Administration Seeks Input on Privacy Policy

November 6, 1998

Administration Seeks Input on Privacy Policy

By JERI CLAUSING
ASHINGTON -- The Clinton Administration is seeking public input on the position it is taking in response to a strict new European privacy law, prompting speculation it may be trying to back away from its controversial hands-off approach to protecting privacy in the digital age.
The Commerce Department on Friday will post on its Web site a statement that spells out its basic laissez-faire approach on privacy regulations, a position that is at odds with a European Union directive that took effect October 26. But for the first time, the Administration is seeking public comment about its position on this issue.
A key provision of that law prohibits any company doing business in the European Union from transmitting personal data to any country that does not guarantee comparable privacy protections -- which could cause major disruptions in electronic commerce between the United States and Europe.

Related Articles
Strict European Privacy Law Puts Pressure on U.S.
(October 9, 1998)
European Law Aims to Protect Privacy of Personal Data
(Oct. 26, 1998)
Forum
Join a Discussion on Online Privacy

Sanctions against the United States have been delayed until December while the governments involved attempt to negotiate a compromise. And while the statement of principles issued by David Aaron, the Under Secretary of Commerce, on Wednesday reaffirms the position that the EU has so far rejected, some experts said the fact that the Administration is now seeking public input indicates it might be looking to shift course.
"This may signal a way for the Administration to back away from its hard-line, self-regulatory position," said Joel Reidenberg, a law professor at Fordham University in New York and an expert on United States-European relations.
"Because for two years now the Administration has said, 'We'll let self-regulation run it's course.' It's said to the marketplace, 'Show us you can do the job.' But every six months it has had to extend the deadline. And now the government is faced with the problem that the directive is now in effect and American industry has not yet demonstrated effective self-regulation."
Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, D.C., called the action by the Commerce Department a positive step, but one that is long overdue.
"Up until this point, the Commerce Department has been almost solely concerned with the interests of U.S. businesses operating in Europe and has completely ignored the public concerns in the United States about the absence of privacy protection," Rotenberg said.
"It has taken them a long time to realize that they ended up with a policy that really was not workable. We said throughout the whole last Congress that there was plenty of support for privacy legislation. They said, 'No, we're going to make self-regulation work,' but self- regulation is not working."
Aaron was traveling on Thursday and his office said he would not be available for comment. On Wednesday, he told The Associated Press the statement he was issuing officially lays out the government's bargaining position with the European Union.
"For now, we're trying to get [the European Union's] reaction to these principles themselves," Aaron said.
The new European directive embraces several basic principles that national governments must now translate into their own laws. It requires that companies tell people when they collect information about them and disclose how that information will be used. In addition, customers must provide informed consent before any company can legally use that data.
The law also requires companies to give people access to information about themselves.
In its position paper, the Administration reiterates its belief that U.S. companies should not be forced to give people access to personal information about themselves. In addition, the paper outlines the Administration's policy that companies should have the option to choose an independent industry group to police their privacy policies, instead of a government body, as required by the EU directive.
Aaron says the United States wants to give companies a variety of "safe harbors" to satisfy privacy protection. One idea is to create independent organizations that would monitor a company's data practices and give companies that comply with accepted guidelines what amounts to a stamp of approval.
A survey by the Federal Trade Commission of the privacy practices of 1,400 Web sites early this year painted a dismal picture of the effectiveness of self-regulation in protecting privacy online. The results of that survey prompted Congress this year to pass a law requiring Web site operators to get parental permission before collecting any personal information from children under 13.
The survey also spurred creation of the Online Privacy Alliance, a coalition of major companies and marketing firms that has established guidelines for protecting consumer privacy on the Internet as well as a model for enforcing the guidelines.
The Federal Trade Commission has said that if dramatic improvements are not seen by January, it will push for broader legislation to protect the privacy of all consumers online.

Related Sites
Following are links to the external Web sites mentioned in this article. These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability. When you have finished visiting any of these sites, you will be able to return to this page by clicking on your Web browser's "Back" button or icon until this page reappears.

Department of Commerce
Fordham University
Electronic Privacy Information Center
Federal Trade Commission
Online Privacy Alliance

Jeri Clausing at jeri@nytimes.com welcomes your comments and suggestions.

Help/Feedback | Classifieds | Services | New York Today