A Senate committee migrated back to the online privacy debate again, leaving little doubt that the 107th Congress would pick up where its forerunner left off—putting more than 50 online privacy laws in play while Republicans lead the charge. Web technologists tout P3P.

by Patricia Fusco ISP-Planet Managing Editor [July 17, 2001]

The Senate Commerce Committee discussed Internet privacy legislation with senior-level industry executives last week. Among those executives testifying were representatives from Microsoft and Amazon.com. Like other leaders before them, each industry chief at the privacy powwow urged that lawmakers hold off on creating online privacy legislation, in favor of allowing new technologies and industry initiatives already in place to take root.

But current committee chair Sen. Fritz Hollings (D-SC) and former committee chairman John McCain (R-AZ) both indicated that they would revamp old privacy bills they had submitted separately last year and bring them to the floor this year. Hollings indicated his regurgitated legal band-aide would be sent to the Senate floor for a vote by the end of this session, while McCain simply said he is "convinced that a federal privacy law is needed."

Seceding servers
Each player in this renewed privacy policy battle pitched tents in different camps—tech firms are trying to figure out how not to break laws already on the books, privacy advocates have their own ideas about online rights, Congress is itching for a Web win with online constituents, and consumers are tossing their cookies. No, wait … that's Sen. Jay Rockefeller (D-WV) tossing his cookies.

The honorable West Virginian Senator expressed his concern regarding the tracking capabilities of online technologies. Rockefeller paraded a pile of computer printouts detailing one of his recent Web excursions at the committee meeting. Rockefeller said he was unnerved by the tracking capabilities of online technologies like "cookies" and asked "how we allow this to go on.'' Let's provide him with an answer, shall we?

Essentially, Sen. Rockefeller is considering dismantling the very premise of the Web. This is not to say that the e-commerce sector has made online companies look good or even semi-competent when it comes to online privacy matters. Highly publicized privacy goofs and gaffes undermine even the most secure Web properties, making it more likely than ever that Congress will pass personal data protection legislation this year.

The ins and outs of opting
Regardless of Sen. Rockefeller's rants, the bills sponsored by Senators Hollings and McCain last year differed only in one key provision—whether companies should be required to get explicit permission before sharing customer data, an approach known as "opt-in," or whether they should be free to exploit the data unless consumers asked them not to, known as "opt-out.''

The original bill sponsored by Sen. McCain and co-sponsored by John Kerry (D-MA), would set "opt-out" as the standard of online privacy. The bill by Sen. Hollings requires "opt-in" protocols be set by consumers. But Senators McCain and Kerry indicated they would consider an opt-in variable for more sensitive information, like financial and medical data, when they reintroduce their legislation.

One thing is certain, any representative or senator immersed in this particular area of policy will quickly find themselves being criticized by extremists and moderates on either end, since there is almost no satisfactory resolution of privacy matters anywhere along current lines of thought. But there is a technical solution for new technology woes, that U.S. lawmakers could opt-in and endorse.

Empowering the people
The best way to make almost everyone concerned about Web privacy secure again is to empower Internet users with more control over their online privacy. The Platform for Privacy Preferences Project (P3P) P3P 1.0, developed by the World Wide Web Consortium, is emerging as a balanced solution for online privacy concerns. It provides a simple way for users to gain more control over the use of their personal information collected by Web sites they visit.

At its most fundamental level, P3P is a standardized set of multiple-choice questions covering all the major aspects of a Web site's privacy policies. P3P-enabled Web sites make this information available in a standard, machine-readable format, while P3P-enabled browsers "read" viewer snapshots and automatically adjust for individual's set privacy preferences. P3P enables Web sites to translate their privacy practices into a standardized, machine-readable format via Extensible Markup Language (XML), which can be retrieved automatically and readily interpreted by a user's browser.

The P3P 1.0 specification is advancing through the W3C bureaucratic process toward its final destination as an official W3C recommendation. Microsoft has already leapt action and intends to include P3P capabilities in a new version of its Internet Explorer browser due out this fall.

But P3P is not the final solution for online privacy in itself. In order to work, P3P needs the support of lawmakers that could provide the legal framework of proper implementation and enforcement. Along with inspired lawmaking, P3P technology will need to be embraced by the industry allowing for best-practice standards to evolve.

P3P specifications remain the most promising solution to online privacy concerns today. After all, if technology created the problem, shouldn't Congress allow an online executive committee to correct the problem, rather than have a commerce committee create new Web bugaboos?

— End

 

Related articles:
	[Jun. 22, 2001]	Anti-Spam Best Practice: Put Personal Politics Aside
	[Apr. 11, 2001]	Rep. Armey on Privacy
	[Sep. 8, 2000]	Legacy of the 106th Congress