With global electronic commerce, you're going to eventually
wind up with many databases of personal information. The European
Parliament has passed the database directive that gives European Union
citizen's certain specific rights about personal, identifiable
information stored in databases. What about the administration's stand
Well first of all, we think that the question of
privacy is of crucial importance; that much as we value the increased
ability to gather and share information that the Internet provides, it
puts an even greater responsibility on us to make sure that people have
the right to protect their privacy. And Americans care deeply about
their privacy. It's been sort of a founding tenet in this country to
promote privacy to a much greater extent than most other countries. So
we think that's very important.
The question then is how do you do it. Do you sit a number of
government bureaucrats in a room and write hundreds of pages of
regulations about "you can do this, you can't do that"? We think that would
be the wrong way to do it, because it would make it so
complicated for people to know what they could or couldn't do. And then
you'd have the privacy police coming out trying to check whether you did
So what we would prefer instead is to have a simple but very powerful
set of laws which say that if I'm going to sell you something I have to
notify you--notify you in a very clear way and not in quarter inch print
or something--if I'm going to use information, including the information
that you made the purchase (or any other information). You have to
have the ability to say no if you don't want to. You have to have the
ability to not enter into the transaction with me and so on and so
forth. For sensitive information--whether it be medical
information or other kinds of sensitive information--I should have to
get your explicit consent. You should have to say specifically, "Yes,
I consent to this," in a noncoercive way before I can do it.
There should also be very strict laws which say that if I abuse that, I'm
going to pay some very strict penalties. Once that
notification requirement and those penalties are there, then
we think this sort of market-based solution is the right way to go,
rather than trying to anticipate every situation in which information
could be used one way or another in writing hundreds of pages of
So that's what we're advocating, and what I suspect will
happen, is that industry groups will step up and try to come up with
Better Housekeeping-type seals of approval on certain procedures. Consumers
will learn that there are certain seals or symbols that they look for that
they can be sure will protect their privacy.
There's one exception to this approach and that has to do with children.
one of the things that the initial draft of our paper is not good enough.
We're improving it in the next draft because we got a lot of very
valid comments and criticisms.
What I've just said is fine if you're
dealing with adults. Adults can give consent but what happens if you have a
ten-year-old child on the other end? You just can't say "Are you 21?" A ten
year-old kid will say, "Sure why not?" And you can run into serious problems
with information being gathered from children and even terrible problems
about stalkers getting information from children and so on.
The concerns the Polly Klaas Foundation has expressed?
With respect to children, there may need to
be a more prescriptive approach and a much more serious set of penalties.
We're looking to explore ways with industry and consumer
groups and children's advocacy groups to create that kind of
So what if a buyer says no to information
gathering or sharing and the Internet business just says shove off? Can you
discriminate against people who don't want their information used for
I think what may wind up happening is that
sellers don't want to diminish their market and if their main business
is to get information from people, if that's really what they're doing,
then I think you can have guidelines that prevent that kind of thing
from happening. If their main business is to sell their product, I don't
think too many of them are going to say "I won't sell to you unless you
give me this" because that cuts down on their market.
But you raise a good point. I think if we saw over time that there was
discrimination developing of this sort and people were effectively being
coerced, then I think you have to do something.
The difficulty when you're in government is that we have very, very
clever lawyers in government. You could sit a number of them in a
room and say, "OK, anticipate every possible way in which a consumer
can get screwed and write a regulation about it." And you wind up with
10,000 pages of regulations and nobody will want to do business on the
Internet because they'll be afraid of violating some regulation.
So what I'd rather do is try to allow things to develop in as free manner
as possible with the kinds of protections on notification I talked
about. I'd rather
wait until there's a real problem and not act based on imagined problems or
problems that may never develop, hypothetical problems.
NEXT: Free trade and the Net