Indecent Exposures in an Electronic Regime

I. INTRODUCTION "The privacy that any computer user would and should and is justified in expecting is illusory; Big Brother shrunk to a miniature cyber spy always looms and never sleeps." (1) This is because an Internet user's online activity leaves electronic footprints, commonly called a "clickstream," that businesses routinely use to collect and create user profiles of personally identifiable data that they later use and sell. As the Internet is now a part of virtually every aspect of our lives, this process introduces wide-ranging dangers regarding personal autonomy and dignity. Professor Lawrence Lessig explains that "[t]he system watches what you do; it fits you into a pattern; the pattern is then fed back to you in the form of options set by the pattern; the options reinforce the pattern; the cycle begins again." (2) This constant surveillance shifts power over one's identity from the user to the commercial entity, absorbing individuality and self-determined independence. It destroys the feeling of freedom brought by anonymity and the ability to be free from unsanctioned intrusion. And, it is pervasive. In fact, in a recent lawsuit, Universal Image accused Yahoo! of watching, spying, conducting surveillance, and analyzing "the habits, inclinations, preferences, and tastes, and otherwise ... follow[ing] and stalk[ing] those who visit the ... site." (3) Without recourse to an effective privacy law, Universal Image has resorted to suing Yahoo! for violations of the criminal and civil theft laws, criminal stalking laws, civil conversion laws, and civil trespass laws. (4) Indeed, in the largely unregulated cyber realm, the applications of computer technology have introduced new possibilities for marketers, insurance companies, employers, and other interested parties to profit from users' personal information in a variety of ways. Given the ubiquity of unauthorized online profiling, what changes should be made to safeguard privacy? As the topic of data privacy is vast and the subject of much scrutiny, this Comment focuses narrowly on commercial cyber-activities relating to the nonconsensual Internet acquisition of personally identifiable user data. This Comment begins with a brief examination of the technology that has exacerbated privacy law's inadequacies. It briefly discusses failed attempts to safeguard privacy rights through the market and federal agency management. It then addresses current U.S. privacy legislation and the 1995 European Privacy Directive. Finally, this Comment proposes the creation of a new legislative system to effectively combat the surreptitious collection, storage, use, and sale of personal data. II. THE NEW FRONTIER OF WOE Cyberspace introduces new privacy concerns. Its lack of physical boundaries enables abusers to invade privacy with greater ease, efficiency, and power than has been experienced in the offline world. What once required extraneous methods of snooping, such as the manual planting of listening devices or the tapping of phones, can now be done universally and inexpensively through the online monitoring of clickstream data and built-in computer hardware. This invasion of privacy can also be done in much greater detail. Unlike a transaction receipt in the physical world that simply evidences a completed transaction, clickstream data is a record of a user's every online keystroke. (5) Realizing its value, many online businesses, including Yahoo!, RealNetworks, DoubleClick, and Amazon.com, actively accumulate personally identifiable visitor information while an individual visits their sites. (6) Yahoo! President Jeffrey Mallet even publicly stated that the information Yahoo! surreptitiously collects from users is its "single greatest asset." (7) Internet Service Providers ("ISPs") possess even greater collection abilities, as they can record a user's entire clickstream because the ISP is the user's gateway to the Internet. Further, the decentralized nature of the Internet guarantees the ability easily and instantaneously to transfer accumulated data to any party, anywhere in the world, at any time. …