Senator attacks data sharing

Computerworld - A massive effort by dozens of e-commerce companies to share dossiers containing information about consumer buying habits and other personal information came under fire last week when U.S. Sen. Richard C. Shelby (R-Ala.) raised privacy concerns about the effort in a letter to the chairman of the Federal Trade Commission.
A group of 70 e-commerce companies, including IBM, MicroStrategy Inc. and First Union Corp., for the past year have been quietly developing an XML-based data-sharing specification known as the Customer Profile Exchange. CPexchange is part of an ongoing effort by the companies to create a standard method for pooling data about potentially millions of consumers.
The group's aim is to eventually persuade software developers to use the specification when designing programs that let companies track, share and sell consumer data.
In his letter to FTC Chairman Robert Pitofsky, Shelby, who is the outspoken chairman of the Senate Select Committee on Intelligence, criticized the lack of clear-cut privacy protections being put in place to govern the use of personal consumer data once software developers and companies begin using the CPexchange standard.
"While this effort is intended to enhance commercial activity, I am troubled that insufficient attention has been given to the negative ramifications that the use of this exchange will have on the privacy of American consumers," Shelby wrote to the FTC.
A spokesman for the FTC said the commission is withholding comment on Shelby's request until it can be reviewed in detail. He wouldn't speculate when or what type of action may be taken.
Officials at IBM and Charlotte, N.C.-based First Union didn't return Computerworld requests for an interview. A spokesman for MicroStrategy, however, said that although the company hasn't played an active role in developing the CPexchange specification, privacy remains "of the utmost importance" for the Vienna, Va.-based company.
Authority Unclear
Mark Uncapher, who handles privacy issues for the Arlington, Va.-based Information Technology Association of America, said the FTC's authority in this case isn't clear.
"I am hard-pressed to see how, under existing law, any of this constitutes a deceptive trade practice," said Uncapher. "A year from now, when P3P [the Platform for Privacy Preference] is implemented in Internet browsers, consumers will be able to set their privacy preferences on their browser. Effectively, all this becomes completely a matter of consumer choice."
Most firms today rely on automated information systems to keep track of customers' buying patterns, in an effort to better understand and anticipate consumer likes and dislikes. These systems include tools for analyzing and storing data on