Briefly Series …

                          Briefly Series
                          Volume 5, Number 8
                          The Cyberlaw Series
                          Volume 1, Number 2
                          August 2001




   CONSUMER PRIVACY
        IN THE
ELECTRONIC MARKETPLACE



     PAULA J. BRUENING




     © 2001 National Legal Center
         for the Public Interest
            ISSN 1089-9820
          ISBN 0-937299-46-4
          ISBN 1-930742-13-4
         Published August 2001
                       CONSUMER PRIVACY IN THE ELECTRONIC MARKETPLACE

                                                                      by

                                                          Paula Bruening
                                              Center for Democracy and Technology

                                                 A Publication of the
                             National Legal Center for the Public Interest, Washington, D.C.


                                                                 SUMMARY

                  New opportunities have been created through the advent of the electronic marketplace.
            Businesses, as much as any other institutions in our country, can benefit through this new
            market located in cyberspace. Simply by having a web presence, a business is able to reach
            a market that was never possible before recent advances in technology. The Internet is a new
            frontier, but not one without challenges to those that want to harness its potential.

                  In recent surveys, consumers are expressing greater concern about their online privacy
            protections. For a large segment of the population, privacy concerns still keep many
            individuals from purchasing items over the Internet. Gaining consumer trust is crucial for
            the new electronic marketplace to succeed. When personally identifiable information is sold
            and exchanged like any other commodity, the public's concern seems justified.

                  However, personal data helps businesses target their markets and bring down costs.
            This results in lower prices for consumers. Products and services that an individual would
            have never known about can now easily be advertised to individuals. On the Internet,
            consumer profiles can become more sophisticated. Technologies, such as cookies, can
            monitor the buying habits of an individual by tracking websites visited. For many people,
            this is a scary proposition regardless of whether there is a benefit to businesses and
            consumers. The web is a new and somewhat strange "place" already for many consumers;
            hidden privacy risks, real or not, are a sure way to ensure stagnation of the electronic
            marketplace.

                  In this monograph, Paula Bruening of the Center for Democracy and Technology,
            provides readers a detailed explanation of the privacy challenges that businesses must
            address to succeed in e-business. What are current consumer attitudes? How can their
            trepidation be turned into a feeling of security? There are solutions that are being presented
            to increase consumer faith, from government intervention to self-regulatory mechanisms.
            What are these proposals and how do they differ? By becoming a privacy leader, according
            to Ms. Bruening, businesses can enhance their own financial interests. Recommendations
            are outlined that can help to create a proper balance between business interests and consumer
            protection. Major issues are explored such as the distinction between "opt-in" and "opt-out"
            policies as well as the need for clear privacy statements.

                  As with other National Legal Center publications, this monograph features an expert's
            view on a thought-provoking and critical issue to our nation. This concise monograph gives
            readers a practical understanding of the privacy issues that affect businesses and consumers
            in the dynamic electronic marketplace.




The National Legal Center for the Public Interest ·1000 16th Street, N.W., Washington, D.C. 20036 ·Tel: (202) 296-1683 · Fax: (202) 293-2118
                                                          info@nlcpi.org ·www.nlcpi.org
                     TABLE OF CONTENTS
PREFACE
ERNEST B. HUETER . . . . . . . . . . . . . . . . . . . . . . Inside Front Cover

CONSUMER PRIVACY IN THE
ELECTRONIC MARKETPLACE
PAULA J. BRUENING

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
THE NATURE OF E-COMMERCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
THE ECONOMIC VALUE OF PERSONAL INFORMATION . . . . . . . . . . . . . 4
CONSUMER REACTION--THE SURVEY DATA . . . . . . . . . . . . . . . . . . . 5
THE FOUNDATIONS OF PRIVACY PROTECTION:
FAIR INFORMATION PRACTICES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
    International Expression of Fair Information Practices:
      Guidelines of the Organization for Economic
      Cooperation and Development . . . . . . . . . . . . . . . . . . . . . . . . . 8
    Privacy Revisited: Fair Information Practices
      in the United States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
    U.S. Industry Implementation of Fair Information Practices:
      Privacy Protection Through Self-Regulation . . . . . . . . . . . . 10
INDUSTRY SELF-REGULATION INITIATIVES . . . . . . . . . . . . . . . . . . . . 12
    Direct Marketing Association . . . . . . . . . . . . . . . . . . . . . . . . . . 13
    Online Privacy Alliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
    Network Advertising Initiative . . . . . . . . . . . . . . . . . . . . . . . . . . 14
    Online Privacy Seal Programs . . . . . . . . . . . . . . . . . . . . . . . . . 15
         TRUSTe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
         BBBOnline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
         CPA WebTrust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
    The Evolving Role of Privacy Seal Programs . . . . . . . . . . . . . . 17
    The Debate About Self-Regulation . . . . . . . . . . . . . . . . . . . . . . 18
PRIVACY PROTECTION IN LAW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
    Derivation of a Right to Privacy . . . . . . . . . . . . . . . . . . . . . . . . 20
    Federal Legislative Protections for
      Private Sector Information . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
ACTIVITY AT THE FEDERAL AGENCY LEVEL . . . . . . . . . . . . . . . . . . . 26
    The Role of the Federal Trade Commission . . . . . . . . . . . . . . . 27
    FTC Web Privacy Surveys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27




                                                                                                   i
    Office of Management and Budget
      Chief Counselor for Privacy . . . . . . . . . . . . . . . . . . . . . . . . . .              28
PRIVACY-ENHANCING TECHNOLOGIES . . . . . . . . . . . . . . . . . . . . . . .                       29
    Cookie Cutters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .     29
    Anonymizers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .    29
    The Platform for Privacy Preferences--P3P . . . . . . . . . . . . . .                          30
    Child Protection Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . .            31
STEPS COMPANIES NEED TO TAKE . . . . . . . . . . . . . . . . . . . . . . . . . . .                 31
    Conduct an Internal Privacy Assessment . . . . . . . . . . . . . . . . .                       33
    Write and Post a Privacy Policy . . . . . . . . . . . . . . . . . . . . . . . .                33
    Appoint a Chief Privacy Officer . . . . . . . . . . . . . . . . . . . . . . . .                36
    Establish an Internal Privacy Awareness Program . . . . . . . . .                              36
    Build a Privacy Impact Assessment Process into
    Business and Product Development . . . . . . . . . . . . . . . . . . . . .                     37
    Participate in a Privacy Enforcement Seal Program . . . . . . . .                              38
    Implement a P3P Privacy Policy . . . . . . . . . . . . . . . . . . . . . . . .                 38
    Conduct Yearly Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .          39
    Consideration for Companies Whose Sites
    Are Visited by Children . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .          39
    Consideration for Companies Involved
    in Health Care Information . . . . . . . . . . . . . . . . . . . . . . . . . . . .             40
    Consideration for Companies Engaged in
    Business in Europe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .       41
CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   42

APPENDIX A:
THE EUROPEAN UNION PRIVACY DIRECTIVE . . . . . . . . . . . 43
APPENDIX B:
THE ONLINE PRIVACY ALLIANCE GUIDELINES
FOR ONLINE PRIVACY POLICIES . . . . . . . . . . . . . . . . . . . . . . . 45

ABOUT THE AUTHOR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

THE MISSION OF THE
NATIONAL LEGAL CENTER . . . . . . . . . . . . . Inside Back Cover




ii