Wednesday, October 07, 2009
Controlling Internet information
Editorial commentary
Recent contributions
- Can we be a two-trolley town?
- Striving for civility
- School funding no fantasy
- Pesticide board's work will continue through merger
- Commentary archive
From the RoundTable blog
Read the latest entries
Rick Boucher
Boucher, a Democrat, represents Virginia's 9th District in the U.S. House.
Broadband networks are a primary driver of the national economy, and it is fundamentally in the nation's interest to encourage their expanded use. One clear way Congress can promote greater use of the Internet is to assure Internet users a high degree of privacy protection, including transparency about the collection, use and sharing of information about them, and to give them control over that collection, use and sharing.
Because consumers need an assured level of control over the collection, use and sharing of information about them, a statute providing those assurances is now called for. That goal should be achieved by legislation, which reflects best industry practices and requires that they be followed by all Web sites that collect information from Internet users. Legislation assuring Internet users that their online experience is more secure will be a driver of greater levels of Internet uses such as e-commerce, not a hindrance to them.
It is also important to note that online advertising supports much of the commercial content, applications and services that are available to Internet users today without charge, and I have no intention of disrupting this well established and successful business model.
At the same time, consumers are entitled to some baseline protections in the online space. For these reasons, I plan to introduce, with bipartisan participation, a measure based on the following principles, which will extend a clear set of privacy rights to Internet users:
Disclosure. Consumers should be given clear, concise information in an easy-to-locate privacy policy about what information a Web site collects about them; for what purposes; for how long the information is stored; and under what circumstances it is given or sold to third parties. A Web site that makes material changes to its privacy policy will be required to give consumers notice of those changes.
Collection. As a general rule, Web sites should be permitted to collect information about Web site visitors sufficient to build preference profiles about them unless the Web site visitor affirmatively opts out of this practice.
However, a Web site may only knowingly collect sensitive information, such as medical information, financial information, information about sexual preference, precise geographic location information and information about children and adolescents, with a consumer's express opt-in consent. In addition, a network operator or Internet service provider should be permitted to use technologies like deep-packet inspection, which collect information about all of a subscriber's online activities across the Internet with that subscriber's express opt-in consent.
Use of information. If someone does not want a Web site he visits to use information it collects to deliver ads to him, he should opt out of that use. However, a consumer has a reasonable expectation that a Web site he visits will not be sharing his information with unrelated third parties. Accordingly, if a Web site wants to provide information to an unrelated third party, it should procure that Internet user's affirmative opt-in consent.
Safe harbor. To encourage proactive industry efforts that give consumers extra control over how information about them is collected, used and disclosed, the legislation should create a safe harbor for companies that participate in robust self-regulatory programs that have been approved by the Federal Trade Commission. A variety of models that place the power to make privacy-related decisions in the hands of consumers might qualify and allow, subject to consumer opt out, the sharing of information among unrelated Web sites.
Such programs could, for example, allow consumers to opt out of the collection, use and disclosure of information by all companies participating in a particular ad network that serves targeted advertising to those companies' Web sites by taking a single step, such as checking one box on one Web site. Other programs might allow consumers to view and modify, or opt out of entirely, the profile a Web site maintains about them or give consumers a ready means of obtaining more information about the source of particular online advertisements and the opportunity to opt out of them. Such a safe harbor will encourage these and other pro-consumer creative self-regulatory efforts.
The FTC will be given regulatory authority to enforce the privacy principles set forth in the statute and to define the pro-consumer policies which will qualify for the safe harbor provision.
The structure I have set forth should not prove burdensome for Internet-based businesses that rely on targeted advertising and is in line with the practices of reputable service providers today. More importantly, by giving Internet users a greater confidence that they have control over the collection and use of information about them by Web sites, it will encourage greater levels of general Internet usage and e-commerce, benefiting not only consumers, but also the companies that transact business online and our nation's economy.
