Congressional interest in privacy issues gaining steam

Computerworld - WASHINGTON -- Privacy, the leading technology issue in Congress before last year's terrorist attacks, quickly took a back seat to homeland security, corporate financial scandals and Iraq. But as Washington cooled to the issue, some states and a California county moved forward and adopted tougher privacy rules. It's a trend that has gotten the attention of federal lawmakers and may be spurring them to action on privacy.
Following a hearing today on a major privacy bill in the U.S. House, Rep. Clifford Stearns (R-Fla.) said he would push for action by his Commerce, Trade and Consumer Protection subcommittee -- and possibly by the full Energy and Commerce Committee -- before Congress adjourns next month.
State efforts to adopt their own privacy laws are going to give much more of an impetus to a federal privacy bill, Stearns said. Those localized efforts also represent the worst fears of business groups: an emerging patchwork of state laws and systems capable of recognizing the various rules.
At a hearing today, John Palafoutas, a senior vice president of the American Electronics Association in Santa Clara, Calif., told the committee that state privacy actions are of "great concern to us." In particular, Palafoutas cited a privacy law adopted in Minnesota earlier this year that restricts what Internet service providers can do with customer data and information regarding Web-browsing habits. Service providers that share data with advertisers to customize advertising may be violating the law, some legal experts have said.
"The Minnesota model is the one that scares the industry the most," said Palafoutas, who warned that more and more states will use Minnesota, and other state bills, as templates for their own laws.
The Consumer Privacy Protection Act, a key element of the Stearns bill, is a provision that prevents states and local municipalities from setting their own privacy rules.
But Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, said actions to adopt privacy rules in Minnesota and North Dakota and by San Mateo County in California show "how strongly people feel about this issue."
Rotenberg was also critical of a number of provisions in Stearns' bill, including strict limits on the privacy rights of consumers and legal action available to them. Under the bill, enforcement of privacy issues would rest with the U.S. Federal Trade Commission. Without private rights of action, "that means there is no real accountability," Rotenberg said.
Stearns, speaking with reporters after the hearing, said he may have to make compromises in some areas, possibly to win Democratic support. But businesses aren't looking for many changes in the Stearns bill.
Jon Schall, executive director of the National Business Coalition on E-Commerce and Privacy, which represents large companies such as The Home Depot Inc., Charles Schwab & Co., General Motors Corp. and Procter & Gamble Co., said Stearns' bill "lays out a clear-cut and balanced privacy policy."
Schall also praised the bill for what it wouldn't provide -- an access requirement that might lead to centralized systems.
"Access provisions are best avoided because they could ironically create perverse incentives for companies to centrally maintain exactly the sort of customer profiles that we all seek to avoid," he said.
Stearns' bill, if adopted, would also require firms to post a privacy notice and would give consumers the right to opt out or bar the sale or disclosure of their personal data to other entities.
A competing bill in the U.S. Senate, authored by Senator Ernest "Fritz" Hollings (D-S.C.), isn't expected to win approval this year.
A key difference between the Hollings and Stearns bills is how they would apply: The House bill covers both online and off-line transactions; the Senate measure applies to online commerce. The Hollings bill also creates a number of categories for handling information -- distinguishing, for instance, between sensitive and nonsensitive data, a distinction that businesses don't typically make, said Schall.

Read more about Privacy in Computerworld's Privacy Topic Center.