Policymakers Should ‘Opt Out’ of Privacy Legislation

This essay originally appeared on TechCentralStation.com.

Q: What belongs to you, but others use it more than you do?
A: Your name.

That old riddle captures the paradox of Internet privacy. People viewpersonal information as "theirs," yet they realize others must know thatinformation to deal with them. With the Internet, the problem is who shouldknow what and when.

Today, a legislative push for federal privacy regulation is mounting. Muchof the business community, including Hewlett-Packard, Intel and eBay,endorses legislation to require prominent notice of a Web site's privacypolicy and a check box to opt out of information collection. President Bushhas embraced such "notice and consent" policies.

But special policies for the Internet and not the off-line world (likesupermarket discount card programs) are discriminatory and unfair. Moreover,any federal bill pre-empting states from setting their own policies will becontested. Most important, Congress' exploitation of fears of an Internet"eye in the sky" to gain new regulatory powers hurts consumers ande-commerce. Businesses don't seek information because they want to harmpeople. While sometimes irritating, they just want to sell stuff. Manypeople enjoy and are amazed that Amazon.com can anticipate the next bookthey may want to buy.

The notice and choice allegedly sought in privacy legislation exists now.Most Web sites feature privacy policies -- and those that don't should beavoided. Users can set their Web browser to reject information gathering (byturning off so-called "cookies"). Barring that, free software tools thatwarn when information is being collected can further empower consumers. Foranonymous surfing, the market provides tools from Anonymizer to ZeroKnowledge.The notion of "privacy" encompasses varying relationships between consumersand businesses. There is no one level of privacy appropriate for all thatcan be configured in legislation. And an individual may want to presentdifferent faces in the online world.

Government's role is not to dictate the terms of privacy contracts, but toenforce privacy contracts -- as when it halted Toysmart's sale of consumerdata in violation of its stated privacy policy. Where sites post privacypolicies, the data consumers make available will have been grantedconditionally. As lawyer-author Jonathan Bick told GigaLaw, "[B]ad privacyagreements are deceptive trade practices."

The forgotten good side of the Internet's information customization is theimproved relevance of offers and advertisements -- fewer pitches are "junk."However annoying, advertisements are welcome when offering something youneed.

Information customization benefits individuals and society as a whole bylowering the costs of services like credit and insurance, and boosting theiravailability. The family that had to settle for a secured credit card maybenefit from probability tables that find them a good credit risk because ofjob history or other facts. Information sharing expands options and givespeople second chances. A reputation that could exclude an individual fromservice in one setting may be irrelevant in another, or when viewed incontext with other Internet-gleaned facts.

Information also expands Internet access itself. While some pay monthlyaccess fees, others who don't mind supplying information and sufferingthrough a few banner ads can have free Internet access.

As businesses respond to consumer preferences, more stringent privacyprotections will emerge when desired. Sites will develop policies knowingthat ever-more-efficient browser cops will report to surfers on the level ofsecurity. Mistakes will be made. But restrictive policies can hinderevolving privacy technologies before they mature, weakening consumersagainst malicious spies and hackers who take advantage of a false sense ofsecurity.

And let's not forget that those same governments allegedly eager to protectprivacy can be the leading offenders. It was they who mandated the creationand distribution of the most sensitive information in the first place, suchas driver's license and Social Security numbers. Nothing can rival theInternal Revenue Service and a proposed Internet tax collection scheme interms of invasion of privacy.

The distinction between information disclosure forced by governments and Webcommerce is critical, so any law limiting information collection shouldtarget government first.

In the final analysis, restrictions on information collection haveoverwhelming free speech ramifications. As UCLA law professor Eugene Volokhhas noted, we know things about any individual we run across. We may writedown what we know or tell others. There are no rights to stop people fromtalking about you, he says, just as we talk about others -- and about thecompanies we deal with.

Policymakers should "opt out" of privacy legislation and avoid damage toe-commerce, consumers and the First Amendment.