Internet privacy legislation emerges: new legislation could bring U.S. privacy protection laws into step with those of the European Union. (Legislative & Regulatory Update).

Despite overwhelming concerns about the threat of terrorism, the unethical conduct of corporate America, and the recent floundering of Wall Street, privacy remains an important issue among consumers in the United States and worldwide.

Key committee members from both chambers of the U.S. Congress have introduced privacy legislation. Sen. Ernest Hollings (D-S.C.), chairman of the Senate Commerce Committee, introduced S.2201, the Online Personal Privacy Act, on April 18. The Senate Commerce Science and Transportation Committee held hearings shortly after its introduction and reported the bill with amendments on May 17.

Rep. Cliff Stearns (R-Fla.), chairman of the House Commerce Committee's Subcommittee on Consumers and the Internet, introduced H.R.4678, the Consumer Privacy Protection Act of 2002, on May 8. The bill is currently under consideration by the House Energy and Commerce Committee, as well as the House Committee on International Relations. No hearings have been held on the H.R.4678.

If passed, S.2201 would require records managers to protect databases against unauthorized use and guarantee that sensitive data not be collected and shared with third parties without explicit consumer permission.

Hollings' measure calls for a hybrid approach to privacy regulation. The bill seeks an "opt-in" approach, requiring businesses to obtain consumer consent to collect and disclose sensitive personal information such as political party, religious affiliation, and sexual orientation. For less-sensitive information such as name, address, and telephone number, businesses would be required to provide notice to "opt-out" of the collection of such data. It would require the Federal Trade Commission (FTC) to create regulations for new privacy requirements and to report annually on the progress of the law.

One of the most contentious items in the bill would allow consumers the right to sue if their personal information is mishandled or improperly collected from online transactions. Service providers also would be responsible for providing utilities for users to access their information, allowing them to delete or correct any personally identifiable information. This bill would supercede any state law or regulation regarding privacy and would apply to federal agencies so long as the regulations would not compromise law enforcement activities. Provisions of the legislation would apply only to online operations.

From a global viewpoint, passage of S.2201 would bring privacy laws in the United States closer to those of the European Union (EU) and might resolve the conflict regarding data transfer between the United States and the EU.

In April, the Commerce Committee held a hearing on S.2201. Panelists included Paul Misener, vice president of global public policy for Amazon.com, and John Dugan of Covington and Burling, a law firm representing the financial industry. Both witnesses shared the concerns of Sen. George Allen (R-Va.), citing that the legislation might be "premature." In his opening statement, Allen said, "I don't think we should discriminate against personally identifiable information with regard to the medium through which the information is collected." Dugan added that the bill could "cause some companies to avoid online operations altogether."

Other dissenters included Sen. John McCain (R-Ariz.) and Sen. Ron Wyden (D-Ore.). McCain opposed the provisions in the bill creating a right for consumers to sue for privacy violations, as well as potentially cumbersome requirements to permit customers to access their personal information. Wyden stated that the bill should include a "safe harbor" for companies that adopt self-regulatory privacy standards.

Two panelists in support of the legislation were Marc Rotenberg, executive director of the Electronic Privacy Information Center, and Frank Torres, legislative counsel for the Consumers Union. Torres said that the Consumers Union could support the bill with its combined "opt-in, opt-out" approach if the right to sue is preserved. Rotenberg said that the right to sue should be broadened and suggested that the exemption from the privacy standards for law enforcement should be eliminated.

At markup of S.2201, the Hollings Committee included the addition of a safe harbor provision for small businesses, further limitations on private rights of action, and the addition of a requirement for the FTC to create similar rules for the offline marketplace following passage of the bill.

The Stearns measure would require businesses to provide notice of their privacy practices at the point of collection and provide consumers with the ability to "opt-out" of sharing any data unrelated to fulfilling the transaction. This bill would apply to all consumer information collection, both online and off.

However, H.R.4678 does not create a consumer's right to sue for violations of the law and would direct the FTC to oversee voluntary self-regulatory programs for privacy practices. While the legislation would require businesses to provide an opportunity for consumers to preclude the sale or disclosure of personally identifiable information, it would allow businesses to provide incentives to consumers for the right to sell that data. H.R.4678 also includes provisions that better define the role of the FTC's Identity Theft Clearinghouse and provides for the improvement of current identity-theft procedures by the Commission.

The legislation would supercede any state law or regulation but would not modify or limit any other international or federal privacy laws.

The difference between the two bills and the lack of full support for either in their respective committees may preclude the passage of privacy legislation this year. The current measures have provided additional dialogue in the public policy arena but, more than likely, the issue will not be revisited until 2003.

Comparison of Hollings (S.2201)/Stearns (H.R.4678) Privacy Legislation

Opt-in/Opt-out

S.2201 Opt-in: Would require businesses to obtain consent for the collection and disclosure of sensitive personally identifiable information (including health, race, political party, religious belief, sexual orientation, Social Security number, or financial information).

Opt-out: Would require businesses to provide robust notice (at point of collection) of the opportunity to opt-out of the collection or disclosure of personally identifiable information.

H.R.4678 Opt-out: Would require businesses to provide "notice" of their privacy practices at the point that personally identifiable information is collected and give consumers the ability to opt-out of sharing any data unrelated to fulfilling the transaction with a third party. Would require data-collection organizations (excluding a government agencies, nonprofit entities not using information for commercial purposes, and very small businesses) to establish "clear and conspicuous" privacy policies to be accessible at the Web site.

Bricks vs. Clicks

S.2201: Would treat online and offline information collection differently. Bill is applies to Internet service providers (ISPs), online service providers (OSP), or operators of a commercial Web site. Also includes third-party operators such as advertising networks that use an ISP, OSP, or commercial Web site operator to collect information about users of that service or Web site.

H.R.4678: Would treat online and offline information collection the same. Bill is applicable to "data collection organizations." That term does not include:

* governmental agencies

* non-profit entities where personally identifiable information is not used for commercial purposes

* businesses

1. with an annual revenue of less than $1 million

2. with fewer than 25 employees

3. that collect or use personally identifiable information from fewer than 1,000 consumers for a purpose unrelated to a transaction with the consumer

4. that do not process personally identifiable information of consumers

5. that do not sell or disclose for consideration such information to another person

Enforcement (Private Right to Sue, FTC Role, and Whistleblowers)

S.2201: Would allow consumers the right to sue if an ISP, OSP, or commercial Web site operator collects, discloses, uses, or fails to provide reasonable access to, or reasonable security for, sensitive personally identifiable information. The consumer would be entitled to the greater of the actual monetary loss associated with the violation or $5,000.

Would make the FTC responsible for creating regulations to enforce the new privacy requirements of the act within 90 days of enactment and will complete that process 270 days after the beginning of the rulemaking. The FTC also would be responsible for reporting the progress of law to the Senate Commerce Science and Transportation Committee and the House Committee on Commerce 18 months after enactment and annually after that.

Would provide legal protections to any "whistleblower" who provides information to any federal or state agency, to the U.S. Attorney General, or any state attorney general, regarding a violation of any provision of Title I, so long as that employee did not cause or participate in the alleged violation or provide substantially false information.

H.R.4678: Would not allow consumers the right to sue for violations of the federal law or to find civil action standing under any state law.

Would have the FTC oversee voluntary self-regulatory programs for "data collection organizations." The FTC would receive applications and approve program parameters. The "data collection organizations" would be required to conduct an initial self-review and self-certification to ensure compliance, and then conduct subsequent periodic self-reviews to be submitted to the FTC. Each program would be subject to random and regular compliance testing by the FTC. Each violation would be subject to fines under 1S U.S.C. 45(a)(1) not to exceed $500,000 for all related violations by a single violator.

There are no "whistleblower" provisions.

Access

S.2201: Would require ISPs, OSPs, and the operator of commercial Web sites to provide a user with access to information that the provider has collected. Would require the provider to give a user the opportunity to correct or delete any personally identifiable information.

H.R.4678: Would require the "data collection organization" to provide a consumer with the opportunity to preclude any sale or disclosure of personally identifiable information. A data collection organization has the right to offer benefits to the consumer in exchange for the privilege of selling or disclosing information. A preclusion remains in effect for five years or until the consumer indicates otherwise, whichever occurs sooner.

Security

S.2201: Would require an ISP, OSP, or commercial Web site operator to establish and maintain reasonable procedures necessary to protect the security, confidentiality, and integrity of personally identifiable information.

H.R.4678: Would require the FTC to develop and provide an "Identity Theft Affidavit" for consumers who feel that they are victims of identity theft. The FTC also would be responsible for the timely resolution of identity theft disputes and for providing improvements to the currently operative FTC Identity Theft Clearinghouse, which is the federal government's centralized repository of consumer identity theft complaint information.

Preemption of State Laws

S.2201: Would supersede any state statute, regulation, or rule regulating Internet privacy to the extent that it relates to the collection, use, or disclosure of personally identifiable information obtained through the Internet.

H.R.4678: Would make qualified exemption for "data collection organization" if it complies with relevant provisions of other federal privacy laws. Would not modify, limit, or supersede the operation of other federal privacy laws. Would preempt any statutory law, common law, rule, or regulation of a state.

Agencies

S.2201: Would apply to every federal agency that serves as an ISP, OSP, or operates a Web site so long as it does not compromise law enforcement activities or the administration of any investigative, security, or safety operation conducted in accordance with federal law.

H.R.4678: Does not apply to federal agencies as defined by the term," data collection organization."

What is Protected

S.2201: Defines "personally identifiable information" as 1) name, address, e-mail address, telephone number, birth certificate number, any other identifier for which the Commission finds there is a substantial likelihood that the identifier would permit the physical or online contacting of a specific individual; or 2) information that an ISP, OSP, or operator of a commercial Web site collects and combines with an identifier included in this definition.

Defines "sensitive financial information" as the amount of income earned or losses suffered by an individual; an individual's account number or balance information for a savings, checking, money market, credit card, brokerage, or other financial services account; the access code, security password, or similar mechanism that permits access to an individual's financial services account; an individual's insurance policy information; or an individual's outstanding credit card, debt, or loan obligations.

Defines "sensitive personally identifiable information" as individually identifiable health information, race or ethnicity, political party affiliation, religious beliefs, sexual orientation, Social Security number, or sensitive financial information.

H.R.4678: Defines "data collection organization" as an entity (or an agent or affiliate of the entity) that collects (by any means, through any medium), sells, discloses for consideration, or uses personally identifiable information of the consumer.

Defines "personally identifiable information" as information relating to a living individual who can be identified from that information including name, address, e-mail address, telephone number, Social Security number, and any other unique identifying information that a data collector and processor collects and combines with any information previously described in this definition. This definition does not include anonymous or aggregate data, or any information that does not identify a unique living individual, information about a consumer inferred from data maintained about a consumer, or information about a consumer obtained from a public record.

Bob Tillman is Director of Public Relations and Advocacy for ARMA International. He may be reached at [e-mail].