I also agree that there is cause for skepticism about the effectiveness of legislative and administrative solutions, but I would argue that some of the difficulties in enforcing, monitoring, and implementing more effective solutions might be answered by the establishment of a Privacy Commission or Board. The original Privacy Act that passed the Senate in 1974 provided for the establishment of a Federal Privacy Board with authority over both the public and private sectors. The House bill did not provide for such an entity, the Ford administration was opposed, and the resulting conference bill provided for the Privacy Protection Study Commission. At various points over the last 25 years, the proposal to establish some institution has resurfaced. The question of its scope has been more contentious with the private sector, which has not been ready to endorse the establishment of an entity whose powers might be expanded.
Some institutional solution is appropriate and necessary, even in a self-regulatory scheme.
One of the main problems in the privacy area is the difficulty individuals have in finding out about organizational information practices and the implications of those practices. Some advisory or educational entity could fill this gap by providing a forum for the discussion and debate about privacy. An institutional focus is much needed. Herb's data on the difficulties of formulating privacy guidelines and policies, getting them passed, and then enforcing them, is very depressing. John adds more reasons to be doubtful that we can make progress.