Restoring Americans' Privacy in Electronic Commerce Symposium - The Legal and Policy Framework for Global Electronic Commerce: A Progress Report

In the United States today, substance abusers have greater privacy than web users and privacy has become the critical issue for the development of electronic commerce. Yet, the U.S. government's privacy policy relies on industry self-regulation rather than legal rights. This article argues that the theory of self-regulation has normative flaws and that public experience shows the failure of industry to implement fair information practices. Together the flawed theory and data scandals demonstrate the sophistry of U.S. policy. The article then examines the comprehensive legal rights approach to data protection that has been adopted by governments around the world, most notably in the European Union, but finds that difficulties implementing these laws for online services pose important challenges for the effective protection of citizens' privacy. The lessons show that safeguarding citizens' rights requires a combination of law and technology and that a legal incentive structure is necessary to stimulate the rapid development and implementation of privacyprotecting technologies. The article concludes with a recommendation for a framework privacy law in the United States modeled on the O.E.C.D. guidelines that includes a safe harbor provision for policies and technologies and that creates a U.S. Information Privacy Commission to assure the balance between citizens' privacy, industry needs, and global competitiveness. Privacy is a critical issue for the growth of electronic commerce. During the last few years, an overwhelming majority of Americans report that they have lost control of their personal information and that current laws © 1999 Joel R. Reidenberg. t Professor of Law and Director of Graduate Program Academic Affairs, Fordham University School of Law. An earlier draft of this paper was presented at the University of California, Berkeley Symposium The Legal and Policy Framework for Global Electronic Commerce: A Progress Report held March 4-6, 1999. 1 am very grateful for the thoughtful comments of Symposium participants and of the editors of the Berkeley Technology Law Journal. HeinOnline -14 Berkeley Tech. L.J. 771 1999 BERKELEY TECHNOLOGY LAW JOURNAL are not strong enough to protect their privacy.' In 1998, Business Week found that consumer worries about protecting privacy on the Internet ranked as "the top reason people are staying off the Web above cost, ease of use and annoying marketing messages."2 The fair treatment of personal information and citizen confidence are each necessary conditions for electronic commerce over the next decade. Yet, sadly, at the political birth of the electronic commerce movement in 1997, the White House's report, A Framework for Global Electronic Commerce, 3 more commonly referred to as the Magaziner Report, missed a key opportunity to assure the protection of citizens' privacy on the Internet. For years, the United States has relied on narrow, ad hoc legal rights enacted in response to particular scandals involving abusive information practices.4 The approach has led to incoherence and significant gaps in the protection of citizens' privacy. 5 For example, substance abusers have stronger privacy rights than web users in the United States. 6 Yet, rather than revise American privacy protection, the Magaziner Report adopted a position enshrining the status quo. This paper will first examine the philosophy and sophistry behind the U.S. policy of industry self-regulation. Next, the paper examines the com1. Privacy Exchange.org, 1998 Privacy Concerns & Consumer Choice Survey, Executive Summary, at 1 (last modified Dec. 15, 1998) (reporting that 82% of those surveyed feel that consumers have lost all control over how companies collect and use their personal information); Am. Ass'n. of Retired Persons, AARP Members' Concerns about Information Privacy, Dec. 1998 (reporting that 78% of those polled found existing statutory protections inadequate to protect privacy). 2. BW/Harris Poll: Online Insecurity, BUS. WK., Mar. 16, 1998, at 102 . 3. WILLIAM J. CLINTON & ALBERT GORE, JR., A FRAMEWORK FOR GLOBAL ELECTRONIC COMMERCE (1997), available at [hereinafter FRAMEWORK]. 4. See PAUL M. SCHWARTZ & JOEL R. REIDENBERG, DATA PRIVACY LAW: A STUDY OF UNITED STATES DATA PROTECTION 10 (1996). 5. See generally FRED H. CATE, PRIVACY IN THE INFORMATION AGE (1997); SCHWARTZ & REIDENBERG, DATA PRIVACY LAW, supra note 4. 6. Federal law carefully protects the personal information of individuals who undergo treatment for alcohol or drug abuse in programs receiving federal funds or subject to federal regulation. See 42 U.S.C. §§ 290dd-1, 290dd-2 (1994); SCHWARTZ & REIDENBERG, DATA PRIVACY LAW, supra note 4, at 177-78. At the same time, only limited protection is available for Internet users. Statutory protection applies to telecommunications transaction information when collected by telecommunications service providers. See 47 U.S.C. § 222. However, if the data is collected by web sites, instead of service providers, then the statutory protection does not apply. [Vol. 14:771 HeinOnline -14 Berkeley Tech. L.J. 772 1999 RESTORING AMERICANS' PRIVACY prehensive legal rights approach to data protection that has been adopted by governments elsewhere around the world, in a movement led by the European Union. While conceptually the cross-sectoral approach is better suited to the treatment of personal information in electronic commerce, the foreign experience illustrates a number of challenges for effective protection of citizens. The concluding section argues for a more desirable policy that combines legal and technological means in order to safeguard the privacy of citizens on the Internet. I. THE PHILOSOPHY AND SOPHISTRY OF U.S. PRIVACY