to make sure there is some oversight, and I think
there is some provision for the FTC to take a look at the seal
programs that are kind of approved for this purpose.
Chairperson Feinstein. Good. Well, from this point on, I
would like to work together to see that the consumer interest
as well as the business interests are protected, because when
we started this, it was very difficult, as you know. Nobody
wanted opt-in in any way, any shape, or any form. So you
gentlemen in the business community are really in the forefront
of this and I really want to commend you. I am very grateful
for this support. I think it is very important that we work
together as we make any changes in this that need to be made. I
think we have got a pretty good bill that goes as far as it can
go.
In looking for points of controversy, one thing may be that
we allow for or provide for State enforcement, and one of my
reasons is it is the only way the bill is really going to get
enforced. You heard the testimony of the GAO, how little the
Federal aspect of this has to look into it. So I think the
State enforcement of it is extraordinarily important. Do any of
you have a view on that?
Mr. Comer. I agree with your view on that because you now
have the 50 State attorneys general who will be in a position
under this bill to carry forward, if you will, extend the reach
of the FTC's jurisdiction and I think the Commission is quite
comfortable with that kind of a model. It has been used in COPA
and in other pieces of legislation. Provided, as your text is
written, that this is subject to the, if you will, the rights
of intervenor of the FTC and FTC oversight, we are quite
comfortable with State enforcement in this context.
Chairperson Feinstein. Good. Good.
Mr. Comer. I would say it is an equally important part of
the preemption provisions that there is no new private right of
action created by your bill and that will help keep the law
uniform and straightforward with regard to consumer rights.
Chairperson Feinstein. Right. I understand that.
Mr. Avila, do you have a comment?
Mr. Avila. Yes. We would agree that it is very important
that there be a single uniform national standard. The vesting
authority in the FTC and in the attorneys general is a very
important way to achieve that uniformity.
Chairperson Feinstein. Thank you.
Mr. Torres. Senator?
Chairperson Feinstein. Certainly. Go ahead.
Mr. Torres. If I may, on the preemption question, as I said
in my testimony, it is crucial, then, that if there is
preemption, that the underlying bill be as strong as possible,
and your bill is fairly strong on a number of points. And so
that for us may be the tradeoff. We get preemption thrown at us
quite a bit. It undermines a lot of good State efforts in
various areas and so that is why I also said in my testimony
that we really need to consult with some of the States.
As far as the attorneys general having some enforcement
authority here, the attorneys general have done a tremendous
job on the issue of privacy both in California and in
Minnesota. It was one of the reasons why privacy became such an
important part of the Gramm-Leach-Bliley debate, because there
were abuses of personal financial information.
So those are just things that we need to be working on
through the discussion of this legislation.
Chairperson Feinstein. Thank you very much. I mean, there
is no way of doing a bill unless you have preemption because
you are going to have different laws in every State and how do
you follow that on an online community? You cannot, so it
becomes extraordinarily difficult to have any meaningful reform
unless you establish that national preemption.
In any event, I think we have done it today. Let me thank
you. Ms. Fisher, let me thank you so much for coming this
distance to testify and I hope you will work along with the
staff to see that victims' rights are protected as we move this
legislation along.
It is my intention to have another hearing, I think it is
on March 19, and we will consider Senator Cantwell's bill and
another bill that Senator Kyl and I have, and then hopefully,
if all goes well, maybe combine them into one bill so that we
can then move on to the full committee. I would hope that you
all would look at those bills, as well, and let us know if you
think they are mutually compatible. I appreciate that.
Mr. Comer. Senator, can I just--
Chairperson Feinstein. Senator Thurmond has a statement,
which I will put in the record.
We will enter Senator Grassley's statement in the record,
as well.
Mr. Comer, did you have a comment?
Mr. Comer. A final comment. I want to thank your staff for
their very fine work and working closely with us to polish some
of the provisions.
Chairperson Feinstein. Thank you very much.
Mr. Torres. I second that.
Chairperson Feinstein. And Senator, thank you very much,
and I particularly appreciate that. It has been a lot of work.
Let me thank the witnesses. The hearing is adjourned.
[Whereupon, at 4:38 p.m., the subcommittee was adjourned.]
[Submissions for the record follow.]
SUBMISSIONS FOR THE RECORD
American Electronics Association
Washington, D.C.20004
February 12, 2002
The Hon. Dianne Feinstein
U.S. Senate
331 Hart Building
Washington, DC 20510
Dear Senator Feinstein:
Thank you for your ongoing leadership on the very important issue
of privacy. AeA has a significant interest in ``The Privacy Act of
2001'' (S. 1055). I write in support of the essential elements of Title
I of this bill. While we have concerns about other titles of the bill,
we do want to express our commitment to work with you in your efforts
to strengthen protections for consumer privacy on the Internet
As you know, AeA is the largest high-technology trade .association
in America, representing over 3,500 companies that develop and
manufacture software, electronics, and high technology products. Our
member companies range from large, industry leaders to small and medium
sized high-technology start up ventures. As such, online consumer
confidence is of paramount concern to AeA members. Furthermore, many
AeA companies use information gathered from their customers to alert
them to new products and services that may be useful in their homes or
offices. The proper use of this information is essential to the growth
of the Internet economy. Therefore, any attempt to regulate information
practices must be approached with caution and only after careful
consideration of the potential unintended consequences of such
regulation.
It is important to emphasize that our current support for federal
preemption legislation is a direct response to the multiplicity of
state privacy initiatives that were considered during 2000 and 2001.
AeA believes that patchwork state regulation will reduce consumer
confidence online by presenting consumers with conflicting privacy
protections, as well as harm small and medium sized businesses by
forcing them to comply with a multiplicity of regulations. Also, we
continue to believe that industry self-regulatory efforts must play a
significant role in any federal proposals.
AeA's Board has approved principles for federal legislation that
are set forth at the end of this letter. Fundamental to these
principles are the benchmarks of notice, choice, and uniform federal
standards for privacy protection. We are very pleased that Title I of
your bill includes clear notice and choice provisions consistent with
our principles, as well as a strong federal preemption section that
would provide certainty for both consumers and businesses about their
respective rights and responsibilities. Importantly, your bill would
also apply these same requirements to offline data collection
activities. This is consistent with our principle that policy should
not discriminate between online and offline activities to the
disadvantage of e-commerce.
We stand ready to work productively with you to maintain the proper
balance between the need to strengthen protections for consumers while
avoiding unnecessary restrictions on the ability of businesses to
provide, through the Internet, the valuable products and services that
consumers demand.
Sincerely,
William T. Archey
President & CEO
AeA Principles for Internet Privacy Legislation
provide individuals with notice
Web sites that collect personally identifiable information should
provide individuals with clear and conspicuous notice of their
information practices at the time of information collection.
Individuals should be notified as to what type of information is
collected about them, how the information will be used, and whether the
information will be transferred to unrelated third parties.
ensure consumer choice
Consumers should have the opportunity to opt out of the use or
disclosure of their personally identifiable information for purposes
that are unrelated to the purpose for which it was originally
collected. Consumers should be allowed to receive benefits and services
from vendors in exchange for the use of information. It is important
that the consumer understands this use and be able to make an informed
choice to provide information in return for the benefit received.
leverage market solutions
Private sector privacy codes and seal programs are an effective
means of protecting individuals' privacy. Lawmakers should recognize
and build upon the self-regulatory mechanisms the private sector has
put in place and continues to build. These mechanisms are backed by the
enforcement authority of the Federal Trade Commission and state
attorneys general. Public policies also should allow organizations to
implement fair information practices flexibly across different mediums
and encourage innovation and privacy enhancing technologies.
ensure national standards
The Internet is a new and powerful tool of interstate commerce.
Public policies related to Internet privacy should be national in
scope, thus avoiding a patchwork of state and local mandates. This
uniform framework will promote the growth of interstate ecommerce,
minimize compliance burdens, sustain a national marketplace and make it
easier for consumers to protect their privacy.
protect consumers in the public and private arena
Government and non-profit organizations collect a tremendous amount
of personally identifiable information about citizens. The need to
foster consumer confidence applies to private and public sector
activities. Government agencies and non-profit organizations that
collect personally identifiable information should be required to
follow fair information practices imposed on the private sector by law
or regulation.
don't discriminate against the internet
Consumers should have confidence that their privacy will be
respected regardless of the medium used. Similar privacy principles
should apply online and offline. Public policy should not discriminate
against electronic commerce by placing unique regulatory burdens on
Internet-based activities.
utilize existing enforcement authority
With the imposition of notice requirements, the Federal Trade
Commission should use its existing authority to enforce the mandates of
federal legislation. Legislation should not create any new private
rights of action.
avoid conflicting or duplicative standards
In cases where more than one government agency seeks to regulate
the privacy practices of a particular organization or industry, those
agencies should offer a single coordinated set of standards.
Statement of American Medical Association
The American Medical Association (AMA) and its physician and
medical student members appreciate the opportunity to present
information to this Subcommittee on the important issue of patient
privacy and the confidentiality of medical records. The AMA believes
that patient privacy is fundamental to the physician-patient
relationship and is a right long advocated by the AMA.
We would like to commend Chairman Feinstein for introducing S.
1055, the ``Privacy Act of 2001.'' Title IV of S. 1055 would
significantly improve the current framework of federal privacy
protections for all of America's patients.
Background on Federal Privacy Protections
The Department of Health and Human Services (HHS) published on
December 28, 2000, a final rule establishing standards for the privacy
of individually identifiable health information (``Standards for
Privacy of Individually Identifiable Health Information'' 65 Fed. Reg.
82462) (the ``Final Privacy Rule ''). Congress did not pass privacy
legislation by the August of 1999 deadline set by the Health Insurance
Portability and Accountability Act of 1996 (HIPAA). Therefore, the
Secretary of HHS issued privacy standards as directed by HIPAA.
The AMA applauds HHS for the tremendous effort it took to write the
Final Privacy Rule. After years of contentious debate in Congress it
became clear to all involved that drafting federal privacy standards
would be no easy task. Overall, the AMA is pleased with many provisions
of the Final Privacy Rule. However, we also have many serious concerns.
During a public comment period in March of 2001, the AMA submitted
extensive comments on the Final Privacy Rule. Among many significant
issues, we expressed concern over the marketing provisions. We also
expressed concern that, even with potential future improvements, the
Final Privacy Rule would not adequately protect patients because it
only applies to certain ``covered entities.'' We firmly believe that
Congress must act to extend privacy requirements to all entities that
maintain patient information.
Because HIPAA limited the Secretary's regulatory authority to
health care providers, health plans, and health data clearinghouses,
these are the only entities covered under the Final Privacy Rule. All
other users of individually identifiable health information
(``protected health information '') are not regulated by the Final
Privacy Rule. Yet, protected health information is received by many
other entities such as schools and universities, public and private
agencies that oversee health care treatment and payment, law
enforcement officials, and public health departments. These entities
include, but are not limited to, state insurance commissioners, state
health professional licensure agencies, the Office of Inspectors
General of federal agencies, the Department of Justice, State Medicaid
fraud units, Defense Criminal Investigative Services, the Pension and
Welfare Benefit Administration, the HHS Office for Civil Rights, the
Food and Drug Administration, the Social Security Administration, the
Department of Education, the Occupational Health and Safety
Administration, and the Environmental Protection Agency.
Other persons or entities may also receive protected health
information in the normal course of business such as lawyers,
accountants, consultants, etc. The Final Privacy Rule identifies such
secondary users of protected health information as ``business
associates'' of physicians and other covered entities. The Final
Privacy Rule requires that the confidentiality standards of the rule be
applied to these business associates through contracts with covered
entities.
The AMA objects to the business associate provisions because they
present the potential for significant liability for physicians even
when the physicians themselves are in compliance with the Final Privacy
Rule. Covered entities are subject to enforcement and sanctions under
the Final Privacy Rule for acts of their business associates, while
business associates at most may lose their contract with the covered
entity and incur possible damages if the covered entity files a
subsequent civil suit. In addition, covered entities will have a duty
to mitigate any known harmful effects of a violation of the rule by a
business associate.
As currently written, the business associate requirement will
subject physicians and covered entities to an array of both foreseeable
and unforeseeable compliance costs. All existing contracts with each
business associate will need to be rewritten and renegotiated. Every
single interaction physicians have that might involve the disclosure of
protected health information will require analysis. For example, state
and county medical associations that assist physicians with specific
compliance, patient care and billing issues, as well as private
accreditation and certification agencies, will now be required to have
business associate contracts.
The AMA acknowledges the limitations inherent in the Congressional
grant of authority under HIPAA that constrain the Secretary from
directly regulating secondary or ``downstream'' users of protected
health information. However, covered entities should not be held
responsible for actions taken or inaction by these separate entities
simply because Congress did not include them in the legislative
directive to HHS. As a matter of fairness, these users of protected
health information should also be brought under the terms of
comprehensive privacy laws.
Fortunately, Chairman Feinstein has taken a first step to address
these concerns.
Title IV of S. 1055 would prohibit the unauthorized sale of
protected health information by entities that maintain protected health
information but are not ``covered entities'' under the privacy
regulation. S. 1055 would also remove harmful marketing loopholes from
the Final Privacy Rule. These are two much needed improvements to
federal privacy protections.
The Sale of Health Information
The AMA is pleased that Title IV of S. 1055 would expand federal
privacy protections for patients by establishing some conditions on the
disclosure of protected health information received and maintained by
entities that are not covered under the Final Privacy Rule. Title IV
would prohibit these ``non-covered entities'' from selling protected
health information without an authorization by the patient. ``Non-
covered entities'' under S. 1055 would include all public or private
entities such as health researchers, schools and universities, life
insurers, property and casualty insurers, employers, public health
authorities, health oversight agencies, law enforcement officials, and
any person acting as an agent of such entities.
In addition, S. 1055 would ensure that patients are adequately
informed before they authorize the sale of their protected health
information. Authorizations would need to be in writing, explain the
purpose for which the information would be sold, identify in a specific
and meaningful manner what information would be sold, the persons who
would be selling the information, and the persons who would receive the
information. Individuals would also have the right to revoke an
authorization and entities would not be permitted to condition the
purchase of a product or service on an individual signing an
authorization.
We would like to voice one cautionary note, however, regarding the
definition of ``sale.'' Because it could, and should, be interpreted
very broadly, the definition of ``sale'' might lead to the unintended
consequence of prohibiting important research, particularly research
published in medical journals. Without a clarification, we are
concerned that the use of protected health information for analysis and
research that is later published might be considered to be an
``indirect'' sale of protected health information under Title IV of S.
1055. We would like to propose a rule of construction for addition to
the language of the bill that would address this matter.
Marketing
In the Final Privacy Rule, marketing is defined very broadly as
``mak[ing] a communication about a product or service a purpose of
which is to encourage recipients of the communication to purchase or
use the product or service.'' There is a ``carve out'' for certain oral
communications and written communications if the covered entity does
not receive remuneration from a third party for making such a
communication. These communications are not considered marketing if
they are made by a health care provider and tailored to a particular
patient as part of treatment, or made by a provider or plan to manage
treatment of a patient or recommend alternative therapies, providers,
or settings of care. S. 1055 maintains this appropriate definition.
The proposed privacy rule included a general prohibition against
the use of protected health information for marketing without a patient
authorization and would have prohibited the disclosure of such health
information for sale, rental or barter without patient authorization.
However, these prohibitions were weakened in the final rule. The Final
Privacy Rule removed altogether the prohibition against disclosure of
protected health information for sale, rental or barter without patient
authorization. And, although patient authorization for marketing of
protected health information is still required, there are several
exceptions that effectively remove this protection in many
circumstances. (Section 164.514(e)(1)) This is unacceptable to the AMA.
Under the Final Privacy Rule, the marketing communications that are
exempt from the authorization requirement fall under the definition of
``health care operations.'' Health care providers are required to
obtain patient consent before protected health information can be used
or disclosed for health care operations under the Final Privacy Rule.
But, for health plans, this is a major loophole because they do not
need to obtain patient consent to conduct health care operations under
the Final Privacy Rule. This means health plans can use or disclose
protected health information for various marketing purposes without any
type of permission from the patient.
The Final Privacy Rule exempts from the authorization requirement
communications that occur in a face-to-face encounter with the
individual but it is not limited to those between physicians and
patients. Therefore, any face to face encounter on behalf of a covered
entity is excluded from the authorization requirement. This could
potentially include telemarketing, or door to door marketing of items
or services unrelated to health care.
The Final Privacy Rule also exempts from the authorization
requirement items and services of nominal value. This overly broad
exception is unacceptable to the AMA. ``Nominal value'' a vague term
that could include all kinds of marketing communications to patients.
This exception also allows the use of protected health information
without patient authorization for marketing items or services that are
not even health related.
Another exception under the Final Privacy Rule permits marketing of
health-related items and services on behalf of third parties (pursuant
to a business associate contract). The marketing communication must
identify the covered entity as the party making the communication,
state whether any remuneration was received, and allow the patient to
opt-out from future communications. Therefore, a health plan or
pharmacy can sell a patient list without the patients' authorization to
a pharmaceutical company or pharmaceutical benefits manager (PBM) as
long as a business associate contract is in place. The pharmaceutical
company or PBM can then send the patients information about
prescription drugs that are alternatives to their current
prescriptions. This will offend many patients as an unwanted intrusion
into their personal health. The AMA has heard that many patients are
already complaining to their physicians about receiving such marketing
communications at home.
The opt-out requirement in the Final Privacy Rule is also weak and
full of loopholes. No opt-out procedure is specified in the rule and
covered entities must only make ``reasonable efforts'' to ensure that
those individuals who opt-out from future marketing communications do
not receive another such communication. Therefore any type of opt-out
process is permitted, even one that is extremely inconvenient to the
patient. There is no opt-out requirement when the marketing
communication is sent to a broad cross-section of patients or
enrollees.
We strongly support the provisions of Title IV of S. 1055 that
would eliminate these harmful marketing exceptions from the Final
Privacy Rule. In addition, Title IV of S. 1055 would expand the
protections in the Final Privacy Rule by extending the prohibition from
using, disclosing, or selling protected health information for
marketing without patient authorization to non-covered entities as
well. These are two much needed improvements to federal privacy
protections.
Conclusion
The AMA commends Chairman Feinstein for including Title IV in S.
1055, the ``Privacy Act of 2001.'' The provisions of Title IV would
strengthen the Final Privacy Rule by removing harmful marketing
loopholes and would extend federal privacy protections beyond the
coverage of the Final Privacy Rule by prohibiting all entities that
maintain protected health information from selling or marketing such
information without the approval of the patient.
The AMA strongly supports Title IV of S. 1055 as a step in the
right direction for America's patients. We also encourage Congress to
consider additional legislation to further improve the Final Privacy
Rule and to further extend the coverage of privacy protections to all
entities that maintain health information. As the President
acknowledged on Monday during remarks to physicians in Wisconsin:
``personal medical information must always be strictly confidential. A
patient's right to privacy must be protected.'' [Emphasis added.]
We look forward to working with the Subcommittee on this and other
important privacy legislation.
Statement of Hon. Charles E. Grassley, a U.S. Senator from the State of
Iowa
Madam Chairwoman and Senator Kyl, thank you for allowing me to make
a few comments on this important matter. As you know, I'm no longer a
member of this Subcommittee, but I remain very interested in making
sure that we eradicate identity theft. So I thank the Chair for her
indulgence.
The dangers to our society and its citizens that result from the
misuse of personal information are significant. Social Security Number
misuse is a subset of identity theft. This pervasive use of SSNs
coupled with the advent of the Internet has opened up new opportunities
for wrongdoers to create false identities. And we've all seen that when
a person's name and other identifying information is stolen to commit
theft or fraud, or to access confidential information, there can be
devastating results. The Inspector General of the Social Security
Administration reported that, ``The tragedies of [September 11]
demonstrate that SSN misuse and identity theft are breeder' offenses
with the ability to facilitate crimes beyond our imagination.'' We now
know that identity theft was a prime modus operandi of the terrorists.
The hijackers and their suspected accomplices committed identity theft,
including at least one documented case of using a false Social Security
Number, to infiltrate American society while planning these attacks.
Congress can help make it a lot harder for these criminals to get
this sensitive information. There are a number of bills currently
pending in Congress that try to do just that. I've joined with Senators
Feinstein and Kyl in sponsoring ``The Identity Theft Prevention Act of
2001'' to make it more difficult to steal someone's identity, and to
impose additional duties on credit issuers and credit bureaus to ensure
the accuracy of information in credit applications.
Let me say just a few words about some relevant data that my
Finance Committee investigative staff has found with respect to the
safeguarding of SSNs by the Social Security Administration and the
Department of Veterans Affairs. The Inspector General of the Social
Security Administration reported that SSA has no programs designed to
uncover illegal activity or to assist in the detection of terrorist
activity. According to the Inspector General, ``Once an individual
obtains an SSN, either through proper or improper means, the Agency has
little ability to control the use of that, number.'' SSA controls to
detect or prevent undocumented immigrants from obtaining a false or
stolen SSN ``do not always work as intended and are not always used.''
This is not good enough. Knowing what we know now about the 9-11
terrorists, the Social Security Administration's safeguarding of Social
Security Numbers must be among its highest priorities.
The Department of Veterans Affairs didn't fare much better in terms
of improper access to and theft of Social Security Numbers. I asked the
Inspector General to examine cases involving identity theft by VA
employees, patients or visitors. The Inspector General found losses to
the VA to include:
$11.5 million in improper benefit payments;
$52,000 in fraudulent credit card charges; and
$159,000 worth of medical treatment.
This supports the Inspector General's finding that, ``VA programs
and operations have identified a continuing vulnerability to
destruction, manipulation, use, and inappropriate disclosure of
sensitive veteran identifier information.'' Although there are levels
of access, once employee access is assigned, ``restrictions have not
been implemented to prevent full access to all veterans'' information
in that group.'' That information may include Social Security Numbers
and :medical histories of psychosis or other mental ailments. I think
this is very troubling.
Clearly, these agencies, as well as other federal agencies, need to
reform their programs to identify and combat Social Security Number
misuse, and I intend to help them with this effort. But the federal
agencies cannot do it alone. As people increasingly rely on credit
cards for electronic commerce and daily business transactions, industry
needs to step up to the plate to protect consumers' sensitive
information. And Congress can enact tougher laws that make it harder
for these criminals to obtain access to this information, and that
severely penalize identity thieves. I hope we can minimize
opportunities for invasions of privacy in the form of identity theft
through legislative and oversight initiatives. The American people
deserve no less than knowing that their identities are protected.
Statement of Hon. Orrin G. Hatch, a U.S. Senator from the State of Utah
Madame Chairwoman, I want to thank you for holding this important
hearing. As we recently have been made acutely aware, identity theft
has become one of the most critical tools of the criminal trade of
terrorists as well as other criminals. In this information age,
identity theft is one of the fastest growing crimes in the United
States. Of the 204,000 consumer fraud complaints compiled by the
Federal Trade Commission last year, 42% involved identity theft. Recent
news reports suggest that as many as 750,000 identities are stolen each
year.
This Subcommittee is well aware of how criminals appropriate
personally identifiable information, including Social Security numbers,
to steal money, credit records, victims' good names, and, in some
cases, to commit violent crimes. As a result, victims incur substantial
harms, including financial losses, damaged credit histories, and legal
problems, which take long periods of time to rectify.
In 1997, Senator Kyl introduced ``The Identity Theft and Assumption
Deterrence Act.'' Together we worked with our House counterparts to
enact this bill into law. Among other things, the Act made it a crime
to transfer or use, without lawful authority, a person's means of
identification, including a Social Security number, with the intent to
commit a violation of Federal law, or a felony under State or local
law.
``The Identity Theft and Assumption Deterrence Act'' represented an
essential first step in our effort to curb identity theft. But we can,
and should, consider additional preventive measures to reduce this
pervasive problem. In so doing, however, we must be careful to ensure
that such legal reforms do not unduly restrict businesses and financial
institutions in their legitimate commercial dealings.
I applaud Senator Feinstein's effort to develop legislation that
attempts to balance the privacy rights of consumers with the needs of
this nation's businesses, and I am committed to working with her and
this Subcommittee to strike the proper balance between these important
interests. I look forward to hearing from our distinguished witnesses.
Statement of Jeff P. Nicol, Customer Privacy Manager, e-Business Group,
Intel Corporation
Intel Privacy Perspective
Thank you for giving me the opportunity to speak before you today.
My name is Jeff Nicol and I manage the Privacy Compliance Team at Intel
Corporation. Intel supplies computer chips, boards, systems, software,
networking and communications equipment, and services that comprise the
``ingredients'' of computer architecture and the Internet. Intel's
mission is to be the preeminent building block supplier to the
worldwide Internet economy.
Let me give you some background on how Intel got so involved in the
privacy debate. In late 1998, we disclosed our plans to include a
serial number feature in the next version of our flagship
microprocessor. Almost immediately, some end users and privacy
advocates told us that such a feature was a threat to their privacy.
Our intention in developing the feature had been to find a simple
technical solution to our clients' request to provide greater security
for private information through stronger identification tools.
Unfortunately, what we perceived to be a technical issue raised privacy
concerns for many end users. We quickly took steps to provide greater
control of this feature for users. We realized that the best way to
satisfy consumer concerns in an environment of heightened anxieties is
to clearly disclose your personal information collection & handling
practices and offer people the ability to exercise choices regarding
those practices.
Our privacy program has come a long way since its rough and tumble
beginning. We established a three-tiered organization structure to
manage our privacy programs. At the top is an executive staff led
Management Review Committee. Management Review Committee membership
includes our General Counsel, Chief Information Officer, and the Vice
President of Marketing. This senior management backing gives our
program top-down support as well as bottoms-up visibility. Next, we
have the Privacy Compliance Core Team (which I lead). My team deals
with the day-to-day responsibilities of setting, implementing, and
enforcing our policies. This takes the fulltime efforts of four of us,
plus we receive a tremendous amount of support from employees across
the corporation. Lastly, we have the Privacy Review Board. The Privacy
Review Board is a cross-functional team comprised of the Privacy
Compliance Core Team, plus subject area experts in fields such as Law,
Information Security, Human Resources, Information Technology, Customer
Support, and other disciplines. The Privacy Review Board is a balanced
forum in which employees may raise questions related to the privacy
implications of new technologies and services or interpretation of
existing privacy policies.
In addition to our internal compliance efforts, we have many
externally visible accomplishments. In the self-regulatory space, we
are founding sponsors of both BBBOnLine and TRUSTe, and are proud
holders of their respective privacy seals. We continue to actively
support these groups, especially in the area of helping them expand
their programs internationally. Continuing with the international
theme, Intel filed for Safe Harbor Certification with the US Department
of Commerce in June. This certification provides us with a uniform
mechanism for compliance with the European Union (EU) Data Protection
Directive for our online and offline customer data. Lastly, on the
technology front, we have been working with the World Wide Web
Consortium (W3C) on rolling out the Platform for Privacy Preferences
(P3P) technology. P3P provides an automated way for users to gain more
control over the use of personal information on Web sites they visit.
Intel sites will all be P3P compliant.
While some privacy technologies (like P3P) are promising, they only
offer part of a solution and are not a substitute for federal privacy
legislation. Members of this Committee may be aware that Intel has
taken a proactive stance within our industry associations, such as AEA,
CompTIA, and ITI, in favor of the passage of federal Internet privacy
legislation. I will touch on the principles that should guide such
legislation in a moment, but first I would like to comment on the
reasons why we believe Congressional ground rules are required.
Why Congressional Guidance is Necessary
First, we are persuaded that there is a general level of
uncertainty on the part of consumers regarding the safety of doing
business on the Internet that has been a major factor restraining the
growth of consumer commercial transactions. While the general public
has embraced the Net as a ready source of information and a tool for
communications, and businesses are aggressively adopting e-business
models, the average consumer is reluctant to purchase products or
services through the Internet. A recent Gartner survey of 7,000
consumers showed that 60% say security and privacy concerns keep them
from doing business online.1In our judgment, privacy is one of the key
consumer concerns that hold that percentage down. Congressionally
mandated ``ground rules'' will go a long way toward alleviating these
concerns. Consumers need to have confidence no matter what state they
live in. They should not be left guessing to what degree they are
protected when they move from state to state.
Second, there is the need to educate businesses. Intel has been
proactive in the Privacy Leadership Initiative (PLI), which has
ardently advocated the adoption of fair privacy practices by firms
doing business on the Internet. The adoption of fair privacy practices
is well advanced in the community of large, Fortune 500 level business
entities; but in the world of start-ups, new entrants to the Internet
space, and small business in general, the record is not as good. There
are problems with awareness of best industry practices, compliance with
articulated policies when dealing with outside parties, and responsible
internal management of data. Again, we think that federally mandated
rules on basics such as notice and choice would focus business
attention at all levels and raise the level of consumer protection.
Third, there is the issue of doing business in Europe. As members
may be aware, the U.S. and the European Union reached a landmark
agreement in calendar year 2000, commonly known as the ``Safe Harbor''
agreement. This agreement, negotiated by the U.S. Department of
Commerce, provides framework through which U.S. companies may certify
compliance to European data privacy and security requirements and
collect data from consumers in EU countries with a presumption of
compliance with European directives governing the collection and use of
information. During negotiations, European negotiators raised strong
concerns regarding the availability of enforcement tools in U.S. law.
In response to those concerns, the agreement's drafters referenced
provisions of the Federal Trade laws that grant the Federal Trade
Commission (FTC) the power to regulate, and punish, companies for
making misleading, false or fraudulent statements to consumers in
connection with the sale of goods and services. While the EU has
accepted for now that existing FTC powers provide a ``floor'' level of
enforcement authority, the continued viability of this agreement may in
large part be dependent on whether the U.S. moves, over time, to
strengthen consumer rights and the oversight role of federal
authorities. The EU Safe Harbor agreement is critical to the stability
and predictability of the Internet business environment in Europe.
Finally, if one concludes as we at Intel have that strengthening
consumer rights is necessary, it is apparent that those rights, as well
as the rights and responsibilities of businesses, should not vary from
state to state. Our Chairman, Dr. Andy Grove, believes personal data
has value and therefore, consumers have legitimate property rights
regarding their personally identifiable information. Over time,
legislatures will act to define and recognize the legal status of those
property rights. Today, there are numerous bills pending in state
legislatures all over the United States most actively in California,
Delaware, Massachusetts, and New York that would mandate specific
practices with respect to the handling of consumer data or the design
and management of websites. A scenario where those rights and
responsibilities varied from state to state would sow confusion, uneven
enforcement of rights, and a threat of legal liability in multiple
states under multiple standards. Such an environment would retard the
growth of e-commerce in the consumer space for years to come.
Principles that should Guide Congress
For all of these reasons, we believe that the time has come for
Congress to act. Now I would like to comment specifically on what we
believe Congress can, and should, do that will enhance consumer rights,
help build the Internet into a powerful tool of interstate commerce for
consumers, and provide guidance for industry regarding privacy policy.
All of the major high-tech industry associations to which we belong
have articulated core principles that should guide privacy legislation.
In sum, these principles though not detailed prescriptions of
legislative language provide a template for sound policy choices. I
will reference the statement of principles adopted in January of 2001
by the American Electronics Association (AeA) as perhaps the best
example of the thinking within our industry.
AeA guidelines, adopted to put ``flesh on the bones'' of a Board
resolution in favor of preemptive federal privacy legislation, address
seven substantive areas: notice, choice, the appropriate role of the
private sector, the need for national standards, application of those
standards to both public and private websites, treatment of off-line
data collection on the same basis as on-line collection activity,
appropriate enforcement mechanisms, and avoiding duplicative
requirements for specific industry sectors. The guidelines state as
follows:
aea guidelines regarding computer privacy
Provide Individuals with Notice
Web sites that collect personally identifiable information should
provide individuals with clear and conspicuous notice of their
information practices at the time of information collection.
Individuals should be notified as to what type of information is
collected about them, how the information will be used, and whether the
information will be transferred to unrelated third parties.
Ensure Consumer Choice
Consumers should have the opportunity to opt-out of the use or
disclosure of their personally identifiable information for purposes
that are unrelated to the purpose for which it was originally
collected. Consumers should be allowed to receive benefits and services
from vendors in exchange for the use of information. It is important
that the consumer understands this use and is able to make an informed
choice to provide information in return for the benefit received.
Market Solutions
Private sector privacy codes and seal programs are an effective
means of protecting individuals' privacy. Lawmakers should recognize
and build upon the self-regulatory mechanisms the private sector has
put in place and continues to build. These mechanisms are backed by the
enforcement authority of the Federal Trade Commission and state
Attorneys General. Public policies also should allow organizations to
implement fair information practices flexibly across different mediums
and encourage innovation and privacy enhancing technologies.
Ensure National Standards
The Internet is a new and powerful tool of interstate commerce.
Public policies related to Internet privacy should be national in
scope, thus avoiding a patchwork of state and local mandates. This
uniform framework will promote the growth of interstate e-commerce,
minimize compliance burdens, sustain a national marketplace and make it
easier for consumers to protect their privacy.
Protect Consumers in the Public and Private Arena
Government and non-profit organizations collect a tremendous amount
of personally identifiable information about citizens. The need to
foster consumer confidence applies to private and public sector
activities. Government agencies and non-profit organizations that
collect personally identifiable information should be required to
follow fair information practices imposed on the private sector by law
or regulation.
Don't Discriminate Against the Internet
Consumers should have confidence that their privacy will be
respected regardless of the medium used. Similar privacy principles
should apply online and offline. Public policy should not discriminate
against electronic commerce by placing unique regulatory burdens on
Internet- based activities.
Utilize Existing Enforcement Authority
With the imposition of notice requirements, the Federal Trade
Commission should use its existing authority to enforce the mandates of
federal legislation. Legislation should not create any new private
rights of action.
Avoid Conflicting or Duplicative Standards
In cases where more than one government agency seeks to regulate
the privacy practices of a particular organization or industry, those
agencies should offer a single coordinated set of standards.
We believe these guidelines lay out a path for Congressional policy
that is coherent, logical and addresses the core concerns of consumers
and the needs of business for predictability and stability in the legal
environment.
Title I of S. 1055 Is Consonant with AeA Guidelines and Advances
Consumer Rights
S. 1055 is a comprehensive attempt to speak to a wide variety of
concerns regarding the proper collection and use of consumer
information in many different social contexts. While we will leave to
others the merits of specific provisions dealing with identity theft,
financial and health information, we applaud you, Chairman Feinstein,
for your efforts to focus Congress' attention on the need for a
systemic approach to the variety of privacy issues facing consumers.
With regard to Internet privacy--an area where we do have expertise I
am pleased to state that Intel strongly supports the provisions of
Title I of your bill. They would substantially strengthen the ability
of Internet users to protect their privacy in a manner consonant with
the industry guidelines that we support.
Ensuring that an Internet user has clear and conspicuous notice of
information collection and disclosure or sale practices, and the
opportunity to exercise choice regarding the collection and use of user
information, is the essential foundation of protecting privacy. Your
bill would achieve this, and it would moreover provide for effective
enforcement of such rights through the auspices of the FTC and state
Attorneys General. This federal/state enforcement structure will help
guarantee that the rights of users are the same no matter where the
user or the website is located, and it is supplemented by a strong
preemption provision that will guarantee uniformity of rights across
state boundaries. Uniformity of rights is accomplished by language in
your bill that clearly establishes the primary role of the FTC in
shaping implementation rules, forecloses conflicting state statutory
and regulatory law, and common law. It creates no new private right of
action which is a critical point for our industry and gives the FTC the
authority to intervene in enforcement actions brought by state
authorities. Consumers will have the benefit of uniform rules
throughout the nation, enforcement of those rules by federal and state
authorities, and businesses will have clear and straightforward
obligations established by one authority.
Equally important, however, are the safe harbor provisions of your
bill that will minimize legal uncertainties for businesses
participating in voluntary trust seal organizations such as BBBOnLine
and TRUSTe. These seal organizations serve the important function of
certifying member companies' adherence to fair privacy practices, and
their efforts to recruit participation of companies will also be
strengthened by your bill should it be enacted into law.
Title I of S. 1055 applies to both on-line and off-line data
collection activities, ensures segregation of general on-line standards
from requirements already established for health and financial data,
and establishes reasonable penalties for flagrant violations. We would
like to see the notice and choice requirements of S. 1055 extended
generally to public sector web sites, and we believe that a further
requirement of independent verification of compliance to policies
should be articulated in statute to provide stronger ``teeth'' for
self-regulatory efforts. We would be pleased to offer specific
legislative language suggestions to the Committee toward those ends if
desired.
In sum, we believe that the continuing viability of the Internet
marketplace depends upon good rules, good practices, and good policing.
Congress should lay down the rules, depend upon the self-regulatory
tools now in the marketplace to advance the adoption of fair privacy
practices, and give responsibility for the enforcement of those rules
to the FTC and state Attorneys General. In this way, bad actors will--
over time--be driven out of the marketplace and consumer acceptance of
the Internet as a safe place to do business will be secured. The
Internet will flourish as one of the most efficient, if not the most
efficient, market tools ever developed.
On behalf of the senior executives of Intel, and our entire privacy
team, I thank you Senator Feinstein for your leadership on the
important issue of Internet privacy. We pledge to work with you and
other members of the Congress to secure the privacy rights of Internet
users through balanced federal legislation such as Title I of S. 1055.
Thank you for your time. I will be pleased to answer any questions
you may have.
Statement of Laura Nyquist, Chief Privacy Officer, NCR Corporation
Chairwoman Feinstein, Senator Kyl, and members of the Subcommittee,
my name is Laura Nyquist, Chief Privacy Officer for NCR Corporation.
Thank you for the invitation to submit written testimony today before
your Subcommittee.
As the Chief Privacy Officer, I supervise compliance across all
NCR's businesses to the company's privacy policy and international
privacy laws, as well as oversee the company's privacy initiatives
implemented in the solutions we provide to our customers. As you may
know, NCR was an early leader in the privacy space as our Teradata
database was the first to incorporate consumer data protection.
NCR's heritage in providing solutions for the retail industry goes
back over 115 years when it was founded as the National Cash Register
Company in Dayton, Ohio. Now NCR Corporation is one of the world's
largest suppliers of solutions that facilitate and optimize
transactions between consumers and businesses, whether in stores,
through self-service equipment, or over the Internet. NCR currently
employs over 31,000 people globally.
Madame Chairwoman, the subject of today's hearing is important to
us all, as we are all consumers.
Businesses collecting information about their customers is not new.
Your grandmother's butcher probably knew not only her name and her
favorite cuts of meat, but how the children were doing in school as
well. We used to call it ``friendly, personal service'' at a time when
businessmen and their customers were also neighbors.
Today, technology makes it possible for companies thousands of
miles away to also serve their customers better by collecting and using
massive amounts of data. This explosive growth in data collecting is
fueling the global debate over privacy; creating a tension between
consumers' sharing of personal information and businesses attempting to
realize competitive advantage from gathering and analyzing personal
data to better and more efficiently serve them.
A division of NCR called Teradata provides data warehousing and
customer relationship management solutions to a wide range of
businesses and industries. Our Teradata customers include 20 of the
world's largest retailers, 19 of the world's largest banks, 10 of the
largest global telecommunications companies, 8 of the world's leading
airlines and 10 of the largest insurance companies. Simply stated, NCR
provides companies with the technology to strengthen their
relationships with customers in ways that protect their privacy and
earn their trust. Again, ensuring privacy is essential to building
trust that, in turn, is needed to build enduring customer relationships
and customer loyalty.
The benefits to consumers of targeted, one-to-one marketing and the
protection of their personal data are not incompatible; consumers
should and must have control over the use of their personal data.
Surveys show that consumers will gladly provide personal
information if they perceive a worthwhile benefit. A recent study shows
how American consumers view privacy on the Internet-54% of them
routinely give personal information to web sites and an additional 10%
would be willing to provide the same information under the right
circumstances.
Privacy, the protection and appropriate use of personal
information, is a growing concern for consumers and businesses. To
ensure continued business success and growth, it's important for
companies, big and small, to address privacy as an increasingly
important consumer expectation.
One fundamental necessity of commerce, both online and offline,
both traditional as well as e-commerce, is trust. Without trust,
businesses cannot survive. Businesses and, for that matter, government
entities--that do not heed the privacy concerns of their customers will
quickly lose trust, and ultimately their ongoing viability.
Customers in control of their data may freely choose release of
their personal information in return for better choices or services. I
would suspect that you as an airline passenger would not mind being
offered an upgrade at the gate because the airline agent knows you
experienced a flight cancellation days earlier.
Most companies are doing the right thing in providing privacy
options. But as long as there is potential short-term gain in abusing
personal information, can we count on company voluntarism to prevent
abuse? While many company executives shudder at the thought of more
regulation, their companies and customers alike will be better served
if industry and government work together toward rational and uniform
rules that are fair to all. NCR believes that reasonable legislation is
needed to ensure that there are universal controls on the collection
and use of personal data. The right legislation built on top of market-
driven solutions can assure that all companies provide this protection.
There are currently laws which impact specific industry sectors
such as telecommunications, financial services and healthcare.
Additionally, State legislatures are debating various privacy bills
that will further complicate this matter. But in the U.S. there is
currently no single, broad- based law that affects personal data
collection and use, which is why we are here today.
But what type of legislation can work? First, it must be
comprehensive and apply the same privacy requirements to all personal
data, whether collected online, over the telephone or in face-to-face
commercial transactions. It would be misleading to American consumers
to enact legislation that applies only to online activities. As a
supplier of business intelligence solutions, NCR knows that click-and-
mortar firms do not distinguish between personal data obtained through
different channels. Online transactions account for only a small
fraction of consumer transactions. Last year, online sales accounted
for less than one percent of all retail business. Further, the movement
of the Internet to the wireless world, the integration of Internet
sales channels with Customer Call Centers, and voice-actuated Internet
services are blurring the distinction between on-line and off-line.
Obviously, any law that addresses only online transactions limits
the benefit to the consumers compared to one that equally addresses
online and offline activities. Simply put, data is data.
Madame Chairwoman, I am proud to say that your bill, S. 1055
accomplishes this goal. It accurately addresses the needs of consumers
and businesses. S. 1055 ensures that clear and conspicuous disclosures
are made about privacy practices and enables individuals to make
informed choices about sharing their personal information. Title I of
your bill addresses personal data protection in commercial transactions
and is written in a comprehensive and effective manner.
During NCR's long business history, a lot of things have changed,
but its philosophy has not if you want your customers' trust, you have
to respect your customers' privacy. In summary, NCR is pro-privacy. S.
1055 is a step in the right direction and I look forward to working
with the members of this Subcommittee on enacting good privacy
legislation. The business of privacy is quite simply, good business.
Madame Chairwoman, thank you for holding this hearing today and
thank you for your hard work on drafting S. 1055. This is a very
complicated and difficult issue and you are to be commended for your
interest in moving this important matter forward.
Statement of Evan Hendricks, Editor/Publisher, Privacy Times,
Washington, D.C.
Madame Chairwoman, thank you for the opportunity to testify before
the Subcommittee. My name is Evan Hendricks, Editor & Publisher of
Privacy Times, a Washington newsletter since 1981. For the past 24
years, I have studied, reported on and published a wide range of
privacy issues, including credit, medical, employment, Internet,
communications and government records. I have authored books about
privacy and the Freedom of Information Act. I have been qualified by
the Federal courts as an expert in Fair Credit Reporting Act and
identity theft litigation. I have served as an expert consultant for
government agencies and corporations. I am also a founding member of
the Privacy Coalition, which consists of the nation's leading consumer
and privacy advocates.
Madame Chairwoman, from the outset, I want to express support in
the strongest possible terms for your leadership. To the best of my
knowledge, you have taken one of the most comprehensive approaches to
privacy of any Member of Congress. This is crucial because privacy is a
far-reaching issue, one that touches all aspects of our society. Only a
comprehensive approach will begin to confront the challenge of
protecting privacy in 21st Century America. In supporting the
comprehensive approach, you are ``moving the bar higher'' for this
Congress. You are also offering hope to the millions of Americans who
want stronger legal protection for their personal data.
In addition to protecting the personal data of all Americans, a
strong national privacy policy advances several societal interests. By
ensuring that personal information is only used in a fair manner,
citizens can more securely participate in economic, community and
political activities. Clearly, consumer privacy concerns proved to be a
major impediment to e-commerce. What many people failed to realize was
that a ``privacy-first'' policy was fundamental to the health of e-
commerce, not a detriment to it.
Moreover, we must put in place a privacy-first policy if we are to
enjoy the benefits--and the potentially tremendous cost savings--of the
electronic age. Nearly all governmental and corporate organizations can
dramatically reduce their costs and provide more efficient service if
they can move from a paper environment to an electronic one. But
consumers will not participate widely in electronic environments until
they are convinced their privacy will be respected, and protected. In
other words, we cannot afford not to adopt a comprehensive privacy
policy.
When it comes to privacy legislation, specifics and details are
paramount. I, and other members of the Privacy Coalition, look forward
to working with you and the Subcommittee to ensure that the specific
provisions of S. 1055 stay true to its purpose of comprehensive privacy
protection. Many coalition members, including the Privacy Rights
Clearinghouse, Electronic Privacy Information Center, Consumers Union
and U.S. PIRG will be able to provide specific recommendations for
making your bill even more effective at protecting Americans' cherished
right to privacy.
Why Legislation Is Urgently Needed
A brief look at history helps explain why there is such a large gap
between the comprehensive privacy protection we should have and the
inadequate system currently in place.
Because of the Fourth Amendment of the U.S. Constitution, which
guaranteed Americans that they would be secure in their personal
papers, the United States emerged as a world leader in privacy. At the
beginning, most personal data were kept at home in desks or lock boxes.
In the 20th Century, however, a vast system of third-party record
keeping arose. Personal information was collected and maintained by
banks, doctors and hospitals, credit reporting agencies, pharmacies,
utilities, insurers, employers and government agencies.
In 1976, the U.S. Supreme Court, in U.S. v. Miller, ruled that
Americans did not have a Constitutional right to privacy in personal
data held by third parties. It reasoned that when you open a bank
account, you surrender your data to the flow of commerce. Absent
statutory protection, the bank is more or less free to give your
financial data to whomever it pleases. The bottom line was even though
the information was about you, those that collected it and kept it,
owned it. The Supreme Court ultimately extended this reasoning to
telephone records and to the garbage.
One year later, in 1977, a bipartisan commission created by
President Ford and Congress when it enacted the Privacy Act,
recommended a comprehensive legislative package, concluding that
protections were needed in such areas as financial, medical,
communications and government records and Social Security numbers. It
also recommended what every other Western country now has: a national
office to oversee and enforce privacy policy. Unfortunately, most of
the recommendations were not carried out.
Since then, Congress generally has responded to ``narrow'' privacy-
related problems or anecdotes with narrow solutions. The result has
been a hit-or-miss patchwork of laws that have left huge gaps. As I was
the first to point out in 1990, America was the only nation with a law
to protect the privacy of video rental records, but without a law to
protect medical records. Such gaps, and the lack of a reliable
enforcement mechanism, are key reasons why the European Union is
concerned about the adequacy of U.S. privacy law and may someday have
to restrict the flow of personal data about European citizens to the
U.S.
Problems Mounting, Higher & Deeper
In the first debates of the late 1970s, opponents argued that
privacy legislation was not necessary because there was ``no evidence
of harm.'' Now, evidence of harm abounds.
Identity theft is said to be the fastest growing crime, climbing
from a handful of cases in the early 1990s to 500,000 cases per year
now. ID thieves bribe clerks, steal from mailboxes, filch data from
computers and from the garbage and raid personnel files.
The underworld of ``carders,'' that is, hackers, who specialize in
stealing and selling credit card numbers, is steadily growing. Some are
connected to organized crime groups in Russia, Eastern Europe and
Nigeria. Victimized Web sites include Western Union, Egghead, CD
Universe and CreditCards.com. Sources say that only a fraction of
carder successes are known to the public. (see Bob Sullivan's excellent
reporting at MSNBC.com)
Identity thieves are using stolen credit card numbers to buy names,
addresses and SSNs from legitimate information brokers, and then use
the fraudulently-purchased identifiers to commit identity theft. (see
Washington Post, May 31, 2001)
Financial institutions basically have ignored federal regulators'
recommendation that they guard against would-be privacy invaders by
asking customers for PINs or passwords before giving out their personal
data. (see Washington Post, July 23, 2001)
A computer hacker or hackers compromised the customer records of
more than 100 online banks by attacking the servers of the S1 Corp.,
which serviced the online banks. The S1 Corp. declined to confirm which
banks were compromised, and it's not clear how many of the banks
informed their customers. An expert said the S1 case was ``only a drop
in the bucket.'' (see Privacy Times, July 23 & Securityfocus.com, July
6, 2001)
A pornographic Web site operator in California made $38 million by
purchasing 800,000 credit card numbers, ostensibly for account
verification, and then using the numbers to charge cardholders $19.95
for visiting his Web site. In 1999, a convicted felon similarly bought
credit card numbers from Charter Pacific Bank.
Financial institutions continue to participate in telemarketing
schemes in which customers are solicited for 30-day free trials and
memberships, and then the telemarketer either charges it to the
customer's credit card or adds a monthly charge to his or her mortgage
statement.
Growing Public Support For Protection
Opinion polls have shown consistent support for privacy
legislation, and steady concern that privacy is not adequately
protected.
A 2001 Forrester Research survey found that 70% of the respondents
were either ``extremely'' or ``very'' interested in seeing Congress
pass Internet privacy legislation.
A June 2001 poll conducted by the Gallup organization has
found that 66% of Internet users think that the government should pass
laws protecting privacy. The poll also found that frequent Internet
users and individuals under the age of 50 were among the strongest
supporters of such laws.
In August 2000, Pew Internet & American Life Project found
two major points of consistency: Internet users want a guarantee of
privacy when they go online and many consumers are unaware of how
privacy invasions take place and are consequently unable to take
advantage of available privacy-enhancing technologies. Another finding
of the report is that 86% of Internet users surveyed support an opt- in
standard for the collection of personal information. (``Trust and
privacy online: Why Americans want to rewrite the rules'')
A series of opinion polls conducted by Alan Westin, of
Privacy & American Business, showed high consumer concern. For
instance, a December 1998 survey found that 82% of consumers say they
have lost all control over how personal information is used by
companies (with 50% agreeing ``strongly '') and 61% do not believe that
their rights to privacy as a consumer are adequately protected by law
or business practices.
Several members of the Al-Qaeda terrorist network
supported their operations through identity theft, credit fraud and
skimming. In fact, Al-Qaeda had a top-level committee devoted to
identity theft, chiefly for passport fraud.
S 1055
S 1055 is an excellent starting point because 1) it takes one of
the most comprehensive approaches to date; 2) it is largely based upon
the standard which must drive all privacy law: affirmative, informed
consent and 3) it requires, at a minimum, notice and opt-out for
personal data that are not currently protected by federal law.
The strength of the bill is its creation of a strong privacy
standard for information that most Americans feel is private and should
not be used for secondary purpose without their consent: financial,
medical, drivers and SSNs. Also attractive is the private right of
action for SSNs, which I favor being expanded to other parts of the
bill. A private right of action (PROA) is vital because it is not
practical for one entity to enforce privacy law in each and every case;
individuals must be empowered to defend their own rights. A PROA
accomplishes this, and has proven effective in the Fair Credit
Reporting Act and the Telephone Consumer Protection Act.
The bill appropriately envisions enforcement roles for the Federal
Trade Commission and the State Attorneys General.
Social Security Numbers (SSNs)
The bill should establish that only those entities currently and
specifically authorized by law to collect SSNs may continue to demand
consumers' SSNs, and that those entities not specifically authorized
may not demand an individual's SSN.
Secondly, the bill should have an ``anti-coercion'' provision so
that there are penalties for attempting to condition the use of goods
or services on the basis of the individual providing an SSN.
Limit Exceptions for Law Enforcement
The bill includes too many exceptions for law enforcement access to
personal data without notice to the individual. On this issue, it would
be preferable to follow the model of the Right to Financial Privacy Act
of 1978.
Independent Privacy Office
In keeping with the bill's comprehensive approach, however, I
strongly recommend that it be amended to create an independent national
privacy office that can oversee the bill, investigate complaints and
serve as a resource for the public and for the Congress. Every other
Western nation has such an office; Canada has both a Federal Privacy
Commissioner and Privacy Commissioners in each Province. These offices
are usually small; for many years they had little or no regulatory
authority. But the public gets tremendous value from them, in part
because of their ability to shine the public light on questionable
practices. Not having such an office has somewhat excluded the United
States from the international privacy community. Members of Congress
would find such an office increasingly valuable as constituents'
complaints about privacy continue to mount. Such an office was proposed
in legislation (S 1735) introduced in the 103rd Congress by
Sen. Paul Simon.
Preemption of State Law
A major issue in privacy debates is preemption of State law. I
believe strongly that a strong, comprehensive national privacy law is
the best, indeed the only, anecdote to a hodge-podge of inconsistent
State laws. Passing good privacy laws in the States is not easy.
Adoption of a strong national law would free the States to devote more
time to other pressing issues. But until Washington can prove it is up
to the job, it's premature to talk about prohibiting States from
protecting the privacy rights of their citizens.
More importantly, we must engage a process in which State
officials, including the State Attorneys General, governors,
legislators and citizens groups, can evaluate whether a Federal
proposal is satisfactory. If it is, the States voluntarily might commit
to the Federal proposal. But presently, it would be profoundly
undemocratic for Washington to dictate privacy policy to the States.
Access
A fundamental aspect of privacy is guaranteeing individuals access
to their personal data. This is a right already granted with respect to
credit reports under the Fair Credit Reporting Act. We need to extend
this right to all personal records and to exploit electronic technology
to the benefit of consumers. Ensuring that consumers are ``plugged
into'' their personal records is an important solution in the
electronic age, particularly considering the need to regularly monitor
your own profiles for unauthorized activity in order to prevent fraud
or identity theft.
Again, thank you for this opportunity. I would be happy to answer
any questions.
Statement of Hon. Strom Thurmond, a U.S. Senator from the State of
South Carolina
Madame Chairwoman:
I am pleased that you are holding this hearing on the protection of
private.information and the enormous problems associated with identity
theft. Privacy of personal information is important to all Americans,
especially in an age when details of financial transactions can be sent
all over the world in an instant. It is important that Congress enact
legislation that will protect personal identifiers, but at the same
time will allow for the legitimate conduct of the business community
and government agencies. I hope to work with my colleagues to develop a
comprehensive and reasonable piece of legislation that will deter
identity theft by eliminating.the unauthorized access of personal
information.
Identity theft occurs when an individual obtains the personal
information of a victim, such as a social security number or a date of
birth, and uses that information to open accounts and establish lines
of credit. In effect, a person with access to another's social security
number can pretend to be a different person. Usually, the victim does
not discover the fraud-before the identity thief has substantially
damaged the victim's credit. The victim must then go through a long and
arduous process to correct the situation.
Unfortunately, the crime of identity theft appears to be on the
rise. According to the testimony of Consumers Union, there were 500,000
to 700,000 victims of identity theft last year. Moreover, the number of
complaints received by the Federal Trade Commission in December of 2001
was almost double the complaints received in March of the same year.
The increasing prevalence of this crime is unacceptable.
Congress has addressed this issue in the past. The Identity Theft
Act of 1998 established identity theft as a distinct crime and provided
for punishment of fines and jail time. This Act gave law enforcement an
important tool in the prosecution of identity theft. While the 1998 Act
was a momentous step, we must do more than prosecute the thieves. We
must also make it more difficult for these lawbreakers to. access
personal information. Without access to personal information, there
would be no identity theft, and thousands of Americans would no longer
be victimized.
One of the primary ways in which identities are stolen is by use of
the social security number. Unfortunately, the social security number
is ubiquitous and is used for many purposes other than its originally
intended use. It is routinely used as an identification number by
health care professionals, educational institutions, and many private
businesses. People are often pressured into providing this very
sensitive number, never knowing who may ultimately be given access to
their personal information.
I am therefore strongly in support of several of the Chairwoman's
proposals regarding social security numbers. For example, one proposal
would prohibit companies from selling social security numbers to the
public. Congress should close all avenues to the sale of social
security numbers and conduct appropriate oversight to ensure that
violators are prosecuted. Another good proposal would require Social
Security numbers to be redacted from public documents. Where feasible,
Congress should cut off the public access of social security numbers.
Yet another suggested reform would prohibit private companies from
denying.service to individuals who refuse to provide social security
numbers, with specific exceptions for transactions such as those that-
involve credit checks. Most businesses have no legitimate need for
social security numbers. Rather, the numbers are used for purposes such
as identification and filing. Surely, there are other identification
methods that could be developed easily, ensuring that social security
numbers are not available to persons who would misuse them.
Many victims do not know how a social security number was stolen. I
believe that Congress should respond by limiting the public use of this
number. While no law will eliminate all instances of identity theft,
Congress can and should make it more difficult for thieves to obtain an
individual's personal information.
Madame Chairwoman, I am very interested in the bill introduced. I
will carefully consider your the witnesses today in hopes of action. I
will also on identity theft that will future. We should do all we can
to limit the use of personal identifiers so that the growing problem of
identity theft will be extinguished. I thank the Chairwoman for taking
an interest in this important matter, that you have proposals and the
testimony of determining the best course closely examine the GAO report
be released in the near and I look forward to working with you.
-