Developments Affecting Privacy

Although some technological developments, such as Platform for Privacy Preferences, or P3P, hold promise, the privacy landscape will be most significantly affected by the passage of any one of the numerous federal privacy bills currently under consideration. A number of different versions have been proposed, and they differ in many respects. One of the key issues being debated in the context of proposed privacy legislation is whether state law will be preempted. This is a particularly stormy topic, since many states have proposed more restrictive privacy regulation. Although Federal preemption would reduce administrative burdens, it would also eliminate the states' ability to regulate commerce within their borders.

A second issue affecting privacy is whether privacy legislation will adopt an opt-in or opt-out approach. Some bills under consideration right now propose a mandatory opt-out policy, meaning that a customer, once he or she provides information to a company, will have the opportunity to preclude that company from sharing the information. The other option is a mandatory opt-in, which is much more restrictive and would require companies to proactively obtain the consent of the individual before sharing information with a third party. Also proposed is a hybrid approach, where opt-in policies would apply only to "sensitive information," including financial, medical, and other types of information. This hybrid approach is currently used in the telecommunications industry, depending on whom information is shared with and under what circumstances.

In addition to legal shifts, technologies such as P3P will be extraordinarily useful in helping implement any new legal privacy requirements. Right now people are frozen with indecision on privacy matters; businesses and consumers find privacy a complicated issue, partly because global economies don't have a default rule. No one knows when they log onto a particular Web site if they will be given opt-in or opt-out rights. Furthermore, an individual needs to read every privacy policy if they want to fully understand information-sharing practices. This situation is not particularly efficient or helpful to online commerce. P3P should enable individuals to quickly and efficiently identify information collection and sharing practices.

Technology will continue to create more privacy issues. Technology is obviously increasing the capability to gather and disseminate information, capabilities that are generally positive developments as our need to collect data, identify trends, and anticipate demand increases. What concerns most individuals is that this computer processing power can be used for purposes not intended by the party providing their personal data. Arguably, as a society, we need to not restrict technologies' ability to collect this information and disseminate it or to use it in fascinating new ways that benefit our lives. Instead, we need to be able to feel secure in the information that is gathered by these devices. We haven't let the genie out of the bottle yet; we do, however, need to develop greater legal guidelines on how information is collected and used. Technology should be allowed to continue along its developmental path, but legislators, judges, and lawyers must quickly develop laws to contain the collection and distribution of personal information contrary to an individual's wishes.

There has been an enormous debate about privacy over the past few years. It is somewhat amazing to me that it took the Internet revolution to get people to focus on privacy issues. Having engaged in this societal debate, I'm certain we will see some privacy legislation that gives consumers and businesses some knowledge and control over how personal information is collected and shared. This legislation must include an individual right of redress if it is to be effective. I also believe these legal changes will drive a host of new technologies, whether P3P or something else, that will allow customers to inventory and keep track of their personal information and make sure it doesn't go where it shouldn't. My guess is as good as any - but I foresee technology and law coming together to give people a greater sense of comfort with respect to information privacy.