[House Hearing, 107 Congress]
[From the U.S. Government Publishing Office]
OPINION SURVEYS: WHAT CONSUMERS HAVE TO SAY ABOUT INFORMATION PRIVACY
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
COMMERCE, TRADE AND CONSUMER PROTECTION
of the
COMMITTEE ON ENERGY AND COMMERCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTH CONGRESS
FIRST SESSION
__________
MAY 8, 2001
__________
Serial No. 107-35
__________
Printed for the use of the Committee on Energy and Commerce
Available via the World Wide Web: http://www.access.gpo.gov/congress/
house
__________
U.S. GOVERNMENT PRINTING OFFICE
72-825 WASHINGTON : 2001
_______________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Printing
Office
Internet: bookstore.gpo.gov Phone: (202) 512-1800 Fax: (202) 512-2250
Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON ENERGY AND COMMERCE
W.J. ``BILLY'' TAUZIN, Louisiana, Chairman
MICHAEL BILIRAKIS, Florida JOHN D. DINGELL, Michigan
JOE BARTON, Texas HENRY A. WAXMAN, California
FRED UPTON, Michigan EDWARD J. MARKEY, Massachusetts
CLIFF STEARNS, Florida RALPH M. HALL, Texas
PAUL E. GILLMOR, Ohio RICK BOUCHER, Virginia
JAMES C. GREENWOOD, Pennsylvania EDOLPHUS TOWNS, New York
CHRISTOPHER COX, California FRANK PALLONE, Jr., New Jersey
NATHAN DEAL, Georgia SHERROD BROWN, Ohio
STEVE LARGENT, Oklahoma BART GORDON, Tennessee
RICHARD BURR, North Carolina PETER DEUTSCH, Florida
ED WHITFIELD, Kentucky BOBBY L. RUSH, Illinois
GREG GANSKE, Iowa ANNA G. ESHOO, California
CHARLIE NORWOOD, Georgia BART STUPAK, Michigan
BARBARA CUBIN, Wyoming ELIOT L. ENGEL, New York
JOHN SHIMKUS, Illinois TOM SAWYER, Ohio
HEATHER WILSON, New Mexico ALBERT R. WYNN, Maryland
JOHN B. SHADEGG, Arizona GENE GREEN, Texas
CHARLES ``CHIP'' PICKERING, KAREN McCARTHY, Missouri
Mississippi TED STRICKLAND, Ohio
VITO FOSSELLA, New York DIANA DeGETTE, Colorado
ROY BLUNT, Missouri THOMAS M. BARRETT, Wisconsin
TOM DAVIS, Virginia BILL LUTHER, Minnesota
ED BRYANT, Tennessee LOIS CAPPS, California
ROBERT L. EHRLICH, Jr., Maryland MICHAEL F. DOYLE, Pennsylvania
STEVE BUYER, Indiana CHRISTOPHER JOHN, Louisiana
GEORGE RADANOVICH, California JANE HARMAN, California
CHARLES F. BASS, New Hampshire
JOSEPH R. PITTS, Pennsylvania
MARY BONO, California
GREG WALDEN, Oregon
LEE TERRY, Nebraska
David V. Marventano, Staff Director
James D. Barnette, General Counsel
Reid P.F. Stuntz, Minority Staff Director and Chief Counsel
______
Subcommittee on Commerce, Trade, and Consumer Protection
CLIFF STEARNS, Florida, Chairman
NATHAN DEAL, Georgia EDOLPHUS TOWNS, New York
Vice Chairman DIANA DeGETTE, Colorado
ED WHITFIELD, Kentucky LOIS CAPPS, California
BARBARA CUBIN, Wyoming MICHAEL F. DOYLE, Pennsylvania
JOHN SHIMKUS, Illinois CHRISTOPHER JOHN, Louisiana
JOHN B. SHADEGG, Arizona JANE HARMAN, California
ED BRYANT, Tennessee HENRY A. WAXMAN, California
STEVE BUYER, Indiana EDWARD J. MARKEY, Massachusetts
GEORGE RADANOVICH, California BART GORDON, Tennessee
CHARLES F. BASS, New Hampshire PETER DEUTSCH, Florida
JOSEPH R. PITTS, Pennsylvania BOBBY L. RUSH, Illinois
GREG WALDEN, Oregon ANNA G. ESHOO, California
LEE TERRY, Nebraska JOHN D. DINGELL, Michigan,
W.J. ``BILLY'' TAUZIN, Louisiana (Ex Officio)
(Ex Officio)
(ii)
C O N T E N T S
__________
Page
Testimony of:
Bauman, Sandra, Vice President, Marketing and Business
Development, Wirthlin Worldwide............................ 23
Newport, Frank, Editor-in-Chief, Gallup Poll................. 20
Rainie, Lee, Director, Pew Internet & American Life Project.. 5
Taylor, Humphrey, Chairman, The Harris Poll, Harris
Interactive................................................ 11
Westin, Alan F., Professor Emeritus, Columbia University,
President, Privacy and American Business................... 14
(iii)
OPINION SURVEYS: WHAT CONSUMERS HAVE TO SAY ABOUT INFORMATION PRIVACY
----------
TUESDAY, MAY 8, 2001
House of Representatives,
Committee on Energy and Commerce,
Subcommittee on Commerce, Trade,
and Consumer Protection,
Washington, DC.
The subcommittee met, pursuant to notice, at 3 p.m., in
room 2123, Rayburn House Office Building, Hon. Cliff Stearns
(chairman) presiding.
Members present: Representatives Stearns, Shimkus, Bryant,
Walden, Terry, Tauzin (ex officio), and Doyle.
Staff present: Ramsen Betfarhad, majority counsel; Mike
O'Rielly, majority professional staff; Kelly Zerzan, majority
counsel; Anthony Habib, legislative clerk; M. Bruce Gwinn,
minority counsel.
Mr. Stearns. I welcome you all to the Subcommittee on
Commerce, Trade and Consumer Protection. This is the fourth in
a series of hearings on Information Privacy. I thank all of you
for attending this hearing this afternoon, especially our
witnesses.
Today's witnesses include representatives of four major
national polling organizations that have surveyed public
opinion on the issue of information privacy. One such survey
was just completed last week. We are also pleased to have Dr.
Westin, a prominent researcher in the field of information
privacy, who began his research and surveys on the issue over
30 years ago.
Credible and scientific public opinion surveys on multi-
faceted public policy issues such as information privacy can be
at times both instructive and perplexing. Still, at no time are
surveys dispositive, nor should they be.
In reviewing the polling data, I realize that like most
important things in life, there is more to the story being told
by the data than a cursory first glance would suggest.
Therefore, after reviewing the survey results, I found myself
facing more questions rather than answers regarding Americans'
views on information privacy.
I look to our witnesses to answer some of those questions,
and maybe one or two questions on other mysteries of life, like
how do you do a good jump shot.
I walk away with a somewhat puzzled, but concrete,
conclusive feeling from some of these surveys. They suggest
that most Americans are anxious about what they perceive to be
a loss of control over the dissemination and use of their
personal information. It seems that this anxiety has been
exacerbated with the advent of the Internet. Still, some of
those same polls also indicate that different people mean
different things when they talk about their information privacy
and their anxieties.
As one of today's witnesses observes, for some Americans
information privacy means anonymity. They want no information
about them traced or disclosed in any circumstance. For others,
information privacy means confidentiality. They are not
comfortable letting information be passed along to third
parties without permission. For many Americans, information
privacy equals simply security. Yet, where poll results are
seemingly clear and thus instructive is the fact that Americans
are most anxious about the improper use of their personal
information, when that improper use can lead to real harm.
Those real harms, in turn, seem to be intimately related to
Americans' information security concerns.
For example, polls indicate that the vast majority, 87
percent, fear financial loss through disclosure of their credit
card information, while 80 percent of Americans fear that the
Internet can be used to commit wide-scale fraud, and 70 percent
are anxious about criminals or pranksters sending out computer
viruses that alter or wipe out personal computer files.
In addition, the fact that Americans are particularly
concerned about protecting their information privacy against
government intrusions is consistent with the proposition that
Americans are most anxious about their information privacy when
they perceive a real harm attaching.
The survey results also seem to reflect a truism--different
people think differently about the same issue. It seems that
older Americans, women, parents and, most importantly, Internet
novices, are more anxious about losing control over their
personal information. There is an inverse correlation between
time spent online and the increased willingness to engage in
what is called ``trusting behavior online.'' Trusting behavior
online includes buying and selling goods, banking, getting
health information, communicating via email or instant
messaging with strangers, joining support groups and making
friends and dates online.
The surveys seem also to suggest that what we as Americans
say in response to a survey question may be different from what
we actually do. Two-thirds of American Internet users having
expressed serious information privacy concerns have,
nevertheless, engaged in at least one trusting activity online,
such as purchasing a book online.
Moreover, while the majority of Americans have a negative
visceral reaction to online tracking and profiling, a
relatively few take steps to shield their identities. For
example, one survey reports that only 1 in 10 Internet users
has set his or her browser to reject ``cookies.'' This brings
me to another observation.
Surveys suggest that Americans as a whole lack knowledge as
to when, how and for what purpose information about them is
collected and used. For example, according to one survey, 56
percent of Internet users do not know what a ``cookie'' is. Yet
another survey reports that 48 percent of Americans who
regularly surf the World-Wide-Web admit to paying little or no
attention to matters such as online tracking and profiling.
And, finally, one of the more interesting survey results is
that as most Americans are anxious about the loss of control
over their personal information, they want rules, but they
reject the notion that the Government and/or Internet companies
are the best stewards of their personal information privacy.
When asked who would do the best job setting those rules,
50 percent said Internet users themselves would be best adept
at setting those rules, while only 24 percent said the Federal
Government, and 18 percent said Internet companies would be
best adept at setting those rules.
Another survey registered some 71 percent of Internet users
saying they themselves, rather than the Government or online
businesses, would have the most say over how Internet companies
track Web activities.
My colleagues, if the public opinion poll suggests one
thing definitely, it is that the American public consumer, with
the issues of information privacy, is as complex as the issue
is itself. So, I look forward to the witnesses' testimony, and
the gentleman from Pennsylvania, Mr. Doyle, is recognized for
an opening comment, as Ranking Member.
Mr. Doyle. Thank you, Mr. Chairman. I am happy to join my
friend here on the panel. Mr. Chairman, I would ask unanimous
consent that the opening statement of Mr. Towns be included.
Mr. Stearns. Without objection, so ordered.
Mr. Doyle. Thank you, Mr. Chairman. I want to thank you for
convening today's hearing providing us insight as to what
American consumers are saying about their information privacy.
I want to thank our invited witnesses for taking the time this
afternoon to share with us the results of these efforts.
I have received a good deal of mail from my constituents
concerning information privacy issues, some expressing concern
that the Government is not doing enough to protect personal
information, and others advocating that the Government is doing
too much. But regardless of their particular opinion on the
issue, the bottom line is, the majority of the contact I
receive sends a clear message that people in Pennsylvania are
very concerned about what happens to and with their personal
information, no matter if they are on- or off-line or if the
Government or a private entity is managing the affairs.
I can tell you that as a consumer I am concerned about the
extent of information on my family's Internet usage and how
that is gathered through the use of cookies, and by whom that
information is used.
Establishing guidelines and limits of information usage and
ensuring proper enforcement presents significant challenges on
a national scale, especially considering the varying degrees
the general populace feels comfortable allowing the Government
or industry to establish regulations related to information
privacy.
Additionally, concerns about private health information
online or off remains very critical to most people and the
Nation. Perhaps most telling is the statistic Mr. Rainie of the
Pew Internet and Life Project gives us. Eighty-five percent of
those who seek health information online are concerned that an
insurance company may raise their rates or deny them coverage
because of the health sites they have visited. Of that, 72
percent are very concerned this may occur.
Without a doubt, protection from discrimination based on
personal health information is a great concern to many
Americans. That is why many of us have supported the Genetic
Nondiscrimination and Health Insurance and Employment Act, H.R.
602, again this session, and will continue to do so until this
important bill is signed into law.
Many of my colleagues on this committee and 229 Members of
Congress support this legislation. No person should be denied
coverage or forced to pay higher premiums because they are
genetically predisposed to develop a certain health condition.
Entities that compile such information while consumers are
online must be held accountable for such actions.
My colleagues, I look forward to the information that our
panel of witnesses will provide us today. I think it will come
as no surprise that the American public want to be secure
online and want their Government to take the appropriate
measures to ensure their desires are protected. Thank you, Mr.
Chairman.
Mr. Stearns. Thank my colleague. The gentleman from
Nebraska, Mr. Terry.
Mr. Terry. Pass, Mr. Chairman.
Mr. Stearns. The gentleman from Illinois, Mr. Shimkus, is
recognized.
Mr. Shimkus. Thank you, Mr. Chairman. I, too, appreciate
you having this hearing. I just quote Diana DeGette, you know,
the public, the individuals have a hard time understanding the
benefit we have through sharing information as much as some
individual folks who don't understand the benefits of holding
classified or important information to themselves.
The scary thing about going into privacy is it is kind of
like opening Pandora's Box because there are going to be so
many conflicting concerns and emotions involved. Where do you
start? How do you finish? Nobody will be satisfied. And it is
into this muddle mess that the Chairman is venturing, and I
commend him because it is, as I think we are going to find out
from the testimony today, really a pressing concern and
something we need to get our hands around, reluctantly probably
from many corners.
So, thank you for taking the time. Your testimony is very,
very important, and I look forward to hearing your testimony
and asking questions. And I yield back my time, Mr. Chairman.
Thank you.
Mr. Stearns. I thank my colleague. We will now hear from
our panel: Mr. Harrison Lee Rainie, Director of Pew Internet &
American Life Project; Mr. Humphrey Taylor, Chairman of The
Harris Poll, Harris Interactive; Dr. Alan Westin, Professor
Emeritus, Columbia University, President, Privacy and American
Business; Dr. Newport, Editor-in-Chief, Gallup Poll, and Dr.
Sandra Bauman, Vice President of Marketing and Business
Development, the Wirthlin Worldwide Group. I want to thank all
of you for your attendance here, and we will start from my left
and go to my right and, Mr. Rainie, we will have your opening
statement.
STATEMENTS OF LEE RAINIE, DIRECTOR, PEW INTERNET & AMERICAN
LIFE PROJECT; HUMPHREY TAYLOR, CHAIRMAN, THE HARRIS POLL,
HARRIS INTERACTIVE; ALAN F. WESTIN, PROFESSOR EMERITUS,
COLUMBIA UNIVERSITY, PRESIDENT, PRIVACY AND AMERICAN BUSINESS;
FRANK NEWPORT, EDITOR-IN-CHIEF, GALLUP POLL; AND SANDRA BAUMAN,
VICE PRESIDENT, MARKETING AND BUSINESS DEVELOPMENT, WIRTHLIN
WORLDWIDE
Mr. Rainie. Thank you. Chairman Stearns, honorable members
of the subcommittee, it is an honor for the Pew Internet &
American Life Project to be asked to testify at this important
hearing. The project is an independent, nonpartisan, research
operation created to examine the social impact of the Internet
with a grant from the Pew Charitable Trusts. We have no agenda
except analytical research.
Our surveys show that Americans with Internet access would
like the presumption of privacy when they are online, and they
would like to be in control of when pieces of their identity
are given out. If they could craft a Golden Rule for the
Internet, it would be: ``Nobody should know what I do on the
Web or anything else about me unless I say so.''
Not surprisingly, these Americans have great concerns about
their privacy being compromised, but it is also clear that
different people mean different things when they are talking
about privacy. For some, privacy means absolute anonymity; for
others, it means absolute confidentiality. They are comfortable
letting some Web-based organizations know about them, but they
do not want that information passed along to third parties
without their permission. And for others, privacy means
security; More than two-thirds of Internet users worry that
hackers will steal their credit card information.
Americans are most anxious, of course, about highly
sensitive information that might be used to cause them harm.
For instance, most Internet users fear insurance companies
learning about their searches for medical information and
perhaps changing their insurance status or canceling their
insurance. Many fear their employers might find out about their
health searches and worry how that would affect their job
status.
At the same time they express anxiety about their privacy,
Internet users do a striking number of intimate and trusting
things online. More than two-thirds of those who have serious
privacy concerns have done at least one of the things that is
on the chart to your right. It starts in the upper, left-hand
corner with seeking medical information, using credit cards for
online purchases, seeking financial information, making travel
reservations. About a third of Internet users have customized
Web sites or have gotten registration for email alerts on
various subjects including news, health concerns, weather, and
even horoscopes. Some have responded to email from strangers,
some have participated by giving their full name and discussing
both medical problems and personal problems in online support
groups, and some have gone to dating sites.
To some degree then, there is a gap between Internet users
expressed fears and their actual behavior. Perhaps one of the
reasons for that apparent contradiction is that few Internet
users have ever had a serious problem online. Another reason is
that the majority of Internet users do not know if, or how,
they are being tracked. Most feel they are anonymous online
unless they take affirmative steps to disclose information
about themselves. The majority, 56 percent, of Internet users
do not know what a ``cookie'' is. They don't know the basic
mechanics of how they are tracked and profiled through the use
of cookies, and they don't know this is going on almost all of
the time they have access to the Web.
One useful way to measure the gap between Internet users'
attitudes and their behaviors is to look at the privacy
protection steps they have taken, and that is on the next chart
before you. If you compare this chart, the privacy protection
steps they have taken, to the previous one, you will see that
Internet users are much less likely to take privacy protection
steps than they are to do things online where significant
pieces of information about them are disclosed.
The most serious Internet users, of course, know how to lie
to protect their identity. They have set up secondary email
accounts. Some of them, a pretty small percentage, know how to
use encryption to protect their email in anonymizing
technology, but it is a very small number. These tools are not
being used by the vast majority of Internet users.
Even though Internet users have fears about their online
privacy, these sentiments do not translate into a universal
yearning for anonymity. In fact, almost two-thirds of them are
comfortable with disclosing information under the terms of the
basic Information Age bargain: ``I give you a piece of
information about me in return for something of value from
you.''
In addition, there is at least one other context in which
the strong public concern about privacy is tempered by other
fears, and that is when Americans express their anxiety about
online crime. We found recently that 54 percent of all
Americans and 60 percent of Internet users approve of the FBI
or law enforcement agencies intercepting email sent to or from
people suspected of criminal activities. At the same time, 62
percent of Americans say new laws should be written to make
sure that ordinary citizens' privacy is protected from
government agency interceptions like the ones that they approve
of.
It is also important to understand that concern about
privacy is notably higher among some groups, especially
parents, older Americans, women, African Americans, and
Hispanics who have Internet access. In general, those who are
most worried about privacy tend to be the ones who do the least
online.
One of the biggest questions hanging over the Internet is
whether today's newcomers will eventually act like today's
veterans in their online behavior and their beliefs. The
veteran population is dominated by young, upscale, well
educated, white men. The Internet novice population looks a lot
more like the rest of American because it has large numbers of
women, African Americans, Hispanics, and those from modest
economic circumstances.
As you can see from the final chart that is over here and
in your material, veterans are much more likely to have
exploited key features of the Internet. They are more likely to
have clicked on advertisements. They are more likely to have
purchased goods online. They are more likely even in their
beliefs to be tolerant of tracking. They are more likely to
have responded to emails from strangers. They are a more
trusting crowd.
The issue, of course, is whether this large, newcomer group
which is more concerned about privacy issues, will feel less
anxious as time passes, and will do more activities online.
Several weeks ago, we wrapped up a survey of people that we
also interviewed a year ago, so we have year-to-year
comparisons of their behavior and their beliefs. Our
preliminary analysis suggests that experience online
significantly increases the commercial transactions of Internet
users as well as their willingness to do trusting things
online.
What are the policy implications of these findings?
Internet users embrace principles of notice, choice, access to
information about them, and security. Internet users would
prefer a different tilt on the privacy playing field, one where
the burden of effort is shifted away from them to be vigilant
about managing their identity and toward those who want to
collect information about them.
Internet users would profit from an industry-led education
campaign that focuses on the mechanics and virtues of tracking.
Companies would gain in users' eyes if they offered a clearer
and more convincing explanation for the value of cookies,
specifically how cookies enhance user experiences and how their
use is tied to advertisers' support of much of the free content
on the Web.
Finally, Internet users would appreciate more technology
tools to give them a sense of control, or at least
transparency, in letting them know what is happening to pieces
of their identities as they move through Internet space. Thank
you.
[The prepared statement of Lee Rainie follows:]
Prepared Statement of Lee Rainie, Director, Pew Internet & American
Life Project
Chairman Stearns and honorable members of the Subcommittee, it is a
distinct honor for the Pew Internet & American Life Project to be asked
to testify at this important hearing. I am the director of the project.
It is an independent, nonpartisan, center created to examine the social
impact of the Internet with a grant from the Pew Charitable Trusts. We
do not have an advocacy agenda. I will be talking today about our
findings from several polls we conducted last year and in February this
year that illustrate some fascinating cross currents on the privacy
issue.
At the most fundamental level, Americans would like the presumption
of privacy when they are online and they would like to be in control of
when pieces of their identity are given out. This is the Information
Age corollary to the classic American formulation of privacy: the right
to be left alone. In the 21st Century, they want right to control their
identities. If they could craft a Golden Rule of the Internet it would
be: ``Nobody should know what I do on the Web or anything else about me
unless I say so.''
Not surprisingly, these Americans have great concerns about their
privacy being compromised. Still, it has become clear in our work
related to this issue that different people mean different things when
they are talking about privacy. The context of the questions and of the
behavior needs to be understood in order to grasp how Americans feel
about privacy. For instance, the definition of the term is very
important. For some it means anonymity. About a quarter of Internet
users say they want no information about them traced or disclosed in
any circumstance.
For others, the concept of ``privacy'' means confidentiality. They
are comfortable letting some Web sites or organizations know about
them, but they do not want that information passed along to third
parties without permission. And for others it means security; they are
anxious that information about them is going to be discovered by
hackers (68% of Internet users worry hackers will steal their credit
card information) or that important personal data will be inadvertently
disclosed by a sloppy Web operation.
Americans also are most anxious about improper use of their
information when it could do them real harm. Most Internet users fear
insurance companies learning about their health and medical information
searches and, as a result, changing or canceling insurance because of
the kinds of Web sites that were visited. Many fear their employers
might find out and that could affect their job status. And the vast
majority fear financial loss through disclosure of their credit card
information.
TRUSTING BEHAVIOR
At the same time they overwhelmingly express concern about their
online privacy, American Internet users do a striking number of
intimate and trusting things online. This is another aspect of how the
context of privacy discussions is important to understand. More than
two-thirds of Internet users who have serious privacy concerns have
done at least one of these things online: purchase goods, make travel
reservations, get health information, respond to email and instant
messages from strangers, make friends and dates with people they have
never met face-to-face, join support groups, place their calendars and
address books online, and participate in online auctions.
Perhaps one of the reasons for that level of trustful behavior is
that few Internet users have ever had a serious problem online. Just 4%
of Internet users say they have felt threatened in some way while they
were online; 3% say they have been cheated when they tried to buy
something online; and fewer than 3% believe their credit card
information has been stolen online. The irksome issue is ``spam,'' the
online equivalent of junk mail, which makes about a third of Internet
users unhappy to varying degrees. And about a quarter of Internet users
say they have gotten an offensive email from a stranger.
Yet another reason for the high level of trusting activity online
is the majority of Internet users do not know if or how they are being
tracked. Most feel they are anonymous online unless they take
affirmative steps to disclose information about themselves. This is
enormously important, for instance, to some who seek health
information, especially when they are conducting their searches in the
privacy of their den or recreation room. Most are unaware, of course,
that many of the health-related Web sites they visit plant cookies--
small bits of encrypted information deposited on a computer's hard
drive so the online firm can track the user's clicks through the site
(and sometimes other sites) and to identify that computer the next time
it visits the health site. Fully 56% of Internet users do not know what
a cookie is; and just a tenth of Internet users have set their browsers
to reject cookies.
In principle, Americans do not much like the idea of online
tracking and profiling--by a two-to-one margin they say that tracking
is an invasion of privacy, rather than a tool to help Web sites provide
customized information to users. Still, relatively few take steps to
shield their identities: 24% of Internet users have provided a fake
name or personal information in order to avoid giving a Web site real
information; 9% have used encryption to scramble their email; 5% have
used ``anonymizing'' software that hides their computer identity from
Web sites they visit.
INFORMATION TRANSACTIONS
Internet users' preference for a presumption of privacy does not
translate into a universal yearning for anonymity. In fact, most are
comfortable with disclosing information under the terms of basic
information transaction of the Internet age in which the bargain
between a user and a Web site is: ``I give you a piece of my identity
in return for something of value from you.'' Some 54% of Internet users
have chosen to provide personal information in order to use a Web site
and an additional 10% say would be willing to provide it under the
right circumstances.
They want rules, but they reject the notion that the government and
Internet companies are the best stewards of their personal privacy.
Asked who would do the best job setting those rules, 50% of online
Americans said Internet users' themselves would be best, 24% said the
federal government would be best; and 18% said Internet companies would
be best.
And they are clear in their gut-level preference for what they
would like the rule to be: 86% of Internet users say that Internet
companies should ask people for permission to use their personal
information. It is important to add that at the time we measured this
sentiment last spring, we knew that most Internet users would not know
the intricacies of the policy debate about the different kinds of
options--opt-in or opt-out or robust-opt-out and everything in between.
So, we did not pose our questions in a way that would sort out
Americans' views on these matters. We know they express every way they
can that they would like to control the process of information
collection and disclosure.
Finally, there is also at least one other context in which the
strong public concern about privacy is tempered by another fear: the
anxiety about online crime. In a survey in February, we found that
substantial majorities of Americans were concerned about every kind of
online crime. As a result, 54% of all Americans (and 60% of Internet
users) approve of the FBI or law enforcement agencies intercepting
email over the Internet sent to and from people suspected of criminal
activities; 34% of all Americans said they disapprove; 12% said they
don't know. At the same time, 62% of Americans say new laws should be
written to make sure that ordinary citizens' privacy is protected from
government agencies.
DEMOGRAPHIC CONTEXT
Concerns about privacy are notably higher among some groups,
especially Internet novices (those who first got online within the past
six months), parents, older Americans, and women. In some cases, these
fears also apply to online African-Americans, Hispanics, and those in
households with modest income levels. These fears are often associated
with lower participation in online life and some online activities,
especially commercial transactions. For instance, one of our surveys
suggested that those who had the strongest fears about privacy
violations online were 20% less likely to have shared information with
a Web site; 15% less likely to have used their credit cards online, and
15% less likely to have clicked on an ad.
One of the biggest questions hanging over the Internet is whether
today's newcomers will eventually act like today's veterans in their
online behavior and in their beliefs. The veteran population is
dominated by young, upscale, well-educated, white men. They are much
more likely than others to say they are unconcerned about their privacy
being compromised in the online world and much more likely to spend
money and manage money (through online banking and brokerage
activities) than other Internet groups. On the other hand, the novice
Internet population looks a lot more like the rest of America with lots
of women, minorities, and those from modest-income households, and
without college educations. The issue is whether this large newcomer
group, which is more concerned about privacy issues, will feel less
anxious as time passes and will do more business online.
We are just getting some preliminary information that suggests
experience online significantly increases the commercial activities of
Internet users as well as their willingness to do other trusting
activities online, such as seeking health information. In March 2001,
we reinterviewed about 90 Internet users who told us in March 2000 they
had recently gotten Internet access. In the course of a year of gaining
experience online, this group showed a 15% increase in the number of
trusting activities this group had performing online and a nearly 50%
increase in the commercial activities it had performed online. This is
too small a group from which to draw strong conclusions, but it
suggests that experience breeds higher levels of trust.
Privacy concerns are an even bigger issue to those who do not now
have Internet access. More than 82 million American adults to not have
Internet connections and more than half of them say they have no plans
to get access. One of the major concerns they cite is the danger and
unreliability of the online world. These worries are most acute among
older Americans.
POLICY IMPLICATIONS
Internet users would be happier if their online experiences were
governed by the strong preference to be in charge of their identities.
They embrace principles of notice, choice, access to information about
them, and security. Internet users would prefer a different tilt on the
privacy playing field, where the burden of effort was shifted away from
them and towards those who want to collect information about them.
Internet users would surely profit from an industry-led education
campaign that focused on the mechanics of tracking. Companies would
gain in users' eyes if they offered a clearer and more convincing
explanation of the virtues of cookies--specifically, how their use
enhances users' experiences and makes it simpler and more efficient for
them to use the Web, and how their use enables advertisers to support
the vast amount of free content on the Web. Our surveys show that most
Americans viscerally oppose the ideas of online tracking and profiling
and they will need a lot of convincing before they accept some of the
benefits of those activities.
Finally, users would appreciate more technological tools that would
give them a sense of control, or at least transparency in letting them
know what is happening to the pieces of their identity they are
divulging as they move through Internet space.
addendum: other significant findings in pew internet project surveys
86% of Internet users think Internet companies should ask
people for permission to use personal information when people
give it to them.
71% of Internet users say they themselves, rather than the
government or online businesses, should have the most say over
how Internet companies track Web activities,
54% of Internet users believe that Web sites' tracking of
users is harmful because it invades their privacy; 27% say
tracking is helpful because it allows the sites to provide
information tailored to specific consumers.
89% of those who seek health information online (we call them
``health seekers'') are concerned that a health-related Web
site might sell or give away information about what they did
online; 71% are ``very concerned'' about such privacy
violations.
85% of health seekers are concerned that an insurance company
might raise their rates or deny them coverage because of the
health sites they have visited; 72% are ``very concerned''
about this possibility.
52% of health seekers are concerned that their employer might
find out what health sites they have visited. This ranks
comparatively low in part because most health seekers are
getting their information online from home.
60% of Internet users think that putting medical records
online is a bad thing, even if the records are on a secure,
password-protected site, because they worry about other people
seeing their personal information. The rest think it's a good
thing because they and their doctors would have easy access to
patients' medical records.
94% of Internet users want privacy violators to be
disciplined. If an Internet company violated its stated privacy
policy and used personal information in ways that it said it
would not, 11% of Internet users say the company's owners
should be sent to prison; 27% say the owners should be fined;
26% say the site should be shut down; 30% say the site should
be placed on a list of fraudulent Web sites.
Internet users are pretty savvy about at least one privacy
safeguard: passwords. Sixty-eight percent of Internet users use
different passwords when they register at various Web sites.
While many are concerned about their privacy online, there is
no evidence that the Internet is a more menacing threat to
privacy, in most Americans' opinion, than activities in the
offline world. That applies, for instance, to credit card
information. Of all those Americans who had used their credit
card to buy something over the phone, 56% said they worried
about someone else getting their credit card number. In
comparison, of all those with Internet access who used their
credit card to buy something online, 54% said they worried
about someone else getting their credit card number.
Similarly, Americans are just as likely to approve FBI or law
enforcement surveillance of criminal suspects' phone calls and
postal mail as they are to approve surveillance of suspects'
email. Fully 56% of all Americans approve of the FBI or law
enforcement agencies intercepting telephone calls to and from
people suspected of criminal activities; 55% of all Americans
approve of the FBI or law enforcement agencies intercepting
letters and packages sent by mail to and from people suspected
of criminal activities; 54% of all Americans approve of the FBI
or law enforcement agencies intercepting email over the
Internet sent to and from people suspected of criminal
activities.
11% of all Americans and 17% of Internet users know someone
who was fired or disciplined because of an email they sent or a
Web site they went to at work.
25% of Internet users have been hit by computer viruses. The
vast majority of the viruses have been sent to them via email.
Older Americans are more likely than younger Americans to
express concerns about privacy and the Internet. Fully 67% of
those between the ages of 50 and 64 years old say they are
``very concerned'' about businesses and people they don't know
getting personal information about them or their families,
compared to 46% of between 18 and 29.
81% of those who get health information online would like to
have the right to sue a medical company that gave away or sold
information in violation of its privacy promises.
92% of Americans say they are concerned about child
pornography on the Internet and 50% of Americans cite child
porn as the single most heinous crime that takes place online.
In other areas, 87% of Americans say they are concerned about
credit card theft online; 82% are concerned about how organized
terrorists can wreak havoc with Internet tools; 80% fear that
the Internet can be used to commit wide scale fraud; 78% fear
hackers getting access to government computer networks; 76%
fear hackers getting access to business networks; and 70% are
anxious about criminals or pranksters sending out computer
viruses that alter or wipe out personal computer files.
62% of Americans say new laws should be written to make sure
that ordinary citizens' privacy is protected from government
agencies.
Among the relatively small number of Americans (21%) who have
heard about the FBI's email sniffing program called
``Carnivore'' or ``DCS1000,'' there is much more evenly divided
opinion. Forty-five percent of people who have heard of it say
Carnivore is good because it will allow the FBI a new way of
tracking down criminals. Another 45% say Carnivore is bad
because it could be used to read emails to and from ordinary
citizens.
79% of Internet users who did not buy gifts during the holiday
season of 2000 said they do not like to send credit card or
other personal information over the Internet.
Mr. Stearns. Mr. Taylor.
STATEMENT OF HUMPHREY TAYLOR
Mr. Taylor. Mr. Chairman, Members of Congress, many thanks
for inviting me to give this testimony. I am delighted to be
here. I will slightly abbreviate my written remarks in the
interest of time.
Harris Interactive, formerly Lewis Harris and Associates,
sometimes known as the Harris Poll, has conducted some 30
surveys on privacy issues over more than 20 years. Many of
these surveys were done with my friend and privacy mentor, Dr.
Westin over here, whose knowledge and wisdom and judgment on
this subject has been invaluable to us.
In the interest of time, I am going to talk only really
about privacy on the Internet, and not about the many other
things we have covered. Because of the need for brevity,
however, it is important to make three general comments. One is
that public opinion, as I think Dr. Westin will tell you, is
not at all homogeneous.
Second, the public opinion on privacy issues is not stable,
it changes, and will continue to change. Third, that privacy
is, as you have said, a very multi-faceted issue covering
everything from identity fraud and discrimination to
embarrassment--for example, if it lets people know that you
have been visiting porno sites--or just plain nuisance from
being repeatedly spammed.
We have described privacy as a ``landmine issue'' because
it is something which may blow up in the faces of people who
are not expecting it. They are not aware that it is there as an
issue until it blows up.
When we ask people to tell us what issues are important to
them spontaneously, they very rarely mention privacy. It is not
usually a top-of-the-mind issue. But whenever we ask people
about the importance of privacy, they almost invariably tell us
that it is important or very important.
And, indeed, the public concern about privacy and the
public perceptions of the importance of privacy and the
feelings that they have lost control of their privacy have all
been increasing over the last two decades.
When somebody does tread on an issue like this and it does
explode, the potential for public outrage is very substantial,
and there can be very strong demands for punitive government
regulations of industries, most of which are entirely innocent
of any wrongdoing, but where there are a few bad apples in the
barrel.
What are the biggest concerns about privacy online? The
largest numbers in our surveys, between 50 and 65 percent, say
they are very concerned about Web sites which provide
information, personal information about them to other
organizations without their knowledge, Web sites which collect
information about them without their knowledge, Web sites which
merge their shopping and browsing habits to develop profiles of
their behaviors and tastes, and their financial or other
sensitive information being stolen.
Now, you should know that the public differentiates quite
sharply between different companies and different industries
and different organizations, and that the public is much more
trusting of some than of others so it depends who you are, and
clearly trust is something which can be earned and can equally
easily, or much more easily, be lost.
I interpret our data as showing that having and displaying
strong privacy policies is not just something which is ethical,
but which is something actually good marketing and good
business, whether or not people actually read them and, in most
cases, or in many cases, only a small minority of Internet
users actually read the privacy notices.
There is clear evidence of the public's willingness to
trade information, personal information, in return for
benefits. However, most people have very little idea about how
companies are now using that information in ways which are
helpful to them, and they don't therefore see why it is
necessary to provide that information. But when the use of that
information is explained to them in terms of specific benefits
to them, they become much, much more willing to provide it.
We also see that the use of the Internet over time
increases trust and decreases concern about privacy because, as
you just heard, relatively few people have suffered any adverse
consequences.
Familiarity with the Internet generally breeds not
contempt, but comfort and trust. This is also true of the user
purchasing online and the use of credit cards.
Finally, what does the public want from government? Well,
ours and other surveys show that on balance the public doesn't
have much confidence in government's ability to protect their
privacy and, indeed, often views them as a greater potential
threat to their privacy than the private sector. And, ideally,
people say that it would be better if industry or companies
could self-regulate to protect their privacy.
Having said that, our surveys also show that the majority
of the public favor government regulation to protect their
privacy because they actually do not believe that the
industries will self-regulate effectively. In other words,
there will be enough bad apples in the barrel to make
regulation necessary.
We also have information as to the specific things that the
public wants in the way of protection. Overwhelming majorities
want people who collect information about them to ask their
permission before using their personal information for any
other purpose than it was originally given for. They want the
companies to explain to consumers what personal information is
collected about them and how it is used. They want these
companies to allow consumers to see the information the company
has stored about them. And they want to be told exactly how
their sensitive information is secured in both transmission and
storage.
Finally, as I said, I think that having good, strong
privacy protection policies and notices is not only something
which the public wants, but which is also actually good for
legitimate business. Thank you, Mr. Chairman.
[The prepared statement of Humphrey Taylor follows:]
Prepared Statement of Humphrey Taylor, Chairman, The Harris Poll,
Harris Interactive
INTRODUCTION
Thank you for inviting me to today's hearing.
Harris Interactive, formerly Louis Harris & Associates (and often
known as The Harris Poll) has conducted more than 30 surveys over the
last 23 years on privacy issues for clients such as IBM, Equifax, The
Privacy Leadership Initiative, The Wall Street Journal, Business Week,
and the National Consumers League. Many of these surveys were done with
the invaluable advice of my privacy mentor, Dr. Alan Westin. I should
note that Harris Interactive conducts many research projects using the
Internet, that we have strong privacy protection for our respondents,
and that we are member of the Privacy Leadership Initiative (PLI).
However, today I speak only for myself. My opinions are not necessarily
those of anyone else.
Much of this research, relating to issues such as direct mail,
consumer databases and marketing generally, in relation to credit,
insurance, medical records, employment, telecommunications, law
enforcement and the Census for example, had nothing to do directly with
the Internet. In my brief time today, I will try to give you the big
picture of what we found in our research about privacy on the Internet,
and not mention the many other privacy issues we have addressed in our
research.
Because of the need for brevity, three words of caution are
necessary:
1. Public opinion--as I hope Alan Westin will tell you--is not at all
homogeneous.
2. Public opinion is not stable. It has changed and will continue to
change.
3. Privacy is a multi-faceted issue involving everything from identity
fraud and discrimination or embarrassment to minor annoyances.
how important is privacy online as an issue?
I have often described privacy as a ``landmine issue.'' It is only
rarely mentioned spontaneously by the public as a ``top of mind'' issue
but, when asked about privacy, large majorities of the public say it is
an important issue, that they do not believe their privacy is
adequately protected and they are very concerned about it. We use the
word ``landmine'' because we believe privacy can very quickly become a
major issue based either on bad personal experience or on negative
media coverage of offensive violations of privacy. (This is what
happened with credit ratings.)
When this happens public outrage can grow rapidly and support
strong, even punitive, government regulations of industries most of
whose members are blameless.
WHAT ARE PEOPLE'S BIGGEST CONCERNS ABOUT PRIVACY ONLINE?
The largest number of online users are ``very concerned'' that:
------------------------------------------------------------------------
------------------------------------------------------------------------
Websites will provide personal information about them to 64%
other organizations without their knowledge...............
Websites will collect information about them without their 59%
knowledge.................................................
Websites will merge their shopping and browsing habits to 53%
develop profiles of their behavior and tastes.............
Their financial, or other sensitive information, will be 53%
stolen....................................................
------------------------------------------------------------------------
THE PUBLIC DIFFERENTIATES BETWEEN DIFFERENT COMPANIES AND DIFFERENT
INDUSTRIES
Several surveys have shown that the public is much more trusting of
some industries and of some companies, than of others. This trust must
be earned--and can easily be lost. Having, and displaying, strong
privacy protection policies is one factor consumers use to
differentiate between them.
what online consumers want
Very large majorities of online users think it is ``absolutely
essential'' or ``very important'' that sites:
------------------------------------------------------------------------
------------------------------------------------------------------------
Ask consumers permission before using their personal 94%
information for any other purpose than it was originally
given for.................................................
Explain to consumers what personal information is collected 87%
about them and how it is used.............................
Allow consumers to see the information the company has 82%
stored about them.........................................
Tell consumers exactly how their sensitive information is 82%
secured in transmission and storage.......................
------------------------------------------------------------------------
PRIVACY CONCERNS INFLUENCE ONLINE ACTIVITY, PARTICULARLY PURCHASING
ONLINE
While concerns about privacy are only a modest barrier to the use
of the Internet and the Web, they do inhibit it. This is particularly
true of the public's reluctance to purchase goods or services online
and to use credit cards to do so.
THE IMPACT OF STRONG PRIVACY PROTECTION POLICIES AND NOTICES
Many of those who are unwilling, or reluctant, to use the Internet
and in particular to purchase products and services online, say they
would be much more likely to do so if companies had strong privacy
protection policies and displayed them prominently. This willingness to
do business with such companies increases even more when respondents
believe that such policies are observed and enforced.
Having, and displaying, strong privacy policies is good marketing
and good business, whether or not people actually read them (only a
modest minority of Internet users do so regularly).
THE PUBLIC'S WILLINGNESS TO TRADE INFORMATION FOR BENEFITS
Many people do not seem to have much understanding of how companies
who are selling financial services or other goods or services use
information about consumers to target their sales efforts to those who
are most likely to buy them. As a result, they do not see why they
should provide the information.
However, when the use of the information, and benefits to
consumers, are explained to them they become much more willing to
provide it.
In other words, many people who are initially reluctant to provide
personal information are willing to do so when this is seen to be of
some benefit to them.
USE OF THE INTERNET INCREASES TRUST AND DECREASES CONCERNS ABOUT
PRIVACY
Familiarity with the Internet generally breeds comfort and trust,
not contempt. The more people use the Internet without suffering
adverse effects, the less they are concerned that their privacy might
be violated. This is true of online purchasing and credit card use.
WHAT DOES THE PUBLIC WANT FROM GOVERNMENT?
On balance, the public trusts the government rather less than it
trusts business to protect its privacy. Ideally people would prefer
that industries adopt sound privacy protection policies to having
government regulation. However, substantial majorities of the public
believe government regulation to protect consumer privacy on the
Internet is necessary, presumably because they do not believe that
self-regulation will be successful. Absent adequate legal protection,
people seem to believe that consumer protection will be abused.
Mr. Stearns. Thank you.
Dr. Westin, welcome.
STATEMENT OF ALAN F. WESTIN
Mr. Westin. Mr. Chairman and members of the subcommittee, I
am appearing today at your invitation as a long-time privacy
expert. Some people think my first article on privacy was
published the same year as Lewis Brandeis' in the Harvard Law
Review but, of course, his was in 1890, mine was in 1952, so
that gives me about 50 years of pioneering with the privacy
issue, endlessly fascinating. Also, I appear as someone who,
for his sins, has participated as the Academic Advisor in 45
national surveys of the American public and leadership groups
on privacy, starting in 1970.
I think it helps to start by recognizing that surveys are a
complex blend of art, science and advocacy, and whenever you
get survey findings you always have to, as I am sure Members of
Congress alone are accustomed to do, take a careful look at how
the questions are framed and the order in which they are
presented, and the kind of sample, and also the sponsors and
what their perspectives are.
So, with that background, the subcommittee asked me to
address three questions and to give my view as to what the
surveys--not only my own, but my organization, Privacy and
American Business, has literally 120 national surveys on
privacy in our library--some excellent, some poor, mixed bag,
and I did do a review of a lot of them in order to answer the
three questions which the counsel asked me to address.
First, has there been a transformation of consumer privacy
attitudes over the past decade? And I think good surveys tell
us absolutely ``yes.'' That whereas once only about a third of
the American public expressed any concern about threats to
their privacy, we now have nine out of ten Americans saying
they are concerned about the potential misuse of their
information and threats to their privacy in America today, and
what is important is, 77 percent expressed themselves as very
concerned.
Equally important, we find that there is a new wave of what
I call ``privacy assertive behavior'' on the part of American
consumers. Three out of four, 78 percent, report that they
refuse to give information to businesses because they felt it
was too personal and not really needed by the businesses, and
over 80 percent think businesses collect too much personal
information for the services they provide.
Majorities tell us that they have declined to patronize
companies that they thought were going to misuse their
information or create profiles about them.
We also know that when people are given a list of reasons
why they are not on the Internet or why they are not buying on
the Internet, majorities say that privacy is the single, most
important reason for that behavior.
At the same time--this is what makes privacy such an
interesting issue--American consumers, by large majorities,
want all the benefits and opportunities of a consumer service
society and of a market-driven social system. As long as you
give them proper notice and choice, more than three out of four
respondents again and again say it is all right for the
businesses they patronize to look at their transactions and
their interests, and to communicate with them things that they
think will be of interest to them.
So, we have concern about privacy, but also a desire to
enjoy the benefits of a consumer society, and the question is,
how do Americans divide in those balances between those two
values?
Over the years, surveys that I have done with Harris and
with Opinion Research Corporation have produced a profile of
three segments of the American public. First, you have what we
call ``Privacy Fundamentalists,'' about 25 percent of the
public. These are people intensely concerned about privacy, who
generally will reject benefits offered to them by business or
will be skeptical about government's need for information, and
will want to see legislation to control business collection and
use of personal information.
At the opposite end, you have what I call the ``Privacy
Unconcerned,'' used to be 20 percent but now it is down to 12
percent, who really don't know what the privacy issue is all
about. I like to think that for 5 cents off, they will give you
any information you want about their family, their lifestyle,
their travel plans, and so forth.
In between are what we call the ``Privacy Pragmatists,''
and that is 63 percent which represents approximately 126
million American adults and, essentially, they go through a
very structured process when concerned with their privacy.
First, they want to know what is the benefit to them as a
consumer if their personal information is provided or if they
give it, what is collected about them.
Second, they want to know what privacy risks they run if
the information is collected and used.
Third, they look to see what safeguards the company or the
industry offers to protect them against those risks.
Finally, and most important, they ask do they trust you, do
they trust the company or the industry, and if they want the
benefit and they are worried about the risks but they don't
trust the company or the industry, then they want legislation
to protect them and a governmental role of oversight and
implementation.
Second question the committee asked me to address is, do we
understand what are the driving sources of these privacy
attitudes which all the witnesses are reporting? I think good
surveys tell us a great deal about that.
My own work suggests that there is a correlation between
the distrust level of American consumers and citizens and their
attitudes on privacy. We have a ``distrust index'' that
measures people's attitudes toward government, voting, the
business community, and technology, and when people score high
in distrust, they tend to take the strongest ``privacy
attitude,'' and when they have low distrust or even no
distrust, then they tend to be much more accepting of
information collection and its use.
But when you dig down at a deeper level, I think privacy
has three components that the surveys truly illuminate. First
is what I call ``anti-intrusion.'' People are hostile to
unwanted mail and especially to telemarketing. Seventy-eight
percent of respondents are angry about telemarketing to them
without their consent.
Second element is ``anti-manipulation.'' People fear that
profiles are going to be collected about them that will allow
the kind of hidden persuader type of marketing we associate
with Vance Packard and the Naked Society and the other anti-
manipulation themes.
Third, they worry about discrimination, that information
will be collected and secretly used through credit scoring or
algorithms that they don't know about in order to decide
whether they get credit or insurance or whether they are
employed.
I think those three are components of what the privacy
concern is all about.
More recently, we have some new elements that are in some
ways even more powerful. First is the Internet leads people to
make astounding self-revelation, if you think about it. People
are going to places and looking at things and revealing things
about themselves that has no precedent really in Western
history in terms of self-revelation and communication. And
people are worried about tracking or hacking them in terms of
that kind of experimental and revelatory behavior.
Second, people are concerned about identity theft. Another
survey I did found that one out of five households in America
report that a victim in their household has been the object of
identity theft.
Finally, what do consumers want? I think good surveys
indicate that what consumers want is systems for informed
privacy choices to be implemented and enforced. Majorities
think it would be better if business did this, but they are
ready and anxious that government step in if business fails to
do so or if there is outlaw behavior.
We know that a majority of the American public does not
favor the European Union style of omnibus national privacy
legislation and a national privacy regulatory agency, but when
it comes to sensitive information such as financial information
or health information, overwhelming majorities are looking to
legislative protections to set the rules and the standards for
that kind of activity.
We also know that in terms of where Congress is going,
large majorities would like to see Congress pass anti-spam
legislation, would like to see genetic privacy legislation
enacted, and that some kind of framework legislation for online
privacy is heavily favored.
Let me close, though, by noting that surveys are not a very
good way to write legislation. Surveys are a dun to the general
public, they are not policy wonks, they can't get down into the
guts and details of good legislation. Also, we are really just
opening up some meaningful debate about what the costs and
dislocations of some of the proposals for online privacy
legislation would bring to the fore. And I think it is going to
take a lot of legislative wisdom and expert input to get to
good legislation.
What the surveys tell us is that the overwhelming majority
of the American public is looking for systems of protection,
but crafting good legislation is not something you should look
to surveys for much help on.
[The prepared statement of Alan F. Westin follows:]
Prepared Statement of Alan F. Westin, Professor of Public Law &
Government Emeritus, Columbia University, and President, Privacy and
American Business
EXECUTIVE SUMMARY
This testimony is based on my experience as the academic advisor to
45 national privacy surveys between 1979 and 2001, and my analysis of
more than 120 privacy surveys held in the Privacy & American Business
survey library. I am answering questions posed by the subcommittee as a
political scientist and privacy expert.
1. There has been a well-documented transformation in consumer
privacy attitudes over the past decade, moving concerns from a modest
matter for a minority of consumers in the 1980s to an issue of high
intensity expressed by more than three-fourth of American consumers in
2001. In addition, a majority of consumers has become quite privacy
assertive in their relations with businesses, making decisions on who
to use and what information to provide based on their own privacy
judgments.
2. But US consumers also want the benefits of a consumer-service
economy, and they are not monolithic in their privacy views. Tracked
across the past decade, they divide into three segments with very
different general approaches to privacy views and tradeoffs--a high,
medium, and low privacy perspective described in the main testimony.
About 125 million American adults fall into the moderate--Privacy
Pragmatist--category. How to merit and secure the trust of this group
should be the focus of businesses and lawmakers alike.
3. The driving factors behind high privacy concerns stem from high
levels of distrust of institutions and the fears of technology abuse.
Privacy concerns are centered on intrusions, manipulation, and
discrimination; on special concerns about third parties capturing the
sensitive self-revelations users are making on the internet; and on
consumer concerns about identity theft and stalking through capture of
personal information.
4. The great majority of consumers favor a notice and choice
approach to privacy policies. They hope that business will do this well
but stand ready to invoke government intervention if business fails.
For especially sensitive types of information--financial and health--
and for online protection, large majorities favor legislative
standards. However, surveys generally do not offer much useful data, on
the details of such legislation, since consumers are not policy wonks,
and the debates over costs and economic dislocations in adopting
policies such as ``all-opt-in'' are just beginning in to be heard in
the legislative chambers.
Three Subcommittee Questions
The Subcommittee has asked me to present a critical analysis of
privacy surveys published over the past decade, offering my views on
three questions. Has there been a transformation of the privacy
concerns of American consumers in the Internet age? If so, what are the
sources of this development? And what do these concerns suggest about
legislative choices on privacy protection?
My perspective in responding is that of a political scientist and
privacy expert (author of Privacy and Freedom, 1967) who has been the
academic advisor to 45 national public and leadership surveys on
privacy since 1970 that were sponsored by a wide variety of
foundations, government-research agencies, and business organizations.
(A short bio has been provided in Appendix One, along with a Selected
List in appendix Two of the privacy surveys on which I have been the
academic advisor.) Since the 1970's, I have been presenting the results
of my privacy surveys to Congressional committees, the FTC and FCC, and
various Federal Executive Agencies.
At the outset, of course, legislators should recognize that
contemporary survey research is a complex blend of art, science, and
advocacy. No one should accept ``survey findings''--on privacy or any
other social or political issue--without examining the content and
order of the questions, the representativeness of the sample, and the
perspectives of the sponsors.
Based on my reading of the solid surveys within a larger pool of
over 120 U.S. privacy survey reports collected in the Privacy &
American Business library, I believe these offer useful answers to the
questions posed by the Subcommittee:
1. Has There Has Been A Transformation In Consumer Privacy Attitudes
Over The Past Decade? Definitely yes.
Surveys show that today nine out of ten Americans are concerned
about the potential misuse of their personal information; three fourths
of them (77%) say they are now ``very concerned.'' Even more
significantly, a majority of American consumers have become privacy-
assertive. They are refusing to give their personal information to
businesses when they feel it is too personal or not really needed,
asking not to be marketed to, and declining to patronize a business
because of uncertainty about how their personal information would be
used. Concern about privacy is the single most cited reason Net users
give for not making purchases and for non-Net-users declining to go
onto the Net.
At the same time, however, surveys show that most consumers want
the opportunities and benefits of our consumer-service and marketing-
driven society. With proper notice and choice, more than three out of
four consider it acceptable that businesses compile profiles of their
interests and communicate offers to them.
Further, consumers continue to divide into three basic segments
that my surveys have been tracking since the early 1990's, when it
comes to overall consumer privacy preferences. these are Privacy
Fundamentalists (25%), who reject offers of benefits, want only opt-in,
and seek legislative privacy rules; Privacy Unconcerned (now down to
12% from 20% three years ago), who are comfortable giving their
information for almost any consumer value; and--the most important
group for Congresspersons to understand--the Privacy Pragmatists (63%
or 125 million strong). Privacy Pragmatists ask what's the benefit to
them, what privacy risks arise, what protections are offered, and do
they trust the company or industry to apply those safeguards and to
respect their individual choice. How to create conditions of trust for
the Privacy Pragmatists is the challenge for businesses and law-makers
alike.
Overall, surveys show that privacy now scores as one of the top
consumer and social-policy issues in the U.S., especially intense among
women, a strong concern of both conservatives and liberals, and a
political imperative for both Republicans and Democrats.
2. Do We Understand The Driving Sources Of This Transformation? Yes, We
do
Consumers report that their views on privacy do not come solely
from what they read or hear in the media but strongly reflect their own
personal experiences and those of family and friends. As far as driving
factors, my surveys since 1978 have shown that the higher a
respondent's general distrust of institutions and fears of technology
abuse by organizations, the greater will be the concerns about privacy.
We also know that ``privacy'' in the consumer-business relationship has
three components expressed by survey respondents: anti-intrusion
(against unwanted mail or telemarketing); anti-manipulation (against
compiling profiles that allow ``hidden persuader'' marketing); and
anti-discrimination (against secret standards being used for making
consumer risk-assessments, as for credit or insurance).
Three additional underlying factors fueling current high privacy
concerns have been documented in surveys: (a) fears about tracking or
hacking the unprecedented self-revelation that most Internet users
engage in (with email, forums, information-seeking, and purchasing);
(b) concerns about tangible and serious harm from identity theft,
through capture of consumer's personally-identifying information, and
(c) fears, especially by women, of stalkers or child-predators gaining
location information from either public-record sources or Internet
communications.
3. So, What Do Consumers Want? Systems for Informed Privacy Choices,
Implemented and Enforced.
In general, majorities of consumers think it would be best if
businesses put good privacy policies in place voluntarily, and saw to
their wide implementation; if they fail to do so, consumers want law to
step in.
Organizational surveys in 2000-2001 show that a majority of
American businesses have--at last--gotten the message that most
consumers really care, and will make decisions to assert their
interests on the basis of privacy. Surveys of business conduct on and
off the Net show most businesses are now adopting meaningful privacy
policies, and a majority of consumers say in public surveys that they
think this is happening. Surveys have also shown that a majority of the
American public does not favor a European-Union-style omnibus national
privacy law and a national data protection regulatory agency.
There are some new issues we have yet to test in surveys but are
beginning to do. A survey that Privacy & American Business is now
putting in the field, for example, asks consumers whether they think
that the appointment of Corporate Privacy Officers (CPOs) by companies
is a positive development, what consumers want CPOs to do, and whether
such institutionalization of privacy responsibility in individual firms
would enhance consumer confidence in such companies.
However, it is clear that where especially sensitive consumer
information is being collected and exchanged today--in the financial
and health areas in particular--surveys show the public wants to see
legal privacy-protection rules enacted and enforcement actively
pursued. Reflecting that overwhelming sentiment, Congress included
Title V in the Financial Modernization Act of 1999 and both Presidents
Clinton and Bush supported the health privacy regulations of HIPAA.
Surveys showing overwhelming Net-user hostility to spam will, and in my
judgment should, lead Congress to pass anti-spam legislation at this
session. Similar survey results showing strong public opposition to
uses of genetic information for employment or health-insurance purposes
suggest that well-designed legislation here would be responsive to the
public's deep concerns.
As for online privacy legislation, surveys show strong majorities
favoring ``action'' by Congress to set framework rules. But general-
public surveys do not provide good data on what kind of online privacy
legislation consumers would support, since the public is not made up of
policy wonks and the key policy issues lie in the legislative details.
Debates are just developing on what true costs and market dislocations
would be created by some of the sweeping, ``all-opt-in'' proposals for
online privacy legislation, and these remain to be tested--if indeed
they can be--through survey methods.
Summing Up
A decade of extensive survey research, much of it solid and
credible, documents a steadily rising rational and justified public
demand to set new, privacy-protecting rules for collection and use of
consumer personal information by businesses. The work of this decade.
among survey researchers and Congresspersons alike, is to discover what
will persuade the 125 million American Privacy Pragmatists that we have
the right blend of business initiatives and legal oversight for good
consumer information relationships with business.
Mr. Stearns. Thank you.
Dr. Newport.
STATEMENT OF FRANK NEWPORT
Mr. Newport. Good morning, Mr. Chairman, members of the
committee. I appreciate having this opportunity to review with
the subcommittee the findings of our Gallup polls relating to
privacy over the Internet.
Although there are concerns about privacy that relate to a
wide variety of settings in today's society, my testimony today
will focus on concerns relating to personal information and use
patterns of the Internet.
Our data suggest that roughly 50 to 55 percent of adult
Americans say they use the Internet on a regular basis either
at home, work or at school, and it is this population that I
will be referring to in the rest of this very brief testimony.
One key question that we asked Internet users in one poll
last fall that is particularly germane to this subcommittee is,
``What is the role of the Federal Government in these
matters?'' The response of about half of our Internet users
said that the Federal Government should be ``paying more
attention to matters of Internet privacy.'' About a third said
that what the Federal Government was doing now was about right.
And--and this relates to what Representative Doyle, I think,
mentioned just briefly in his introductory remarks--about 13
percent, a relatively low number, said that the Government
should, in fact, be paying less attention to matters of
Internet privacy.
We obtained roughly the same answers when we asked in a
slightly different way if the Federal Government should do more
or less to ensure citizens' privacy online. In this case,
however, only 6 percent said that the Government should do
less. That same rough number, about half, said the Government
should ``do more,'' and 40 percent said what the Government was
doing now was about right.
The interpretation of these types of responses, for myself
and ourselves at the Gallup Poll, is a challenge in part
because this is a new area of research. We have very little
trend data. It is not a question about Internet privacy and
what the Government should be doing that Dr. Gallup was asking
back in the 1930's and the 1940's, obviously, so we can't go
back in time and see whether that is relatively high or
relatively low. It is tough to place the current sentiment in
the context of historical patterns, and we also have few pre-
existing hypotheses against which we are testing the data.
Now, we do know that roughly half of Internet users say
that they are very concerned about the ``privacy of personal
information you give out on the Internet, as well as privacy
regarding what you do on the Internet.'' Another three in ten
are somewhat concerned, meaning that only about 20 percent,
echoing what we have been hearing, say that they are not
concerned.
But, on the other hand--and I think this is a very
important point--the issue itself does not appear at this point
to be highly salient to Internet users. Just about 16 percent
in our poll last fall said that they were following issues
related to privacy of personal information and use patterns on
the Internet very closely, half said that they were not
following the issue closely at all--and, again, this sample was
a sample of those who told us that they regularly use the
Internet. In a way, I think this goes back to Mr. Rainie's
testimony that at this point most people have not had a major
privacy concern and therefore it is not a very highly salient
issue.
Our overall conclusion is that this is an issue which is of
significant potential concern--I would underscore the word
``potential''--but one which has not yet moved to the point
where it is currently a front-burner problem to many Americans
who regularly use the Internet. As my colleague, Humphrey,
said, we do not find it hardly at all in our most important
problem questions when we ask Americans what it is that are
burning concerns on their mind at this point.
We can be a little more specific. In one poll last fall, we
gave our respondents six different dimensions of Internet
privacy and asked which ones they were most concerned about.
Interestingly for the subcommittee, at the top of the list were
concerns about the Government being able to tap into Internet
email. Sixty-three percent of Internet users said they were
very concerned about this issue, putting it No. 1 out of the 6
that we tested. Second was the issue of large, online data
bases,. Sixty percent said they were very concerned about that
issue. There was less concern about the Government's ability to
tap into suspects' computers, and at the bottom of our list,
relatively less concerned about Internet advertisers who gather
marketing information about people who click on ads and
corporate Web sites which gather marketing information about
consumers by tracking their habits. The percentage of Americans
were very concerned about all of these issues ranges from
roughly 43 to 63 percent.
In summary, I would repeat that in our opinion the issue of
Internet privacy is not one of the greatest concerns to
Internet users today, but one which has the potential--and I
heard the word ``landmine'' used a moment ago, which seems a
reasonable term to use--to be a significant perceived problem
in the years ahead. It is not a problem at this point which a
lot of consumers have had trouble with, and therefore is not
one which comes readily top-of-mind when you stop Internet
users on the street, figuratively speaking, and ask what it is
that is a pressing concern to them at this point.
In terms of what the Federal Government should be doing,
remedies and actions, as mentioned, about half of the Internet
user population said the Government should get more involved.
On a relative basis, this does not put this high on the list,
in our opinion, of priorities that the average American or even
average Internet user has for the Federal Government.
One last point. Our polls show--and we did ask Americans
this--that when asked which political party would do a better
job handling this issue, it came to almost an absolute tie
between Republicans and Democrats. So, at this point, at least
as of last fall, it was not perceived as a highly partisan
issue in terms of who would do the better job of trying to
address these issues. Thank you.
[The prepared statement of Frank Newport follows:]
Prepared Statement of Frank Newport, Editor-in-Chief, The Gallup Poll
Mister Chairman, members of the committee, and guests.
I appreciate having this opportunity to review with the
Subcommittee on Commerce, Trade and Consumer Protection the findings of
our Gallup polls relating to privacy over the Internet.
Although there are concerns about privacy that relate to a wide
variety of settings in today's society, my testimony today focuses
exclusively on concerns relating to personal information and use
patterns of the Internet.
Our data suggest that about 53% of adult Americans use the Internet
on a regular basis either at home, work or at school. It is to this
population that I will be referring in the rest of this testimony.
One key question we asked Internet users in our poll last fall
related to the role of the Federal government in these matters. About
half of Internet users said that the Federal government should be
``paying more attention to matters of Internet'' privacy. About a third
said that what the federal government was doing now was about right,
while 13% said that the government should in fact pay ``less
attention'' to matters of Internet privacy.
We obtained roughly the same answers when we asked in a slightly
different way if the federal government should do more or do less to
ensure citizens' privacy on line. In this case, however, only 6% said
that the government should do less. Half said ``do more'' and forty
percent said what the government was doing now was about right.
The interpretation of these types of responses is a challenge. In
this particular situation, we have no trend data. This is the first
time we have asked about Internet privacy in this fashion, and
therefore we cannot place the current sentiment in the context of
historical patterns. We also have few pre-existing hypotheses.
We do know that roughly half of Internet users say that they are
very concerned about the `privacy of personal information you give out
on the Internet, as well as privacy regarding what you do on the
Internet''. Another three out of ten are somewhat concerned, meaning
that only about twenty percent say they are not concerned.
But, on the other hand, the issue itself does not appear to be
highly salient to Internet users. Just about 16% said in our poll last
fall that they were following issues relating to privacy of personal
information and use patterns on the Internet very closely, while about
half said that they weren't following the issue closely at all.
Our conclusion is that this is an issue which is of significant
potential concern, but one which has not yet moved to the point where
it is a currently front-burner problem to many Americans who regularly
use the Internet.
We can get a little more specific. We gave our respondents six
different dimensions of the Internet privacy issue and asked them to
rate their concern over each.
At the top of the list are concerns about the government being able
to ``tap'' into Internet e-mail. For whatever reason, some 63% of
Internet users are ``very concerned'' about this issue. Second in the
list comes the issue of ``large online databases which publish
telephone directories, property tax information, legal information and
other publicly available records which allow database subscribers to
investigate the lives of ordinary Americans''. Sixty percent of
Internet users are very concerned about this issue.
There is somewhat less concern about the government's ability to
``tap'' into suspects' computers, and still less concern about Internet
advertisers gathering marketing information about people who click on
their ads, and corporate websites which gather marketing information
about consumers by tracking their habits.
Although the percentage of Americans who are ``very'' concerned
about these issues ranges from 43% to 63%, most of the rest say that
they are at least ``somewhat'' concerned. Relatively few web users say
that they are not too or not at all concerned.
In summary, I would say that the issue of Internet privacy is not
one of the gravest concern to Internet users today, but one which has
the potential to be a significant perceived problem in the years ahead.
In terms of specific governmental remedies and actions, about half of
the Internet user population feels that the federal government should
get more involved, but most of the rest think that the government is
doing today is just about right.
One last point. Our poll shows that Americans have no preconceived
notion as to which political party will do a better job handling this
issue.
Thank you.
Mr. Stearns. Thank you.
Dr. Bauman.
STATEMENT OF SANDRA BAUMAN
Ms. Bauman. Thank you, Mr. Chairman and honorable Members,
for the opportunity to speak before you today. My name is
Sandra Bauman. I am a Vice President at Wirthlin Worldwide, a
30-plus-year-old international public opinion research and
consulting company with headquarters in McLean, Virginia.
It is an honor to speak with you today about the research
we have conducted regarding information privacy. Let me first
start by acknowledging that in some sense Americans are
generally concerned about how companies are using their
personal information. What they fear most is that somehow their
personal information will get into the wrong hands and cause
them some harm, such as hurting their credit history or having
their identity stolen. At the same time, consumers also
understand that in order to get information or complete a
transaction, they need to give some information. Whether it be
online or distance shopping, consumers are willing to give
personal information that is deemed necessary for a particular
transaction, rather than some possibly sensitive personal
information that doesn't seem necessary or relevant.
This is intuitive, of course. The challenge is to
understand what types of information are more sensitive and
what types of information customers deem necessary to that
particular transaction. If we were to generically ask in a
poll, ``Are you concerned about your privacy?'' of course a
majority would say yes because there is no context. Why
wouldn't you be concerned about your privacy? It depends on why
it is necessary to share information in the first place.
Different situations may require different types of
disclosure of personal information. Consumers may be very
comfortable providing a specific piece of information in one
context, yet uncomfortable providing that very same piece of
information in another context.
At Wirthlin Worldwide, we have conducted a great deal of
opinion research in the recent years on the subject of privacy,
most of which is proprietary to a number of different clients,
but last year we conducted a multi-phase, in-depth qualitative
study, including several focus groups and 85 in-depth one-on-
one values-based laddering interviews. The interviews were
designed to provide a thorough, in-depth understanding of the
general public's attitudes about privacy issues by uncovering
their perceptions of the direct marketing industry and related
industries at both rational attribute and benefit levels, and
emotional and values levels. These interviews are very in-
depth. They last on average 2 hours each.
Findings from these qualitative studies and generally from
our experience in our 30-year history indicate that people make
choices and form opinions based on closely held personal
values. The rational elements of decisionmaking process are
important in supporting the emotional components that they tap
into.
As individuals feel protected and that they have control,
the physical benefits from sharing information satisfy
emotional needs. In fact, we summarize the way people think
about the need to provide personal information similarly to how
the panelists articulated it today: I want to give what I want
to give when I want, and I want to get what I want when I want.
In other words, consumers are willing to part with information
they perceive necessary to commence or complete a transaction
of their choice, as long as their values of control and safety
are intact.
Most recently, we conducted a nationwide telephone study to
obtain an up-to-date picture of how the public is viewing
privacy issues. Our survey was conducted late last week and has
a margin of error of about 4 percentage points.
We found that there are categories of information that
consumers are willing to share in order to conduct a
transaction, and other information they believe should never be
shared, which you can see on the chart here to your right. It
is also in your materials.
For example, the majority of people say they are never
comfortable sharing their Social Security number, financial
information, medical information, or information about their
children. These types of information are deemed sensitive and,
therefore, individuals are less likely to share information
which falls into the category of ``not necessary'' or ``none of
your business.''
Conversely, people are usually comfortable revealing their
gender, age, education, occupation, hobbies and interests, and
how they heard about a particular company.
There are actions businesses can take to further satisfy
consumers' needs for safety and control of personal
information. A second chart here to your right. For example,
our study finds that 6 in 10 consumers are more confident in
sharing their personal information, knowing that they can opt-
out of direct marketing and telemarketing lists. Three-quarters
tell us they are more supportive of allowing industry to
address the use of personal data knowing that the opt-out
policy is in effect. Other things that comfort consumers are
using technology to prevent identity theft, restricting access
to medical and financial data for marketing purposes, and
communications campaigns about highlighting consumer rights and
privacy protections. If businesses champion a series of safety
and security measures, consumers would have a better sense of
control and feel that by providing personal information they
have made a smart choice, saving themselves time and money.
The Internet, which is still a relatively new medium, is
not completely understood by the public, even by many users.
Most aren't sure exactly how it works. They know it is a
communications tool, they can receive information, provide
information, but they don't know when information travels over
the Internet where it goes and who is at the other end. It is
this fear of the unknown that raises the level of skepticism
for many consumers and reduces their feelings of control.
For example, most people will provide their credit card to
a stranger to process a transaction at a traditional business
or restaurant without concern for their personal credit data.
These practices have a tradition of being secure and are
therefore widely accepted by consumers. The same is true for
catalog purchases. Of 11 factors that are important to a
purchase decision, concern over privacy of personal information
or credit card information rank 9th and 10th out of a list of
11.
With a new medium such as the Internet, consumers' level of
comfort is tied to their experience. Our research shows that as
people have positive experiences with Internet commerce, their
level of skepticism is diminished. Over time, as more and more
people experience Internet commerce, the unknown nature of the
medium will fade as it becomes part of our daily lives.
In summary, companies that voluntarily enact good privacy
policies, ones that are easily understood by everyday
consumers, can help comfort consumers that their information
will not be abused. Industry can achieve this effectively by
engaging in self-regulating policies concerning the collection,
use, storage and exchange of personal information. Thank you.
[The prepared statement of Sandra Bauman follows:]
Prepared Statement of Sandra Bauman, Wirthlin Worldwide
Americans are generally concerned about how companies who collect
personal information use the information. What they fear most is that
somehow this personal information they share gets into the wrong hands
and some harm comes to them, such as having their identity stolen. At
the same time, consumers understand that in order to get information,
they need to give information. That said, in order to conduct a
transaction, whether it be online or distance shopping, they are more
willing to give personal information that is deemed necessary for that
transaction, rather than some possibly sensitive personal information
that doesn't seem necessary.
This is intuitive, of course. The challenge is to understand what
types of information are more sensitive and what types of information
customers deem necessary to a transaction. If we were to generically
ask in a poll: ``Are you concerned about your privacy?,'' of course a
large percentage would say yes because it is taken out of context in
terms of why the information was necessary to share in the first place.
Different situations may require different types of disclosure of
personal information.
Wirthlin Worldwide has conducted a great deal of opinion research
in the past three years on the subject of privacy (most of which is
proprietary to a number of different clients), but in the aggregate as
we drill down into what the consumer receives in returnfor the sharing
of personal information ``both from the internet transactions and
direct shopping--the picture is painted differently than what some
would have you think.
In March 2000, we conducted a multi-phase qualitative study on
privacy. Our approach began with four group discussions in
Philadelphia, PA and Grand Rapids, MI, which were designed to uncover
initial impressions of the public's attitudes toward privacy issues.
Following these group discussions, we conducted a total of 85 in-depth
one-on-one values-based laddering interviews. These interviews were
designed to provide a thorough, in-depth understanding of the general
public's attitudes about privacy issues by uncovering respondent's
perceptions of the direct marketing industry at both the rational and
emotional level. These interviews lasted approximately 2 hours and were
conducted in New York, NY, Chicago, IL, Los Angeles, CA and Washington,
DC.
Most recently, we conducted a nationwide telephone study to obtain
an up-to-date picture of how the public views privacy issues. Our
survey was conducted late last week, on May 2-3, 2001. We contacted 617
respondents to participate in the 13-minute survey, the results of
which we have prepared for you. The margin of error for a study of this
size is +3.9 percentage points.
Findings from the two qualitative studies indicate that people make
choices and form opinions based on personally held values. The rational
elements of the decision-making process are important in supporting the
emotional components they tap into. As long as individuals feel
protected and that they have control, the physical benefits from
sharing information satisfy emotional needs. In fact, we summarize the
way people think about the need to provide personal information in this
way: I want to give what I want when I want, and I want to get what I
want when I want. In other words, consumers are willing to part with
information they perceive as necessary to commence or complete a
transaction of their choice.
There are categories of information consumers are willing to share
in order to conduct a transaction and other personal information they
believe should never be shared. In our most recent research, for
example, the majority of people say they are ``never comfortable''
sharing their social security number, financial information, medical
information or information about their children. These types of
information are deemed sensitive and therefore individuals are less
likely to share information which falls into the category of ``not
necessary'' or ``none of your business.'' Conversely, people are
usually comfortable revealing their gender, age, education, occupation,
hobbies and interests, and how they heard about the site.
There are actions businesses can take to make the information that
is shared more secure, which would result in raising consumers'
confidence to give personal information in the first place. For
example, actions that make consumers more comfortable include: using
industry services to opt-out of direct marketing and telemarketing
lists, using technology to prevent identity theft, restricting access
to medical and financial data for marketing purposes and communications
campaigns about highlighting consumer rights and privacy protections.
If businesses champion a series of safety and security measures,
consumers would have a better sense of control and feel that by
providing personal information they have made a smart choice, saving
time and money.
The Internet, which is still a relatively new medium, is not
completely understood by the public, even by many users. Most do not
know how it operates. They know the Internet is a communication tool
for receiving and providing information. However, they do not know how
information travels over the Internet and who is at the other end of
the monitor. It is a fear of the unknown that raises the level of
skepticism for many consumers and reduces their feelings of control
For example, most people will provide their credit card to a
stranger to process a transaction at a traditional business or
restaurant without concern for their personal credit data. These
practices have a tradition of being secure and are therefore widely
accepted. With a new medium such as the Internet, consumers' level of
comfort is tied to their experience. Those who participate in Internet
commerce tend to feel more knowledgeable about the Internet and more
comfortable with providing personal information. Our research shows
that as people have positive experiences with Internet commerce, their
level of skepticism is diminished. Over time, as more and more people
experience Internet commerce, the unknown nature of the medium will
fade as it become more a part of our daily lives.
In summary, companies that voluntarily enact good privacy
policies--ones that are easily understood by everyday consumers--can
help comfort consumers that their information will not be abused.
Industry can achieve this effectively through self-regulating policies
concerning the collection, use, storage and exchange of personal
information.
Thank you.
Mr. Stearns. Thank you, Dr. Bauman.
Just as a general comment here, the tendency after
listening to you is to want to ask you a lot about the
Internet, but obviously your expertise is basically a polling
of information, so we can't get into, you know, what would you
do if you were a policymaker and X, Y, Z because you are on
this area of trying to understand what the American people
perceive about the Internet. And it is interesting that it
seems to come in almost all your opening statements, that the
public is not really educated. I mean, one of you folks has
broken down the understanding for this to the people who are
basically the ``skeptics,'' the ``pragmatists,'' and the people
who just don't know. And the fundamentalists are 25 percent,
they are the skeptics, and the pragmatists are the 63 percent,
and the unconcerned are 12 percent. And how much should the
Government protect these unconcerned, you know, is a very
difficult question.
But I thought we will try, if we can, just to try and
understand better what you are talking about in terms of the
surveys, so let me just go to you, Mr. Rainie, and ask what you
mean in your opening statement when you say ``demographic
context''? Could you mention--explain what that means? Your
survey highlights that term.
Mr. Rainie. Yes. Different people in different groups have
different senses of the privacy issues. Parents are much more
concerned than nonparents because of information that might
relate to their children. Women show a greater degree of
concern, for instance, than men on some issues because they
just feel like they are stewards of certain kinds of
information that men don't feel as close to.
So, there is a hierarchy of information values--you have
heard it from other witnesses, too. Health information,
financial information, credit information, information about
children, matters most to people, and it matters most to
specific groups of people.
Mr. Stearns. The problem is, as a legislator, are we here
to try and protect the consumer even though they are
uneducated? You know, the person who really uses the Internet,
like somebody who is like my younger son who has been using it
for many years, doesn't have any concern at all. And you
observed that although Americans do not much like online
traffic tracking and profiling, a lot of them take relatively
few steps to stop it. You know, a person can find out how to
prevent the cookies from coming in through the preference on
their Web browser, or they could stop the keystroking
monitoring, they could probably do that. They could also do
encryption. But they just don't seem to be interested.
And so I guess is there something in the data that suggests
why they have this fear but they don't take any action?
Mr. Rainie. Well, I think they don't know the mechanism of
how it is done, and I think in some cases it is expecting a lot
of them to understand all the technologies that are at play,
all the possible ways information can be gathered, bundled,
disseminated and passed along. For some people, they are really
into it and they are happy to be vigilant about checking
privacy policies, be vigilant about checking the source of
information, but for a lot of people that is a lot of work and
they have got other things to do with their lives and they
expect this technology to help them, not be an extra burden in
their lives.
And so I am not sure that throwing all the onus on them is
one that they would be happy with. Clearly, for them, tracking
is a dirty word. They haven't yet begun to comprehend all of
the ways that it is a benefit to them, or potential benefit to
them. Transactions haven't been very explicit to them. I think
a lot of their concern would go away if a better case were made
about how that were done.
Mr. Stearns. Dr. Westin, you indicated in your statement
that nine out of ten Americans are concerned about the
potential misuse of their personal information and that three-
fourths of them say they are very concerned. What are they
concerned about? I mean, can you give us specifically what
their fears are?
Mr. Westin. More and more, as I said, identity theft is one
of the things that is in the minds of the respondents.
Mr. Stearns. Identity theft--they get their Social
Security, they get their pin numbers and they start walking off
with their money out of their bank accounts.
Mr. Westin. That is correct. And as I mentioned, one out of
five households reported that there had been in their
households someone who had been the victim of an identity
theft. So, talk about harm as opposed to potential, one of the
harms is that people perceive that if their telephone calling
card can be obtained, if their credit card information can be
obtained, their Social Security number can be obtained, that
these are all the tools that the fraud artist can use.
One of the largest causes of people not getting mortgages
today is that they have had an identity theft and have not been
able to clear up in time their credit history, and we found
that it takes between 1 year and 1\1/2\ years for somebody to
overcome the harm done to them in their credit report and in
their relations with retailers and charge card companies as a
result of identity theft. That's an example of where people are
connecting the collection of their personal information to a
concrete harm that has happened to them or somebody they know.
Mr. Stearns. Dr. Bauman, you know, this is just, as we
point out, this Internet privacy concern or fear is not just on
the Internet, but they also have it about their personal sense
of information--they are worried about it so much so that we
have passed in Congress the Gramm-Leach-Bliley Act and also
HIPPA regulations. I don't know if you are familiar with those,
but I guess the question is, consumers seem to have a general
concern, and maybe they are pushing the issue more than
legislators need to be worried about. Have you seen any change
in consumer perception after we have passed these two major
pieces of legislation, the HIPPA regulations and the Gramm-
Leach-Bliley Act?
Ms. Bauman. Our research didn't specifically ask about
pieces of legislation, so I can't speak to that directly, but
our findings in both our qualitative and our quantitative
surveys are very consistent with the other research that has
been presented here today.
Mr. Stearns. Mr. Taylor, you have cited, for example, that
privacy is a potential landmine issue. Perhaps you could give
me a worst-case scenario of what you mean by a landmine issue.
Mr. Taylor. Well, an example historically of where privacy
did explode was in relation to credit and, to some extent,
insurance, and it needs some highly publicized instance of
somebody abusing somebody else's privacy for the landmine to go
off.
Now, it seems to me that this could occur in terms of
identity fraud, such as Dr. Westin has described. It could
certainly occur in relation to discrimination for health
insurance or life insurance or employment or credit. It could
certainly go off if, for example, a public figure's use of the
Internet to access pornography sites was highly publicized,
that would certainly trigger a few angry calls. Or, indeed, if
the volume of spamming got so intense you might expect to see
more and more people saying let us make spamming illegal, as I
believe faxing, cold faxing marketing is illegal.
Mr. Stearns. Right now, I could not find the history on
your using the public library in your hometown, what books you
took out. Likewise, I couldn't find out what videos you have
taken out over a number of years or any length of period. So,
likewise, it seemed to me that Congress might have a
responsibility here to say we want to prevent this keystroke
monitoring to protect the consumer, even though the consumer
probably has no concern themselves on what we are talking
about. So, it is a combination of the chicken or the egg. I
mean, should we educate the consumer and then protect him, or
just protect him before we go out and educate him?
Mr. Taylor. Well, ``should'' is your decision, not mine,
but historically I think that legislators have normally reacted
after the landmine has gone off, not before. That isn't to say
that that is the ideal way of doing it.
Mr. Stearns. Maybe just as a general question before I
complete, and just ask yes or no. If Congress went ahead and
instituted an Internet privacy bill and presented it, you know,
the White House signing in the Rose Garden and everything, do
you think that would give a higher level of confidence to the
consumer so that he or she, those folks that are in the one
category here, might help the Internet, might increase business
if we, by Congress being a leader here, could actually bring
more trust to the Internet and increase ecommerce business? Do
you follow what I am saying? Just yes or no, or just a slight
comment. Mr. Rainie. It is a little off your survey question,
but it may be, after all this information, you might have an
intimate or innate ability to say, yes, we think it will help
ecommerce and give more trust, or not.
Mr. Rainie. I am going to steal Dr. Westin's thunder by
repeating what he said. Writing legislation before-the-fact and
particularly off survey work is tricky business. One of the
things that we tried to do in several of our surveys was walk
respondents through to the point where they actually were
facing the clearest policy choice that I think is frame for all
of you, which is, do you want Government to do it, or do you
believe businesses can self-regulate? And invariably, as we
walked the respondents through these questions, they wanted to
stop right at the point where they were in charge. They wanted
to assert that as the primary value that they want control over
their identities, they want to have a seat at the table when
any decisions are made, and we couldn't get them to help sort
it out because they feel so disenfranchised as things stand
right now.
Mr. Taylor. Mr. Chairman, unlike, I think, the other
polling organizations represented here, Harris Interactive
conducts more surveys online than in person or by telephone,
and we are very strong advocates of Federal legislation to
establish high standards to which we want to adhere, and to
have a level playing field.
So, for our business, we think that legislation and
regulation would be very good for our business and for the
consumer.
Mr. Westin. My other hat is a privacy expert, not a survey
expert, and I think the time has come, the surveys would
suggest, for what could be called ``framework'' legislation for
online privacy. What I mean by that is that if you set in
motion requirements that Web sites post privacy policies, step
one, that you provide that the individual is well informed to
exercise the choices that those policies provide, whether it is
opt-out or clicking to opt-in. And, third, whether you have
supervisory jurisdiction in a body like the Federal Trade
Commission, for example, that under its existing Section 5
jurisdiction can look for prosecuting or issuing cease-and-
desist orders for any Web site that violates its promises, you
would have put in place what I think the Chairman is talking
about when you ask what would it take to give confidence for
people to use the Internet.
It worries me if there would be any kind of legislative
standard to opt-in as the requirement or the default because I
think that all the survey research shows that consumers want
choice, but they don't want somebody to dictate what their
choice is. And I think notice and choice, to me, especially in
the Internet environment, means stating what the Web site wants
the information for, how it will use it, and to give the
individual a choice then to opt-out or not to do business with
the Web site.
So, I would argue that all the survey material tells you
that the public is seeking tools for confidence. What Congress
can do, in my judgment, is to provide a piece of framework
legislation that allows then the good businesses to have good
relations with the consumers who come to their Web sites, but
allows consumers not to do business with those companies that
are not posting the kind of privacy policies that the consumer
wants to expose themselves to.
Mr. Newport. Mr. Chairman, Dr. Westin has good points. My
initial reaction to your specific question was, I would not
anticipate an enormous change if Congress did pass the
legislation and it was signed in the Rose Garden of the White
House. At this point, I don't think there is dramatic evidence
that a lot of consumers are staying off the Internet or in any
way restricting their behavior because of concerns over privacy
except when we pollsters ask those questions, so I don't think
at this point there is a pent up demand to use the Internet
that once this legislation was signed we would see dramatic
change, at least initially.
Ms. Bauman. I agree with Mr. Rainie that our research finds
that the public wants to retain control of their personal
information and decide which information to divulge and when.
To some degree, they can't be in full control without
understanding their options and tools available to them in
controlling these items of personal information.
In our qualitative research, which was very in-depth, we
heard from consumers that they want businesses to self-
regulate, they think that is important, but they also want
businesses to collaborate with Government on these efforts, and
that way builds trust between the consumers and the companies.
Mr. Stearns. My time has obviously expired. Mr. Doyle.
Mr. Doyle. Thank you, Mr. Chairman. It just seems to me--I
mean, I remember the first time I gave my credit card online,
there is a certain element of risk-reward. I think the public
in general is just somewhat schizophrenic on this whole idea of
what they really want with privacy. It seems to me, you know,
if you are dealing with sensitive financial data or medical
information, I think there seems--I mean, there seems to be
more of a tendency of people wanting privacy there yet, on the
other hand, you hear retailers say, ``Well, one of the ways to
prohibit spamming or eliminating junk mail on the Internet is
for us to learn more about the people that we are trying to
serve, and we can reach a point where you are only receiving
the kind of advertisement that you want to receive because you
have indicated what some of your buying preferences are, or
those types of things.''
You go into a supermarket in Pittsburgh and you shop at
Giant Eagle, they have got a thing--I think it is called the
Advantage Card or something--that basically they scan your card
going in, and the enticement is they give you some discounts on
their products, but then they start to learn about your buying
patterns, and they tell us, well, that helps them better serve
the people that walk into the store because they know what to
order, when to order it, and what you are going to buy.
So, you see these tremendous benefits on the one hand where
retailers can tailor-design advertising and products to people
based on what they say they want. On the other hand, there is a
real worry out there about giving information about your
medical history. And I just wondered, does most of your
surveying show that the greatest concern is really in the areas
of medical privacy and financial records, and is there maybe a
need for us to look more closely or deal more strictly with
those areas as opposed to retail shopping or eBay buying? I
mean, I am just wondering what--is that where the major concern
is when you are talking with your--and just generally to the
panel.
Mr. Newport. In one survey we did last fall, we gave people
a list and, indeed, financial and health care information was
at the top of the list of concerns. The things which were lower
were not so much retail--I am not sure they were on the list--
but employment history and educational background history,
where you had degrees and things like that, seemed to be of
much less concern.
But you mentioned, Congressman Doyle, the two magic words,
I think--financial and health.
Ms. Bauman. Our study also found that, that was conducted
late last week--medical information, financial information. The
great majority of the people said they were ``never
comfortable'' providing that information.
Mr. Westin. Our surveys show that one of the apprehensions
people have is that the mergers that have brought together
banks, credit card companies, insurers and investment firms,
has broken down what once was a great protection of privacy,
which was the ``silo'' effect that your information was in one
silo and, because of competitiveness and industry separation,
it wasn't shared.
There is a great concern today that the mergers and
acquisitions have opened up much larger pools of sharing of
information, and that is why Congress in Title 5, in the Gramm-
Leach-Bliley Act, tried to deal with the difference between
sharing information outside with affiliates, and the choices
that individuals are looking for in terms of the way their
information circulates inside those merged institutions.
Mr. Rainie. We found in a survey of people who use the
Internet to get health information, that even in those
circumstances where they are getting sensitive information
online, they are adamantly opposed, for instance, to having
their medical records put online. Sixty percent of those health
seekers said ``We would not feel comfortable having our health
records online even at a password-protected, secure Web site.''
We put that in the questionnaire to give them some level of
assurance of it. Their default thought is this is way too
sensitive. The harm that can come from improper disclosure of
this is way too grave for me to risk it.
Now, my guess is that over time, if people's doctors
educate them and say to them, ``If you put your records online,
the likelihood of a medical error being made when you are in an
emergency situation or a loved one is in an emergency
situation, that level of concern might go down,'' but no one in
the people we were talking to had a great sense that that was
the tradeoff. All they thought was, ``My gosh, this is
horrible, and horrible things could happen to me or a loved one
if this kind of information were disclosed.''
Mr. Taylor. I agree with what you have heard from the other
witnesses. We asked last year, people to say how concerned they
were about different kinds of information not being protected,
and the top five items were credit card number, Social Security
number, financial assets and information about finances, name
and address so that people could actually reach me, and,
finally, medical and health records.
Mr. Doyle. Thank you. Mr. Chairman, I see my time is up.
Mr. Stearns. I thank my colleague. Mr. Shimkus.
Mr. Shimkus. Thank you, Mr. Chairman. Mr. Doyle has got to
learn how to be a Ranking Member, and don't you know you get to
go way past your time like the Chairman.
It is great to have you. I keep thinking of Richard Dawson
saying, ``Survey says,'' boom, ``Survey says,'' and that brings
up a little bit of controversy about this hearing of should we
be making public policy based upon surveys. Of course, our
President says no, but many of us use polling data quite
frequently. In fact, Wirthlin Worldwide is mine, and I would
like to welcome Dr. Bauman. I know she doesn't deal with me or
in that spectrum, but there is a lot of credibility in what you
all bring to the table, and I appreciate you all being here
today.
Dr. Westin, I want to follow up on a comment that you made,
first of all. You said one in every five people have been a
victim of identity theft. That probably needs some more
clarification. That is two out of every ten people.
I have heard of identity theft because I serve on this
committee, it is my fifth year. But I bet you I could go
through quite a few people before I know of anybody. I don't
know of anybody in my immediate realm, and I come from a family
of seven kids, or identity theft. Can you help us and tell us
where you get this one in every five?
Mr. Westin. We asked a question that said, ``Have you or a
member of your household been the victim of an identity theft,
which is defined as someone assuming your identity to charge
goods or services, or assume your identity for financial
gain.'' Keep in mind then, that that could be somebody who
watches you put in your telephone calling card at an airport,
or somebody who has obtained your credit card in the ways we
have been discussing. So, it is not one out of five adults or
people, it is one out of five households.
In my own household, almost every member of my household
has had one or another of these happen--credit card charge pops
up on an Internet account or a credit card account. Twice I
have had my telephone calling card obtained by somebody who
must have seen me putting it in in an airport.
So, I don't think that that is out of line with some
figures that the Treasury Department, the Secret Service and
others have put out recently, indicating how enormously
widespread these kinds of identity thefts have become.
So, it is true that this is self-reporting, and survey
people always are cautious when people report things and you
don't have objective verification. But if you ask in a survey
has this happened to you, and there is no shame in saying it
has or hasn't, and there is no advantage in saying it has or
hasn't, and if the question really described concretely what
you mean by identity theft, I think that you have to take the
finding fairly seriously.
Mr. Shimkus. Does anyone, based upon their research,
corroborate the two out of ten, or--as far as identity--not to
cause a fight between the brethren here and the industry, but
anyone want to add to that?
Mr. Rainie. We have data which is similar to that, so we
will corroborate, yes.
Mr. Shimkus. Thank you. Survey says two out of five
panelists agree. What is a better judge of the impact of this?
We are mostly focusing on consumers or mostly ecommerce. I
mean, we will go into a whole brave, new world when we deal
with medical privacy. My opening statement talks about the
conflict between the two. I don't know if they can be handled
similarly. But on the ecommerce end, what is the ability of a
projection on business based upon having good privacy
protection versus real-world data on what really occurs in a
market? A survey is a projection. Real data as far as sales and
commerce is a real deal.
I think, Dr. Newport, you mentioned that were we to move in
with some of these privacy provisions--correct me if I am
wrong--your point was we may not see an automatic jump in
ecommerce, is that correct?
Mr. Newport. Yes, that is what I said. I don't know that we
have strong evidence which suggests that lots of people are
restraining from buying things or doing other things on the
Internet because of concerns about privacy. And as I mentioned
in some of my data, although when we asked people ``Are you
concerned'' and they say ``yes,'' it is not, as others have
mentioned, a highly spontaneous problem that comes up when we
talk to people in our polling and, therefore, that is why I
think several of us have said right now I am not sure that
there is an enormous front-runner concern over it.
Mr. Shimkus. Dr. Bauman, I have one--the question that I
wanted to ask Dr. Bauman, and anyone else can add--in your
questioning, did you address the additional cost-benefit
analysis that may occur, and what would the consumer accept as
reasonable cost for protection, or was there in essence no
boundaries?
Ms. Bauman. That is an interesting question, Congressman.
We didn't----
Mr. Shimkus. Yes, it is my job.
Ms. Bauman. We didn't exactly specifically go into the
cost-benefit analysis. What we did ask them about is if certain
provisions were in place, would that make you more comfortable
and more supportive of industry engaging in self-regulation,
and overwhelmingly they said yes to all of those various types
of self-regulating policies and actions.
Mr. Shimkus. Anyone else want to add--and my time, Mr.
Chairman--on the cost-benefit analysis of moving forward?
Mr. Westin. In 1994, we did a survey of how consumers felt
about consumer reporting. What we found was overwhelmingly
consumers accepted the fact that if credit grantors did not get
good credit information about payment of bills and bankruptcies
and liens, that it would cost more for every consumer, it would
take much longer for their applications to be approved, that
minorities would not get the advantages that they seek because
they would be not enhanced in any way in the marketing to them,
and so forth.
So, I think consumers, in fact, are quite accepting of the
benefits that come from information being used for quality risk
assessment, and in the tradeoff there, they are very aware that
there are costs in not having information for making these
kinds of judgments.
Mr. Shimkus. Thank you very much. Mr. Chairman, I yield
back.
Mr. Taylor. Could I just add one note. At the risk of
sounding arrogant, we are very, very proud of the very strong
privacy protection policy we have for our online surveys, which
I described earlier, and it is interesting that in our
telephone surveys we get about 2 percent of people who will
willingly self-identify as gay, lesbian or bisexual. When we do
this with in-person surveys with a ballot box so that the
anonymous form is put in the ballot box, that goes up to 4
percent. In our online surveys, we are consistently getting 6
percent who self-identify in that way. We believe it is because
they trust us not to reveal that information to anyone, and we
think they would not do so if we did not have strong privacy
protection.
Mr. Shimkus. Mr. Chairman, if I could.
Mr. Stearns. Sure.
Mr. Shimkus. Is that because on your survey when it pops
up, you have got, as was stated before, you post the privacy
provisions and that you believe that the consumer or the
individual will be well informed and will make a judgment based
upon the trust they put in your ability to keep that
information private?
Mr. Taylor. Yes.
Mr. Shimkus. Thank you, Mr. Chairman.
Mr. Stearns. The gentleman from Tennessee, Mr. Bryant.
Mr. Bryant. In this committee, I am going to go by John
Shimkus from here on. You have your identity stolen now.
I want to welcome the panel and apologize for being late.
We just landed from back home, and so I have kind of caught up
with some of what you are saying. I do appreciate, as Mr.
Shimkus does, your value in polling and what you do add to this
hearing.
I would suspect, from personal experience, a lot of the
concern that people would have online would be just--many
haven't developed a comfort zone yet in the use of the
Internet, and aren't as skilled as they believe many others
are, and they have a fear, I am sure, of hackers and things
like that getting in the records, but probably, by and large, I
think it is more as people get comfortable using it and their
own abilities and realize that it can be safely used with
adequate protections, that you will find the so-called consumer
confidence going up in this.
I am wondering--I think, Mr. Taylor, if I could ask you--is
there something that the companies can do in making a
compelling case to these consumers that in exchange for this
personal information, there is a benefit, a consumer benefit
there, and how can they do this, if they can?
Mr. Taylor. Well, I think that you have heard from several
of us that they certainly can do that and that they should do
that, and it is necessary because, in general, people are often
unaware of the benefits themselves as opposed to the company
they are dealing with of providing that information.
If you take, for example, information about automobile
accidents for insurance, people realize pretty quickly that if
you obtain that information and if you have got a good,
accident-free record, you will get a better insurance rate, but
initially that probably had to be explained to people. So, you
have to spell out the benefits and they have to be real
benefits, and I would say that sometimes they may not be real
benefits, in which case you have got a problem.
Mr. Bryant. In sort of a follow-up to that, your work for
PLI indicates that the presence of privacy statements and seals
are valued by the public. Further, your work indicates that
consumers rarely take advantage of these privacy tools. In
essence, is it accurate to say that if the consumers see
privacy statements and seals, that they are less likely to
leave a site than not, notwithstanding whether the company
actually provides technology solutions to help the consumer?
Mr. Taylor. Yes, it is clear that the posting of privacy
policies has a positive impact, even though, in some of our
surveys, very few people are actually reading all of them, and
there is also a fair amount of skepticism as to whether
companies actually enforce their privacy policy. So, it is both
a question of having good policies and displaying them and, of
course, enforcing them.
Mr. Bryant. Dr. Bauman, we have talked about this issue a
little bit, but I want to follow up in terms of Gramm-Leach-
Bliley and HIPPA. It seems that consumers are most concerned
about sharing their personal sensitive information such as
medical or financial information. Many of these poll results
have indicated that consumers believe that legislative action
is needed. Have you seen a change in consumer confidence as a
result of the passage of these bills, Gramm-Leach-Bliley and
the HIPPA regulations, and, if not, would you expect to see a
change? These basically incorporate privacy protections. Do you
see anything out there in your polling results that would
reflect the passage of this legislation?
Ms. Bauman. Like I said before, we haven't specifically
asked people about pieces of legislation or even their
awareness of them, so I can't speak directly to that question,
although it is definitely a logical one that could be tested.
People generally are uncomfortable providing that type of
information, and when we do our in-depth qualitative work, we
find the two values that emerge here are people wanting that
peace of mind protecting their personal security, and also
having that personal control to determine that destiny.
So, I would think that those two pieces of legislation
would be comforting, although our research hasn't directly
tested it either before or--so, therefore, I can't speak about
it changing over time either.
Mr. Bryant. This is, I think, a question for Dr. Westin.
Your site evidence that consumers fear privacy keeps them from
participating in the Internet or going on the Net. However, you
state in your testimony that surveys to-date haven't been
helpful in determining what consumers want in terms of
legislation to protect privacy.
Mr. Westin. Yes. If I could go back to your earlier
question, Congressman, isn't it important to know that Gramm-
Leach-Bliley is just beginning to kick in in terms of behavior
toward consumers? It is the flood of notices that people are
now getting from the banks, insurance companies, an avalanche
of them, two or three dozen for a typical family, very
complicated. Federal regulators require that you say things
that nobody would ever want to say to a consumer, but you have
got to follow the regulations both with a litany of what they
tell you you must do.
So, I don't think we know yet how consumers are reacting to
the Gramm-Leach-Bliley structure of rights. It is going to play
out as they begin to understand the way their information is
going to be used and what rights they have.
As far as HIPPA is concerned, it is going to be 2 more
years before those regulations go into full effect, so you
can't really expect consumers to feel anything yet about the
medical and health privacy. Most of the providers are just
beginning to get themselves organized to bring in compliance
with that in 2 years.
So, especially in the survey sense, I don't think you will
find much knowledge on the part of consumers about those two
interventions by Congress, and only one is an enacted, in-force
regulation, the other is something that has to play out across
2 more years.
As to the question you asked me, I think that what I was
trying to say was that in crafting legislation, putting the
choices between, let us say, an opt-in or an opt-out regime
into a survey in a way that you give much credence to the
response of the individual, it is very difficult because that
is a question in which you are really struggling to figure out
what the effects would be of one regime in terms of the
confidence of consumers to business and the business model, as
to how they are going to make money on the Internet.
So, what I was trying to suggest is that consumers can
express concern, but when legislators go to decide what the way
to respond to that concern is, that is where legislative skills
and policy analysis and cost-benefit analysis is what you have
to bring to bear. I have never seen a good survey on cost-
benefit analysis in privacy that I would put much credence in.
Mr. Bryant. Thank you, and I thank each member of the panel
for your appearance and testimony today. Thank you, Mr.
Chairman.
Mr. Stearns. Thank you. Mr. Walden.
Mr. Walden. Thank you, Mr. Chairman. I wanted to follow up
on what Dr. Westin was saying, especially your comment about
the Gramm-Leach-Bliley notices. Probably like a lot of people
in this room, we have been getting them. I think to myself, it
is a good thing it is an opt-out as opposed to an opt-in
because we probably have all kinds of things getting canceled
because after a while you just--have any of you actually read
those notices in detail?
Mr. Westin. I have to for my job.
Mr. Walden. If you weren't required for your job to have
read them, would they--it seems to me we have raised the issue
a bit, but in a very complex, grammatical way. Does anybody
want to comment on the effect of that notification process?
Mr. Taylor. There is an interesting analogy. In the 1980's,
I think, and early 1990's, the pharmaceutical industry was
under a great deal of pressure to put in patient package
inserts describing the risks and the potential side effects of
medication. This was not something which large numbers of the
public were demanding, but there were activists who were
demanding it, and it was the reluctance of the industry to do
this which made people very critical of them and very
suspicious of them. They now are required to do it. Our data
shows that almost nobody reads them, but the fact that they are
there is a little bit reassuring, and the criticism of the
industry has died down, so I actually think it was good for the
industry even though they fought against it.
Mr. Walden. Interesting. All right. Reading through the
testimony and some of the data, am I correct in summarizing
that the bulk of people don't look to the Federal Government
for new legislation here, they would rather control their own
destiny on the Internet, control their own information?
Mr. Westin. I think it is complicated because sometimes
survey research puts the question this way: Do you think
Congress should enact legislation to protect your privacy on
the Internet, and that is a motherhood-type question and it is
not surprising that 60 or 70 percent will say, yes, they are in
favor of it. But if you give them alternatives, if you say:
Would you rather have an option to make your choices as to how
your information is used, or do you think business ought to do
this as a matter of self-regulation and Government should just
police those who do not do it----
Mr. Walden. The hackers and the violators.
Mr. Westin. Exactly--you get a very different result, which
suggests that it is in the framing in the question as to
whether you make it motherhood or whether you give options and
choices, that you really will get your data back.
Mr. Newport. And, Congressman, even with the motherhood
effect--Mother's Day is coming, that is an appropriate point--
we only had half of the individuals, regular Internet users,
who said, yes, the Federal Government should be more involved
than they are currently. Our interpretation contextually was
that that is a fairly low number.
It is easy--I think that Dr. Westin is absolutely correct--
it is easy for a respondent to say, ``Well, of course,
Government should do more``, and the fact that only half said
yes, the Federal Government should do more, to us suggested
that there was not a strong clamoring on the part of
constituents for the Government to intervene.
Mr. Walden. Well, isn't it accurate, too, that a very small
percentage of users even understand cookies and their ability
to do anything about that? I read that in some testimony here.
Mr. Rainie. Yes. Our finding is that more than half of
Internet users and a significant portion even of veteran users
do not know what cookies are, do not know the basic mechanisms
of tracking. And so they would appreciate more knowledge about
that, and they would appreciate a much better explanation of
the virtues of what they get out of cookies.
Mr. Stearns. Is the gentleman complete?
Mr. Walden. I would yield back. Thank you, Mr. Chairman.
Mr. Stearns. I thank the gentleman. We are going to close
here. I think this member, this Chairman, is left with a little
bit of ambivalence here because we were hoping in June to try
to draft something. We feel from the previous hearings that
although we might be ahead of the consumer, we thought it would
be worthwhile to put something as a marker and not drop it as a
bill, then get the response of people in industry--the
software, the hardware companies, consumers--and try to get
feedback on what they felt. And we thought we would do sort of
a minimalist type of approach because the perception is that, I
think even from the surveys, that a lot of people have some
concerns, as Dr. Westin pointed out.
But at this point, as many of the Members said, you really
can't necessarily develop legislation based upon a survey, but
there is the possibility of a landmine, and that is what we
have to weigh. We haven't had any consumers running to us down
in our districts saying, ``Please, please give me an Internet
privacy bill,'' but I innately feel that if we did have
provided a bill of some type and provided a consistency across
the Internet for protection, and the consumer thought he or she
had that, it would certainly increase, I think, ultimately, the
consumer using ecommerce as a form of business.
And so I think the hearing today has pointed out some of
the ambivalence that we all felt. I think you have done a
superb job of giving us your opinion on this, and we appreciate
your time. And with that, the subcommittee is adjourned.
[Whereupon, at 4:40 p.m., the subcommittee was adjourned.]