WASHINGTON (05/23/2000) - After months of telegraphing a shifting attitude about online privacy, the U.S. Federal Trade Commission has recommended that Congress enact broad new legislation to protect private data on the Internet.
The commission's third annual congressional report was released yesterday prior to a scheduled Thursday appearance by the five Federal Trade commissioners before the Senate Commerce, Science and Transportation Committee chaired by Sen. John McCain, a Republican from Arizona.
On May 19, the commission voted 3-2 to ask Congress to pass a law guaranteeing "a basic level of privacy protection for consumer-oriented commercial Web sites."
The commissioners will ask Congress:
--To pass a law mandating "clear and conspicuous" privacy notices; --To require that consumers be offered a choice as to how their personal information is used; --To allow "reasonable" consumer access to personal information collected online; --And require sites to take "reasonable steps" to secure the personal information collected.
Yesterday's report, which signals an important shift in the FTC's official stance on online privacy, is based on a Web site survey conducted earlier this year that gauged the privacy practices of hundreds of leading sites, including Amazon, Yahoo and eBay.
The survey revealed that only 42 percent of the 90 most popular Web sites that collect personal information adhere to the FTC's "fair information practice principles" of notice, choice, access and security regarding the collection and use of personal data. The report also includes recommendations made by a special advisory committee of industry experts that studied online information access and security questions.
For years, the FTC has been telling Congress that consumers' online privacy is best protected by voluntary self-regulation, a position eagerly echoed by industry representatives. But the FTC's patience with the online industry apparently has worn thin.
During the past year, the commission has conducted investigations into the privacy habits of leading e-commerce sites, from Amazon to Yahoo. For the past several months, the commission has been signaling a change of heart. In February, FTC Chairman Robert Pitofsky told a Senate committee that he was "increasingly coming around to the view" that legislation was needed to supplement self-regulation.
"The question is not whether industry self-regulation has passed or failed a test," Pitofsky said in a statement issued with Monday's report.
"Self-regulation alone, without some legislation, is unlikely to provide online consumers with the level of protection they seek and deserve." The chairman added that self-regulation was still "vitally needed" and that new legislation shouldn't be "unduly burdensome or expensive" to implement.
Despite Pitofsky's conciliatory posture, industry representatives blasted the FTC report. They pointed to the commission's own statistics, which show a steadily improving level of online privacy protection over the past several years. They also argued that self-regulation, along with specific laws aimed at protecting financial, medical and children's data, is better than sweeping regulation. The Direct Marketing Association released a survey showing that 93 percent of highly popular Web sites post detailed privacy policies.
"We believe the recommendations are overbroad, premature, impractical and unnecessary," said Christine Varney, a former FTC commissioner who advises the industry group Online Privacy Alliance. "I think [the report is] pretty astonishing."
Although the report's language is carefully vague, some industry lobbyists worry that the bigger problem looming behind any new law is the new rule-making authority that would be conferred on the FTC.
"Once the regulatory process starts, you're going to get into very specific requirements," said Harris Miller, president of the Information Technology Association of America. "There are always a lot of unanticipated consequences.
Before you know it, you've got a 90-page recommendation. The phrase 'light-handed regulation' is an oxymoron."
Lawmakers had mixed reactions to the report. Ken Johnson, spokesman for Rep.
Thomas Bliley (a Republican from Virginia), chairman of the House Commerce Committee, said Bliley is opposed to online privacy legislation.
"It's too early," Johnson said. "The bottom line is, we need to proceed cautiously. The quickest way to kill the Internet is to regulate it to death."
Those comments were echoed by Rep. Bob Goodlatte, a Repubican from Virginia, who said Congress would be "very cautious to make sure this is not something that will stifle an industry whose growth is dependent upon the ability to share information."
Privacy advocates praised the report as a step in the right direction. Marc Rotenberg, executive director of the Electronic Privacy Information Center, called it "a significant development," but said it doesn't go far enough. While Rotenberg praised the FTC, he also called for the creation of an independent privacy commission and a "private right of action" against Web sites that mishandle personal data.
"Self-regulation is important and should be promoted," said Josh Kardon, chief of staff to Sen. Ron Wyden, a Democrat from Oregon. "But self-regulation won't get the job done without baseline legislation regulating privacy." Kardon said Wyden is revamping an online privacy bill he introduced with Sens. Conrad Burns, a Repubican from Montana, and Herbert Kohl, a Democrat from Wisconsin, in light of the FTC's report.
Commissioners Sheila Anthony and Mozelle Thompson joined Pitofsky in approving the report.
Commissioners Thomas Leary and Orson Swindle voted against the report. In a scathing written dissent, Swindle called the report an "embarrassingly flawed" document that relied on "skewed descriptions" of survey data. Leary said the report is too broad in scope regarding online privacy practices and too narrow in that it draws a distinction between online and offline consumer privacy.
Leary said the report's concentration on online privacy is "illogical, impractical and potentially harmful."
Regardless of the FTC's shift, few observers expect Congress to enact meaningful privacy legislation this year, barring a massive breakout of online privacy abuse.
The Republican congressional leadership, the White House and the Commerce Department, which are all reluctant to antagonize the high-tech lobby, continue to favor self-regulation as the sole means of policing Internet privacy. But, at the very least, the FTC's report has set the stage for the 107th Congress, which might not be as reluctant to regulate privacy as its predecessors.