April 8, 1999

Lawmaker Plans Bill to Protect Consumer Privacy Online

By JERI CLAUSING

ASHINGTON -- Saying new technology poses a threat to fundamental civic freedoms, Representative Edward Markey on Wednesday said he was drafting legislation to put basic rules on the books to protect consumers in the digital age.

Markey said companies that gather information about consumers online have made great strides in their efforts to police themselves. But he told the Computers, Freedom and Privacy Conference here that the self-regulatory efforts being pushed by the Clinton Administration and industry need to be supplemented with a bill of rights that gives consumers solid legal recourse when the information they provide is misused.

The Democrat from Massachusetts led the effort last year to pass a bill protecting children from online marketers. He said his new proposal would encompass three basic principles: the right of individuals to know what information is being collected about them online, the right to know how that information is being used, and the right to take legal action if it is misused.

Related Articles IBM Takes Stand for Consumer Privacy on Web (April 1, 1999) Privacy Watchdog Declines to Pursue Microsoft, a Backer (March 22, 1999) Business Group Unveils Plan for Online Privacy (March 18, 1999) Forum Join a Discussion on Online Privacy

"I'm giving all rights to the individual and leaving nothing in doubt as to what the responsibilities of industry are," Markey said of the bill, which is not yet complete.

Markey's message was well received at the three-day conference, which has largely focused on the complex international debates over new challenges presented by the Internet and other technological advances.

Although many at the conference are strong backers of the Clinton Administration's position that the Internet should remain largely unregulated, most take exception when it comes to privacy.

In a keynote address Wednesday, Vint Cerf, senior vice president of MCI and one of the founders of the Internet, re-emphasized his position that the global network needs to remain "unfettered and unregulated," free of a "thicket" of varied national laws. But when pressed about whether that means consumer privacy should not be regulated, Cerf emphasized that the Internet is just a way of transmitting information, while the use of personal data is a different "end game" that might require legislation.

Markey, though light on specifics about his proposed bill, said it would call for "stiff penalties" for anyone who used personal information collected online for a purpose other than that clearly stated by the collector. The laws would likely be enforced by the Federal Trade Commission, he said.

With the backing of the Clinton Administration, merchants and online marketers have so far been able to ward off new regulations on the collection of information online, saying they would police their own handling of personal data.

But the Administration could change its mind and support new regulations if companies do not make significant progress toward demonstrating that they are policing and enforcing online privacy practices.

The Federal Trade Commission, which last year conducted a survey that showed only 14 percent of Web sites had posted privacy policies, is preparing a report to Congress on whether or not significant improvements have been made.

Robert Pitofsky, chairman of the FTC, has said he would push for new laws to protect consumers if the report finds that self-regulation is not working.

Markey said that although the bulk of businesses can be trusted to cooperate under the self-regulatory plans being constructed by groups like the Better Business Bureau and the Online Privacy Alliance, a basic law is needed for the "10 to 20 percent of businesses that are going to exploit consumers."

Privacy protections require a combination of new laws, self-regulation and new technologies, he said.

Indeed, one of the areas that has been explored at the conference, which opened Tuesday, has been new technology for protecting consumer privacy. Among the advances in this field is a system known as the Privacy Preferences Project or P3P, developed by members of the World Wide Web Consortium, the body that sets technical standards for the Internet.

"Personal privacy should not bend to the latest technology."
Representative Edward Markey

The system was unveiled last year, but it has gone largely unused because it is technically difficult to implement. It is designed to let consumers tell their Web browser how much information they are willing to give out. The theory is that sites would then automatically disclose what information they collect, and users' browsers could warn them about sites collecting or using information they do not want to share.

On Tuesday, Microsoft and the Electronic Frontier Foundation said they had developed a new "Privacy Wizard" that would make it easier for Web sites to develop machine-readable privacy statements, a development they hope will accelerate the adoption of the P3P standard.

Markey said he is a strong believer in such technologies, but that he does not believe these tools will be ubiquitously available and affordable enough to "solve the problem with technology alone."

"Personal privacy should not bend to the latest technology," he said. "But technology should be developed with privacy in mind."

He admitted, however, that this was an unrealistic expectation, "which is why we need rules."

Markey cited recent reports about products from Intel and Microsoft that have unique identifying numbers, allowing users' electronic activities to be tracked.

Markey said he remained undecided on whether his legislation would require companies collecting personal information to make that information available to individuals, so that people would be able to find out what information about themselves has been compiled in databases and whether the data is accurate.

The problem is whether or not such a provision would make it more difficult to pass the bill.

"I do believe that people do have an inherent right to access," Markey said. "But that may be a fight we can't win."

---

Related Sites
These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability.

• Representative Edward Markey

• Computers Freedom and Privacy Conference

• Federal Trade Commission

• Better Business Bureau

• Online Privacy Alliance

• Privacy Preferences Project

• World Wide Web Consortium

• Microsoft Corp.

• Electronic Frontier Foundation

---

Jeri Clausing at jeri@nytimes.com welcomes your comments and suggestions.

---