understand or have have heard rumors of legislation coming in the next few weeks and i look forward to that working with you on on legislation to improve the rights of privacy as i've stated before i believe in individuals information is their own personal property we as consumers should know what information is gathered about us where and how it is stored and protected and who has access to that stored information and most importantly for the context of this hearing with whom and for what purposes is that information shared but the fact of the matter is that information collection aggregation and sharing predates the internet by decades and yet most of us don't know the details of who has the information what information they have about us and where they obtained it the most critical point of concern for me is not necessarily the aggregation of this data offline but when that comparatively limited offline data is combined with more comprehensive data collected online i believe that that is the most important development because it will continue to grow in significance as e commerce and mobile commerce expand the flipside of my concern for privacy and the right to control my information is the recognition that this information sharing is good for business and i certainly do feel that i've do not feel that i've been harmed because a retail catalog appeared on my mail maybe the tenth one in one day yes i have an arm but but however we all know that collecting information can in certain contexts be used by criminals that have if that information is not respected and protected in general i believe the free market can and should be allowed to solve these types of issues as consumers become aware and demand certain protections practices and control options industry will respond in order to maintain those vital relationships thankfully the best actors do take privacy privacy seriously and they do provide options for consumers to block the sharing of their information for marketing purposes the problem for congress is similar to what we face on many issues and that is how to address the bad actors without overburdening the good by depressing or even eliminating productive and beneficial commercial activity that's the balance for which we should strive and i approach and in the approach that i'll continue to support i look forward to hearing from our witnesses today particularly our small business representatives alike i'd like to know exactly what information you collect with whom you share it and how you and your partners use that information i'd also like to hear all of your thoughts about how this can be addressed through industry self regulation and what if any steps congress may need to consider to ensure personal information in the use of that information  adequately protected and treated properly finally i'd like to know your thoughts on how the varying approaches to potential regulation of sharing we previously discussed and this committee such as first party third party approach or a primary personal approach would impact the world of small business we've seen in other contexts the consequences of acting too quickly without full investigation of potential consequences in this area that is so important to so many people i want to make sure that any policy decisions are based upon the fullest information available and will be fair to all businesses regardless of their size and corporate structure we all want to protect privacy and prevent harm but income but congress should not seek to solve the issue by choosing winners and losers that which not in riches him but makes me poor indeed now as we were growing up our doctors bankers nurses they were private keepers we knew that our medical record was locked up and that causes the nurse with the key to open it up to go in and get the records and it wasn't going to be shared with the neighborhood the same thing is true for all of our records but we have moved from an era now of privacy to one of private and data mining reapers who want to turn our information merge it becomes all the more possible to take this world on to into compromise the privacy of america and so this really goes to the heart of who we are we wouldn't let the government do this we wouldn't let the government gather all the information make it a product so we have to protect against businesses that think that we are all products off families are all products the members of our family are all information because that can help patients but we don't want that information to now be compromised is taken out of the file and put online we want the benefits the bloat of the patients but not for the information we turn to the product  profile that can then have everyone in town or everyone across the country knowing who had prostate cancer breast cancer in your family if you want to tell someone about it be able to do it but don't want to tell anyone about it world is really no different than the discussion that our grandparents and our parents had about the privacy and i think that the same values exist the technology should work for families and they should have the right to say no the knowledge and information is being gathered about them they notice that the information is going to be used for other purposes other than that which was originally intended and they should have the right to say no no i want the benefit of the technology but i don't want to turned into a examined how companies are using consumer internet behavior to tailor online advertising to simply identify the ways this kind of targeted advertising affects the consumer how does he or she benefit from this and i think most of the feeling that the consumer doesn't benefit doesn't benefit from this so in a sense this committee is here to hear more about the subject but also with the understanding to do no harm only the consumer knows how he or she feels about the information being collected the parties that are doing the collecting and of course a purpose for which the information is being collected for the question becomes does how much influence and how much regulation should congress be involved  with i don't think congress cannot and should not make the decision for the consumer the consumer should make that decision for themselves we as members of the committee certainly can play a proactive role ensuring that consumers have this adequate information and full range of tools at their disposal in order to simply make this informed choice whether it's opt in or opt out companies that collect information about consumers in both an offline and online manner obviously had to be good stewards of the information and should seek to protect that information where it's appropriate additionally all companies whether they be data brokers major retail companies or even small businesses should operate in a transparent manner and fair manner when it comes to the information they collect about consumers or consumers or consumers or how that information is subsequently being used their real transparency i guess is a question of how robust a disclosure and notice to the consumer is required in their privacy policy they obviously should be presented in a clear conspicuous manner so consumer knows should be indicating was being collected the ways the information is being used and the ways a consumer can print prevent the collection of that information they don't want to do it this is a very significant challenge having had many hearings on privacy and understand the constitution  opt out provision and i come to believe that for the most part that if we get into too much of the we here that we're going to impede the internet and make it more difficult for people to collect information  probably not necessary in fact at one time the federal trade commission i talked about a good housekeeping seal that would be provided by private companies that in a sense would be a seal of approval so that people when they went on the website would realize this already complies with a good housekeeping seal that has been approved by the federal trade commission so that they would have the confidence right there without going through the rigor more or looking at an opt in opt out provision and reading the detail fine print in the privacy policy the small businesses countries create all the jobs and a lot of internet companies are starting up and obviously we would want to and their ability to function so this internet is such a powerful means of communication and putting in a significant privacy policy is very important and has a great effect either helping enhancing or deterring shall we say the purchase of products the use of it so i think this is a very important hearing to hear from the people that are most involved and i look forward to hearing from them and i hearing some of the pitfalls of sort of what we have is a draft policy draft bill that mr boucher and mr rush and i am mister others have put together and so we're looking forward to perhaps after this hearing to get this draft bill out so know what is exactly contained in it no ability to edit that profile like they would their credit report but their records maintain on the databases are unregulated and often maintain more and wider ranging information and a credit for the information is not used for products or services that fall under the fair credit reporting information about transactions behaviors and online offline and occur offline are also becoming more prevalent in these records that can be purchased from companies that sell the handed disrupted or destroyed by aggressive legislation in this area you know back in my time brothers created the retail credit company to track the credit worthiness of atlanta grocery and retail customers some people know that company now is equifax six since then the cost of storing and manipulating information is falling sharply and now we're going to capture increasing amounts of data about individual behavior consumers hunger for personalization products services websites that cater that causes them to reveal information about themselves ordering off a catalog reveals other information using a credit card and thinking you have to send in that warranty card can reveal almost your entire life to other parties but that information probably delivers better product more targeted services and a more enjoyable internet experience as alexandro of carnegie mellon writes is there a combination of economic incentive and technological solutions the privacy issues that is acceptable for the individual and beneficial to society in other words is there a sweet spot that satisfies the interest of all parties and then what are the rules of the road that we need to put in place to make sure that consumers privacy is protected and that commerce flourishes that's what i hope to learn more about  today's hearing i want to credit the work dozens of dedicated faculty and students working on consumers that a privacy at carnegie mellon university located in the heart of my district don cmu the data privacy lab and file lab have all chairman russian boucher i want to thank you in ranking members read out of a chance turns for having this hearing on the collection and use of personal information please that both subcommittees are examining this issue i know that congress and this committee have held hearings on privacy in the past but as we all know consumers personal information is being collected more and more every day often without their knowledge through both online and offline modes of commerce whether they're participating in a survey using facebook or even ordering a product over the phone given the importance of information in today's economy and given how often consumers give out their personal information there is a genuine cause for concern therefore we must continue to examine ways to ensure consumers don't have their personal information compromised or misused as one pointed out in our last joint hearing many internet companies are offering the ability to opt in or opt out of the company's policies to use or share personal information they collect but those policies often do not address the collection of the data collection and use of personal information can help companies better serve company's customer market products to certain consumers and verify consumers identity but the potential for danger does exist personal information could easily be compromised and there are bad actors that use consumers personal information in ways that take advantage of the consumer and in some cases in ways that are illegal consequentially there are issues that we must address as we take those into consideration and debate the best steps moving forward i hope we proceed carefully when drafting legislation in this area as i stated at the previous hearing on behavioral advertising i hope the focus of today's hearing is how we can protect consumers and their personal information and what steps the industry will take on their own to do that i hope today's hearing does not focus on ways government can get more involved in areas of people's lives where it does not belong for this reason i believe that if self regulation is not sufficient and if any privacy regulatory requirements are needed they should be targeted consistent and not be greater for one business or industry than they are for another congress should not pick winners and losers i look forward to hearing the comments of our panelists today particularly on the collection of data through offline methods and how companies are using this data i also hope to hear about current security measures that companies have in place and any they may be planning to implement in the future to ensure the protection of personal information it's important that these committees understand their position positions and activities as i'd like to also thank our panel s for being with us this afternoon today will be examining the collection of commercial use of consumer information across the offline online and mobile marketplaces without their knowledge or approval consumers person information  being collected where they conduct daily activities such as using the internet shopping at the grocery store or even order takeout from the local beverage favorite restaurants and that's just to name a few in today's economy information is everywhere and to everyone unfortunately it is essentially impossible to protect one's personal information these days and it is understandable that most americans simply do not trust that their personal information is properly protected privacy policies and disclosures should be clear and transparent so consumers can choose what information if any they want others to know instead of inappropriate collection and misuse of that information consumers should also understand the scope of information that is being collected what it is being used for the length of time is being retained and its security the more information that consumers have the better moving forward we must ensure that americans feel secure that their personal freedom ation will not be misused the next time they surf the internet shop at a grocery store or a carry out more restaurant meaningful privacy safeguards should be in place while making move thank you mr chairman and welcome to our witnesses we're glad you are here and i am pleased that we're having this hearing today nearly everything that we do on the internet is monitored and one of the things that we need to do is make certain that there is an understanding of what the level of privacy is and what those expectations are and to make certain that we put some good rules of the road in place of the same time we don't want to stifle the engines of internet commerce in e commerce that have been an absolutely wonderful economic driver specially for many small businesses and in areas like mine all the area from  nashville where we have so many small businesses that do depend on those e commerce for man to make certain that they are profitable and now my constituents in tennessee have raised with me the issue  there does seem to be an alarming trend in which ads from some well known brands are consistently appearing on sites that traffic illegal content such as pirated movies and music and these sites are often located outside the u s and may be linked to broader criminal enterprises that clearly have no regard for the privacy of others they are very concerned about this and they want to make certain that that is an issue that is addressed as we move forward in this debate they're also concerned about rules as we look at privacy something that about congress getting in the business of dictating what data is acceptable or unacceptable and distorting how that travels up and down the pipe so we need to be responsible looking for responsible solutions that are going to both protect consumers and empower consumers to have control over their data and allow businesses to continue with their e commerce format so welcome look forward to hearing  the gentleman from maryland mr sarbanes is recognized for five minutes i waved away my opening well thank you i commend the chairman rush and chairman belcher for convening this fascinating and important hearing as technology develops the opportunity for abuse i believe is going to grow exponentially and consequently policy does need to keep pace to ensure that consumers are protected a couple things i'd like to learn this morning first of all i'd like to get idea of the scope of the potential problems how is this data going to be able to  used to affect our lives and secondly i'd like to understand what makes sense in terms of how data access and data use can and should be restricted and i want to thank you all  represent the organizations that collect data and use data so you're on the front lines and with that i'll yield back thank you very much the gentleman from ohio mr space is recognized for two minutes thank you chairman boucher let's thank chairman russian ranking members radanovich and stearns for computer convening our subcommittees today to discuss online and offline collection and use of consumer information i was struck in reviewing our witness's testimony that there seems to be limitless sources for information on consumers bickley available data data volunteered by customers and data collected from company customer facing businesses taken individually each of these data sets provides a partial picture of a consumer however when these data sets are combined retailers and data brokers can cobble together a fairly complete customer profile and i find this fascinating i certainly understand the benefits that  and to the extent that customer profiling can embrace or enhance commerce i believe such data gathering is an important tool however as outlined by our witnesses there are also some concerning possibilities bo regarding the abuse of this information it seems like common sense that there should be some protections built in to shield mentally ill citizens for example from repeated unsolicited targeting marketing the bottom line is a consumer data sets compiled from information gathered online and offline and the handling of such data remain largely on regulated this strikes me as being the wild west of e commerce so that we have some critical interests to consider and i welcome the continued discussion on this issue i look forward to working on this matter with my colleagues and i yield back thank you mr chairman thank you very much mr space the gentleman from connecticut mr murphy is recognized for two minutes thank you mr chairman thank you for the hearings our chairman and our ranking members certainly i think as we spend more time online this issue of what data is being collected  about each of us is increasingly critical and i think we can all agree that most consumers would prefer to have a clear understanding of what information is being collected and how it's being used but to some degree i also believe these consumers if they think that the data collection is  obtrusive inoffensive and if it's being used i think this point is important if it's being used to give them information or opportunities that are relevant to them that are cater to their interests i think a lot of folks will take lesser offense to that type of data collection certainly does all predicated on a system that consumers can trust and verify beyond this i'm interested today and hope witnesses might elaborate on this how the information that we're talking about today is being used to direct consumers to or advertise on sites that might engage in the pirating of legal content as we know there are a vast number of sites available to users whose business model is developed on providing pirate content individuals sometimes for a price and sometimes because they're supported by ad revenue for free in combating piracy it seems that we should look at how information derived from consumers is then being used to place advertisements or direct individuals to places where we know illegal activity is occurring i hope to explore this issue in greater detail look forward to testimony and listening to questions i think chairman you'll back thank you very much mr murphy the gentleman from georgia mr barrow is recognized for two minutes i thank the chair i want to welcome all the witnesses today i especially want to welcome day discussed the issue of online and offline data collection and the commercial use as it were information for the purpose of living targeted advertising i have no doubt that sharing consumer information offers benefits all of those benefits pretty much kill sales at least somebody can sell them it's the costs that i'm worried about as information brokerage continues to expand becomes more important than ever that we draw the line between enhanced data collection methods on the one hand and unwarranted breach of personal privacy on the other in september this committee was able to mark up h r thirteen one teen the informed peer to peer user act which i co sponsored with congress in one bono mack that bill tackles the privacy and security risks that come with peer to peer file sharing programs i see the work that we're doing here today is a continuation of that effort to protect personal privacy without discouraging market and technological innovation i want to thank chairman rush and value for their leadership  addressing this issue with that i yield back the balance of my time thank you very much mr barrow members having had an opportunity now to make opening statements we turn to our panel of witnesses and i would like to welcome each of you here this afternoon and thank you for taking the time to share your views on the subject of great interest to all of us here just a brief word of introduction about each of our witnesses mister chris  is the director of information privacy programs at the university of california berkeley school of law mr george pappa chinned is the chief privacy officer your internet marketing manager for learning resources dot com and educational insights dot com pat dixon is the executive director of the world privacy forum without objection each of your prepared written statements will be made a part of our record of proceedings today and we would welcome your oral summaries and the interest of time because we're not sure when we're going to have recorded votes that may command our presence on the floor for an extended pulled that microphone fairly close and be sure to turn it on thank you chairman boucher and ranking members radanovich and honorable member members of the committee thank you for holding this hearing today on an often overlooked issue in consumer protection while we have debated online privacy issues for the past decade little attention has been focused on how business collect information collected in offline contacts for instance at stores at the point of sale through surveys sweepstakes catalogs sales and the like i first approached this issue from a civil liberties perspective about six years ago i started highlighting the relationships between offline marketing companies and the government as mr mark noted in his opening statement he said that americans would never allow the government to collect so much information about however i found that many government agencies had simply outsourced their information collection activities on citizens by hiring marketing companies offline marketing companies had data on almost every american adult and they had created techniques to analyze the data that could be adopted to law enforcement intelligence  more recently my work has focused upon consumer protection and the offline marketplace for some time i tried to call attention to the sale of personal information about consumers among companies i would find data cards which are personal information difficult to read on the screen but it is included as appendix two in my testimony the marketplace has greatly outpaced legislative and regulatory interventions protect consumer privacy for instance in california legislators acted quickly to block phone companies from creating a wireless for one database this would be a service to look up cell phone numbers however in focusing upon phone companies california legislators missed the mark several data companies with no consumer relationship whatsoever now market cell phone databases and other databases that list unlisted in private phone numbers appendix two of my testimony gives an example of one that's collected through the phone numbers that are given when you order pizza and this is my second exhibit this is an information service that claims to get unlisted telephone numbers by collecting them from pizza delivery companies this brings me to a central point of my testimony today american privacy law allows most offline businesses to sell customer data without giving the consumer notice or an opportunity to object  my public opinion research at u c berkeley has focused upon whether consumers understand this the findings are clear americans falsely believe that they enjoy a right of confidentiality with most businesses this is why they do not ask for privacy policies at the register or opt out to information collection incorrectly assume that privacy law prohibits the use of their personal information americans don't understand that the burden is upon them to object to the lack of a legal framework that governs information collection and leads to practices that americans would object they knew about them i detail too in my written testimony first data companies confidentiality agreements to keep information sharing secret this means that if an advertiser wants to buy personal information about a group of people the seller of the data binds the advertiser to confidentiality database companies prohibit their clients from telling customers how they work wired what data were acquired and what categories the consumer has this means that if you go to a business and ask how did you get my information the advertiser is contractually required to say we cannot tell you this is part of a larger strategy that leaves consumers in the dark about information selling practices second in the offline context and increasingly in the online world companies are using enhanced this is the practice of buying additional data about existing consumers so for instance have you ever been in a store and the cashier the cashier ask you what your phone number is if you share your phone number that gives that retailer the ability to reverse look up your name and home address some of these problems could be solved with what i call data provenance the ability to determine from where data was collected in the rules and context govern collection since i have just ten seconds left i'd like to thank the committee again for holding this hearing and i look forward to your questions thank you very much marketplace with products and services to be responsive to consumer needs attitudes and behaviors at the heart of our business model as you can appreciate catering to consumer preferences on a continuous basis is simply not possible without the ability to collect or have access to reliable data and actionable insights the dialogue taking place it is important not only for the purpose of awareness and understanding of industry practices but also to grant perspective on our shared respect for consumers getting it right with regard to interaction consumers is an essential element of business success for us our brands and the client brands that we represent have spent decades building trust with consumers and within the marketplace i involved in today's really a continuation of that capital investment is one of the world's largest inside information consultancy networks covering eighty countries and across the whole spectrum of research and counsel consultancy discipline we offer clients insights at each and every point of the consumer or customer cycle our services are employed by majority of fortune five hundred companies domestic and foreign governmental entities at all levels and almost every kind of brand that seeks to communicate to have a relationship with consumers conduct market research media measurement which essentially means for example how many knowing measuring how many people watch t v versus watch mobile t v has watched t v online and we have consulting and specialty services that run the spectrum from brand value to retail to health care to government service management w p p is the world's leading communication services group operating companies a group provides a comprehensive range of advertising marketing services past due to audiences being more fragmented across the range of media platforms and devices and challenging also because of media convergence the idea that although people are using different devices to access content or to communicate these platforms can be interlinked or overlap because of unifying digital language simply put whereas consumers were confined to a limited number of channels broadcast over a handful of distinct platforms such as v new media is allowed a political challenge choice staying ahead of these markets that we continue to deliver best in class services trust us with their investment in advertising and marketing is a matter of high priority for us consistent with that is our commitment to provide consumers with brad experiences that are relevant responsible as noted earlier cancer provides market research services and they use a variety of methods to accomplish this objective market research is the voice of the consumer  or the citizen or the donor as you can surmise market research fuels a variety of commercial and governmental it services research methods of data collection certainly there are parts of the world where data collection is primarily done offline via telephone interviews intercepts surveys paper diaries etc however in the u s in particular much of research is now conducted online online pal sometimes dedicated to single sectors such as health care web intercept service where consumers are invited in real platforms permit greater customization for the user and better measurement for the content or service provider i would agree with that from an aspirational inherent capability perspective the promise of customization and improved measurement measurement is is encouraging i believe the medium is still maturing and still only on its way to fulfilling potential the federal trade commission released its staff report on online behavioral advertising and this summer coalition of industry tra associations which included the interactive advertising for several others and various businesses they put forward a self regulatory framework to address the issues raised by congressional power companies like twenty four seven real media and team to develop and test tools to a tool which provide enhanced notice and greater transparency about online tracking we have sought to collaborate with technology firms and others who would introduce real solutions for implementing the full elements of the self regulatory framework while behavioral advertising is one way to build a more customized user experience there are so many other innovations the web enables and some of them employ designs that don't necessarily require tracking behavior activity across multiple site good afternoon thank you chairman rush and thank you for inviting wal mart to participate in today's hearing on online and offline privacy my name is always strickland and i am the wal mart chief privacy officer for us good privacy is good business as the largest retailer and private employer in the u s with approximately one hundred forty million customers shopping in our u s stores every week wal mart considers an array of privacy issues on a daily basis unlike companies that interact with customers or other businesses primarily online wal mart approaches privacy from a very broad perspective wal mart operations cover almost every conceivable privacy topic channel and geographical region given the depth and breadth of wal mart's understanding of consumer privacy issues we appreciate the committee including wal mart in today's discussion and would encourage you to engage other similarly situated companies it is imperative that as privacy rules are developed legislators take the time to fully understand the impact on consumers that have both online and offline relationships with company wal mart supports a principle based approach to privacy rather than a focus on one particular technology or tech activity as an example of a principle based approach this summer we updated our customer privacy policy for wal mart operations the updated policies based on the fair information practice principle as well as industry standards and global guidelines our goal was to make it transparent meet best practices and to be integrated across all businesses to further increase transparency we included a summary notice that links through to the detailed policy the new privacy policy provides customers more control over their data some examples are creating a preference center that allows customers to tell us directly their preferences regarding direct marketing and data sharing for marketing purposes stablish ing a stricter standard for data usage customers typically consider more sensitive wal mart uses opt in for telemarketing and data sharing providing additional or enhanced opt out mechanisms such as for email ratings and online behavioral advertising giving customers greater access to their own information and finally providing more options with questions and concerns this initiative gave us further insights into how to focus on underlying privacy principles and then to operationalize them with regard to online behavioral advertising while more provides clear notice is an opt out consistent with the regulatory principle as well as industry best practice equally important in our view we integrated our approach into our larger view of privacy in both the online and offline world when and how is it appropriate to give notice when and how should consumer choice be offered we do believe notice and choice are still central privacy protections even a further protections are warranted we think our experiences with the use of electronic product code technology is a useful example that demonstrates how a broader principle based approach is appropriate and needed at the simplest level is the next generation barcode currently is primarily used to track certain case and pallet supply chain when a p c may be offered an individual products on the sales floor future potential customer say we believe that choice is absolute the right model for this technology some perhaps most consumers will appreciate it benefit someone but ultimately co consumers should be able to choose which they prefer the challenge of course is how to provide appropriate notice this covers have consumers know this technology is an operation and also know what this technology actually means a variety of methods and channels are possible including notices on products  notices on or in facilities and web site information you can see how a debate that focuses solely on notices provided on websites like pop up would miss the boat for this technology in conclusion wal mart interaction consumers frequently and every conceivable way a uniform or at least consistent privacy framework that includes standards such as consumer choice is effective for both consumers and businesses a privacy regime based on a set of core principles will be sufficiently flexible to be applied in multiple contexts consumers deserve to know what to expect in regard to how their information is being collected and where they may have taken further details that they desire and how they can make appropriate choices regarding the use of their data or technology thank you again for the opportunity to testify today we look forward to continuing to work with you and i'm glad to answer any question thank you very much  thank you mr chairman and members of the subcommittee my name is michelle who's the senior internet marketing manager of learning resources incorporated into hills illinois a small business manufacturer and distributor of classroom materials and educational toys both the business of business and business the consumer maintaining an extensive website and e commerce store as well as undertaking active direct mail program for schools teachers and consumers in our business the protection of consumer information is paramount we have long maintained a detailed privacy policy which is posted prominently on our website our commitment to the protection of consumer privacy is voluntary but is also required in the marketplace self regulation by industry and market standards works the fish effectively and i urge you to be cautious in regulating the use of consumer data to invoice unintended consequences that might put small businesses at a permanent market disadvantage by preventing us from using technology to grow and expand in the last twelve years i have worked with literally dozens of companies in various capacities relating to the use of consumer data in my experience industry voluntary privacy standards have been universally adopted and our regular element of any commercial transaction online or offline privacy is a routine and fundamental part of good business practices involving the sharing and use of consumer data today industry voluntary privacy standards were developed to meet consumer expectations and to match best practices from traditional direct mail companies who do not participate and self regulatory practices such as protecting consumers financial information or fail to follow opt out instructions are blacklisted by consumers as we all come to understand the consumer is now more powerful on line consumers use the power of social media to warn others about websites that offend or use bad practices consumers will likewise use the same tools to promote businesses that use best practices it is important to recognize the collection and use of consumer data is essential to improving the consumer experience on line cookies and other tracking means were developed to make it possible to make good product and service offers that match consumer needs this if it's a kid information gathering process has to create a three hundred billion dollar industry and one point two million jobs we must be careful not to endanger this major source of jobs and enhance consumer choice consumers can control the collection of consumer data and many important ways many companies like ours offer the right to opt out for consumers and choose to not participate in our marketing activities opt out options are far superior to opt in options both from the standpoint of businesses and consumers businesses for opt out because they believe that if you consumers will ever opt your alone discourages most people from opting in consumers have already experienced an online world filled with in the early days of the internet feature cautious approaches by websites with many opt in choices consumers were prompted to accept web site terms before entering a practice that turned off many consumers at the early on line experience mood at a glacial pace bowling the online purchase process for customers and lowering revenues for businesses consumers have a ways to control the collection of data internet browser software can notify consumers of cookies active x controls or other means of data collection in order to maximize the speed of pleasure of their online experiences many consumers turn off these warnings against consumers and businesses are making these privacy options and choices without the need for federal regulation we believe that regulation of consumer data may sharply curtailed our ability to grow both online and offline small businesses don't generate enough leads to keep customer lists fresh and growing we must have access to market data to find new customers likewise consumers need us to promote our products and services because without this marketing small businesses are just too hard to find in our ability to collect and use this data we are vulnerable to large businesses gaining in effect a monopoly on consumer identities and preferences large businesses with high web traffic or many store fronts as a means to generate and use consumer data for prospects to remain dominant small businesses will lose this game every time i urge you to be cautious and to carefully avoid unintended consequences the internet is a huge job creator and one of the great drivers of today's complex and rapidly evolving tanami a one size fits all solution is very dangerous an economy of this complexity we believe the new legislation should take a crawl walk run approach focusing on the most sensitive data such as financial information or health care data and relying and opt out mandates for commerce by taking such a prudent approach congress can ensure that small businesses do not find themselves in a permanent federal mandated market disadvantage thank you for considering my views on this subject i'm happy to answer any questions thank you very much thank you but to thank the chairman for inviting me here today i'm pam dixon i'm executive director of the world privacy forum for a nonprofit public interest research group based in california we focus on in depth research of privacy issues the online and offline collection of information from consumers matters because it impacts our lives whether we know it or not in the past consumers have been told you better watch out because you've got to act a certain way because something might go on your permanent record we heard this in school when we were young but today because of the large commercial databases and those activities related to those commercial databases we have a new kind of permanent record i call this the modern permanent record this is a permanent record compiled from rich online and offline resources and it can be used to deny or offer benefit services and goods and information to consumers what i'd like to do is talk about how these commercial databases can be used to create a very detailed picture of a consumer and what that picture can do to a consumer's life and to do that i'd like to walk you through how the modern permanent record is created and used so first one source for the modern permanent record  marketing lists in databases these are typically source from highly identifiable data we're not talking about to thomas data residing on a hard drive somewhere we're really talking about data where someone knows your name if you can look at the monitor you'll see a list of twenty million consumers this is an element list and it's a data card that's being sold on consumers it lists detailed demographic information and also with the various diseases that they have  the company says these people marketing to them is they're extremely receptive to any campaign from various mental problems and the real impact of these kinds of lists that are so on regulated  is being seen already today it's not theoretical so for example one ninety one year old elderly that was profiled in the new york times he landed on one such list and what happened is he filled out a sweepstakes form and he landed on a telemarketing list it was sold as a result of purchasing the list he was built with his life savings and this gentleman once he was on the list he had no effective right to remove himself from the list mitigate those issues another way that the modern permanent record is created through what i call non fair credit reporting act databases or noncredit databases or databases that have rich the bad customer's database and we have a screenshot of that website that website says are your purchasing transactions being denied find out if you've been blacklisted before it's too late this database has six million consumers on it right now and it's only been in existence for about a month and the way consumers land on this database is that charges to their credit account now if that sounds familiar it's because identity theft were a victim of fraud or because you were about actor this is a very difficult thing the third way that the modern permanent record is compiled and created through a type of a newer type of database behavioral a databases these are the databases that put the three d into the consumer they provide the real detailed picture of the consumer and put flesh on the bones of the consumer an example of this is tracking cameras in retail stores these cameras are not visible to consumers what they do is they track basically the number of tumors that have walked by certain points in the store also identify what a consumer is looking at and for how long but what happened at least in the past year is that this type of technology has been also combined with facial recognition technology so what happens is that the consumer walking down the store captured by the  camera is also recognized and then marketed to now that's a practice that the news today everything that i have told you is in use today and it's not the radical so the question this committee has to face is is it worth the risk involved to consumers when you have these large aggregated pictures of complete consumers that can define their lives is it worth that risk to leave them unregulated and i would argue that the modern permanent record and the substantive rules of the road that govern how the modern permanent record that we're really creating a situation where they're going to be corrected and pile up as consumers become more aware of the threat of how a modern permanent record can potentially be used in their lives i think we really enter a situation where commerce and really chill people's lives and inhibit them a good example of this can be found through cox communications they offer a digital telephone service that digital telephone service detailed analysis and what it does is it analyzes the numbers of the phone numbers that you call and who calls you well there's nothing wrong with that but what if you're a family member who's a deadbeat what if you're a friend who's a deadbeat what inference is drawn on you based on those phone calls what does that do to your permanent record your modern protections should we apply those both with regard to online and offline transactions yes i believe you should because the collection of data is highly identifiable and i biometric information name health information and other information that is entirely on regulate really restrict our ability to process with web searches and things like that so you're not saying apply online only you're just saying be careful about how your flawed to be very careful because the unintended consequences of what happened thank you mister yes what does favor principle based approach doesn't focus on one particular technology and i think it's very hard to draw a line that clearly separate online from offline a lot of carefully observed but a broader application is correct mr who's michael i think the answer depends offline data collection is a little different microphone closer please i my answer would be it depends it depends on the subset of protections built in seville and whether they are appropriate in the offline context all right mr hufnagel let me pose my second question to you you have performed and we're aware of your study that as i understand it finds that two thirds of the american public does not favor the receipt by them of tailored advertising as and given the benefits of tailored advertising that many on our panel have stressed here today what do you think we might be able to do that could change that number and persuade more people that not only is it not harmful but perhaps even beneficial to the receipt of that advertising to receive it that's a great question mr chairman and the microphone closer please we were surprised by the answer that so many americans said that they principally reject tailored advertising and troubled by that result because it's clear that tailored advertising does have it vantages for consumers and for businesses but we think also that consumers might have a lot of anxiety around information collection they might not want information collection in one context follow them into another so for instance the targeted ads that you get at home when you're using internet for personal purposes might consumers might not want that the bleed over to how to use a computer in a workspace i think that if there is greater transparency and rules around data collection it might change that number more people so let me just cite an example let's suppose that we adopt a law that says that any entity that collects information from a customer whether that collection be online or offline provide to the customer a thorough description of what information is collected a thorough description of how that information is used and then provide that ability through a series of opt in and opt out arrangements depending on what the information is and how it's used for that customer to be able to control the use or perhaps control the collection of the information itself if we provide that consumer guarantees what do you think that might do to persuade more people that having information collected for the purpose of tailored advertising is perhaps advantageous to them or at a minimum have them be willing to acquiesce and that is an interesting approach i would point out that our survey shows that people already assume that there are opt in standards in place americans assume that they have a right of confidentiality in the marketplace so they're making that assumption even when two thirds of them say they don't want to tailored advertising that's right and they're and if they knew that they really didn't have even the measure of control they think they do that two thirds number might even be higher i think that consumers have a lot of anxiety in this area and that might be one of the reasons why they're expressing that level of objection my collaborator and i joseph turow at the university of pennsylvania argued that notice an opt out might not be the most optimal approach because consumers do not read privacy we simply said that the right answer is not just to go to opt in we discussed the idea of there being mandatory retention ceiling so that information would have to be deleted after a certain after a certain period of time and that would allow targeted advertising but it wouldn't profile let's suppose just for the sake of this question that we do those things and that we have retention limits full disclosure a set of opt in opt out opportunities to control what happens do you think that instills a greater amount of confidence in the american public that the online experience is secure and to the extent that they're engaging in offline transactions that they have more control over their earlier in my opening testimony i talked about one point you know people about the delivery of a catalog to your doorstep and i expounded on a little bit extemporaneously because i remember in the past where the holidays would come around or an event would happen in my family and all of sudden you don't have one magazine or a catalog you've got ten or fifteen credibly frustrating and and what was more frustrating was a hassle it was to get these people to shut it down because i didn't want to and i just didn't and i don't that my following question will not speak to the issue of declaring a private data but it does speak to the issue of a person's ability to control what happens in their home and and so i want to ask each member of the panel you know i don't want to interrupt free commerce and trade and as long as the boundaries are proper i think it's good but i'm all for in in a number of ways making sure that a family's home to be politically correct is its castle and that the people in their homes have as much to provide people with really a lot of ease in their households to be able to shut this stuff down if they want to i mean i got to think if i was the father of a new child i may or may not appreciate the fact that i got one hundred catalogs in there on how to buy a baby crib and want to shut it down but if i shut it down i might think oh gosh maybe i do want that information i'd like to see that control in the home has anybody given any thought to how you can shut that down or ways to make it easier problem is that it's just a good companies that are following the rules that typically join self regulatory and they're always the ones who you know you call and they stop sending the catalog it's the bad actor and that's why i think that a broader approach could be very useful in really curtail regulatory approach and i think that one of the things to look at is looking at some data right that are not identical to the fair credit reporting out because it would be  complex to do but looking at that what can we learn from that statute and apply to this area is there a way that consumers could have a regular standardized way of finding out what list they're on and seeing that information making sure it's accurate that it's not retained for the duration of their lives and so on and so forth i think that that approach would require a lot of discussion and very serious thought but has merit it's if it's not one size fits all away but i believe by allowing voluntary privacy standards with marketing and we focus on the regulations of financial and medical that it's going to be more advantageous for small business and allow technology debate we're having about online and offline as well so as we think about what appropriate notices that will be different on a website as you might imagine in a store you're not going to have the ability to have the depth and level of information in a store notice necessarily you i understand your company has roughly fifteen hundred pieces of data on every american so i'm a male i live in pittsburgh  fifty six years old that's three data points three pieces of information about me that means there's roughly fourteen hundred ninety seven data points left so just between you and me  dixon and mr hoffman it's clear that vast amounts of personal information about individual consumers are collected aggregated analyzed and sold for a variety of commercial purposes in response some people say so what if a person likes  but is mistakenly identified in a database as an angler and receives offers or coupons for phishing appointment what's the harm recommended in her written testimony that before we engage in additional regulation we should  question that there are benefits i don't think anyone's arguing about the benefits we know there are benefits the problem is that there are indeed also harm so for example if the shadow side of of all of this the same information  used for completely different purposes once the information is compiled you really lose the ability to determine how that information will be used and all contact in less is covered under the fair credit reporting act but what we've been talking about have these very clear pictures of consumers you really do get locked into a bit of a pictorial box here's what consumer x or y looks like here's how we're going to treat this consumer we're all familiar with a situation where people were not allowed to vote  they landed in certain databases some of this information was incorrect so we're talking about substantive rights that can be impacted here so if the picture of the consumer is the right if it's not how do we correct that  they will go out and get your home address why not just ask the consumer can we have your home address the fact that so much of the data collection occurs and i think speaks to the harm issue thank you very much my time is long since expired and i'm going to yield now to my good friend from florida thank you mr chairman i just compliment you on your rapid fire questions you've got a lot of questions and i'm impressed and went to the g mail to do my job deleted all because the same thing happened there so that's a whole lot of cookies that i don't know what's going on and this is for george in your testimony you mention the use of passive tracking certain ad you tell that from the cookie that i was exposed to and it yes you can tell which when i get an ad on drudge for a car for a book that's based upon my previous search engines on drugs or google and so you get from those cookies you read those cookies and say ok stearns went to amazon dot com he went to these sites and these sites you find that all out right you wouldn't be as far as  going to search or there might be some categories where you might not have availability to track or know what the consumer engagement was but there are larger scale there is the practice of tracking exposure to advertising so that you're not burdened with excessive advertising of the same kind and you sell this to the advertisers to tell them this is how effective you are not right so the idea is to  understand how they performed whether you were being relevant or not similar to how we would do with t v or in other forms as a customer do you make the customers aware of this and other words let's say you're doing us on me what i find that if you're doing it and what you're doing sure  one thing we've been actively encouraging and working on is proactive privacy the privacy icon project that we were involved in is about allowing for a  enhanced notice to that then gives them discipline not now doing it it's a self regulatory initiative that's underway we are definitely doing the best standards of best practices of informing about our practices within privacy policies and wherever else we can but we are encouraging that the industry absorb and enhance know to suffer under a self regulatory framework that allows for disclosure that may be more relevant to them that we are being told is important for consumers so we're trying to respond in a way that allows for consumers to have transparency but that allows for business to have work in the way that it traditionally has to be effective in their   the privacy bill should have anything applicable to cookies that come into the computer i think that regulating technology is a tricky thing is what i mean i don't think technology is  necessarily the enemy i think we can talk about the uses of it i think we can talk about how we disclose how we're using we can talk about how we give over the levers of control about how we can use it you said you discuss  idea that self regulation can work with other actors going towards providing access to the interests and profiles that they build on line and letting consumers have some control over whether those interests are built and what those interest groups they would want to belong to list responders list and it advertises who is struggling with an addiction to gambling sex or food who just can't say no to drugs alcohol or tobacco millions of americans  so venti has the names of people who have had an alcohol problem then and they sell those names is that right that is what their advertising claims and typically  where do they get the information that a person is on the call program they are likely to be self reported for instance if a consumer fills out a survey and checks a box saying that i have struggled with alcoholism that is information that could be bundled and resold in this type of conduct context it would not come for instance from a health care provider so this would be it could be a product loyalty card  would be you're walking through the mall and someone stops you and says will you help fill out this survey and we'll give you a gift card or we'll give you some something if you fill out that survey it could end up like this and there is no right to notice they to really unlikely in this context because this information is sold in bulk if you look at the terms it says one hundred fifty dollars which means that it's a thousand four hundred fifty dollars you could not say  money these companies are not set up to this type of company is not architected to sell information about a specific individual with respect to the pizza delivery exhibit that i provided where merlin data is selling identifiable information about people's homes phone numbers your cell phone numbers etc that is very different that's when you say this is a situation where you say i want information about a specific individual thirty seven is for healthy male wellness code sixty four thirty six is health diet slash weight loss what would be the information to generate people's inclusion in those codes where would you loss website that provides weight loss services or products say a person just visits the web site opens the page is there any legal prohibition of that owner of that page disseminating to a data information service the fact that this computer this identity identify computer has visited that site and then that data collector being able to collect if they have some connection to an individual connecting that to the data is there any legal as about anorexia and other topics they talk about online now so give the information out and these notices can be quite small they don't see them and then their information gets old so it's not just that you visited a weight loss website it's that you visited the site then you filled out your name gave them your e mail and then that can be furthered associated downstream in collaboration and linked with other data but in some cases the information is so identifiable it doesn't even need to be linked when you look at these really scary list of ailments prostate cancer mental health these people are known by name because they really given their name and one of the really difficult questions i think that this committee faces is that the opt in opt out model is very challenging because it's educate consumers about well what does giving your name on such a web site actually mean to you are you opting in do you really know what you're opting into because for example the mental health of those people gave that information up in some way typically through some kind of web site or survey and did they really truly know  people into opting in and converse to make it so people will not opt out so i have suggested several other interventions having the data disappear after a certain amount of time if you have a upward data retention limit is one way of doing it but there are other tools from the advertising world that can be used one example is advertising what is advertiser liability so for instance in the telemarketing spam  in this context you could create liability for people who buy certain lists and in an example out of is worth noting there was a list brokerage company there that was selling a the data seller i think should offer diligence especially when they are using sensitive personal information and that can be in reviewing advertising that's ultimately disseminated or in being responsible if the advertiser ultimately uses the information to take advantage of people with respect to your first question that the general legal standard in the us offline data collection is not regulated by a specific federal privacy law cept in certain areas your video rental records for instance are protected your cable records are protected but between in all the gaps left