Taking a Stand On Privacy

When Doug Koelemay looks out any window of his Herndon, Va., office, he sees a landscape as changed as it is vast. Five years ago, the area was rural, aside from Dulles International Airport. Now it's known as "Techtopia," home to the Northern Virginia Technology Council (NVTC), and companies including America Online and PSI.Net. They dot the major highways that lead east to our nation's capital, where powerbrokers are working overtime to better understand what's happening in Techtopia and other tech sectors. Atop their list of concerns: privacy.

"There's a deeper interest in public policy here than in other high-tech areas," says Koelemay, vice president of the NVTC. "The industry overall is becoming more politically active because people are realizing they have the ability to be instructors for future policies on technology."

With public concern over consumer protection growing, an increasing number of legislators in the tech-friendly Congress are pushing new, restrictive privacy bills. "Surfing the Web shouldn't require you to share your life story," says Sen. Spencer Abraham (R-Mich.), a popular IT supporter who is pushing legislation for privacy protection.

Not everyone, however, is satisfied the legislation will address the needs of consumers while simultaneously protect the interests of business. Even within Congress, there's a split between those who want to regulate the new economy and those who prefer to watch it evolve from afar.

"There is market demand for privacy protection, and a lot of firms are meeting it and doing it in very effective ways," says Rep. Jim Moran (D-Va.). "If the federal government comes up with a cookie-cutter solution, we're liable to arrest that innovation."

Taking Sides
Supporting the bid for government regulation are organizations, including the Electronic Privacy Information Center (EPIC), and lawmakers, including senators Abraham and Ernest Hollings (D--S.C.), who co-sponsored the Consumer Privacy Protection Act. The bill, currently in review by Senate committees, would prohibit any Internet company or organization from collecting personal or identifiable data from a user without consent, and makes violations punishable under FTC standards. Not surprisingly, the Consumer Privacy Protection Act has quickly become the bill of choice to opponents of self-regulation.

"The big problem with self-regulation for consumers is that there's no standard for the industry and no enforcement," says Marc Rotenberg, director of EPIC. "Companies change their privacy policies, and users or customers don't know it."

Surprisingly, opposition to government regulation is weak, despite the sheer size and scope of the IT industry. While powerful corporations have become politically active in supporting candidates for Congress and the presidency, there is little action on the part of the industry as a whole to lobby against legislation on issues such as privacy. The Online Privacy Alliance (OPA), which supports self-regulation, boasts names like Apple Computer, IBM and KPMG. But the 80-member group represents only a fraction of the combined power the industry wields. Only recently have companies begun to recognize the influence they could have.

"There's a growing number of companies that have shown a willingness to tackle tough issues, such as AOL," Koelemay says. Among other things, more IT companies are staffing their own lobbyists and public-policy analysts, while household names are paving the way for political involvement, he notes.

With regard to privacy, the Computing Technology Industry Association (CompTIA) helped organize a yet-to-be-named coalition of industry leaders this past summer to focus on privacy issues. Among those involved are AOL, HP and Intel, which Tom Santaniello, public policy manager for CompTIA, calls the backbone of the coalition. Santaniello says CompTIA and other organizations say the government shouldn't act on privacy issues until it knows more about the topic.

Privacy Battle Goes Public
Consumer rights for the Web took a giant leap forward last summer when the House passed an anti-spam bill. At the time, it seemed to balance the interests of legislators, industry leaders and consumer-rights activists. Only one House member voted against it, and even strong advocates of self-regulation praised it.

"We supported the bill because we thought it got to the heart of the matter, preventing things like fraud, identity falsification and other [harmful] tactics," says Rich D'Amato, an AOL spokesman.

Now that consumer rights has become a popular cause, some in IT think Congress is going too far. They regard the number of privacy bills drafted in 2000 with fear and suspicion. But legislators in favor of stricter privacy standards insist that it's not the government the industry needs to fear--it's consumers.

E-tailers and Web companies scoff at that claim, but a recent consumer survey by Forrester Research found that 41 percent of online shoppers check out a Web site's privacy policy when visiting for the first time. Amazon.com was scorned by privacy activists earlier this year for its loose standards, while Toysrus.com was hit with 11 class action lawsuits for alleged violations.

Rotenberg says incidents such as these are prompting more legislators to take a look at privacy laws.

Will Cookies Crumble?
While many Web companies keep customer and user information confidential, they're still in the information-collecting business. Many e-commerce sites use personalization software known as a "cookie," which allows a Web site to identify and track visitors. As long as there are cookies, there is sufficient reason to be concerned about self-regulation, activists contend. They want a government body to enforce tougher standards. One candidate: the FTC. The Consumer Privacy Enhancement Act would allow the FTC to fine companies that violate privacy standards $22,000 per violation.

But the effects of such legislation go beyond simply requiring privacy policies and handing out hefty fines; technology such as cookies and CRM software could be in jeopardy as well. Groups like OPA advocate privacy standards that help users prevent their personal information from being used for unrelated purposes. But strict laws could eliminate the use of identifiable information for virtually any purpose without users' approval, choking personalized services for e-commerce sites.

Will the Empire Strike Back?
Some members of Congress still favor industry self-regulation. Rep. Moran co-sponsored a bill called the Privacy Commission Act with Rep. Asa Hutchinson (R-Ark.). The bill, which would have established a commission to review privacy issues, received 250 votes in the House in early October but failed to meet the two-thirds majority and died. A similar "look before you leap" bill has been proposed in the Senate by a bipartisan team.

Technology companies are also fighting back on their own turf by developing privacy-protection software. Cloaking devices, disposable credit card numbers and "blind" shopping accounts can protect financial data and block cookies. American Express and Visa recently began using such technology for e-commerce sites.

CompTIA is optimistic about Techtopia and vows that coalition members will take an active role in Congress. However, Santaniello suspects the IT fallout in Congress will continue.

"It's only a matter of time before the government starts acting like government," Santaniello says. "In Washington, everything is subjected to demagoguery and politicalization."

Even the new economy.