Privacy Protections for Personal Information Online 
Released: 2011-04-06T00:00:00

Background

The collection and use of personal information by websites, Internet service providers, direct marketers, data brokers, network advertisers, law enforcement entities, and others has raised privacy concerns. Personal information is readily available because of the widespread usage of the Internet and of cloud computing, the availability of inexpensive computer storage, and increased disclosures of personal information by Internet users in participatory Web 2.0 technologies. The increased availability of online personal information has fueled the creation of a new tracking industry. Behavioral advertising, a form of online advertising, is delivered based on consumer preferences or interest as inferred from data about online activities. In 2010, over $22 billion was spent on online advertising. This revenue allows websites to offer content and services for free. What They Know , an in-depth investigative series by the Wall Street Journal, found that one of the fastest growing Internet business models is of data-gatherers engaged in "intensive surveillance of people [visiting websites] to sell data about, and predictions of, their interests and activities, in real time." Websites such as Spokeo, an online data aggregator and broker, give site visitors vast quantities of personal information. Congress is examining the use of new technologies (such as flash cookies), and the privacy practices of the 15 websites identified as installing the most tracking technology on their visitors' computers. Consumers and public interest groups are filing complaints to challenge the collection and use of consumer data without consumer consent or knowledge. Online privacy concerns are widespread.

Stakeholders routinely acknowledge that the continued success of electronic commerce depends upon the resolution of issues related to the privacy and security of online personal information. The U.S. Department of Commerce recently reiterated that the large-scale collection, analysis, and storage of personal information is central to the Internet economy; and that regulation of online personal information must not impede commerce. The Commerce Department's report on Commercial Data Privacy calls on Congress to create a "privacy bill of rights," and concludes that privacy policies are now widely viewed as ineffective for the protection of personal information. A recent Federal Trade Commission (FTC) Staff Report recommended implementation, either through legislation or self-regulation, of a Do Not Track system to allow consumers to opt out of online tracking or advertising. Developers, organizations, and businesses are voluntarily working on ways to allow users to opt out of behavior advertising.

The U.S. Congress continues to examine the federal legal framework that protects personal information. Historically, Congress has played a major role in protecting personal information online. Beginning in the late 1990s, Congress passed laws aimed at specific online harms and amended existing laws to reflect the ways in which technology was being used to collect, use, and share personal information. Beginning with the 109 th Congress, every Congress has held numerous privacy-related hearings. The current Congressional privacy agenda is broad and includes items that Congress has worked on for several years, new issues posed by advances in technology, and items related to efforts to update the electronic surveillance laws for advances in technology.

Reportedly, several Members in the 112 th Congress plan to introduce or reintroduce substantive privacy legislation. Online consumer privacy is an issue that is at the forefront of the Senate Commerce Committee's agenda, and it is a top priority for Chairman Rockefeller. Senator Kerry, Chairman of the Commerce Subcommittee on Communications, Technology and the Internet, along with Senator McCain, intend to introduce a privacy bill similar to the Obama Administration's legislative framework. Representative Rush reintroduced a comprehensive privacy bill, H.R. 611 , to require businesses to disclose details about their data-collection practices and allow consumers to make choices about such activities. Representative Stearns announced that he had drafted a consumer privacy bill with a provision to establish an FTC-approved self-regulatory program. The House Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade Chair Bono Mack said that the subcommittee will examine online privacy issues in hearings. Senate Judiciary Chairman Leahy has a long-standing interest in privacy, and his committee has several initiatives underway. A new Senate Committee on the Judiciary Subcommittee on Privacy, Technology and the Law was created in the 112 th Congress with jurisdiction covering oversight of laws and policies governing the collection, protection, use, and dissemination of commercial information by the private sector, including online behavioral advertising, privacy within social networking websites, and other online privacy issues. Senator Wyden has also announced plans to draft a bill to clarify what legal standards law enforcers and intelligence agents must satisfy before tracking an individual's physical movements using geolocation data generated by a mobile device.

Important policy questions include whether Congress should draft legislation tailored to specific privacy threats (such as online behavioral advertising) or whether a broader, comprehensive federal privacy law is desirable. There is a growing consensus among stakeholders that basic privacy rules are necessary. However, consensus is lacking about the elements of a federal privacy law: what types of information it should cover (personal identifying information or more general information that is associated with a computer or device); how far it should reach; whether it should cover data collection or merely use; and who should be able to enforce it. One legal scholar posits that

[i]t may be helpful to pull back the lens and see if it is possible to create a larger-scale outline of privacy. This broader perspective may help to illuminate the constituent elements of a privacy incursion, and the interrelationships between those elements. In this context, . . [there are] six discrete aspects of privacy relating to: (1) actors–relationships; (2) conduct; (3) motivations; (4) harms–remedies; (5) nature of information; and (6) format of information.

Businesses view U.S. sector-by-sector regulation of personal information as an impediment to commerce and seek simplification. For example, Microsoft recommends a multi- pronged approach to the protection of individuals' privacy that includes legislation, industry self- regulation, technology tools, and consumer education. Three principles—transparency, control, and security—underpin Microsoft's approach to privacy. Under this approach, privacy protections would not be specific to any one technology, industry, or business model; would apply across sectors; would provide consistent baseline protections for consumers; and would simplify compliance. In addition, privacy legislation would preempt state laws that are inconsistent with federal policy.

Federal Legal Framework for the Privacy of Online Personal Information

At the end of the 19 th century, a seminal law review article was published that developed the basic principle of American privacy law—the "right to be let alone." The article was written in response to invasions of personal privacy caused by the technological innovations of mass printing (newspapers) and the portable camera (photographs). Following this article, American common law jurisprudence developed four distinct tort remedies to protect personal privacy: false light, misappropriation, public disclosure of private facts, and intrusion upon seclusion. With the late 20 th century technological innovations of the Internet and the World Wide Web, the collection, use, and dissemination of electronic personal information is potentially much more invasive. As noted above, the right to privacy has long been characterized as the "the right to be let alone." And yet, today the more practical view may be that "[i]n the digital era, privacy is no longer about being 'let alone.' Privacy is about knowing what data is being collected and what is happening to it, having choices about how it is collected and used, and being confident that it is secure."

Some advocate the expansion of this concept to include the right to "information privacy" for online transactions and personally identifiable information. The term "information privacy" refers to an individual's claim to control the terms under which "personal information"—information that can be linked to an individual or distinct group of individuals (e.g., a household)—is acquired, disclosed, and used. Others urge the construction of a market for personal information, to be viewed no differently than other commodities in the market.

Constitutional Protections

In the United States there is no comprehensive legal protection for personal information. The Constitution protects the privacy of personal information in a limited number of ways, and extends only to the protection of the individual against government intrusions. Constitutional guarantees are not applicable unless "state action" has taken place. Many of the threats to the privacy of personal information addressed in this report occur in the private sector, and are unlikely to meet the requirements of the "state action" doctrine. As a result, any limitations placed on the data collection activities of the private sector will be found not in the federal Constitution but in federal or state statutory law or common law.

The federal Constitution makes no explicit mention of a "right of privacy," and the "zones of privacy" recognized by the Supreme Court are very limited. The Fourth Amendment search-and-seizure provision protects a right of privacy by requiring warrants before government may invade one's internal space or by requiring that warrantless invasions be reasonable. However, "the Fourth Amendment cannot be translated into a general constitutional 'right to privacy.' That Amendment protects individual privacy against certain kinds of governmental intrusion, but its protections go further, and often have nothing to do with privacy at all." Similarly, the Fifth Amendment's self-incrimination clause was once thought of as a source of protection from governmental compulsion to reveal one's private papers, but the Court has refused to interpret the self-incrimination clause as a source of privacy protection.

In Whalen v. Roe , the Supreme Court recognized an implicit constitutional "right of informational privacy." Whalen concerned a New York law that created a centralized state computer file of the names and addresses of all persons who obtained medicines containing narcotics pursuant to a doctor's prescription. Although the Court upheld the state's authority, it found this gathering of information to affect two interests. The first was an "individual interest in avoiding disclosure of personal matters"; the other, "the interest in independence in making certain kinds of important decisions." These two interests rest on the substantive due process protections found in the Fifth and Fourteenth Amendments.

More recently, the Court appeared to reiterate its recognition of a constitutional right to information privacy when it rejected 8-0 the National Aeronautics and Space Administration (NASA) contract workers' contentions that NASA violated their privacy rights under the U.S. Constitution by requiring them to answer questions about their drug treatment and asking their references whether they have any reason to question the individual's honesty or trustworthiness. Justice Samuel A. Alito, writing for the Court, said it was not necessary for the Court to decide whether NASA's questions about contract workers at the agency's Jet Propulsion Laboratory implicated privacy interests of "constitutional significance" because it was clear that any such constitutional interest, if it exists, did not prevent the government from taking reasonable steps that served legitimate government interests and gave the employees substantial protection against public disclosure of their personal information. Citing the Privacy Act's requirements that the government limit disclosure of information about the Jet Propulsion Lab (JPL) contract employees and the government's long-standing use of pre-employment investigations of federal job applicants, the court concluded "that the Government's inquiries do not violate a constitutional right to informational privacy."

Statutory Protections

A patchwork of federal and state laws exists to protect the privacy of certain personal information. There is no comprehensive federal privacy statute that protects personal information held by both the public sector and the private sector. This report does not address state privacy laws. The private sector's collection and disclosure of personal information has been addressed by Congress on a sector-by-sector basis. Federal laws and regulations extend protection to consumer credit reports, electronic communications, federal agency records, education records, bank records, cable subscriber information, video rental records, motor vehicle records, health information, telecommunications subscriber information, children's online information, and customer financial information.

The Federal Trade Commission

Federal Trade Commission Act. The Federal Trade Commission Act (the FTC Act) prohibits unfair and deceptive practices in and affecting commerce. The FTC Act authorizes the Commission to seek injunctive and other equitable relief, including redress, for violations of the act, and provides a basis for government enforcement of certain fair information practices (e.g., failure to comply with stated information practices may constitute a deceptive practice or information practices maybe inherently deceptive or unfair).

FTC Enforcement Actions Concerning the Privacy of Personal Information

The first online behavioral advertising case was brought against an online network advertiser that acts as an intermediary between website publishers and advertisers. The Commission alleged that the online network advertiser violated the FTC Act by offering consumers the ability to opt out of the collection of information to be used for targeted advertising without telling them that the opt-out lasted only 10 days. The Commission's order prohibits the online network advertiser from making future privacy misrepresentations, requires the online network advertiser to provide consumers with an effective opt-out mechanism, and requires destruction of any data associated with a consumer collected during the time its opt-out was ineffective.

The FTC recently approved a final consent order in a case involving the social networking service Twitter. The FTC charged that data security lapses allowed hackers to obtain unauthorized administrative control of Twitter. As a result, hackers had access to private "tweets" and non-public user information and took over user accounts. The order prohibits misrepresentations about the extent to which Twitter protects the privacy of communications, requires Twitter to maintain reasonable security, and mandates independent, comprehensive audits of Twitter's security practices.

In December 2010, the FTC announced a case against a company selling a software program called Sentry Parental Controls that enables parents to monitor their children's activities online. The Commission alleged that the software company sold certain information that it collected from children via this software to third parties for marketing purposes, without parental consent. The Commission's order prohibits the company from sharing information gathered from its monitoring software and requires the company to destroy any such information in its database of marketing information.

In September 2010, the Commission settled a case against a data broker that maintained an online service, which allowed consumers to search for information about others. The company allowed consumers to opt out of having their information appear in search results for a $10 fee. Four thousand consumers paid the fee and opted out, but their personal information still appeared in search results. The Commission's settlement requires the data broker to disclose limitations on its opt-out offer, and to provide refunds to consumers who had previously opted out.

In March 2011, the FTC reached a settlement with Google over charges that it violated user privacy when it launched the Google Buzz social network. Google Buzz was offered to Google users through Gmail. Many who chose not to join the Google social network were enrolled anyway, and those who chose to join were not fully informed regarding the extent their personal information might be shared with, or exposed to, Google users outside of their own personal network. The Google privacy policy at the time stated, "When you sign up for a particular service that requires registration, we ask you to provide personal information. If we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use." The FTC alleged that the representations in Google's privacy policy were false or misleading, and despite its privacy policy that Google would ask for consumers' consent before using their information for another purpose, Google used it to populate its social network without getting user permission. The FTC charged that the policy was false or misleading and constituted a deceptive practice. The proposed settlement bars Google from future privacy misrepresentations, requires the company to implement a comprehensive privacy program, and requires independent privacy audits for the next 20 years. The Federal Trade Commission announced that it has accepted, subject to final approval, a consent agreement from Google that would resolve the Commission's allegations. This is the first time an FTC settlement order has required a company to implement a comprehensive privacy program to protect consumers' information.

Recent Policy Initiatives

The FTC recently released a Staff Report on a Preliminary Framework on Protecting Consumer Privacy which includes three major elements: (1) companies should integrate privacy into their regular business operations and throughout product development; (2) provide meaningful privacy options while preserving beneficial uses of data, and provide choices to consumers in a simpler, more streamlined manner; and (3) improve the transparency of all data practices. The Framework's basic building blocks are scope, privacy by design, simplified choice, and greater transparency. The Framework applies to all commercial entities that collect or use consumer data that can be reasonably linked to a specific consumer, computer, or other device. The FTC recommends that companies provide consumers with reasonable access to data about themselves depending on the sensitivity of the data and the nature of its use, and provide prominent disclosures and obtain affirmative express consent before using consumer data in a materially different manner. The FTC Staff Report includes a recommendation to implement a universal choice Do Not Track mechanism for behavioral tracking or behavioral advertising.

The Commerce Department's Internet Policy Taskforce (IPTF) is examining how commercial data privacy policy advances the goals of protecting consumer trust in the Internet economy and promotes innovation. The Taskforce released a "Green Paper" on consumer data privacy in the Internet economy on December 16, 2010, and made 10 separate recommendations about how to strengthen consumer data privacy protections. The IPTF concluded that the basic element of current consumer data privacy framework, the privacy policy, is ineffective because it is often a lengthy, dense, and legalistic document. The IPTF recommended updating the commercial data privacy framework because the notice-and-choice system does not provide adequately transparent descriptions of personal data use. The IPTF also concluded that the rules of the road are hard to discern for businesses and sometimes become clear only after FTC enforcement actions, and differing international legal frameworks and new technologies present privacy challenges and complicate commercial data flows across national borders. The IPTF's report recommends considering a clear set of principles concerning how online companies collect and use personal information for commercial purposes. These principles would build on existing Fair Information Practice Principles (FIPPs) of transparency, data use limitation, and accountability. The IPTF report also recommended that Congress authorize the FTC to enforce baseline privacy protections, and create incentives, such as safe harbors, for businesses to adopt self-regulatory privacy codes of conduct, and consider how to harmonize security breach notification rules. The IPTF report calls on Congress to review the Electronic Communications Privacy Act (ECPA) for the cloud computing environment. In light of calls for Congress to reform ECPA, a brief discussion of ECPA follows.

Electronic Communications Privacy Act Reform

In 1986, Congress enacted the Electronic Communications Privacy Act (ECPA) to strike a balance between the fundamental privacy rights of citizens and the legitimate needs of law enforcement with respect to data shared or stored in various types of electronic and telecommunications services. Since the ECPA was passed the Internet and associated technologies have expanded exponentially.

ECPA consists of three parts: a revised Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (also known as "Title III" or the "Wiretap Act"); the Stored Communications Act (SCA)); and provisions governing the installation and use of trap and trace devices and pen registers. ECPA prohibits the interception of wire, oral, or electronic communications unless an exception to the general rule applies. Unless otherwise provided, Title III prohibits wiretapping and electronic eavesdropping; possession of wiretapping or electronic eavesdropping equipment; use or disclosure of information obtained through illegal wiretapping or electronic eavesdropping; and disclosure of information secured through court-ordered wiretapping or electronic eavesdropping, in order to obstruct justice. The Stored Communications Act prohibits unlawful access to stored communications. The Pen Register and Trap and Trace statute proscribes unlawful use of a pen register or a trap and trace device. ECPA establishes rules that law enforcement must follow before they can access data stored by service providers. Depending on the type of customer information involved and the type of service being provided, the authorization law enforcement must obtain in order to require disclosure by a third party will range from a simple subpoena to a search warrant based on probable cause.

ECPA reform efforts focus on crafting a legal structure that is up-to-date, can be effectively applied to modern technology, and that protects users' reasonable expectations of privacy. ECPA is viewed by many stakeholders as unwieldy, complex, and difficult for judges to apply. Cloud computing poses particular challenges to the ECPA framework. For example, when law enforcement officials seek data or files stored in the cloud, such as web-based e-mail applications or online word processing services, the privacy standard that is applied is often lower than the standard that applies when law enforcement officials seek the same data stored on an individual's personal or business hard drive.