Time to Get Down to Business on Privacy

By Chris Calabrese
ACLU Washington Legislative Office

Today, the White House released a new policy paper on consumer privacy which may mark an important turning point in the effort to return control over how our online information is handled.

The report contains two main elements. The first is a detailed description about what the administration believes are the core principles that should underpin consumer privacy. The principles go beyond familiar subjects like privacy policies and recommend additional rights for online users, including limitations on collection and use of their information, additional consumer access and accountability for use and misuse of information. These principles closely mirror existing best practices in data privacy law as well as the legal regimes in Europe and Canada.

The report recognizes existing practices in the US aren't up to snuff: personal information is flying everywhere with its owners' control or awareness. Media reports demonstrate that all sorts of problems result including the targeting of vulnerable senior citizens by marketers, misuse of social networking data by insurers and denial of employment.

The solution – which the report clearly states and the administration has testified to in the past – is new privacy laws in the U.S. that cover search engines, onlineservices, social networks, behaviorally targeted advertising and data brokers. Despite these recommendations, the report acknowledges that such legislation isn't imminent.

This is where things get interesting.

The second part of the report proposes the creation of a "multistakeholder" process. Essentially, it would gather together the key constituencies including consumer and civil liberties groups, businesses, academics and possibly other government officials (like state attorneys general) with the stated goal of outlining concrete solutions that would put these privacy principles into practice. These practices would then be enforced by the Federal Trade Commission and possibly state governments. Alternatively, or possibly in addition to, they could also be adopted into law by Congress.

The good news is that conditions may be ripe for success. In Europe, plans are under consideration for very restrictive new data protection laws and businesses would love to see workable alternatives. Consumer groups have been pressuring Congress for action on privacy for years without success. The administration is supportive and willing to use its bully pulpit to push for change.

The ACLU, along with other privacy and consumer groups, has laid out detailed principles for what a fair and open process should look like and how to avoid having it dominated by corporate or other interests. Of course achieving consensus will be difficult but we are gratified that the administration has begun the process. The ACLU will participate and we hope the result will be a series of efforts to help us all regain control of our information online.