House Telecom Subcommittee Holds Hearing on Online Privacy

(July 14, 1999) Robert Pitofsky, Chairman of the Federal Trade Commission, testified before the House Telecom Subcommittee that "legislation to address online privacy is not appropriate at this time." While most members of the subcommittee agreed, or stated no position, Rep. Ed Markey complained bitterly that legislation is necessary.

The House Commerce Committee's Subcommittee on Telecommunications heard testimony from all four Commissioners of the Federal Trade Commission on their report, titled  Self-Regulation and Privacy Online. The subcommittee also heard from a panel of industry witnesses.

The report also concluded that "self-regulation is the least intrusive and most efficient means to ensure fair information practices online, given the rapidly evolving nature of the Internet and computer technology." It cited increased posting of privacy policies, and development of online seal programs, such as TRUSTe.

Rep. Tom Bliley

Rep. Tom Bliley (R-VA), who is Chairman of the Commerce Committee, spoke against any legislation to regulate online privacy. "As I have stated many times in the past, I believe that ensuring the safety, security and privacy of online consumers is key to consumer use and acceptance of the Internet. Without these concerns being met, I believe that consumers loose confidence in electronic commerce."

Rep. Bliley continued in his opening statement that "Electronic commerce changes so quickly, I am concerned that a government mandated privacy policy would stifle innovation. We would be imposing a static policy on a dynamic and constantly changing industry."

"Since that hearing last year, I have been monitoring the progress industry has made in self-regulation. I think the progress to date has been very good. The recently completed Georgetown privacy study showed impressive results in the posting of privacy policies by commercial websites," said Bliley.

Rep. Billy Tauzin (R-LA) (web site | bio), the Chairman of the Telecom Subcommittee, presided over the entire hearing of almost four hours.

Rep. Ed Markey

Rep. Edward Markey angrily criticized the FTC Commissioners for their recommendation. "We need a basic level of privacy protections for all Americans online. I believe that there is a role for a privacy marketplace, and a role for industry regulatory self-initiatives. No American should be left, however, without any privacy protection in the online environment. My view, we should pursue a legal framework which should, one, incorporate elements of industry self-regulation, two, allow technological tools to enhance privacy, and three, guarantee basic government backed protections."

He told the FTC Commissioners that "what you are saying is that the system is broken, but we are going to ask the people who have allowed it to remain broken throughout all of 1990s to continue to try to improve, even though they have a 90% failure rate.

He also complained about the lack of financial privacy provisions in the banking reform bill recently passed by the House (HR 10). He wants this to be addressed in conference.

"For instance, we need to address the failure to provide consumers with notice, and a right to say no, when a consumers information is disclosed to affiliates within a bank holding company, rather than an unaffiliated third party. This artificial distinction between affiliate and third party transfers of consumer information makes no sense. It is like outlawing robbery while legalizing embezzlement," said Rep. Markey.

Rep. Rick Boucher also disagreed with the FTC's conclusion, but calmly. Rep. Bill Luther's line of questioning suggested that he too disagrees with the report.

Many members of the subcommittee, and the witnesses from industry, concurred with the report's conclusion.

	Chris Cox

One member, Rep. Chris Cox (R-CA), suggested that while government regulation is not the solution, perhaps creating a property right in personal information, and a private right of action for conversion if that property is taken, would be an appropriate mechanism for protecting online privacy.

He stated that a system by which companies give notice that personal information may be transferred to third parties, along with an opportunity for consumers to opt out "provides the essential ingredient for an enforcement system based on the licensure of personal private information, as if it were a property right. That is to say, that in the same way that all of us accepts a license when we rip open a package of software, or signs a license agreement when we buy computer products of significance, that we would be able to license these provisions, publications of our personal information by others, if we chose to do so. And, we would have a cause of action for conversion of our private property if we chose not to do so. That would require only this in order to make it work, and that is, a legal system that protected private property in that way."

"It is consistent with the way people feel about this issue." Robert Pitofsky responded. "I think the approach you have described is one that they would be comfortable with."

Rep. Tauzin asked the FTC Commissioners about how to deal with bad online businesses which do not submit to industry self-regulation. Robert Pitofsky stated that "no matter how good self-regulation is, some people are going to ignore it." But, Pitofsky added that the same would be the case for any law that Congress might pass.

Orson Swindle stated that the most important thing is to get the large sites, with most of the web traffic, to submit to self-regulation.

FTC Commissioners made the point several times that there would not be 100% compliance with self-regulation, or with law enforcement. Rep. Markey was not impressed. "We have laws against murder on the books. We will never catch all of them. But we are not taking the murder statutes off the books."

Later in the hearing, in response to questions from Rep. Bill Luther (D-MN), Pitofsky stated that he thinks all of the big web sites will submit to industry self-regulation, and it will only be smaller sites that do not comply. He added that the smaller sites' collection of personally identifiable information will not be a threat to privacy because those small sites will not be able to sell their data.

Rep. Anna Eshoo (D-CA) stated that identifying the problem and finding a solution "is like trying to get socks on an octopus." She added that "I don't know that I have made my mind up yet about which is the best way to go."

Rep. Chip Pickering (R-MS) asked questions regarding the legal authority of the FTC under Section 5 of the Federal Trade Commission Act. Robert Pitofsky responded that the FTC has authority to take action under its deceptive trade practices mandate if an online business misleads consumers about its privacy policy. However, he stated that the FTC has not brought a Section 5 case against any business for its online privacy practices where it had advertised no policy. He added, "I am not sure that we could win it."

Rep. James Rogan (R-CA) (web site | bio) asked about the validity of a study conducted by Georgetown University, which the FTC report relied upon as evidence that industry is making progress at self-regulation. Pitofsky stated that the FTC had examined it and concluded that "it is a reliable survey conducted in a very professional way."

Rep. Rogan also commented that "there has to be an awful lot of consumer pressure on corporations" to protect personal privacy. Pitofsky concurred. He stated that "companies are moving towards privacy policies because they believe it is in their own self interest." Commissioner Mozelle Thompson added that protecting privacy "allows them to distinguish themselves in the market."

Rep. Rick Boucher

Rep. Rick Boucher (D-VA) (web site | bio) expressed polite astonishment that the FTC did not recommend legislation. Rep. Boucher is the sponsor of HR 1685 IH, the Internet Growth and Development Act. This bill would require any web site that collects personally identifiable information to clearly and conspicuously provide notice of its collection, use, and disclosure policies.

"I have to express a measure of surprise at your conclusion that no new federal legislation is necessary at this time," said Rep. Boucher. "I am appalled by the recommendation that we not act now." Boucher added that "I think that there is some legislation that we could pass this year that the industry would not head off."

Rep. Boucher also addressed the EU directive on online privacy rights, which provides that data flows could be interrupted when Europeans visit web sites in nations without a privacy policy comparable to the Europeans directive. Boucher argued that if the Congress passes a disclosure and opt out bill, such as his bill, it might satisfy the EU.

Both Pitofsky and Thompson pointed out that while HR 1685 provides for notice and opt out, it does not provide for consumer access  to their data or security precautions. Thompson added that the EU directive also requires access and security.

Rep. Tauzin stated at the conclusion of the hearing that "it is clear from the testimony today that this is still very much in flux."

The members of the subcommittee who participated in all or part of the hearing included Tom Bliley (R-VA), Rick Boucher (D-VA), Chris Cox (R-CA), Barbara Cubin (R-WY), Nathan Deal (R-GA), Anna Eshoo (D-CA), Paul Gillmor (R-OH), Bart Gordon (D-TN), Gene Green (D-TX), Steve Largent (R-OK), William Luther (D-MN), Edward Markey (D-MA), Chip Pickering (R-MS), James Rogan (R-CA), Tom Sawyer (D-OH), John Shimkus (R-IL), Cliff Stearns (R-FL), and Billy Tauzin (R-LA)