Consumer privacy legislative and regulatory initiatives

Bulletin of the American Society for Information Science, Apr/May 1997

Editor's Note: The February/March 1997 issue of the Bulletin of the American Society for Information Science included a special section on the topic, Personal Privacy. Since the preparation of that series of articles, Congress and several regulatory agencies have stepped up their activities in this realm. The following is an update.

The current year may well be the one in which official Washington seriously considers legislation and regulatory actions focusing on consumer privacy, online databases and locator services. The threat of an all-encompassing, privacy-oriented legislative effort is greater than it has ever been in the past. It is very possible that access to a variety of important and necessary information will be restricted.

On the congressional front, some members of Congress are considering wide-ranging legislation that would significantly restrict what information could be made available on online services. Though legislation has not been introduced to date, there are indications that an emphasis will be placed on prohibiting the use of public records, locator services and other information which some groups consider sensitive. There is also talk of requiring each company to secure an individual's permission before including any information about that individual in a locator or reference service, which would effectively outlaw or make impossible to produce many online databases.

On the regulatory side, the Federal Trade Commission is holding a series of workshops in June to further explore consumer privacy, the collection and storage of electronic data and access to online databases. The first session will examine the threat to consumers of computerized databases containing identifying information. The second session focuses on consumer online privacy, with an emphasis on the collection and storage of data from the Internet. The third session examines children's online privacy and data collected about children over the Internet. The FTC has asked for comments from individuals or organizations with knowledge of these issues. Copies of the questionnaire can be obtained by contacting the FTC in Washington, DC. Responses must be submitted by April 15. Upon completion of the workshops, the FTC will send a report of findings to Congress.

Finally, the Federal Reserve Board (FRB) is taking a hard look at privacy/database issues as well. The FRB was expected to release a report of its findings at the end of March and some expect it to include legislative recommendations for the industry. FTC Announces Two Significant Efforts in Its Comprehensive Examination of Consumer Privacy In early March, the Federal Trade Commission announced two significant efforts in its examination of consumer privacy issues. First, the Commission announced that it will undertake a study of the collection, compilation, sale and use of data from computer databases, often referred to as "lookup services," that contain what consumers may consider sensitive identifying information. Second, the Commission announced a four-day public workshop on consumer privacy issues to be held June 10-13. The workshop will gather information for the new computer database study and also will update and review the industry's response to the issues raised in last year's workshop and the staff report, Consumer Privacy on the Global Information Infrastructure.

A notice describing the public workshop and requesting public comment in connection with the computer database study and online privacy issues will be published shortly in the Federal Register. Written comments and notifications of interest in participating in the workshop must be submitted on or before April 15. Computer Database Study The computer database study responds to concerns raised by the public and members of Congress about databases that are typically used to locate individuals or develop individual background information. These databases contain information that consumers may consider sensitive, such as Social Security numbers, current and prior addresses, and dates of birth. Some of these databases reportedly contain much more information, including an individual's physical characteristics, property holdings, and family members and neighbors. Customers of these services can simply input information (such as an individual's name and address) and then obtain a profile of the subject individual containing some or all of this identifying information. Database operators generally compile and sell this information without the subject individual's knowledge or consent.

The FTC study will examine the types of information that consumers consider sensitive, as well as their level of concern about the collection of and access to such information. The study will also evaluate the risks and benefits associated with using these databases. Finally, the study will explore consumers' privacy concerns regarding the collection and sale of their identifying information. The study will not address computer databases used primarily for direct marketing purposes, medical and student records, and the use of consumer credit reports for employment purposes.