Privacy .edu
A FRAMEWORK FOR PRIVACY PROTECTION
Christian Baekkelund
David Kelman
Ann Lipton
Alexander Macgillivray
Piotr Mitros
Teresa Ou
December 10, 1998
Table of Contents
EXECUTIVE SUMMARY I
Danger i
Goals ii
Proposal iv
Introduction 1
Scope 3
Goals 4
Current and Proposed Regulatory Frameworks 6
Technology 7
Internet Protocol (IP) 8
IP Logging 9
The Future of IP Logging 10
IP Version 6 10
Anonymizing Routers 11
Anonymizing Proxies 12
Hypertext Transfer Protocol (HTTP) 14
Cookies 15
An Alternative to Cookies: Client-Side Targeting 16
Other Web Technologies 17
Lightweight Directory Access Protocol (LDAP) Databases 17
JavaScript and VBScript 19
Java and ActiveX 20
E-Commerce 21
Payment 21
Digital Cash Protocol Type 1 22
Digital Cash Protocol Type 2 22
Delivery 24
P.O. Boxes 25
Cryptographic Delivery 25
Trusted Third Party 25
Case Study: A Technological Solution 26
Platform for Privacy Preferences (P3P) 27
P3P Strengths 29
P3P Problems 33
Law 35
Constitutional Law and Common Law 37
Common Law 39
Tort Law 40
Contract Law 41
Federal Statutes and Common Law 43
Privacy Act of 1974 45
Privacy Protection Act (PPA) of 1980 45
Electronic Communications Privacy Act (ECPA) of 1986 46
Legislative Outlook 50
The European Data Directive 51
Markets and Social Norms 54
Case Study: A Norms Solution 59
TRUSTe Strengths 62
Problems 63
Proposal 68
Entitlement to Individuals 68
Three Exceptions: 70
Operational and Aggregated Data 70
Opt-In by Contract 70
Autonomous Computer Contracting Privacy Technology (ACCPT) 71
Critique 77
Technical and Legal Complexity Added by ACCPT 77
Technical Complexity for the Programmer 77
Technical Complexity for End-Users 78
Legal Complexity for Programmers 79
Legal Complexity for End-Users 80
Public Access 81
A Slower Internet 82
Limitations of ACCPT 82
International Conflict of Laws 83
Profiling 84
Operational Data 85
"Race to the Bottom" 86
Philosophical Criticisms of ACCPT 86
No Data Collection 87
Less Regulation 89
Conclusion 92
Appendix A: Table of Proposed Legislation
Appendix B: Example P3P protocol
Executive Summary
Danger
The current direction of the information revolution threatens personal privacy. According to the Federal Trade Commission, 92% of websites collect personal information from their users. Add Internet Protocol (IP) address logging and that number nears 100%. However, industry self-regulation has been an unqualified disaster with very few sites providing notice of their data practices and default settings on devices which implicate personal privacy set at their most lenient. Users do not own their personal information and current informational practices point towards more abuse of personal information rather than less.
Most large websites handle advertising through one of several large brokers. To better target advertising, those brokers commonly track what websites a person visits, and what that person does on each site. For instance, the first time a user downloads an ad from DoubleClick (which handles ads for Altavista, Dilbert and many of other popular websites), DoubleClick sets a cookie on the user’s hard drive. This cookie is used to track the sites a user visits, keywords from Altavista searches and other information. If a user makes a purchase on a site subscribing to DoubleClick, DoubleClick can potentially match the user’s name to the cookie, and sell that profile to direct marketers. All of this typically happens without the user’s consent or even knowledge.
Advertising and information brokers are not the only abusers. Individual companies store data on their customers and are free to use that data how they see fit. , for example, keeps a record of all books individuals purchase. With modern data mining techniques, could collaborate with other companies to form a detailed profile of a person. As electronic commerce spreads, the amount of information in these profiles will become increasingly complete, and the business of buying and selling this information will become increasingly profitable. The more comprehensive these profiles become, the greater the potential for misuse of the information they contain.
Goals
In the face of these threats to privacy, the current legal framework offers insufficient protections to personal privacy, particularly against private entities. Our proposal attempts to create a legal and technological architecture that addresses this problem while satisfying the following goals:
1. Protect Individual Privacy: In the straightforward words of Al Gore, "You should have the right to choose whether your personal information is disclosed."
2. Enable Electronic Commerce: Electronic commerce is becoming a significant part of the U.S. economy with sales expected to reach close to five billion dollars this year and as much as one and a half trillion dollars by the year 2002.
1. Enfranchise Everyone: Too often privacy is only for the elite. Web privacy should be available regardless of wealth, technological, or legal savvy.
1. Encourage Diversity: We recognize that diversity and competition are the lifeblood of the growth of the Internet and the World Wide Web. Any privacy protection framework should encourage a diversity of technological solutions. Similarly, a good privacy protection framework should not dictate the level of privacy afforded each person. Since people have different privacy preferences, any proposed framework should allow for a wide range of competing privacy policies.
1. Enable Collective Privacy Choices: Communities have an interest in protecting the privacy of their members and so should be able to make and administer collective privacy choices.
Our proposal is limited in scope based on several assumptions. We do not consider governmental privacy violations; issues relating to children’s privacy; sniffing, snooping and other transmittal privacy violations. We do not expect to solve related problems dealt with by other subject matter white papers, such as international sovereignty issues, but do hope to identify how those problems affect our proposal. Furthermore, our proposal relies on a number of technological and legal structures. For example, we assume that certification and encryption can make users identifiable and contracts verifiable. These are further detailed in the text of our proposal.
Proposal
Our proposal entitles individuals to ownership of personal information. We provide a legal and technological framework such that personal information cannot be used by any other entity without permission from the individual. We further propose that "default" settings on computer programs should not reveal personal information and that, for a user to enter into a contract where the user’s information is given to an entity, the user must be aware (either explicitly or through a transparent agent) of the terms of that contract and be able to enforce those terms.
We begin by envisioning a legal framework whereby the use of information, without permission, carries a statutorily determined minimum penalty. A user who feels his or her rights have been violated may sue the offending company. This might be administered through a government agency responsible for investigating the source of the privacy violation -- an individual, for example, might only know that he or she had received a solicitation without knowing which of the several companies with which he or she had interacted had released information. Alternatively, the user could initiate her own suit through a private right of action.
If a company wishes to use personal information about an individual, it is the company’s responsibility to enter into a contract with that individual by asking for permission to use the information and disclosing the intended purposes of the data collection. This can be done either by personal, "manual" interaction, or through the use of a computerized agent. In order for the contract formed by the computerized agent to be legally binding, there must be some evidence that the client was aware of, and authorized, choices made by its agent. If no such evidence exists, then the contract, or certain provisions therein, would not be enforceable and the company would be potentially liable for use of the personal information.
In order to remove some confusion about which autonomous agent contracts will be enforced, we propose the Autonomous Computer Contracting Privacy Technology (ACCPT) guidelines as a framework for enabling users to negotiate privacy preferences with websites. In a basic ACCPT transaction, the client and server negotiate to reach a mutually acceptable set of privacy practices. If no agreement is reached in an ACCPT transaction, the server can log a failed attempt and sample proposals, but no additional information about the transaction (the user’s IP address, etc.).
ACCPT incorporates the elements necessary to ensure that users are aware of the activity of the computerized agents. To the extent that negotiation is governed by a set of preferences entered by the user when the technology is first installed, the ACCPT guidelines require that the agent informs users who choose the default settings of the ramifications of the choice, and requires users to assent to that choice. Any company interacting with an agent that identifies itself as ACCPT compliant can rely on the validity of contracts made with that agent despite potential differences between the user’s personal preferences and the preferences as expressed by the computerized agent. That liability would be shifted to the authors of agents pledging ACCPT compliance (under negligence standards for deviations from the ACCPT guidelines). If a program does not identify itself as ACCPT compliant, the contracting parties retain liability for reliance on invalid contracts. In that way, a company which collects information from an agent that does not pledge ACCPT compliance is at its own peril and authors of agents that falsely pledge ACCPT compliance are also in peril.
Our proposal also encourages the development of other privacy protecting technologies, such as a framework for anonymous browsing and electronic commerce. This includes an addition to IPv6 for connecting to servers without disclosing one’s IP address, an anonymous payment protocol and an anonymous shipping protocol (for delivering goods ordered on-line).
Introduction
New technology must not reopen the oldest threats to our basic rights: liberty, and privacy. But government should not simply block or regulate all that electronic progress. If we are to move full speed ahead into the Information Age, government must do more to protect your rights - in a way that empowers you more, not less. We need an electronic bill of rights for this electronic age.[1]
-Vice President Al Gore
The World Wide Web has grown exponentially from its proposal in March of 1989 as a way for physicists to keep track information at the European Laboratory for Particle Physics (CERN).[2] More than one hundred and fifty million people now use the Web[3] and any effort to count the number of individual sites is doomed to be outdated before finished.[4] Those sites represent a wide range of interests and ways of using the Web but almost all share at least one characteristic: the collection of information. Ninety-two percent of websites recently surveyed by the United States Federal Trade Commission (FTC) collect information from their users.[5] Add Internet Protocol (IP) address logging and that number nears one hundred percent. The U.S. government believes in industry self-regulation but thus far self-regulation has been an unqualified disaster. Fewer than fourteen percent of the sites surveyed by the FTC even give notice of their privacy policies.[6] The default privacy settings on the two most popular web browsers are set at their most lenient. Users do not own their personal information and current informational practices point toward more abuse of personal information rather than less.
Consider the hypothetical surfer, Alfred. Alfred surfs from home and goes to a wide variety of sites. Alfred checks the performance of his favorite technology stocks on . Being an older man, Alfred looks for information on the hereditary nature of prostrate cancer at and checks out the job listings at a web publishing site called . He buys a few books on gardening at and has them delivered. Even if Alfred has been careful, a large quantity of personal information has been collected from these sites and others. Alfred may be surprised when he receives an e-mail from telling him that anyone who invests in tech stocks should subscribe to their insider’s guide. Or, come Monday morning, when he finds the company policy on job-seeking while still employed on his desk. Or when he receives advertisements for a new prostrate cancer wonder drug by mail at his home. Or when his HMO calls him in and talks about raising his rate if prostrate cancer is in his family. However, all of these nightmare scenarios could come true today. Technology enables it, law allows it, the market encourages it, and social norms constrain only the most flagrant privacy violations, and then only as long as the public’s attention affords.
This paper will describe the current privacy framework in the United States and outline why neither technology, nor law, nor the market, nor social norms adequately regulate the privacy practices of data collectors. It will examine two current privacy solutions as case studies of how the current privacy framework is inhospitable to personal privacy. It will propose a new framework for privacy protection and discuss some possible critiques of the proposed framework. But first we must be clear on the scope of the project and the goals we hoped to achieve in crafting this proposal.
Scope
This white paper puts forward a privacy framework that would protect the privacy of individuals on the World Wide Web. As such, it has a wide focus but does not attempt to solve every problem of individual privacy. In particular, we do not discuss workplace privacy, as it is a rapidly evolving field with issues specific to the workplace that have already been well commented on by many authors.[7] We do not discuss governmental invasions of privacy because some protection already exists in this area.[8] We likewise do not attempt to provide a framework for the protection of personal data from interception in transit or unauthorized access in storage because these too are covered by existing privacy regulations.[9] We also do not specifically target children’s privacy issues which have received much attention in this Congress, though our proposal is adaptable to their needs. Instead, this paper aims to propose a framework for individual privacy protection from private entities who collect data on the World Wide Web.
Goals
Within the scope of individual privacy on the World Wide Web, there are many possible frameworks that would reflect different goals. The current government stance on privacy has allowed the goals of business to be the basis for the privacy framework in this country. Our proposal follows directly from a different set of goals. These goals reflect our biases and are listed below in order of their importance to us in crafting this proposal.
1. Protect Individual Privacy: In the straightforward words of Al Gore, "You should have the right to choose whether your personal information is disclosed."[10]
2. Enable Electronic Commerce: Electronic commerce is becoming a significant part of the U.S. economy with sales expected to reach close to five billion dollars this year[11] and as much as one and a half trillion dollars by the year 2002.[12]
1. Enfranchise Everyone: Too often privacy is only for the elite. Web privacy should be available regardless of wealth, technological, or legal savvy.
1. Encourage Diversity: We recognize that diversity and competition are the lifeblood of the growth of the Internet and the World Wide Web. Any privacy protection framework should encourage a diversity of technological solutions. Similarly, a good privacy protection framework should not dictate the level of privacy afforded each person. Since people have different privacy preferences, any proposed framework should allow for a wide range of competing privacy policies.
1. Enable Collective Privacy Choices: Communities have an interest in protecting the privacy of their members and so should be able to make and administer collective privacy choices.
Current and Proposed Regulatory Frameworks
Cyberspace is regulated in a variety of ways.[13] Law obviously can affect behavior, even in cyberspace, as the courts are becoming more familiar with the space. Sites react to lawsuits[14] and courts dictate the ways in which certain sites function.[15] Market forces affect the space too. Popular sites get financial backing and can afford to hire the best graphic designers. Similarly, lucrative content[16] or business models[17] breed many sites. Social norms further affect the space as sites appear to serve different communities[18] and fads dictate website style.[19] Finally, the most important effect on cyberspace is that of its technical architecture. Those characteristics that differentiate the web from chat or a real-space library are functions of its unique architecture.
It is important to realize that all of these forces are fluid, and, in the next section, we propose changes to the legal regime and technical architecture in order to effect changes in the market and social norms. However, we must first understand why the current technical, legal, market and social forces do not offer sufficient protection for individual privacy and that is the subject of this section.
Technology
The current state of Internet and World Wide Web technology provides ample opportunity for the collection of personal information about a user. More importantly, the user possesses relatively little control over the flow of this information. One of the most obvious privacy threats comes from information freely handed over by the user – filled-out surveys, purchases with credit cards and mailing addresses, etc. This information, amassed, stored, and traded, can present a significant privacy threat. Other less visible privacy threats, that users may or may not be aware of are embodied in the technical architecture of the Internet and the World Wide Web.
Internet Protocol (IP)
Internet Protocol (IP), as its name suggests, is the fundamental protocol of the Internet. Any computer connected to the Internet, despite the nature and composition of the computer’s local subnet (the local network of which it is a part) has an IP address. A computer on the Internet may have a static IP address, in which case it is always the same unique address. Alternatively, a computer may have a dynamically allocated IP address, which is assigned (usually on a per-session basis) from a pool of addresses available to the computer’s subnet.
IP addresses currently consist of four one-byte (i.e., ranging from 0 to 256) numbers, normally delimited by periods (e.g., "127.0.0.1"). A subnet may use IP addresses that are either Class A, Class B, or Class C addresses. The class of the addresses determines how many total IP addresses a subnet possesses. In a Class A address, the first one-byte number in the address is identical for all machines on the subnet (e.g., all MIT IP addresses start begin with the number 18). In a Class B address, the first two numbers in the address are identical for all machines on the subnet. In a Class C address, the first three numbers are identical.[20]
IP addresses are equivalent to the U.S. Post Office’s ZIP code plus four digits numbering system; at any one time, only one computer should have any one address, and anything sent to that address should not end up anywhere else instead. IP addresses are used to ensure that data on the Internet is sent to the correct computer. For this reason, a computer must indicate its IP address when making a request for data, or the responding computer will not know where to send its reply.
IP Logging
Computers that users interact with, such as web servers, will obtain the IP addresses of their visitors. In most cases, these IP addresses are written to a log file. The server machine can also easily indicate what IP address queried for what page. More sophisticated IP logging systems might tie this information to other queries and data acquired by other collection technologies, which are discussed below.
An IP address may betray certain information about a computer. At the very least, in a subnet where IP addresses are dynamically allocated, an IP address will indicate the general location of a computer. For instance, an IP address may indicate that a user is from AOL or MIT. In many cases, with static IP address, an IP address alone can indicate the identity of a user and tie him to other data collected about him.
One hypothetical scenario might run as follows: On one day a user with a static IP address goes to Playboy’s website and looks at a playmate pictorial but does not do anything to identify himself in any other way. His IP will still be tied to his picture viewing session later on. If, at another time, he revisits the Playboy site but "only reads it for the articles," and he decides to give his name and mailing address so that he can receive Playboy’s new free "just the articles" mailing, he has really revealed his identity for every visit to the site. Playboy’s server can now associate a certain name and mailing address with the IP address it originated from. Thus, the user’s name can be associated with the pictorial-viewing web session of the previous day. IP correlated profiles are not foolproof, however. Under this method, the IP address only identifies the computer; a different user of the computer may have visited the site for the pictorial query.
The Future of IP Logging
IP Version 6
The Internet is currently undergoing a major technological change. Many of the protocols designed when the Internet was a fraction of its current size are beginning to show signs of wear. The current version of IP (Internet Protocol Version 4) only has provisions for 32 bit IP numbers.[21] This places an upper limit on the number of computers with unique IP addresses on the Internet at once. Although 232 is a fairly large number, the assignment is fairly inefficient by design. For instance, MIT has more than 16 million IP numbers for less than 16 thousand people. The end result is that there is a severe shortage of IP numbers. IP numbers sell for as much as $150 per year in some areas.
To correct this (and several smaller problems), the Internet will convert to a new version of IP, known as IPv6 (Internet Protocol version 6). IPv6 is a complete revamp of the most fundamental layers of the Internet. IPv6 will increase IP size to 128 bits, giving the astronomical number of 2128 IP addresses. It includes other improvements useful for automatic configuration of machines, better routing of Internet traffic, better multicasting (transmitting the same data to a large number of machines), better machine mobility, maintaining large networks, transmitting encrypted data and a host of other tasks.[22]
With the introduction of IPv6, there will be about 3.4*1038 IP numbers. Within a few years, almost all computers will have unique IP addresses. Businesses like DoubleClick will no longer need cookies (see below) to track individual machines. The proposals below attempt to counter this by allowing users to connect to servers without disclosing their IP addresses.[23]
Anonymizing Routers
It has been suggested that the adoption of IPv6 should also include an anonymizing router technology to allow anonymous connections. Each router between the client and the server would mangle the IP by marking what router it came from, adding a few random bits, and encrypting it with a private key. When the web server responded, each router would unmangle the IP, pick out the bits indicating what router it came from, and send it to the previous router. Keys (and their corresponding mangled IP addresses) would expire after a preset amount of time (~24 hours). Alternatively, instead of encrypting, routers could store IP addresses in memory, and replace them with a reference to the IP’s location in memory.
Although mangling and unmangling IP addresses may seem like an unnecessary burden on routers, encryption and decryption is fast, and the actual difference in cost would be marginal. Some Cisco routers can already encrypt packets (although not for the purpose of anonymity),[24] and there are extensions to most operating systems that allow for ordinary computers to do the same.[25] Simple encryption chips easily achieve speeds in excess of 177 Mbits/sec.[26] On the low-end, instead of encryption, IP addresses could easily be stored in random slots in a cheap memory table.
The adoption of anonymizing routers could potentially cause the tracking of "crackers" (individuals that break into other computers) to be significantly more difficult. Right now, IP logs can be used to track many attacks. With anonymizing routers, law enforcement would need to ask (or possibly subpoena) every router between the cracker and the compromised machine to unmangle the IP and figure out where the attack originated. However, experienced crackers already conceal or erase their IP addresses from logs. It does not take long for amateur crackers to pick up techniques from experts.
Anonymizing Proxies
Anonymizing proxies serve the same purpose as anonymizing routers, but use a different technology. Instead of connecting directly to a web server, the web browser connects to a trusted proxy and asks it to retrieve a web page. The proxy retrieves the web page, and sends it back to the browser. The web server only knows the proxy’s IP, and not the user’s. Since anonymizing proxies are shared by a number of users and do not transmit any individually identifying information, web servers have no way of tracking users going through proxies.
There are a number of disadvantages to anonymizing proxies. A malicious or compromised proxy could log all of its user's transactions. Although there are free anonymizing proxies available on the web, they are not very popular for a number of reasons. To begin with, few people know about them. Of those that do, most opt not to use them because there is a noticeable lag, and making the appropriate configurations on the web browser is a hassle. Further, because there are twice as many requests for every page retrieved when proxies are used, universal adoption could significantly increase traffic on the Internet. And if a significant number of individuals start using them, people will no longer be able to afford to operate proxies for free.
However, proxies are already used in a number of places for other reasons. Filtering proxies censor certain types of web content in libraries, schools, small oppressive countries, and large oppressive businesses.[27] Caching proxies remember pages that were recently accessed by users, and can quickly retrieve them for other users, increasing speed and reducing bandwidth.[28] Firewalls that filter all packets sent to the Internet frequently provide proxies for web content.[29] Converting an existing proxy to remove identifying information is easy, and anonymizing proxies are an excellent option for places where another form of proxy is already in use.
Hypertext Transfer Protocol (HTTP)
Hypertext Transfer Protocol (HTTP) is the protocol used by web servers to fulfill user requests for web pages. One of the distinguishing features of HTTP (as opposed to File Transfer Protocol or Telnet) is its instantaneous nature. There is no real connection between a web server and browser during an HTTP session. The browser makes a request, the server fills it and moves on to its next request. When your browser makes another request, it does so as if it had never made the first. This is a good thing because it reduces server load (the server does not need to keep a connection open with your computer while you browse a page) but it is a bad thing because your browser must make a new connection for every request and the server treats every request as unrelated to any other. So-called "stateless" protocols are a problem for features like shopping carts or password saving because such features require some memory of what happened in previous requests from the same browser.
Cookies
Cookies were created to add “state” to HTTP. They are bits of information, generally text, that may be stored on either a user’s computer (client-side cookies) or on a web server that the user is visiting (server-side cookies). Client-side cookies may be specified to be readable by only a particular machine (e.g., personal.), only machines in a certain domain (e.g., ), or any computer. The readability scope of server-side cookies depends on the network and architecture of the server site (for instance, data may be stored in a central LDAP database, discussed below).
Users, in general, have very little control over the use of cookies. Some web browsers allow users to completely disable cookies (which prevents the user from taking advantage of a large number of useful sites and services in the web industry), to accept or reject them one by one (which can become very tiresome very quickly), or to accept cookies which may only be read by the specific server which issued them. Users have no control over server-side cookies. Although website providers have more control over server-side cookies, they generally use client-side cookies for several reasons. To begin with, web browsers automatically save client-side cookies between web sessions, and browsers often keep a different set of cookies for each user on a computer. The maintenance of server-side cookies between sessions, by contrast, generally requires a user to log in to the server at the beginning of each session to identify himself, although IP address logging, which may not indicate the same computer across multiple sessions, may eliminate this requirement. Additionally, increasing the scope of readability for a client-side cookie (e.g., for a whole domain) is much easier than for a server-side cookie. Sharing server-side cookies often requires a larger investment in a particular server architecture and intranet.[30]
Because of their persistence, as well as their user-level targetablility, client-side cookies serve as excellent tools to track users and to tie together various pieces of data collected about them. A server may assign a user a unique ID in a cookie. This may serve the same basic identifying function as an IP address, but the ID is more likely to be traceable to a single, unique user – although, unlike an IP address, a technically savvy user may reject or even edit/hack client-side cookies. Once a user has a unique cookie ID, he may be tracked across a site or even multiple sites in a domain. Then, if at any of these sites a user provides other information about himself, such as an address, as in the Playboy scenario, or an interest in a certain book on (by adding it to his "shopping cart"), the new information can be tied together with the user ID and any other information collected.
An Alternative to Cookies: Client-Side Targeting
DoubleClick, , and other targeted web advertisement companies use cookies to direct ads at individuals based on their browsing habits. An alternative to this system would be one in which the web browser would log browsing habits and pick ads itself. Targeted ad companies would no longer need knowledge about individuals to target advertising.
In the simplest version, an ad company would send multiple ads with lists of keywords. The browser would pick the one most appropriate for the user based on browsing habits and tell the ad provider which ad it picked through an anonymous protocol, like the survey protocol described above.
In more advanced versions, an ad company could send a bit of Java bytecode that the browser would run to decide between ads. The browser could also have a profile of the user filled out by the user when the browser initially runs. If connections to the ad provider are properly anonymized, the provider could have a conversation with the browser to pick the best ad.
Guaranteeing that an ad company cannot tie back ad choices to individual browsers is very important; otherwise, this technology could be more dangerous than cookies. An ad company could ask very specific questions, log the results, and build a much more detailed profile.
Other Web Technologies
Lightweight Directory Access Protocol (LDAP) Databases
Lightweight Directory Access Protocol (LDAP) was designed to provide quick access to a directory or database of information over a network. An LDAP database, like any database, can store information in, and look up information based upon, various fields. Thus, an LDAP database might store users, their e-mail addresses, preferences, mailing information, etc. LDAP is useful for collecting personal data on the Internet because multiple servers within a website provider’s intranet may easily and quickly access a central system of LDAP database servers. Because most modern-day, industrial-strength websites, actually involve multiple mirrored front end servers and multiple layers of computers behind the front end in order to handle heavy loads, an LDAP-style system allows users’ personal information to be collected, distributed, and stored more easily.[31]
This technology has important implications for collection of private data. As stated, LDAP databases can store a wealth of information, and the LDAP front end protocol and implementation allows for rapid storage and retrieval of this information. These properties alone greatly reduce the cost of collecting private information. Additionally, because LDAP allows many machines to easily centralize data, collected personal information can be made available to a larger number of server machines and websites. In essence, LDAP is a technology that provides a backbone for large scale collection and sharing of users' private information. Without a technology like LDAP, several servers, on the same site or different sites, might collect a large amount of information about a user, but the machines would unable to easily collate the data. Such a situation would be somewhat like the "fog of war," where many events are observed in many different places, but the communication of information from various battlegrounds to the generals in the army headquarters is difficult. LDAP provides the roads and couriers to bring the information to the headquarters.
JavaScript and VBScript
JavaScript and VBScript are two similar technologies (the former developed by Netscape, the latter by Microsoft), that direct web browsers to perform certain functions and transfer certain information. When a user downloads a page from a server, that page may contain these technologies, which instruct the browser to perform certain tasks either automatically or upon certain user actions. Most data-collection methods that utilize these technologies rely on bugs in the implementations and specifications of the scripts. Although most or all of these bugs have been corrected in the latest versions of the browsers that support JavaScript and/or VBScript, a large number of people are still using versions that harbor security weaknesses. Thus, a brief discussion of these weaknesses is warranted as part of the current state of technology.
Scripts can obtain information about a user by reading their web caches (pools of recently visited web pages that a browser often keeps for better performance) or reading data about a computer type or the files within it. This data is often sent back to the server through a hidden form similar to a typical HTML form, except that all of the fields are invisible. Needless to say, these methods for collecting personal data are sufficiently shady that most or all mainstream commercial websites do not utilize them. Despite this, the potential risk of privacy violations through script security holes is very high.
Java and ActiveX
Java and ActiveX are two somewhat similar (for our purposes) technologies (the former developed by Sun, the latter by Microsoft) that allow small, contained programs (applets or components), originating from a web server, to be executed on a user’s computer. Java programs are usually restricted by a sandbox or a security manager. The former is a sealed off environment on the user’s computer which contains no personal data or files, and the latter is a more granulated system that allows programs to request -- and be allowed or denied -- access to various personal computer resources to the extent that they cannot collect any useful personal data. However, if the user explicitly grants permissions to the Java programs, they may read or manipulate files and settings on the user's computer, as well as send information to another machine on the Internet. Only the latest versions of Java implementations provide a full security manager as opposed to a sandbox.
ActiveX is based on the all-or-nothing web of trust system. A user downloads an ActiveX component onto his system, and if he allows it to run, it has free reign on his computer. ActiveX components can be signed by a "trusted entity" that vouches for the identity of the original author, and sometimes, the security of the component. It is up to the user to decide whether he trusts the author and the "trusted entity."
Despite the potential for extra security protection in the latest versions of Java and ActiveX, the ability of a site to collect private information is still quite strong. In the end, a user must trust those sites to which he does grant special access to protect the confidentiality of the information they collect. Non-technological standards, such as TRUSTe (see below), help to alleviate this problem to some extent.
E-Commerce
Payment
Credit cards are the most common method of payment on-line, but they have a number of problems associated with their use. Users must disclose their names, card numbers, and card expiration dates. Furthermore, credit cards leave an audit trail; the credit card companies have a log of almost all purchases made on-line. To solve the privacy problem (and more importantly, the potential problems of on-line credit card fraud), cryptographers have come up with a number of secure, on-line payment protocols. The goals of such protocols, as defined by T. Okamoto and K. Ohta, are:
Independence: Does not depend on physical location or objects (can be used on-line).
Security: Cannot be copied.
Privacy: No one can trace users.
Off-Line Payment: Does not require a permanent network connection for use
Transferability: Can be transferred between users (merchants no different from normal users).
Divisibility: A large e-bill can be split up into smaller e-bills (and the reverse). [32]
DigiCash, once the dominant player in this field, recently filed for Chapter 11 bankruptcy. Several other companies are currently developing smart cards, and in the process, digital cash. Two proposed payment protocols for protecting privacy under a digital cash regime are outlined below.
Digital Cash Protocol Type 1
In the first protocol, each denomination is tied to a public/private key pair. Owners of that denomination hold the private key and a banking institution holds the public key. When a buyer makes a purchase, the seller creates a private/public key pair, and shows the buyer the public key. The buyer sends an anonymous, encrypted instruction to the financial institution, requesting that the money be transferred to a new public key. He signs the request with the old private key. The financial institution publicly broadcasts a signature of the transaction, so the seller knows the money is available under his private/public key pair.
This protocol meets the needs of independence, security, transferability, divisibility, and privacy. It fails for smart cards and off-line payment.
Digital Cash Protocol Type 2
Most cryptographic protocols designed work with smart cards are based on a physical scheme:[33] Alice prepares 1000 money orders for $100. She puts each, together with a piece of carbon paper, in a different envelope. She hands the 1000 envelopes to the bank. The bank verifies that 999 of the envelopes contain a money order for $100, deducts $100 from Alice's account, and blindly signs the last one. Alice gives the money order to a merchant. The merchant verifies the bank's signature, and accepts the money. The merchant takes the money order to the bank, which verifies its own signature, and gives the merchant the money.
Note that electronically, the bank can sign an "envelope" by signing a one-way hash of the money order -- the "closed envelopes." The bank '"opens" them by requesting that Alice show a money order, and verifying the hash on that order.
This protocol meets five of the six goals. Though Alice can easily copy the money order and use it over, this can be corrected by adding a random uniqueness string to each money order. When the bank receives a money order, it can verify that it has not received a money order with the same uniqueness string before.[34]
Although this protocol prevents Alice and the merchant from cheating the bank, it does not identify whether it was the customer or Alice who tried to cheat the bank. There is an additional protocol that verifies this, although it is impossible to explain in detail without a presenting a stronger cryptographic background. The basic idea is:
Alice, in addition to putting a uniqueness string on the money order, places on it a series of 100 "identity pairs," designed in such a way that any one element of a pair does not reveal her identity, but any matching pair can be combined to give her identity (name, address, etc.). When Alice makes a purchase, the merchant asks Alice to reveal a specific half of each identity string ("Show me the second string from the first pair, the first from the second pair ..."). If Alice tries to cheat and copy her money order, the second time she tried to use the money order, the merchant would ask for a different set of identity strings (the chances of asking for the same set are one in 2100). The bank could match up two identity pairs and confirm that Alice tried to cheat. If a merchant tries to cheat, he would only have one set of identity strings, and the bank could tell it was the merchant.[35]
Perfect digital cash allows for significant abuses. For instance, with any one of the protocols in the second set, consider the perfect crime:
Alice kidnaps a baby. Alice sends the law enforcement authorities an anonymous note with the hashes of 1000 money orders, and a request that a bank sign them and publish the signatures in a newspaper (or else the baby dies). The authorities comply. Alice frees the baby. Unlike physical systems, there is no way to track Alice. She is free to spend the money.[36]
Delivery
When goods are ordered on-line, they need to be delivered. Traditional delivery methods require the user to disclose his name and address. A number of anonymous delivery methods exist that are designed to circumvent this problem. Notice the similarity in the three methods to status quo, anonymizing proxies, and anonymizing routers for delivering packets on the Internet.
P.O. Boxes
Classically, anonymous delivery has been handled through post office boxes. The user is assigned a unique, untraceable number by the post office. Deliveries can be sent by that number without disclosing the user’s identity.
But post office boxes are a poor solution. They are expensive, and most people cannot afford to have a unique box for each transaction. Eventually, a person's box may be tied back to his identity, and all of the previous transactions are compromised.
Cryptographic Delivery
The post office publishes a public key every month. When a user gives out his address, he encrypts it, together with an expiration date and a few random bits, with the post office’s public key. The post office can decrypt it and deliver to that address, but the sender cannot trace it down to a specific person. Further, unsolicited mail can only be sent for a short time, because the address expires. The encrypted data could also contain the merchant’s name and address, so the post office would only deliver packages sent by the merchant.
Trusted Third Party
The product is sent to a trusted third party, which forwards the product to the intended recipient. This doubles the cost of shipping, and it is often not possible to find a trusted party offering this sort of service.
Case Study: A Technological Solution
In recent times, the lack of good privacy on the Internet has been spotlighted and examined following the pressure from numerous sources. The general Internet user’s desire for stronger privacy protection as he uses the Internet[37] and the impending possibility of governmental intervention to help create stricter privacy controls[38] have driven many individuals, corporations, and organizations to try to create solutions to the expressed privacy concerns. For example some individuals have created anonymizing remailers for anonymous e-mail,[39] and others have created anonymizing browsers or proxies.[40] Due to the difficulties users encounter trying to find websites’ privacy practices, many individuals and organizations have made proposals to control the release of their personal information.[41]
In June of 1997, Netscape Communications, Inc., FireFly, LLC., and Verisign, Inc., proposed the Open Profiling Standard (OPS) to address concerns about privacy on the web.[42] OPS required that when a user goes to a website, the website may (via HTTP, as was proposed) ask the user’s computer for information about that user. Any piece of information about the user can be marked by the user as something his computer is always allowed to freely distribute (ALLOW), something that should never be distributed (DENY), or something the user should always be prompted to decide upon at the time of request; this information would be kept locally on his/her computer on a "virtual business card" or vCard,[43] which contains certified information about the user as the user chooses.[44]
Platform for Privacy Preferences (P3P)
While OPS has for the most part fallen by the way-side, another proposal under development during and after the wake of OPS, adopting many of its features, is the Platform for Privacy Preferences (P3P).[45] This proposal, sponsored by the World Wide Web Consortium (W3C), has been in development since October of 1997 and is still under development today. The concept behind P3P is that one can set up a flexible software agent to represent the user’s privacy interests that will then interact with websites as user moves around the WWW to create agreements as to what information the user agent, and thus the user, will give to a website, as well as how the website can use this information.
|[pic] |
| |
|Figure 1: A P3P pseudonymous interaction with a service[46] |
A P3P session begins when a user makes a request for a URL (see Figure 1, above). The contacted server then replies to the user with one or more machine-readable P3P proposals encoded in Extensible Markup Language (XML)[47] as part of the HTTP headers. In this proposal, the organization maintaining the server makes a declaration of its identity and privacy practices. This proposal, applicable only to the requested URL and similar sites,[48] lists what data elements the server would like to collect from the user while the user is connected, how those data elements are to be used, and specifically, whether those data elements will be used in a personally identifying manner.[49]
The proposal is then parsed by the user’s agent, which would most likely be an extension of the user's browser/client software. The agent would compare the proposal to the user’s privacy settings. If the user already has settings that would agree with the proposal, the proposal may be automatically accepted If the user has no settings appropriate to the proposal, the user’s agent may present the user with the proposal and prompt for a response, reject the proposal outright, create an alternative proposal (counter-proposal) and send it to the server, or ask the server for an alternative proposal. Once a mutually acceptable proposal is found between the user’s agent and the server, an agreement/contract is met, and the user will gain access to the service.[50]
P3P Strengths
P3P has a number of important, inherent strengths. Many of these strengths stem from the fact that P3P was designed with flexibility in mind. In this respect, P3P is very different than many of the other W3C meta-data activities, such as the Platform for Internet Content Selection (PICS). PICS is used in the privacy domain to statically define privacy practices (as well as content), and the only room for control based upon a PICS tag would be a complete accept or a complete reject.[51] P3P allows for far greater freedom to negotiate, for multiple proposals may be sent by the service, and multiple counter-proposals and requests may be made by the user’s agent before an acceptable contract is reached. There are also a number of points in the use of P3P where additions or changes are possible. For example, one important possible addition is for the user agent to store the proposal IDs (also called propIDs) that are transmitted on the agreement of a proposal.[52] The next time the user tries to access the site, the saved propID need merely be sent with the user’s request for the service to show that a previous contract has already been struck between the user and the service and the user desires to use the same contract again.[53]
Another boon brought about through flexibility is the fact that the P3P specification defines a standard set of base data elements[54] that all P3P related software should acknowledge, but provides a mechanism that will let services create new data elements for users to consider. Also, the fact that the W3C is making P3P's design generally available will encourage its adoption and improvement, fostering competition and innovation.
During a P3P negotiation, the creation of Temporary Unique IDs (TUIDs) is a mechanism that allows P3P to keep track of the state of the current negotiation: basic information required to determine the current state of the negotiation, such as who had last "spoken" (the user’s agent, the service, etc.) and the IP address of the user (such that the service knows where to send data), etc. These TUIDs are necessary for the connection and negotiation to occur but are especially useful to websites trying to collect aggregate information on the users that connect to their website.[55] Pairwise Unique IDs, or PUIDs, are an additional mechanism with which to give information to be collected in aggregate to the service. If a user sets up his user agent to use PUIDs, additional information about the agreement that has been reached will be transmitted to the service for collection and aggregation.[56] The combined use of PUIDs and TUIDs are a possible improvement on the current cookies mechanism with which the website can collect information in aggregate about its users. Also, to facilitate the communication of personal information when it is desired by both the website and the user, such as in the process of making an on-line purchase, the P3P user agent will store a base set of user data elements locally that can then be sent easily while connected to a website via P3P. In fact, the combined use of a data repository with PUIDs and TUIDs to replace cookies is actually highly beneficial to businesses desiring to collect information on their users. The cookie structure as it currently exists only allows cookies to exist for three months. The use of these P3P features would offer a website more precise and longer lasting information on the users of their service[57], and it would do so, unlike cookies, in a manner which the user will find acceptable – or it won't be done at all.
Another positive point in the design of P3P is its use of current existing technological standards. The proposed transport mechanism of the P3P proposal and data elements is an extension of HTTP 1.1, the standard protocol used for WWW information transport.[58] P3P also makes use of XML for "creating elements used to structure data" and thus to communicate the machine-readable P3P proposals and counter-proposals. The Rich Data Format (RDF)[59] is used to provide a "model for structuring data such that it can be used for describing Web resources and their relations to other resources" for the data elements in the proposal.[60] The use of these standards will make the development of servers and user agents capable of making P3P negotiations come about more quickly and easily. Also, the use of a harmonized vocabulary for the proposals means that there will be no misinterpretation between the public and a service about what the privacy practices described in the proposal actually mean, and will also enforce the requirement of certain basic privacy practices to be revealed.[61] Furthermore, the use of P3P does not inhibit the use of other technological privacy solutions, such as anonymized browsing.[62]
P3P Problems
P3P has a number of faults as well, however. The design for P3P,[63] now in its third revision, has grown somewhat overly large, complicated, and unwieldy.[64] This excessive verbosity in the definition of the P3P communication syntax will be a burden on the shoulders of developers desiring to write software to be used in P3P transactions, and may even be a deterrent to some developers to begin to write such utilities at all. Also, the extra amount of communication that must occur before a user accesses a website in a "normal" fashion will create a much greater amount of network traffic and load on web servers that will inhibit the overall speed and growth of the Internet. The fact that P3P communications are not encrypted or protected in any other way also leaves the user data transmitted via P3P open to third party interception.[65]
Implementation of P3P servers and agents, and issues regarding the penetration of P3P, trouble the success of P3P. If agents are not easy to use, people will not want to bother with the initial setup of a P3P user agent,[66] nor will they want to deal with proposals that cannot be decided by their agent and that request dialog from them. The authors of popularly used user agents will be in an extremely important position in the creation of the default profile with which the agents are distributed. Currently, Microsoft and Netscape dominate the WWW browser market,[67] and if either was to create a user agent built into their browser, the default profile with which that browser/agent was submitted would drastically change the privacy practices of the entire Internet. Finally, the biggest problem impeding the desired penetration of P3P is the lack of any enforcement of the P3P negotiated contracts for privacy policy. Essentially P3P assumes that after having reached an acceptable contract with a service, the user will then trust the service to abide by that contract – an assumption that simply cannot be made.[68]
On a more basic level, the fact remains that websites currently have no incentive to adopt P3P – the current legal regime allows them to collect information at-will,[69] and so they have no reason to expend time, effort, and resources to form contracts with particular users to obtain their data. As long as websites do not adopt P3P, users will not push for the product – and so long as users do not push for it, websites will not feel pressure to adopt it. This point is discussed in more detail in the Markets and Norms section.
If the market's current resistance to the adoption of P3P can be overcome, P3P has a great chance of achieving its desired goals – to better protect the privacy of users while supplying websites with a clean and fair amount of information on the user. In fact, both Microsoft and Netscape have made numerous public statements as to their "commitment to privacy," and it is widely believe that companies would create user agents for P3P, upon the completion of the P3P specification. The most popular web server being used today, Apache, has made statements affirming its commitment to P3P, as well.[70] With some mechanism in place to encourage these, and other sites, to make good on their commitments, P3P could likely succeed.
Law
There are currently no legal limits on the use of information gathered through the methods described above in the absence of an explicit promise by the website to limit the use of such data.[71] To date, federal governmental response to the possibility of privacy violations on the Internet has been to recommend industry self-regulation.[72] However, a review of the current legal patchwork regarding informational privacy provides some insight as to how privacy is traditionally conceived, and protected, in the United States. Moreover, the erratic development of privacy law in the "real world" may be indicative of future difficulties with protecting privacy in cyberspace.
In the United States, privacy is protected by three mechanisms of law: constitutional law, case or common law, and statutes. As the supreme law of the land, the Constitution provides the framework within which the limits of privacy protection operate. Federal and state statutes, operating within the confines of the Constitution, explicitly regulate behavior and provide protection for privacy as conceived by the vox populi. State and federal courts interpret statutes and apply constitutional principles, generating case or common law, which, by precedent, govern future legal decision-making.
Constitutional Law and Common Law[73]
In 1791, the Bill of Rights was created to protect the people of the United States from the government.[74] Primarily through the First, Third, Fourth, and Fifth Amendments, various "zones of privacy" are protected from federal[75] government intrusion.[76] Although the right to privacy may not have been explicitly stated as a right of U.S. citizens, various courts have interpreted several Amendments[77] to provide important ancillary protections for privacy.
The First Amendment[78] is the authority behind freedom of speech. Although the constitutional prohibition on the regulation of speech usually concerns the freedom to speak, the doctrine also includes the freedom not to speak.[79] Although the right to anonymity -- the right to withhold speech identifying oneself -- has been repeatedly upheld in the context of the print media, it is still unsettled whether this protection will be extended to on-line media.[80] The First Amendment also provides for the right to free assemblage. It has been interpreted to protect the "freedom to associate and privacy in one's associations."[81] For example, this has been extended to privacy in one's marital relations.[82]
The Fourth Amendment[83] protects people from searches based on a "reasonable expectation of privacy" test[84] by excluding from criminal trials evidence obtained by an unconstitutional search. While the vagueness of the term "reasonable expectation" has foreseeably led to much litigation, the translation of the Fourth Amendment to the on-line world adds additional wrinkles to the debate over the meaning of the Fourth Amendment. Harvard Law School Professor Lawrence Lessig has lectured about this problem, pointing out that technology will soon make it possible to conduct "burdenless" searches.[85] The Fourth Amendment prohibits "unreasonable" searches – and the newest advances now bring to light the latent ambiguity behind the term. Does "unreasonable" really refer to expectations of privacy or to the burden upon the individual searched?
Common Law
The Constitution provides protection for private citizens from the government; for intrusions of privacy from non-state actors, common law has conferred some protection as well.[86] Two basic areas of common law have been invoked to preserve people's right to privacy: tort law and contract law. Tort law involves wrongs committed by one person to another; the courts have long recognized the tort of invasion of privacy. Contract law involves agreements between parties and may govern the level of privacy granted, either explicitly (as in a contract for data that includes privacy provisions) or implicitly (as in an informal employment contract).
Tort Law
William Prosser, the original draftsman of the Restatement (Second) of Torts, delineated the four actions in tort for invasions of privacy as:
1) intrusion upon the plaintiff's seclusion or solitude, or into his private affairs;
2) public disclosure of embarrassing private facts about the plaintiff;
3) publicity which places the plaintiff in a false light in the public eye; and
4) appropriation, for the defendant's advantage, of the plaintiff's name or likeness.[87]
There are many exceptions and defenses to the above claims,[88] and it is often difficult in the privacy realm to specify what damage resulted from the wrong,[89] making these doctrines very difficult to use in court.
According to Joel Reidenberg, most state courts recognize actions for at least one of these privacy invasions[90] and some have codified aspects of the four actions in both civil and criminal statutes.[91] Yet Reidenberg notes that this is not the case in the majority of states. New York, for example, only allows the misappropriation claim,[92] and Minnesota is reputed to disallow all four actions for privacy intrusion.[93]
Contract Law
Whereas tort law awards compensation for intrusions on privacy after the fact, contract law attempts to set the terms of the "intrusions" beforehand. Most of the measures suggested to protect online privacy, either by technology or by statute, inherently rely on contract law – that is, they envision people contracting to "sell" information about themselves in exchange for access. This means that all of these measures are limited by all of the flaws that exist in contract law, like informed consent, unequal bargaining power, and mandatory non-negotiable contracts (also known as contracts of adhesion). For example, some websites offer basic (and superficial) information about their privacy policies and warn the user that use of the site is conditioned upon acceptance of these practices.[94] However, there is no opportunity for the user to bargain over the terms of the contract – the terms are offered on a take-it or leave-it basis. Because most sites have similar policies, or do not delineate their practices at all, the user generally has only the choice between surfing on the terms of website owners or not surfing at all. Further, there is little point to a user rejecting a particular website over its privacy policies, as many other sites – which do not reveal their policies – may use the user's data, and so any particular transaction has little value to the user.[95]
However, in real space, the legal issues involved in cases revolving contract terms with explicit privacy protections are relatively uninteresting. Rather than presenting novel issues of law, the translation of contract law from the real world to the cyberworld would seem to lead to consistency and present little difficulty.[96]
In those cases where terms governing the protection of privacy have not been explicitly delineated in contracts or agreements, the courts have been more divided. Privacy implied in contracts mostly surfaces as an issue in workplace privacy, where employees may or may not have waived their right to privacy implicitly by agreeing to work for an employer.[97] However, the trend appears to be that the courts will allow most monitoring on the theory that there is no "reasonable expectation of privacy" in the workplace.[98] Techniques include video surveillance, keystroke monitoring, and monitoring of e-mail and Internet usage.[99]
Federal Statutes[100] and Common Law[101]
In 1977, recognizing the danger posed by new technology, Congress established the Privacy Protection Study Commission in order to conduct an extensive study of privacy rights in a world with computers.[102] The Commission focused on record-keeping in eight different areas: (1) consumer-credit; (2) the depository relationship; (3) mailing lists; (4) insurance; (5) the employer-employee relationship; (6) medical care; (7) investigative reporting agencies; and (8) education.[103] The study concluded that, even within the limits of law, privacy was not sufficiently protected from government, nor from private industry.[104] Despite this early warning, it is only recently that Congress began to move towards more protection of privacy.[105]
While the substantial number of Internet bills introduced recently in Congress seems promising,[106] very few bills have actually been enacted, suggesting that the government is reluctant to make many changes to its policy on the Internet. Unfortunately, Congress' inaction, particularly in the area of privacy, does not mean that the status quo will prevail. The currently allowed level of "legitimate" access to information allows a great deal of room for the quickly improving methods of collecting, aggregating, organizing, storing and "mining" data. Without a radical move by the legislature, novel cases and controversies will continue to arise, the legal vacuum will have to be filled in "on a piecemeal basis by ad hoc judicial decisions, initiatives by state attorneys general and other state and local regulators, and by restrictions imposed on the United States from abroad"[107] – providing little consistency and even less peace of mind for online participants.
Legislation regarding privacy has been scarce and fairly spotty; legislation regarding privacy online is even rarer. The government deals with particular areas on an ad hoc basis, largely in response to public outrage,[108] or as an afterthought in legislation dealing mainly with other bodies of law. Moreover, most of the legislation has been in reference to the government intruding on an individual's privacy. Very little protection has been added for intrusions by private actors.
Privacy Act of 1974
Probably the earliest important piece of privacy legislation was the Privacy Act of 1974 (amended).[109] It granted individuals the right to see, copy, and correct their federal agency records, as well as to restrict disclosures of the information without consent. The limitation is that the Privacy Act only applies to government actors.
Privacy Protection Act (PPA) of 1980
The government made another important move with the enactment of the Privacy Protection Act (PPA) of 1980.[110] The PPA prohibits law enforcement from searching or seizing "work product" and "documentary" materials from journalists and publishers unless they have probable cause to believe the person possessing the materials is involved in a crime, and the materials sought are evidence of the crime. Thus, online systems and their users are protected by the PPA "to the extent they act as publishers and maintain publishing-related materials on the system." Again, this was a limitation against government action, yet provided almost no protection from private entities.
Electronic Communications Privacy Act (ECPA) of 1986
With the Electronic Communications Privacy Act (ECPA) of 1986, the government finally took steps to limit the reach of private actors. Enacted to amend Title III of the Omnibus Crime Control and Safe Streets Act of 1968, which limited the use of telephone wiretapping, the ECPA covers all forms of digital communications, including private e-mail. Title I of the ECPA[111] prohibits unauthorized interception and Title II governs unauthorized access to stored communications. The distinction between messages in transmission and stored messages is important because transmitted messages are afforded a much higher level of protection than stored communications; Title II provides for lower fines, higher burdens of proof, and lower requirements for security.[112] Courts, following the foundational case of Steve Jackson Games v. United States Secret Service,[113] have interpreted Title I very narrowly, leaving stored e-mail -- even where a user has not yet accessed it -- only Title II protection.[114] It is questionable whether e-mail packets "stored" on routers en-route between mail servers would get Title I protection, but the courts have not yet discussed this issue.
Courts have been extremely reluctant to find that messages were intercepted during transmission. Moreover, employers may avoid liability under Title I by showing that the employee consented to the interception either expressly or by implication. Under the "ordinary course" exception, an employer may intercept an employee's e-mail communications in the ordinary course of its business if it uses "equipment or [a] facility, or any component thereof" furnished by the provider of the electronic communication service in the ordinary course of its business. However, legitimate purposes may include monitoring to reduce personal use.[115]
A person violates Title II of the ECPA, the Stored Communications Act, if he or she "intentionally accesses without authorization a facility through which an electronic communication service is provided." Such unlawful invasions are more severely sanctioned when the violation was motivated by "commercial advantage, malicious destruction or damage, or private commercial gain." There are, however, two major exceptions. There is no violation of the Stored Communications Act when the conduct is authorized "by the person or entity providing a wire or electronic communications service." Many legal commentators warn that this exception may be interpreted by the courts to mean that private employers who maintain a computer system have the ability to browse employee e-mail communications without violating the ECPA Title II.
Under the user exception or consent exception, the Stored Communications Act does not apply to conduct authorized "by a user of that service with respect to a communication of or intended for that user." Such authorization may be expressly given, and in some cases, reasonably implied from the surrounding situation.
One final exception to the ECPA may be required by the Constitution. Since the jurisdiction of Congress is limited to interstate commerce, the definition of "electronic communications" under the ECPA is limited to communications and systems which "affect interstate or foreign commerce." Therefore, a computer system which does not cross state lines may not be covered by the ECPA. This would seem to exempt company-owned, internal e-mail systems.[116]
These acts and other similar laws protect areas as broad and diverse as the interception and disclosure of electronic communications,[117] protection for government-maintained databases,[118] regulation of credit reports[119] and financial records,[120] telemarketing,[121] and the "Bork law" that protects video rental records.[122] Unfortunately, the industry-specific approach taken thus far by the government has not produced a general protection for personal data online. Moreover, some experts contend that existing provisions are inconsistent if not contradictory.[123]
Legislative Outlook
Unfortunately, it appears that a general protection for online information will not be created any time soon. Except for a few pockets, such as encryption legislation[124] or protection of children,[125] the probability of congressional action on any number of privacy bills is rather low. Echoing the thoughts of other commentators, Nicholas Allard conjectures that:
The immediate impact on Congress of the FTC's decision to give industry (IRSG) self-regulation a chance to work, and the uncertainty over how this approach can be reconciled with the European Union's privacy rules, probably will derail any action on privacy legislation this year. [126]
Regardless of the expectations for enactment, most of the currently proposed legislation concerning privacy, abundant thought it may be, would not create a general protection for online information. Instead it replicates the past governmental pattern of providing industry-specific measures.
The proposed on-line privacy legislation can be divided up into five main categories:[127]
1) Protection of Children
2) Protecting Personal Identification Data
3) Protecting Medical Records
4) Regulating Direct Marketing and Unsolicited E-Mail
For a more complete description of the proposed legislation, please see Appendix, Table of Pending Legislation.
The European Data Directive
While the U.S. has been moving slowly on the issue of privacy, this is not solely a domestic issue – and the U.S. needs to consider its role in the global information market. The most urgent consideration, the European Union Data Directive,[128] went into effect October 25 of this year. The Directive sets out privacy standards to be observed in the collection, processing, and transmission of personal data (standards that are rarely observed in the US). European countries are also directed to prohibit transfer of personal data to countries that do not "ensure adequate levels of protection."[129] Although the Directive was passed in 1995, it was only this past summer that U.S. government and industry began to seriously entertain the thought that European Union would actually find U.S. practices not up to European standards of data protection, and consequently restrict data flow.[130] In fact, until very recently, the U.S. response had been to lobby European countries to convince them that the current U.S. policies were adequate.[131]
Article 25 of the Directive has caused a stir in the United States because it prohibits transfers to countries that do not have similar privacy regulations giving "adequate protection" to consumers. The most basic provisions of the Directive are quite contrary to the status quo in the United States. For example, the Directive, if enacted into law by an EU member state, would require that data collectors provide advance notice of their intent to collect and use an individual's personal data;[132] in addition they give that individual access to her data,[133] the means to correct it,[134] and the ability to object to its transfer to other organizations.[135] Moreover, the enacted Directive would require that data collectors maintain the security and confidentiality of the personal data and only process personal data for specified, explicit, and legitimate purposes.[136] More particularly, the common use of Internet cookies in the U.S. may be especially troublesome to the European Union Privacy Commission, which has previously stated that "transfers involving the collection of data in a particularly covert or clandestine manner (e.g. Internet cookies) pose particular risks to privacy."[137] In theory, conflicts such as these could keep the United States off the Privacy Commission's White List of countries that provide adequate privacy protection.
Recognizing these dangers, various U.S. parties have begun to reconsider their privacy policies. The Commerce Department proposed guidelines[138] to help U.S. companies meet the European Union's new privacy rules. The proposed guidelines include: notifications to individuals about the collection and use of personal information; instructions about how to limit or stop the use of that information; being told when information is being sold, rented, or shared with a third party; disclosure about how secure that information is from being stolen or misused, and instructions to individuals about accessing any and all information a company has obtained about them.[139] As of late November, perhaps in recognition of the possible embargo in information, the Direct Marketing Association had agreed to endorse conditionally a series of guidelines proposed by the Commerce Department.[140] What is encouraging is that these changes have come about despite the fact that the European Union had agreed to allow information to flow unimpeded between U.S. marketers and its member nations.[141] How long this state of affairs will last, however, is unknown.[142]
Markets and Social Norms
When Secretary of Commerce William Daley admonished businesses earlier this year that protecting privacy was in their best interest, he was talking about the threat of government regulation, not market forces.[143] Businesses interested in collecting and sharing personal information about their site visitors have never had it so good. The collection, storage, analysis and sharing of information is cheap in today’s economy and consumers willingly part with personal data in a market where divulging that data without privacy protection is the norm.
As discussed above, all currently available web server software logs IP addresses and various other pieces of information about every HTTP request it processes. In order to collect additional information from web users, all a site operator needs to do is code an HTML fill out form and CGI script to process its results. Many form examples and tutorials are available on the web[144] but form processing CGI programming used to be an impediment to some users.[145] Since free services now e-mail responses directly to the form author, even that barrier has been eliminated.[146] That means that setting up a website that collects personal information is now no more expensive than setting up a website that doesn’t.[147] "Cookie" processing, as described above, is slightly more complicated but again free scripts are available on the web[148] and the subject is covered in many introductory programming books.[149]
Storage of the collected information is also very cheap and getting cheaper. Storing the name, social security number, address, phone number, income, birthday, and last 100 pages requested by a user would take approximately 5,000 bytes without any compression.[150] Using data compression algorithms, that number could be as low as 500 bytes.[151] Current prices for hard drives mean that the data for approximately 8000 users can be saved for every dollar spent.[152] In short, the collection and sale of data is easy, cheap, and extremely profitable.
Under the current legal regime – or lack thereof – and the current state of the technology, information essentially "belongs" to whatever entity has access to it. The user has little control over what information is revealed or how it is used, and very often has only the choice between handing over information or not using the Internet at all. In this way, the United States' lack of a legal framework has awarded to website owners an "entitlement" to all information that they can obtain – leaving it to users to "buy back" that information, if they can.
In a perfect market, users would, theoretically, be able to "repurchase" their information so long as the users valued the information more than the website did.[153] In the absence of transaction costs, users would be able to negotiate with each website to persuade that site not to use the data it had collected. Unfortunately, the transaction costs in this instance are huge: users cannot easily coordinate their efforts so as to exploit their market power, websites are not actual "people" and so cannot be negotiated with (leaving the users in a flat take-it-or-leave-it position), the costs of investigating the policies of individual websites are high, and even if a user is able to "repurchase" information from a single website, there will still be a myriad of other websites that the user will have to negotiate with in order to truly "own" his or her information – otherwise, the individual contract formed with the single website is valueless, because other websites will still be able to trade the information freely.[154]
Industry self-regulation has been remarkably unsuccessful in large part because of these basic realities.[155] Though the Federal Trade Commission has long advocated a system of self-regulation and has provided guidelines to industry to assist it in this effort,[156] the FTC reports that fewer than 14% of websites surveyed even posted basic information about their privacy practices, and fewer than 2% actually had developed "comprehensive" privacy policies.[157] The Electronic Frontier Foundation has also noted that despite guidelines issued by the Direct Marketing Association regarding web user privacy, most websites are stubbornly noncompliant.[158] Given the profitability of collecting personal information, as well as the costs of implementing a system of privacy protections,[159] these results are hardly surprising. In fact, whenever a particular company does make basic assurances about protecting users' privacy, it is merely opening itself up to liability should these policies be violated.[160] A perfect example can be found in the Geocities case: Geocities, a large provider of free web space, promised its customers that their data would not be sold to any other entity. As it turned out, the data was sold, and the Justice Department forced Geocities to modify its policies in exchange for dropping the lawsuit. However, rather than simply agreeing to abide by its original privacy policy, Geocities chose instead to discontinue its privacy guarantees.[161]
Some attempts have been made to solve these problems and allow for greater user control over personal information. P3P, described above, is one such proposal. Unfortunately, P3P on its own suffers from the fact that the current "free-market" regime is very beneficial to corporate interests. Commercial websites own the information now – this leaves consumers with precious little to bargain with, and it leaves websites with no incentive to adopt P3P technology. Though, in theory, widespread consumer demand for P3P might entice websites to begin to use it, such coordinated demand is unlikely arise given general consumer ignorance, inertia, and the entrenched commercial interests that have a stake in ensuring the system remains unchanged.
Case Study: A Norms Solution
In early 1996, Internet privacy concerns became so great and widespread that the U.S. government began to consider possible legislation regulating privacy practices on the Internet. Businesses on the Internet clearly did not think that this was in their best interest, fearing that governmental intervention would not be researched properly, would be too heavy handed, and would be too strict for businesses desires. Instead, efforts to create privacy self-regulation came about in an effort to head off the need for governmental intervention.[162] After hearing a talk at Esther Dyson's PC Forum in March 1996, Lori Fena, Executive Director of the Electronic Frontier Foundation (EFF), and Charles Jennings, founder and CEO of Portland Software, formed TRUSTe.[163]
TRUSTe is an effort to change the norms with regards to privacy on the Internet. The idea is to create a "trustmark" that can be displayed by websites which acts as a certification to the Internet public. TRUSTe is attempting to create a social norm that dictates if a user visits a site with the TRUSTe trustmark, he should feel confidence in the stated privacy practices of that website. This desire to shift the norms to have people feel secure while using the Internet, specifically while accessing a website that is a member of the TRUSTe organization, is even present in TRUSTe’s trademarked motto: "Building a Web you can believe in."[164] The two key principles that TRUSTe is founded on are that "users have a right to informed consent" and "no single privacy principle is adequate for all situations."[165]
This shift of norms must be accomplished on two fronts: websites must join the TRUSTe organization and abide by their rules, and users must understand what TRUSTe is, what the trustmark means, and desire to access websites with the TRUSTe mark. To join TRUSTe, websites must put together an easily-accessible public description of their privacy practices that is linked to a clearly-displayed TRUSTe mark, and they must agree always to abide by those privacy practices. TRUSTe members then pay a fee proportional to their company’s annual revenue to the TRUSTe organization and thus become official TRUSTe sites.[166] TRUSTe sites are periodically audited by TRUSTe to make sure they are in accordance with the TRUSTe rules and regulations, for it is in TRUSTe’s best interest to promote faith in its mark by ensuring that the websites bearing the mark be truthful and honest.
A TRUSTe site’s posted privacy statement must at a minimum describe seven different areas of that website’s privacy policy.[167] The first section explains what information can or will be gathered about the user (e.g., e-mail address, site pages visited), and the second section clearly identifies the entity that is making the collection . The third section explains how any collected information will be used (e.g., for anonymous, aggregate statistics, for personalization, for ad targeting). The fourth section explains with whom the information might be shared (e.g., only divisions of the company running the site, particular outside companies, the highest bidder). The fifth section describes the "opt-out" policy of the site; this policy deals with those services and collection schemes in which the user may not to participate. The sixth section explains how a user may update or correct any information collected about him. The seventh section explains the "delete/delist" policy. This policy deals with how a user may remove his information or registration from a site.[168]
For TRUSTe to be successful, it must make the Internet public aware of, and watchful for, the TRUSTe mark. Through public dissemination of information, such as that easily accessible at the TRUSTe website,[169] Internet users must be made to have faith that websites will be true to their declared privacy practices. TRUSTe is continuously striving to make people aware of what the trustmark means in an effort to have users desire to use websites with the mark.[170] The aforementioned minimum privacy practices are advertised to the Internet public, as well as the fact that if any TRUSTe member website is in breach of their declared privacy policies, the user should contact TRUSTe to seek action against the website’s publishing organization.[171]
TRUSTe Strengths
A few key strengths exist in TRUSTe’s proposed plan of self-regulation and manipulation of World Wide Web norms. First, the fact that adoption of TRUSTe is technology independent and does preclude other technological solutions. Anonymization, encryption, and similar technological solutions can coexist with TRUSTe. In fact, P3P provides the possibility for "assuring parties" to mark the privacy practices of a particular website to boost users' faith in the value of their contracts.[172] A second advantage is that, unlike P3P, no new technology is needed to be used by the websites and users. Third, as TRUSTe wishes to maintain the credibility of its mark, TRUSTe will engage in extra effort to audit the TRUSTe websites and ensure that they abide by the rules and guidelines. Finally, TRUSTe claims that it will negotiate the settlement of any breaches of stated policy between a website and user, providing the user a path of recourse if a website does not adhere to its promises. A user might otherwise have no easy remedy against a website who had broken its privacy promises.
Problems
However, TRUSTe has many problems, current and potential, that are impeding its effect on the privacy norms of the Internet. For one, it is designed primarily as a solution for businesses to self-regulate and thereby ward off governmental intervention,[173] and as such, many of the fundamental principles of TRUSTe do not apply well to small web publishers. TRUSTe’s proposed solution simply does not make it simple and useful for a private individual or small web publisher to register as a TRUSTe website. In fact, TRUSTe may even raise possible anti-trust issues, as TRUSTe's privacy requirements may act as a barrier to entry in the e-commerce market for smaller companies.[174] An additional detriment to smaller organizations trying to adopt TRUSTe is that it increases the liability of the company. A company would not necessarily wish to subject itself to possibly having to pay fines via TRUSTe for a breach of privacy for actions that, but for its adoption of the TRUSTe mark, are perfectly legal and without penalty.[175]
Another serious problem is that the TRUSTe mark does not mean anything other than that the website adheres to its stated policies – it is not an endorsement of the policies themselves, and the mark itself does not alert the user as to what those policies might be.[176] There is the potential for confusion among users, who might easily understand the mark to signal the presence of a certain level of privacy protection, and who might therefore willingly hand over information to a site with practices abhorrent to the user. When TRUSTe was first launched, it issued three different types of marks signaling associations to standardized TRUSTe privacy policies. However, many websites did not like the codifying scheme, and it was switched to a single mark.[177]
For TRUSTe to be effective, the user must examine the privacy policy of every website visited and determine, case-by-case, whether each website's practices are tolerable. This process is cumbersome and complicated, and most users will not want to be bothered to do it (though such manual checking and rechecking would be greatly reduced through the use of a technology such as P3P). Also, TRUSTe does not allow for any negotiation – users must either accept a site's policies or leave the site. Again, the addition of a technological solution such as P3P would provide some help in this regard.
Though TRUSTe is still largely unknown to Internet users, it recently signed on some very visible sites. Many of the large commercial Internet sites have joined TRUSTe, including America OnLine, IBM, Yahoo!, CNET, and Infoseek. In October 1998, TRUSTe started a special children’s related trustmark, and further dealings with the Federal Trade Commission helped TRUSTe reaffirm its significance.[178] These steps, however, are relatively small and simply not enough. Of the many millions of Internet sites that collect information about their users, only 215 are currently TRUSTe certified.[179]
It is interesting to note that a very similar approach to TRUSTe’s is about to be launched in early 1999 by the Better Business Bureau (BBB). The BBB is attempting to accomplish the same goals as TRUSTe with its own mark, the BBBOnline Privacy Seal.[180] The BBBOnline programs have almost all the requirements and stipulations of TRUSTe, with a few more base level of privacy requirements to join, such that the user has a little bit more reassurance upon seeing the Privacy Seal.[181] BBBOnline, however, will probably be subject to many of the faults of TRUSTe’s attempt at shifting public norms regarding privacy on the Internet.
The future of TRUSTe is bleak. Plagued with numerous problems that inhibit its mass adoption, it is not likely that TRUSTe will have the penetration that is necessary to shift social norms and effect personal privacy on the web. Ultimately, both TRUSTe and P3P suffer from the same problem – the lack of incentive by website owners to adopt strict privacy policies. Both are measures to improve contracting – P3P lowers transaction costs while TRUSTe distributes information – but, as was stated above, web users currently have no assets to contract with. Any information they can offer to a site is generally available to that site without a contract at all, and the web's exponential growth demonstrates that, despite fears about lack of privacy protections, users are willing to risk their personal information for Internet access. Until this state of affairs has changed, there is no reason to expect any proposal that depends on industry initiative, will be widely accepted.
Proposal
As discussed in the previous section, the current privacy protection framework does not protect individual privacy. In this section we outline a radically different privacy framework where individuals own their personal information and data collectors must contract with users for access to it. We impose sanctions on most uses of an individual's personal information not explicitly authorized by the individual and we suggest a technical solution to the high transaction costs of getting authorization.
Entitlement to Individuals
We start with the assertion that the current set of entitlements is wrong, from a distributional and efficiency standpoint.[182] From distributional and moral standpoint, we do not believe that there is any justification for allowing personal information to "belong" to a commercial entity merely because that entity has access to it – such a rule, in fact, is analogous to a real-space rule that allows anyone to break into an apartment and steal the television set so long as the homeowner left the door unlocked. Though, given the ease of locking one's door, we might have little sympathy for the homeowner careless enough to fail to take precautions, this does not mean that we have handed over the property rights in the homeowner's possessions to all passers-by. The case for refusing to hand over property rights to information gatherers in cyberspace is even stronger, as, given today's technology, it is virtually impossible for a user to "lock" his or her doors against invasion in the first place. There are also unpleasant distributional effects to awarding commercial websites, rather than individuals, the right to gather information – users, who may be composed of individuals of widely varying economic resources, may, as a group, be less able to afford to make the purchase than would be commercial entities which are, by and large, a better organized and wealthier group.
From an efficiency standpoint, the current set of entitlements is unsatisfactory, for all of the reasons set forth in the previous section. If users are too disparate and widespread a group to effectively coordinate with each other, they cannot easily buy back their information even if they desire to do so and even if such an ultimate allocation of resources would be efficient. Industry, with its superior resources, organization, and information, can most easily initiate requests, determine appropriate "price levels," and generally prevent the harm that comes from unconstrained use of personal information. It is therefore better to grant the entitlement to the user and thus force industry to "reveal" its superior information through the process of contracting.
We propose, therefore, a new legal framework awarding the entitlement of information to the individual, rather than the current system which awards the entitlement to the party which can build the better locks.[183] This framework would set the default rule at privacy for users, with three basic exceptions.
Three Exceptions:
Operational and Aggregated Data
The first exception would be to allow websites to collect that information that is functionally necessary for the communication to occur (in the form of TUIDs[184]) – for instance, the user's IP address for the time it takes to transmit data. The second exception would allow the collection of information held in the aggregate (which would be recorded in the history of TUIDs and also transferred in the form of PUIDs[185] if the user so desires). Because websites often want information about the demographic characteristics of their own users, and because such information represents no privacy threat to individuals so long as all data that would connect the information to a particular person is erased, websites will be permitted to gather this information without users' permission.[186] However, websites would bear the burden of proving that use for aggregation was not individually identifiable.
Opt-In by Contract
The final exception would be to allow parties to "opt in" to a less-restrictive system through the use of contract. Our new standard would require that to gather information beyond the exceptions mentioned above, websites first gain the explicit permission of an individual. Further, if the website wants to do more than simply use the data internally – that is, if the website wishes to sell the data to other businesses – permission would also need to be obtained.[187]
Autonomous Computer Contracting Privacy Technology (ACCPT)
The granting of such permission on a case-by-case basis, though legal, would, of course, be extremely unwieldy. Therefore, given this new legal regime forbidding websites to collect information without permission, a technological and legal solution must now be created to allow websites to easily contract into an agreement with a user as to the privacy policy to be used. We call our proposed guidelines for these agreements the Autonomous Computer Contracting Privacy Technology (ACCPT). The Platform for Privacy Preferences (P3P) proposal being developed at the W3C provides an excellent basis for what ACCPT is to try to accomplish and is adopted as the sample technological foundation for ACCPT; the technological structure of ACCPT is simply to be a P3P framework extended and revised with an eye to the legal concerns inherent in agency contracting in order to ensure fair and enforceable contracts. It is worth noting at the outset that for ACCPT to be adopted and work successfully, it must be both very simple for the none-too-savvy user, as well as have a large range of configureability for the power user. This range of ease of use and flexibility will hopefully come about in the research and development of user agents by businesses, independent organizations, and private individuals, as is the intended goal with P3P.[188]
One of the major difficulties, from a legal standpoint, of allowing computerized agents to contract away real users' privacy is the possibility of a disjunction between a user's preferences and the "deals" made by the agent. Where there is no meaningful assent on the part of the user, there is no contract.[189] With no contract, under our proposal, the website is potentially in violation of the law for having used the information without permission. In order, then, to make sure that ACCPT transactions are legally binding – and that they provide protection from liability for websites – we propose that all ACCPT programs operate with a certain degree of transparency. Novice users may not wish to delve into the bowels of the program in order to set their particular preferences, and default settings may be devised for them; however, the ACCPT program must require that the user affirmatively assent to basic aspects of these default profiles, using clear and easily-understood explanations of what the settings actually mean.[190] It is only by this sort of transparency that a user can be said to have truly assented to the contract formed by the agent.
Websites negotiating with agents identifying themselves as ACCPT compliant could, therefore, rely on those contracts as representing the will of the user, whereas they would enter into contracts with non-ACCPT technology at their peril. If the ACCPT agent employed by a particular user then turned out to be faulty in some way – say it was not transparent about its defaults, or did not properly "follow" user instructions – liability for the resulting privacy violations would lie on the maker of the faulty ACCPT technology, using a negligence standard. In this way, websites would have an incentive only to bargain with agents that truly do express the preferences of the user, while programmers would have an incentive to ensure that their products are accessible, and comprehensible, to less-skilled consumers.
P3P contains a number of beneficial characteristics that it would be wise for ACCPT to adopt.[191] ACCPT utilizes P3P's entire flexible negotiation between user and service to contract as to privacy practices. As it is designed for P3P, this flexible negotiation, with possibilities for multiple proposals sent by the service and counter-proposals sent by the user, allows for a good and appropriate agreement to be readily and easily found. P3P's adoption of already defined and used technological standards such as HTTP, XML, and RDF is another benefit worth noting; it is important to use popular standards to promote the adoption of ACCPT solutions by businesses. The use of a harmonized vocabulary is an advantageous step towards universal acceptance and understanding of P3P, and ACCPT proposes to use the same technique, and in fact retain the original vocabulary.[192] Additionally, the open and non-proprietary nature of the development of P3P by the W3C is another important point to maintain in ACCPT, for not only does open development engage well with the developmental nature of the Internet, it helps foster better and more secure technologies as well as further enable and encourage market adoption.
The actual technical differences between the adopted ACCPT base protocol, P3P, and ACCPT itself are small, but important. First, as stated above, ACCPT requires that a certain degree of transparency in its operation to ensure that users do not object to the activities of the agent . Second, ACCPT requires that the individual have some basic digital certification verifying at least key characteristics such as age and relevant geographical location.[193] This is necessary because ACCPT envisions that sovereigns – national governments, local governments, and even parents – may wish to restrict an individual's ability to reveal certain pieces of information. In an effort to enable this possibility, ACCPT will transmit in the TUID of an ACCPT negotiation the location of the user making the negotiation as it is represented in their digital certificate.[194] Upon the beginning of a P3P negotiation, the server would collect the profiles from the necessary sources according to the location of the user. For example, if a user in Pompano Beach, Florida, makes a request from an ACCPT server, the server may be required to retrieve the privacy requirements of the city of Pompano Beach, Broward county, Florida state, and the United States before continuing with the negotiation with the user’s agent. Which profiles the server must retrieve would be dependent upon the location of the user and applicable laws.[195] These profiles would then be used in conjunction with the server’s privacy desires in the continuation of the ACCPT negotiation. The actual ACCPT negotiation would then proceed in the same method as it would under P3P.[196] Ultimately, if the user failed to authorize the release of the geographical (or age-related) data, the website would be required to erase it from its files.
ACCPT would also adopt many of the optional P3P related features. To enable the aggregate collection of information by websites even in the event of failed negotiations, the use of PUIDs and TUIDs as described in P3P will be used by ACCPT in the manner mentioned earlier in the proposal. The creators of user agents will be heavily recommended to make use of propIDs and PUIDs as well as the necessary TUIDs; the use of a storage of a base set of information on the user on the user’s computer such as is possible with P3P will be encouraged as well.[197] The use of propIDs will increase accountability of past formed contracts as well as provide a network to the overall structure, and the use of PUIDs combined with data repositories on the users computers will be very beneficial to businesses due to the desire to collect data on user preferences, in a manner to somewhat similar to, but as a replacement for, cookies.[198] Also, in ACCPT, all propIDs would be digitally signed upon creation to "provide irrefutable evidence of an agreement."[199] Unlike P3P, there would be no fear on the part of the user of unenforceability of the web agreement, for with ACCPT, the trust would lie in the fact that the user knows there are hard legal backings to the ACCPT agreement.
Critique
Although the legal and technical framework that we propose as ACCPT has many advantages and benefits, in this section we identify and discuss some of the potential problems with the proposal.
Technical and Legal Complexity Added by ACCPT
Technical Complexity for the Programmer
First of all, although relatively simple, ACCPT does add an additional level of complexity. On the technical side, for example, ACCPT adds considerable technical complexity to the HTTP protocol. Unfortunately, the additional technical complexity could lock out smaller programmers, which, if history is any indication, would probably slow down the rate of development and advancing innovations of the web. Right now, the web is powered by software, written by smaller programmers and academics, and released for free public use and modification. According to a December 1998 Netcraft survey, over half of all web servers are powered by Apache, a free web server written by an ad-hoc group of volunteers.[200]
Complicated protocols can lock out small programming teams from being able to innovate. This might mean that large corporations will dominate the ACCPT compliant agent software market. As the infamous Halloween Memo, an internal Microsoft document, stated:
OSS [free software] projects have been able to gain a foothold in many server applications because of the wide utility of highly commoditized, simple protocols. By extending these protocols and developing new protocols, we can deny OSS projects entry into the market. [201]
ACCPT is an extension of the HTTP protocol and one with complex legal issues at that. Currently HTTP is trivial to implement. Even law student hackers can write HTTP clients without much trouble, particularly with the wealth of free software libraries available to help.[202] Incorporating ACCPT will be more complicated but we expect that similar libraries would be developed following the ACCPT guidelines and that the extra complexity of the ACCPT protocol would eventually be masked from most programmers.
Technical Complexity for End-Users
In addition to the added intricacy on the programming end, ACCPT agents are will require installation, either as part of a browser or separately. Users may be reluctant to set (or even read and accept) their ACCPT preferences.
In counterpoint, however, it would only be fair to recognize that the ACCPT proposal only requires certain settings for installations in order for a website to be certain that a computerized agent is authorized by the user. The installation of most computer programs requires an initial time commitment to set up preferences and the like. Moreover, the protocol could make the process of installing the browser as easy and efficient as possible. Just as the additional technology required by ACCPT can add complications, technology can also eliminate those complications, as we expect it will.
Legal Complexity for Programmers
ACCPT places legal liability for buggy software on small programmers. Although the legal framework is not excessively complicated, it may still discourage small programmers from entering the space for fear of suit. The use of a "negligence standard" may mitigate that effect but application of that standard is unlikely to be easily understood by programmers. The negligence standard is not a standard that is delineated by law or statute, but one that is given its force by the courts, as cases and controversies with concrete facts are decided. Thus, it is really only as problems come up that the standard is fleshed out. Given the importance of the free software movement, it is possible that such an ambiguous standard, with the accompanying penalties, will be highly discouraging to programmers. It is unlikely that they are willing to be guinea pigs for the legal system when they often receive little benefit for making their programs available to the public gratis.
However, such an argument ignores the fact that the ACCPT legal framework proposed is actually simpler than the legal framework that now exists. The current legal framework is a patchwork of industry-specific statutes and difficult-to-follow common law which varies by state.[203] The main innovation of ACCPT is the "flipping" of the entitlement to information. Rather than the automatic disclosure of information, with the burden on the user of the site to negotiate with the site in order to regain his or her information, ACCPT would help the user to "own" his or her information, requiring the site to negotiate with the user for access to the information. Rather than adding a layer of legal complexity, ACCPT may be better analogized to an inversion of the current framework. Moreover, the complexity of the "legalese" can be minimized by those who write the law. Given the alternative mosaic of common law rights and industry specific statutes, of which it is unlikely that programmers are any more aware, the more comprehensive and general legal backdrop proposed by this paper is preferable.
Legal Complexity for End-Users
Aside from the legal complexity presented by ACCPT to programmers, there may also be residual effects on end-users. Under ACCPT, users are allowed to customize privacy preferences in extreme detail. Upon installation, the user may feel overwhelmed by "legalese," and may be discouraged from participating in on-line transactions altogether. In an analysis of P3P, this same problem was cited. Citibank expressed their opinion that:
>From a consumer standpoint using P3P may be quite confusing, as the user may feel inundated with "legalese" and too many choices. . . . The user may feel inundated with too many choices about too many pieces of information when configuring P3P. If the user does not choose to fill in the information beforehand, there will be a point when the user is transacting with a website operator, that he/she would need to fill in that information. The user would then have to decide under what sort of conditions he/she would like to have personal information given out. . . . Nevertheless, there is a possibility that P3P will discourage neophytes from transacting or interacting online altogether. [204]
In reality, we believe that proper user interface implementation can avert this problem. Most browsers will probably lump privacy settings into large, easily understandable groups, and only advanced users will engage in further customizations. Furthermore, the facilitation of collective privacy choices through the APPEL-like functionality of a well designed ACCPT agent will allow users to use settings constructed by groups instead laboriously constructing their own.
Public Access
Also important to note is that fact that the technical complexity added by ACCPT may have unintended secondary effects on public access. For instance, many schools and libraries have public access web terminals. It would be unwieldy for each user to customize the ACCPT preferences on these machines. At the same time, without ACCPT, users may not be able to view a potentially large part of the content on the Internet. ACCPT may make be sacrificing some amount of public access for the sake of flexibility.
Services for the remote storage of ACCPT profiles should arise to solve this problem in much the same way Yahoo currently stores many people’s calendars.[205] This would again make use of our proposal for APPEL-like language for transferring privacy preferences.
A Slower Internet
An additional problem with the use of ACCPT is the network traffic that it would create. Due to the necessary negotiation that must occur before a user can access data from a website, more data must be transmitted back and forth to a website before a user can gain access to it creating both a noticeable delay in the time it takes to initially receive information from a website, as well as an over all increase in the amount of data that it will create in general. This overall increase in data transmission will in fact slow down other users on the Internet as well especially at points of low bandwidth. This problem would be further exacerbated by ACCPT's use of regional profiles to enforce legal standards due to the even further elevated level of necessary network traffic. This problem, however, may become moot in the future as the average Internet user's bandwidth increases at the same rate it has in the past.
Limitations of ACCPT
While the above criticisms constitute commentary about the problems with the implementation of our proposal for ACCPT, legitimate objections may be made in that perhaps ACCPT does not go quite "far enough." Though ACCPT has addressed many of the problems in government policy towards the protection of information, other areas of concern also exist which we have not fully addressed.
International Conflict of Laws
A major limitation of our proposal is its domestic nature, when the problem with information privacy is a global one. Most likely, not all nations will pass laws requiring or even supporting ACCPT. Since the ACCPT proposal does not require its international adoption – though we would welcome it –international websites could lie about the level of privacy they provide without there being an easy recourse for consumers. Some nations could provide safe haven for websites that wished to collect information without accepting limitations on its use. [206] As long as other countries can break ACCPT contracts without repercussions, then the proposal may be adding very little in the way of protection of privacy.[207] The U.S. government can "forbid" users to contract away data without particular guarantees if it so chooses, but if the other end of the party breaks the deal, there is no recourse. Some argue that a completely technical solution may be the only way to deal with this problem.
However, a "complete technical solution" cannot be the only answer to the question. As with our proposal, the problem is that technology doesn't exist in a vacuum -- there must be legal standards in place to encourage the adoption of the technology. This is particularly true on the international level, where other countries might actively pass laws preventing its adoption. On the other side, this is also a question of sovereignty – treaties, conflicts of law principles, and the like step into the gaps, just as in "real world" conflicts.[208] Granted, technology may provide a partial solution. If the United States adopts a code-based solution, it is likely that Europe will follow. Since packets go through several routers in the U.S., it will guarantee at least partial privacy for U.S. citizens.
If TCP/IP is modified in such a way that websites cannot collect IP addresses, electronic payment is completely anonymous and shipping is completely anonymous, no companies could collect personal information. If anonymizing routers were implemented as part of IPv6, countries would have to adopt it to avoid being cut off from the rest of the Internet. Regardless, ACCPT does not preclude the additional protection of a code-based framework to protect privacy.
Profiling
Another criticism of ACCPT is that it does not address the collection of "public" information into detailed profiles. Currently, much information is available for legal collection. There is no current U.S. provision,[209] nor is there any provision in ACCPT, to prevent the selling of this information. An individual or organization is legally allowed to collect information from the United States postal system, phone directories, tax information, family lineages/geneologies, real estate records, as well as collecting all posts, web pages, or any other on-line "traces" made by individuals.
This problem is one that should definitely be considered by the legislature and courts. Even if ACCPT becomes widely accepted, it is indisputable that such endeavors would be still technically be legal, yet may be a more serious violation of privacy than a website keeping a record of IP addresses. Surely ACCPT will slow the collection and use of this data as ownership would have to be established and the information collected without any help from the individual being profiled. However, ACCPT does not retrieve information currently public nor regulate the collection of information about users in the real world.[210]
Operational Data
Another problem with a legal structure that prevents collecting any information without permission is that of data that needs to be collected for normal server operations. Although the law includes provisions the collection of operational data for use in fulfilling transactions (IP addresses used to send requested pages), frequently, servers need or want to collect additional operational data for security purposes. Currently, the operational use exception does not include security use under our proposal. Indeed what would constitute a legitimate security use is unclear. Presumably, an officer with a warrant could obtain the operational logs in spite of a user’s privacy interest in them. However, though there was significant discussion over the tradeoff between privacy and accountability, our proposal errs on the side of privacy and does not provide a specific security use exception.
If introduced, anonymous browsing, shipping, and payment technologies may make a potential security use exception much less important as much operational data could be revealed with minimal privacy loss. Our proposal encourages further work in these areas.
"Race to the Bottom"
Finally, a potential problem unaddressed by our proposal is that ACCPT may not result in a diversity of privacy policies if various websites collude. This may become especially problematic if the websites only allow access to their pages upon the disclosure of information; if a "floor" develops, such that all pages require a minimum of information, then the privacy of users may not be significantly protected by ACCPT. This is an issue which we recommend government closely monitor. In the event that a floor on information does develop, Congress may reanalyze the issue, perhaps distinguishing between information which can be exchanged and information that is inalienable.
Philosophical Criticisms of ACCPT
In addition to the various criticisms thus far discussed, there are several debates which occur at a more basic level. ACCPT is based upon the acceptance of several assumptions and basic beliefs about privacy.[211] Yet, there are various other frameworks within which alternative proposals could be suggested.
No Data Collection
An even more extreme view is that there is no need at all for data collection. Despite the initial impressions, there are a fair number of arguments made in its favor. First, while data collection may bring in a significant amount of revenues, e-commerce may actually increase with a prohibition against collection of data.[212] Second, the argument maintains that most respectable websites do not engage in privacy violations; thus, the only sites it would potentially harm provide minimal positive value to society.[213] Moreover, larger revenues do not necessarily lead to good content. Many websites with quality content are created by people interested in more than money, such as public interest organizations,[214] musicians,[215] academics,[216] etc., more so than content from overcommercialized sites. Rather than simply encouraging growth and more content on the Web, perhaps we should be encouraging better quality or discouraging the minimally beneficial websites. Finally, marketing and data collection uses resources, but contributes little of substance back to society. In the long run, if human resources are reallocated from data collection or marketing to productive work, the output and average standard of living for society as a whole may rise. Although in the short run, this may hurt e-commerce, it may help other industries just as much in the long run.
An Internet where data collection was prohibited is some people’s view of a Utopian cyberspace. However, our proposal took a different stance because we believe that the technology is not mature enough for this to be practical goal. Furthermore, we recognize that different people have different privacy concerns and would be best served by different privacy policies. Thus in fulfilling our goals of protecting individual privacy but also enabling electronic commerce and encouraging a diversity of privacy policies, we took a more moderate approach.
Less Regulation
On the opposite side of the spectrum, there are advocates for the philosophy that there should be little to no regulation of data collection and storage. [217] The argument assumes that as long as the information is obtained legally, i.e. no trespass or fraud is involved, then the user has no more power over what is done with that information. The basic assumption underlying this theory is about entitlements – if a website has the technological ability to obtain information about the user, then the website owns that information.
For the advocates of this argument, the force comes from the First Amendment. In support of the theory that collectors of legally obtained data can do whatever they like with that data, some have argued that the primary constitutional issue is free speech, rather than privacy; once information is freely released, any restrictions on corporate speech, such as customer lists, should be disfavored.[218] However, the ACCPT proposal does not present an absolute ban on the speech. Instead, it suggests that the government implement constitutionally permissible "time, place, and manner restrictions"[219] – that the government simply regulate the manner in which this "speech" is conducted.
More importantly, this seems to be a misleading application of the First Amendment. Rather than the right to free speech, it seems more closely analogized to the limited right to appropriate or use other people's speech – in this case, an individual’s private information. Copyright, trademark, and patents are all examples of instances where the government has legitimately stepped in to protect the rights of the original "speaker." Alternatively, ACCPT can be seen as an extension of the government's right to regulate interstate commerce.[220] Given that the most vocal proponents of this structure of "less regulation" are from the direct marketing camp,[221] it is unlikely that they would deny that interstate commerce is involved.
Moreover, a world with this structure would degenerate into a cat-and-mouse game, with the user trying to technologically stay one step ahead of commercial websites. And this is a game that most users of the web are likely to lose, given their lesser resources and access to technological innovations, as well as problems with collective action.
Conclusion
The introduction of this paper discussed Alfred, the hypothetical web surfer. In the sections that explained the current technical, legal, market and social norm frameworks we saw how Alfred’s privacy could be violated in surprising ways. We saw that Alfred could be tracked by IP address or cookie and information given to one site could be easily correlated with his name and address given to another. In the market and social norms section, we saw that the technology to collect, store, analyze and share Alfred’s information was cheap. We also saw that although people are concerned about their personal privacy online, Alfred was likely to give up his information anyway. Finally, in the legal section explained that Alfred’s video rental receipts are likely to receive more privacy protection than his concerns over prostrate cancer. We discussed P3P and TRUSTe as potential solutions to Alfred’s privacy problems but saw that the background legal and technical regimes prohibit the success of both of these potential solutions.
In response, we proposed the ACCPT legal framework and technical guidelines. These would ensure that Alfred would be aware of the way in which his private information might be used before he agreed to divulge it. If Alfred didn’t want his visit to to be logged or given to other entities, he could either come to that agreement with , or find another site that would agree to those terms. However, as discussed in the critique section, Alfred’s privacy comes at a price. Companies will need to be more careful about how they handle information. Individuals will need to install agents and assent to their defaults. Web sites will open themselves to liability for the using information in ways that currently do not carry any potential penalty. Computer programmers wanting to write browsers with ACCPT compliant agents will find it technically more challenging and also open themselves up to potential liability which is not present under the current framework. Furthermore, our proposal does not solve thorny internationalization issues or completely eliminate profiling.
Privacy regulation is a balancing act. This proposal strikes that balance in favor of the individual. ACCPT protects individual privacy while enabling electronic commerce and providing a new market for information where the players are on more even ground. ACCPT attempts to enfranchise everyone, not only the rich or tech-savvy. Furthermore, ACCPT is flexible enough to encourage diversity in implementation and privacy policies while still allowing collective action.
As the Information Revolution chugs on its course, the United States has demonstrated an extreme reluctance to offer legislative guidance as to how it should proceed. Other than pledging protection for its own records, and enacting a few stop-gap protection measures that correspond to the day's headlines, the federal government has adhered to its rosy view of industry whereby a few fierce words from an extremely pro-business administration will prompt businesses to forego an extremely easy and profitable activity. If it was not clear before now that such an approach had little likelihood of success, the FTC's report to Congress should have been the final nail in the coffin of the idea of self-regulation.
America's reluctance to take drastic action may not be entirely predicated on the influence of moneyed interests in Washington. The United States has a very long tradition of freedom of information, and that norm might be one that legislators are reluctant to disturb. It is a shocking thing to say in America, "You have access to the knowledge, but you cannot use it." Though it would not be the first time such a thing was done – as was mentioned earlier, we have protection for copyrights, for trade secrets, and a host of other intellectual properties – ultimately what we are proposing to protect here is information that an individual parts with in the real world on a daily basis, without any expectation that that such information will be controlled. Our names, our addresses, our phone numbers, our favorite television shows, our buying habits – we simply are not used to thinking about these things as "private." When we see, however, the potential harm caused by the unrestricted flow of this information in vast databanks, it becomes clear that our traditional ideas about privacy must be radically altered to fit this new world.
Our proposal is the first step in this process – it is intended to function as a redefinition of what information is private. This is a context-sensitive redefinition: if the man at the newspaper stand on the corner remembers that Alice buy the Washington Post every morning, that is not a privacy violation – but if Altavista "remembers" this information without her consent when Alice searches for the Post online, or DoubleClick remembers it because DoubleClick hears through Altavista, or Barnes & Noble remembers it because Alice followed a link to its website – these are, indeed, violations of her privacy. The problem certainly extends beyond the web – we are living in an age where vast stores of data about every person in this country are freely available, by going down to the courthouse, or a Hall of Records. Without a workable, context-sensitive definition of privacy, our willingness to make those records available publicly on paper will translate to a willingness to make those records available publicly in electronic form – which, because of the ease with which electronic records can be accessed and searched, may very well have a qualitatively different meaning of "public" than was present in the case of a public record in a file in a cabinet in the basement of City Hall. Our proposal lays the groundwork for this new understanding variations of "public" and "private" depending on who has access to the information, how it is used, and how much control the individual has over it, but there is still much to be done. We must alter our understanding of "public" and "private" from how these terms were meant 200 years ago, when basic decisions about the structure of our legal architecture were made, to what those terms mean now, when our technological architecture has reached a place that no one could have envisioned when the rules were created. As the web and use of computers continues to grow, the importance of this process cannot be underestimated – and it requires more direction from our government than a simple hope that ultimately, everything will work itself out. Our proposal has the courage to take a stand and suggest ways that the government can help to protect personal privacy. We answer Al Gore’s challenge for an electronic bill of privacy rights – the only question now is whether government will have the courage to follow.
Appendix A: Table of Proposed Legislation
DURING THE 105TH CONGRESS[222]
PROTECTION OF CHILDREN
|H.R. 1972 |
|Children's Privacy Protection and Parental Empowerment Act of 1997 |
|Prohibits "list brokers" from selling, purchasing info about children without written consent of parent. Requires marketers to give|
|access about child to parent, prohibits using prison inmate labor to process children's' information. Requires marketers to give |
|lists to National for Missing and Exploited Children for data matching purposes. The bill has 52 cosponsors. |
|H.R. 2368 |
|Data Privacy Act of 1997 |
|Interactive computer services may not collect any information about a child or disclose this information without notifying the |
|child, in advance of collection or use, that the child should not provide any information without the consent of his or her |
|parent. No person shall solicit or collect information from a child regarding his or her parents. Part of a more comprehensively|
|conceived protection. |
|H.R. 2815 |
|Protecting Children From Internet Predators Act of 1997 |
|Criminalizes sending sexually explicit messages to people under 16, even if sender is under that age. |
|H.R. 3494 |
|Child Protection and Sexual Predator Punishment Act of 1998 |
|Criminalizes sending sexual material to a minor. Minimum prison term for using computer is 3 years. Allows use of subpoenas to |
|obtain evidence instead of warrants. |
|S. 504 |
|Children's Privacy Protection and Parental Empowerment Act of1997 |
|Prohibits the sale of personal information about children without their parents' consent. |
|S. 1965 |
|Internet Predator Prevention Act of 1998 |
|Prohibits the publication of identifying information relating to a minor for criminal sexual purposes. |
|S.1987 |
|Child Protection and Sexual Predator Punishment Act of 1998 |
|Increases penalties for transmitting obscene materials to minors, contacting minors using net "for the purpose of engaging in any |
|sexual activity". |
Protecting Personal Identification Data
|H.R. 98 |
|Consumer Internet Privacy Protection Act of 1997 |
|Interactive computer services may not disclose personally identifiable information provided by their subscribers to third parties |
|without subscriber's written consent, which may be revoked at any time. Upon subscriber's request, service must provide the |
|subscriber's personally identifiable information maintained by the service to the subscriber for verification and correction |
|purposes. Upon subscriber's request, service must inform the subscriber of the identity of the third party recipients of the |
|subscriber's personally identifiable information. Additionally, this act would prohibit knowing disclosure of falsified |
|information. |
|H.R. 1287 |
|Social Security On-line Privacy Protection Act of 1996 |
|Interactive computer services may not disclose Social Security account numbers or personal information that is identifiable to an |
|individual by means of his or her Social Security number without the individual's written consent, which may be revoked at any |
|time. See "Regulating On-Line Databases." |
|HR 1330 |
|American Family Privacy Act of 1997 |
|Prohibits Federal officers and employees from providing access to social security account statement information, personal |
|earnings and benefits estimate statement information, or tax return information of an individual through the Internet or without |
|the written consent of the individual, and to establish a commission to investigate the protection and privacy afforded to certain |
|Government records. |
|HR 1331 |
|Social Security Information Safeguards Act of 1997 |
|Requires the Commissioner of Social Security to assemble a panel of experts to assist the Commissioner in developing appropriate |
|mechanisms and safeguards to ensure confidentiality and integrity of personal Social Security records made accessible to the |
|public. |
|H.R. 1367 |
|Federal Internet Privacy Protection Act of 1997 |
|Federal agencies may not make available through the Internet any record with respect to an individual. For the purposes of this |
|act, records include information with respect to education, financial transactions, medical history, or employment history that |
|contains the name or identifier assigned to the individual. |
|H.R. 1813/S. 600 |
|Personal Information Privacy Act of 1997 |
|Persons may not buy, sell, or trade Social Security account numbers or use social security account numbers for identification |
|without written consent of the individual. Individual must be informed of all purposes for which the number will be used and all |
|persons to whom the number will be known. |
|H.R. 2368 |
|Data Privacy Act of 1997 |
|This act creates an industry working group to establish guidelines to limit the collection and commercial use of personally |
|identifiable information obtained from individuals through any interactive computer services. The guidelines shall apply to those |
|Providers or persons who voluntarily agree to such applicability. These guidelines shall require interactive computer services to |
|inform subscribers of the nature of the information collected and allow subscribers to prevent disclosure of this information. Upon|
|subscriber's request, service must provide the subscriber's personally identifiable information maintained by the service to the |
|subscriber for verification and correction purposes. Part of a more comprehensively conceived protection. |
|H.R. 2581 |
|Social Security Privacy Act of 1997 |
|Limits use of Social Security number. Requires disclosure of uses of SSN by businesses. |
Protecting Medical Records
|H.R.1815 |
|Medical Privacy in the Age of New Technologies Act of 1997 |
|Protects the privacy of health information in the age of genetic and other new technologies. |
|H.R.2198 |
|Genetic Privacy and Nondiscrimination Act of 1997 |
|Would limit use and disclosure of genetic information by health insurance companies; prohibit employers from attempting to acquire,|
|or to use, genetic information, or "to require a genetic test of an employee or applicant for employment" or to disclose the |
|information. |
|HR 2215 |
|Genetic Nondiscrimination in the Workplace Act |
|Amends Fair Labor Standards Act to restrict employers in obtaining, disclosing, and using of genetic information. |
|HR 2216 |
|Genetic Protection in Insurance Coverage Act |
|Limits the disclosure and use of genetic information by life and disability insurers. Prohibits insurers from requiring genetic |
|tests, denying coverage, setting rates based on genetics, using or maintain genetic info. |
|H.R. 2368 |
|Data Privacy Act of 1997 |
|No person may use, for commercial marketing purposes, any personal health or medical information obtained through an interactive |
|computer service without prior consent of the individual. No person may display the social security account number of an |
|individual, through the use of an interactive computer services, except when part of a government record available to the general |
|public or pursuant to industry guidelines. Part of a more comprehensively conceived protection. |
| H.R. 3755 |
|Prescription Privacy Protection Act of 1998 |
|Restricts disclosure of pharmacy records. |
|H.R.3900 |
|Consumer Health and Research Technology (CHART) Protection Act |
|A bill to establish Federal penalties for prohibited uses and disclosures of individually identifiable health information, to |
|establish a right in an individual to inspect and copy their own health information, and for other purposes. Allows disclosure to |
|government without warrant and researchers with little need. |
|H.R. 4250 |
|Patient Protection Act of 1998 |
|Republican Health Care bill. Sets weak standards for privacy, prohibits states from passing stronger protections. Approved by the |
|House 216-210 on July 24. |
| S. 89 |
|Genetic Information Nondiscrimination in Health Insurance Act of 1997 |
|Prohibits denial of insurance based on genetic information. Prohibits insurance companies from requesting genetic information. |
|Prohibits disclosing genetic information without written consent. |
|S. 1368 |
|Medical Information Privacy and Security Act |
|General medical privacy bill. |
| S. 2352 |
|The Patient Privacy Rights Act |
|Repeals the "unique medical identifiers" requirement of the Health Insurance Portability Law of 1996 (HIPAA). |
Regulating Direct Marketing and Unsolicited E-Mail
|HR 1748 |
|Netizens Protection Act of 1997 |
|Persons may not send unsolicited advertisements to an electronic mail address of an individual with whom they lack a pre-existing |
|or ongoing business or personal relationship, unless the individual provides express invitation or permission. Persons may not |
|send unsolicited advertisements without providing the identity and the return electronic mail address of the business or individual|
|sending the message at the beginning of the unsolicited ad. |
|H.R. 2368 |
|Data Privacy Act of 1997 |
|Persons may not send unsolicited advertisements without providing the identity, the physical address, the electronic mail address, |
|and the phone number of the initiator of the message. The business or trade name must appear in the subject line of the message. |
|The guideline must provide a method by which an individual may choose to prohibit the delivery of unsolicited commercial electronic|
|mail. Part of a more comprehensively conceived protection. |
|H.R. 4124 |
|E-Mail User Protection Act of 1998 |
|Anti-Spam bill |
|H.R. 4176 |
|Digital Jamming Act of 1998 |
|Anti-spam bill. |
|S. 771 |
|Unsolicited Commercial Electronic Mail Choice Act of 1997 |
|Persons sending unsolicited electronic mail advertisements must include the word "advertisement" in the subject line of the message|
|and include the sender's electronic mail address, physical address, and telephone number in the body of the message. Interactive |
|computer services must provide a system for blocking any electronic mail that contains the word "advertisement" in its subject line|
|and inform its subscribers of this service. Once such a blocking system is in place, interactive computer services must block |
|unsolicited advertisements at the request of the individual subscriber and may block these advertisements upon its own |
|initiative. |
|S. 875 |
|Electronic Mailbox Protection Act of 1997 |
|Persons may not transmit unsolicited electronic mail messages from an unregistered electronic mail address or disguise the source |
|of unsolicited electronic mail messages. Persons may not send unsolicited electronic mail to individuals who have requested no |
|further messages and may not distribute that individual's electronic mail address to others who intend to use the address for |
|sending unsolicited electronic mail. Persons may not send unsolicited electronic mail messages in contravention of the rules of an |
|interactive computer service or access the server of such a service to collect the electronic mail addresses of its subscribers for|
|the purpose of sending unsolicited electronic mail advertisements. |
Regulating On-Line Databases
|H.R. 1226 |
|Taxpayer Browsing Protection Act |
|Criminalizes "browsing" of taxpayer files by IRS employees. Passed by the House April 15, 1997. Placed on the Calendar in the |
|Senate (CR S3346) on 4/17/97. Signed August 7, 1997 (PL 105-35). |
|HR 1287 |
|Social Security On-line Privacy Protection Act of 1996 |
|Prohibits computer service (such as Lexis-Nexis) from disclosing person's SSN without permission. See "Protecting Personal |
|Information." |
|H.R.2652 |
|Collections of Information Anti-Piracy Act |
|Creates property right in databases of information, even if public domain information. Approved by House on voice vote on May 19. |
|Referred to Senate Judiciary Committee. |
|S.2291 |
|Collections of Information Anti-Piracy Act |
|Creates new form of intellectual property for databases. Unfortunately, does not protect individuals from whom information is |
|collected, except from 3rd parties who would misappropriate database from collector. |
Appendix B: Example P3P Proposal
THE FOLLOWING CODE SHOULD BE PLACED IN YOUR DEFAULT WEB SITE PAGE. THIS HTML PROPOSAL WILL ALLOW YOUR VISITORS' BROWSERS TO READ AND UNDERSTAND THE HUMAN READABLE PROPOSAL WHICH FOLLOWS IT.
Group3-privacy's Privacy Statement
GROUP3-PRIVACY MAKES THE FOLLOWING STATEMENT FOR THE WEB PAGES AT . THIS IS THE HUMAN READABLE VERSION OF THE ABOVE P3P PROPOSAL.
Online Contact Information
Group3-privacy may collect the following data regarding a user's home:
an e-mail address or a URI.
Group3-privacy could collect information regarding a user's business:
an e-mail address or a URI.
Group3-privacy makes a statement regarding how a user might benefit by providing this information:
"It will help us better serve your interests as you browse our website."
Group3-privacy uses this information for the purposes of completion and support of current activity, Web site and system administration, customization of a Web site to an individual and research and development.
This information may be distributed to ourselves and our agents.
Computer Information
We collect information about a users computer system and associate this information with other identifiable information collected from the user. Group3-privacy uses this information for the purposes of completion and support of current activity, Web site and system administration, customization of a Web site to an individual and research and development.
This information may be distributed to ourselves and our agents. Moreover, this information could be used in such a way as to personally identify a user.
Clickstream and Navigation Data Information
Group3-privacy may collect the following types of passively gathered data: click stream data collected on the server. Group3-privacy uses this information for the purposes of completion and support of current activity, Web site and system administration, customization of a Web site to an individual and research and development.
This information may be distributed to ourselves and our agents.
Transaction Data
Group3-privacy may collect the following types of information generated through explicit transactions (i.e. search queries): stored negotiation history data or search query data. Group3-privacy uses this information for the purposes of completion and support of current activity, Web site and system administration, customization of a Web site to an individual and research and development.
This information may be distributed to ourselves and our agents.
Content Data
Our Web site contains elements that would allow a user to communicate with another user or to post information so that others may access it at . Group3-privacy uses this information for the purposes of completion and support of current activity, Web site and system administration, customization of a Web site to an individual and research and development.
This information may be distributed to ourselves and our agents.
General Disclosure
No user access to identifiable information is given.
Group3-privacy makes a disclosure in our policy posted at regarding the capability for a user to cancel or renegotiate an existing agreement at a future time.
Group3-privacy makes a disclosure in our policy posted at regarding how long data is retained.
-----------------------
[1] Al Gore, New York University Graduation Address (May 15, 1998) (last visited December 3, 1998) .
[2] See Tim Berners-Lee, Information Management: A Proposal (last visited December 7, 1998) (proposing a hypertext system called "Mesh" which was later renamed the "World Wide Web"). See also A Little History of the World Wide Web (last visited December 7, 1998) .
[3] See Nua Internet, How Many Online? (last visited December 8, 1998) . See also Gregory G. Gromov, History of the Internet: Part 8 – Statistics, (last visited December 8, 1998) (estimating the number of US Internet users at 57 million but admitting that there is some dispute about that figure).
[4] But see Tony Rutkowski, Internet Trends (last visited December 8, 1998) (estimating the number of Internet hosts at ten million in early 1997).
[5] See Testimony of Robert Pitofsky before House Subcommittee on Telecommunications, Trade and Consumer Protection Consumer Privacy on the World Wide Web (July 21, 1998) .
[6] See FTC, Privacy Online: A Report to Congress (1998), available in .
[7] See, e.g., Kevin Kopp, Comment: Electronic Communications In The Workplace: E-Mail Monitoring And The Right Of Privacy, 8 Seton Hall Const. L.J. 861 (1998); Kevin J. Konlon, The Kenneth M. Piper Lecture: Privacy In The Workplace, 72 Chi.-Kent. L. Rev. 285 (1996); Kevin J. Baum, Comment: E-Mail In The Workplace And The Right Of Privacy, 42 Vill. L. Rev. 1011 (1997).
[8] See infra text accompanying notes 73-85, 109-110.
[9] See infra text accompanying notes 111-116
[10] See Gore, supra, note 1.
[11] See NUA Internet, Online Porn Industry Facing Crisis (last visited Dec. 8, 1998) (citing Forrester Research).
[12] See NUA Internet, Paradigm Shifts (last visited December 8, 1998) (quoting Nicholas Lippis, an industry analyst).
[13] See Lawrence Lessig, Code, and Other Laws of Cyberspace, unpublished circulating draft (1998).
[14] See, e.g., Washington Post Co., et al. v. TotalNews, Inc., 97 Civ. 1190 (S.D.N.Y. Feb. 2, 1997). In early 1997, , a clearing house site for current news stories from a variety of online media sources, was sued by some of those companies, including the Washington Post. See id. The plaintiffs objected to the ’s "framing." A "framed" site is a site whose content is opened within another sites’ pages. TotalNews framed the Washington Post’s stories within its own pages so that users saw Washington Post stories as well as Total News advertisements and menus in the same web browser window. The plaintiffs alleged unfair competition, misappropriation, trademark dilution and infringement and other violations. As part of a settlement, agreed to stop framing the plaintiffs' sites.
[15] See e.g. Shetland Times Ltd. v. Wills, Scot Sess-Case, 1 EIPLR 723 (1996). In late 1996 The Shetland Times sued its former editor, Dr. Jonathan Wills, over links from his new web based newspaper, The Shetland News, to stories on the Shetland Times site. See id. See also Simulation of Shetland News Pages (last visited Nov. 21, 1998) (showing how the Shetland News page of October 14, 1996 linked to Shetland News Articles). An interim judgement held that it was prima facie arguable that using headlines from the Shetland Times’ website to link to the stories on that site could be a breach of copyright. See J.P. Connolly et al, Fair Dealing in Webbed Links of Shetland Yarns, 1998 J. Info. L. & Tech. 2. A settlement after the ruling allowed The Shetland News to continue deep linking to individual stories on the Shetland Times site as long as the News identified the stories as being from the Times website in the link text. See id.
[16] Pornography revenue is expected to top one billion dollars this year. See NUA Internet, supra note 11.
[17] The portal frenzy is just on example of this phenomenon. See Daniel Rimer, Let the Portal Games Begin, C-Net News, June 23, 1998 .
[18] See, e.g., Planet Out: Land On It! (last visited December 8, 1998) (whose slogan is "The Number One Online Community of Gay, Lesbian, Bi and Trans People Worldwide"); Why America Online Sucks (last visited December 8, 1998) .
[19] The ill-fated Netscape HTML extension tag is a good example of this as is the C-Net multi-column look that has spawned vast number of similar layouts. See Brian Wilson, Index Dot HTML: Blink (last visited December 8, 1998) ; Welcome to CNET! (last visited December 8, 1998) .
[20] See Gopher Menu (last visited Dec. 9, 1998)
[21] See Information Sciences Institute, Internet Protocol: Darpa Internet Program Protocol Specification (1981), available in
[22] See Network Working Group, Internet Protocol, Version 6 Specification (1998), available in .
[23] See Eric Osborne, Linux IPv6 FAQ/HowTo (last visited Dec. 9, 1998) .
[24]See Cisco Encryption Technology (last visited Dec. 9, 1998) .
[25] See S/Wan Online Interoperability Test (last visited Dec. 9, 1998) .
[26] Bruce Schneier, Applied Cryptography 264 (1994).
[27] See e.g. Filtering Associates, Proxy Server Filtering Solutions for ISP and Business Networks (last visited December 9, 1998) .
[28] See The National Janet Web Cache Service, Introduction to WWW Caching (last visited December 9, 1998) .
[29] See e.g. Unicomp Technologies, Firewall Security (last visited December 9, 1998) .
[30] See Netscape, Client-Side State – HTTP Cookies (last visited Dec. 9, 1998) .
[31] See Lightweight Directory Access Protocol (last visited Dec. 9, 1998) .
[32] See T. Okamoto& K. Ohta, Universal Electronic Cash, in Advances in Cryptology – Crypto '91 Proceedings 324-337 (1992).
[33] See Schneier, supra note 26, at 117-18.
[34] See id. at 118-19.
[35] See id. at 120-22.
[36] See S. von Solms & D. Naccache, On Blind Signatures and Perfect Crimes, 1992 Computers & Security 581-83.
[37] See Pitofsky, supra note 5.
[38] See id.
[39] See Ian Goldberg, David Wagner, & Eric Brewer, Privacy Enhancing Technologies for the Internet (last visited Dec. 9, 1998) .
[40] See, e.g., Anonymizer, Inc. (last visited Dec. 9, 1998) .
[41] See FTC, supra note 6.
[42] See Netscape, Open Profiling Specification Submission (1997), available in .
[43] vCards are a technology created by Verisign, and thus constitute Verisign's main role in the OPS relationship.
[44] See Netscape, supra note 42.
[45] See W3C, Platform for Privacy Preferences Project (last modified July 16, 1998) .
[46] Joseph Reagle and Lorrie Faith Cranor, CACM Platform for Privacy Preferences, (last visited December 10, 1998) .
[47] For more information on XML, see W3C, Extensible Markup Language (last modified Nov. 11, 1998) < >.
[48] Also called a realm.
[49] See Appendix B: Sample P3P Proposal
[50] See W3C, Platform for Privacy Preferences (last modified Nov. 6, 1998) .
[51] See W3C, Platform for Internet Content Selection (last visited Dec. 9, 1998) .
[52] See W3C, supra note 50.
[53] See supra, Figure 1.
[54] See W3C, P3P Base Data Sheet (last visited Dec. 6, 1998) .
[55] See W3C, Platform for Privacy Preferences Syntax Specification (last visited Dec. 6, 1998) .
[56] See id.
[57] Telephone Interview by Christian Baekkelund with Joseph M. Reagle, Jr., Resident Fellow, Berkman Center for Internet & Society, Harvard Law School (Dec. 3, 1998).
[58] For more information on HTTP, see Network Working Group, Hypertext Transfer Protocol (1996), available in .
[59] For more information on RDF, see W3C, Metadata and Resource Description (last visited Dec. 9, 1998) .
[60] See W3C, supra note 50.
[61] See W3C, P3P Harmonized Vocabulary Specification (last visited Dec. 7, 1998) .
[62] See W3C, supra note 50.
[63] See W3C, Platform for Privacy Preferences Specification (last visited Dec. 6, 1998) .
[64] Telephone Interview by Christian Baekkelund with Joseph M. Reagle, Jr., Resident Fellow, Berkman Center for Internet & Society, Harvard Law School (Dec. 3, 1998).
[65] See Kenneth Lee & Gabriel Speyer, Platform for Privacy Preferences Project & Citibank (1998), available in .
[66] See id.
[67] See Stever Lohr & John Markoff, Netscape Bid Seen by America Online, N.Y. Times, Nov. 23, 1998, at A1.
[68] See Lee & Speyer, supra note 65.
[69] See Legal Section.
[70] Interview by Christian Baekkelund with Daniel Weitzner (Dec. 8, 1998).
[71] For instance, Deirdre Mulligan from the Center for Democracy and Technology, pointed out this exact problem before the Senate Committee on Commerce, Science, and Transportation, Subcommittee on Communications. She states:
The Federal Trade Commission's jurisdiction over deception generally comes into play where a company has inaccurately stated its information practices to consumers. Therefore, those who make no statements about how the handle data are less likely than those who inform consumers of data use to be prosecuted. While the FTC's legal framework is likely to discourage self-regulatory activities, the FTC, the Department of Commerce and the White House have actively encouraged and prodded industry to take steps to protect privacy or be subject to legislation. The recent Geocities settlement offers an example of the problem. Geocities was found to be in violation of their privacy policy. Had they not posted a privacy policy it seems unlikely that the FTC would have sought them out for action.
FDCH Congressional Testimony, September 23, 1998.
[72] See Beth Givens, A Review of the Fair Information Principles: The Foundation of Privacy Public Policy (last visited Dec. 7, 1998) .
[73] Because constitutional law by its nature requires interpretation by courts, it is almost impossible to provide a coherent analysis of constitutional doctrine without cases applying the principles. Thus, the discussion of constitutional law is supplemented by some case discussion.
[74] Because the Bill of Rights was created to protect from the abuses of government power, it provides little to no protection from private actors, although there is a small exception for when a private entity is essentially acting in a governmental capacity. See e.g., Norwood v. Harrison, 413 U.S. 455 (1973) (affirming that "a state may not induce, encourage or promote private persons to accomplish what it is constitutionally forbidden to accomplish").
[75] Although our focus is on efforts by the federal government to protect privacy, it is noteworthy that nine states explicitly guarantee the right to privacy within their constitutions: Alaska, Arizona, California, Florida, Hawaii, Illinois, Louisiana, Montana, and Washington. See Comment, E-mail in the Workplace and the Right of Privacy, 42 Vill. L. Rev. 1011, 1018-19 (1997) [hereinafter Workplace]. Of these nine states, only California, extends protection of the right to privacy to not only public employees, but private employees. See id at 1019.
[76] See Griswold v. Connecticut, 381 U.S. 479 (1965).
[77] Further discussion of the Third and Fifth Amendments are not necessary, as their context is rather limited. For example, the Third Amendment is a prohibition against the quartering of soldiers in homes without consent, i.e. protecting the privacy/sanctity of a citizen's home. See U.S. Const. amend. III. The Fifth Amendment protects an individual's right against self-incrimination – again, the right to withhold speech. See U.S. Const. amend. V. The Ninth and Fourteenth Amendments are also often included in discussions of constitutional amendments protecting privacy. See Center for Democracy and Technology, CDT's Guide to Online Privacy (visited Dec. 1, 1998) .
[78] "Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press, or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances." U.S. Const. amendment I.
[79] See McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995) (affirming the right to conduct anonymous political leafletting).
[80] In 1996, the Georgia legislature enacted a statute prohibiting online users from using pseudonyms or communicating anonymously over the Internet. See Ga. Code Ann. § 16-9-93.1 (Supp. 1997). In response, the ACLU and the Electronic Frontier Foundation brought suit in September 1996 in the Federal District Court for the Northern District of Georgia, and obtained a preliminary injunction against enforcement of the statute. See ACLU v. Miller, No. (N.D. Ga. June 20, 1997). For more information, see Jeff Kuester, Unconstitutional Georgia Internet Police Law (visited Dec. 2, 1998) .
[81] NAACP v. Alabama, 357 U.S. 449 (1958) (ruling unconstitutional an Alabama statute requiring the registration of the NAACP membership list with the state).
[82] Although courts have generally been reluctant to intrude on the right of privacy in one's bedroom, this right has been, and continues to be, the subject of many battles. See Griswold v. Connecticut, 381 U.S. 479, 484 (1965) (striking down a Connecticut statute forbidding the use of contraceptives because it conflicts with the exercise of the right to marital privacy); see also Roe v. Wade, 410 U.S. 113 (1973). But see Bowers v. Hardwick, 478 U.S. 186 (1986).
[83] "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Const. amendment IV.
[84] See Katz v. US, 389 U.S. 347 (1967) (establishing the reasonable expectation of privacy test).
[85] Professor Lawrence Lessig, Lecture for Cyberspace and Social Protocols, Fall 1998.
[86] At its earliest conceptions, however, the right to privacy was not widely accepted. See Roberson v. Rochester Folding Box Co., 64 N.E. 442, 443 (N.Y. 1902) (rejecting right to privacy because past American courts had not yet recognized a right to privacy, preferring instead to defer to the legislature's power to create such a right). Later courts realized that a right to privacy did exist, emanating the various guarantees in the U.S. Constitution. See supra text accompanying notes 73-85.
[87] See William Prosser, The Right of Privacy, 48 CAL. L. REV. 383, 389 (1960).
[88] For example, information voluntarily disclosed or readily available from public sources is not protected under any of these actions. See Joel R. Reidenberg, Privacy in the Information Economy: A Fortress or Frontier for Individual Rights? 44 Fed. Comm. L.J. 195, 223-24. (1992). Moreover, plaintiffs may have to meet the standard of "offensiveness," i.e., the information revealed/publicized/misappropriated was extremely private, or of showing that the information was publicly distributed. In the context of the privacy violations envisioned by this White Paper, such a threshold is extremely difficult to overcome.
[89] See id.
[90] See Restatement (Second) of Torts, 652A app. reporter's note (1989 & Supp. 1990). See also Kelly v. Franco, 391 N.E.2d 54, 57-58 (Ill. App. Ct. 1979) (holding that Illinois protects only against the misappropriation of a person's name or likeness for commercial purposes); Strutner v. Dispatch Printing Co., 442 N.E.2d 129, 134 (Ohio Ct. App. 1982) (holding that Ohio has not adopted false light privacy tort); Kalian v. People Acting Through Community Effort, 408 A.2d 608 (R.I. 1979) (holding that Rhode Island recognizes only limited common law rights of privacy), all cited in Reidenberg, supra note 88.
[91]See, e.g., Cal. Civ. Code @ 3344 (West Supp. 1991); Fla. Stat. Ann. @ 540.08 (West 1988); Ky. Rev. Stat. Ann. @ 391.170 (Michie/Bobbs-Merrill 1984); Mass. Ann. Laws ch. 214, @ 3A (Law. Co-op. 1986); Neb. Rev. Stat. @@ 20-201 to -211 (1987); N.Y. Civ. Rights Law, @@ 50, 51 (McKinney 1990); Okla Stat. Ann. tit. 21, @ 839.1 (West 1983); R.I. Gen. Laws @@ 9-1-28 to 9-1-28.1 (1985); Tenn. Code Ann. @@ 47-25-1103, 47-25-1105 (1988 & Supp. 1990); Utah Code Ann. @ 45-3-3 (1988); Wis. Stat Ann. @ 895.50(2) (West 1983), all cited in Reidenberg, supra note 88.
[92] See, e.g., Gautier v. Pro-Football, Inc., 107 N.E.2d 485, 487-88 (N.Y. 1952); Anderson v. Strong Memorial Hospital, 531 N.Y.S.2d 735 (N.Y. Sup. Ct. 1988)., cited in Reidenberg, supra note 88.
[93] See Robert Ellis Smith, A Compilation of State and Federal Privacy Rights 29 (1988), cited in Reidenberg, supra note 88.
[94] For example, at the FX Networks site, the privacy policy reads: "Use and participation in FX's Internet sites is contingent upon your acceptance of the following terms and rules. By using our sites, you accept these terms. In addition, your continued use of this site after a change has been made to the policies of our sites implies your assent to those changes." FX Networks, Terms, Conditions, and Privacy (last visited Dec. 7, 1998) .
[95] See Jerry Kang, Information Privacy in Cyberspace Transactions, 50 Stan. L. Rev. 1193, 1253-1255 (1998).
[96] Granted, there is the current furor over the proposed UCC Article 2B. See, e.g., Brenda Sandburg, UCC Talks Falling Apart, IP Magazine (Oct. 8, 1998) . However, this is outside the scope of the paper.
[97] See Susan Stellin, Privacy in the Digital Age, CNET (May-June 1996) .
[98] See Michael A. Smyth vs. Pillsbury Co., 914 F. Supp. 97 (E.D. Pa 1996).
[99]As explained earlier, see Introduction, this is largely outside the scope of our focus. For a more complete explanation, see Workplace, supra note 75.
[100] For a good discussion of state laws protecting privacy, see Reidenberg, supra note 88, at 227-37.
[101] In a manner similar to the above discussion of constitutional law, an analysis of disembodied statutes and regulations is largely meaningless without application to real-life scenarios. Thus, case law discussing the application of statutes is included in this section.
[102] See U.S. Privacy Protection Study Commission, Personal Privacy in an Information Society (1977).
[103] See id. at xiii.
[104]See id.
[105] See Reidenberg, supra note 88, at 196-98. (1992).
[106] While in the 104th Congress, only fifty bills directly related to the Internet were introduced, that number has approximately doubled for the 105th Congress. See Nicholas W. Allard, Privacy On-Line: Washington Report, 20 Hastings Comm. & Ent. L.J. 511, 515 (1998). In addition, and perhaps more illustrative of the growing governmental interest in the Internet, Strom Thurmond (R-S.C.), the oldest member of the Senate, became the 100th member of the bicameral Congressional Internet Caucus. See id.
[107] See id.
[108] For example, theVideo Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195 (1988) was enacted to protect information about movie videos people buy or rent after such information was disclosed during the confirmation process of Supreme Court nominee Robert Bork.
[109] Privacy Act of 1974, 5 U.S.C. §§ 552a-559 (1994).
[110] Privacy Protection Act of 1980, 42 U.S.C. §§ 2000aa et. seq. (1980).
[111] 18 U.S.C. § 2510 et seq. (1998). See especially § 2510(4)("interception" includes the "acquisition of the contents of any … electronic communication"); §2510(17)(defining "electronic storage" to include electronic temporary, intermediate and backup storage); §2511(Title I)(prohibiting interception of electronic communications); and, § 2701 (Title II)(prohibiting unauthorized intentional access to stored electronic communications). See also § 2702(a):
(1) a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service; and
(2) a person or entity providing remote computing service to the public shall not knowingly divulge to any person or entity the contents of any communication which is carried or maintained on that service…
But note that §2702(a) is narrowly construed such that only entities who provide electronic communication services to the public at large (not just employees) qualify for the prohibition. See Andersen Consulting LLP v UOP, 991 F. Supp. 1041 (N.D. Ill. 1998)(UOP’s divulging Anderson Consultant’s e-mail does not fall within 2702 because UOP is not a e-mail provider to the public).
[112] See Nicole Giallonardo, Casenote: Steve Jackson Games v. United States Secret Service: The Government's Unauthorized Seizure Of Private E-Mail Warrants More Than The Fifth Circuit's Slap On The Wrist, 14 J. Marshall J. Computer & Info. L. 179 (1995)(government can get stored e-mail with a warrant but would need a court order for interception).
[113] 36 F.3d 457 (5th Cir. 1994)
[114] See id; see also A. Michael Froomkin, The Metaphor Is The Key: Cryptography, The Clipper Chip, And The Constitution, 143 U. Pa. L. Rev. 709, 864, note 676 (1995) (discussing the Steve Jackson case as troubling in its narrow interpretation of the ECPA denying Title I protection to the e-mails, but pointing out that the e-mails would still be protected by Title II of the EPCA).
[115] See Susan Stellin, Privacy in the Digital Age, CNET (May-June 1996) .
[116] There has been more written regarding employer monitoring of e-mail. Most articles conclude that employees have little recourse and cite Bosses With X-Ray Eyes, for evidence that employers monitor e-mail. See Charles Piller, Bosses With X-Ray Eyes, Macworld, July 1993, at 118 (21% of employers search employee files, over 66% who do, don’t tell the employees). The best, most recent discussions are Anne L. Lehman, Comment: E-Mail in the Workplace: Question of Privacy, Property or Principle? 5 Comm. Law Conspectus 99 (1997) and Thomas R. Greenberg, Comment, E-Mail And Voice Mail: Employee Privacy and the Federal Wiretap Statute, 44 Am. U.L. Rev. 219 (1994).
[117]See Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2701 (1986).
[118]See Privacy Act of 1974, 5 U.S.C. §§ 552a-559 (1994).
[119]See Fair Credit Reporting Act of 1970, 15 U.S.C. §§ 1681-1681t (1994).
[120]See Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3422 (1995).
[121]See Telephone Consumer Protection Act of 1991, 47 U.S.C. § 227(b)(1) (1991).
[122] See Video Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195 (1988).
[123]See Robert O'Harrow, Jr., Laws on Use of Personal Data Form a Quilt With Many Holes, Wash. Post, Mar. 9, 1998, at A12, cited in Allard, supra note 106, at 529.
[124] For example, "Secure Public Networks Act," see S. 909, 105th Cong. (1997), was passed by the Senate Commerce Committee on June 19, 1997 and later amended slightly. The bill would require the registration of keys with key recovery agents. On the other side of the spectrum, the Security and Freedom Through Encryption Act (SAFE), see H.R. 695 105th Cong. (1997), opposes control over encryption and attempts to impose key recovery; this bill has 249 cosponsors and has been placed on the calendar.
[125] Despite industry opposition, several bills which would protect children appear close to being passed. In the House, H.R. 1972, the Children's Privacy Protection and Parental Empowerment Act, see H.R. 1972, 105th Cong. (1998), would criminalize the selling of personal information about a child absent consent from a parent. This measure currently has 52 cosponsors and is pending before the House Crime Subcommittee. Moreover, S. 771, for example, mandates the labeling of advertisements and requires that Internet service providers make available blocking software to filter out advertisements. See S. 771, 105th Cong. (1997). The idea behind this legislation is that children are not able to discern between program content and advertising. This measure is pending before the Senate Communications Subcommittee.
[126] Allard, supra note 106, at 533.
[127]Encryption is not being addressed here. Bills and proposals regarding encryption are numerous enough to warrant a separate paper.
[128] See European Parliament, Directive 95/46/EC (Oct. 24, 1995) [hereinafter Directive] .
[129]See id. at Article 25
[130] See David Banisar, The Privacy Threat to Electronic Commerce, Comm. Week Int'l, June 1, 1998 .
[131] See id. According to Banisar, in fact, the lobbying could have unfortunate results:
In order to put pressure on Brussels, the White House has sent envoys around the world to push other countries, such as Japan, to not adopt privacy laws. They have threatened to take the EU to the World Trade Organization, even though GATT specifically exempts privacy laws. It is hard to imagine that Brussels would not find these actions and statements highly provocative and they may respond strongly in October.
[132] See Directive, supra note 128, at art. 10.
[133] See id. at art. 12.
[134] See id. at art. 10.
[135] See id. at art. 14.
[136] See id. at art. 6.
[137] The European Commission, First Orientations on Transfers of Personal Data to Third Countries: Possible Ways Forward in Assessing Adequacy (last modified June 26, 1997) .
[138] See C-Net , U.S. Proposes Privacy Principles (Nov. 9, 1998) .
[139] However, the administration and the EU still disagree on enforcement. The administration proposal suggests the creation of independent' entities to resolve disputes between individuals and companies. It also includes unspecified "consequences'' for firms not adhering to the guidelines. See id.
[140] See Directnewsline, DMA Tentatively Backs Commerce Dept. EU Privacy Guidelines (last modified Nov. 23, 1998) .
[141] See Directnewsline, EU Agrees Not to Interrupt Data Flow for Time Being (last modified Oct. 28, 1998) . Despite this concession, however, the EU has chosen to reject the proposed Commerce Department principles as sufficient in the long run. See Fox News, EU Rejects U.S. Data Privacy Protection Plan (last modified Nov. 23, 1998) .
[142] For news as it becomes available in regard to the effects of the European Data Directive, see The Privacy Page (last visited Dec. 7, 1998).
[143] William Daley, Speech at Commerce Department Conference on Internet Privacy, June 23, 1998 (last visited December 1, 1998) (last visited December 1, 1998).
[144] See Web Communications, HTML Form Tutorial (last visited Dec. 3, 1998) .
[145] See National Center for Supercomputing Aplications (NCSA), A Beginner’s Guide to HTML (last visited Dec. 3, 1998) (stating that forms are not covered in this widely known primer because of the "of the need for specialized scripts to handle the incoming form information").
[146] See Response-O-Matic: Free Form Processor (last visited Dec. 3, 1998) .
[147] Website set up and maintenance costs have also fallen sharply. Many website hosting companies charge less than twenty dollars a month for unlimited access sites while other websites will host individual pages for free. See HostSearch (last visited Dec.3, 1998) (listing many web hosting packages under twenty dollars). See also Geocities (last visited Dec. 3, 1998) (offering up to eleven megabytes of free web page space).
[148] See e.g., Matt Wright, HTTP Cookie Library README (last visited Dec. 3, 1998) .
[149] See e.g., Shishir Gundavaram, CGI Programming on the World Wide Web 202 (1996).
[150] This number was arrived at using a group member’s personal data. Granted the number used for salary saved some data space, however it was made up for by the excessively long name. The page references used were the first ten pages referenced in this section of text.
[151] PKWare’s PKZIP program was used for this example.
[152] Based on storing an uncompressed 5,000 bytes per user and a hard drive cost of $25 per gigabyte which is the current average price for large drives at Compu Tech USA, a computer retailer. See Compu Tech USA (last visited Dec. 3, 1998) .
[153] See A. Mitchell Polinsky, An Introduction to Law and Economics 11-12 (1989).
[154] See Kang, supra note 95, at 1256.
[155] See FTC, supra note 6.
[156] See FTC, Consumer Privacy on the World Wide Web (last visited Dec. 8, 1998) .
[157] See id.
[158] See EPIC, Surfer Beware II: Notice is Not Enough (last visited Dec. 8, 1998) .
[159] See Joseph M. Reagle, Jr., Boxed In: Why U.S. Privacy Self-Regulation Has Not Worked, Dec. 4, 1998.
[160] See id.
[161] See Joel Brinkley, Website Agrees to Safeguards in First On-Line Privacy Deal, N.Y. Times, August 14, 1998, at A15.
[162] See TRUSTe, For Web Publishers (last visited Dec. 9, 1998) ("The federal government is dead serious about enacting stringent privacy legislation if the industry doesn't show NOW that it can self-regulate effectively .... If you don't take advantage of self-regulatory measures such as the TRUSTe program for protecting users' privacy, it is only a matter of time before government regulation takes over. Federal intervention will absolutely translate into less flexibility and more costly privacy implementation measures for Websites across the board.").
[163] See TRUSTe, About TRUSTe (last visited Dec. 6, 1998) .
[164] See id.
[165] See id.
[166] See TRUSTe, How to Join the TRUSTe Program (last visited Dec. 5, 1998) for details on how websites join TRUSTe and how much money they must pay to join.
[167] For good and interesting examples of this posted privacy policy, see C-NET (last visited Dec. 9, 1998) ; Disney (last visited Dec. 9, 1998) ; (last visited Dec. 9, 1998) ; Wired (last visited Dec. 9, 1998) ; and Verisign (last visited Dec. 9, 1998) ,>.
[168] See TRUSTe, TRUSTe Program Principles (last visited Dec. 6, 1998) .
[169] See TRUSTe, The TRUSTe Program: How it Protects Your Privacy (last visited Dec. 7, 1998) .
[170] See id. ("The trustmark is awarded only to sites that adhere to established privacy principles and agree to comply with ongoing TRUSTe oversight and consumer resolution procedures.").
[171] See TRUSTe, The TRUSTe Watchdog (last visited Dec. 7, 1998) .
[172] See W3C, The Platform for Privacy Preferences (last visited Dec. 7, 1998) ("The P3P proposal may also contain other information including the name of an assuring party and disclosures related to data access and retention .... The assuring party is the organization that attests that the service will abide by its proposal. Assurance may come from the service provider or an independent assuring party that may take legal or other punitive action against the service provider if it violates an agreement. TRUSTe (discussed elsewhere in this issue) is one such organization that has provided Website privacy assurances, even before the development of P3P.")
[173] See TRUSTe, supra note 162 ("The electronic commerce industry stands to miss out on billions of dollars in revenue if Websites don't address consumer privacy.").
[174] See Reagle, supra note 159.
[175] See id.
[176] For instance, Classifieds2000 bears the TRUSTe mark, and describes its privacy policy as:
Occasionally we ask you to provide us information such as your name, e-mail address, or what your interests and hobbies are. You never have to answer these questions although this may limit what services we can offer you .... We use a feature of your browser called a "cookie" to assign a "User ID." Cookies, by themselves, cannot be used to find out the identity of any user. Your Classifieds2000 User ID automatically identifies your computer - but not you - to our servers when you visit our site. Unless you specifically tell us, Classifieds2000 will never know who you are, even though we assign your computer a cookie. Other companies which place advertising on our site also have the ability to assign a different cookie to you in a process that Classifieds2000 does not control. But since cookies aren't useable for identifying individuals (you'll be just a number to them), these advertisers will never know who you are - and Classifieds2000 will never tell them!
Classifieds2000 (last visited Dec. 9, 1998) < >.
[177] Telephone Interview by Christian Baekkelund with Joseph M. Reagle, Jr., Resident Fellow, Berkman Center for Internet & Society, Harvard Law School (Dec. 3, 1998).
[178] See TRUSTe, supra note 163.
[179] See TRUSTe, Look Up a Company, (last visited December 9, 1998) (listing all TRUSTe certified web sites).
[180] See BBBOnline, Online Privacy Self-Regulation Program (last visited Dec. 8, 1998) .
[181] See BBBOnline, The BBBOnline Privacy Program (last visited Dec. 8, 1998) .
[182] See Guido Calabresi and A. Douglas Melamed, Property Rules, Liability Rules, and Inalienability: One View of the Cathedral, 85 Harv. L. Rev. 1089 (1972) (explaining the use of distributional and efficiency considerations for allocating entitlements).
[183] Cf Kang, supra note 90, at 1245 ("[R]elying upon technologies alone may have unfavorable distributional consequences, which favor the computer savvy and well-educated.").
[184] See the P3P Case Study, in Technology Section, for more information on TUIDs.
[185] See the P3P Case Study, in Technology Section, for more information on PUIDs.
[186] We would recommend that, as a penalty for misuse of data, websites be subject to a statutorily-determined minimum penalty, either in the form of a fine or in the form of liability in tort. We also recommend the creation of an agency to investigate complaints of privacy violations, as a user might only know that his or her information was compromised, without being aware of which of the many companies the data was released to was responsible for the violation.
[187] A third exception might be necessary to allow websites to ascertain the real-space location of the user employing modified TUIDs, with this record of location ultimately being erased unless the user later explicitly agrees to its storage. See infra text accompanying notes 193-196.
[188] Interview by Christian Baekkelund with Daniel Weitzner (Dec. 8, 1998).
[189] See Restatement (Second) of Contracts § 21.
[190] A less technical and more user-friendly readable version of the harmonized vocabulary would be widely distributed to promote user understanding and awareness of terms.
[191] See the P3P Case Study, in the Technology Section, for more information on the following listed benefits of P3P.
[192] See W3C, supra note 61.
[193] It is important to note that how individuals attain these certificates and how the certificates are assuredly true is beyond the scope of our proposal. Our proposal is simply based in a setting where this is the case.
[194] The server would make use of a language to be proposed similar to P3P’s APPEL (A P3P Preference Exchange Language). For more information on APPEL, see W3C, A P3P Preference Exchange Language (last visited Dec, 8, 1998) . APPEL is to be used in P3P to exchange privacy preference profiles between two entities and a language similar to, but more secure than, APPEL would be used in ACCPT to exchange privacy profiles in a similar manner. This APPEL-similar tool will also be helpful for users that desire to use the privacy practices of a certain organization, such as their employer or a civil rights group, for they need merely set up their agent to pre-fetch these privacy preferences.
[195] We do not attempt, for the purposes of this paper, to determine which laws those would be – rather, we just assume that some set of laws applies, and we propose that ACCPT be capable of enabling them. We further do not make geography based checking of the collective choices of a community a requirement for the current proposal. Rather we leave the ability for communities to require such a mechanism.
[196] Servers maintaining the privacy requirements for a locale must be created and maintained by the appropriate organizations and lists of such servers must be publicly and easily accessed for server administrators to use to update their server configuration with. In the creation and adoption of ACCPT, it will be a necessity to help foster the creation and knowledge of these servers. With a properly designed ACCPT system, a cache of such pre-fetches should be created and used frequently to minimize the network traffic.
[197] See the P3P Case Study, in the Technology Section, for information on data repositories and vCards.
[198] Interview by Christian Baekkelund with Daniel Weitzner (Dec. 8, 1998).
[199] See W3C, supra note 50.
[200] See Netcraft, The Netcraft Web Server Survey (visited Dec. 9, 1998) . Microsoft's own Hotmail service runs on Apache, on top of the FreeBSD operating system (developed in the same fashion), despite Microsoft's repeated attempts to move to NT/Microsoft-IIS. See id.
[201] Open Source, {Halloween I -- 1.10}: Open Source Software (visited Dec. 9, 1998) .
[202] See e.g. LIBWWW - PERL - 5 (last visited December 9, 1998) (describing the World Wide Web functions PERL library which implements many HTTP methods).
[203] See supra Law Section.
[204] Lee & Speyer, supra note 65.
[205] See e.g. Yahoo Calendar (last visited December 8, 1998) .
[206] See Sovereignty Presentation for Cyberspace and Social Protocols, Harvard Law School (Nov. 24, 1998).
[207] See id.
[208] See generally, Jack Goldsmith, Against Cyberanarchy (visited Dec. 8, 1998) .
[209] See supra Law.
[210] For example, what if Alice discloses information, yet decides she wants it back 15 years later? Perhaps as a 21-year-old college student, she traded some information when ordering a rubber chicken to save 50 cents. Now she is 39, has discovered cold fusion, is under a lot of media attention, and doesn't want it to become public that she has a chicken fetish. There is some flexibility here in an ACCPT negotiation where a site might state as a privacy practice that it deletes all records after 2 years or some other similar period of time. However, without law mandating such a requirement, it is hard for a user to require it. Although it is easy for a website to state something, and a user to accept it or not, under ACCPT, it is more difficult for the user to make a counter-proposal with certain stipulations. The website may not even recognize some of the user's proposals/requests.
[211] See supra Introduction.
[212] The FTC states that:
[Although] the online marketplace is growing rapidly, there are also indications that consumers are wary of participating in it. Surveys have shown that increasing numbers of consumers are concerned about how their personal information is used in the electronic marketplace. . . . In fact, a substantial number of online consumers would rather forego information or products available through the Web than provide a Web site personal information without knowing what the site's information practices are. According to the results of a March 1998 Business Week survey, consumers not currently using the Internet ranked concerns about the privacy of their personal information and communications as the top reason they have stayed off the Internet. . . . These findings suggest that consumers will continue to distrust online companies and will remain wary of engaging in electronic commerce until meaningful and effective consumer privacy protections are implemented in the online marketplace. If such protections are not implemented, the online marketplace will fail to reach its full potential.
FTC, supra note 6.
[213] The Direct Marketing Association takes issue with this assertion. It states :
A Website that provides no opportunity for interaction is not interesting to consumers, adds little or no value to their dialogue with marketers, and therefore is of little value to businesses. Some may need to simply track the number of persons who are visiting their sites. Others may encourage visitors to ask questions as a way of improving their services or building their customer base. Others may provide a product for free that they charge for in the traditional world. In return, it seems reasonable for a publisher to ask a Website visitor to register before providing that person with the same material that could cost him on a newsstand.
Direct Marketing Association, FTC: Consumer Privacy Comments Concerning The Direct Marketing Association--P954807 (July 16, 1997 )
[214] For example, much of the research for this paper was conducted on the web. Many cites in this paper were pulled from public interest organizations such as the Electronic Frontier Foundation, which has also been ranked as one of the four most-linked-to sites by Webcrawler. See Electronic Frontier Foundation (last visited Dec. 9, 1998) .
[215] For instance, Lycos lists among its Top 5% Websites The Recorder Home Page. See Lycos, Best of Web (visited Dec. 9, 1998) . Although the creator never says he is a recorder player himself, he provides a non-commercial site containing an incredibly detailed historical background, extensive list of links, and a discussion of the cultural role of the recorder in all its forms, from medieval pipe to the contemporary plastic kid's noisemaker. See Nicholas S. Lander, The Recorder Home Page (last updated Nov. 30, 1998) .
[216] Lycos also lists multiple university libraries that provide on-line access to their resources. See Lycos, supra note 212. Moreover, many academics will public their books and articles on-line before "paper" publication. See, e.g., Simson Garfinkel, 2048: Privacy, Security and Community in the Next Century (visited Dec. 9, 1998) .
[217] See Oscar H. Gandy, Jr., The Panoptic Sort: A Political Economy of Personal Information 66-68 (1993).
[218] See id. at 107.
[219] Even if direct marketing were held to use public forums, which have the strictest standards for regulation, the ACCPT proposal passes strict scrutiny and would be held permissible. See Ward v. Rock Against Racism, 491 U.S. 781 (1989) (holding that if the regulation is content neutral, narrowly tailored to serve a significant government interest, and leaves open alternative channels of communication, government regulation is permissible).
[220] See e.g., U.S. v. Darby, 312 U.S. 100 (1941) (affirming the federal government's right to regulate interstate commerce).
[221]See Gandy, supra note 217, at 66-68.
[222] All information from EPIC Online Guide to 105th Congress Privacy and Cyber-Liberties Bills (Last visited Dec. 3, 1998) .
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related searches
- online shopping privacy concerns
- google privacy concerns
- yahoo privacy dashboard
- facebook and privacy concerns
- duckduckgo privacy browser for computer
- walt disney company privacy site
- duckduckgo privacy browser for pc
- duckduckgo privacy browser windows 10
- disney plus privacy choices
- privacy act marking dod
- navy privacy act instruction
- privacy act form navy