Feeds

US lawmakers publish internet privacy Bill

Draft law to regulate online info sharing

Boost IT visibility and business value

A new law has been proposed that mandates information to be given to website visitors to improve privacy protections in the US. It also lists types of data that can be used until people opt out, and others that can be used only with their consent.

The proposal (pdf) has been published by members of the House of Representatives, Rick Boucher and Cliff Stearns, who are on the House's Subcommittee on Communications, Technology and the Internet. They claim it will offer better protection to users from the increased processing of data demanded by the growing use of behavioural advertising.

The draft law sets new rules for what it calls "covered information" and "sensitive information".

"Covered information" is defined to include, among other things, names, postal and email addresses, fingerprints and retina scans, Social Security and credit card numbers and Internet Protocol (IP) addresses.

The law says that an organisation "shall not collect, use or disclose covered information from or about an individual for any purpose" unless it makes available a privacy notice and obtains the user's consent, though that consent can be implied.

The privacy notice must be "posted clearly and conspicuously on the website" and it must be accessible from a link on the site's homepage. The organisation has to include, among other things, details of the purposes for which the data are collected and used; how it stores the information; how it may merge or link the information collected about the individual with other information about the individual that it may acquire from unaffiliated parties; how it may share the information; how long it will retain the information "in identifiable form" and how it will dispose of it.

The law says that an organisation shall be considered to have the individual's consent to the collection and use of covered information if it provides the privacy policy or statement and if the individual "either affirmatively grants consent for such collection and use or does not decline consent at the time such statement is presented to the individual".

However, the law limits the right of the organisation to share that data with third parties "without first obtaining express affirmative consent" from the subject. The individual's "express affirmative consent" will also be required to make material changes to a privacy policy.

"Sensitive information" is defined to include medical records, race or ethnicity, religious beliefs, sexual orientation, financial records and precise geolocation information. An organisation must not collect or disclose sensitive information from or about an individual unless it makes available its privacy notice before collecting such data and obtains the individual's express affirmative consent.

The law will not apply to government agencies and it will not apply to organisations that collect covered information from fewer than 5,000 people in any 12-month period and that do not collect sensitive information.

The law would bar some sharing of information with other companies, but it makes an exception for advertising networks, which can have access to the information.

"An individual has a reasonable expectation that a company will not share that person’s information with unrelated third parties," said Boucher in a statement. "If a company wants to share an individual’s personally-identifiable information with unaffiliated third parties other than for an operational or transactional purpose, the individual must grant affirmative permission for that sharing.

"Many websites work with third-party advertising networks, which collect information about a person or an IP address from numerous websites, create a profile and target ads based on that profile," it said. "As an exception to the general rule requiring opt in consent for third-party information sharing, opt-out consent would apply to sharing of an individual’s information with a third-party ad network if there is a clear, easy-to-find link to a webpage for the ad network that allows a person to edit his or her profile and, if he chooses, to opt out of having a profile, provided that the ad network does not share the individual’s information with anyone else.

"Companies may collect information about individuals unless an individual affirmatively opts out of that collection," said Boucher. "Opt-out consent also applies when a website relies upon services delivered by another party to effectuate a first party transaction, such as the serving of ads on that website."

“I have been working for years to enact meaningful privacy protection legislation and this draft is advancing the process," said Stearns. "While I may not support everything in the current draft bill, it is important to get the input of stakeholders."

"Our goal is to encourage greater levels of electronic commerce by providing to Internet users the assurance that their experience online will be more secure," said Boucher. "That greater sense of privacy protection will be particularly important in encouraging the trend toward the cloud computing."

Boucher sought to reassure advertisers that the legislation is not designed to stop them using data to show what they think are the right adverts to the most profitable audience.

"Online advertising supports much of the commercial content, applications and services that are available on the Internet today without charge, and this legislation will not disrupt this well established and successful business model. It simply extends to consumers important baseline privacy protections,” he said.

UK consumer regulator the Office of Fair Trading is conducting an investigation into whether it needs to take action to protect consumers over the use of their information to decide what ads they see.

The European Union's then-Consumer Affairs Commissioner said last year that she, too, would monitor behavioural ad systems:

"If we fail to see an adequate response to consumers’ concerns on the issue of data collection and profiling, as a regulator, we will not shy away from our duties nor wait for a cataclysm to wake us up," warned Meglena Kuneva last year.

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

The Essential Guide to IT Transformation

More from The Register

next story
Has Europe cut the UK adrift on data protection?
EU reckons we've one foot out the door anyway
Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
'Greenhouse effect is real, but as for the rest of it ...'
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
Government's 'Google Review' copyright rules become law
Welcome in a New Era ... of copyright litigation
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
Apple smacked with privacy sueball over Location Services
Class action launched on behalf of 100 million iPhone owners
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.