Q&A: New technologies pose online privacy uncertainties, Rotenberg claims

Computerworld - Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC), spoke recently with Computerworld about online privacy issues. In an initial installment of the interview, Rotenberg said he fears that a "privacy meltdown" will result from Google Inc.'s planned acquisition of online ad-serving vendor DoubleClick Inc., a deal that was given the green light last month by the U.S. Federal Trade Commission. In this second installment, he gives his take on how young people view privacy and discusses the privacy ramifications of shopping courtesy cards, radio frequency identification (RFID) tags and bar-coded driver's licenses.

Some privacy advocates argue that the younger generation of Internet users – the Facebook and MySpace users – are less guarded about data privacy. Is this younger generation in the vanguard of a new way of thinking about privacy, or are they just naïve? Younger people today have a different way of thinking about privacy. I think it's a mistake to believe that they value privacy less [than other users do]. And in many respects, that's actually the experience we've often had in this country: notions of privacy evolve based on what technology makes possible. But I think the mistake that people sometimes make is to believe that because kids have a different expectation of privacy, somehow it's a diminished expectation.

Do you think, though, that young users are sharing more information about themselves in public environments than they should be? I think the interesting issue, and where the privacy debate begins, is when the information that they make available to their friends – for example, on a social network site – is gathered surreptitiously and used for marketing purposes. And there, I think there really is a [valid] debate about whether people, and kids in particular, understand what's going on and if it's really fair.

The courtesy cards that retailers issue to customers to qualify for discounts can be used to record everything that someone like me buys. How can that information be used? And as a consumer, should I worry about it? I generally think that being worried is not a helpful way to talk about privacy. In terms of how businesses collect and use personal information, the right approach is really to ask the question, "Are companies being fair with what they do with the data they collect?" If they aren't, then we need some rules in place.

Do you think that retailers are being fair about how they use the purchasing information they collect? I think it's a very serious issue. One of the big paradoxes about privacy is that the companies that collect and use so much information about consumers tend to be very secretive about their own practices, and as a result, it's just very difficult for people to really know what's happening to the data that is provided to [the companies]. So typically, when we talk about privacy laws, one of the main things we're arguing for is simply making companies more accountable in the collection and use of data that they collect.

At an IBM conference that I was at recently, the ID badges for attendees included RFID tags that automatically tracked what sessions people attended. IBM's conference organizers had a reasonable explanation: instead of scanning people's badges as they went into sessions, they just RFID'ed them. But where can this all go if things like driver's licenses or library cards get RFID tags? Your story is very interesting, and in fact, [IBM's] analogy is imperfect. When you scan a card, there's a moment when the card is removed, it's turned over to a reader and the person is aware of the fact that the card is being read. The problem, of course, with an RFID tag is that it can be read at any time by anyone who is in possession of a reader – whether or not the person knows that their card is being scanned. And this is precisely the debate we are having right now with the Department of Homeland Security over many of the identity schemes.