Online Privacy Proposals Abound in Congress

(February 16, 1999) It has been barely a month since the 106th Congress began, yet there are already several proposals that would affect the way web sites and online services collect and disseminate personal information. Sen. Burns released a discussion draft of his proposal on Friday, February 12. Representatives Vento and Franks submitted their bills last month.

Congress first legislated on the subject of online privacy at the close of the 105th Congress. It passed Sen. Richard Bryan's (D-NV) "Children's Online Privacy Protection Act" at the very end of the session as a part of the massive Omnibus Appropriations Bill.

This law requires that any web site or online service that is directed to children obtain parental consent before collecting information from children under the age of 13. Enforcement authority was given to the Federal Trade Commission. FTC Chairman Robert Pitofsky stated at a press conference on February 5 that the FTC is in the process of promulgating regulations to implement the law.

Sen. Conrad Burns (R-MT) released his discussion draft of the "Online Privacy Protection Act of 1999" on Friday, February 12. He intends to introduce this bill after the Congress returns from its Presidents' Day recess. His bill is roughly based on Sen. Bryan's bill, but would extend privacy protection beyond just young children.

"The Internet is the key to our future, but we need to protect privacy on the Internet if it is to ever reach its full potential," said Sen. Burns in a press release. "I believe that this draft walks that fine line between protecting one person's privacy without hindering the rights of another."

Rep. Bruce Vento (D-MN) has introduced his own online privacy bill, HR 313, the "Consumer Internet Privacy Protection Act."

This short bill contains three basic provisions. First, interactive computer services cannot disclose personally identifiable information without written consent. Second, if it does disclose, it cannot falsify information. And third, individuals have the right to learn what information is kept on them. In addition, the bill provides the right to revoke a consent.

The key clause reads:

"An interactive computer service shall not disclose to a third party any personally identifiable information provided by a subscriber to such service without the subscriber's prior informed written consent."

The bill would give investigative and enforcement authority to the Federal Trade Commission; however, the only remedy stated in the bill is a "cease and desist order." The bill would also give aggrieved individuals a private cause of action; again, remedies are not specified.

A third privacy bill was filed by Rep. Bob Franks (R-NJ) on January 19. It would not just affect the Internet. It would cover all activity in interstate commerce. The "Children's Privacy Protection and Parental Empowerment Act of 1999," would criminalize the commercial sale of data about children under 16 without parental consent. While its sanctions are greater than those of the Burns and Vento proposals, it only protects the privacy of children under 16.

Rep. Bob Franks

Unlike the Burns and Vento proposals, which would leave it to consumer protection lawyers in the Federal Trade Commission to civilly enforce their terms, the Franks proposal would have professional prosecutors in the Department of Justice enforcing its criminal sanctions.

It would criminalize the sale by list brokers of information about children under 16, who they know to be under 16, without the prior written consent of the parent. It would also give parents the right to learn what information a list broker has disclosed, to whom it was disclosed, and what information was disclosed. It would also give parents the right to stop further disclosure. The bill would also give parents a private right of action, in which the minimum damages would be $5,000.

Rep. Franks is also Co-chairman of the Congressional Missing and Exploited Children's Caucus. He is also the lead sponsor HR 543, the "Children's Internet Protection Act," which would require schools and libraries receiving funds under the e-rate to use software that filters out pornography.