Fair Information Practices Still the Exception on the Web >BY Rachel Chalmers.

A new meta-study on privacy, conducted by the Center for Democracy and Technology (CDT), reports that web sites routinely abuse both the Fair Information Handling Practices and the seal programs designed to enforce their observance. The CDT has called on Congress to legislate to protect the privacy of personal information on the internet. "Fair Information Practices continue to be the exception rather than the rule on the World Wide Web," claims the report; "private sector enforcement programs cover a very small segment of commercial web sites; and individuals' concerns with their privacy online remain only partly addressed." Worst of all for those who pin their hopes on an e-commerce explosion, the CDT says popular awareness of the privacy issue is rising. "Privacy now overshadows censorship as the number one most important issue facing the internet."

The CDT report distills the 1973 Code of Fair Information Handling into a few simple principles. People have the right to access information held about them and correct any errors. They should control how that information is disclosed to third parties. Record keepers should disclose what they collect and should collect only information that is necessary for the task at hand. The information should only be used for the purpose for which it was collected, unless the individual gives his or her consent for it to be used otherwise. Record keepers should also work to ensure data quality and security and should themselves be accountable for all of the above.

Based on its analysis of the June 1998 FTC Report to Congress and the May 1999 Georgetown Internet Privacy Policy Study (GIPPS), the CDT concludes that: "Privacy policies are the exception not the rule on the internet... few web sites are adhering to the full set of Fair Information Practices." The private sector boasts of its success in self-regulating privacy on the internet, but the CDT is unimpressed with its efforts of the three leading seal programs, BBBOnline, TrustE and WebTrust. "At the current time, the quality of privacy practices required of seal holders by the three programs varies substantially," it reports. "Because two of the seal programs (TrustE and WebTrust) are in the process of raising their standards, a consumer cannot tell by the seal exactly what protections are offered. This undermines the simplicity the seals were intended to provide."

Web businesses, then, are ignoring the accepted code of conduct on information handling, and the industry's best efforts to enforce it are proving inadequate. "While the Seal programs standards are, according to the GIPPS, higher than the current practices at the vast majority of web sites, they fall short of meeting the Fair Information Practice Principles," reports the CDT. Nor does self-regulation provide individuals with much in the way of recourse if their privacy is violated, since there are few provisions for enforcement. "Enforcement program participants make up only a small portion of the web sites online," the CDT found. "Today the three programs have enrolled a total of 900 web sites... In light of these statistics on the behavior of highly trafficked web sites, consumers have good reason to be concerned about their privacy online," the report concludes. "We continue to believe that legislation is both necessary and inevitable to make individual privacy on the internet the rule rather than the exception."