Yesterday, Reps. Rich Boucher and Clifford Stearns released a “discussion” draft for what they intend to become a new law addressing privacy online. Mr. Boucher, whom I and a number of consumer and privacy representatives met with in March, is sincere in his desire to address online privacy. But the bill’s overall orientation maintain (and really nurtures) the intense and pervasive data collection, online profiling, and targeting status quo. Instead of focusing the goal of the bill on data minimization, a important Fair Information Principle, it really enables the maximization of information collection on consumers.
The bill does make several important contributions, including acknowledging that racial/ethnic and sexual orientation must be considered “sensitive” information requiring higher safeguards [I played a role in urging Congressional leaders to include racial/ethnic data in the sensitive category]. By acknowledging that a “unique persistent identifier” should be classified as personal information, the draft bill follows what policymakers in the EU have crafted (and the FTC staff has already largely suggested).
But by primarily relying on so-called “notice and choice”–namely privacy policies–the bill fails to protect online users. There is a growing consensus, backed by research, that privacy policies are inadequate. The reliance by Mr. Boucher on Google’s ad preference manager system, which allows users to opt-out of more specific ad targeting categories, doesn’t address the key question: how can we ensure less information is collected and used about each of us. Nor does the bill protect sensitive information involving health and finance, where it permits a huge loophole that will continue online data practices involving our interactions online with financial and health related sites and services]. Adolescents are left unprotected in the bill–one of its most glaring omissions.
The bill doesn’t really empower the FTC to act effectively in this area, in our opinion. Under the Boucher/Stearns bill, consumers will still have to rely on digital fine print–written in invisible ink–to protect privacy. This is not a debate on ensuring online ad revenues for free content–we all support that. It’s about defining reasonable rules of the online road that balances citizen and consumer rights with the interests of those who collect our data–whether they be commercial or government.
