• by Wendy Davis , Staff Writer @wendyndavis, June 7, 2010

The nonprofit group Center for Democracy & Technology says that a privacy bill floated recently by Rep. Rick Boucher should be revised to include a broad set of so-called "fair information practices."

"While CDT generally agrees with the draft's basic framework for notice and choice, including its opt-in and opt-out structure, we are concerned that the strong reliance on consent places the entire burden for privacy protection on consumers," the group says in written comments. Among other fair information practices, CDT recommends that privacy legislation should involve a requirement that collectors glean only what they need for particular purposes.

The draft privacy bill, circulated last month by Boucher and Rep. Cliff Stearns, would require companies that track users across the Web to notify them and either obtain their consent -- though opt-out consent would be okay if the companies allowed consumers to view and access their profiles. The bill also would require opt-in consent before sites collected or disclosed sensitive information, defined as medical records, race or ethnicity, religious beliefs, sexual orientation, financial records and precise geolocation information.

Not surprisingly, the Interactive Advertising Bureau isn't a big fan of the draft bill, which it says, could curb online advertising. But, while the IAB isn't happy, neither are some consumer advocates -- though for different reasons. A coalition including the Center for Digital Democracy, Electronic Frontier Foundation and World Privacy Forum says that the potential measure doesn't go far enough to protect online privacy.

Those groups object to the proposal because it would allow behavioral targeting companies to obtain opt-out consent -- as opposed to explicit consent -- as long as they allowed consumers to view and access their profiles. Among other arguments, the consumer groups say that the notice-and-choice model that's been in effect -- at least informally -- for the last decade doesn't work online. Instead, they would like to see a provision banning companies from retaining information about users for more than 24 hours without opt-in consent.

CDT appears to be offering politicians a middle ground -- one that they might find more appealing than either scrapping the bill or requiring all companies to obtain users' explicit consent to online tracking. In addition to the recommendation that the bill incorporate fair information principles, CDT is urging the lawmakers to delegate more decisions about online privacy to the Federal Trade Commission.

For instance, the group recommends that the bill include a provision granting the FTC the power to formulate the wording of notices that companies should give consumers about online tracking and targeting.

CDT also is urging a "safe harbor" for companies who comply with industry-approved standards. "We believe that a carefully crafted safe harbor framework, giving industries or industry segments flexibility to develop tailored privacy solutions with FTC oversight, is the best way to accommodate differences between industries," the organization writes.