Privacy on the Internet: the Vole Ving Legal Landscape Debra A
Total Page:16
File Type:pdf, Size:1020Kb
View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Santa Clara University School of Law Santa Clara High Technology Law Journal Volume 16 | Issue 2 Article 10 January 2000 Privacy on the Internet: The volE ving Legal Landscape Debra A. Valentine Follow this and additional works at: http://digitalcommons.law.scu.edu/chtlj Part of the Law Commons Recommended Citation Debra A. Valentine, Privacy on the Internet: The Evolving Legal Landscape , 16 Santa Clara High Tech. L.J. 401 (2000). Available at: http://digitalcommons.law.scu.edu/chtlj/vol16/iss2/10 This Symposium is brought to you for free and open access by the Journals at Santa Clara Law Digital Commons. It has been accepted for inclusion in Santa Clara High Technology Law Journal by an authorized administrator of Santa Clara Law Digital Commons. For more information, please contact [email protected]. PRIVACY ON THE INTERNET: THE EVOLVING LEGAL LANDSCAPE Prepared Remarks of Debra A. Valentinet TABLE OF CONTENTS I. Introduction ................................................................................ 401 II. Privacy on the Internet-The Evolving Legal Landscape ............. 403 A. Federal Trade Commission Act and Informational Privacy ........... 404 B. Other Federal Statutes and Informational Privacy ......................... 408 C. Federal Intemet-Law ................................................................... 410 III. Current Federal Policy on Internet Privacy .................................. 412 IV. The U.S. Approach to Privacy Versus the E.U. Approach ............ 415 V . Conclusion ................................................................................. 417 I. INTRODUCTION The Internet has evolved from a communications link among defense researchers into a network providing millions of users easy access to a wealth of information, goods, and services. Currently, it is estimated that well over 100 million people have access to the Internet, and the number is growing quickly.' In part, the exponential growth in the on-line consumer market has propelled the Internet's extraordinary growth. As the Federal Trade Commission (FTC or "Commission") noted in its July 1999 report to Congress, on-line commerce tripled from approximately $3 billion in sales in 1997 to t General Counsel of the United States Federal Trade Commission. Ms. Valentine previously served as Assistant Director for International Competition and Deputy Director for Policy Planning at the FTC. Before serving with the FTC, she was a partner at O'Melveny & Myers. Ms. Valentine graduated from Yale Law School and received her undergraduate degree from Princeton University. The views expressed here are those of the author and not necessarily of the Federal Trade Commission or any Commissioner. 1. See Cass R. Sunstein, Code Comfort, THE NEw REPuBLc, Jan. 10, 2000, at 37; Nielsen//Netratings, Weekly Internet Ratings, Data for Monday, January 3 through Sunday, January 9, 2000 (Jan. 13, 2000) <http://www.nielsen- netratings.com/press'-releases/pr'-0001 13.htm>. 402 COMPUTER HIGH TECHNOLOGYLAW JOURNAL [Vol.16 approximately $9 billion in 1998 Annual consumer sales are projected to skyrocket from $15 billion in 1999 to $184 billion in 2004.1 The Net is transforming not just our economy, but also our society and our notions of privacy. While the Internet provides a goldmine of information, products, and services to consumers, the Internet also is a rich source of information about consumers. Internet sites collect substantial amounts of personal information, both directly through registration pages, survey forms, order forms, and on-line contests, and indirectly through software products such as "cookies" and other types of tracking software.4 By following consumers' on-line activities, Internet site owners and other data collectors gather significant information about visitors' personal interests and preferences. Such consumer data have proven to be extremely valuable to on-line companies-they enable on-line marketers to target products and services tailored specifically to the interests of individual consumers and permit companies to boost their revenues by selling the data or selling advertising space on their Internet sites.5 An entire industry has emerged to market a variety of software products designed to assist Internet sites in collecting and analyzing visitor data and in serving targeted advertising.6 Ultimately, the prevalence, ease, and relatively low cost of collecting, maintaining, and disseminating personal consumer information have a Janus-faced aspect. On the one hand, the ability to gather, process, and disseminate information on the Internet provides 2. FTC, SELF-REGULATION AND PRIVACY ONLINE: A FEDERAL TRADE COMMISSION REPORT TO CONGRESS 1 (July 1999) <http://www.ftc.gov/os/1999/9907privay99.pdf> [hereinafter FTC's JULY, 1999 PRIVACY REPORT]; see also FTC, THE FTC'S FIRST FIVE YEARS: PROTECTING CONSUMERS ONLINE 3 (Dec. 1999) <http:llwww.ftc.gov/os/1999/9912/fiveyearreport.pdf>. 3. Actual sales for 1999 are not yet available, but the FTC has projected figures of $12 to $18 billion. See FTC's JULY, 1999 PRIVACY REPORT, supra note 2, at 3; see also Forrester Research, Inc., Online Retail to Reach $184 Billion by 2004 as Post-Web Retail Era Unfolds (Sept. 28, 1999) <http:lwww.forrester.comlER/PresslRelease/0,1769,164,FF.htm>. 4. See John Markoff, Bitter Debate On Privacy Divides Two Experts (Dec. 30, 1999) <http:llwww.nytimes.comllibrary/tech/99/12/biztechlarticles/30privacy.htnl>. Cookie technology allows a web site server to place information about a consumer's visits to the site on the consumer's computer in a text file readable only to that web site server. The cookie assigns each consumer's computer a unique identifier so that the consumer can be recognized in later visits to the site. Advertisers are now able to assign a cookie to the computers of users who visit sites in advertising networks and to follow those users from site to site by reading information stored in that cookie at each site. 5. See FrC's JULY, 1999 PRIVACY REPORT, supra note 2, at 2. 6. See id.; see also supra note 4. 2000] PRIVACY ON THE INTERNET consumers with a wealth of benefits (e.g., web sites can "remember" where a consumer has been and what type of products the consumer likes so that when the consumer returns to the site, she can be directed to additional products that are likely to interest her). On the other hand, darker voices are legitimately concerned that the manipulative 7 use of information available on the Net may adversely affect privacy. Some uses of personal data can be intrusive, as when private information is widely circulated; or reckless, as when inaccurate information is widely shared with other people and companies; or predatory, as when the information is used to target victims for a scam or crime. For over five years, the FTC has actively monitored developments in e-commerce, particularly those affecting consumer privacy. The FTC has supported industry self-regulation and has taken enforcement actions as needed. The FTC also has endorsed certain legislative initiatives (e.g., the Children's Online Privacy Protection Act8) to address specific on-line privacy concerns. As explained below, there is no simple choice between self-regulation or legislation as the anointed vehicle for protecting consumers' privacy. We already have both and will continue to need both in the future. II. PRIVACY ON THE INTERNET-T-IE EVOLVING LEGAL LANDSCAPE In the United States, individual privacy, including on-line privacy, is protected through a combination of constitutional guarantees, federal and state statutes, regulations, and voluntary codes of conduct, all of which apply to the public and private sectors in different ways. Although the U.S. Constitution does not explicitly mention a right to privacy, the Supreme Court decades ago recognized a fundamental right to privacy, or the right to be left alone.9 The Court subsequently interpreted the Bill of Rights as creating, through a penumbra of various rights, "a right of personal privacy, or a guarantee [that] certain areas or zones of privacy [do] exist under the Constitution."' ° Viewed in hindsight, the federal courts have effectively acknowledged a right to privacy with respect to marital relations, procreation, contraception, family relationships, 7. See Sunstein, supra note 1, at 37; see also Glenn R. Simpson, E-Commerce Firms Start to Rethink Opposition to Privacy Regulation as Abuses, Anger Rise, WALL ST. J., Jan. 6, 2000, at A24. 8. 15 U.S.C.A. §§ 6501-6506 (West Supp. 1999). 9. See Griswold v. Connecticut, 381 U.S. 479,483-86 (1965). 10. Roe v. Wade, 410 U.S. 113,152 (1973). 404 COMPUTER HIGH TECHNOLOGYLAW JOURNAL [Vol.16 child rearing, and education." In addition, a number of state constitutions specifically enumerate the right of citizens to be protected from privacy invasions.'2 Aside from constitutional guarantees, the U.S. legislative approach to privacy has been traditionally sectoral, that is, privacy law has developed to address particular data types and users.' 3 Historically, fear of the government's use of personal data was the primary concern. Certain statutes thus limit the use of personally identifiable data that the government maintains. 14 Other statutes limit the government's use of personal data maintained by industry. 5 And some statutes limit firms' use of personal data.16 While no single law or regulation specifically recognizes a U.S. citizen's general right to informationalprivacy, certain laws as applied do afford a fair amount of such privacy to consumers. A. Federal Trade Commission Act and InformationalPrivacy Section 5 of the Federal Trade Commission Act 7 ("FTC Act") in 11. See, e.g., Loving v. Virginia, 388 U.S. 1 (1967) (marital relations); Skinner v. Oklahoma, 316 U.S. 535 (1942) (procreation); Eisenstadt v. Baird, 405 U.S. 438 (1972) (contraception); Prince v. Massachusetts, 321 U.S. 156 (1944) (family relationships and child rearing); Pierce v. Society of Sisters, 268 U.S. 510 (1925) (education). 12. See, e.g., CAL CONST. art. I, § 1; ARiz.