On-line privacy: self-regulate or be regulated later - Industry Trend or Event

Communications News, June, 1999 by Harold III McGraw

Listen to any discussion of the economic potential of the Internet, and the numbers start flying. Billions. Trillions. It's enough to make any CEO's head spin. But dizzying as the numbers may be, the fact is that they all point in the same direction: electronic commerce, which totaled about $8 billion in 1998, will reach--by some very sound estimates--more than $327 billion in the U.S. by 2002 and four times that amount globally.

Change is coming and, without doubt, it's mostly on the upside. But any growth path that swift and steep is destined to transform the economic landscape, including the regulatory front. One dramatic transformation is the pressure building on the private sector to step up its self-regulatory efforts on the issue of on-line privacy. That pressure is building in Europe, in the United States, and throughout the global economy.

U.S. companies, my own and others, have enjoyed a significant competitive advantage in e-commerce business over the rest of the world, thanks in large part to an accommodating regulatory approach on the part of the U.S. government. This is particularly true when it comes to issues concerning on-line privacy, where U.S. organizations have been allowed to self-regulate privacy practices--an approach that is business- and innovation-friendly and that has given all of us an important edge.

This self-regulatory edge, however, could soon be in jeopardy--along with those stratospheric forecasts of e-commerce growth--unless those of us in the private sector manage to convince more of our corporate peers to adopt privacy policies.

This is true for any business that collects personal data on a Web site for any reason. It doesn't matter if it's for customer-service purposes, for registration, to conduct a sweepstakes, or to sell cars, books, computers, or groceries. If a company asks on-line customers for birthdates, credit card information--even the number of pets in a household--it needs to post and implement an effective privacy policy. And there are several reasons why companies need to do it now.

First, customers care deeply about personal privacy. A recent survey found that 60% of U.S. respondents listed privacy issues as the major reason they were uncomfortable doing business on line. Indeed, two out of three said they would leave a Web site if they were asked to provide personal information. Until consumers feel their privacy is secure, they are simply not going to do business on line, which puts a question mark alongside all of the enormous economic potential of the Internet.

Second, governments are manifesting growing concerns about on-line privacy. A report released by the U.S. Federal Trade Commission this past summer found that less than 14% of the 1,400 Web sites surveyed provided any kind of notice with respect to private information. When asked to grade industry's privacy protections so far, FTC Chairman Robert Pitofsky gave it an "incomplete," saying: "The final grade will not be in until we know that a large number of firms are in this tent with some excellent principles ..."

President Clinton has also released the first annual report of the Electronic Commerce Working Group, which points out that, while the U.S. has come a long way, more companies need to get involved and adopt privacy policies. The FTC seems to be signaling that it's willing to continue supporting self-regulation--for now. But industry must significantly step up its self-regulating efforts.

On-line privacy has also become an issue in the halls of the U.S. Congress. Before adjourning in 1998, Congress passed a children's on-line privacy bill; 80 other privacy bills were pending, and many have already reappeared this year. You can bet that more comprehensive legislation will come unless industry proves itself responsible.

Pressure to act on on-line privacy isn't limited to the U.S. government. Last October, the European Union (EU) implemented a strict new privacy directive, making it critical for U.S. negotiators to prove that our self-regulatory approach provides "adequate" privacy protection for EU citizens--both customers and employees--when data is being transferred to American companies. The Europeans seem willing to give us some time to make our case, but the clock is ticking. The electronic marketplace may be global, but different policies in different countries can effectively constitute an Electronic Curtain constraining e-commerce.

The bottom line is that private-sector companies need to put policies in place that explain to people exactly what information they are collecting on line, how they are planning to use it and give them an opportunity to review it, and opt out if they wish. Our company's experience has shown that once people understand what you are doing--or not doing--with their personal information, their comfort factor rises. Many other companies have found the same to be true. In fact, the average consumer opt-out rate when given a choice is less than 5%.

In a world where competitors are only one click of a cursor away, a sound privacy policy is not only beneficial to customers--it's good for business. If companies fail to grasp this, we risk not only alienating our customers but also inviting cumbersome new regulations and seriously curtailing the exchange of electronic information between overseas markets. If we do, however, take steps to develop and implement strong privacy policies, we give our customers, U.S. negotiators, Congress, and the global market real reason to believe we can be trusted. And we will unlock the trillion-dollar potential of e-commerce.