A senior Republican
lawmaker expressed concern on Thursday that a privacy bill introduced by Rep. Bobby Rush (D-Ill.) could impose too many restrictions on businesses.
"We must craft legislation that creates
an incentive for businesses to subscribe to the very best practices," Rep. Cliff Stearns (R-Fla.) said at a hearing on Rush's proposal. Stearns criticized several aspects of Rush's bill, including
that it would allow consumers to bring lawsuits against companies that violate the law, and that it delegates too much power to the Federal Trade Commission.
Stearns had signed on to an earlier
proposal floated in May by Rep. Rick Boucher (D-Va.), which differs in a few key ways from Rush's bill
the Best Practices Act (H.R. 5577).
Rush's measure would require Web companies to obtain users' explicit permission before sharing their personal information with third parties, unless those
companies participate in a "universal opt-out" program operated by a self-regulatory program and overseen by the Federal Trade Commission. Rush also would allow consumers to sue privately for up to
$1,000 per violation, with damages capped at $5 million per incident.
Boucher's slightly different proposal would require ad networks that track people and collect personal information for ad
purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and also allow people to view and edit their profiles. Boucher also would ban private
lawsuits.
Rush's bill, like Boucher's, doesn't just cover personally identifiable information like names and addresses, but also applies to supposedly anonymous information, including Web users'
marketing profiles that are associated with cookies on their computers. But unlike Boucher's proposal, Rush's measure also tasks the FTC with further defining the type of data that is covered by the
bill.
At Thursday's hearing, Rep. Ed Whitfield (R-Ky.) asked whether the collection of anonymous browsing activity should "require the same level of consent" as collecting material like names
and financial account numbers.
Two privacy advocates on the panel, Ed Mierzwinski, program director of the U.S. Public Interest Research Group, and Leslie Harris, president and CEO of the
Center for Democracy & Technology, indicated they believed the answer was yes, because of the possibility that people could be identified based on "anonymous" information.
"We're concerned that
de-identified or supposedly anonymous information can be repackaged back together," Mierzwinski said.
But the Interactive Advertising Bureau's Vice President for Public Policy Mike Zaneis said
that Congress shouldn't try to legislate about activity that was only theoretical. He said that it isn't the "predominant business model" to connect clickstream data to personally identifiable
information.
Whitfield also asked whether requiring users' opt-in consent to data collection would hinder online businesses.
Federal Trade Commission Consumer Protection Chief David Vladeck
said that the most important consideration isn't whether companies obtain opt-in or opt-out consent, but whether they are adequately notifying consumers about data collection. "The goal ought to be
to keep consumers well-informed," he said. "Clarity and ease of use ought to be the key metrics."