New Privacy Bill Released, House To Consider Thursday

Bobby Rush

Rep. Bobby Rush (D-Ill.) unveiled a privacy bill on Monday that would require companies to obtain people's opt-in consent before disclosing their personal information to third parties in some circumstances.

A version of the bill seen by Online Media Daily appears to be similar to a draft measure floated in May by Rep. Rick Boucher (D-Va.), chairman of the Subcommittee on Communications, Technology and the Internet, but with some key differences.

Both bills follow a notice-and-choice framework, and both require users' consent for online behavioral advertising, or tracking users across sites in order to serve targeted ads. Both also allow companies to obtain opt-out consent rather than opt-in, but under slightly different circumstances.



Rush's measure would require Web sites to obtain users' explicit permission before sharing their personal information with third parties, unless those companies participate in a "universal opt-out" program operated by industry groups, like the Network Advertising Initiative, and overseen by the Federal Trade Commission.

Boucher's draft proposal, by contrast, would require ad networks that track people and collect personal information for ad purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and also allow people to view and edit their profiles.

Rush's bill also defines third-party broadly, saying that companies are considered third parties to each other if consumers would not expect reasonably them to be related. For instance, a publisher that owns an unbranded network of blogs could be considered a third party to those blogs.

Rush's measure also tasks the FTC with further defining "third party" within 18 months.

Like Boucher's proposal, Rush's bill would apply to data that is traditionally considered "personally identifiable" -- such as names and addresses -- as well as information sometimes deemed "anonymous," like marketing profiles associated with particular computers.

Rush's bill provides that IP addresses would be covered if used to create marketing profiles, but not when used to send ads dynamically. As with the definition of third party, Rush delegates to the FTC the task of further defining personal information.

Also similar to Boucher's measure, Rush's bill requires companies to obtain users' affirmative consent before collecting or sharing sensitive information -- but provides a more sweeping definition of that term. Rush says that sensitive data includes information about people's medical history or health, race or ethnicity, religious beliefs and affiliation, sexual orientation or sexual behavior, as well as certain financial data. Precise geolocation information would be considered "sensitive" if associated with other data like names or profiles. Rush also says FTC may modify the definition of sensitive information through a rulemaking.

Boucher, by contrast, defined sensitive information as medical records, race or ethnicity, religious beliefs, sexual orientation, financial records and precise geolocation information.

One key area that differs from Boucher's proposal involves consumers' ability to sue. Rush would allow individuals to sue companies that don't follow the measure for up to $1,000 per violation. Boucher's bill would completely bar consumers from bringing private lawsuits.

Rush, chairman of the House Energy and Commerce Subcommittee on Commerce, Trade and Consumer Protection, did not have a co-sponsor for the bill as of Monday afternoon. A hearing on Rush's proposal is slated for Thursday.

  Some consumer advocates reacted more favorably to Rush's proposal than to Boucher's. Privacy advocate Jeff Chester, executive director of the Center for Digital Democracy, said Rush's proposal "significantly advances the privacy debate in Congress."

Chester added, "By empowering the FTC to engage in additional rule-makings on privacy, it creates a framework to better address consumer privacy concerns -- online and off."

Leslie Harris, president of the digital rights group Center for Democracy & Technology, said Rush's bill "establishes a forward looking and flexible framework for protecting consumer privacy."

Harris is expected to testify at a hearing on Thursday addressing privacy legislation.

2 comments about "New Privacy Bill Released, House To Consider Thursday".
Check to receive email when comments are posted.
  1. Jim Brock from privacychoice, July 20, 2010 at 3:29 a.m.

    The Rush bill sensibly relieves safe-harbor participants of an opt-in requirement and the threat of private lawsuits. But it’s not at all clear why safe-harbor participants also should be relieved of an obligation to show consumers their own profile as advertisers can see it for targeting. Transparency in targeting is the sunshine that will establish norms and boundaries for profiling, and therefore critical to the success of self-regulation.

    If an advertiser can see my profile, why shouldn’t I be able to see it, too? (PrivacyChoice Blog)

  2. Paula Lynn from Who Else Unlimited, July 20, 2010 at 9:39 a.m.

    Exactly, Jim. How would a person know if their information is being shared? Would it require each individual to check on each individual site one clocks into or signs up for? How frequently? How can an individual prove the company is sharing their info without supeanas? Without spending a fortune on a lawyer to re-coop their privacy, identity, to find out if that 3rd party hasn't sold it? Again without costing a fortune to find out? So then what does a $1000 mean besides a class action suit to a law firm? Good idea - vague discipline - lack of executional ability.

Next story loading loading..