Which Way Internet Privacy?

Momentum toward enforcing some kind of privacy standards for the Web has stalled. Without clear impetus from government, the stage may be set for industry self-regulation efforts.

Late last year, a Washington research group specializing in technology policy predicted that 2001 could be the year for breaking the longstanding impasse over Internet privacy. Noting that the debate finally had a central theme -- whether online consumers must directly "opt in" to the sharing of their personal information or whether companies simply must give them the choice to "opt out" -- the Delaney Policy Group argued in its "Tech Policy 2001" report that "some federal government actions seem unavoidable" in 2001. (See the report at www.delaneypolicy.com/ publications/tp200l.htm.)

The analysis didn't seem all that bold at the time. Within weeks of its release, key lawmakers such as Rep. Joe Barton (R-Tex.), a co-chairman of the Congressional Privacy Caucus, were predicting much the same thing. The electronics trade group AeA even bucked the technology industry line on privacy by calling for federal legislation.

But expectations of a privacy consensus have proven premature. Powerful legislators who pushed the issue to the fore have not revived their bills, Timothy Muris, confirmed May 25 as the new head of the Federal Trade Commission (FTC), refused to say at a confirmation hearing whether he would back the agency's endorsement of federal privacy legislation -- an endorsement the agency made last year after two years of emphasizing industry self-regulation. And at the state level, attorneys general who could play a role in enforcing any federal law are divided over what their privacy stance should be.

Privacy advocates see hope in the Senate's sudden shift to Democratic control, thanks to Sen. James Jeffords' decision to bolt the GOP. But no longer do policymakers and political observers use words like "inevitable" and "substantial" when discussing Internet privacy legislation; instead, they talk of being cautious, sober and incremental.

"People have realized that the issue is much more complex than some of the self-styled privacy advocates want them to believe," says Harris Miller, president of the Information Technology Association of America (ITAA). "There is no simple solution to this problem, and specifically there is no simple legislative solution."

Is There a Champion Out There?

Observers credit the change in outlook to numerous factors, including the party parity in Congress and the early emphasis on other hot-button issues like tax cuts and education reform. Richard Delaney, president of the Delaney Policy Group, says privacy lacks a "champion" in either the Bush administration or Congress. Lawmakers are focusing on a relatively few issues, he says, "and protecting online privacy does not seem to be one of those issues."

Fred Gate, an Indiana University law professor and nationally recognized privacy expert, added that privacy might not rank high on the legislative agenda because it is not a top priority of Americans. The ITAA's Miller added that recent federal laws and regulations designed to offer privacy protection for financial and medical information and for controls on children's use of the Internet have addressed consumers' most pressing concerns.

Yet privacy is by no means a dead issue. Polls continue to show the public believes the Internet could rob them of privacy and expose them to identity theft, fraud and other mischief, and the courts have been active on the issue, even if legislators have not. On April 30, for instance, a U.S. district judge upheld an FTC ruling that credit bureaus and database companies cannot sell Social Security numbers and other personal information on the "credit headers" at the top of credit reports without consumers' permission.

Privacy rights' advocates offer another explanation for the ebbing of the privacy tide: money. They say the industries that oppose privacy legislation have bought enough influence with political contributions to guarantee legislative success. Chris Hoofnagle, a staff counsel at the Electronic Privacy Information Center (EPIC), pointed to the quick and lopsided House and Senate passage of bankruptcy reform legislation early this year. He characterizes those votes as lawmakers' "repayments to contributors," and added that the credit card and lending industries likewise have been able to stifle substantive action on privacy legislation because of their political investments.

That is true at both the state and federal levels, says Beth Givens, director of the California-focused Privacy Rights Clearinghouse in San Diego. "Industry has been a very effective lobbyist and also contributed a great deal of money to the campaign coffers of congressmen, she says.

But people in the technology industry counter that privacy catapulted to the top of the agenda in 2000 in large part because privacy rights advocates succeeded in sensationalizing the issue. With the "pressure cooker of an election year" now past, says John Palafoutas, senior vice president of domestic policy for the AeA, policymakers and the public are better able to weigh the costs and benefits of federal privacy legislation.

"The so-called consumer organizations were sort of singing a doom-and-gloom chant [last year], and people were expecting the Exxon Valdez of privacy," he says. "Well, there has been none. ... And I think people see that maybe there is less here than meets the eye."

Preemption a Hot Button

The war is being waged along well-established lines. The key elements of the debate include:

* Notice: Whether consumers should be warned of company privacy policies.

* Choice: Whether consumers decide to participate in information-sharing through an opt-in mechanism or the less burdensome opt-out approach.

* Access: Whether consumers should be allowed to see the information marketers collect.

* Security: Whether the data that is collected is secure enough to prevent abuse.

This year, another principle also has gained momentum: federal preemption. The back-and-forth about whether to make any federal privacy legislation a ceiling that could not be exceeded by tougher state laws, or a floor that would serve as a baseline, is fast becoming the proverbial line in the sand. AeA has conditioned its support for privacy legislation on federal preemption, while privacy groups see it as anathema.

"They say the states are the public policy laboratories for the nation," says the Privacy Rights Clearinghouse's Givens. "And when you impose a federal standard, you lose the ability of the states to come up with more creative and more stringent laws."

But industry sources say stringent privacy laws could cripple the business community. Even worse, they say, a failure to create a federal ceiling could force businesses to comply with a patchwork of 50 privacy laws. "That would be disastrous to industry, and it would be disastrous to consumers," the AeA's Palafoutas says. "Enforcement would be a nightmare."

Experts who occupy the middle ground on privacy agree. Jerry Berman, executive director of the Center for Democracy and Technology (CDT), says the lack of a federal privacy baseline would be "very bad for the Internet." And Dave Steer, communications director for the voluntary TRUSTe "seal program" that polices the privacy practices of its member businesses, says creating a federal privacy floor "would be a giant step backward from where we are today. ...A quilted approach won't just harm industry; it will confuse the people it is trying to protect."

Push for Self-Regulation

Self-regulation is the other leading privacy philosophy. ITAA's Miller says it "is the way to go, and we find that that message seems to be resonating on Capitol Hill." Privacy-seal programs like those offered by TRUSTe and the Better Business Bureau Online are at the core of the self-regulatory approach, and TRUSTe's Steer says they are gaining in popularity. He adds that companies are realizing the benefits of having a pro-privacy image. "Pacific Bell now calls its Caller ID a 'privacy manager,'" he says. "EarthLink is branding itself to consumers as the pro-privacy Internet service provider."

Business interests also tout technological solutions, such as the Platform for Privacy Preferences (P3P) standard that Microsoft is incorporating into its new version of Internet Explorer. P3P allows Web surfers to adjust their privacy preferences among settings of "high," "medium-high," "medium," "medium-low" and "low."

Steer says the best, and most likely, solution to the privacy dilemma is "a healthy mixture between government oversight, new technology and industry self-governance. It is a system of 'checks and balances.'" And Berman says CDT is trying to play a "broker role" among all the principals in the debate to help them find that balance.

Perhaps the most noteworthy development in recent months was President Bush's April decision to implement the medical privacy regulations approved late in the Clinton administration. That decision "is going to heighten awareness of privacy issues," says EPIC's Hoofnagle. "It will sensitize people." But even privacy rights' advocates acknowledge that nothing substantive is likely to happen in 2001 -- and some observers don't expect passage of any comprehensive legislation until after the next election, if then. Indiana University's Cate goes a step further. "No comprehensive privacy law is likely to ever pass under our current political system," he says.

TRUSTe's Steer says the ultimate conclusion to the online privacy debate hinges largely on the business community. "If industry fails to show demonstrable proof that it is regulating its own practices ... policymakers will be much more aggressive," he says. "On the other hand, if current trends continue, I think you will see policymakers codify a legal structure that relies on the discipline of self-governance. It's really in the industry's court now."

That assessment is one that industry seems to be embracing. "If we mess this up," says AeA's Palafoutas, "we're going to lose big money. And we're in business to make money.

K. Daniel Glover, managing editor of National Journal's Technology Daily, has more than a decade's experience covering politics and policy in Washington, D.C. He can be contacted at [e-mail].