Consumer Privacy Legislative and Regulatory Initiatives

Editor's Note: The February/March 1997 issue of the Bulletin of the American Society for Information Science included a special section on the topic, Personal Privacy. Since the preparation of that series of articles, Congress and several regulatory agencies have stepped up their activities in this realm. The following is an update.

The current year may well be the one in which official Washington seriously considers legislation and regulatory actions focusing on consumer privacy, online databases and locator services. The threat of an all-encompassing, privacy-oriented legislative effort is greater than it has ever been in the past. It is very possible that access to a variety of important and necessary information will be restricted.

On the congressional front, some members of Congress are considering wide-ranging legislation that would significantly restrict what information could be made available on online services. Though legislation has not been introduced to date, there are indications that an emphasis will be placed on prohibiting the use of public records, locator services and other information which some groups consider sensitive. There is also talk of requiring each company to secure an individual's permission before including any information about that individual in a locator or reference service, which would effectively outlaw or make impossible to produce many online databases.

On the regulatory side, the Federal Trade Commission is holding a series of workshops in June to further explore consumer privacy, the collection and storage of electronic data and access to online databases. The first session will examine the threat to consumers of computerized databases containing identifying information. The second session focuses on consumer online privacy, with an emphasis on the collection and storage of data from the Internet. The third session examines children's online privacy and data collected about children over the Internet. The FTC has asked for comments from individuals or organizations with knowledge of these issues. Copies of the questionnaire can be obtained by contacting the FTC in Washington, DC. Responses must be submitted by April 15. Upon completion of the workshops, the FTC will send a report of findings to Congress.

Finally, the Federal Reserve Board (FRB) is taking a hard look at privacy/database issues as well. The FRB was expected to release a report of its findings at the end of March and some expect it to include legislative recommendations for the industry.

FTC Announces Two Significant Efforts in its Comprehensive Examination of Consumer Privacy

In early March, the Federal Trade Commission announced two significant efforts in its examination of consumer privacy issues. First, the Commission announced that it will undertake a study of the collection, compilation, sale and use of data from computer databases, often referred to as "look-up services," that contain what consumers may consider sensitive identifying information. Second, the Commission announced a four-day public workshop on consumer privacy issues to be held June 10-13. The workshop will gather information for the new computer database study and also will update and review the industry's response to the issues raised in last year's workshop and the staff report, Consumer Privacy on the Global Information Infrastructure.

A notice describing the public workshop and requesting public comment in connection with the computer database study and online privacy issues will be published shortly in the Federal Register. Written comments and notifications of interest in participating in the workshop must be submitted on or before April 15.

Computer Database Study

The computer database study responds to concerns raised by the public and members of Congress about databases that are typically used to locate individuals or develop individual background information. These databases contain information that consumers may consider sensitive, such as Social Security numbers, current and prior addresses, and dates of birth. Some of these databases reportedly contain much more information, including an individual's physical characteristics, property holdings, and family members and neighbors. Customers of these services can simply input information (such as an individual's name and address) and then obtain a profile of the subject individual containing some or all of this identifying information. Database operators generally compile and sell this information without the subject individual's knowledge or consent.

The FTC study will examine the types of information that consumers consider sensitive, as well as their level of concern about the collection of and access to such information. The study will also evaluate the risks and benefits associated with using these databases. Finally, the study will explore consumers' privacy concerns regarding the collection and sale of their identifying information. The study will not address computer databases used primarily for direct marketing purposes, medical and student records, and the use of consumer credit reports for employment purposes.

Session One of the June workshop (June 10) will be devoted to the computer database study. Participants will discuss relevant issues, including the types of identifying information that consumers may consider sensitive; consumers' privacy concerns regarding the collection, compilation, sale and use of their identifying information; and the benefits and risks associated with the use of databases containing sensitive consumer identifying information.

Any person who wishes to apply for participation in this session of the workshop must file a written comment addressing one or more of the questions set out in the Federal Register under the heading, Session One: Computerized Databases Containing Sensitive Consumer Identifying Information. Commission staff will consider all written comments, including those of non-participants in Session One. The workshop, together with other information-gathering efforts of the Commission, will form the basis of a report to Congress.

Consumer Privacy Issues Posed by the Online Marketplace

As part of the Bureau of Consumer Protection's Privacy Initiative, Sessions Two (June 11-12) and Three (June 12-13) of the workshop are intended to update the Commission on current practices regarding collection and use of personal information online, including information collected from children, and on self-regulatory efforts and technological developments since June 1996. Session Two addresses the issues related to adults' personal information and Session Three to children's personal information.

In preparation for Sessions Two and Three of the workshop, the Commission's Federal Register notice asks questions on topics such as

Interested parties who wish to apply for participation in Session Two must file a written comment addressing one or more of the questions listed in the Federal Register notice under the heading, Session Two: Consumer Online Privacy. Those interested in applying for participation in Session Three must file a written comment addressing one or more of the questions listed in the Federal Register notice under the heading, Session Three: Children's Online Privacy.

Anyone may apply to participate in more than one workshop session. Notifications of interest must specify the session(s) in which participation is sought. Those requesting to be participants will be notified as soon as possible after May 15, if they have been selected to participate. Workshop sessions are open to parties not selected as participants, as well as to the general public. The workshop will be held in Room 432 of the Commission's headquarters building, Sixth Street & Pennsylvania Avenue, N.W., Washington, DC. The tentative schedule for the workshop sessions, as well as further instruction on how to file comments, is included in the Federal Register notice.

Copies of the notice, the December 1996 FTC staff report, titled Public Workshop on Consumer Privacy on the Global Information Infrastructure and transcripts of the June 1996 workshop are available on the Internet at the FTC's World Wide Web Site at http://www.ftc.gov (no period). FTC documents are also available from the FTC's Public Reference Branch, Room 130, 6th Street and Pennsylvania Avenue, N.W., Washington, DC 20580; 202/326-2222; TTY for the hearing impaired 202/326-2502. To find out the latest news as it is announced, call the FTC's NewsPhone recording at 202/326-2710.