IAB, Consumer Advocates Weigh In On Privacy Laws

Bobby Rush

A senior Republican lawmaker expressed concern on Thursday that a privacy bill introduced by Rep. Bobby Rush (D-Ill.) could impose too many restrictions on businesses.

"We must craft legislation that creates an incentive for businesses to subscribe to the very best practices," Rep. Cliff Stearns (R-Fla.) said at a hearing on Rush's proposal. Stearns criticized several aspects of Rush's bill, including that it would allow consumers to bring lawsuits against companies that violate the law, and that it delegates too much power to the Federal Trade Commission.

Stearns had signed on to an earlier proposal floated in May by Rep. Rick Boucher (D-Va.), which differs in a few key ways from Rush's bill the Best Practices Act (H.R. 5577).

Rush's measure would require Web companies to obtain users' explicit permission before sharing their personal information with third parties, unless those companies participate in a "universal opt-out" program operated by a self-regulatory program and overseen by the Federal Trade Commission. Rush also would allow consumers to sue privately for up to $1,000 per violation, with damages capped at $5 million per incident.

Boucher's slightly different proposal would require ad networks that track people and collect personal information for ad purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and also allow people to view and edit their profiles. Boucher also would ban private lawsuits.

Rush's bill, like Boucher's, doesn't just cover personally identifiable information like names and addresses, but also applies to supposedly anonymous information, including Web users' marketing profiles that are associated with cookies on their computers. But unlike Boucher's proposal, Rush's measure also tasks the FTC with further defining the type of data that is covered by the bill.

At Thursday's hearing, Rep. Ed Whitfield (R-Ky.) asked whether the collection of anonymous browsing activity should "require the same level of consent" as collecting material like names and financial account numbers.

Two privacy advocates on the panel, Ed Mierzwinski, program director of the U.S. Public Interest Research Group, and Leslie Harris, president and CEO of the Center for Democracy & Technology, indicated they believed the answer was yes, because of the possibility that people could be identified based on "anonymous" information.

"We're concerned that de-identified or supposedly anonymous information can be repackaged back together," Mierzwinski said.

But the Interactive Advertising Bureau's Vice President for Public Policy Mike Zaneis said that Congress shouldn't try to legislate about activity that was only theoretical. He said that it isn't the "predominant business model" to connect clickstream data to personally identifiable information.

Whitfield also asked whether requiring users' opt-in consent to data collection would hinder online businesses.

Federal Trade Commission Consumer Protection Chief David Vladeck said that the most important consideration isn't whether companies obtain opt-in or opt-out consent, but whether they are adequately notifying consumers about data collection. "The goal ought to be to keep consumers well-informed," he said. "Clarity and ease of use ought to be the key metrics."

 

Next story loading loading..