Draft Of Privacy Bill Introduced… And Pretty Much Everyone Hates It

from the is-that-a-good-sign? dept

Rep. Rick Boucher released a draft internet privacy bill that’s getting plenty of attention. You can read the draft on Boucher’s site (pdf) or embedded below:

In Europe, internet privacy laws are pretty standard — but in the US we’ve stayed away from them. The initial reaction to the bill seems to be that everyone hates it. Well, everyone who has a strong position and/or financial interest in it. Privacy groups say the bill is way too weak. Companies say it’s way too restrictive. As per usual, the reality is probably somewhere in the middle. The key component of the bill is that is splits up information into two categories: “covered information” which sites will have to allow users to opt-out of collection, and “sensitive information” which sites will have to have users opt-in.

Covered information (information that sites can collect, but users will have the right to “opt-out” if they don’t like it) includes:

1. The first name or initial and last name.
2. A postal address.
3. A telephone or fax number.
4. An email address.
5. Unique biometric data, including a fingerprint or retina scan.
6. A Social Security number, tax identification number, passport number, driver’s license number, or any other government-issued identification number.
7. A Financial account number, or credit or debit card number, and any required security code, access code, or password that is necessary to permit access to an individual’s financial account.
8. Any unique persistent identifier, such as a customer number, unique pseudonym or user alias, Internet Protocol address, or other unique identifier, where such identifier is used to collect, store, or identify information about a specific individual or a computer, device, or software application owned or used by a particular user or that is otherwise associated with a particular user.
9. A preference profile.
10. Any other information that is collected, stored, used, or disclosed in connection with any covered information described in subparagraphs (A) through (I).

As for “sensitive information” (which sites will require people to opt-in to collect), you’ve got:

1. medical records, including medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;
2. race or ethnicity;
3. religious beliefs;
4. sexual orientation;
5. financial records and other financial information associated with a financial account, including balances and other financial information; or
6. precise geolocation information.

There are also some “exemptions” for the collection of information that was for “operational purposes” or “transactional purposes.” Reading through the whole thing, I have to admit I’m a bit confused as to the purpose of the bill. It seems like the “opt-in” information is the type of information that you would have to opt-in for anyway, because no website is going to be able to get that information without it. As for the opt-out information, most of that can again be handled by the user, simply through various technology offerings out there.

Perhaps I’m missing something, but this seems like the kind of bill that’s designed to say “hey, look, privacy law!” but that doesn’t really do anything to protect people’s privacy. I could see it causing a lot of trouble for sites, though, for no good reason. For example, saying that IP address information can be “opt-out” could create a massive hassle for pretty much any site that keeps log files. Imagine the fun someone could cause by visiting sites and then demanding the site remove his or her IP address from their logs. I understand the general thinking behind this, but I just don’t see it doing anything good, while I could see all sorts of unintended consequences from it.

Filed Under: laws, privacy, rick boucher