• PC World
• » Security

WASHINGTON--Imagine this: As you stroll past a store, your cell phone rings announcing there's a sale inside you shouldn't miss.

Is it a privacy invasion or legitimate promotion? Whichever, it's quite possible to occur, once wireless services begin to draw and redirect customer information, such as telephone numbers and addresses, from Internet sites.

To prevent unwanted solicitations, Reps. Anna Eshoo (D-California) and Chris Cannon (R-Utah) are proposing legislation to "provide consumers with clear notice of how their personal information is being used by Web sites."

Introduced this week, the bill is almost exactly like one proposed last year in the Senate by Arizona Republican John McCain and Massachusetts Democrat John Kerry. It would preempt any existing state laws and set a countrywide standard. Web sites that collect individuals' personal information would have to give individuals a chance to limit the collection and disclosure of those details. Sites could still collect this information by default, but Web surfers could stop its release by specifically opting out of disclosure.

The Eshoo-Cannon proposal differs from some earlier legislation, which set nondisclosure as the default. Under that "opt in" approach, you'd specifically give permission for phone numbers and e-mail addresses to be used for purposes other than intended when you entered the information at a site.

Spotlight on Privacy

"We take our privacy for granted, but now people have less and less confidence in it," Eshoo says. "I think the 107th Congress will pass some sort of privacy legislation this year, and I hope that with this act we can move the ball down the field."

Eshoo takes this legislation personally. Two years ago, someone filed a fraudulent tax form in her name. Yet privacy is a universal issue, she says.

"It is in every member's legislative mind and runs through the veins of every American," Eshoo says. She considers this bill only a starting point.

Robert Litan, vice president of economic studies at the Brookings Institution, says the elements of Eshoo's bill are the ones that could actually pass in Congress.

"Any bill that mandates an opt-in won't pass. It would stop the free flow of information and severely disrupt commerce," Litan says, of the earlier legislation that makes non-participation a default. "And any law that would not preempt the state law is not worth passing."

Yet he doubts any Internet privacy laws will pass in the first year of this Congress, because focus will be centered on the Bush agenda.

"It will take some real consumer horror stories for this to be passed. Consumer fear is not enough to do it," Litan says.

Opening Floodgates

Eshoo maintains the time is right for online privacy legislation at the federal level.

"The stories are already out there," Eshoo says. "I think the reason Congress hasn't dealt with them yet is that they didn't want to rush and issue prescriptive legislation. There still needs to be a lot of discussion."

Jeff Richards, executive director of the trade association Internet Alliance, expects a flood of privacy-related bills in both the federal and state governments this year. But he warns the politics of the issue may blur consumer protection.

"If Congress passes privacy legislation that's symbolic but not effective, then it will make consumers cynical," Richards says. "We don't need new approaches that would deluge consumers with information that doesn't make any sense. Congress needs to take into account the fact that the public is frustrated with abstract language and remedies."

Richards says government doesn't realize the technological landscape will change enormously in the next year or two. Measures like opting in or out of information disclosure miss the point, he says.

"Lots of people will opt in to things, then forget about it and be annoyed when the ads or e-mails actually arrive," Richards says. "I worry about this act building in an adversarial relationship between consumers and companies, and opt-in-out does this."

Balancing Commerce, Concerns

Eshoo believes her proposal strikes a balance between allowing e-companies free flow of information while empowering consumers.

"Business understands that to attract and hold on to customers they have to address issues of privacy," says Eshoo, who refers to industry self-regulation policy as "sticking your head in the sand. It's naïve to think that Congress won't be involved at all."

But federal regulation of technology is a major move, notes Connie Correll, director of communications for the Information Technology Industry Council, a trade association for information technology companies. Congress needs to understand the serious repercussions of federal technology legislation, she says.

"They need to figure out what they are doing with technology first. The last thing they should do is to statically regulate technology that is always going to be changing," Correll says.

Another industry analyst thinks the Eshoo-Cannon proposal is broad enough to avoid imposing static rules on a dynamically changing industry. In fact, it could go further, says Ari Schwartz, policy analyst at the Center for Democracy and Technology.

The danger is that Congress members might vote against this bill either because they think industry self-regulation is sufficient or, at the other extreme, that the Cannon-Eshoo bill is not strong enough, Schwartz says.

"The Cannon-Eshoo bill is too weak," Schwartz says. "It doesn't go far enough to embed fair information practices. But opt-in, opt-out--either way will fundamentally change how we buy things online, whichever way it falls."

• See more like this:
• Eshoo,
• online privacy,
• Congress,
• legislation,
• Cannon