[House Hearing, 107 Congress]
[From the U.S. Government Publishing Office]
INFORMATION PRIVACY: INDUSTRY BEST PRACTICES AND TECHNOLOGICAL
SOLUTIONS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
COMMERCE, TRADE, AND CONSUMER PROTECTION
of the
COMMITTEE ON ENERGY AND COMMERCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTH CONGRESS
FIRST SESSION
__________
JUNE 21, 2001
__________
Serial No. 107-38
__________
Printed for the use of the Committee on Energy and Commerce
Available via the World Wide Web: http://www.access.gpo.gov/congress/
house
__________
U.S. GOVERNMENT PRINTING OFFICE
73-730 WASHINGTON : 2001
_______________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Printing
Office
Internet: bookstore.gpo.gov Phone: (202) 512-1800 Fax: (202) 512-2250
Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON ENERGY AND COMMERCE
W.J. ``BILLY'' TAUZIN, Louisiana, Chairman
MICHAEL BILIRAKIS, Florida JOHN D. DINGELL, Michigan
JOE BARTON, Texas HENRY A. WAXMAN, California
FRED UPTON, Michigan EDWARD J. MARKEY, Massachusetts
CLIFF STEARNS, Florida RALPH M. HALL, Texas
PAUL E. GILLMOR, Ohio RICK BOUCHER, Virginia
JAMES C. GREENWOOD, Pennsylvania EDOLPHUS TOWNS, New York
CHRISTOPHER COX, California FRANK PALLONE, Jr., New Jersey
NATHAN DEAL, Georgia SHERROD BROWN, Ohio
STEVE LARGENT, Oklahoma BART GORDON, Tennessee
RICHARD BURR, North Carolina PETER DEUTSCH, Florida
ED WHITFIELD, Kentucky BOBBY L. RUSH, Illinois
GREG GANSKE, Iowa ANNA G. ESHOO, California
CHARLIE NORWOOD, Georgia BART STUPAK, Michigan
BARBARA CUBIN, Wyoming ELIOT L. ENGEL, New York
JOHN SHIMKUS, Illinois TOM SAWYER, Ohio
HEATHER WILSON, New Mexico ALBERT R. WYNN, Maryland
JOHN B. SHADEGG, Arizona GENE GREEN, Texas
CHARLES ``CHIP'' PICKERING, KAREN McCARTHY, Missouri
Mississippi TED STRICKLAND, Ohio
VITO FOSSELLA, New York DIANA DeGETTE, Colorado
ROY BLUNT, Missouri THOMAS M. BARRETT, Wisconsin
TOM DAVIS, Virginia BILL LUTHER, Minnesota
ED BRYANT, Tennessee LOIS CAPPS, California
ROBERT L. EHRLICH, Jr., Maryland MICHAEL F. DOYLE, Pennsylvania
STEVE BUYER, Indiana CHRISTOPHER JOHN, Louisiana
GEORGE RADANOVICH, California JANE HARMAN, California
CHARLES F. BASS, New Hampshire
JOSEPH R. PITTS, Pennsylvania
MARY BONO, California
GREG WALDEN, Oregon
LEE TERRY, Nebraska
David V. Marventano, Staff Director
James D. Barnette, General Counsel
Reid P.F. Stuntz, Minority Staff Director and Chief Counsel
______
Subcommittee on Commerce, Trade, and Consumer Protection
CLIFF STEARNS, Florida, Chairman
NATHAN DEAL, Georgia EDOLPHUS TOWNS, New York
Vice Chairman DIANA DeGETTE, Colorado
ED WHITFIELD, Kentucky LOIS CAPPS, California
BARBARA CUBIN, Wyoming MICHAEL F. DOYLE, Pennsylvania
JOHN SHIMKUS, Illinois CHRISTOPHER JOHN, Louisiana
JOHN B. SHADEGG, Arizona JANE HARMAN, California
ED BRYANT, Tennessee HENRY A. WAXMAN, California
STEVE BUYER, Indiana EDWARD J. MARKEY, Massachusetts
GEORGE RADANOVICH, California BART GORDON, Tennessee
CHARLES F. BASS, New Hampshire PETER DEUTSCH, Florida
JOSEPH R. PITTS, Pennsylvania BOBBY L. RUSH, Illinois
GREG WALDEN, Oregon ANNA G. ESHOO, California
LEE TERRY, Nebraska JOHN D. DINGELL, Michigan,
W.J. ``BILLY'' TAUZIN, Louisiana (Ex Officio)
(Ex Officio)
(ii)
C O N T E N T S
__________
Page
Testimony of:
Cerasale, Jerry, Senior Vice President, Government Affairs,
Direct Marketing Association, Inc.......................... 59
Cole, Steven J., Senior Vice President and General Counsel,
Corporate Secretary of the Council of Better Business
Bureaus, Inc............................................... 66
DeVault, Jerry R., National Director, Innovative Assurance
Solutions, Ernst & Young................................... 73
Hsu, Stephen, Co-Founder, Chairman and CEO, SafeWeb, Inc..... 29
Hughes, J. Trevor, Director, Privacy Compliance, Engage, Inc. 55
Rotenberg, Marc, Executive Director, Electronic Privacy
Information Center......................................... 76
Schlosstein, Frances, Vice President, Business Development
and Marketing, Webwasher................................... 25
Schwarz, John, CEO, Reciprocal............................... 32
Wallent, Michael, Product Unit Manager, Internet Explorer,
Microsoft Corporation...................................... 18
(iii)
INFORMATION PRIVACY: INDUSTRY BEST PRACTICES AND TECHNOLOGICAL
SOLUTIONS
----------
THURSDAY, JUNE 21, 2001
House of Representatives,
Committee on Energy and Commerce,
Subcommittee on Commerce, Trade,
and Consumer Protection,
Washington, DC.
The subcommittee met, pursuant to notice, at 10 a.m., in
room 2123, Rayburn House Office Building, Hon. Cliff Stearns
(chairman) presiding.
Members present: Representatives Stearns, Deal, Shimkus,
Bryant, Bono, Terry, Bass, Tauzin (ex officio), Towns, DeGette,
Doyle, Harman, Markey, and Eshoo.
Staff present: Ramsen Betfarhad, majority counsel; Mike
O'Rielly, majority professional staff; Brendan Williams,
legislative clerk; and Bruce M. Gwinn, minority counsel.
Mr. Stearns. Good morning. The Subcommittee on Commerce,
Trade, and Consumer Protection will come to order.
I wish, of course, to thank all of those in attendance,
especially our distinguished witnesses. Welcome to the
subcommittee's hearing. We entitled it ``Information Privacy:
Industry Best Practices and Technological Solutions.'' It could
also be entitled ``Software Solutions and Self-Determination.''
This hearing is the fifth in a six-part series of hearings
examining information privacy. The series is scheduled to
conclude next month. My colleagues, I am confident that this
morning's hearing, as with the four preceding it, will add to
an already rich record on the issues of information privacy.
The record developed by this subcommittee on information
privacy is the most comprehensive in Congress and enjoys both
an impressive range and depth. I invite all members to review
the record before formulating their thoughts and positions on
the issue of information privacy.
Today's hearing adds a new and important dimension to the
existing record--private sector response to privacy concerns.
That response engenders two components--technological solutions
and voluntary industry information privacy standards. I am
particularly pleased that this morning we will witness the
demonstration of just a handful of technological solutions that
are now available to the American consumer.
In my view, these solutions designed to reach information
privacy concerns of the consumer are a critical ingredient of
whatever is a recipe to the final solution of our problem.
Technological solutions are such a critical ingredient for
three reasons among many.
First, nothing offers a consumer greater control over his
information privacy destiny than technology. Using some of the
filtering software being demonstrated today, I, as an internet
user, can determine how much personal information I want to
share and for what purpose.
For example, I can determine to accept a ``good cookie,''
one that makes surfing a website seamless and efficient, as
easily as I can decide to reject a ``bad cookie,'' one designed
to track my online movements for purposes I don't care for.
The second reason why technology is a critical part of any
response to information privacy concerns is the fact that
technology responds to change much faster and with greater
responsiveness and precision to the new and continually
evolving privacy concerns than any other way of addressing
information privacy concerns.
Innovation and technological change has, and continues to
be, a hallmark of the American experience and its culture.
Technology has helped us combat many ills of society, albeit
not by itself. Moreover, solutions to privacy concerns have the
advantage of precision, not too dissimilar to laser surgery. A
tech solution can remove the bad cells with minimal, if any,
damage to the good cells surrounding the bad.
Finally, the incentive for the creation and constant
improvement upon technological tools, getting at consumers'
information privacy concern, is a great one. It is the mighty
dollar. When there is a consumer concern such as privacy, a
marketplace is created. Where there is a market, there are
dollars to be made. Where there are dollars for whatever
reason, there is creativity, innovation, speed, and efficiency.
The second component of the private sector response to the
American consumers' information privacy concerns is the
adoption of self-regulatory measures. Today's witnesses will
highlight a number of voluntary self-regulatory programs
adopted by direct marketers, online advertisers, and retailers.
Moreover, we will hear about a new field in ``assurance
services,'' privacy assurance. No one is under the illusion
that altruism has brought about this movement in self-
regulation. After all, substantial costs are associated with
the deployment, implementation, and adherence to these self-
regulatory standards governing consumer information privacy
practices.
Rather, it seems that many, if not the majority, of
companies dealing with individual consumers have reached the
conclusion that being responsive to their customers'
information privacy concerns is simply ``good business.'' Now,
how successful have they been? I don't know.
What I do know is that some companies have chosen to use
their privacy policies as a means of gaining a competitive
advantage vis-a-vis their competitors. Such competition
ultimately empowers a consumer to vote with his dollars as to
what are his or her information preferences.
In my many years of public service, I have yet to find an
important complex public policy concern that has lended itself
to a panacea quick-like solution. Information privacy concerns
are no exception. Private sector solutions, such as technology
and self-regulatory practice, however, do go a long way toward
mitigating those concerns.
So I look forward to our witnesses' testimony, and we are
just delighted to have them. And I will offer the ranking
member, the distinguished member from New York, Mr. Towns, an
opening statement.
[The prepared statement of Hon. Cliff Stearns follows:]
Prepared Statement of Hon. Clifford Stearns, Chairman, Subcommittee on
Commerce, Trade, and Consumer Protection
Good morning. I wish to thank all in attendance, especially our
distinguished witnesses. Welcome to Commerce, Trade, and Consumer
Protection subcommittee's hearing entitled, Information Privacy:
Industry Best Practices and Technological Solutions. This hearing is
the fifth in six part series of hearings examining information privacy.
The series is scheduled to conclude next month. I am confident that
this morning's hearing, as with the four preceding it, will add to an
already rich record on the issue of information privacy. The record
developed by this subcommittee on information privacy is the most
comprehensive in Congress and enjoys both an impressive range and
depth. I invite all members to review the record before formulating
their thoughts and positions on the issue of information privacy.
Today's hearing adds a new and important dimension to the existing
record: private sector response to privacy concerns. That response
engenders two components: technological solutions and voluntary
industry information privacy standards. I am particularly pleased that
this morning we will witness the demonstration of just a handful of the
technological solutions now available to the American consumer. In my
view, technological solutions designed to reach information privacy
concerns of the consumer are a critical ingredient of whatever is the
recipe to the solution for the problem.
Technological solutions are such a critical ingredient for three
reasons, among many. First, nothing offers a consumer greater control
over his ``information privacy destiny'' than technology. Using some of
the filtering software being demonstrated today, I, as an Internet
user, can determine how much personal information I wish to share and
for what purpose. For example, I can determine to accept a ``good
cookie--one that makes surfing a website seamless and efficient--as
easily as I can decide to reject a `bad cookie' '' one designed to
track my online movement for a purpose I don't care for. The second
reason why technology is a critical part of any response to information
privacy concerns is the fact that it responds to change much faster and
with greater responsiveness and precision to the new and continually
evolving privacy concerns than any other way of addressing information
privacy concerns. Innovation and technological change has and continues
to be a hallmark of the American experience. Technology has helped us
combat many ills of society, albeit not by itself. Moreover,
technological solutions to privacy concerns have the advantage of
precision. Not to dissimilar to laser surgery, a tech solution can
remove the bad cells with minimal, if any damage, to the good cells
surrounding the bad. Finally, the incentive for the creation and
constant improvement upon technological tools getting at consumer's
information privacy concerns is a great one. It is the mighty dollar.
When there is a consumer concern such as privacy, a market place is
created. Where there is a market, there are dollars to be made. Where
there are dollars, for whatever reason, there is creativity,
innovation, speed and efficiency.
The second component of the private sector response to the American
consumer's information privacy concerns is the adoption of self-
regulatory measures. Today's witnesses will highlight a number of
voluntary self-regulatory programs adopted by direct marketers, online
advertisers and retailers. Moreover, we'll hear about a new field in
``assurance services,'' privacy assurance. No one is under the illusion
that altruism has brought about this movement in self-regulation. After
all, substantial costs are associated with the deployment,
implementation and adherence to those self-regulatory standards
governing customer information privacy practices. Rather, it seems that
many, if not the majority, of companies dealing with individual
consumers have reached the conclusion that being responsive to their
customers information privacy concerns is simply good business. Now,
how successful they have been, I don't know. What I do know is that
some companies have chosen to use their privacy policies as a means of
gaining a competitive advantage vis-a-vis their competitors. Such
competition, ultimately empowers the consumer to vote with his feet
and/or dollars as to what are his or her information privacy
preferences.
In my many years of public service, I have yet to find an important
and complex public policy concern that has lent itself to a panacea
like solution. Information privacy concerns are no exception. Private
sector solutions such as technology and self-regulatory practices,
however, do go a long way towards mitigating those concerns.
Thank you. I look forward to the testimony.
Mr. Towns. Thank you very much, Mr. Chairman. I have a
prepared opening statement, but I would like to just put it in
the record and just make a couple of comments.
Mr. Stearns. Without objection, so ordered.
Mr. Towns. First of all, let me commend you, Mr. Chairman,
for the way you are handling this situation. The fact that you
are moving very slowly, you are listening, you are talking to a
lot of people before moving forward. I think that is really the
smart way to do it, and I want to commend you for that.
I also want to say that some people are saying that we
should just leave this alone and it will sort of work itself
out. But the consumers are out there saying, ``We want to be
protected.'' And I think that we need to take a very careful
look and try to find out ways and methods that we can protect
them.
And I feel very comfortable, Mr. Chairman, in the way you--
again, the way you are moving, because, you know, we need to
talk to people, we need to listen, and we need to visit. And I
have been trying to visit as many companies as I possibly can,
of course, in the New York area to talk to them to get their
input in terms of how we should handle this situation.
I don't want us to make the mistake that Thomas Jefferson
made. Thomas Jefferson read a pamphlet on how to swim and
jumped in the water and almost drown--you know, kicking his leg
and pulling his arm, and all of that. So I don't want to be
guilty of that. I think that we need to make certain that we
talk to people that are out there in the field on a day-to-day
basis, in terms of--and involved in this issue.
And I think that if we do that, then I think that at the
end of the day we can come up with something that will not put
a whole lot of folks out of business, but at the same time be
able to protect the consumer as well.
So I wanted to say to you, I salute you on that, and I am
anxious and eager to hear from the witnesses because I think
this is something that we must deal with eventually. No
question about it. And on that note, I yield back.
[The prepared statement of Hon. Ed Towns follows:]
Prepared Statement of Hon. Ed Towns, a Representative in Congress from
the State of New York
Mr. Chairman, thank you for holding this educational hearing on
information privacy. I would also like to join you in welcoming the
members of both panels assembled here today. I would especially like to
welcome my friend, John Schwarz, the CEO of Reciprocal, which is
located in New York's Silicon Alley. John has a great product to
display for us today and I look forward to hearing from him as well as
all the witnesses.
Mr. Chairman, I must say that I am heartened by the technologies
assembled here today that will allow consumers more control over their
personal identifiable information. I am particularly pleased with
Microsoft including the Platform for Privacy Preferences or (P3P) into
their latest edition of Internet Explorer. After seeing a demonstration
of this new technology integrated with the new Microsoft Operating
System, I feel that consumers are going to be empowered like never
before to not only further protect themselves but to further educate
themselves on protecting their privacy, which is of the utmost
importance.
I do not commend the P3P technology because it is an end all-be-all
for privacy protection, but rather because Microsoft is truly the first
company to offer a pragmatic solution which grants more power to the
consumer while they surf the Internet.
The other technology that I want to bring to my colleagues'
attention is that which is being used by Reciprocal. Reciprocal is a
company, which currently protects Intellectual Property on the Internet
by encrypting the content when it is purchased online. While Mr.
Schwarz will explain this more in depth during his testimony, his
technology can be and in the near future I believe should be used to
help protect medical as well as financial records, in addition to other
personal information belonging to consumers.
Companies need to feel that their efforts will not go unrewarded.
Many of my colleagues are bent on legislating Internet privacy. While I
would agree that minimum standards are needed, why limit an industry
that continually awes consumers with each new product developed? Let's
not put restrictions on the Internet or on the technology that is
bettering our constituents' lives.
I look forward to hearing the testimony from our witnesses and
yield back the balance of my time.
Mr. Stearns. I thank the gentleman.
The gentleman from Illinois, Mr. Shimkus?
Mr. Shimkus. Thank you, Mr. Chairman. And I will be brief;
we have two large panels. And I apologize for having to leave.
Our State delegation is meeting on appropriation issues, and I
get to chair that meeting at 11.
But I want to thank you for holding this hearing. I look
forward to the demonstrations that I am going to be able to
observe. We will have staff present.
Also, I am interested in hearing how the businesses depend
on sharing personal information and their views of new privacy
tools. We all know that our citizens want privacy protection.
We also know that our citizens want to accrue all of the
benefits of information sharing.
The question is: are these two issues mutually exclusive?
Hopefully you will inform us that what is--what the consumers
want is the best, and you are helping provide the technology
through the business model to solve those issues. I hope you
can answer those questions, and we look forward to hearing from
you.
I yield back my time, Mr. Chairman. Thank you.
Mr. Stearns. I thank the gentleman.
The gentlelady from California, Ms. Eshoo?
Ms. Eshoo. Thank you, Mr. Chairman. Good morning to you,
and welcome to the witnesses. We are grateful to you for coming
to Washington to enlighten us.
Today's hearing can provide very important information I
think for all of the members of the subcommittee for our
discussion on the need for privacy legislation. By examining
some of the existing technological solutions and business
practices, I think that we can learn and understand better and
be able to gauge the type of legislation that the issue calls
for.
I have introduced a bill, along with Congressman Chris
Cannon from Utah, that achieves--at least we think it achieves
a balance between the protection of online consumers and
continued promotion of technological innovation relative to the
evolution of e-commerce.
We want to be able to encourage the growth of the internet
and e-commerce, and I think that the bill strikes that balance.
It does this by establishing some basic minimum standards in
the form of notice and choice, and at the same time leaving
room for the industry to continue to develop its own privacy
protection technologies, some of which we are going to see
today.
We have to get this right legislatively. I think if there
is anything that is built into legislation that allows for the
unintended consequences that could happen we can really hurt
what we are really attempting to grow. So I am very mindful of
that, and I think anything that we do that--in haste, that we
could live to regret it legislatively.
We know that all of our constituents feel very strongly
about privacy. I think that privacy runs through the veins of
the American people. We have always had a resistance and a
suspicion of Big Brother, and I think that there are people out
there today that have a sense that they are suspicious or
afraid of Big Browser.
So we not only can collect information, it can be sold, it
can be shared. There are some blessings to that, but there is a
down side to it as well. So I think that today's hearing can go
a long ways with the subcommittee so that we can then tell our
colleagues about what technologies can do, but I also think
that it will help build a foundation for legislation in the
107th Congress to provide the privacy that the American people
feel so strongly about and insist upon justifiably.
So I look forward to hearing from the witnesses, and thank
you, Mr. Chairman, for having this important hearing.
Mr. Stearns. I thank the gentlelady.
My colleague from New Hampshire, Mr. Bass, is recognized.
Mr. Bass. Thank you very much, Mr. Chairman. And, again, I
repeat, I appreciate these series of hearings. They have been
tremendously informative for me as a newer member of the
committee and my first exposure to what is an exceedingly
complex and difficult issue.
I understand that before the Congress moves forward with
any kind of government solution--if you want to give it a
generic definition--we need to fully understand the scope of
the problem, the players involved, and what reasonable role
government can play, balancing the need to maintain a strong
and vital economy on the internet, while at the same time
protecting the rights of individuals.
I was, unfortunately, not able to come to the hearing that
was held yesterday on--or Tuesday, rather, on Ford v.
Firestone, because I was holding a cyber security/privacy
conference of my own in my district, in which a number of
individuals, some of whom are in the same business that you
folks are in, and others that are--that run concerns that have
a significant cyber exposure, to try to--we met to listen to
speakers who made presentations to try to make sure that we
understand, at least in my district, which is a very high-tech-
oriented district, what the problems are and what the potential
solutions are.
And without getting into some of the conclusions that were
drawn by this conference that I had, suffice it to say that
this hearing dovetails very well with the subject matter that I
am personally concerned with and that is the concern of a
significant constituency in New Hampshire.
So thank you, Mr. Chairman, and I will yield back to you.
Mr. Stearns. The gentleman yields back.
The gentleman from Massachusetts, the ranking member of the
Telecommunications Subcommittee, Mr. Markey?
Mr. Markey. Thank you, Mr. Chairman, very much. And we
welcome all of you best practices people, and, you know,
congratulations. We are going to give you each gold stars on
your forehead today for your excellent work. And you are going
to actually set a standard for this committee as to what we can
expect everyone else in the industry to do.
Obviously, we're not going to pass any laws that will
punish you, because you all do good work. But because you know
better than we do how many really bad people are out there
online, which is why all of your technologies are necessary, we
are going to have to pass laws to protect the public against
them. But you don't have to worry because you all are meeting
the standards for protection of the public.
That is the good news about your testimony today, that this
technology is there, that public privacy can be protected, that
it is not hard for the industry to do this. That is the good
news, that you have the strongest case that can be made to pass
legislation, that we need legislation, that we have to give
everyone the minimal rights to be able to protect their
information.
After all, we have done it before. You know, people's tax
returns are protected, their cell phone records, their
telephone records, their cable records. None of this is
publicly available. None of it can be disseminated without the
express permission of the individual.
We were doing that in an analog world. Now that we have you
digital geniuses here to help us to explain--there are some
people, believe it or not, who will tell us you can't do it in
a digital world, even though they did it in an analog world.
You know, how foolish, how anti-technology, huh? How
antediluvian they all are. Because we all know that we have
moved, actually, from the world of Big Brother to Big Browser.
The real threat now is less what the government can do to
you, but what corporate America can do to you, as these
corporate data-mining giants seek to combine every piece of
information about you so that they actually wind up knowing
more about yourself than you do or any other member of your
family.
Now, we should give every American, obviously, the right to
protect against that kind of invasion, because that is--that is
the central right that every American has. That is what
distinguishes us from the rest of the world.
And it is sad to think that the Europeans are ahead of us
in granting these kinds of rights, because we have--that is why
we fled all of these nice, European countries, most of us in
this room, our grandparents, because we weren't given these
rights to protect our religion, to protect our ethnic
background, to protect our privacy, from what the king--from
what these despots might try to do to us. So we thank you for
illustrating how this is possible.
And I think, Mr. Chairman, in conclusion, we need three
levels of protection. One, we need for every American to have
the right to access to these technologies--P3P, any other
technology that can wall out any of this information. We need
individuals to themselves try to protect themselves.
But at the third level, you have to realize that there are
still going to be corporate or individual attempts to intrude
upon our privacy. And as a result, there has to be a minimal
floor of privacy that every American is entitled to, legally
and enforceably.
And only at the point at which all three components are in
place simultaneously will there be a set of privacy protections
which can protect the public. But I want to thank all of you,
because there are many people, by the way, who don't want to
testify here today, who will contend that what you are saying
is really impossible, too difficult, can't do it,
technologically impossible to protect privacy, too complicated
for industry.
Even as industry says, ``We can move your information from
here to Kuala Lampur in the blink of an eye. And isn't it
great, this information age?'' And then when you say, ``Oh, by
the way, can you just let me check off someplace where I don't
want it disclosed,'' they go, oh, the horror, the technological
complexity of adding that one extra little box. I don't know
how we are going to do it. It is a little bit--I will just
conclude on this.
It is a little bit like this hearing that we had last week
where, you know, you have got the Energy Department here
saying, ``Yes, it is possible to deploy a Star Wars technology
that can be deployed in outer space with nuclear powerplants in
outer space, and lasers and beams and coordinated on the
ground, and knock down every Chinese and Russian missile in
under a minute and a half.''
And we can do this all in the next 4 years, and actually we
don't even need the anti-ballistic missile treaty, and we can
abrogate our relationships with just about every other country
in the world, and we know it is technologically possible.
And then you say to them, ``Well, can we improve the
efficiency of air conditioners?''
And they go, oh, the horror. The horror of trying to
improve air conditioners so that we can deal with the
electricity crisis. Okay?
So you are proof positive of something that is working in
the marketplace that--complemented with a legal minimal set of
enforceable protections that every American can sleep at night
knowing that if somebody tries to do something to them that
there will be a way in which the law can protect them.
Thank you, Mr. Chairman.
Mr. Stearns. Thank you.
The gentleman from Nebraska, Mr. Terry, is recognized for
an opening statement.
Mr. Terry. Thank you. I appreciate your holding this
hearing. Welcome to all of our witnesses, and I yield back.
Mr. Stearns. The gentleman yields back.
The gentlelady from Colorado, Ms. DeGette?
Ms. DeGette. Thank you, Mr. Chairman, for holding yet
another informative hearing on a topic none of us ever tire
of--privacy.
While I am always loathe to follow Mr. Markey, I still want
to add a few words, although I am sure not as glibly as Mr.
Markey often does.
Not too long ago, if an online business had a privacy
policy, they were probably way ahead of the eight ball,
regardless of what the privacy policy actually said. Now having
a privacy policy is not so important as what that policy
actually is. And, increasingly, consumers seem to know that.
During earlier hearings in this series on privacy, I
remarked that I see privacy as an issue that can be used to
great advantage by industry, if it realizes how important the
issue is to consumers. And we all know poll after poll shows
that personal privacy continues to be one of the top concerns
of individuals ranking right up there with health care and
social security. And in the technological age, privacy is an
increasing concern of consumers.
If businesses, like those today will testify, institute
straightforward and effective privacy policies, I think
customers will beat a path to their door. And there are a lot
of examples how this is already happening.
We need to address both the perceived and real fears people
have with respect to privacy, though, particularly in this
electronic age.
And I think this bears repeating today because the best
technology and privacy policies in the world won't do much to
further consumer protections if the consumer doesn't realize
what is aware to him or her, or if they don't understand the
vagaries of the particular technologies or policies they are
dealing with.
From a business perspective, a lot of time and money can be
invested in implementing a certain technology. And if the
customers can't figure it out, or if the customers don't even
know about the existence of the policy, then the business won't
reap the benefits.
One of the programs that I read about in the testimony for
today is the AICPA web trust program for online privacy. I
recently talked about this program with some of my constituents
who are members of the Colorado Association of CPAs, and they
told me that when this program was first getting off the ground
their members did not want to implement the system.
They thought it was a hassle. They thought it was
expensive, and so on. Many of the CPAs still have not put the
system into place, but those who have done so found they were
more than earning back their investment because of the
increased business that came their way because of higher levels
of consumer confidence in the business.
So I think it is both the responsibility of business and a
smart economic decision to make sure their privacy policies are
fully accessible to their customers. The trick will be, as Mr.
Markey pointed out, what do we do about the businesses who
don't understand that this is both the right thing to do for
consumers and also the economically prudent thing to do for
their own business? And how do we protect consumers?
It is an ongoing discussion that we will have. There is no
magic bullet, because of advances of technology. And I look
forward to hearing from our witnesses and hearing some of the
new advances, and I am happy to yield back, Mr. Chairman.
Mr. Stearns. I thank the very distinguished colleague.
The gentleman from Tennessee, Mr. Bryant, is recognized for
an opening statement.
Mr. Bryant. Thank you, Mr. Chairman. I, too, look forward
to hearing from our witnesses today as we continue our look
into the issue of information privacy.
It is good to see the private sector respond to the
concerns of so many--that so many people have about the
internet, and this hearing is a great opportunity for us to
learn more about the technologies developed and how it provides
consumers with the protection that they want.
In previous hearings, I have learned that each user has a
different opinion of what a violation of a person's privacy
entails. It is good to know that technology such as Webwasher,
Zero-Knowledge, P3P, and Microsoft Internet Explorer have been
developed so each user can choose what kind of protection she
wants when using the internet.
I am particularly glad that the Better Business Bureau has
taken the initiative as a third party to verify the security of
various websites. I am also looking forward to hearing from the
Direct Marketers Association and the National Advertisers
Initiative, so that we can learn more about the efforts used by
each to ensure that online advertisers don't overstep their
bounds.
Internet users like to be aware of instances when their
information is going to be shared, and I think most would like
to have that option of opting out.
I also hope that today's hearing can serve effectively as a
public forum to inform Americans about technologies, software,
and assurances out there, which a person can utilize to prevent
information about themselves and their internet habits from
being known by parties without knowledge or permission of that
user.
I also hope that this hearing will provide people with
information so that a user can have more confidence in the
security of internet.
With this, I would close my statement and thank the members
of this panel for coming here today. Thank you.
Mr. Stearns. I thank my colleague.
Mr. Doyle, Pennsylvania, is recognized for an opening
statement.
Mr. Doyle. Thank you, Mr. Chairman.
Good morning and welcome to all our invited guests and
witnesses. I am looking forward to hearing what you as industry
experts have to tell us regarding the viability and approach
that your companies have employed to make electronic
transactions via the internet more secure.
Many of my colleagues on this subcommittee are well aware
that today's hearing is the fifth in a series that the Chairman
has called to examine various aspects of internet privacy
debate. Without a doubt, the majority of American consumers are
concerned about the security of their personally identifiable
information that can be gathered while online.
This subcommittee has heard testimony from previous
witnesses who have conducted numerous surveys of online
customers that speak to this fact. Additionally, we are here
today to listen to the technological solutions and approaches
various companies have developed or are in the process of
developing to meet the privacy needs of online consumers.
Companies would not be developing and marketing these
services if a market demand for such goods did not exist. The
issue of controlling the information that is gathered about
consumers while online and how to go about limiting the
distribution of this information is a fundamental consumer
protection issue.
We have a significant challenge and a good deal of
discussion ahead of us before we reach a conclusion as to the
best way to ensure that personal information is protected
online while not stifling the continued growth of e-commerce in
America. Today we revisit the issue of proper industry self-
regulation this subcommittee raised in another previous
hearing, and hopefully we will see some definitive solutions to
privacy protection.
I find it encouraging that the industry is responding to
the challenges presented by internet privacy and is developing
and implementing security software or protocols to address
these concerns. It has been said that there is a buck to be
made with the development of such services. After all,
innovation and creative industry response to consumer needs has
long formed the backbone of commerce in this country.
I am concerned that although privacy protection companies
may prevent direct third-party access to personally
identifiable information, the privacy protection software
itself could be used to gather information which might be
shared with affiliated third party companies.
I am quite sure that the representatives of the companies
here today would never employ such tactics and are making great
strides to combat this abuse. But without a basic framework of
standards and regulations, other less responsible entities
could exploit public trust for financial gain.
Mr. Chairman, I look forward to hearing about the software
and the practices that our esteemed guests have developed to
ensure that this scenario does not become a reality.
I thank you, and I yield back.
Mr. Stearns. I thank my colleague.
And now we recognize for an opening statement the
distinguished Chairman of the full committee, the gentleman
from Louisiana, Mr. Tauzin.
Chairman Tauzin. Thank you, Mr. Chairman.
As the committee knows, this committee requested that
Chairman Stearns conduct a thorough review and educational
process on the issue of privacy. And, Mr. Chairman, I want to
compliment you on the fact that I think you have already
outdone your assignment.
This has been an extraordinarily instructive series of
hearings, and I think it is going to help our full committee at
some point make some very good and wise decisions regarding
privacy, not only online but for the general sake of the
American public. And I thank you for this hearing today.
Today, as you know, we focus on two very important aspects
of the question. In the privacy conference this committee
conducted last year with the Chamber of Commerce, we first-hand
saw and learned about some of the new technological
developments of new equipment and software that, in fact,
enable consumers to protect themselves online in various and in
sundry ways.
And we have also learned that over the last year there have
been a myriad of new products coming on board and new
technologies being developed. We will learn more about that
today, and I thank you for arranging that, Cliff.
Second, we will learn a lot more about the practices in the
self-regulatory regimes that exist in the marketplace by which
the industry and its players are attempting to do what a good
marketplace always does, and that is give consumers something
they want.
And we know that consumers do want an assurance that
privacy concerns are being addressed by the companies they deal
with, and the people they will deal with online, and that these
privacy concerns are taken seriously enough that consumers have
some confidence in both the security of their transactions and
the respect that will be given to information that consumers
would rather not be used in ways that they would not approve
of.
And so we will learn a lot today about the practices within
the industry. Mr. Chairman, in your last hearing we learned why
consumers have reason to be concerned, and that there are, in
fact, some bad practices in the marketplace. We have learned
recently, even worse, that Federal websites are filled with
cookies, websites where consumers don't necessarily volunteer
information but in many cases are obliged to give information
to a Federal agency.
So we have got some real work to do in both the publicly
owned websites of America and the Federal agencies and their
relation to their consumers and to the consumers who enter the
commercial online world and want and expect some degree of
security and privacy in their transactions.
This will be a very illuminating hearing because it will
help us understand what is, in fact, occurring out there,
particularly over the last year, that will give consumers more
and more control over this sensitive issue in their lives.
I also want to point out that while privacy concerns are
not limited to online transactions, this exercise today will
again give us more insight as to some of the broader issues of
privacy concerns in the marketplace. And, again, I thank you
for that.
Finally, I want to address one issue that has received a
little attention lately, and that's the changes that have
occurred in the other body, and as they affect the issue of
privacy and legislating on privacy.
Let me assure all of you that the subcommittee chairman and
I are committed to a very thoughtful, a very careful, and
professional review of these privacy concerns, and that changes
in the other body are nothing more than that--changes in the
other body.
We intend to keep our course, and we intend to proceed very
carefully in this area because we understand how delicately the
information age depends upon a very careful cut between
restricting information for the cause of protecting privacy and
permitting the free flow of information for the sake of an
information age that depends upon information.
We are going to proceed very carefully because our rule is
to do no harm and to facilitate and to actually encourage the
development of things we are going to learn about more today--
self-regulatory practices, self-regulatory regimes, enforcement
regimes, and technologies that empower consumers in this
marketplace.
Thank you very much, Mr. Chairman.
[The prepared statement of Hon. W.J. ``Billy'' Tauzin
follows:]
Prepared Statement of Hon. W.J. ``Billy'' Tauzin, Chairman, Committee
on Energy and Commerce
Thank you, Mr. Chairman, for holding this hearing. This is another
step in the education process on this important public policy issue.
You have certainly outdone yourself in an effort to provide the
Subcommittee with a full background on the subject of privacy.
Today's hearing focuses on two important pro-active steps
organizations are taking at their own initiative to help improve
consumer privacy: developing technological privacy solutions and
creating positive private sector practices and/or enforcement regimes.
For a number of reasons, some valid and some invalid, current
information exchange practices have generated increased concern by
consumers about their ability to maintain their personal privacy. From
the last hearing on privacy, we learned that consumer confidence is
somewhat shaken by the privacy practices of some companies. Today, we
get to look at what is being done about this.
With every problem, however, there is a corresponding opportunity.
As with most things in the free market, someone is going to find a way
to take advantage of this opportunity. The creative and innovative
nature of technology is starting to take root to fill in the gap
between the privacy protections consumers want and the information
gathering and exchange that some companies practice. Specifically, some
entrepreneurs and technology companies are developing products designed
to further protect consumer privacy. Software and hardware solutions
are sprouting-up in the marketplace to deal with consumer privacy
interests. These solutions come in many forms with differing options
and costs. From filtering products, to anonymous web-surfing, to
browser notifications and standards, technology is just starting to
enter this field. And this is just the tip of the iceberg. I expect
many new technologies to be created to address this issue and meet
consumer demand for privacy protections.
In addition, many American companies, recognizing it is in their
best interest to address consumer concerns, have already taken steps to
improve their privacy practices or provide necessary assurances to
consumers of their practices. In other words, many companies want to
promote consumer confidence by giving them what they want--better
privacy.
Self-imposed privacy enforcement and assurance regimes have been
created to promote company use of positive privacy practices--or
industry ``best practices.'' These regimes also come in many different
forms and may target specific sectors of industry. Today, we will hear
from a number of representatives about the steps they are taking, the
companies they represent or oversee, the processes they use to approve
and enforce their privacy practices, and more.
I think one important message to take from this hearing is the
great work that is being done by the private sector to promote consumer
confidence as it pertains to privacy. I appreciate the work of those
companies that are developing technology and those organizations
keeping privacy practices in line with consumer wishes.
I think the Committee can gain a valuable education by actually
trying to use and implement the technology that is out there. And so, I
will be asking the relevant interested parties, especially those not
able to testify today, to work with us over the next few months to show
us how your technology or industry best practice would work as they
apply to this Committee's website. I recognize that the privacy debate
is more than just what is happening online, but this should be a useful
exercise. In a voluntary way, I am hopeful that we can explore the
differing programs, including the seal and assurance programs, to learn
how they work. We also need to learn more about which technologies the
Committee could implement to ensure citizens feel comfortable with the
Committee's privacy practices. In other words, show us first-hand what
you have and what it really does.
Lastly, let me address one issue that has received added attention
recently because of the changed perspective of the Other Body towards
privacy. Let me assure everyone that the Subcommittee Chair and I are
committed to a well thought-out, deliberate, rational process as it
pertains to privacy and any potential fixes. The changes in the Other
Body and its impact on privacy are just that--changes in the Other
Body. We will continue along our own path.
I again thank the Subcommittee chair for holding this hearing and
look forward to the testimony of the witnesses.
Mr. Stearns. I thank the distinguished chairman.
We will now go to panel No. 1. Before I start, I would
introduce or indicate to my colleagues that Mother Nature has
prevented one of our witnesses from attending. Mr. Austin Hill
of Zero-Knowledge was unable to get a flight from Montreal to
Washington last night because of electrical storms. Mr. Hill
asked that his testimony be made part of the record in his
absence. And without objection, it will be so ordered.
[The prepared statement of Austin Hill follows:]
Prepared Statement of Austin Hill, Co-Founder, Executive Vice
President, and Chief Strategy Officer, Zero-Knowledge Systems, Inc.
Thank you, Mr. Chairman and members of the committee. I applaud the
Subcommittee's leadership in addressing privacy issues, and appreciate
the opportunity to talk today about the role technology solutions play
in maintaining information privacy in our global information society.
My name is Austin Hill, and I am the co-founder, executive vice-
president, and chief strategy officer for Zero-Knowledge Systems. Zero-
Knowledge is a provider of privacy-enabling technologies and services.
We employ 175 people and are headquartered in Montreal, Canada with
offices in Redwood City, California. Zero-Knowledge is the oldest and
largest privacy technology and services company. We employ many of the
world's leading privacy policy and cryptography experts, and have been
working since 1997 on technological ways to prevent the erosion of
privacy in the information society.1
---------------------------------------------------------------------------
\1\ See http://www.zeroknowledge.com for more information.
---------------------------------------------------------------------------
As both a privacy advocate and entrepreneur, I will outline the
factors creating our society's major privacy challenges, and detail
where we have the technological tools to manage and secure information
privacy.
INFORMATION PRIVACY: AN ENTREPRENEUR'S PERSPECTIVE
Four years ago, after successfully creating Canada's third largest
ISP, my partners and I started thinking about Internet privacy. We saw
studies showing that privacy was a growing concern for consumers and
immediately recognized its importance to an emerging e-business sector.
Much of our inspiration was based upon the idea that technology
will be everywhere: multiple networked devices, wireless location
services, intelligent homes, and ubiquitous networks. We believed that
if we, as a society, did not come to terms with how to safeguard
people's personal information, the technologies that would soon become
so pervasive would erode individual privacy. We also recognized that if
information privacy was not addressed in a way that offered customer
preference and choice while enabling businesses to build trusted
relationships with consumers, all of the coming advancements in
technology would not reach their full potential.
As a person who places a high value on individual privacy, I was
deeply concerned. Yet, I also saw an incredible opportunity for
privacy-enabling products and services. So, in 1997 my partners and I
created Zero-Knowledge Systems to be the company that provides the
solutions to ensure information privacy in our society.
At Zero-Knowledge we have long held the view that good privacy is
good for business, and the more we talk with our customers at some of
the world's leading companies, the more we see that industry leaders
share this view.
The Gartner Group articulated it well in a recent report, saying:
``The widespread adoption of the Internet and the web has shifted
cultural attitudes toward privacy. Heightened privacy sensitivity will
require online and offline businesses to re-examine existing
information practices. Through 2006 information privacy will be the
greatest inhibitor for consumer-based e-business.'' 2
---------------------------------------------------------------------------
\2\ Please visit http://www.gartner.com
---------------------------------------------------------------------------
We are at the beginning of the information technology revolution
and it is clear that privacy has emerged as both a major challenge and
opportunity. Now is the time to build privacy into business, and the
new products and services being deployed every day. On the positive
side, businesses and policy-makers such as yourselves have recognized
the problem and are actively looking for solutions. I firmly believe
that Zero-Knowledge and other companies are well positioned to provide
these solutions.
When examining what we need to address to provide the tools to
assure information privacy, one must look at the information itself.
How well an enterprise manages its personal information assets will
determine the success or failure of critical e-business initiatives. A
core business asset, personal information carries with it many
challenges and opportunities.
One must recognize the information explosion our society is in the
midst of. UC Berkeley's School of Information Management and Systems
stated that ``(m)ore information will be created in the next 3 years
than in the last 40,000 years.'' Between 1980 and 2000 we created 10
million terabytes of data. This includes music, books, credit, medical
and personal records and other common data types. From 2000 to 2003 we
will create 40 million terabytes of data.3
---------------------------------------------------------------------------
\3\ Please visit http//www.sims.Berkeley.edu
---------------------------------------------------------------------------
This is a truly astounding statistic. It becomes even more
important to today's discussion when two more factors are taken into
account.
The first is to again realize that the trend for technology is
toward pervasive devices and ubiquitous networks. Everything from your
car to your home and phone will talk to each other and share data. The
combination of the two technological trends of information explosion
and pervasive computing suggests that personal information will now
need to stored and transferred in a variety of new manners. Information
will not simply reside on a home PC, or a PDA, but will be stored on a
variety of networks, and with a variety of different organizations.
This data will then be shared via the fixed Internet, the mobile
Internet, and emerging personal area networks such as Bluetooth and
wireless 802.11 connections.
The second factor, and most relevant to your topic today, is that
of all of this data the overwhelming majority of it will be personal
information. Some estimates hold that over 80% of it will be personal
information, including medical records, insurance records, educational
records, personal communications, credit history, photos and home
video, and government records.4
---------------------------------------------------------------------------
\4\ EMC, the leading data storage company, http://www.emc.com
---------------------------------------------------------------------------
Zero-Knowledge believes that there are two classes of privacy-
enabling products necessary to fully address information privacy in a
climate such as this: (1) consumer-side privacy protection tools; and
(2) corporate-side Privacy Rights Management technologies.
Examples of privacy protection tools include products such as anti-
virus programs, firewalls, and encryption tools. The goal of privacy
protection technologies is to stop people from invading your privacy.
These types of tools place the burden of use on the consumer, but also
empower them to take control over and protect their privacy. We will
always have private data that only we as individuals can protect and so
it is essential for there to be privacy protection tools available to
consumers.
Zero-Knowledge has created the Freedom Internet Privacy Suite to
empower Internet users to secure and protect their privacy when online.
Its standard features include a firewall, ad manager, form filler, word
scanner, and cookie manager. These features combine to enable an
Internet user to control how and when their personal information is
released, and to protect their PC from malicious hackers. We also offer
Freedom's Premium Services, which add the industry's most robust
private encrypted email and private browsing to the suite. These two
services utilize the global Zero-Knowledge Network of servers that re-
route and privatize the traffic of Freedom users.
Other privacy protection solutions are available to consumers and
two of them are here to testify today, WebWasher and Microsoft with its
P3P-enabled browser. Technologies such as these are essential to ensure
that consumers have the tools necessary to protect their privacy.
The second class of privacy solutions I referred to, Privacy Rights
Management (PRM) technologies, represent an essential framework for
building information privacy into the enterprise.
In the information society, I must trust various organizations,
businesses or individuals such as my doctor with my personal
information. Hence, there is a requirement for those parties to be
responsible and accountable for how they manage my data. Today, no
tools exist for a business or organization to demonstrably protect and
manage the personal information it has collected about its valued
customers and employees.
Businesses must adhere to a complex and constantly emerging global
framework of privacy regulations and have begun hiring Chief Privacy
Officers (CPO) and other data protection officers to help with the
task. I have spoken with many of these new CPOs at Fortune 500
companies and they all articulate the same concern: they don't have the
tools to do their job. Imagine a Chief Financial Officer attempting to
do her job without tools such as Enterprise Resource Planning software
or even spreadsheets. It would be close to impossible. Unfortunately,
that's exactly the position that every CPO is in today. There is, quite
simply, a lack of tools for the job. This is where PRM technologies
will be applied. The core idea behind PRM is that the enterprise needs
a policy-based framework for data management and protection if it is to
comply with regulations, mitigate risk, support customer preferences
and build consumer trust.
There are several companies developing solutions that fit in the
Privacy Rights Management framework. These include IBM, Novell, and
Tivoli. PRM is an emerging category of enterprise software that will
help close the current gap between stated policies, customer
preferences and operational realities.
Privacy Rights Management: Software Solutions for the Global
Enterprise
The proliferation of data systems in both the public and private
sectors that handle sensitive personal information such as health/
medical records, financial/credit records, and location-based profiles
demand that proper controls be put in place to ensure this data does
not fall into the wrong hands and is not subject to misuse. It is of
great value for a business to have these controls in place in order to
mitigate risk, reduce the cost of compliance and build consumer trust.
A comment I often hear from CPOs at major corporations is that they
have no idea what personal information assets are present at their
company, who has access to them and how the data is being used. As a
case study, imagine a global corporation with operations in disparate
countries and several divisions. As an incoming CPO you will need to
first discover all of the personal information present throughout the
organization. You will need to know who controls each repository of
personal information, which people are allowed to access what
information and in what cases this information is combined with other
data resources.
Once that information is gathered you will have to assess which
regulations apply to what kinds of data. For example, a Customer
Relationship Management database located in Canada will be subject to
the recently enacted Personal Information Privacy and Electronic
Documents Act. Data held in a European country will be subject to the
EU Directive. American companies also face privacy legislation at the
local, state and federal level including the Gramm-Leach-Bliley (GLB)
Act and Health Insurance Portability and Accountability Act (HIPAA).
Combined with this global patchwork of regulations are the data and
privacy policies present in your company.
As Chief Privacy Officer your next challenge is to apply and
enforce data regulations and policies on the data and continually
monitor and assess the data flows within the organization. A CPO also
needs to grapple with issues such as providing consumers with access to
certain types of data in order to foster trust, and restricting third
party sharing of data in an environment where thousands of employees
might have access to information assets that are spread across multiple
applications. Some regulations such as HIPAA also call for businesses
to obtain consent from consumers before sharing their data. Setting up
a call center or mailing out hundreds of thousands of notices can be a
costly exercise compared to having tools that can automate this
procedure.
Zero-Knowledge Systems' Privacy Rights Management Suite is an
enterprise software solution designed to enable the entire range of
processes detailed above.
Our PRM Suite applies a policy-based framework to enterprise IT
infrastructures for the responsible management of personal information,
enabling business to mitigate risk, attain compliance and build
consumer trust. The various components of the Suite are designed as
tools to allow businesses to rollout their information privacy program
in an efficient and reliable manner, and include:
Discovery and inventory of personal information resources
Definition and articulation of privacy policies in an
application-readable form
Policy implementation at the application and data store level
System monitoring of personal information handling practices
Enforcement of information privacy requirements
Audit and assurance of information privacy practices
The Zero-Knowledge PRM Console, the first component of our PRM
Suite to be released in Q4 of this year, enables the end-to-end
management of information privacy within an enterprise. Information
security and privacy officers can discover, inventory, and classify
personal information (PI) assets while applying relevant global data
regulations and corporate privacy policy. The Console works with
existing IT resources such as customer and employee databases, Web
servers, enterprise applications and access control solutions.
PRM Console features include:
Discovery and Inventory module: Enables and centralizes the
identification, classification and management of personal
information throughout the enterprise
Modeling module: Supports compliance efforts by enabling the
application of rules based on regulation or corporate policy,
and customer preferences to personal information
Reporting module: Ensures privacy or security officers have
the reports needed to facilitate management, auditing and
verification
Underlying PRM is Privacy Rights Markup Language (PRML), a language
specification designed to capture the complex relationship between
business operations and personal information. PRML formalizes privacy
policies and operational procedures across enterprise applications and
data stores, producing detailed reports and requirements as output.
PRML's underlying principles are based on the OECD Fair Information
Practices and support a wide range of possible privacy policies and
several forms of output, including XML and plain English. Future
releases of PRML will provide automated enforcement within the
enterprise IT infrastructure.
The goal of the PRM Suite is to define a standard of functionality
that will secure personal information by providing data protection and
security officers and CPOs with a toolkit to facilitate and reduce the
cost of regulatory compliance, while supporting business objectives,
and customer preference and choice. The PRM Suite takes advantage of a
wide range of new and evolving technologies to support legacy
enterprise applications while simplifying integration through a
component-based application model. It supports applications ranging
from traditional client-server applications delivered over corporate
intranets to outward facing web services on the Internet.
If the developments of recent data and communication technologies
are going to fulfill their promise, customers need to trust businesses
with the collection, disclosure and use of their personal information.
The Zero-Knowledge PRM Suite provides a cost effective means to
implement privacy solutions that enable global and industry-wide
compliance, which in turn fosters consumer trust, and enhances both the
value of information assets.
THE PROMISE OF PRM AND PRIVACY ENABLING TECHNOLOGIES
PRM technologies such as Zero-Knowledge's PRM Suite can be a major
force in enabling businesses to build privacy into their operations and
thus raise the bar for privacy in our society.
The Zero-Knowledge PRM suite empowers data protection and security
officers with the tools to effectively address the intensifying demand
for consumer privacy, to navigate complex global regulations, and most
of all, to institutionalize the enterprise's commitment to protecting
consumer privacy in a demonstrable manner. Specifically, the Suite
allows for
assessment and mitigation of risk across the entire
organization
simplifies compliance in a cost-effective manner
assembles a dynamic inventory of company-wide information
assets and practices
enforces policy on personal information assets
generates reports to facilitate auditing and assurance
The key to successful adoption of data protection and information
privacy technologies within the enterprise is to assure that they
support corporate objectives, do not hinder commercial activity or
burden the enterprise with demands that cannot realistically be met.
Privacy Rights Management technologies are being developed to privacy-
enable everyday business operations in a way that is manageable and
cost-effective to the organization, yet still meets the high privacy
standards of consumers.
Business objectives like personalization, marketing, and online
transaction and payments do not have to compromise consumer privacy.
Analytical research, direct marketing, and trends in ubiquitous
communications also need not be impeded by privacy objectives such as
compliance, consent, notice, opt-in, access, or use limitation.
Building trust with consumers, managing data security risks, and
implementing sufficient safeguards can be achieved by aligning business
and privacy into a single, coherent, strategy that combines effective
policies and Privacy Rights Management technologies.
STANDING AT THE CROSSROADS
As both an entrepreneur and privacy advocate I believe we are at a
critical junction for privacy. We are currently experiencing the
largest explosion of information in history. The new networks and
devices being deployed will make personal information available
anywhere, anytime. The overwhelming majority of this information being
created and spread over a plethora of devices and networks will be
personal information--and it will primarily reside with businesses and
organizations, rather than with individuals themselves.
The information and networking explosion affects every individual,
organization and business. Whether the net effect will be positive for
information privacy or negative will depend on the policies we adopt,
and the availability of technologies to enforce those policies.
I believe the combination of consumer privacy protection tools and
Privacy Rights Management technologies within the enterprise provide an
immediate and fundamental framework for addressing privacy in the
information society. The combination of these privacy-enabling
technologies with strong privacy and data handling policies is a
powerful and effective approach.
In conclusion I want to articulate that over the past four years I
have been encouraged by the positive steps industry leaders and policy-
makers such as yourselves have taken. As a society, we have a critical
challenge and opportunity in front of us, and I hope we can continue to
work together to ensure information privacy and business can flourish
together.
Again, I thank the Subcommittee for the opportunity to participate
in today's hearing. This hearing provides a valuable opportunity to
discuss the important role that technology solutions play in addressing
both business and consumer needs with regard to privacy. Zero-Knowledge
Systems looks forward to continuing to work with the Subcommittee in
its review of privacy issues.
Mr. Stearns. We have with us this morning on panel No. 1
Ms. Frances Schlosstein, VP, Business Development and
Marketing, Webwasher, New York City; Mr. John Schwarz, CEO of
Reciprocal of New York City; Mr. Michael Wallent, Product Unit
Manager, Internet Explorer, Microsoft Corporation; and, last,
Mr. Stephen Hsu, Co-founder, Chairman, and CEO of SafeWeb,
Incorporated, Oakland, California.
We are delighted that you are here, and we look forward to
your opening statement. And we will start with you, Ms.
Schlosstein. Oh, we are going to start with Mr. Wallent, sorry,
with the demonstration. Go ahead.
STATEMENTS OF MICHAEL WALLENT, PRODUCT UNIT MANAGER, INTERNET
EXPLORER, MICROSOFT CORPORATION; FRANCES SCHLOSSTEIN, VICE
PRESIDENT, BUSINESS DEVELOPMENT AND MARKETING, WEBWASHER;
STEPHEN HSU, CO-FOUNDER, CHAIRMAN AND CEO, SAFEWEB, INC.; AND
JOHN SCHWARZ, CEO, RECIPROCAL
Mr. Wallent. I just want to ensure that the monitors are on
before we--sorry for the delay, sir. Could we get a little bit
more light, actually, so I can see my notes? Thank you.
Turn on the monitors. It should be on. Did it get
unplugged? Okay. Okay. It is great working for technology
companies.
Chairman Stearns----
Mr. Stearns. Mr. Wallent, just pull the microphone just a
little bit more closer to you. That would be helpful.
Mr. Wallent. Certainly.
Mr. Stearns. Yes, okay. Great. Okay.
Mr. Wallent. Chairman Stearns, ranking member Towns,
members of this committee, thank you very much for the
opportunity to testify here today. My name is Michael Wallent,
and I run the Internet Explorer team at Microsoft Corporation
in Redmond, Washington.
We are currently working on Internet Explorer version 6,
the next version of our popular browsing technology, which we
had planned to release with Windows XP on October 25 of this
year.
What I am going to show you today is a tool that gives
consumers on a broad scale greater control over their online
information than they have ever had before. One of the most
frequent issues that we hear are concerns about online
profiling or online tracking, issues that many of the members
here today raised in their statements.
This is the practice of collecting a history of a user's
actions as they work across the web or across a series of
sites. Once this information is combined with what is called
``personally identifiable information,`` such as a name, an
address, or a phone number, specific advertising or other
services can be targeted directly to that consumer.
Most of this tracking is done from a technological sense
through the use of a technology called cookies. Cookies are
simply small pieces of information that the website leaves on
the user's computer for later access. It is important to note
that cookies are neither good nor bad. Without cookies, the web
as we know it would simply not work.
There would be no customization, an important part of a
consumer's web surfing experience. E-commerce would be
accessibly difficult, and the economics of the web would be
radically different. Before we get into details about cookie
management, the topic I am going to talk about today, let me
define a couple of terms.
First of all, you will hear a lot about what are called
first party cookies. A first party cookie is simply a cookie
that comes from the website that the consumer knows that they
are visiting. I go to MSN. MSN serves me a cookie. It is a
first party cookie.
The other concept you will hear is what is called a third
party cookie. A third party cookie comes from some content on
the page that the consumer may not know about. A very common
example of this was seen with the online advertisers, such as
Doubleclick, Avenue A, or Engage, many of which the services
that even Microsoft uses today.
When a consumer goes to a website that has this online
advertising, if that online advertiser serves a cookie, that is
what we call a third party cookie. Third party cookies were, in
fact, implicated in many of the online tracking issues that
consumers brought to us. However, I will also note that third
party cookies do have some very consumer beneficial features
and some are very benign, and also, as I said, beneficial for
those consumers.
Last summer we made a first attempt at providing some
advanced cookie management for our customers. What we thought
was is that whenever a consumer encountered one of these third
party cookies that were at times implicated in online tracking
we would simply ask the consumer, ``Consumer: Would you like to
accept this cookie or block this cookie?'' When confronted with
this choice, though, consumers didn't really have enough
information to make that choice, and it was a confusing
question. We didn't have the capabilities at that time to give
consumers the information and the data they needed to answer
that question. So they simply turned the feature off.
At the same time, and for quite some time now, we have been
working with the World Wide Web Consortium or W3C on a standard
called P3P, which, again, many of you mentioned here today. The
goal of P3P is to provide a common language for a site to
describe its data practices, such as what data it collects, who
that data is given to, what the use of that data collection is.
It turned out that it was just this type of information
that consumers needed to use to make better decisions about
cookies. What we have now done in Internet Explorer 6's
integrated P3P technology is provide a precisely controllable,
non-intrusive model that gives consumers very easy-to-use
cookie controls.
One of the important issues that we faced, though, was how
to provide a heightened level of protection, what we call out
of the box, by default, so people would be protected without
any intervention on their behalf.
What we have come to, then, for this default or out of the
box setting is that in order for these third party cookies to
be used they must indicate--the company that provides the third
party cookie must have a P3P compliant privacy policy. And if
that privacy policy indicates that that site is reusing the
consumer's personally identifiable information, they must allow
the consumer to either opt in or opt out of that data practice,
or, even with a privacy policy, that cookie is, in fact,
blocked.
Let me show you how this works. We have some screen shots
that we took very recently that we will show you here today. It
is a little bit quicker than an online presentation.
So the first time a consumer connects to a website whose
privacy practices do not match the consumer's settings,
whatever they might be in Internet Explorer 6, this small
window appears. The goal of this window is to educate the
consumer about this new red-eye privacy icon that we see down
in the bottom right corner of the screen. I don't know if the
members can see that. There is an arrow, and I will point it
out to you. We will blow it up.
See this little red stop with the ``I.'' This is the new
red-eye privacy icon. Whenever it disappears on a website, it
indicates to the consumer that there is a fundamental mismatch
between the privacy policy of the website and the consumer's
current privacy preferences.
The other thing I would like to call out here is that the
privacy defaults that Microsoft created are by no means the
only choices that a consumer has. Here we see a dialog that
actually gives consumers control over what their privacy
settings are. By default here, we see that the setting is on
medium, which has the behavior that I described to you earlier,
which requires privacy policies and requires opt-out for any
personal information reuse.
We have heard a lot of comments and feedback about opt-in
privacy, and we felt it was very important to allow consumers a
very easy mechanism for them to choose to move to an opt-in
model. With this slider, if the user clicks up two notches,
they go to high privacy. High privacy requires privacy policies
across the board for all websites at all times.
And further than that, it requires that if there is any
personal information reuse that the user has expressly opted in
to that data reuse.
I would like to also point out that we also have a setting
that we call accept all cookies or the lowest possible security
setting, and this, in fact, is the status quo on the web with
browsers today. Now, I would like to just show an example of
what a consumer might encounter as they browse through the web
at a later time.
I shot an example here, sir, of The Wall Street Journal.
The Wall Street Journal I know is using advertising from
Doubleclick. And Doubleclick, while we are working with them
actively to deploy P3P-compliant privacy policies, has not yet
done so.
Because The Wall Street Journal has this advertising from
Doubleclick, Doubleclick is using third party cookies, and
there is no privacy preference or privacy policy around those
cookies. Those cookies are, in fact, blocked.
So we actually see here on the bottom right-hand corner of
the screen the little red-eye privacy icon. This is something
that we expect consumers to notice over time and be able to
clearly tell when they go to a site that has a privacy policy
that matches their settings, versus a privacy policy that does
not match their setting, helping them really control their
browsing experience.
And we can also see just in detail that the consumer can
get a lot of information about what specifically was blocked on
their behalf.
So while I am not showing it here today, we have many other
features in Internet Explorer 6 that help consumers control
their privacy, such as a mechanism to easily read the P3P
policy and provide a very common format such that consumers can
compare them between site to site. We have also ways for
consumers to import custom privacy settings of their own that
might be created by experts such as folks on the panel sitting
here with me today.
We also have mechanisms that are very easy for the consumer
to use to either block or opt out of specific sites, to either
block or always allow that content.
We are actively encouraging websites to deploy these P3P-
compliant privacy policies. Based on the feedback we have
received so far, we hope and expect that many of the top 100
websites, as well as the vast majority of the online
advertisers, to deploy P3P-compliant policies by the time we
ship Internet Explorer version 6.
IE6 is not a silver bullet solution to all online privacy
issues, though. But we believe it is a significant step,
showing that technology can play a very critical role in
addressing consumers' concerns. Fundamentally, we believe that
we have done work that consumers want and it will delight them.
Thank you, and I look forward to your questions.
[The prepared statement of Michael Wallent follows:]
Prepared Statement of Michael Wallent, Product Unit Manager, Internet
Explorer, Microsoft Corporation
Chairman Stearns, Ranking Member Towns, Members of this
distinguished committee, thank you for the opportunity to testify
before you today on subjects that are very important to consumers--
Internet privacy and the tools that consumers can use to protect their
privacy. My name is Michael Wallent, and I lead the Internet Explorer
technology team at Microsoft Corporation. At Microsoft, we are not only
dedicated to protecting consumer privacy, but from an even broader
perspective, to building an online community that customers trust and
to promoting vigorous growth of online opportunities for all.
overview: the marketplace is demanding better privacy tools
Today I would like to share with you just one of the things our
company is doing around the issue of online privacy. For several years,
Microsoft has been at the forefront of promoting privacy online. We
have been developing privacy best practices and procedures under the
leadership of our Director of Corporate Privacy, Richard Purcell. We
have been actively involved in coalitions such as getnetwise.org, which
focuses on building a safer web for our children. Elsewhere in the
company, we are developing futuristic technological tools that have the
potential to ultimately transform how online privacy protection is
delivered to consumers. My division of the company, the Internet
Explorer team, is just one place where privacy protection is a part of
our basic objectives.
One of the great things about working on Internet browsing
technology in general, and Internet Explorer specifically, is that
almost everyone that I meet has used this web surfing capability in
some way. Because the web is increasingly important in people's lives,
one of the issues customers raise with us more and more is their desire
to know that their privacy is being protected when they go online. When
we receive such feedback, we attempt to the extent possible to
incorporate features that meet this demand and that give consumers
better control of their personal information. In the end, it's my job
to build software that delights our customers. Because of consumer
demand, I currently have about 25 people working on the privacy
protections in Internet Explorer.
INTERNET EXPLORER 6.0: TACKLING ONLINE TRACKING
When we talk to our customers, one of the questions they raise most
often is whether their web surfing activities can be tracked. It is an
issue that the Microsoft Internet Explorer team has been working to
address for about eighteen months now. Tracking or profiling is the
practice of collecting a profile or history of a user's actions across
a web site or series of sites. When combined with ``personally
identifiable information,'' such as name, address, phone number or
other identification, whoever collects this profile can market or
target advertising or other services specifically to a customer.
Much of the online tracking you hear about comes through the use of
``cookies,'' small benign pieces of information that a web site stores
on an individual's computer. It is important to note that cookies in
and of themselves are neither good nor bad. Without cookies, the web
wouldn't work as people expect it to. There would be no customization,
no e-commerce and the economics of the web would be called into
question. However, consumers should still be in control of this
technology.
Since most online profiling comes through the use of cookies,
Microsoft has been concentrating its privacy protection mechanisms in
Internet Explorer around cookie management features, which we have
designed to enhance notice and choice of the information practices of
the web sites that consumers use. Based on our experience with a series
of test versions of Internet Explorer and our work with the World Wide
Web Consortium's (the ``W3C's'') Privacy Working Group, we believe that
the next version of Internet Explorer--IE 6.0--will take significant
strides in protecting consumers' privacy.
One of the most challenging things about building software for tens
or even hundreds of millions of people all around the world is that it
needs to work in a way that provides the protection consumers want, but
without disrupting or slowing their web browsing experience. In some of
the earlier test versions of privacy protections in Internet Explorer,
we found that consumers were actually frustrated with tools that
popped-up questions or prompted the consumer every time a cookie might
be used for tracking purposes. It turned out to be too burdensome and
confusing for consumers to understand exactly what was going on behind
the scenes on their computers.
From the significant usability tests that Microsoft does, we know
that if you constantly pop-up privacy questions, users either disregard
them or perform whatever action is necessary to make these pop-ups go
away. Obviously, this behavior undermines the goal of protecting the
user more thoroughly. So we've been working to create a solution that
helps consumers to control cookies. And we've been especially focused
on so-called third-party cookies that can be used to track your
activities across sites--that is, cookies that come from a party other
than the site a consumer is visiting. Our tools help consumers better
understand the source and purpose of the cookie, thereby giving the
consumer more control over whether it is accepted or rejected. Our
tools also offer a default level of privacy protection that is greater
than exists on the web today, so that out of the box, users of Internet
Explorer 6.0 enjoy protections they currently do not have.
PROTECTING PRIVACY THROUGH INDUSTRY STANDARDS
Before we get deeper into the details, let us focus on the role
industry standards have played in getting us to where we are today. As
my team of engineers was examining the best path to take to control
cookies through Internet Explorer, we were simultaneously working with
the World Wide Web Consortium on a technical standard called the
``Platform for Privacy Preferences Project'' or P3P. The goal of P3P is
to provide a common language for a site to describe its data
practices--such as what data the site collects, how the site uses it,
who gets access to it, how long the data is retained, what consumers
should do if they have a privacy complaint, etc. The common language
helps web sites describe the important aspects of their information
practices according to a standardized road map.
P3P also provides a mechanism for a site to provide a machine-
readable version of its data practices. The grand vision of P3P is that
once sites code their privacy policies according to the standard, and
consumers have P3P tools in their hands, consumers can automatically
match their individual privacy preferences against the practices of the
web sites they are visiting. If the web site satisfies the consumer's
preferences, the consumer enters the web site without incident. If the
site does not match the individual's personal setting, the consumer at
least is warned of that fact before proceeding.
In Internet Explorer 6.0, we take a significant first step in
promoting adoption of the industry's P3P standard by both web sites and
consumers. By providing a default level of protection out of the box,
we are creating incentives for web sites--and especially those that use
cookies in a third-party fashion--to code their privacy policies in the
P3P language. These incentives will exist because we anticipate that
millions of web surfers will choose to upgrade to IE 6.0 in the near
term and will automatically get the protections IE 6.0 offers.
USING P3P IN INTERNET EXPLORER 6.0
Again, based on our earlier research, consumers want to be able to
automatically control the use of cookies based on the data practices of
the site sending the cookie. The use of P3P technology to help solve
this online tracking problem is a natural fit.
How will this work? You can actually test these tools now by
downloading the public beta version of IE 6.0 at www.microsoft.com/
windows/ie. But to go through them quickly, here is an overview. By
default, in order for third-party cookies to be set to a consumer's
computer, a third party that collects personally identifiable
information must indicate, via a P3P-compliant mechanism, that the site
offers ``Notice'' and ``Choice.'' By notice, we mean that the site
provides the consumer a machine-readable privacy policy in P3P format,
which clearly states the information collection practices of that
party. If there is no notice, third-party cookies from this site are
blocked automatically by IE 6.0.
By choice, we mean that if a web site is reusing a consumer's
personally identifiable information, then it must allow the consumer to
``opt out'' of or ``opt in'' to that data reuse. If personal
information is being reused, and consumers don't have choice around
that use, then the cookies from that third-party web site are blocked.
This approach tracks the arrangement established last summer between
the Federal Trade Commission and prominent web advertisers. The core of
that arrangement is that a company that tracks users across sites, at a
minimum, must provide notice of that practice and the choice of opting
out of it.
To help consumers understand the concepts of notice and choice, the
first time a consumer connects to a web site whose privacy practices do
not match the default setting in Internet Explorer 6.0, an
informational dialog-box appears. This box attempts to educate the
consumer about a new ``red eye'' privacy icon that appears at the
bottom of the browser window and what this icon means in light of the
user's privacy settings. Then, with Internet Explorer 6.0, as users
browse other sites that attempt to set cookies but do not meet their
privacy settings, the red-eye will reappear, alerting the consumer to
potential privacy issues.
While we have taken care to establish what we believe is a workable
default setting, we've provided a sliding-scale feature that allows
consumers to easily change their privacy settings. With a single click,
consumers can change the default setting to higher privacy settings,
which have more stringent requirements for the use of privacy policies,
or to lower settings, which are less stringent. For example, the
``high'' setting requires all web sites, both first and third-party, to
obtain explicit (opt-in) consent before the reuse of personal
information. We additionally have a feature that allows almost infinite
customizability of the privacy settings, and we have an ``import''
function that allows the consumer to download a third party's privacy
settings (which, for example, may have default settings different from
IE 6.0) and insert them into the browsing technology.
This is just an overview of our technology's features. We are happy
to visit with any congressional office to review the tools in greater
detail.
OUR OTHER EFFORTS TO PROMOTE P3P ADOPTION
I also want to mention the fact that, in the run-up to the release
of IE 6.0, we are actively encouraging web sites to deploy P3P-
compliant privacy policies. Through our ongoing work with the top 100
sites on the web, and with the work that the Internet standards body is
doing, by the time that Internet Explorer 6.0 launches this fall, we
hope to see significant deployment. We've also developed what we call a
``Privacy Statement Wizard,'' an automated privacy statement generator
that can help smaller sites become P3P-compliant by creating policies
simply based on the site's answers to a series of questions about its
practices (subject, of course, to legal review by the site's lawyer).
The statement generator is currently available at http://microsoft.com/
privacy/wizard. It also will soon be available at Microsoft's small
business web portal, at http://privacy.bcentral.com.
PUTTING IE 6.0 IN PERSPECTIVE
Since P3P is an open standard, not controlled by Microsoft in any
way, we believe that other companies will develop additional privacy-
enhancing technologies that will also interact in an automated fashion
with sites that have posted P3P-compliant privacy policies. In fact,
we've already seen the emergence of tools that provide analysis of P3P
policies, as well as search engines that only return hits from sites
that follow P3P guidelines. Over the long run, we hope to see
widespread adoption of P3P by the web community, as well as increasing
consumer understanding of the power that P3P tools put in their hands
to enhance--and customize--their privacy protection. We believe
strongly that P3P is an empowering technology and that it can address
in a simpler way the complex questions around consumer preferences and
the articulation of sites' privacy policies.
We do not believe that the work we've done in IE 6.0 to enhance
consumer privacy is a silver-bullet solution, but we do believe it is a
significant positive step--showing that technology can play a critical
role in addressing consumers' online privacy concerns. We believe we
have done work that consumers want and that will delight them. We also
believe that allowing individuals to control their own personal
information is an important, enduring mission for Microsoft. It is an
ongoing process, and not just a single, all-encompassing step. We take
it seriously because our customers do. Finally, we believe that these
first steps that we have taken to include serious privacy protection in
Internet Explorer will lead to positive cooperation in the industry
around this topic and will result in a better Internet and a better
economy. In the future, we at Microsoft expect to do additional work in
this area, using P3P or other technologies, and we would be happy to
keep you abreast of those efforts.
Again, thank you for allowing me to be with you today and I look
forward to a continued dialogue.
Mr. Stearns. I thank you.
Ms. Schlosstein, we will start with you, then.
Ms. Schlosstein. Thank you.
Mr. Stearns. I think we are going to take a few moments
here to reestablish the connection, so that the projector can
provide the audience a little bit of view of what we are doing
here, if that is possible, so that they also would enjoy what
we see up here as members.
We are hoping in the near future--I know the Financial
Services Committee has retrofitted their committee hearing room
to do video teleconferencing. And so in this case, Mr. Austin
Hill of Montreal, Canada, could be with us today, if we had had
that capability.
And, likewise, we hope to have a projector screen here with
us that will all be in place, and we would not have to
continually have setups. We just move and plug it in, and we
will have that capability, we are assured, that will take place
in the near future. So we look forward to that.
Are you ready?
Ms. Schlosstein. I am.
Mr. Stearns. Okay. Go ahead.
STATEMENT OF FRANCES SCHLOSSTEIN
Ms. Schlosstein. Could I have just a little more light,
please?
Mr. Stearns. Just a little bit more light.
Ms. Schlosstein. Chairman Stearns, and members of the
committee, Webwasher.com, a leader in internet access
management and privacy technology, appears today not as an
advocate for or against privacy regulations, but truly as an
example of internet filtering technology.
We believe the technology does not and should not establish
policy. Technology executes policy. Those who use Webwasher
filtering software in a very real sense are already regulating
their own internet environment and establishing their own
policies of privacy.
What uniquely distinguishes Webwasher is our belief in
internet self-determination for the user. There can be no
internet privacy without the ability to control one's internet
exposure. Webwasher's technology can filter out any hidden data
object, oppose the security, privacy, band width, or legal
risks.
Today, 4 million individuals and small businesses are using
Webwasher worldwide, along with a growing number of enterprise
corporations. This morning I would like to take--to provide the
subcommittee with a brief look into Webwasher software
interface and the types of customizable results possible. And
for your convenience, I have included a copy of the
presentation slides that I will be discussing in our written
testimony.
Let us start now with an example of Webwasher in action,
providing privacy protection from unwanted cookies attached to
ads. This is Salon.com, a home page with no Webwasher filters
activated. And now the same Salon.com home page with Webwasher
filters activated for ad and cookie filtering.
As you see, the ads are eliminated at the top and side. To
assist the visuals, the same Webwash/Salon.com page with the
ads replaced by logo placeholders. This page includes nine ads
that represent 38 percent of the page's total band width. What
you don't see are the non-permission-based cookies behind the
ads which track user behavior. Fortunately, Webwasher does see
them.
Webwasher technology protects privacy and the results are
measurable. On one average desktop, we conducted a 30-day
filtering activity test. The test results--43 percent of band
width was saved by filtering out ads. What is more, 79 percent
of all cookies entering the network, nearly 5,000 cookies in
all, were non-permission-based cookies attached to the filtered
ads.
What is behind this technology? Let me show you the
Webwasher software interface. Take a look at the tabs across
the top--the standard filter, privacy filter, access control,
and security filters. You can customize each function. For
example, the privacy tab, a user can filter web bugs, cookies,
and referrer bugs.
Similarly, the security feature interface can be customized
to safeguard a corporate network. Webwasher includes a setting
for eliminating bad Java scripts, ActiveX commands, including
Trojan Horse-type viruses. This is accomplished through
Webwasher's media type and embedded object filters.
Webwasher also approaches privacy through access control.
Our access control settings deploy a dynamic, new, URL filter
data base to track, classify, and, when appropriate, block
changing visual content on millions of web pages. Webwasher
uses intelligent filtering and image recognition to generate
the most advanced web block list in the world right now.
Here you can see the filters for pornography and nudity
have been activated. To illustrate, here is the Playboy.com
page, including a pop-up ad before Webwasher is activated. Now,
with Webwasher, a user can block access to the website based on
the Playboy.com URL. This is the message generated when a user
attempts to visit a blocked site.
However, even if you did not know that Playboy was a site
that contained inappropriate images, our technology can filter
nudity, breast images, while leaving out content--leaving other
content untouched. This is an important achievement in helping
users control their privacy.
Webwasher takes a proactive approach to developing new
privacy technologies. Here is the next generation technology
that enables businesses and media to partner with consumers
more effectively. Webwasher is anticipating the day when
consumers, businesses, and media cooperate to implement a tight
filtering system.
Our seclude-it technology featured here filters advertising
according to user-determined interest profiles. For example,
this user selected entertainment and lifestyle as just one
category of ads they wish to receive. Seclude-it technology
will create a new channel from advertiser to consumer that
makes ads more targeted, effective, and welcomed.
What we have demonstrated today is the robust privacy
protection technology of Webwasher--a technology powerful and
flexible enough to execute policy, whether driven by
government, corporate, or individual users.
Mr. Chairman, thank you for inviting Webwasher to appear
and for assisting consumers, both individuals and corporations,
to become more aware of privacy technology options such as
Webwasher, already available today on the market and currently
being used by 4 million users worldwide.
Thank you.
[The prepared statement of Frances Schlosstein follows:]
Prepared Statement of Frances Schlosstein, Vice President, Business
Development and Marketing USA, WebWasher.com
INTRODUCTION
Chairman Stearns, Ranking Member Towns, and members of the
Subcommittee, thank you for the opportunity to participate in this
timely hearing and to share webwasher.com's unique perspective on the
role of technology in the Congressional information privacy debate.
As your Subcommittee continues to explore these issues in the
responsible manner that this series of hearings evidence, we firmly
believe that how Congress ultimately defines Internet privacy will
affirmatively determine Federal policy direction--as surely as
webwasher.com's definition of privacy has shaped our own technological
development strategy and core operational focus.
Over the past eighteen months, webwasher.com has directly
experienced the consumer demand for privacy--four million Internet
users in homes and schools have installed a free version of
webwasher.com's intelligent Internet filtering software. This initial
track-record, coupled with our emergence in the corporate enterprise
marketplace, demonstrates to us that available and currently deployable
technologies such as WebWasher already critically shape the privacy
policy debate, and thus must also play a role in any related
Congressional response to consumer concerns.
about webwasher and internet access management solutions
WebWasher is a state-of-the-art, all-in-one software tool that
blocks virus and worm-carrying Internet files, preempts the need for
intrusive employee Web monitoring, protects children from pornography,
and filters out up to 45% of Internet clutter that typically clogs
corporate networks.
How can one program do so many different things in facilitating
consumer and corporate privacy protection? Although WebWasher is a
single, streamlined piece of software, it has a fully modular menu of
independently operating filters that each target a specific category of
Internet content. Each filter can be easily toggled on or off and
configured for individual preferences, allowing each user--corporate or
individual--to execute a highly-customized Internet privacy policy:
Our privacy filter allows the user to filter out non-
permission-based cookies, Web bugs, and the HTTP ``referrer
string.'' Almost everyone has heard of ``cookies'' that allow
third parties to track without detection a user's movements on
the Web. Even more troublesome to corporations is the
``referrer string'' usually sent from browser to Website
server, potentially allowing an outsider to backtrack to the
last browser location, which could be an internal company Web
page.
Our access control setting deploys a dynamic, new URL filter
database to track, classify and, when appropriate, block
changing visual content on millions of Web pages. This
database--``DynaBLocator TM''--is being built with
the help of an exclusive, new image recognition technology that
can keep up with the thousands of porn sites and images that
are dynamically generated every day, without stable URL
addresses. WebWasher is using image recognition combined with a
dozen text-based rating systems to generate the most advanced
Web page blocklist in the world.
Our advertising filter includes a setting for eliminating
malicious (ill-intentioned) Java scripts, as well as Java
scripts designed to lock advertising into a Web page such that
the page will collapse if the advertising is removed. Bad
``ActiveX'' commands that could allow an intruder to read,
delete, or commingle company files can also be filtered.
Our advertising filter also includes dimension and pop-up
settings that remove--at the user's command--unwanted banner
and pop-up ads. Internet advertising becomes a serious business
issue when 35% to 45% of every page downloaded onto a corporate
network is not relevant for immediate core business needs.
Our ``Seclude-It TM'' technology filters
advertising according to a personal interest profile designed
and stored on the user's computer, creating a whole new channel
from advertiser to consumer that makes ads more valuable and
sticky. Advertisers must partner and meta-tag their content so
it can be read by the Seclude-It filter.
DEFINING PRIVACY AND BALANCING THE REGULATORY IMPULSE: USER SELF-
DETERMINATION AND INDIVIDUALIZED CONTROL
What distinguishes WebWasher--and what is truly unique about our
company--is that we equate Internet privacy with nothing less than
Internet user self-determination. This commitment to self-determination
for all Internet users--individual and corporate, public and private--
has from day one driven how we run our company and how we build our
tools.
Individualized user control is the reason why we developed, as our
technology platform, an Internet filtering software solution. If you
want to put the Internet's ``controls'' into the hands of its users--if
you want to establish choice as a primary value in the Internet data
transaction--then, we believe, you must create a broad technology for
filtering many categories of Internet data that is customizable to the
varying needs of users. Acting accordingly, we created and deployed
WebWasher.
Fundamentally, webwasher.com believes there can be no Internet
privacy without the ability to control one's Internet exposure. This
exposure is two-way because data simultaneously enters and exits a
user's computer. Only Webwasher, in a single software tool, addresses
the two-way need for consumers to control both what information is
distributed about them over the Web as well as what information enters
from the Web into the private realm of the workplace, home, or school.
The benefits of webwasher.com's two-way, intelligent filtering
solution are particularly obvious when compared to unidirectional
privacy technologies like encryption and hosted (anonymous) surfing
that are stuck in the one-way mode. WebWasher is the only leading
Internet filtering software that does not compromise its own users'
privacy by routing their Internet transmissions back through our own
company's server.
Privacy is the security of being able to set one's own course, and
most fundamentally, to protect oneself from perceived costs and risks.
Whether you are a home Web surfer, an education professional, or a
corporate IT manager for a Fortune 100 company, webwasher.com provides
a technology that empowers users to operate in a zone of privacy,
safety, and choice.
WEBWASHER IN THE ENTERPRISE: MEETING BUSINESS PRIVACY NEEDS
In many respects, the negatives of raw and unfiltered Internet
exposure are nowhere so great as in corporations, where thousands of
employees have unlimited desktop Internet access for many hours each
day. Many companies--whether they are global financial leaders or
multinational manufacturers--provide unlimited Internet access to their
employees.
IDC has estimated that each employee with unlimited Internet access
spends approximately one hour per day viewing non-work-related Internet
content, at an annual cost in productivity of $9,600 per employee.
Beyond this downtime, it only takes a few employees downloading music
or streaming video to bog down an entire network, just as it takes only
one employee viewing porn or hate content or downloading viral files in
the workplace to put the organization at serious technological or legal
risk.
As a spin-off of Siemens Corporation and as a leading global
developer of Internet access management software, webwasher.com has
worked very hard to understand and be responsive toward the many
categories of Internet data that pose security, privacy, or legal risks
for the enterprise user, and to assist in meeting their corporate risk
management needs through deployment of WebWasher.
Corporations are only now beginning to pre-emptively address the
privacy, security and cost implications of employee Internet access
through a new category of software exemplified by WebWasher Enterprise
Edition. According to a recent study by market analysts Frost &
Sullivan, the Internet access control and filtering software market
segment, while only a $68 million sector in 1999, is expected to
approach $1 billion in revenue potential by 2007.''
As a direct result of our own origin and development in the Siemens
corporate environment, WebWasher is especially suited for large
business users and particularly suited to respond to corporate demands
that mirror what our 4 million consumer users have already told us.
The corporate user's WebWasher software application has a full menu
of independently operating filters that each target a specific category
of Internet content: one filter uses a database to block long lists of
objectionable Websites and Web pages; other individual filters reach
deep into the Web page to remove invisible data ``objects'' like Web
bugs; and still another filter enables a block list for media-type
files such as ``.exe'' that often carry worms and viruses.
WebWasher's access control filter, powered by dynamic image
recognition technology, may prove so effective at managing employee
Internet use that it removes the need to monitor employee Internet use.
It promises a solution that is every bit as powerful as employee Web
monitoring, but much better at balancing the corporation's need to be
an Internet gatekeeper with demands for employee privacy. This same
tool could save corporations the cost of collecting and storing
voluminous amounts of data on employee Web surfing habits by allowing
companies to pre-emptively manage employee access to all relevant
categories of Internet content.
INTERNET ACCESS MANAGEMENT SOLUTIONS AND NEXT STEPS IN THE PRIVACY
DEBATE
While today's Internet is an amazing instrument of the Information
Economy, there is a toll for travelers on this information superhighway
and marketplace. With each click of a mouse, along with the information
a user has requested, kilobytes of data are transmitted automatically
without either the user's knowledge or consent. Most unseen data is
enabling to the information transaction. However, a limitless array of
behind-the-scenes channels open wide avenues for data operations
designed and controlled by third parties of which the user may never be
aware. In other cases, a user's self-determination and individualized
control may be compromised by the persistence, copiousness, or mere
offensiveness of unmanaged Internet content.
For all these reasons, an intelligent Internet access management
tool that can be easily customized and upgraded by the user seems the
obvious technological solution-- though not a simple one--as the
Internet dynamically expands and continually evolves new categories of
invasive content. Webwasher.com is committed to keeping its filtering
tool updated to address all new genres of Internet content that
significant numbers of users, for any reason, may want to filter.
Successful technologies like ours do not establish policy. In fact,
we pride ourselves on having developed and introduced an apositional
product that meets various users' needs. Again our definition of
privacy--user self-determination--has guided our product development.
Rather than be reactive to policy dialogue, our focus has been on--
merely providing real solutions responsive to growing demand. By
bringing privacy-enhancing technologies quickly to market,
webwasher.com has changed the privacy landscape and already has
impacted the conditions policymakers seek to address.
Yet, technology alone may not solve the Internet privacy dilemma.
Business and consumer users must first know what their privacy problems
are before they may act to adopt technical solutions to meet these
concerns. Achieving such awareness often proves problematic in the
Internet privacy arena since most privacy-violating data transfers over
the Internet are not ``visible'' to the consumer. We respectfully
recommend that removing this cloak of invisibility and assisting
consumers to become aware of the technological options already
available to them should be a primary focus of this Subcommittee's
agenda.
High privacy standards are often challenged as costly and limiting
to the growth and development of Web-based business. However, as an
Internet technology company that voluntarily adheres to very strict
privacy rules, webwasher.com can only report positive results in the
form of high customer retention and a sterling corporate image.
Although we do not testify today as advocates for or against
Federal privacy policy, we do see enhanced online privacy as an
essential pre-condition for the Internet's next level of development,
which will require winning the trust of those who have so far remained
skeptical of this new medium.
Mr. Chairman, allow me to thank you for the opportunity to appear
before the Subcommittee, and to close with a pledge: webwasher.com
intends to stay at the forefront of Internet technology in our
continuing mission to put the tools of Internet self-determination in
the hands of Internet users.
Webwasher.com greatly appreciates the opportunity to be of
assistance to the Subcommittee in this important review and is
available to serve as a further resource as required.
Mr. Stearns. I thank you.
Mr. Schwarz? Oh, we are going to go to Mr. Hsu. Be sure to
get that microphone right up close to you, so we can hear you.
STATEMENT OF STEPHEN HSU
Mr. Hsu. Mr. Chairman, and members of the subcommittee,
thank you for this opportunity to share my views on this
important subject. My company, SafeWeb, develops internet
privacy and security technologies for businesses and consumers.
Our core consumer product, SafeWeb.com, lets internet users
surf the web anonymously and securely. SafeWeb's technology
lets users access the entire web through a layer of encryption.
All of the information coming in and out of their computer is
fully encrypted, and dangerous codes such as cookies and web
bugs ares filtered.
Our servers act as a virtual intermediary and communicate
directly with the SSL, or secure socket layer, engine present
in every browser, so that no software download or installation
on the part of a user is necessary.
Because our solution is free, effective, and easy to use,
it has quickly grown to become one of the most widely used
online privacy services in the world. We currently secure 100
million web pages each month. We are currently licensing this
technology to businesses and governmental agencies that place
the utmost importance on security.
The United States Central Intelligence Agency is one of our
investors and has licensed our technology for internal use. The
ideas for our technology originated when I was an assistant
professor of physics at Yale University and was forced to deal
with numerous hacker intrusions on our department network.
A key insight that I had was that the Clinton
administration's relaxation of export controls on encryption,
combined with the requirements of secure e-commerce, would
guarantee a nearly 100 percent installed base of strong
encryption capability in every browser on every desktop.
Although you might not be aware of it, the web browser on
your computer has the capability of performing encryption that
is believed to be unbreakable even by the National Security
Agency or the Central Intelligence Agency. We set out to write
software that would make use of this widespread encryption
capability.
On a global level, SafeWeb is committed to fighting against
censorship and for freedom of information. Each day tens of
thousands of individuals in closed societies like China and
Iran use SafeWeb to access otherwise blocked contents, such as
the BBC, New York Times, and Voice of America websites.
They also use SafeWeb to anonymously express possibly
forbidden political views in chat rooms and on discussion
boards. Our foreign users can be confident that their
activities can neither be tracked, nor monitored, during a
SafeWeb session. We at SafeWeb share a strong belief in the
power of technology to transform closed societies.
It would be convenient to claim that technology alone can
solve the problem of digital privacy. However, I think this is
terribly optimistic. Tools such as ours tend to be adopted by
sophisticated technologically literate people and less so by
the average internet user. According to one survey, only 9
percent of online users have used encryption to scramble their
e-mail, and a mere 5 percent have taken advantage of anonymous
browsing.
Americans should not have to become experts on cookies, web
bugs, and relationship data bases in order to preserve their
privacy. It is my opinion that the protection of consumer
privacy requires both legal and technological action. I hope
that legislators will recognize the current trends and pass
laws that will protect the rights of individuals in this
burgeoning information age.
And now I would actually like to attempt something which is
a little bit tricky, which is a live demonstration. So this
laptop is the property of the U.S. Government, and I have not
installed any software on it. I am running Mr. Wallent's IE,
probably version 5, browser here.
And what you see here is what you would see if you just
typed in SafeWeb.com into the browser. It would connect to our
servers which are located on the internet, and they would allow
you to visit any website that you choose to view. For example,
here I think I have Yahoo's site. If you choose to go to
another site, you can type in--here I have typed in
AltaVista.com.
And what is actually happening now is that this computer is
contacting our servers and requesting that page, so you are
actually receiving AltaVista.com not through the normal means
but through our servers. And if you look carefully, you can see
this little lock icon, which means that you are viewing all of
this information through a layer of encryption.
Normally, you will only see that lock icon when you are
about to give your credit card number to an e-commerce site.
But if you use SafeWeb, all of the traffic coming in and out of
your computer is encrypted with 128-bit encryption--encryption
powerful enough that even intelligence agencies can't break it.
Here I have an icon of a cookie, which when clicked will
show you--this cookie will appear on the interface when a third
party tries to place a tracking cookie on you. And so here it
has intercepted one that would have come from AltaVista had it
not been blocked. So if I click on that, you can see that the
origin of the cookie was a server called ad.doubleclick.net.
Once that cookie is on your computer, Doubleclick can track
you from site to site and track all of your viewing habits. But
we have actually blocked that cookie as it passed through our
server.
We also offer various levels of configuration similar to
what Mr. Wallent talked about for his IE version 6, but
currently available already from SafeWeb, which allow you to
choose your level of sanitation of Java applets, plug-ins, and
different levels of cookie settings.
So I would like to thank the committee for this opportunity
to say a few things about SafeWeb. Thanks.
[The prepared statement of Stephen Hsu follows:]
Prepared Statement of Stephen D.H. Hsu, CEO and Co-founder, SafeWeb,
Inc.
Mr. Chairman and members of the Subcommittee: Thank you for this
opportunity to share my views on this important subject. SafeWeb
develops Internet privacy and security technologies for businesses and
consumers. Our core consumer product, www.safeweb.com, lets Internet
users surf the Web anonymously so that no one can pry into their online
communications.
SafeWeb's technology lets users access the entire Web through a
layer of encryption. All of the information coming in and out of their
computers is fully encrypted, and dangerous code such as cookies and
Web bugs is filtered. Our servers communicate directly with the SSL
(Secure Socket Layer) engine present in every browser so that no
software download or installation is necessary.
Because our solution is free, effective and easy to use, it has
quickly grown to become the most widely used online privacy service in
the world. We currently secure over 100 million Web pages each month
through www.safeweb.com. We are also licensing this technology to
businesses and governmental agencies that place the utmost importance
on security and require the strongest technology available to meet
their stringent requirements.
Before discussing the topic of privacy, let's begin with a broad
view of what is happening in information technology. You may be
familiar with Moore's Law, originally formulated by Gordon Moore, one
of the co-founders of Intel. Moore observed that the computing power of
microchips doubles roughly every 1.5 years. It is no surprise that
today's laptop is far superior to the supercomputer of 10 years ago. A
similar trend is occurring in the areas of data storage and data
transmission: the cost of storing data is cut in half each year and the
capacity to transmit data is doubling each year. With these factors in
play, the end result is exponential growth in our ability to store,
transmit and analyze information.
What does this mean for privacy? It means that technology will
inevitably make it easier for governments and corporations to invade
the privacy of individual citizens.
Consider the following example. Currently, someone with access to
my credit card records could gain a fairly accurate picture of my
eating, shopping and leisure habits. Perhaps two-thirds of all of my
personal purchases are made on this credit card. Imagine the situation
five years from now, when digital cash and smart cards are ubiquitous
and nearly 100 percent of all purchases are executed digitally.
Eventually, databases will be able to record not just how much money I
spend, but exactly what I purchased, as well as where and when I made
this purchase. This will apply to purchases of entertainment and food,
as well as other items. It will not be long before databases will be
capable of recording all of the phone and e-mail traffic of ordinary
individuals--not just basic data (e.g., identities of sender/caller/
recipient, time and length of communication), but the actual content of
the communications.
Why would someone be motivated to assemble such data? The answer is
simple. Most businesses, from banks to shoe stores, spend significant
amounts of money on customer acquisition. As businesses, they are
highly motivated to make this process as efficient and economical as
possible, and technology can oblige in astounding ways. Government and
law enforcement have different, but equally strong, motivations to know
more about what people are doing.
Is this a bad thing? Not necessarily. It would be foolish not to
acknowledge the advantages this future will bring both to individuals
as well as to corporations and governments. However, it is easy to see
that these massive databases, once created, will be subject to myriad
forms of abuse.
Survey after survey indicates that the overwhelming majority of
Americans is already concerned about their online privacy and desire
greater protections when they surf the Web. According to one recent
survey, Americans are more concerned about loss of privacy than health
care, crime, or taxes.1
---------------------------------------------------------------------------
\1\ Harris Interactive survey (National Consumers League), October
2000
---------------------------------------------------------------------------
On a global level, the need for online privacy and freedom of
speech is even more urgent. Despite different countries' differing
laws, we at SafeWeb believe that the right to privacy and the right of
free speech are not just rights granted to American citizens by the
United States Constitution; these are human rights that every country,
democratic or not, ought to accord their citizens. Approximately 327
million people worldwide use the Internet today, and an estimated 502
million people will be online by 2003.
As the number of Internet users steadily grows, we can expect
privacy concerns to escalate and grow increasingly volatile. The
general public has only just begun to realize the extent of the privacy
problem, and has only just begun to explore the possible privacy
solutions.
While it would be convenient to claim that technology alone can
solve these problems, to do so would be to pronounce a fallacy. There
are several companies like SafeWeb that create technologies to help
consumers protect their online privacy. However, these technological
tools tend to be used by sophisticated, technologically savvy people,
and less so by the average Internet user. According to one survey, only
nine percent of online users have used encryption to scramble their e-
mail, and a mere five percent have taken advantage of anonymous Web
browsing services.2 Americans should not have to become
experts on cookies, Web bugs or relational databases in order to
preserve their privacy.
---------------------------------------------------------------------------
\2\ The Pew Internet & American Life Report; Trust and privacy
online: Why Americans want to rewrite the rules (August 2000)
---------------------------------------------------------------------------
It is my opinion that the protection of consumer privacy requires
both legal and technological action. I hope that legislators will
recognize the current trends and pass laws that will protect the rights
of individuals in this burgeoning information age.
Thank you.
Mr. Stearns. Thank you.
Mr. Schwarz, I guess we will offer you a little bit of time
for you to set up.
Mr. Schwarz. Actually, I can fly----
Mr. Stearns. You can fly?
Mr. Schwarz. [continuing] directly.
Mr. Stearns. Wait a second. I think he has to--our staff
has to connect something here.
STATEMENT OF JOHN SCHWARZ
Mr. Schwarz. I decided that a presentation without the
slides may be more appropriate.
Mr. Chairman, Mr. Stearns, Congressman Towns, members of
the subcommittee, my name is John Schwarz. I am the President
and CEO of Reciprocal, Incorporated. I would like to thank you
for the opportunity to speak or testify before the panel.
I would like to start by saying that your committee is
focusing on issues which are extremely important not just to my
company but to our economy, to our citizens' privacy, and I
would argue to our citizens' security, and, obviously,
ultimately to my company's business.
In our view, privacy, intellectual property, and copyright
protection are all critical aspects of the same common issue.
We live in an age where the physical world such as we knew it
and continue to know it is being displaced by a digital one. In
other words, virtually everything that we know today can be
described in information and data. And once that knowledge is
available, recreating the physical is pretty easy.
Products are being converted to services. In other words,
what we used to buy as a ``one of'' thing we now today buy as a
service, as an access to something, as a way to use something.
And I would argue that national boundaries are becoming more
transparent each day as this data is being shipped across the
internet and other networks, literally without any barriers at
all.
And so in this environment I think we can argue that
securing digital assets and preventing unwanted digital
intrusion is equivalent to defending personal and potentially
national integrity. So we are talking about very important
issues.
My company, Reciprocal, provides customized business
infrastructure for the secure online delivery of digital
assets, such things as audio, video, books, documents, games,
or software. Our solution includes a defined set of features
and tools, access to prepaid transaction processing, and the
implementation resources needed to integrate the solution into
the customer's existing systems.
So we are not a producer of technology. We are a services
company that makes technology work for other people. And those
other people could be other businesses. Those people could be
the government. Those people could be private citizens.
We also offer consulting services to clients that need help
with the definition of business models or technology choices in
this digital distribution world. We run a secure online
delivery solution using our computer infrastructure.
Simply stated, our clients only need to identify the
digital assets that they wish to distribute and the channel
through which these products are to be delivered, and we do the
rest. We are arguing for a proactive management of digital
assets. These can be personal, corporate, governmental or
educational assets. But the proactive protection of those is
very important.
Just as an example, the global media market is approaching
$200 billion annually. Many of the properties are extremely
valuable. You have all seen first-run movies generating $75
million of sales in a single weekend or a best-selling book
selling 500,000 copies in a month.
In other industries, pharmaceutical clinical trials are
distributed to thousands of subjects and their doctors.
Contracts and other legal documents need to be verifiably
delivered and secured. And the access to these documents and
these media assets needs to be appropriately managed.
Virtually all media information today is produced in a
digital format. In fact, it is almost a definitive statement.
This means that it is copyable with perfect fidelity. Software
and hardware that enable the reproduction of digital assets is
now a standard feature on most computers.
Vast amounts of digital assets are, thus, illegally copied
and redistributed, and these digital assets include the
personal information which was described by my colleagues that
is gathered from the analysis of personal behavior as people
browse through the internet.
The market or the industry, our industry, has responded
with a large and all-too-often confusing array of solutions
developed to assist digital owners to keep what is theirs--from
a simple user ID and password, to certificates of authenticity,
to cookie management, to digital watermarking, to
fingerprinting, to encryption, and digital rights management.
The simple truth is none of these are infallible, and that
all are currently difficult to implement within what I would
call a comprehensive solution. All of these tools require
fairly substantial knowledge on the part of the people that
will be using them.
The Reciprocal role, or the role of my company, is to take
the complexity out of the decision processes and the
implementation and to provide the best flexible solution for
the problem at hand.
I would argue that our effectiveness and competitiveness as
individuals, as companies, and as a Nation is enhanced in an
environment where standards prevail, where systems can be open
because there is intellectual property protection for the
developer, where the invasion of privacy is treated as an
illegal activity, and where the authors can be assured that
their copyright has an enforceable contractual value.
And I think, by extension, we can argue that our individual
rights to privacy surpass the corporate rights to copyright and
to intellectual property.
The role of Reciprocal is to take it from there and make
sure that these solutions are available in an easy,
comprehensible, cheap, and effective way.
Thank you for listening, and I am happy to take questions.
[The prepared statement of John Schwarz follows:]
Prepared Statement of John Schwarz, President and CEO, Reciprocal Inc.
Dear Chairman Stearns, Congressman Towns, members of the sub-
committee: My name is John Schwarz. I am the President and CEO of
Reciprocal, Inc. Thank you for the opportunity to speak to you today.
Your committee is focusing on issues that are very important to our
economy, to our citizens' privacy and security, and to my company's
business. In our view, privacy, intellectual property and copyright
protection are all critical aspects of a common issue. We live in the
age where the physical world is being displaced by a digital one, where
products are being converted to services and where national boundaries
become more transparent each day. Consequently, being able to secure
digital assets and prevent unwanted digital intrusion is equivalent to
defending personal and national integrity.
Reciprocal provides customized business infrastructure for the
secure online delivery of digital assets (audio, video, books and
documents, games or software). Our solution includes a defined set of
features and tools, access to pre-paid transaction processing, and the
implementation resources needed to integrate the solution into the
customer's existing systems. In addition, we offer consulting services
to clients who need help with the definition of business models or
technology choices in the digital distribution world.
We run a secure online delivery solution using our own computer
infrastructure. Simply stated, our clients only need to identify the
digital assets they wish to distribute and the channel through which
these products are to be delivered and we do the rest.
The global media market is approaching $250B annually. Many of the
properties are extremely valuable--you have all seen a first run movie
generate $75M in sales in a single weekend, or a best selling book sell
500,000 copies in a month. In other industries, pharmaceutical clinical
trials are distributed to thousands of subjects and their doctors,
contracts and other legal documents need to be verifiably delivered and
secured.
Virtually all media today is produced in a digital format. This
means that it is copyable with perfect fidelity. Software and hardware
that enable the reproduction of digital assets is now a standard
feature on most computers. Vast amounts of digital assets are thus
illegally copied and redistributed.
The market has responded with a large and all too often confusing
array of solutions developed that assist digital asset owners to keep
what's theirs. From simple user id and password, to certificates of
authenticity, digital watermarking and fingerprinting, encryption and
digital rights management, the simple truth is that none are infallible
and all are currently difficult to implement within a comprehensive
solution.Reciprocal's role is to take the complexity out of the
decision process and implementation and to provide the best flexible
solution for the problem at hand.
Our effectiveness in enhanced in an environment where standards
prevail, where systems can be open because there is intellectual
property protection for the developer, where the invasion of privacy is
treated as an illegal activity, and where the authors can be assured
that their copyright has an enforceable contractual value.
Reciprocal can take it from there.
Once again, thank you for the opportunity to testify today and I
look forward to answering any questions members of the panel may have.
Mr. Stearns. Thank you. I will start with the questions.
Mr. Schwarz, as I understand it, you were the general
manager of the IBM plant down in Boca Raton before you started
your business.
Mr. Schwarz. That is correct.
Mr. Stearns. And so you have seen it from a more--a longer
perspective perhaps than most. In a nutshell, do you think the
U.S. Government, we as legislators, should set a standard for
internet privacy? Just yes or no, and then tell me why.
Mr. Schwarz. I would say eventually yes. Now may not be the
right time.
Mr. Stearns. So right now you, in your personal opinion,
with all of your experience at IBM, and your new company, you
do not think that we need to establish internet privacy as a
legislative body right at the moment.
Mr. Schwarz. I think as Congressman Markey had said
earlier, there has to be some sort of a minimum floor.
Mr. Stearns. Minimum floor. Okay.
Mr. Schwarz. What that is is going to be difficult to
define, and I don't think we know enough today to set that
standard.
Mr. Stearns. Well, Microsoft has worked with their new P3P,
when it is fully integrated I guess with Explorer 6--when is
that going to be released, Mr. Wallent?
Mr. Wallent. We actually have next Monday publicly
available data that has all of the functionality that I showed
you here today----
Mr. Stearns. Okay.
Mr. Wallent. [continuing] that anyone can download onto
Windows machines from Windows 98 forward. We expect to have a
final release of Internet Explorer 6 by October 25 of this
year, when we plan to launch Microsoft Windows XP.
Mr. Stearns. How many people will eventually be using this
new P3P technology?
Mr. Wallent. Well, if past history is any guide, we expect
that probably within the first 6 months of release of Internet
Explorer 6 approximately 30 percent of the people who use
Internet Explorer will be updated to the latest version. What
that means in real numbers is that we expect by mid-2002 to
have somewhere between 30 and 50 million people using Internet
Explorer 6.
Mr. Stearns. Worldwide.
Mr. Wallent. Worldwide, yes, sir.
Mr. Stearns. Okay. You noted your work with the World Wide
Web Consortium privacy working group on P3P. How important are
standards and standard-setting organizations when addressing
privacy concerns with technological solutions? And I guess the
question, like I talked to Mr. Schwarz, what role, if any,
should the government have in setting these standards?
Mr. Wallent. Certainly. With respect to the issue on
standards, the work we did with the World Wide Web Consortium
was critical, I believe, to creating a useable, worldwide
solution that will help control users' privacy. As we saw last
summer when Microsoft tried to do something that was not a
standard, but what we did only in our browsing software, it
wasn't very successful.
But yet when we pulled together the resources of the
overall internet economy and the internet community, I think we
worked to create something that will be very powerful for
consumers.
Mr. Stearns. Mr. Hsu, when you talk about SafeWeb, as I
understand it is a free service.
Mr. Hsu. Right.
Mr. Stearns. That you can go--the consumer can go on the
internet and download it and interface. How do you make money
with it?
Mr. Hsu. Actually, one correction. It doesn't require any
download.
Mr. Stearns. Okay.
Mr. Hsu. It interfaces directly with Internet Explorer or
any browser.
Mr. Stearns. So it is a seamless interface.
Mr. Hsu. Yes. The consumer service that we offer, which is
free to the consumer, actually pays for itself based on the
advertising that we run on the actual toolbar that you saw.
Mr. Stearns. What happens if somebody eliminates that
advertising that you are hoping to use to make sufficient funds
so that you can operate?
Mr. Hsu. Well, then, I think we would be in trouble. Let me
comment that I think most privacy startups are in trouble right
now. It is very difficult to monetize privacy, although there
is a widespread--if you look at opinion polls, a widespread
demand for it. It is very hard to monetize.
My company, like Austin Hill's company and all of the other
privacy companies, are probably going to get most of our
revenues from corporate clients, from security consulting, from
developing BPN-like products. And so it would be a mistake to
think that the privacy industry, technology industry, is in
good shape right now.
Mr. Stearns. Let me ask you the question I have asked Mr.
Wallent and Mr. Schwarz. Do you think at this point the U.S.
Government should set a standard in internet privacy?
Mr. Hsu. I have to agree with Mr. Schwarz that in the long
run I think it is absolutely necessary, because technologies
can only protect you to a certain extent. And in the end, your
data will be stored in data bases that you have no control
over.
Right now, I don't think it is a completely critical time.
I think that we could wait a few years and see how things
develop before we actually have to----
Mr. Stearns. Even so, the European Union has already
developed a pretty comprehensive internet privacy program. And
they argue that the opt-in or opt-out, depending upon the type
of information, whether it is medical or financial, is very
acute, and that this information should not be collected
without the person's approval.
So you don't think the citizen does have that right in the
United States to either opt-in or opt-out?
Mr. Hsu. I think that in the long run people should have
that option. However, if we delay a year or 2, it is not going
to kill anybody, because right now I think the data that is in
those data bases is not nearly as dangerous as what we are
going to see in 5 years.
Mr. Stearns. Okay. And my last question to Ms. Schlosstein.
Yours is also free to individuals but not to businesses, is
that correct?
Ms. Schlosstein. That is correct.
Mr. Stearns. And how many Americans I think have downloaded
your software?
Ms. Schlosstein. We estimate it is--approximately 50
percent of our downloads are from the United States and from
Americans, and that is 2 million of the consumers.
Mr. Stearns. And what would be your answer to the question
I have given to the other three. Should the Federal Government
set standards for internet privacy now or in the future?
Ms. Schlosstein. Well, we believe that it is inevitable.
What we stand for at Webwasher is user self-determination, that
individuals need and have the right to protect their privacy,
whether--both through the regulations and through the
technology that offers them a way to block and control their
own settings and filtering.
Mr. Stearns. All right. Thank you.
And now the ranking member, Mr. Towns?
Mr. Towns. Let me just sort of follow up along the same
line. It is said that most companies do not take privacy
seriously. Now, if most companies do not take privacy
seriously, then should we still continue to wait? Let me sort
of get a response as we move down the line, starting with you,
Mr. Hsu.
Mr. Hsu. I think companies are starting to take things more
seriously. But the problem is that once data is collected it is
very hard to tell how it will be used in the future. So that as
a company, a very well-intentioned company may collect a
tremendous amount of data, and there is no telling who will
have access to that data base in the future. So there is an
issue even though companies are taking privacy seriously.
Mr. Wallent. I believe, and I think Microsoft believes,
that given the work that we have done now in Internet Explorer
going forward, because of the position that we have in the
market, which we admit kind of carries much responsibility with
it, it also means that at times choices that we make impact
others, and I think that the choices that we have made around
Internet Explorer 6 in requiring P3P policies--if those sites
want to do user tracking.
Websites still work just fine without privacy policies, but
yet they don't get to track the users, and that user tracking
is something that really aids the economics of those sites very
greatly.
So we think that this economic incentive of the consumer
choosing a product like Internet Explorer, the sites wanting to
have information from the consumer, but the consumer being in
the driver's seat. Richard Purcell, our chief privacy officer
at Microsoft, often says that consumers tell him that they want
to use the web, not be used by the web. And I think the work we
have done in Internet Explorer starts to deliver on that
vision.
Mr. Towns. All right. Thank you very much.
Mr. Schwarz?
Mr. Schwarz. Congressman Towns, I am not sure that I would
argue that companies don't care about privacy. I think
companies care about privacy, certainly privacy related to
their own data.
They also care about privacy relative to their customers'
data. It is not clear whether companies care about data that
isn't theirs or isn't their customers', but that, in fact,
provides access to other people through that data.
I also would argue that individuals have often an interest
in transgressing privacy of other individuals' privacy. And
this is where the real crux of the matter is, because it is not
necessarily the willful behavior of companies disregarding
privacy laws or privacy rules.
It is the willful behavior of individuals that are
disregarding those rules, and that is I think where the
government needs to focus on is, how do we make sure that we
manage the intrusion into people's privacy by people with ill
intent?
Ms. Schlosstein. Webwasher responds to--believes very
strongly in the need for privacy protection and in the hands of
the user, whether it be defined as the individual, the
corporate user, or the school or government, whoever is
controlling the entrance to the network.
We believe right now we have technology--Webwasher has
technology, and we are finding that corporate infrastructures
are adopting this kind of technology for privacy and security.
And what we believe is that, with policy or without, products
such as Webwasher can, at the gateway or at the individual
desktop, be used by individuals to determine what comes in and
what comes out of their box now, and as a complement with
future policy.
Mr. Towns. All right. Thank you very much, Mr. Chairman. I
yield.
Mr. Stearns. I thank my colleague.
The gentleman from New Hampshire, Mr. Bass, is recognized.
Mr. Bass. Thank you very much, Mr. Chairman.
Ms. Schlosstein, the Webmaster filtering software----
Ms. Schlosstein. Webwasher.
Mr. Bass. I am sorry, Webwasher.
Ms. Schlosstein. I would like to, for the record, make that
correction. It is Webwasher.com.
Mr. Bass. Webwasher.com.
Ms. Schlosstein. Thank you.
Mr. Bass. Filters out all of these ads. How are the people
that are putting up these websites going to make money if
everybody starts washing out their ads?
Ms. Schlosstein. Well, one way to approach that is if you
saw the last slide that we presented, which was Webwasher's
secluded product, Webwasher takes really a pro-consumer stance
in that we have a right to decide what comes in or doesn't come
in to our networks.
And, therefore, it is not anti-advertising, but only that
we believe as the paradigm is shifting that the old paradigm of
advertising in--traditional advertising is not working on the
web, and that the future of advertising on the web is going to
be a cooperative activity between the consumer, the media, and
the businesses in the kind of activity that I demonstrated as
seclude-it, where one can select what kind of advertising
people want, when they want it, and making it really a more
profitable and more convenient and welcomed activity than it
currently is in the intrusive way.
Mr. Bass. Are there different types of advertising, though?
Is it a kind of advertising where it is just--is there any such
thing as an ad on a website that just is the ad and it doesn't
leave any information in your computer? Does that exist?
Ms. Schlosstein. Well, most ads, you know, are multi-
layered, so to speak, in that they--you will see the visual ad,
or whatever. But behind that ad it was--of the ads that we have
stripped out in that example that I gave you of Salon.com,
there were nine ads on that page. One component is it invaded
privacy. You could imply from the amount of band width or time
or space it took of the consumer's actual space.
But the other part that we didn't see were the cookies
behind that. Thirty-eight percent--I mean, 38 percent of the
band width, but 79 percent of all of the cookies that were
coming into that particular box were attached--were non-
permission-based. And so each ad that is coming in has attached
to it other--could have malicious code, could have--the pop-ups
could have cookies, could have other privacy-imposing
activities going on at the same time. And many do.
Mr. Bass. Does your service eliminate or filter out things
other than ads?
Ms. Schlosstein. Yes. The Webwasher technology takes a very
broad look at privacy, in that we look at not only advertising
or content filtering, we look at the access control. We view an
invasion of privacy, having children, for example, being
exposed to pornography inappropriately. We view privacy as
another approach or a front on privacy in a corporate
environment with malicious code, ActiveX, Trojan Horses, those
kinds of things, that could invade a corporate network and
scramble the files or whatever as another imposition on
corporate privacy and individual privacy.
And Webwasher's settings are such that you can customize
them to really address any one of those privacy concerns.
Mr. Bass. Do you or Mr.--is it Sue?
Mr. Hsu. Shoe as in tennis shoe.
Mr. Bass. You know who has your software, so you must have
a data base of users. Is that right?
Mr. Hsu. No. Actually, our product doesn't require you to
install any software on your computer. You just connect--you
point your browser at our servers. You set up that connection.
It is all encrypted, and then you just go.
Mr. Bass. Do you know that I have contacted you?
Mr. Hsu. No.
Mr. Bass. Really. How about you, Ms. Schlosstein? In other
words, do you have--if I sign up for Webwasher.com, do you know
I did?
Ms. Schlosstein. Webwasher practices what it preaches, in
that, no, we do not keep records of who downloads our----
Mr. Bass. So you can't use the information that I am using
your server----
Ms. Schlosstein. Absolutely not.
Mr. Bass. [continuing] and sell it to somebody else. It is
sort of like two mirrors. It goes----
Ms. Schlosstein. Right. Let me make a distinction here,
because I think it is very important between the two
technologies. And I think they are both valid and they are both
very important in terms of what Webwasher does and what
Webwasher is is completely controlled by the user as determined
whether it be the corporate, the individual, or whatever.
There is no outside governing body. We do not take or keep
or control any of that information, so there isn't any
possibility of a leakage of that information or a misuse of
that information, because it never leaves the control of who
that self-determined user is.
Mr. Bass. Can I interrupt you, because I am going to run
out of time.
Mr. Hsu, you made a comment at the very end of an answer to
the Chairman's question that this is nothing--I am going to
murder the quote here--that this is nothing compared to what it
is going to be like 5 years from now.
Mr. Hsu. That is absolutely true. I think----
Mr. Bass. Tell me about that. What is going to----
Mr. Hsu. Well, I think people might be familiar with
Moore's Law, which is that the power of CPUs doubles every year
and a half. Well, also the power of the band width we use to
transmit information and the cost of storing it, those things
increase by factors of two every year.
So we are on an exponential growth path. And all of those
abilities--to store data, transmit data, and analyze data--are
all useful in invading people's privacy. So we are just at the
very beginning right now. A few web entities have taken
aggressive advantage of the way browsers are written to put
these cookies on you and track you, but I think that is a very
minor thing compared to what you will see 5 years from now.
Mr. Bass. Thank you, Mr. Chairman.
Mr. Stearns. I thank you.
The gentlelady from California, Ms. Eshoo, is recognized
for----
Ms. Eshoo. I am going to pass, sir.
Mr. Stearns. All right. The gentleman from Nebraska, Mr.
Terry? Sorry, sorry, sorry. Mr. Markey from Massachusetts?
Sorry.
Mr. Markey. Thank you, Mr. Chairman.
Mr. Stearns. No problem.
Mr. Markey. First of all, let me say that I think there is
a false security privacy dichotomy which is made. In other
words, industries say that we have top-notch security, meaning
the information as it comes from your home to our company is
very secure. Once we get it, now it is a privacy policy. That
is a different thing altogether.
And now we have a right to modify the privacy. Okay? But
don't worry, it is secure. No purple-haired kid living next
door to you will be able to crack through our very top-notch
encryption.
Now, from a consumer's perspective, they see the whole
thing as privacy. They don't make this distinction. The reason
corporate America makes the distinction is they want to give
you confidence to let it go from your home to the bank or to
the hospital or to the company, but then it is a different set
of standards once it hits our company.
Now, we reserve the right to do certain things with it, and
you have got to check with us on an ongoing basis to see
whether or not your privacy is protected. Of course, the
individual doesn't quite see it that way. It is all security or
all privacy--whichever word you want to use, but it should be
the same the whole way.
So WebTV is a good example. That is a Microsoft product. So
I just pulled down here privacy policy for WebTV. So WebTV says
that when you register as a primary user of the WebTV network
service, WNI will request information that personally
identifies you or allows us to contact you. On the WebTV
network services information is your name, home address, phone
number, e-mail address, and credit card number--my credit card
number.
Now, you say back here that I have the right to opt out of
having this ever shared with anyone else. But I personally
believe you should have to get my permission. I mean, I gave
you my credit card number, but I want you to have to come to me
if you want to give it to somebody else.
Now, do you think that is unreasonable, Mr. Wallent, that
that should be a national standard? That if you are going to
take my very, very, very private credit card number, and I am
going to use it to do business with you, that you should have
to get permission from me if you are going to use it for any
other purpose. Do you think that would be an unreasonable
standard for the Congress to legislate?
Mr. Wallent. Well, just to be clear, Microsoft doesn't
oppose either privacy legislation or a specific standard per
se. But with all of this----
Mr. Markey. So you would not oppose--so Microsoft would not
oppose us applying an opt-in standard for credit card numbers.
Is that what you are saying?
Mr. Wallent. No, that is not what I am saying, sir.
Mr. Markey. Oh, I----
Mr. Wallent. What I am saying is we are not opposed to
legislation per se.
Mr. Markey. No, I understand that. But would you oppose us
applying an opt-in standard for credit card numbers that are
obtained by private sector corporate or individuals, and, then,
that they can't be retransferred for other purposes without the
explicit permission of individuals in America?
Mr. Wallent. I am certainly not a lawyer. I am a software
developer, which gives me some benefit sitting here with you.
Mr. Markey. Well, but you are American, you are a human
being. Okay. Do you think that--would you want someone taking
your credit card number and just selling it as information, or
would you want to have them have to get permission from you if
you had entrusted them with your credit card number?
Mr. Wallent. Well, I believe, sir, that information like
your credit card, there are laws today that prevent credit card
fraud. If I give Amazon.com my credit card number to buy a
book, that doesn't give them permission to charge pornography
on that credit card or some--you know, 10 other books that they
think I might like.
So I am not sure I quite understand your question, sir,
because I believe----
Mr. Markey. Right. There is a difference, though. We are
talking about a difference here. There is misuse of it, in
terms of creating credit card fraud, and then there is just my
desire to be private. I am giving it to you. I don't want you
to give it to somebody else, even if that other person isn't
going to potentially engage in fraud.
I just don't want the whole world to have my credit card
number. Do you think that that is--would that be an
unreasonable thing for us to legislate here?
Mr. Wallent. Well, sir, I think there is two separate
issues. One is Microsoft firmly believes in the concept of
notice and choice.
Mr. Markey. Well, that is what I am saying to you. So it is
no--who has the choice? Do you have to come to us and say,
``Here is your choice. If you don't give us permission, then we
can't use it. Please give us your permission.'' Or should it be
the other way around where we are going to use it, unless you
actively try to stop us.
Do you think it would be unreasonable for us to say that
you have to come to each of us and ask for our permission to
use the credit card information which you have gathered from us
for any purpose other than that which you originally contracted
from a corporation perspective to gain access to that number?
Mr. Wallent. As I said, we do fundamentally believe in the
concept of notice and choice. And I think----
Mr. Markey. But you are not answering my question. The
question is: what is the choice? Okay? Where is the burden
here? I know you are not going to answer it.
Here is why--I know you are not going to answer it, and I
know this is the answer that you had. But here is the problem--
at the back end of this thing, changes to the WebTV network
service statement of privacy. WNI may make changes to the
statement from time to time.
They will post changes to our privacy statement here, right
at the very bottom of this six-page privacy--we will post
changes here, so be sure to check that periodically to find out
if you have any more privacy that might have been changed here
tomorrow morning, even though today we gave you this. We may
also notify you of significant changes by e-mail. We may also
notify you. But we may not notify you, huh?
Well, that doesn't sound like a very strong commitment.
When I sign up, I want it to be my deal now and forever. Amen.
So, you know, it is a little bit troubling to be honest with
you. There is also another part in here that deals with video
and other information that you might gain from me. But, you
know, in the cable industry----
Mr. Stearns. The gentleman's time has expired.
Mr. Markey. Could I just--30 seconds, Mr. Chairman, and I
won't----
Mr. Stearns. By unanimous consent, so ordered.
Mr. Markey. I thank you.
In 1984, we passed the Cable Act, and in the Cable Act
every American out here, as they are flipping from station to
station, the cable industry cannot sell that information. They
can't tell anyone that you flip to that particular station at
11 at night. You know? That no one else in the family knows you
are watching at 11 at night, anyone else in the neighborhood,
or your boss. That is yours. And they have to get your explicit
permission to give out that information.
Well, a lot of the information that now, as we move 5 years
down the line, it is going to be online is the same kind of
very sensitive information. And I would like to think that
Microsoft would understand that, just as Americans, as human
beings. That the very same laws from the analog world must make
some sense, because each of us might not want everyone else
knowing that we were watching--gaining access to that
information.
And a credit card number is a good example, and the fact
that you won't give us a specific commitment here that we have
a right to protect our credit card number. Your coming to us is
a good indication of how far we have to go in this debate.
Mr. Stearns. I thank the gentleman. His time has expired.
The gentleman from Nebraska, Mr. Terry?
Mr. Terry. Thank you, Mr. Chairman.
I will actually allow you guys to talk a little bit here,
but let us follow up on the comments by Mr. Markey, because
there is different philosophies on how to help consumers with
privacy. You have all developed different types of technologies
that work.
Some of us feel that each consumer should be in control of
their own destiny here, they get to make their own decisions
instead of Congress making the decisions for them, personal
empowerment and allowing--and it seems like your technologies
allow that.
My question, though, is: what Mr. Markey is leading to, and
what begs the question from my standpoint, is these
technologies are great, they empower the consumer, but unless
you are watching a congressional hearing, which amazingly very
few people do, how do we get the word out? How do we actually
let consumers know about this? How do we educate consumers
about what is out there?
Because I would guarantee you, if you just pull 10 people
from my neighborhood together, and maybe one of them will even
know what a cookie is. So if I believe in personal empowerment
and letting consumers make their own decisions on their sliding
scale like you have developed, how do we let them do that? They
have to be educated to be able to make those type of decisions.
So where do you fit into the process? And what do you
believe should be done to educate consumers? I will let anybody
start with it. Go down the panel.
Mr. Hsu. Well, I think education is the main issue, because
I think most people don't understand what cookies are, and most
people don't understand that when they send an e-mail it is
like sending a postcard, that anyone in the middle between you
and the recipient can read it.
I deal with venture capitalists and tech reporters every
day who don't understand the privacy issues, and I don't think
the average person understands them either. So for industry to
say that people make these informed choices and punish
companies that have bad privacy policies I think is a little
optimistic, considering the privacy policy that Mr. Markey read
is very complex and most people can't understand it.
So I think that education is extremely important, but I am
not optimistic at the rate at which people will understand
these complex technologies.
Mr. Wallent. This raises the interesting issue that I tried
to bring up in my testimony, which is it comes to a question of
defaults. It is all well and fine to have controls in a product
like Internet Explorer that let people control their privacy
after the fact once they discover that that can be done.
We have tried to take a higher standard with Internet
Explorer 6 and provide good privacy defaults, requiring privacy
policies, and for reuse of personal information requiring that
consumers have the ability to opt out and providing easy ways
to let consumers dial up the bar, so it has to go to an opt-in
model.
Furthermore, besides just building our technology, I have a
team of about 15 people who spend full-time now evangelizing
P3P. Even though it is not a Microsoft technology, we
evangelize it to the top 100 websites, and also to all of the
online advertisers, to try to get them to use that technology
because we think it is the right thing for consumers.
Mr. Schwarz. I would just like to point out, in addition to
Congressman Markey's point about the cable TV law of 1984, I
would suspect that not one in a hundred people in this country
would know that, in fact, passing that information back and
forth is not allowed.
And so we are now some 16 or 17 years past that point, and
we still don't have that education in place. I am not even sure
that that education is necessary.
And so I think without some minimum floor that is, in fact,
legislated or somehow provided as a standard by the government
or by the industry, we will not make much progress in this
regard. So I would argue that--to your point on education,
education is important, but I think a minimum floor is going to
be required.
The question is going to be: what do we define as sensitive
data or data that must be protected? And how do we make that
standard happen? And I don't think we have the answer today.
Ms. Schlosstein. I agree that when Webwasher first started
out we allowed for--we actually didn't have settings, and we
requested that people actually set the settings themselves. And
the feedback that we got from our users was that they did
actually want to have default settings set, so that they
wouldn't have to deal with it on a microscopic basis. And I
think that is one of the dangers that we have with the P3P
platform and other very complex dialogs that occur.
So what Webwasher has done is we have actually just
listened to the consumer and what they want, and our default
settings are such that we have cookies--non-permission-based
advertising cookies are part of the default settings now as per
request by the consumers that have been using the product, and
then they can go in and customize it at will, whichever way
they want, if they have the knowledge and the desire to go it a
further--a higher level. So that is one way that we have
resolved that privacy initiative.
Mr. Terry. Thank you.
Mr. Stearns. The gentleman's time has expired.
The gentlelady from Colorado, Ms. DeGette, is recognized.
Ms. DeGette. Thank you, Mr. Chairman.
One thing that we are grappling with as policymakers is the
fact that increasingly states are beginning to look at privacy
issues, as well as Congress. And then you have an issue--an
international issue, of course, which many of you are dealing
with.
And so what I am wondering is how difficult it is for
companies to navigate between the divergent privacy policies of
different countries. Perhaps, Mr. Wallent, you could speak to
that for a moment.
Mr. Wallent. Certainly. So, obviously, not having a single
worldwide standard is obviously additional hurdles that
companies need to jump over. At Microsoft we are blessed with a
large number of people and good resources to help us solve
those problems.
So if you look at the work we have done on MSN, for
example, and the affiliated products there, they are able to
jump through the appropriate legislative and regulatory hoops
across the world.
Ms. DeGette. But I think you would probably agree that you
are unique in that capability.
Mr. Wallent. I absolutely would. And what I was going to
comment was is that it becomes excessively hard for smaller
companies who are just starting up or startups to kind of
follow all the right rules and understand what the laws are in
all of the different places. That is why, to some extent, I
think that technology standards such as P3P--everyone is
concerned about privacy regulation and defining the privacy
standards on a site.
P3P provides a common mechanism for a site to define their
privacy policy. Now, whether or not----
Ms. DeGette. Well, let me stop you. We only get 5 minutes--
--
Mr. Wallent. I am sorry.
Ms. DeGette. [continuing] so that is the problem. And so I
guess what I am positing, almost as a devil's advocate
position, except for I think there is some issue here, is
wouldn't there be a benefit to trying to craft one uniform
Federal law, so that at least we would have a consistent U.S.
standard? And I don't know what that standard would look like.
That is what we are grappling with.
But, you know, what we are looking at here is not just all
of the international issues, but now 50 divergent State laws.
Mr. Wallent. Right. So, as I was trying to answer for Mr.
Markey, Microsoft is not opposed to privacy legislation per se.
We believe in the concepts of notice and choice. But the devil
is in the details. What data----
Ms. DeGette. I understand that. But you think it would be a
good idea to try to craft something working on the details.
Mr. Wallent. I think that it is a challenge to decide what
data should be opt-in and what data should be opt-out, what
practices----
Ms. DeGette. I understand it is a challenge. But you think
it is a goal we should try to work together on? Yes or no.
Mr. Wallent. I think it is certainly a goal to protect
consumers' privacy. Absolutely.
Ms. DeGette. Right. Mr. Schwarz, I saw you nodding. Perhaps
you would like to comment on that.
Mr. Schwarz. I am in agreement. There is a requirement to
set a standard, to set a base, to set a minimum, but the
difficulty is going to be what data, to what extent, and I
don't know.
Ms. DeGette. Mr. Hsu, what is your view on this?
Mr. Hsu. Well, I think a uniform standard is always
preferable to a patchwork. A small company would have to do a
lot of work to try and comply with every state's varying
legislation.
Ms. DeGette. Ms. Schlosstein?
Ms. Schlosstein. I think that there is a need for a
baseline standard. But I think that beyond--above and beyond
that that the diversity in our country really demands a
diversity in policy and allows--that will allow for a diversity
in policy, and that the technology must be flexible enough in
order to reflect that diversity in policy.
Ms. DeGette. Thank you.
Something else that I am wondering about. We sit here and
we have these hearings, and we hear testimony about the cookies
and the different levels, and so on. And I must say, mainly due
to the fact that I have two young children, I feel like I am
pretty up on computer stuff. And also, I have a husband who is
active in high tech issues.
But I don't think I represent the average American
consumer, and I would bet that the average American consumer
doesn't even know about what a cookie is or that it is
happening on their computer when they order something from
Amazon.com. And all of you are shaking your heads in agreement.
I am wondering if any of you know what the level of
knowledge of consumers is of these issues, and what the
industry is doing to educate consumers about what they can do.
Perhaps we should start with you, Ms. Schlosstein.
Ms. Schlosstein. Well, I know--I would have to agree that
the knowledge level is low, and it is increasing very, very
quickly as these debates contribute to that, as conversations
in the public press about advertising cookies, and that I
believe in the last few weeks every single national and
international paper has had some sort of public article on
that.
So I believe the issue is escalating. We have found that
there is a completely growing demand for it, actually.
Ms. DeGette. Mr. Chairman, if I can ask unanimous consent
just for another additional time to allow the rest to answer
perhaps as to what efforts the industry is making for consumer
education.
Mr. Stearns. By unanimous consent, so ordered.
Ms. DeGette. Thank you.
Mr. Stearns. Go ahead. If the rest of you will answer her
question.
Mr. Schwarz. My answer would be that the level of knowledge
depends on the age of the person that you are talking to. I
would argue that kids that are in grade school, high school,
have no difficulty with most of what we talked about today.
When you get to people of our age, it is a different story.
And I don't think that we are going to change that. I think we
will have to wait for this new generation of people that are
growing up with computers as a toy to become consumers and
adults, to have the level of knowledge that is necessary to
make these informed decisions.
And so in the meanwhile, while we are dealing with
consumers that are not that educated, there is some level of
base that is necessary to protect them.
Mr. Wallent. To somewhat echo what Mr. Schwarz has said, I
think there was an interesting issue, though, where I don't
think in the technology industry it is our goal to try to
educate consumers about all of the little nitty details about
technology, about what a cookie is and what it does, and first
party and third party.
You have to have good consumer privacy and good solutions
for consumers that don't require them to understand what my job
is. It just has to work. It has to make sense for consumers and
have understandable choices for them to make. And that is
really something that we have tried to work very hard on.
Mr. Hsu. I agree with Mr. Wallent. I don't have any hope
that at any point in time 90 percent of the population will
understand what a cookie is or what a profiling data base is.
Even a kid who is very good at playing Doom may not understand
what Doubleclick is doing with their data. So I think that we
have to simply it in some way and inspire confidence in the
individual that things are being done, even though they don't
understand the technical nitty-gritty.
Ms. DeGette. Well, I guess I would just say that if people
don't know what is going on, they don't realize the need for
privacy policy. And so I think consumer education needs to
happen.
And, Mr. Chairman, I would ask if all of these witnesses
could perhaps supplement the record in writing by telling us
what their consumer education efforts are. They are never going
to understand the need to have a privacy policy if they don't
know what their risk is.
And I thank the Chair for its indulgence.
Mr. Stearns. I think what the gentlelady is alluding to the
panel is that we, as legislators, would like your input on what
we could do to educate, and what can be done on a national
scale to educate users of computers who will be let into this
camouflaged area where they think they are safe, where, in
fact, they could be detected and a lot of their privacy
revealed. So if you would do that, it would be appreciated.
The gentlelady's time is up, and the next person--there is
no one on this side. We will move to Mr. Doyle of Pennsylvania.
Mr. Doyle. Thank you, Mr. Chairman.
It has been very interesting. Mr. Markey and I were just
talking. I mean, when you think about the web and the
computers, so many of us are in kindergarten in terms of
understanding the applications. Those of us that started
dabbling in these things at a later stage of our lives, we
understand the implications of that information, but not the
applications.
Our children seem to understand the applications but don't
think about the implications of what they are doing on the web.
And how to bring everyone up to speed--I don't think we are
ever going to be able to do that. I don't think there is going
to be a way to effectively educate everybody on how to use
these tools.
I mean, most people just don't have a clue how to do any of
this, and I don't think they are aware of how the information
is being used. I think that is what is going to change this
down the road. I mean, the idea that somebody would be able to
sell a list of all of the telephone numbers you dialed in the
last month--you know, people would--they grasp that, and they
would never permit that.
What they don't grasp is how this data is floating around
the web and how people are able to track it and access it and
use it. People really don't understand that is what is going
on.
I remember a lot of us, the first time we discovered that
when you send an e-mail, and you erased it, everybody thought
it was erased. Then you found out it is still on the hard
drive, and I can bet you a lot less e-mails went out of this
place once that was discovered a few years back.
So I think, you know, as people come to understand, you
know, how this works, and as we start to progress as a Nation
in our education of the computer age, that it is inevitable
that there is going to be standards.
So maybe we are not ready just yet to figure out maybe what
that standard should be today, but we are going to figure it
out I think fairly quickly, because, as Mr. Hsu said, 3, 4, 5
years down the road, I mean, people are going to demand it once
they come to more fully understand how this information is
being used.
But I find it--the discussion fascinating. Mr. Wallent, I
am just curious. Now, you say there is sort of an incentive for
people to join into the privacy policies--you know, adopt the
privacy policies and code them in this P3P language because
otherwise the browser won't accept their cookies. Right?
Mr. Wallent. Yes, sir.
Mr. Doyle. And I am just wondering, do you see future
applications for this technology and the P3P standard, like to
extend it into other areas such as minimum encryption
standards?
Mr. Wallent. Sir, to answer your first question, sir, yes,
I do believe the P3P will be used--will be deployed onsites,
because if sites do not deploy it their advertising revenue and
some of their functionality will be blocked. With respect to
the application of P3P to other technologies like encryption,
P3P is a good generic technology to describe the data practices
of a site.
It is not exactly clear to me how that would be applied to
encryption, other than for the consumer to decide what level of
encryption that is required based on the data practices of that
site.
I just--if I could have just a moment, sir. I just wanted
to make it clear that I don't actually work for WebTV. I have
not worked on their privacy policy. Mr. Markey raises a very
legitimate concern about the credit card issue that we
absolutely will follow up with him after this to make sure that
that is addressed. We take private information very seriously
and want to make sure we address any concerns that exist on the
panel.
Mr. Doyle. I am just curious, too. What assurances are
really in place to make sure that, you know, when a website
agrees to Internet Explorer's privacy standards that they will
actually adhere to the privacy policy? I mean, in other words,
I may be secure on my side, but what stops a third party from
saying they are going to follow your internet privacy but then
just goes ahead and shares the information with someone else
anyway?
Mr. Wallent. Our analysis of that, sir, and from our
conversations with many of the State attorneys general on this
topic, is that existing consumer protection law about deceptive
trade practices would be covered. Essentially, the company is
making a legal representation as to what their business
practices are. If they say, ``No, we don't keep any of your
information,'' but yet go ahead and do it, then clearly they
are in violation of that. And the great thing is that we have
it on record as to what they said their practice was in an
unambiguous fashion.
Mr. Doyle. Yes?
Ms. Schlosstein. Could I just add to that? And I think that
is one of the issues that we are going to have to deal with
with P3P and other privacy protections that exist outside of
the user's immediate control.
And one of the things that--I mean, it could be a
complimentary function such as Webwasher or other technologies
that allow both that preference selection, but at the same
time, complimentary-wise, to be able to block or control
anything that is going out or that information that you do not
want circulated or you don't want, so that technology is
available.
Mr. Doyle. Great. Anyone else? Yes?
Mr. Schwarz. I would just like to also add that one of the
techniques that might be deployed is to work with companies
that, in fact, produce information which is sensitive
information, such as credit card, such as health data, and work
with them to make sure that the data that they produce or the
data that they control is never dealt with in an inappropriate
way.
Technology exists to protect that type of content, whether
through encryption or whether through hardware implementation.
And there may be another channel to get to the problem rather
than looking at it bottoms up through the grass-roots effort.
Mr. Doyle. Thank you.
Thank you, Mr. Chairman.
Mr. Stearns. I thank the gentleman.
The gentlelady from California, Ms. Eshoo?
Ms. Eshoo. Thank you, Mr. Chairman.
Let me ask the panel if--first of all, if any of you
advertise your technologies online.
Mr. Hsu. We have in the past.
Ms. Eshoo. You have in the past. You don't today?
Mr. Hsu. Well, actually, I can't--it is possible that we
may actually have some banners running on other people's sites
right now. So----
Ms. Eshoo. It doesn't sound like it is a full-fledged
program, though.
Mr. Hsu. No, it is not a big effort.
Mr. Wallent. Microsoft, in our advertising for Windows XP,
privacy is one of the key messages around that. We plan to
spend as much money, if not more, on Windows XP than we did on
Windows 95 for the marketing efforts and launch. So we expect
that we will be touting our privacy efforts very, very heavily,
both online and through other media.
Mr. Schwarz. Our entire business is built around protecting
assets, and so we advertise by default.
Ms. Schlosstein. Though we protect privacy, we don't
advertise our product, but we do get--we have 4 million users
just by the identified need from it. People find out about it
through----
Ms. Eshoo. It really is a curiosity question more than
anything else, because we are talking about how best to have
the consumer understand that these technologies--first of all,
that they are available, how did they find out about them, and
I think there have been several questions kind of in and around
that.
But I was curious to know how, you know, the masses find
out about this. Or is it kind of, as we say inside the Beltway
here, is it within the--kind of the geek community that we know
that this is available. So it was a curiosity question.
Do any of your technologies--the P3P, Webwasher, SafeWeb--
do they slow down the browsing speeds of the online user?
Ms. Schlosstein. I can speak for Webwasher--does not.
Ms. Eshoo. Does not.
Ms. Schlosstein. It actually speeds it up because it
blocks--it actually filters out unwanted content and makes the
actual browsing experience faster and more accessible for the
user.
Ms. Eshoo. I mean, it is obvious why I am asking the
question. If it does slow down, then people will not be so apt
to move to the technology if, in fact----
Ms. Schlosstein. Yes. I think that is one of the benefits
of having it on your box or on your server is that you actually
can control it. Whereas, if it is--if it does, you are at the
mercy of another server.
Mr. Wallent. The performance issue around P3P was one of
the critical things that Microsoft participated on the
committee to try to resolve. And, in fact----
Ms. Eshoo. We have got to get you over to the State
Department. You know, you give these answers that are--there is
an answer buried in the answer, but it is not like upfront. It
is kind of diplomatic talk.
But at any rate, I congratulate you for having refined
that.
Mr. Wallent. No, there is no performance problem with
Internet Explorer.
Ms. Eshoo. Okay.
Mr. Hsu. In our case, because we are routing your data
through an intermediary server before we encrypt it, there is a
small performance hit.
Ms. Eshoo. What kind of feedback have you gotten from
consumers and businesses about what you have? And how do you
assess that?
Ms. Schlosstein. Webwasher has a support line where we get
500 to 600 e-mails a day, and 60 percent of them are positive.
So we are getting--I mean, we are getting rave reviews, thank
yous, all the time--not only for the privacy that we are
protecting but for the convenience that we are offering and
giving them user control and self-determination online.
Ms. Eshoo. So for the time that you have had the product,
give us just a little bit more. Put a little different----
Ms. Schlosstein. Okay. Well, we have 4 million users
worldwide. We have been--Webwasher has been around for about 18
months, almost 2 years, from when it was deployed. And in that
time, we find that as--ironically, it is a public education
issue.
And as this issue becomes more--every time there is an
article in the paper, we have an enormous spike in terms of
downloads onto our site. We can't tell you who they are because
we don't know exactly. But we have an enormous spike, and we
have an--we know that as the education and interest and
awareness level rises, the demand for more privacy is going to
really be enormous.
Ms. Eshoo. So you said, what, 500----
Ms. Schlosstein. We get 500 to 600 e-mails a day.
Ms. Eshoo. A day.
Ms. Schlosstein. A day. And I----
Ms. Eshoo. And they all say, ``This is terrific''? Or do
they give you----
Ms. Schlosstein. You know, unless it is a download blip or
something like that, in terms of the technological issue, or
they are saying it doesn't--they find the new advertising size
that we need to add to our new filters, or whatever. Most of it
is around, ``You are my hero,'' the convenience, ``I am not
bothered by the downloads anymore,'' the privacy is protected.
Ms. Eshoo. So it is positive.
Ms. Schlosstein. And it is very positive.
Ms. Eshoo. I love the name of your company. I think it is
just terrific.
Ms. Schlosstein. Thank you.
Ms. Eshoo. Did you come up with it?
Ms. Schlosstein. No, I would like to take credit.
Ms. Eshoo. Yes, good. Good.
Mr. Schwarz. Since our business, in fact, is making sure
that people only get access to what they have paid for, or
should have access to, this behavior is a fundamental component
of the relationship we have with our clients.
What we find is that if the service that we provide does
not make the experience that they have with the product that
they are trying to acquire any more difficult than it had been
prior to the introduction of the service, then they are
reasonably happy. Of course, when the service becomes
intrusive, it becomes a real problem for them. So the
convenience and the ease of use is a fundamental requirement
that cannot be broached.
Ms. Eshoo. But what do they say to you, and how do you----
Mr. Schwarz. Well, they simply stop buying.
Ms. Eshoo. Do you hear from a lot of people? They are
happy? They----
Mr. Schwarz. We have done implementation for about 300
firms that distribute----
Ms. Eshoo. I see.
Mr. Schwarz. [continuing] online, and have millions of
transactions actually using that service. What we find is when
the implementation for a certain client is intrusive in a way
that the user deals with the content that they are trying to
acquire, they stop buying. It is that simple. And you can track
that almost one for one.
What they do like is once----
Ms. Eshoo. I think we are just about--the red light is on.
Microsoft is not--can't get that information yet, because you
are not out there. Mr.--yes, the next person, because I think--
the red light is on, so I don't have any more time.
Mr. Hsu. We get tremendously positive feedback, and the
most positive feedback we get is typically from people in
closed societies like Saudi Arabia or China, who can't see most
of the web and are enabled to see it by using our service.
Ms. Eshoo. But do you know what I am looking for more than
anything else? Your indulgence, Mr. Chairman, for 30 seconds
more. Is it anecdotal, or do you actually--do you collect this,
so that there is a building--there is a record-building of the
technology and the response from people?
Mr. Hsu. We store it.
Ms. Eshoo. You do.
Mr. Hsu. We have thousands of e-mails from users that are
positive, yes.
Ms. Eshoo. Okay. Thank you.
Thank you, Mr. Chairman.
Mr. Stearns. I thank the gentlelady.
Mr. Shimkus?
Mr. Shimkus. Thank you, Mr. Chairman, and I will be brief.
A simple question, kind of tied to my brief opening statement.
From the testimony--and as you can tell, I have been in and
out with other meetings. But my perception is that the market
has worked, the demand is present for a product to be offered.
These are supposedly success stories of the basic supply and
demand business model.
Briefly, tell--and, again, I apologize. This may have been
answered in some of the statements. But can you briefly just go
by--because the real debate is, how much do we intervene? What
do we do here in Washington to pass laws to protect privacy but
give people options?
Your testimony has made the compelling case that the market
is working. There is a demand. If government is to intervene
and attempt some standardization, which is--will be the
argument that is being made for public safety of personal
information--tell me the benefits and disadvantages of doing
that. And if you can just go left to right, starting with Ms.
Schlosstein.
Ms. Schlosstein. The benefits and disadvantages to policy?
Mr. Shimkus. Federal law mandating standards or standard
practices. Actually, maybe software requirements. We do that.
We do intervene so much sometimes that we actually dictate
technology. So is that good or bad?
Ms. Schlosstein. Well, the stance that Webwasher takes is
that we really support using--that we provide a technology that
allows for the execution of policies, whether they be minimal
or really excessive.
What we would suggest probably is that in the interest of
protecting consumer privacy and the right--the personal right,
user rights, that the minimum amount of regulation be imposed
by the government, and that you allow people to have the
technology to address it on their individual, corporate, or
governmental policies, so that they can be customized to
reflect the uniqueness that makes this country, which is that
we have so many different perspectives.
Mr. Shimkus. So that is a disadvantage, but you haven't
told me if there is a benefit to government intervention.
Ms. Schlosstein. Well, clearly, I mean, if you take the
case of child pornography, there is not a person in this room
that wouldn't--would say that children should not be protected
from pornography.
But at the same time, and this is the dilemma, the
conundrum, is you also wouldn't say with the--with the
education benefits that are available through the worldwide
web, that you wouldn't, at the same time, obstruct a child for
getting education through the web that is available to them,
because--and I understand there has been some trouble with like
the copyrights--that Middlesex College might be blocked from
the students doing research in colleges because sexes in
Middlesex has been blocked by a blocker.
And the technology is such, and I demonstrated a little bit
of that with our Dynablockade, or the block list function, with
now the technology that allows for image recognition and
contextual identification, so that you can read something
within the context.
So you can read skin tones and nudity within a context,
identify is it a medical site, is it an educationsite, is it a
pornography site, that the technology allows now for these
kinds of distinctions that will protect--will play on both
sides of the fence.
Mr. Shimkus. Let me get to the rest of them. But my
question stems to that. Does government intervention in
legislative language help corporate America, who is assessing
producing a product based upon demand, is our involvement
helpful, or is it harmful? Will it impede the ability for you
to do the research and development and reap the benefits of an
identified demand?
Let me go to the other members. So----
Ms. Schlosstein. Just to clarify that Webwasher is
apositional in that what we are designed to do is allow for
execution of policy that is needed.
Mr. Shimkus. Mr. Schwarz?
Mr. Schwarz. I think our view would be that you have to set
an environment within which behavior can be managed and the
markets can behave in a way that works. The point that I would
like to leave with you is that you need to move incrementally.
We don't know enough about these issues to set a standard
for all times. So you need to work within what is available and
work in a way that allows you to increment your way as the
industry has the ability to deliver or as the industry itself
learns.
There are almost 20 million people producing this
technology around the world each year. And they will be, by
definition, ahead of anything that you can think of as a
government or as a policymaking body. You need to stay in tune
and need to stay with that advancement and not to damage it in
some way.
Mr. Shimkus. Mr. Wallent?
Mr. Wallent. There are certainly critical areas that
legislation and your body can help with, especially in areas
like identity. In fact, we talked earlier about what if sites
deceive the public or tell them the wrong thing. I think the
challenge, though, is getting the technology right and making
sure that any specifications in the technology don't actually
retard progress.
Eighteen months ago I couldn't have told you the way the
P3P was going to work. It is hard to see into the future that
far and define the technology.
Mr. Shimkus. It is very hard for politicians who are not
working in engineering to make those determinations.
Mr. Hsu?
Mr. Hsu. Well, the technologies you have heard about today
can do things like protect you from cookie profiling or protect
your data by encryption. But I think the key point is that if I
make a transaction with Amazon, they know who I am, they know
where I live, they have my credit card number. It is stored in
their data base.
I cannot develop any technology that protects that data
once Amazon has it, and that is the province of legislation.
Mr. Shimkus. Thank you, Mr. Chairman. I yield back.
Mr. Stearns. Thank you.
We have completed our questions. Oh, yes. Sure.
Mr. Towns. One quick question.
Mr. Stearns. Yes, Mr. Towns?
Mr. Towns. Mr. Schwarz, you indicated in your testimony
that the technology currently used to protect intellectual
property could also be used to protect government documents and
records. Could you explain how this technology could benefit
consumers by protecting medical, financial records, and also
just personal information?
Mr. Schwarz. Absolutely, Congressman Towns. The fundamental
technology which we deploy is based on encryption. We place the
document in question into an encrypted envelope, and there is a
key assigned to that envelope, and the key is the private
property of the person that is designed or destined to be the
recipient of that document.
And so the key and the document are always in the hands of
that one individual that has been authorized to get access. And
that technology can be applied to any document, whether it is
medical information, whether it is financial information,
whether it is music, or whether it is video.
Mr. Stearns. And I thank panel No. 1 very much. I know how
valuable your time is. And we appreciate your answers, and we
look forward to continuing our discussion with you.
And now I will ask panel No. 2 to come forward. While panel
No. 2 is coming forward, I would point out to my colleagues and
to the audience that what has been alluded to by Webwasher is
what I guess they have called contextual content. But this is
really the start of artificial intelligence.
And what Mr. Hsu has mentioned, that Moore's Law has been
applying to chips, it is also applying to broad band and
storage. And so the analyzing, the storage, and all of this is
moving so rapidly that these logarithms that are going to be
created thereby where they will make decisions based upon
millions and millions shades of meaning, you will make a
contextual content decision which ultimately will be artificial
intelligence, which they will be able to determine whether to
block out something or not. And I think that alone is pretty
interesting in itself.
Now, panel No. 2 is Mr. Trevor Hughes, Director, Privacy
Compliance, Engage, Incorporated; Mr. Jerry Cerasale, Senior
Vice President, Government Affairs, Direct Marketing
Association, Incorporated; Mr. Steven J. Cole, Senior VP and
General Counsel, Corporate Secretary of the Council of Better
Business Bureaus, Incorporated; and Mr. Jerry DeVault, National
Director, Innovative Assurance Solutions, Ernst & Young. We
also have Mr. Marc Rotenberg, Executive Director, Electronic
Privacy Information Center, Washington, D.C.
What we have here is a decision as to whether to start here
with our opening statements. It is quarter after 12. I always
believe in just moving ahead, so we will just start with the
first opening statement, and we will just continue on and we
will break in about--a little after 7 or 8 minutes, and
hopefully then we will come back after lunch and--we have one
vote now, and then we have another vote in about 45 minutes to
an hour.
So we will start with the opening statements, if you folks
are all set up and you are ready with your demonstration. Is
that Okay? Okay. I can't see your name tag. Just move it to the
left. Yes. Mr. Hughes, why don't you start?
STATEMENTS OF J. TREVOR HUGHES, DIRECTOR, PRIVACY COMPLIANCE,
ENGAGE, INC.; JERRY CERASALE, SENIOR VICE PRESIDENT, GOVERNMENT
AFFAIRS, DIRECT MARKETING ASSOCIATION, INC.; STEVEN J. COLE,
SENIOR VP AND GENERAL COUNSEL, CORPORATE SECRETARY OF THE
COUNCIL OF BETTER BUSINESS BUREAUS, INC.; JERRY R. DEVAULT,
NATIONAL DIRECTOR, INNOVATIVE ASSURANCE SOLUTIONS, ERNST &
YOUNG; AND MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC
PRIVACY INFORMATION CENTER
Mr. Hughes. By all means. Mr. Chairman, members of the
committee, good----
Mr. Stearns. If you don't mind just moving it as close as
possible to you.
Mr. Hughes. Absolutely. Good afternoon. My name is Trevor
Hughes, and I am Director of Privacy at Engage. Engage is an
online media company. I am speaking today on behalf of the
Network Advertising Initiative. Engage is a member company of
the Network Advertising Initiative.
The NAI is comprised of six online advertising companies,
such as Doubleclick, Engage, Avenue A, L90, Advanced Logic, and
that is it. We, as a group, represent to our belief
approximately 90 percent of the third party ad networks online
today.
What we do is provide services to both advertisers' and
publishers' websites online. We help to get advertisements to
websites, and we help websites to monetize the advertising
inventory that they have on their sites. One of the things that
we do in this process is online preference marketing, otherwise
known as profiling.
Profiling is the practice of viewing the click stream
habits of a browser as it goes from site to site within any one
of our members' networks. We, as a group, recognize that there
are significant consumer privacy issues associated with this
practice, and, as a result, almost 2 years ago now began a
process of developing principles in conjunction with the FTC
and the DOC, the Department of Commerce, to provide standard
guidelines for our industry in regards to online preference
marketing or profiling.
Those principles were released last July, almost a year ago
now, and we are very proud of them. We have been working for a
year under those principles. The principles, at their heart,
require notice and choice. They require that our members
provide notice through the thousands of websites that we
represent, and also that we provide choice, various different
forms of choice depending on the context of the data that we
are gathering.
What I would like to talk to you today about is one of our
most recent announcements, and that is of a gateway website
that we launched just last month. This gateway website provides
a number of important things to consumers. First of all, and
perhaps most important, it provides a global opt out, a single
opt-out source, where you can go and opt out of the online
preference marketing practices of all six members.
You can see here the home page of the NAI, the Network
Advertising Initiative. And in the bottom left corner of the
screen is the opt out. That button will take you to a page that
describes the process of anonymous profiling. Anonymous
profiling is one of the categories of online preference
marketing discussed under the NAI principles. Anonymous
profiling, or non-PII as we call it, does not involve any
personally identifiable information. In other words, we don't
know who you are. We don't have your name or your address or
your phone number or your credit card number. We don't have any
identifiable information.
Rather, what we have is information about your visit to a
certain site. Now, consumers may not want to have that
information gathered. For that reason, we provide an opt out.
This opt out is on this page. And as you scroll down, you can
see each company has a description of their practices, and then
a check box where you can select the opt-out option. You can
say that you would like to opt out.
Once you have done that, you have gone through the six
companies, I have checked off two in this example here--Engage
and L90--you get a confirmation page. The confirmation page
tells you, indeed, that you have opted out. You can see green
checkmarks indicating that the opt out was successful for both
Engage and L90.
We found that this is a very powerful tool for consumers.
And in the 1 month that the NAI gateway has been up, we have
had 30,000 visits to the website, and approximately 17,000
unique opt-outs at the website.
Not only do we provide a confirmation at the time that you
opt out, but you can also come to the site at any time to
verify what types of cookies you have on your browser from NAI
member companies. The verify function on the site is very
powerful. You can see I ran it here just the other day. And
what it does is it looks at your browser and tells you what
types of cookies you have on your browser.
You can see for most of the members there is no cookie on
this browser. Doubleclick has an active cookie. And because we
have just opted out of Engage and L90, we have opt-out cookies
from both Engage and L90. The combination of the opt out, the
confirmation, and the verify functions we feel provide really
significant--really significant consumer protection around
notice and choice.
The other thing that I would like to speak to you about
just briefly is the third party enforcement program that we
have announced and also released. We have an independent audit
firm, Arthur Andersen, now known as Andersen, and Andersen
actually audits every member, or actually every member is
responsible for obtaining an audit, whether through Andersen or
another audit firm.
Andersen also manages a compliance program for us, where
consumers can go to this site, which is accessible through the
NAI site, and actually file a complaint. There is a fairly
simple process that they can go through by entering some
information about what their complaint is, the member that is
involved, and Andersen will investigate those complaints.
Andersen also fully describes the complaint process.
After an investigation, if Andersen feels that action is
warranted it has a number of options available to it. It can
expel a member from the compliance program and remove the
compliance seal that Andersen offers. It can also notify the
FTC. And through the Andersen website that we see here, it can
also provide notice that the member has been expelled from the
program.
In summary, we feel that the NAI has truly worked
diligently over the past 18 months or so to develop a series of
protections and self-regulatory standards that are meaningful
and substantive. And the combination of our global opt-out and
the enforcement program offered through Andersen we feel really
do offer significant protections for consumers online today.
[The prepared statement of J. Trevor Hughes follows:]
Prepared Statement of J. Trevor Hughes, Director of Privacy, Engage,
Inc.
Mr. Chairman and Members of the Committee, I want to thank you for
inviting me to testify. My name is Trevor Hughes, and I am the Director
of Privacy for Engage. Engage is an Internet marketing and advertising
services company that provides strategic marketing solutions to
companies both online and offline. We were founded in 1995 and
currently operate as a majority-owned operating company of CMGI.
I'm here today representing the Network Advertising Initiative, an
industry group comprised of the leading Internet advertising companies
formed to address consumer privacy concerns. The NAI companies
represent more than 90 percent of the third-party Internet advertising
industry in terms of revenue and numbers of ads served. At the request
of the Federal Trade Commission and the Department of Commerce, we
formed the NAI to develop self-regulatory principles that would govern
the practice of online preference marketing, or so-called ``profiling''
practices.
Mr. Chairman, as you know, the NAI announced its self-regulatory
principles in July of last year after months of intensive consultations
with the Federal Trade Commission and Commerce Department. The Internet
advertising industry, and more specifically, the online preference
marketing industry, needed to adopt ``rules of the road'' for its
information practices to satisfy legitimate user concerns about
privacy. For the industry to write these rules in a manner that would
gain public confidence, the NAI needed the guiding hand of public
officials. The talks between the NAI and the federal government were
tough but fair, in that the industry had to make a number of important
concessions. Ultimately, we were pleased that the NAI could develop
industry self-regulatory guidelines that are meaningful and real and
which the FTC and Clinton Administration could and did unanimously
applaud.
The NAI principles deal with the practice of Online Preference
Marketing. We define this as ``data collected over time and across web-
sites, which is used to determine or predict consumer characteristics
or preferences for use in ad delivery on the Web.'' In other words, we
try to figure out that which is the best ad to play to a consumer at a
given point in time. This benefits the consumer, because they receive
banner ads more relevant than would otherwise be the case. It also
benefits the advertiser, because their advertising dollars are spent
more effectively. Perhaps most important, this presentation of relevant
advertisements allows many Web sites to gain a better return on their
advertising space than they would in an untargeted environment.
Collectively, our job is to make the Internet a more efficient and
competitive advertising medium that will further stimulate the growth
and viability of the Internet as a source for free or reduced-price
content and services. Many web sites depend on our services to be
competitive today.
Although OPM can be, and often stays, strictly anonymous, there are
valuable consumer services that can be offered by linking OPM data to
PII in an environment where consumers are given the option to choose
whether the combination of that data takes place. The NAI principles
lay out the ground rules and safeguards for the collection and use of
Non-PII, the collection and use of PII, and the merger of PII with Non-
PII.
In summary, here are the guidelines:
For Non-PII, we require notice and choice. NAI members must
disclose their OPM practices through their web sites and through the
NAI gateway web site, and in addition, where possible, they must
contractually require their web-sites partners to disclose the
collection of Non-PII for OPM. NAI members provide mechanisms for
consumers to opt-out from the use of Non-PII for OPM through their
respective web-sites and through the NAI gateway web-site.
For PII, we require that NAI members follow the Online Privacy
Alliance (OPA) guidelines for Online Privacy Policies. These policies
require the adoption and implementation of a privacy policy, and that
notice and choice be afforded. In addition to and above the
requirements of the OPA guidelines, NAI members will not use any
sensitive personally identifiable data for OPM, that is, we have banned
the use of any personally identifiable information about sensitive
medical or financial data, sexual behavior or sexual orientation, or
social security numbers for OPM.
For the merger of non-PII with PII, we have two scenarios. The
first case is where PII is linked with previously collected Non-PII. In
this case NAI members will not, without prior affirmative consent
(``opt-in'') merge PII with previously collected Non-PII. The second
case is where PII will be merged with Non-PII for OPM purposes on a
going forward basis. In this case NAI members will provide consumers
with robust notice and choice.
The NAI principles include several examples of what would be
considered robust notice for each of these scenarios.
The NAI principles commit NAI to develop a web site where consumers
can go to ``opt-out''. We have done so and launched the site in May.
Any consumer can today visit www.networkadvertising.org and opt-out for
any or all of the NAI member ad networks. We think this is a very
useful tool for consumers, and more than 30,000 consumers visited the
site during its first week of operation.
The NAI members also have agreed to establish a third-party
enforcement program, and we have retained Arthur Andersen and have
completed that task as well. I have attached a copy of the Andersen
Compliance Program document, which describes in detail all the various
elements of this independent enforcement mechanism.
Andersen has launched a website--www.andersencompliance.com--where
consumers can go to complain about failures to comply with the NAI
Principles. If Andersen finds these complaints to be valid, Andersen
can launch an investigation of any NAI member. And if Andersen finds
that a Member refuses to comply with the Principles, then Andersen will
remove the NAI member from the program, which means that the Member may
no longer display the NAI seal. Moreover, in such an instance Andersen
will notify the Federal Trade Commission with a summary of the
complaint, its investigation and the failure of the Member to comply.
Finally, the NAI members strongly believe that industry,
government, consumer, and advertiser pressures to set and maintain high
standards for privacy will render participation in the NAI all-but-
mandatory for all network advertisers.
We believe strongly that these principles represent a reasonable
and workable self-regulatory approach that satisfies the needs of
Internet commerce and advertising while addressing appropriately user
concerns about privacy.
In conclusion and to summarize, the NAI self-regulatory principles
are designed primarily to accomplish two things: first, to force
advertisers and web-sites where ``profiling'' occurs to post notices
that are strong and clear, and second, to make it easy for users to
opt-out. Under these principles, NAI companies agree to afford
consumers with important notice disclosures and appropriate methods of
choice for participation, while at the same time one of the main
engines behind this nation's booming new economy, the Internet, can
continue its remarkable growth and improve as a provider of free and
reduced-price content.
These agreements attested to by the signatories of the NAI
Principles represent unprecedented levels of user privacy protections.
Because of the contractual reach of these NAI companies across
literally thousands of Web sites, the NAI Principles already have had a
broad impact on Web privacy. We are very proud of these two new
websites for consumers--the NAI site and the Andersen site--and we
encourage you and your staff to visit these sites and give us your
feedback, as we continue to refine the NAI program.
Mr. Chairman, on behalf of the NAI, I want to pledge that we will
continue to work with the FTC, the Commerce Department and you and
members of your staff to ensure that these self-regulatory principles
live up to their promise.
Thank you, and I look forward to any questions you may have.
Mr. Stearns. I thank Mr. Hughes.
Mr. Cerasale?
STATEMENT OF JERRY CERASALE
Mr. Cerasale. Thank you, Mr. Chairman. Jerry Cerasale, the
Senior Vice President for Government Affairs for the Direct
Marketing Association. It is an association of companies with
about 5,000 members who market goods directly to consumers and
to businesses.
Basically, that type of marketing requires trust. If you
buy something without touching it, you paid for it before you
receive it. And in the United States, it is about $1.7 trillion
in sales a year. About $1 trillion of it is business to
consumers.
The DMA tries to build that trust through education,
supporting technology, creating privacy policy generators for
online marketers, self-regulatory guidelines, ethics
procedures, etcetera. And these are all outlined in my written
testimony, which I hope will be included in the record.
I want to focus today on the DMA's privacy promise to
American consumers, and I think they are putting up a chart
which kind of explains it. Every member marketer of the DMA
marketing to consumers must agree to this promise and reconfirm
it annually, regardless of the medium, whether it is mail,
telephone, or the internet.
What does it require? It requires you to tell people if you
are sharing their information, marketing information with
others. You have to tell them.
Second, you have to give the consumers a choice to say no,
they don't want you to share it, and to honor it.
The third one is if somebody tells you, listen, I am a
customer of yours, but I don't want you to send me any more
information via phone, telephone, whatever, phone, mail, or e-
mail, you have to honor that as well.
And the fourth thing is you have to use the preference
service, the suppression list that the DMA has. We have three
of them--the mail preference service, which has been in
existence since 1972. There are 4 million people on that list.
The telephone preference service has been in existence since
1985, 4 million again. By the way, the telephone preference
service is the do not call list for the State of Connecticut,
will be the do not call list for the State of Wyoming on July
1, and will be the do not call list for the State of Maine on
August 1.
And we also have an e-mail preference service, which we
started after Y2K, which has 50,000 names on it at the moment.
These services have to be used to eliminate the name, address,
e-mail address, phone number, whatever, from any marketing
campaign that a marketer has going out to try and find new
prospects.
So this, in a sense, is a do not contact me list based upon
the type of medium you use. It is free to consumers. Marketers
do have to pay to subscribe. But it is $460 a year, and it can
be subscribed to by a letter shop, which will clean up all of
the lists for anyone using that shop. So one subscription can
be used for a significant number of marketers. The EMPA--to get
on that list, go through E-MPS.org, and you can sign up right
online.
Now, what happens here with this? Well, we have staff in
Washington that just deal with compliance for the privacy
promise. So they are doing checks to make sure people are, in
fact, following what they promised.
The mail preference service, telephone preference service,
and e-mail preference service also are seated to ensure that
someone isn't using that list for marketing as opposed to
suppression. And we do get after people there through contract,
etcetera.
But we also have a process at the DMA, the Committee on
Ethical Business Practices, which reviews all DMA guidelines,
not just the privacy promise. We work for correction. It is
self-regulatory. We work to correct things to make it better,
to stop what they are doing or correct what is happening which
we think violates our guidelines, including the privacy
promise.
If you refuse to work with the DMA to correct it, we have a
couple of things that we can do. We have the potential of
public dismissal, and for the privacy promise we have an
antitrust exemption from the FTC. Or we can refer the question
to the appropriate law enforcement agency, be that the FTC, the
Postal Inspection Service, State Attorney General, the FCC if
it has to deal with telephone.
That is our promise. That is what we try and do. We have a
process already set up. We do a significant amount of
education, because we think it is important to provide
consumers with choice, with ability to control their
information, because you cannot have direct marketing without
information.
I have to have your name and address to provide to you the
good that you purchased. I have to have a means to collect
payment, most likely a credit card, to be able to do it. So
direct marketing, unlike going to a mall and paying cash,
requires information, and we have to have that consumer trust.
Thank you. I am ready to answer any questions.
[The prepared statement of Jerry Cerasale follows:]
Prepared Statement of Jerry Cerasale on Behalf of The Direct Marketing
Association, Inc.
I. INTRODUCTION.
Good morning, Mr. Chairman, and thank you for the opportunity to
appear before your Subcommittee as it examines industry best practices
and technological solutions for information privacy. I am Jerry
Cerasale, Senior Vice President of Government Affairs for The Direct
Marketing Association, Inc. (``The DMA''), the largest trade
association for businesses interested in online and offline direct,
database, and interactive marketing and electronic commerce.
The DMA represents nearly 5,000 companies in the United States and
53 foreign nations. Founded in 1917, its members include direct
marketers from every business segment, as well as the non-profit and
electronic marketing sectors. Included are catalogers, Internet
retailers and service providers, financial services providers, book and
magazine publishers, book and music clubs, retail stores, industrial
manufacturers, and a host of other vertical segments including the
service industries that support them.
The DMA's leadership also extends into the Internet and electronic
commerce areas through the companies that are members of The DMA's
Internet Alliance and the Association for Interactive Media. Members of
The DMA include L.L. Bean, Time Inc., Dell Computer, Gateway 2000,
DoubleClick, autobytel.com, BMG Direct, Charles Schwab & Co., Lucent
Technologies, eBay, Acxiom, AT&T, AOL TimeWarner, IBM, MCI WorldCom,
and others.
The DMA is a long-time leader in self-regulation and peer
regulation. DMA member companies, given their track record in
delivering high quality goods and services to consumers, have a major
stake in the success of both online and offline commerce. The healthy,
continued development of brick and mortar, catalog, and electronic
commerce depends on consumer trust. It is important that these online
and offline communications mediums engage in transparent marketing
practices to earn that trust.
Members of The DMA are held to effective industry standards. It is
these practices that I wish to focus on in my testimony today, which
will place into clearer focus the state of the direct marketing
industry's best privacy practices. The DMA's best practices include:
Several DMA programs which are essential to protecting privacy
online that, when created, were ahead of their time, and are
now industry tools and common best practices;
The DMA's self-regulatory Ethical Business Practice Guidelines
which protect consumers privacy by addressing complaints
concerning practices contrary to the Guidelines;
A new DMA program that will satisfy the enforcement
requirement of the U.S.-E.U. Safe Harbor to the European Data
Directive;
Several technology solutions supported by The DMA which will
help consumers to choose and enforce how their personal data is
collected and used by businesses; and
Important DMA public education initiatives which help the
government, businesses, and, most importantly, consumers to
better understand the information collection process.
II. THE DMA'S BASIC ONLINE AND OFFLINE PROGRAMS.
The DMA's members understand and respect the privacy needs of
consumers, can react much faster than the government to new conditions
in the marketplace, and therefore has developed a self-regulatory
response to privacy. For decades, The DMA and its members have worked
to develop effective consumer notice and choice practices as a
fundamental element of self-regulation.
Below is a brief description of The DMA's business practice tools
created to incorporate both notice and choice elements and to bolster a
responsible exchange of consumer information.
A. The DMA's Privacy Promise.
The DMA is providing leadership in the offline and online worlds
through the ``Privacy Promise to American Consumers,'' (``Privacy
Promise''), which became effective July 1, 1999. The Privacy Promise
requires, as a condition of membership in The DMA, that companies,
including online businesses, follow a set of privacy protection
practices:
Providing customers with notice of their ability to opt out of
information exchanges for marketing purposes;
Honoring promptly individual requests to opt out of the sale,
rental, or exchange of their contact information to third
parties for marketing purposes;
Accepting and maintaining consumer requests to be on an in-
house suppress file to stop receiving unwanted commercial
solicitations; and
Using The DMA Preference Service suppression files, which
exist for mail, telephone, and e-mail lists.
Members are permitted to display a recognizable ``seal'' that
assures consumers of a company's commitment to privacy protection.
B. The DMA's Privacy Principles and Guidance for Marketing Online.
The DMA is also providing leadership in the online world. The DMA's
Privacy Principles and Guidance for Marketing Online (``Online
Guidelines'') explain and highlight issues unique to online and
Internet marketing. When marketing online, companies are advised that
the notice they provide to consumers regarding their information
practices be placed in a prominent place. The notice should state
whether the marketer collects personal information online from
individuals, provide certain disclosures, identify the marketer and
provide an e-mail, postal address, and telephone number at which the
marketer can be contacted. Marketers sharing personal information
collected online are also required to provide consumers with an
opportunity to opt out from the rental, exchange, or sale of this
information for commercial purposes.
For online e-mail solicitations, The DMA Online Guidelines state
that member solicitations should be clearly identified as such and
disclose the marketer's identity. Marketers using e-mail are required
to furnish consumers, with whom they do not have an established
business relationship, with notice and a mechanism through which
consumers can notify the marketer that they do not wish to receive
future online solicitations.
C. The DMA's Preference Services.
The DMA has developed services to assist our members in adhering to
our primary values of notice and consent. The DMA offers three
different preference services for various mediums that empower
consumers with effective choice: (1) the Mail Preference Service
(``MPS''); (2) the Telephone Preference Service (``TPS''); and (3) the
e-Mail Preference Service (``e-MPS''). Use of these services by member
companies that market to consumers is required as a part of the Privacy
Promise. To protect against abuse of these Preference Services, The DMA
seeds and constantly monitors these lists.
1. Mail Preference Service.--In 1971, The DMA launched the MPS. The
MPS gives consumers the power to choose whether to receive promotional
mail at home. Those who wish not to receive promotional mail at home
can register with The DMA's MPS by providing a name, home address, and
signature by mail, at no cost, or online via the DMA Consumer Help Web
site. Once a consumer's name and home address is added to the list, it
remains on the list for five years. Consumers are informed about the
availability of this service through state and local consumer agencies
and print and broadcast advertising.
2. Telephone Preference Service.--Similar to the MPS, The DMA
created the TPS in 1985 to honor consumer choice in telemarketing. TPS
is a consumer service that is easy to use and offered at no cost. To
register with TPS, individuals need only provide a name, home address,
home telephone number, and signature, by either mail or via The DMA
Consumer Help Web site. Afterwards, individuals' names will remain on
the TPS list for five years.
The DMA is also the official distributor of the do-not-call list of
the States of Connecticut, Maine, and Wyoming. All of the names found
on these three States' do-not-call lists have been incorporated into
The DMA's TPS file.
3. e-Mail Preference Service.--In further developing responsible
marketing practices for the Internet age, we adapted the fundamental
principles of the MPS and TPS to create the e-MPS. The DMA's e-MPS
similarly empowers consumers with notice and choice concerning the
receipt of unsolicited commercial e-mail (``UCE''). Launched last year,
the e-MPS allows individuals to remove their e-mail addresses from
Internet marketing lists. This ambitious undertaking is aimed at
empowering consumers to exercise choice regarding receipt of UCE, while
creating opportunity for the many exciting new benefits of legitimate
marketing in the interactive economy.
Since January 2000, consumers have been able to register for the e-
MPS at a special DMA Web site. Consumers can use this service, at no
cost, to place their e-mail addresses on a list indicating that they do
not wish to receive UCE. This service affords consumers the flexibility
to determine the types of solicitations they receive. Through this
service, individuals can opt out of business-to-consumer UCE, business-
to-business UCE, or all UCE.
Consumers on the e-MPS list will receive no e-mail from DMA members
unless they have an established online business relationship with that
company. This service also is available to companies that are not
members of The DMA so that they too may take advantage of this
innovative service and respect the choice of consumers who choose not
to receive UCE.
D. The DMA's Privacy Policy Generator.
Another effective DMA program developed to help members provide
effective notice and choice to consumers is The DMA's Privacy Policy
Generator. This tool, available at The DMA's Web site, allows companies
to create and post effective privacy policies.
The DMA's Privacy Policy Generator (http://www.the-dma.org/
policy.html) enables companies, through a series of questions, to
develop customized privacy policies for posting on their Web sites
based on the companies' policies regarding the collection, use, and
sharing of personal information. The utility of this tool, and the ease
with which it is used, is demonstrated by the hundreds of companies
that have used it and sent these policies to The DMA for review.
E. The DMA's Children's Privacy Policy Generator.
Similarly, The DMA created the Children's Privacy Policy Generator,
which allows direct marketers to create and post effective children's
privacy policies. This tool can be used by marketers to help them
comply with the requirements of both the Children's Online Privacy
Protection Act (``COPPA'') and the Federal Trade Commission COPPA Rule
that implements the Act.
The DMA's Children's Privacy Policy Generator is easy to use and
guides marketers through an online step approach through which
marketers answer a series of questions. From these questions, marketers
are able to determine which disclosures they need to make in the
privacy policies posted on their Web sites based on their information
practices.
III. THE DMA'S ETHICS GUIDELINES.
The DMA's self-regulatory guidelines and procedures provide a
comprehensive and meaningful approach to addressing consumer privacy.
At the cornerstone of the DMA's self-regulatory approach are The DMA's
Guidelines for Ethical Business Practice (``Ethical Guidelines'' or
``Guidelines''). These Ethical Guidelines were adopted to aid its
members and others engaged in direct marketing in determining ethical
conduct in dealing with customers and other businesses which will be in
the best interest of their customers. The DMA has undertaken extensive
efforts to ensure that its members market ethically for the protection
of consumers. Indeed, on a daily basis, The DMA gives its members
advice on how to ensure that they are complying with its Guidelines.
In an effort to strengthen sound business practices in the
marketplace, The DMA established the Committee on Ethical Business
Practice to review direct marketing promotions and practices that may
violate the Ethical Guidelines. The Committee reviews potential
Guidelines violations of both association members and non-members. The
Committee has applied the Ethical Guidelines to hundreds of direct
marketing cases concerning deception, unfair business practices,
personal information protection, and other ethics issues.
A. The Process.
The Committee receives promotions and practices for review in a
number of ways: through consumers, member companies, non-members, or
sometimes consumer protection agencies.
If the majority of the Committee believes that the promotion or
practice brought to its attention potentially violates the Guidelines,
DMA staff contacts the company and points out the potential Guidelines
violation. The company is then given an opportunity to respond. If the
Committee does not believe the promotion violates the Ethical
Guidelines, the case is closed and the company is not contacted again.
Cases closed without company contact are handled confidentially.
Most companies cooperate with the Committee's efforts and agree to
modify the questioned promotion or practice. Because cooperation with
the Committee and compliance with The DMA's Ethical Guidelines are
voluntary, a confidential and meaningful dialogue about the particular
promotion or practices usually occurs, and the Committee and the
company are typically able to reach a satisfactory conclusion.
In those cases where the Committee is successful in obtaining the
company's cooperation to change the promotion or practice, or where the
Committee is persuaded that the violation did not take place, the case
proceedings remain confidential. The confidentiality protects all
parties and helps ensure that the Committee's goal of obtaining
compliance with the Guidelines is met.
In those rare instances where the Committee cannot come to a
satisfactory resolution with a member or non-member company, that is,
the Committee believes that the violations are continuing, the case may
be referred to The DMA's Board of Directors for further action. Cases
referred to the Board of Directors are made public by the Committee.
Board action could include censure, suspension of membership or
expulsion from the DMA. The Board may also decide to publicize its
action. Companies with promotions or practices that are found to
violate the law in addition to the Ethical Guidelines are referred to
appropriate law enforcement authorities for handling.
The Guidelines have proven to be an effective means of ensuring
ethical marketing practices by non-members as well. Although non-
members are not bound by The DMA Ethical Guidelines, it has been our
experience that non-member companies comply with Guidelines and
policies so as to comport with industry standard practices. The net
effect is to increase good business practices for the industry and to
increase consumer confidence in the marketplace. In addition, where a
non-member company's practice is illegal, we are able to refer the case
to the appropriate federal and/ or state law enforcement authority.
B. The Committee on Ethical Business Practice's Regulatory Approach.
The DMA's self-regulatory approach has proven successful in
addressing complaints regarding practices contrary to The DMA's Ethical
Guidelines. Working with both members and non-members, The DMA has
gained voluntary cooperation in adhering to these Guidelines. As a
result of The DMA's efforts, many companies have reformed their
practices in areas such as sweepstakes, predictive dialing, unsolicited
faxes, and e-mail to address the concerns raised by activities that are
violations of the Guidelines.
IV. THE DMA SAFE HARBOR PROGRAM FOR EUROPEAN DATA.
On May 22, 2001, The DMA became the first trade association to
provide a European Union Safe Harbor Enforcement Program (``DMASHP'' or
``Program'') at no cost to its members. The DMASHP, which is an
effective way for U.S. firms that choose to comply with European Union
(``E.U.'') data export regulations.
This Program is aimed at compliance with the enforcement element of
the Safe Harbor Principles. Technical assistance and educational
materials will be provided through the DMASHP to assist participants
throughout the process for meeting the Safe Harbor requirements. To
provide consumers with an easily recognizable symbol that signifies and
distinguishes a Program participant as being in compliance with the
Program, The DMA also created an easily recognizable DMASHP mark.
The Third Party Dispute Resolution Mechanism is a major component
under the DMASHP that provides businesses seeking to certify under the
Safe Harbor with an independent third-party dispute mechanism that
complies with the Safe Harbor enforcement requirements. The Safe Harbor
requires that the dispute resolution mechanism be readily available to
consumers, affordable, and be able to ensure compliance with the Safe
Harbor privacy protections. The DMASHP:
provides a fair and unbiased redress of the consumer's
concerns;
is visible so that consumers with concerns know where to turn
for resolution of their problem;
is accessible so that there are no barriers to the filing of a
complaint, whether they be financial or otherwise;
provides resolution in a timely manner;
provides finality for the consumer by reaching an independent
determination of the dispute; and
provides enforceability of the final conclusions in the
determination of the consumer's dispute.
The DMA also created a DMASHP Committee (``Committee''), which has
the power to hear both sides of a dispute and provide a final
determination. As mentioned above, when businesses join the DMASHP,
they are required to abide by the decisions of the Committee. They are
also notified in the DMASHP contract that the Committee will have the
authority to issue certain sanctions as a result of their decision. The
lynchpin to any dispute resolution mechanism is that it be impartial.
One way to ensure impartiality is to ensure openness of the results of
the program by publishing the outcomes of the cases on a regular basis
and for The DMA's staff to be constantly vigilant that the results are
fair and legal.
Overall, this Program will provide consumers with an easy method to
bring their disputes before the Committee. It is the goal of the
Program to obtain a determination of all cases in a quick and timely
manner, but in no case longer than 60 days.
V. TECHNOLOGY SOLUTIONS.
Technology is playing an increasingly important role in helping
users determine and enforce the ways that information about them is
used and collected. The DMA and marketers have been, and continue to
be, instrumental in the development of this important technology by
encouraging, supporting, and indeed helping to develop and promote,
such software.
Since its inception, The DMA has been involved in an initiative
that supports this concept--the Platform for Privacy Principles
(``P3P''). This initiative, undertaken by the World Wide Web
Consortium, has developed a ``negotiation'' approach for protecting
privacy. A broad coalition of information providers, advertising and
marketing specialists, software developers, credit services,
telecommunications companies, and consumer and online advocates worked
together on P3P to achieve a technological solution that will protect
privacy without hindering the development of the Internet as a civic
and commercial channel. P3P allows a user to agree to or modify the
privacy practices of a Web site, and be fully informed of the site's
practices before interacting with or disclosing information to a site.
There also have been several announcements by companies in the last few
months of other commercial products that will empower consumers with
respect to privacy online. As technology continues to improve, so will
consumer empowerment tools. We support the continued responsible use of
this cutting-edge solution as Congress, businesses, and consumers
evaluate it.
VI. PUBLIC EDUCATION.
Another important part of The DMA's efforts is spent in educating
consumers and businesses about the numerous DMA programs that are
available to them. The DMA has a vital interest in educating its
members and the general public about the responsibilities of people who
collect and use data, as well as the process. We take great pride in
our education initiatives, because through them individuals and
businesses will better understand the potential benefits of
interactivity and the choices individuals have to control information
that they submit to these businesses. Therefore, The DMA has developed
a Web page devoted to privacy and launched its Privacy Action Now
initiative.
The DMA has also made a special effort to empower children,
parents, educators, and librarians by establishing its http://
www.cybersavvy.org Web page for them and providing them with tools,
information, and resources to ensure safe Web surfing. Additionally, we
have produced a ``hard copy'' version of the Web site, Get CyberSavvy.
Get CyberSavvy has the distinction of being awarded first place honors
for excellence in consumer education by the National Association of
Consumer Affairs Administrators.
VII. CONCLUSION.
The DMA is a long-time leader in the marketing industry's self-
regulation and peer regulation. For decades, we have worked to develop
practices that will address and protect consumer privacy. We understand
that our online and offline worlds are more dynamic than ever and will
continue to develop effective business practices in a timely manner to
address consumer concerns as these mediums evolve. We congratulate the
Subcommittee for taking a closer look at the industry's best practices
and technology solutions and look forward to working with the
Subcommittee.
[The information on DMA is retained in subcommittee files.]
Mr. Shimkus [presiding]. Thank you. Right on time.
Next, we will turn to Mr. Cole, Senior Vice President and
General Counsel for the Corporate Secretary of the Council of
Better Business Bureaus, Incorporated. Welcome, and you have 5
minutes. And your full written testimony is already submitted
in the record.
Mr. Cerasale, your request was granted to put all of that
into the record.
STATEMENT OF STEVEN J. COLE
Mr. Cole. Thank you very much, and good afternoon. I
actually said good morning in my notes, but change that.
Now, you know the Better Business Bureau well, our almost
universal brand recognition and our reputation for impartiality
in the marketplace. BBB online operates two so-called trust
mark or seal programs, reliability and privacy, and both are
designed to help consumers identify companies safe to do
business with online by looking for sites with one of our trust
marks or using our search mechanism to find those sites.
It was our reputation and experience with self-regulation
that led the business community to ask us to create an online
privacy program. And the phrase ``self-regulation'' is not
boilerplate to us. We take it seriously. Our program standards
were formulated voluntarily, sleeves rolled up in work sessions
by a working group of about 30 of the most important
technology, consumer product, financial service, and
information companies in the United States.
Since our 1999 launch, we have received over 1,500
applications from over the United States and from 20 countries,
and we have awarded seals covering over 800 websites. And there
are now 1,000 sites that are either qualified or in the process
of qualifying.
We need to expand our reach, and I will touch on that
later, but we do reach companies with a huge share of the
market--high-tech companies like Hewlett-Packard, Intel, and
Agilent; communications companies like AT&T and MCI; and travel
services like American Airlines and Expedia; retailers like
Lowe's and Fingerhut; entertainment companies like Lucas Films
and Nickelodeon; and information companies like Dun &
Bradstreet; and consumer goods firms like Procter & Gamble and
Nestle.
In addition, our reliability trust mark now displayed on
about 10,000 websites will soon require, among other things,
that online advertisers post and adhere to fair information
principles. And this will apply to these 10,000 sites whether
or not they participate in our separate privacy seal program.
Now, our program that I am here to talk about today covers
the collection of personal information online, although a few
of our seal holders, such as Tupperware, apply their policies
to all information collected, both online and offline.
Disclosure is the cornerstone of our program. We want a
transparent environment with no surprises. And one of our key
requirements calls for easy-to-find, easy-to-read notices which
tell consumers the types of information collected, how their
information will be used, the choices available in preventing
these uses, and how the consumer could access information and
make corrections.
We require the notices be placed wherever personal
information is collected at the site, so that consumers are
informed at the right place and the right time about the
consequences of their actions, although some of our seal
holders like Xerox go further and put the notice on virtually
every page.
Mr. Chairman, there has been recent critical media coverage
of the complexity of some privacy notices, and we think it may
miss an important point. There is a very delicate balance to
draw between simple disclosures that may not tell the whole
story and full disclosure which does but has a lot of ifs,
ands, and buts, and definitions.
We work hard to strike that balance reasonably, and we
prefer full disclosure to the consumer with the simplest
language possible. But we don't want material information to be
hidden solely for the sake of brevity.
Privacy notices mean very little unless backed up by a
business' actual conforming practices to their notice. We use a
unique assessment tool that inquires into a seal applicant's
management processes. We ask about personnel policies and
training, about their relationship with third parties like
agents and contractors. We inquire into physical security and
electronic security procedures.
Our annual assessment process offers ongoing help and
tailored advice. Actually, we have been told that applying for
a seal is like getting a free consulting service. It is good
public policy even if it isn't the best business model.
Our program requirements include other important best
practices. Consumers must be allowed to opt out of transfers of
their personal information to third parties, and they must be
given an opportunity to opt in for certain transfers of
sensitive data, such as health care.
Seal holder websites must prominently disclose how
consumers can raise questions or complaints with the company
and with BBB online. They must participate in our dispute
resolution program, and they must afford consumers access to
personal information at a reasonable cost, not just to allow
correction of inaccuracies, but simply to inform them what is
being retained and what is retrievable about them. And some
companies like Kodak provide instant online access through
password-protected profiles.
Protection of online privacy requires a global outlook, so
our standards now incorporate the online safe harbor terms
negotiated by our government and the European Union. And I am
proud to say that EU officials have singled out BBB's program
as the most important factor in persuading them that self-
regulation could work.
We apply the safe harbor principles also to U.S.
transactions and U.S. customers. That is not done by everybody.
And we verify compliance with the requirements rather than rely
on self-certification.
On June 1 this month, I signed an agreement in Tokyo with
the Japan Information Processing Development Corporation to
launch the first ever cross-border, online trust mark program--
in this case, the reciprocal privacy seal program.
The program, with the encouragement of Japan's government,
provides for common privacy standards and recognition of each
organization's award of a seal by the other, and it provides a
co-branded privacy seal for use on the websites of either
country. And we think this is going to be a very effective way
to promote cross-border commerce.
Let me close by recognizing that there is still a large
portion of the marketplace that hasn't responded, and it is
fair to ask why this is so. One reason, we suspect, is the
marketplace is uncertain about the current legal environment.
Will there be legislation or not? Will self-regulation
technology have a role? What standards will ultimately govern?
Such uncertainty may fuel a reluctance to embrace any
particular voluntary self-regulation program. Now, this is not
to say that the business community has ignored privacy. Quite
to the contrary. But participating in a seal program is a big
commitment closely related to predictions about the future
legal framework. And, frankly, these predictions simply cannot
be safely made at this time.
Thank you for your interest.
[The prepared statement of Steven J. Cole follows:]
Prepared Statement of Steven J. Cole, Senior Vice President and General
Counsel, Council of Better Business Bureaus, Inc. and BBBOnLine, Inc.
Mr. Chairman and members of the Committee, my name is Steven J.
Cole, and I am the Senior Vice President, General Counsel, and
Corporate Secretary of the Council of Better Business Bureaus, Inc. I
am pleased to be here to speak with you about the BBBOnLine Privacy
Seal Program, one of the significant self-regulatory programs of
BBBOnLine, the Internet subsidiary of the Council of Better Business
Bureaus.
The Council of Better Business Bureaus (CBBB) is the umbrella
organization for the nation's Better Business Bureau system, which
consists of 129 local BBB's and branches and 270,000 member businesses
across the United States. The CBBB is a nonprofit business membership
organization tax exempt under section 501(c)(6) of the Internal Revenue
Code. More than 325 leading edge companies nationwide belong to the
CBBB and provide support for its mission of promoting ethical business
practices through voluntary self-regulation and consumer and business
education.
Each year, millions of consumers contact the Better Business Bureau
for pre-purchase information or for assistance in resolving marketplace
disputes. In large part, they are drawn to the BBB by its enormous name
recognition, reputation, and proven credibility. The BBB trademark is
one of the country's most widely recognized by both business and
consumers. The public looks to the Better Business Bureau for impartial
and reliable information on a broad range of companies, products and
services. We offer consumers and businesses a means to resolve disputes
through conciliation, mediation and, when necessary, arbitration.
Our name recognition, the extremely high level of trust we have
earned from the public, and our experience in operating self-regulation
and dispute settlement programs, including our previous experience with
offering another seal program in the BBBOnLine Reliability Program, are
some of the reasons the business community asked BBBOnLine to provide a
framework for self-regulation in the area of online privacy.
BBBOnLine is a 501(c)(6) tax-exempt organization, supported by
leading online marketing and technology companies in the United States.
A wholly owned subsidiary of the CBBB, BBBOnLine was established by the
CBBB and its member sponsors as a means to promote the highest ethical
business practices online through self-regulation and consumer
education and self-help measures, and thereby help to foster consumer
trust and confidence in this new market.
To help online companies distinguish themselves, BBBOnLine provides
two separate seal programs for online businesses--the Reliability Seal
Program and the Privacy Seal Program--and provides consumer information
through our website, www.bbbonline.org. Both programs emphasize the
importance of posting and adhering to a privacy notice that is based on
fair information practices which includes notice, choice, access and
security. These important privacy notice disclosures provide the
consumer with knowledge so that they may understand the company's
privacy and security practices before providing any personally
identifiable information. BBBOnLine's Reliability Program has developed
a Code of Online Business Practices which will help shape the rules of
the road for e-commerce, not only for privacy but for many other
aspects of consumer protection. This Code has become an international
model for other countries looking to advise their own online businesses
on best practices.
The BBBOnLine Privacy Program awards seals to online businesses
verified as meeting our high standards including: the posting of online
privacy policies meeting rigorous privacy principles, completion of a
comprehensive evaluation, monitoring and review by a trusted
organization, and participation in a consumer dispute resolution
system. Our goal as an organization has and continues to be providing
education for businesses and consumers on fair and honest practices in
the market place.
Our Privacy Program is a logical extension of this objective. The
Privacy Program is designed to be a user-friendly tool that helps
foster trust and confidence in online commerce and as a resource for
business as a simple, one-stop, non-intrusive way to demonstrate
compliance with credible online privacy principles.
The core of the BBBOnLine Privacy Program:
Awards an easily recognizable and affordable ``seal'' to
businesses that post online privacy policies meeting rigorous
principles, including notice to consumers, disclosure, choice
and consent, access, and security;
Offers a separate and distinct seal for sites directed at
children;
Provides a thorough and consumer-friendly dispute resolution
system;
Monitors compliance through requirements that participating
companies undertake, at application and at a minimum annually
thereafter, assessments of their online privacy practices; and,
Takes specific actions for non-compliance, such as seal
withdrawal, publicity and referral to government enforcement
agencies.
To ultimately qualify for a privacy seal, applicants must
successfully complete a comprehensive assessment process that examines
all relevant aspects of an applicant's information practices, including
privacy notice content and placement, security measures, transfer and
merger of information, access, correction; and (if the website or
online service falls within our children's guidelines) a comprehensive
set of additional children's requirements. Our assessment is an
educational tool, providing business with a template on how to
institute and maintain a credible regime promoting fair information
practices to foster protection of consumer privacy in the online world.
In the 27 months that the BBBOnLine Privacy Program has been in
operation, we have already gained much valuable experience. The
assessment process involves a careful dialog between ourselves and our
applicants, and often we find ourselves learning from each other. For
instance, in the process of evaluating the information practices of
applicants, we find that we are also educating them on the importance
of drafting clear privacy policies that disclose with sufficient
specificity what is being collected and how that information is being
used. We are talking with applicants about the necessity of providing
access to and correction of information, and simultaneously, the
importance of having in place verification methods for providing access
to only those individuals authorized to obtain it. We are educating
applicants on security measures, the many issues that arise in clearly
defining the scope of the privacy seal protections, and the best way to
protect children's privacy. In this way, we believe we are not only
certifying websites that follow the BBBOnLine criteria, but also
greatly raising the bar by giving applicants the time and guidance
needed to make them knowledgeable about the issues surrounding online
privacy.
In addition to the assessment process, BBBOnLine offers consumers
and businesses significant experience in resolving disputes. Using
BBB's dispute settlement experience, we stand ready to provide
consumers with a specialized forum to air and resolve privacy-related
disputes. We will accept complaints from both US residents and non-US
residents about companies and organizations with posted privacy notices
that misuse information or are alleged to have violated posted privacy
policies. Complaints can be about the actions of seal participants and
non-seal participants. Companies or organizations that do not cooperate
with us in a dispute resolution proceeding can, in turn, be subject to
public withdrawal of our seal and/or referral to the appropriate
government agency.
Both BBBOnLine's Privacy Program and Reliability Program are
designed to foster consumer trust and confidence on the Internet and
serve as a valuable resource for business as a simple, one-stop, non-
intrusive way to demonstrate compliance with credible online commercial
practices. As an aid to both businesses and the consumer, BBBOnLine's
privacy standards evolve over time to ensure that they incorporate the
rapidly evolving changes in this environment as well as important
governmental concerns.
As previously mentioned, the Better Business Bureau is well-known
for its role in providing consumers with pre-purchase information and
this role has become even more important with the increasing popularity
of the Internet. This medium enables consumers to shop from their home
computer instead of leaving home to visit a bricks and mortar
establishment. The appearance of a BBBOnLine seal on a website provides
consumers with a user-friendly tool because they can simply click on
the seal to confirm a company's participation in one of our programs.
This helps increase a consumer's comfort level when shopping online.
BBBOnLine also helps businesses educate their own customers. A
disclosure-based program both in process and design, BBBOnLine seeks to
create a transparent environment with no ``privacy surprises.'' We
require clear, easy to find, and easy to read privacy notices that
contain relevant disclosures. Consumers of a BBBOnLine seal holder must
be able to rely on the privacy notice, which means it must be
available, must be understandable, and must contain those disclosures
that consumers need to make informed choices about the collection and
use of their own information. Some of the key disclosures required by
BBBOnLine include:
What types of personally identifiable information are being
collected from them.
How their information will be used.
What choices the consumer has regarding the sharing of
personal information
How the consumer can access his or her personally identifiable
information to review and/or make corrections.
Recent critical media coverage of the complexity of some privacy
notices may miss an important point here--namely, that we have a very
delicate balance to draw between full disclosure, which includes
``ifs'' ``ands'' and ``buts'' and definitions because of the complexity
and diversity of the state of privacy practices and ground rules in
this country, and simpler disclosures that don't tell the whole story.
We work hard to strike that balance in reviewing applicant's policies.
We lean towards full disclosure, with an effort at using the simplest
language possible. But, we don't want important exceptions or
clarifications to be hidden for the sake of brevity.
BBBOnLine's website also serves as a great shopping aid for
consumers. One of the most popular features is BBBOnLine's searchable
database, a resource for anyone seeking out trustworthy online
businesses that have been approved by one of our seal programs. The
website also provides guidance should a dispute arise between a
consumer and a specific company. If necessary, the consumer also has
the opportunity to file a complaint against the company. Online
shoppers are increasing in numbers and these steps ensure that
confidence levels can rise at the same time.
BBBOnLine also serves as an educational resource for business, both
for those seeking a seal, and those already carrying one. As an
integral part of our application and renewal process, BBBOnLine offers
ongoing help, guidance, and tailored advice for the creation,
maintenance, and improvement of sound information policies.
This educational component for business is critical. It is rare for
us to receive an application from a business that is already 100%
compliant with our program standards. Privacy remains a new and complex
enough issue that many businesses are approaching the issue of online
privacy for the first time, and still learning how to best protect
privacy.
For instance, in our application and review process it may become
apparent that new procedures for consumer choice, access, data
security, and site design need to be implemented. Privacy notices must
often be amended to provide more meaningful and understandable
disclosures. Binding promises must be obtained to guarantee the correct
use of information.
The interactive process begins with standards that already
incorporate many of the best practices laid out by leading industry
coalitions, privacy advocates, and government bodies such as the
Federal Trade Commission.
One best practice recommended by these groups is the ability of
data subjects to not only correct their own information, but also to
later access and review their information. This is also a standard
requirement of BBBOnLine.
Another is the ability of data subjects to discern not only
``what'' information is being collected, but by ``whom.'' In the
increasingly seamless environment of the Internet, which can visually
blur the line between data collectors, BBBOnLine requires its seal
holders to provide specific disclosures when other data collectors are
incorporated into a site design, and to provide visual cues and
disclosures when there are links to outside parties that may look like
part of a seal-holder's site, either because of co-branding, licensed
services, or frames.
Likewise, BBBOnLine follows recognized best practices by requiring
all its seal holders to explain how they can be contacted in the
instance there are questions or concerns. Their participation in
BBBOnLine itself must be disclosed so that data subjects may take
advantage of our dispute resolution process.
Seal holders must provide a statement of their commitment to data
security. Seal holders must explain whether or not information is
shared with outside parties, and how that sharing can be prevented.
These are all reflections of best practices that have been made an
express part of the BBBOnLine Privacy Program standards.
Equally important, BBBOnLine does not limit its inquiry to just the
quality and placement of a seal holder's privacy notice. Because
privacy notices mean little unless backed up by a business' actual
practices, BBBOnLine also uses a unique assessment tool that inquires
into a seal applicant's management processes. We ask about staff
training. We ask about the relationship a seal applicant has with all
parties that have access to data, including agents and contractors. We
require the creation of internal security logs. We require confirmation
of physical security devices, such as doors and locks, in addition to
electronic security procedures such as encryption and passwords.
In some cases, the comprehensive, interactive, and educational
back-and-forth that leads to the grant of a BBBOnLine Privacy seal
leads to exemplary information practices that may even exceed
BBBOnLine's own standards. Once a business is educated on areas of
privacy concern, and given concrete suggestions on how these concerns
can be addressed, we find many companies creating even more creative
and effective ways to protect online privacy.
For example, BBBOnLine requires posted privacy notices that are
easy-to-find, and appear at least on every homepage, every page where
information is collected and every page that contains an active email
address. Many of our seal-holders, such as Xerox, go beyond this
requirement and place a link to their privacy notice on virtually every
page of their Web site.
BBBOnLine requires privacy notices to clearly explain a business'
online policies, as well as what online elements may not be covered. A
few of our seal holders, such as Tupperware, go the extra step of
applying the promises they make in their privacy notices to all
information collected (both online and offline) and honor these
promises universally for all the company's sites.
BBBOnLine requires its seal holders to provide data subjects access
to their own information, subject only to reasonable frequency and fee
limits. Practically all the BBBOnLine seal holders have chosen to
provide access and correction free-of-charge, and many, such as Kodak,
go the extra step of providing their customers instant access online
through password protected profiles.
In addition to these specific examples of good information
practices, it has also become apparent that when an organization sets
out with a comprehensive approach to privacy, many of the barriers,
costs, and challenges imposed by privacy compliance are reduced. There
are significant efficiencies realized when a ``privacy plan'' is
implemented across the board from the beginning of an organization's
online presence.
When privacy is folded into a corporate culture, new information
practices are implemented more quickly, online content and services are
more swiftly modified, costs are kept down, and compliance with third
party verification services (like BBBOnLine) becomes infinitely easier.
In this respect, we have found that one of the most powerful ways
to encourage good privacy practices is to empower businesses with the
knowledge, tools, and advice they need to make privacy an integral part
of their operation.
Based on leading industry standards and an expert privacy panel,
the guidance of the BBBOnLine Steering Committee, and the 88 year
history of the Better Business Bureau system in providing effective
self-regulation, the BBBOnLine standards continue to provide some of
the most effective and relevant standards for privacy.
To maintain our standards as a relevant education tool, BBBOnLine
has continued to adapt in the face of new regulation and marketplace
needs. BBBOnLine is able to do this because one of the inherent
advantages of a self-regulatory program is this ability to move quickly
and remain responsive, which proves especially important in the fast-
paced environment of the Internet.
To offer just one example, the BBBOnLine Privacy standards were
updated almost a year ago to incorporate the safe harbor privacy
principles negotiated between the Department of Commerce and the
European Union for the adequate protection of information under the
European Union's Directive on Data Protection. This program upgrade has
allowed BBBOnLine Privacy Seal holders to enter the EU safe harbor.
Several BBBOnLine seal holders, including Hewlett-Packard and Dun &
Bradstreet have since gone on to self-certify on the DOC's safe harbor
list. Unlike others, BBBOnLine's safe harbor compliance standards are
made applicable to US businesses and US consumers--so we have enhanced
protection in the US.
As the EU negotiations highlighted, privacy is not purely a North
American issue. In the borderless world of electronic commerce, online
privacy protection has become a key component of doing business in
today's global economy. Various countries have developed their own
country or region specific regulatory approaches to privacy. For the US
to remain competitive in e-commerce, privacy concerns need to be
addressed. This is another area where self regulatory programs like
BBBOnLine can help in the global arena to assist business and consumers
in promoting sound privacy practices and offer consumers and business a
forum for resolving disputes across borders.
In further response to the global marketplace, on June 1 of this
year I signed an agreement in Tokyo, Japan with the Japan Information
Processing Development Corporation (JIPDEC), the Japanese Government
sponsored privacy mark program, to launch the first ever cross border
privacy seal program. The program provides for a reciprocal seal which
provides US businesses who wish to market online to Japanese consumers
with a combined privacy seal, granted by BBBOnLine, which incorporates
the JIPDEC seal, which is easily recognizable in Japan. This effort
will also provide Japanese online marketers, marketing to the US, with
the BBBOnLine Privacy Seal for use in the US. Once a US company
qualifies for the BBBOnLine Privacy Seal, it will also automatically
qualify for the reciprocal JIPDEC seal. This groundbreaking agreement
will help foster e-commerce across borders and also facilitate
resolution of privacy disputes that may arise in cross border
transactions.
Since BBBOnLine's Privacy Seal Program has been officially ``open
for business'' we have received over 1500 applications from all over
the US and from 20 countries, and have awarded seals covering over 800
websites. When you factor in those currently in the application
process, there are over a 1000 sites that have either qualified for or
are in the process of qualifying for our seal.
The credible nature of our assessment process is illustrated by the
number of sites that do not ultimately qualify for the seal. The reason
is our program is tough. However, even those sites that go through our
process, but do not actually receive a seal, still benefit from
learning how to implement good privacy practices. While this has been a
good start, unfortunately, the percentage of applicants, compared to
the wider universe of websites that could benefit from the program, is
still small. Our applicants come from diverse segments of the market
place. Our seal holders include high technology companies like Intel,
Hewlett-Packard, Dell, Agilent Technologies; communications companies
like AT&T and MCI; travel related companies like American Airlines,
Union Pacific Railroad and Expedia; major retailers like Lowe's
Companies and Fingerhut; entertainment companies like Lucasfilm,
Nickelodeon, and Zagat Survey; major trade associations like the
American Electronics Association and the Electronic Retailing
Association, as well as major multinational firms like Proctor and
Gamble and Nestle. When you consider that significant companies like
these have all embraced the rigorous standards of the BBBOnLine Privacy
Program, you can appreciate the large number of consumers that already
benefit from our self regulatory program.
Even so, most of the applications we have received have come from
small to medium-sized businesses. The BBBOnLine Privacy Seal Program
was intentionally priced so that companies of all sizes could apply.
The only item keeping a company from participating in the program
should be its inability to meet the eligibility requirements; price
should not be a factor. The World Wide Web is made up of hundreds of
thousands of websites, most of which are not large companies. In order
for self-regulation to work it must be accessible to the majority of
web marketers, large and small companies alike.
However, even while BBBOnLine continues to grow, we recognize that
there's still a large portion of the marketplace that hasn't responded
to our message. One thing that the Committee might consider is why this
is so. One reason we suspect is that the marketplace is still uncertain
about the current legal environment. Will there be legislation or not?
Will self-regulation and technology be deemed the preferred route? What
standards will ultimately define widely accepted best practices? Such
uncertainty may fuel a reluctance to embrace any particular rush to
voluntary programs such as BBBOnLine, which is unfortunate, given what
we have already accomplished in such a short time frame. This is not to
say that the business community has ignored privacy. To the contrary--
as we have all seen, it is doing well in posting privacy policies on
web sites--but participating in a seal program is a big step, and is
closely related to predictions about the legal environment.
It is our hope that as the program grows, and as consumer awareness
and education increases, we will have been able to make the online
marketplace a safer place to negotiate for all.
We want to thank the Committee for your attention and hope that you
share in our enthusiasm for the tremendous progress already made.
I am available to answer any questions you may have. For those
individuals that may be reading this document, I have provided a list
of website addresses that may help you in further understanding the
various aspects of BBBOnLine programs.
Mr. Shimkus. Thank you.
Next we will turn to Mr. Jerry--is it pronounced DeVault?
Mr. DeVault. Yes, it is.
Mr. Shimkus. National Director, Innovative Assurance
Solutions. Welcome, and you have 5 minutes.
STATEMENT OF JERRY R. DEVAULT
Mr. DeVault. Thank you. Good afternoon. Ernst & Young is a
leader in providing auditing and assurance services around the
globe with 78,000 employees based in 130 countries. I will make
three points illustrating how privacy practices have evolved
and acquaint you with an emerging best practice independent
verification.
First, I would note that the mere existence of a privacy
policy, even a policy that includes standard components, is not
as impressive as it once was. Not long ago the privacy debate
centered on whether a website posted a privacy notice. Having a
policy and providing notice was the best practice. Privacy
policies were once a rarity.
Last year, all of the 100 most popular sites posted such
notices, yet concern remained. Notices did not adequately
discuss protections or key components emerging as industry
standards. In response, industry groups developed self-
regulatory policy, standards, and detailed components of the
notices.
Seal programs such as BBB online and trustee provided a
seal of approval to sites that pledged to include certain
requirements in their privacy policies. But with all of the
improvement in the quality and quantity of privacy notices, why
does public concern remain high? If effective policy practices
have been identified and incorporated into policies, shouldn't
that be enough?
This brings me to my second point, that promises alone
don't earn consumer trust. Today too many consumers don't trust
that organizations will follow through on their promises.
Providing notice, choice, access, and security will only work
if consumers can trust that companies will enforce them.
Leading companies are recognizing that it is not enough to
say what they will do with personally identifiable information.
Businesses must also prove to consumers that they are doing
what they say they are doing. Leading companies now provide
consumers and other stakeholders with more assurance about
their actions. They are proactively having third parties test
their assertions regarding the people, the processes, and the
technologies that operate and enforce their stated policies.
This testing requires that a company earn a compliance
report as compared to promising to comply with a set of self-
regulatory requirements stated on the website veneer.
Businesses increasingly looking for a more effective private
sector solution to privacy are turning to independent third
parties for verification of their practices.
Independent verification is not a new idea. More and more
companies undertake independent verification because they
realize it leads to enhanced consumer trust, which in turn can
result in more loyal customers and a return on their
investment. For example, a large international client credits
our independent verification services with contributing
significantly to its ability to double its online closing-to-
sale ratio and increasing website revenue by more than 45
percent.
In areas where Congress and the executive branch have
regulated treatment of sensitive financial and health data,
such as Gramm-Leach-Bliley and HPPA regulations, you have
required that more than their promises are in place to
safeguard consumer information. You have focused on actions,
which brings me to my final point.
Since building trust requires more than promises, the
mechanism selected to protect consumers should include
independent assurance or independent verification. And there
are several ways to police or assure compliance with privacy
policies: through the courts and increased litigation, through
increased powers of the Federal Government, or through
government facilitation of private sector solutions to this
public policy concern.
Determining which of these compliance measures to employ,
whether individually or in combination, is the policy question
faced by government and industry. If it is determined that the
private sector is the appropriate venue, industry groups simply
pledging to meet tailored promises will likely not be
sufficient in the eyes of consumers to achieve the goal.
As I previously indicated, companies will need to provide a
high level of assurance that its people, processes, and
technologies are operating effectively. The auditing profession
has developed a set of principles and criteria for online
privacy.
The AICPA and the Canadian Institute's Web Trust Program
for Online Privacy, which was mentioned earlier in opening
remarks, provides a global best practice, a set of generally
accepted privacy principles against which companies and self-
regulatory groups can interpret and implement policies,
procedures, and controls to maintain compliance with online
privacy practice standards.
The AICPA standards are the established criteria used by
auditing firms globally in more than 13 countries to test that
an organization operates in compliance with online privacy
assertions.
In conclusion, independent verification is an emerging best
practice. Ultimately, just as notices and standard policy
components and test seal programs took time to emerge and be
accepted into the framework for internet privacy, so will third
party independent verification.
The adoption of independent verification as a best practice
can provide increased assurance to consumers and to
policymakers alike, and, importantly, it can help stave off
more draconian governmental measures that could unduly impede
private sector initiatives.
I appreciate the opportunity to be here this morning, and I
welcome your questions.
[The prepared statement of Jerry R. DeVault follows:]
Prepared Statement of Jerry R. DeVault, National Leader, Innovative
Assurance Solutions
I. INTRODUCTION
Good morning Mr. Chairman, and thank you for the opportunity to
appear before your subcommittee on the topic of industry best practices
in your series of hearings on the important issue of privacy. I am
Jerry DeVault, National Leader of Innovative Assurance Solutions for
Ernst & Young LLP. As one of the ``big five'' accounting firms, Ernst &
Young is a leader in providing accounting and assurance services around
the globe, with 78,000 employees based in 130 countries. While the
Internet revolution has been occurring, Ernst & Young has been adapting
to offer our clients a variety of assurance services aimed at assisting
our customers in establishing trust with consumers, businesses, and
regulators on privacy and trust issues. Our clients include many of the
Fortune 500 companies as well as many new and emerging companies. As a
result of providing our services to numerous companies, Ernst & Young
has a unique perspective on the best privacy practices of various
industry sectors. Today, I would like to share this perspective with
you, explain how industry practices have evolved over the past several
years, and describe our premiere service in this area, the provision of
independent third-party verification services.
II. THE MERE EXISTENCE OF A PRIVACY POLICY ( EVEN A POLICY THAT
INCLUDES STANDARD COMPONENTS ( IS NOT AS IMPRESSIVE AS IT ONCE WAS.
Not long ago, the privacy debate centered on whether a web site
posted a privacy notice. The idea was that consumer concerns would be
alleviated if sites merely explained their practices in public notices.
At one point, privacy policies were a rarity. However, by last year,
according to the Federal Trade Commission's 2000 report to Congress,
all of the 100 most popular sites posted such notices.
Nonetheless, consumers and policymakers remained concerned because
many of these notices did not adequately discuss protections or contain
the key components emerging as industry standards. In response,
industry groups began to develop self-regulatory privacy standards
detailing the components of the notices. Seal programs such as
BBBOnLine and TRUSTe began to provide a seal of approval to sites that
pledged to include certain requirements in their privacy policies.
Leading businesses also began to undertake other best practices to
ensure that their publicly posted privacy notices were being followed.
These measures included developing internal procedures and training for
employees to follow the requirements of the organization's privacy
policies. Additionally, many businesses have empowered a chief privacy
officer or other dedicated official to develop and oversee internal
compliance processes.
Yet, even with this progress, consumers' and policymakers' concerns
surrounding privacy have not been alleviated. The obvious question is:
if effective privacy policies are posted on sites that compose the
overwhelming majority of Internet traffic, why does public concern
remain so high?
III. PROMISES ALONE DON'T EARN CONSUMERS' TRUST
One reason that concerns remain high is that consumers don't trust
that organizations will follow through on their promises. Making a
declaration to provide notice, choice, access and security will only
work if consumers can trust that companies will enforce them.
In the private sector, leading companies are recognizing that it is
not enough to say what they will do with personally identifiable
information; businesses must also prove to consumers that they are
doing what they say they are doing. Leading companies now find it
valuable to provide consumers and other stakeholders with more
assurance about their actions. They are proactively having third
parties test their assertions regarding the people, processes, and
technologies that operate and enforce their stated practices. This
additional step of robust testing requires a company to ``earn'' a
compliance report as compared to simply agreeing to comply with a set
of self-regulatory requirements stated on the web site ``veneer.''
Businesses, increasingly looking for a more effective private sector
solution to privacy, are turning to independent third parties for
verification of their practices.
Independent verification is not a new idea in the e-business arena.
More and more companies undertake independent verification as a best
practice because they realize that it leads to enhanced consumer
trust(which in turn can result in more loyal customers and a return on
their investment. For example, a large international client credits our
independent verification services with contributing significantly to
its ability to double its online ``closing the sale'' ratio and
increasing Web site revenue by more than 45 percent. In addition, our
clients recognize value in other ways such as differentiating
themselves from their competitors and proactively managing the risks of
online business.
Even in those areas in which Congress and the Executive Branch have
regulated the treatment of particularly sensitive information like
financial and health data, lawmakers have required more than mere
promises to safeguard consumer information.
Both the Gramm-Leach-Bliley Act and the HIPAA regulations are
focused on actions--they require that organizations have appropriate
controls and systems in place to ensure data is handled appropriately.
When the Department of Commerce negotiated a Safe Harbor for compliance
with the European Data Directive, they required that qualifying
companies certify that their practices comply with the Safe Harbor
principles. And certain self-regulatory organizations recognize that a
promise to follow policies is not enough. When the Network Advertising
companies found themselves under regulatory pressure, they wrote into
their self-regulatory program a requirement that participating
companies undergo independent verification of their privacy practices.
IV. SINCE BUILDING TRUST REQUIRES MORE THAN PROMISES, THE MECHANISMS
SELECTED TO PROTECT CONSUMERS SHOULD INCLUDE INDEPENDENT ASSURANCE.
There are several ways to police or assure compliance with privacy
policies: through the courts and increased litigation; through
increased powers of the federal government; or through government
facilitation of private sector solutions to this public policy concern.
Determining which of these compliance measures to employ--whether
individually or in combination--is the policy question faced by members
of this Subcommittee, the entire Congress, as well as industry. If it
is determined that the private sector is the appropriate venue,
industry groups simply pledging to meet tailored promises will likely
not be sufficient in the eyes of consumers to achieve the goal. As I
previously indicated, companies will need to provide a high level of
assurance that its people, processes, and technologies are operating
effectively.
Much like other areas where we provide assurance regarding business
practices, the auditing profession has developed a set of principles
and criteria for online privacy that incorporates an effective
assurance component. The American Institute of Certified Public
Accountants (AICPA) and the Canadian Institute of Chartered Accountants
(CICA) WebTrust Program for Online Privacy provides a global best
practice--a set of generally accepted privacy principles--against which
companies and self-regulatory groups can interpret and implement
policies, procedures, and controls to maintain compliance with online
privacy practice standards. In addition to being a set of principles
and criteria that have been reviewed by leading online privacy
organizations, WebTrust is the established criteria used by auditing
firms globally to test that an organization's people, processes and
technology operate in compliance with online privacy assertions.
Mr. Chairman, members of the subcommittee, widely adopted
independent verification as a ``best practice'' can provide increased
assurance to consumers and policy makers alike. It will reduce the need
for enforcement and investigation of information practices that could
unduly impede private sector initiatives. It will also serve as a
mechanism to demonstrate compliance if Congress ultimately finds it
necessary to legislate in this area and to assist companies in limiting
litigation risks.
V. CONCLUSION
In conclusion, independent verification is emerging as a best
practice. Ultimately, just as notices, standard privacy policy
components, and seal programs took time to emerge and be accepted into
a framework for Internet privacy, so too will independent third-party
verification. The adoption of independent verification as a ``best
practice'' can provide increased assurance to consumers and
policymakers alike. And, importantly, it can help stave off more
draconian governmental measures that could unduly impede private sector
initiatives.
I appreciate the opportunity to be here this morning, and am happy
to answer any questions.
Mr. Stearns. Thank you.
Mr. Rotenberg?
STATEMENT OF MARC ROTENBERG
Mr. Rotenberg. Thank you very much, Mr. Chairman, Mr.
Towns, members of the subcommittee. My name is Marc Rotenberg.
I am Executive Director of the Electronic Privacy Information
Center. I have also taught privacy law at Georgetown for the
last 12 years.
I am grateful to be here today, and I wanted to
particularly thank you, sir, for this series of hearings that
you have held on the privacy issue. I think it is very
important that we are able to have this opportunity to
carefully study this issue, and I appreciate the time that you
and the committee members have spent on this.
I would also like to say that while my organization and the
privacy and consumer organizations across the country that we
work with favor privacy legislation, we hope that you will
introduce a bill to safeguard the right of privacy. We also
appreciate the important role that technology plays in
safeguarding privacy.
In fact, my own group, EPIC, was one of the leading
organizations working to make strong encryption tools available
to users of the internet so that when people went online they
could do so with some assurance that their personal information
would be protected. And today on our website we make many
privacy tools available so that people will be able to protect
their online privacy.
We have never viewed the use of technology and the passage
of legislation as an either/or situation. We think they both go
together. And I would like to use a simple example that I think
will be familiar to many people about how this operates.
Think about the use of the telephone. You pick up a
telephone. You don't have to set a privacy setting on the side.
You don't have to figure out how much privacy you are going to
need for who you are talking to or who--you know, what you
might be talking about.
Federal law protects the privacy of that telephone call. It
doesn't matter whether you are rich or poor. It doesn't matter
whether you know a lot about how telephones work. The Federal
law gives everyone in this country strong privacy protection of
their communications when they use the telephone network.
Now it is also the case that when new technologies for
telephone came along, like the cordless phone, the cellular
phone, for example, that created some new privacy issues. And
so it was important to incorporate technological safeguards so
that your telephone didn't operate like a radio, like a
broadcasting device.
And so my point, simply stated, is that I think we need
both technology and law to protect privacy. And I think we need
it in particular for the internet, because I have to tell you,
frankly, what I am concerned about today, you have heard
descriptions of some very powerful privacy tools. Some of these
I think will work well; some of them not so well.
But I am afraid what we are opening the door to is a form
of privacy survivalism, which says to users of the internet, if
you are very sophisticated, if you know the difference between
128-bit crypto and 40-bit crypto, if you can change the
settings on your cookies, reconfigure your SSL, you can have
very good privacy.
But for the rest of you who are still trying to figure out
how to set the VCR that is sitting on top on your television so
it doesn't keep blinking, you may have some trouble. It is
going to be a little bit more difficult for you, and maybe you
have to get used to the idea of not having so much privacy.
And that is why we need legislation, because not all of us
are going to be able to figure out how to take advantage of
these tools. We need them built into the network. People need
to be able to use the internet like they use the telephone,
with the assurance that their personal information will not be
misused, that it won't be used for unrelated purposes, and that
their privacy will be protected.
Now, I would also like to suggest for you that as we look
more closely at some of these new privacy technologies, it is
very important to ask what type of privacy are they providing.
If I say to you, for example, that privacy means giving you a
notice about how your personal information might be used, and
then I develop a technology that puts notices on your computer
screens, on your cell phones, which is an interesting problem
by the way--if you are relying on privacy notices, what is
going to happen to people who begin doing business through
their cell phones. They are looking at a little screen and
trying to read a notice. That is a real problem.
But maybe I can do it. Maybe I can put notices everywhere.
Then the technology looks very good, because the standard that
you have set is actually quite low. It is quite easy to put
privacy notices on things. If you say, instead, that privacy
means being able to limit how information is being used, or
being able to see the information about you that is collected,
or, where possible, maybe even minimizing the information so it
doesn't stay around longer than it has to, than it is a harder
problem.
So I think it is very important as we are talking about
these two technologies, these new types of technologies, we
distinguish between those that genuinely protect privacy and
those that simply provide privacy warning labels.
Now, there is another interesting problem here to think
about, and I know the members of the committee don't want to
overregulate, and they are concerned about leaving the open
nature of the internet. And I think that view is widely shared.
But there is a bit of an irony here, and that is that in the
past privacy legislation has also given individuals safeguards
from government.
We have used privacy laws so that when government agents go
to private companies they have to satisfy a Fourth Amendment-
like standard before they can get access to your personal
information that is held by your bank, or held by your doctor,
or held by some other institution that may have aspects of your
private life that you don't want freely disclosed to the
government.
Now, by failing to enact privacy legislation out of concern
that you may be burdening industry, you are also failing to
establish traditional Fourth Amendment safeguards that have
been put in place for a whole lot of other businesses in this
country to safeguard the rights of citizens against their
government.
My final point is I think it is important when looking at
privacy tools to ask this question. Do they provide better
protection than could otherwise be provided in law? And in my
testimony I give the example which Mr. Markey referred to
earlier of the privacy provision in the Cable Act of 1984.
Small provision in there, it is like a page and a half. It is
one of the most powerful privacy laws in this country, and it
gives every person who uses cable television service a lot of
privacy rights.
I don't think there is a single product or service that was
presented to you this morning that provides as much privacy
protection as that provision that was enacted by Congress more
than 15 minutes ago. And so while we encourage these
technological developments, we think they are very important
for the future privacy, we also think that legislation is
vital.
Everyone in America should have the right to protect their
privacy online, whether or not they can afford these new
techniques or whether or not they understand them.
Thank you very much.
[The prepared statement of Marc Rotenberg follows:]
Prepared Statement of Marc Rotenberg, Electronic Privacy Information
Center, Executive Director, Georgetown University Law Center
I appreciate the opportunity to appear before the Subcommittee
today to discuss privacy issues. My name is Marc Rotenberg. I am
Executive Director of the Electronic Privacy Information Center in
Washington, and I have taught the Law of Information Privacy at
Georgetown since 1990.
I'd like to thank the Subcommittee and you, Mr. Chairman, for your
continued interest in these issues and for the series of hearings that
you have held. The privacy community remains hopeful that when these
hearings are concluded you will introduce legislation to safeguard
privacy and encourage confidence in the emerging electronic
marketplace.
I'd also like to acknowledge the work of the various companies that
are appearing today on privacy issues. While we may disagree with some
of their approaches, we recognize the ongoing effort to find
technological solutions to the challenge of privacy protection.
The focus of this hearing is on ``Industry Best Practices and
Technological Solutions.'' This is an issue that has been central to
the work of my organization--the Electronic Privacy Information
Center--since our first day and was also discussed in our book
Technology and Privacy: The New Landscape (MIT Press 1997).
While we favor legislation to protect privacy on the Internet, we
clearly understand that technology plays a critical role in
safeguarding privacy. In fact, we helped organize the online campaign
to reform the United States encryption policy so that Internet users
could exchange private communications and engage in secure online
transactions. And we have worked to encourage the development of
technical standards that allow Internet users to safeguard their data
and protect their identity. One of the most popular features on our web
site are the Practical Privacy Tools page which allows Internet users
to surf anonymously, delete cookies, encrypt private messages, erase
files, and filter ads.
DEFINITION OF PRIVACY IS CRITICAL
First, it is important at the beginning when discussing any
technological approach to privacy protection to have a clear
understanding of what privacy protection means. If you say, for
example, that privacy protection is simply telling people how you will
use their personal information and then you develop technologies that
provide notices on web sites, symbols on cell phone displays, or
technical standards for computers to exchange information about privacy
preferences, you actually do very little to safeguard personal
information. All of these approaches simply provide warnings to
consumers about how their personal data will be disclosed to others.
But if you understand that genuine privacy technologies actually
promote trust and confidence in the online environment, then you will
understand very quickly that notices do very little to protect privacy.
For example, one of the most important privacy technologies operating
on the Internet today is the Secure Socket Layer in Internet browsers
that allows two computers connected by the Internet to exchange
information securely.
Because of SSL you can enter a credit card number in your computer
and a merchant will receive the number and neither of you have to worry
that the number will be intercepted as it travels across the Internet.
It is a built-in security feature that protects the privacy of the
customer's personal information. SSL operates for Internet transactions
much like car safety features, such as air bags or seat belts. It
provides a basic level of safety that promotes consumer confidence in
the use of technology.
The problem today is that too many of the ``privacy solutions'' are
really just warning labels. They do not provide any actual technical
safeguard for personal information. There should be good privacy
technologies, such as SSL, built into the network and the services
provided to consumers.
EVALUATING PRIVACY TECHNOLOGIES AGAINST PRIVACY LEGISLATION
One critical standard for evaluating the various technical
approaches to privacy protection is to ask whether they provide at
least as much privacy for the consumer as would privacy legislation.
Consider, for example, the privacy provisions contained in the Cable
Act of 1984. Under that law, every consumer in the United States who
subscribes to a cable television service receives certain basic privacy
rights.
Cable providers must provide written notice to subscribers of their
privacy rights at the time they first subscribe to the cable service
and, thereafter, at least once a year. These notices must specify the
kind of information that may be collected, how it will be used, to whom
and how often it may be disclosed, how long it will be stored, how a
subscriber may access this information and the liability imposed by the
Act on providers.
Subject to limited exceptions, the Act requires cable service
providers to obtain the prior written or electronic consent of the
cable subscriber before collecting or disclosing personally
identifiable information. The Act grants cable subscribers the right to
access the data collected about them and to correct any errors. It also
provides for the destruction of personally identifiable information if
that information is no longer necessary. There is a clear Fourth
Amendment standard that limits the circumstances under which government
may gain access to our private viewing records. Finally, the law sets
out a private right of action including actual and punitive damages,
attorney's fees and litigation costs for violations of any of its
provisions. State and local cable privacy laws are not preempted by the
Act.
This is genuine privacy protection that legislation make possible.
Short of techniques that provide actual anonymity, I don't believe
there is a single proposal presented to you today that provides the
same level of privacy protection for consumers as the Cable Act that
was passed by the Congress more than 15 years ago.
NEED FOR LEGISLATION REMAINS
Over the past thirty years the United States Congress has done a
good job developing legislation to safeguard personal privacy even as
new technologies have emerged. We have laws to protect the privacy of
telephone calls, video rental records, automated health records, and
more. And just this past week, the Supreme Court made clear that simply
because there is new technology for surveillance does not mean that we
must sacrifice our right to privacy.
The problem is clear. Data collection by commercial firms has
become more intrusive as more commerce has moved online. The Internet
advertising industry, for example, believes there is nothing wrong with
creating an online profile of where you go on the Internet as long as
they give you the chance to ``opt-out.'' You won't know who is
profiling you. You won't be able to see what is collected about you.
And you won't know how this information affects your ability to buy
goods and services online.
And it is going to get worse.
The interview that appeared in US News and World Report this week
with a former industry insider is particularly revealing. An expert in
business practices and privacy audits Larry Ponemon told US News that
customer profiles, containing detailed personal information typically
have an 85% error rate. ``As an auditor,'' he said, ``you reach the
conclusion that it's pretty awful out there.'' When asked what the
bottom line is for consumers, he answered:
Most companies don't take privacy seriously. The general view
is: Collect as much data as you can, as quietly as possible.
It's dirt-cheap to store, and you never know when it will come
in handy. I still use the Internet, but I'm more cautious. I
won't share any medical data or do financial planning online.
I'll use my credit card only if I think the privacy policy is
reasonable, but I assume the worst.
LOOKING AHEAD
It would be tempting to say that industry is developing good
solutions, that more needs to be done, and that it is premature to
legislate, but I believe this is a short-sighted assessment of what is
currently taking place. In the absence of clear standards set out in
statute, privacy is being redefined from a set a basic rights to a
series of warning notices. The bottom line is that consumers are being
asked to trade their privacy when they go online. The companies post
privacy policies that are incomprehensible and easily changed.
It doesn't have to be this way. Congress can pass good privacy
legislation, similar to the provisions contained in the Cable Act of
1984, and still encourage the development of technological solutions.
This is the right way to go. We will need both good technology and good
legislation to safeguard privacy in the years ahead.
I appreciate the opportunity to appear before the Committee today
and will be pleased to answer your questions.
REFERENCES
Phil Agre and Marc Rotenberg, eds., Technology and Privacy: The New
Landscape (MIT Press 1997)
EPIC Practical Privacy Tools[http://www.epic.org/privacy/
tools.html]
EPIC and Junkbusters, ``Pretty Poor Privacy: An Assessment of P3P
and Internet Privacy'' [http://www.epic.org/Reports/
prettypoorprivacy.html]
Privacy Coalition [http://www.privacypledge.org]
Privacy Site [http://www.privacy.org]
Marc Rotenberg, The Privacy Law Sourcebook 2000: United States Law,
International Law, and Recent Developments (EPIC 2000).
Marc Rotenberg, ``Can We Keep a Secret?'' American Lawyer 57
(January 2001).
Paul M. Schwartz, ``Internet Privacy and the State: Charting a
Privacy Research Agenda,'' 32 Connecticut Law Review 815 (Spring 2000)
Mr. Stearns. I thank you for your opening statement. You
probably listened with interest to the preceding panel, and
particularly Microsoft when they talked about their P3P, in
effect that it is a default information privacy standard. Now,
I suspect that some of you would disagree and some of you would
agree with that.
Let me start with Mr. Hughes. What do you think of the P3P
as a default information privacy standard? Do you agree or not?
Mr. Hughes. Absolutely. The company that I work for,
Engage, actually was one of the companies that was involved in
the development of P3P. And the cookie management features that
you heard about in the Microsoft browser are a result of some
early work that Engage had done, our co-founder had done, on
something called trust labels.
So from the perspective of my company, we definitely have
been very involved in the development of P3P and cookie
management features.
Mr. Stearns. But Mr. Rotenberg I think made a very good
point in terms of talking about the Cable Act of 1984, and this
one and a half page document which outlined the privacy
provisions dealing with your cable. And I think he makes a
pretty good case that that same standard has to be applied to
the internet. Do you disagree?
Mr. Hughes. I think there are difficulties on the internet.
I think the internet, as a global medium, requires a standard
that has comparable ubiquity. And that standard is technology.
And by embedding the privacy protections in the technology, you
provide the greatest coverage possible. So I believe that the
browser is the right place to put those tools.
Mr. Stearns. So you are saying that you think government
has a role to do something like we did with the Cable
Television Act of 1984 or not? Just yes or no.
Mr. Hughes. The Network Advertising Initiative is
definitely open to the possibility of Federal legislation.
However, we would request or push for or suggest that a safe
harbor for self-regulatory regimes that are operating and
functional and meaningful, like the NAI self-regulatory regime,
be put in place.
Mr. Stearns. Mr. Cole, you know, he makes the analogy, you
pick up your phone and you don't think about privacy, but you
already have the privacy in place unless you go to the Fourth
Amendment that the government can't get involved and listen to
your phone calls--you know, tap into your phone.
Do you agree that we need a privacy bill, an internet
privacy bill here in Congress, much like we did for the Cable
Act of 1984?
Mr. Cole. I would like to respond to that in two ways, Mr.
Chairman.
Mr. Stearns. Sure.
Mr. Cole. First of all, I am not sure it is as clear-cut as
Marc would have it. I used to run Maryland's Consumer
Protection Program for the Attorney General, and I remember
that it depended often on State law whether or not you actually
had all of the privacy you wanted on those phone calls. So it
is a very--it is complicated, and it is not as clear. And I am
sure the internet----
Mr. Stearns. Well, I am sure the details of it--but as a
broad scope----
Mr. Cole. Well, it is not so clear that we have perfectly
legislated privacy, even of those areas where we tried. And
there may be a lesson about that. Either we need better
legislation or maybe legislation doesn't always work. But let
me get also to your question.
Our organization, simply as a matter of policy, does not
take position on legislation. Self-regulation could work
without legislation. We could help promote voluntary standards
for the business community in the absence of legislation, and
we could help provide compliance when there is legislation.
I would like to endorse the point made earlier--if there is
legislation from the Congress, you should follow the lead that
you took with the children's online privacy and in other
legislation, and there really should be a safe harbor for
voluntary efforts of compliance.
Mr. Stearns. Mr. DeVault, can you give us a scope of the
number of companies Ernst & Young provides privacy service for,
and how much revenues does the privacy protections practice
take in for your company? And what are the typical ballpark
costs for such services? Is that possible, to get this in a
broad way?
Mr. DeVault. Well, we are, as I mentioned, a global firm.
We have thousands of people that are focused on security,
privacy, and IT risk advisory services.
Mr. Stearns. Why don't we just take it in the United
States.
Mr. DeVault. In the United States, we have approximately
800 to 1,000 people that are, and that employs--obviously, it
keeps those people busy. That gives you a degree of the fees
that we have out of that business.
Mr. Stearns. So of the revenues in the United States, is
this--I think what we are--in the committee we are starting to
realize that this is a whole new area of revenue generation,
and that it could be a large segment in the future. When you
move to broad band, people will come to you, and so this--what
I think is an incipient industry which is going to create a
great deal of profit for people like yourself and others.
Mr. DeVault. Well, to give you an idea, the web trust
principles that I mentioned earlier were released on September
6, 2000. So they are very young, so our independent third party
verification services are very nascent as well. We have been
helping companies with their privacy policies and compliance
now for several years, since really the advent of the
commercialized internet.
And we see that this is a large business for software
companies, for marketing companies, for professional services
companies.
Mr. Stearns. Do companies tend to overpromise and
underdeliver in the privacy area? Mr. DeVault, how many
companies have failed Ernst & Young initial verification tests,
if any? How many have failed a followup verification test?
Mr. DeVault. At this point in time, we have certified as a
profession less than 10 companies. As I said, it is a very new
area for us. I would say, though, that every time we test there
are gaps between our criteria and the actions that we see, and
the good news is that we have clients that are interested in
filling those gaps, and we are helping them do that.
I think on a go-forward basis we will see what the
experience is in terms of testing as we go through. Our testing
is required every 6 months.
Mr. Stearns. Mr. Rotenberg, I think what you are sort of
saying is trust but verify, and the government has to verify in
some way by setting up a standard so that the public feels
comfortable.
After listening to the first panel, were you impressed,
though, that Webwasher--the type of things they can do, and
that maybe if that was part of an integral part of a web
browser that the legislation would be maybe not required as
much but it would help to alleviate the problem?
Mr. Rotenberg. Well, I think there were a number of good
approaches suggested on the first panel. And none of them I
think would be incompatible with privacy legislation. In fact,
I rather suspect that privacy legislation can provide a
foundation that builds support for a number of these
techniques. I mean, this has always been our view, that you
should have legislation that enables strong tools for privacy.
If you don't have the legislation, I think that is really
ultimately the decision that this subcommittee will have to
make. And if you say we are going to rely on these techniques
and hope this works, I think you are going to head toward a
world where people, in effect, will turn to their telephones,
know that there is no real legal protection there, and have to
figure out, in effect, what are the privacy settings right now?
Are the settings appropriate for the call I am about to make?
Do I need to purchase a little bit more privacy because this
call is particularly sensitive?
And you can imagine that that would evolve in the
marketplace. But I think over the long term people would be
less willing to use the telephone, because there will be no
baseline protection established in law that safeguards privacy.
So I really think that the best outcome is one that provides
that baseline assurance to everybody that privacy will be
protected and allows people to innovate and develop better
techniques and take it forward. I think that is the win-win
outcome here.
Mr. Stearns. Yes. My time has expired.
The ranking member, Mr. Towns, is recognized.
Mr. Towns. Thank you very much, Mr. Chairman.
Let me begin with you, Mr. Rotenberg. And let me say I was
very impressed with your testimony. I want to say that before I
ask this question.
Mr. Rotenberg. Thank you, sir.
Mr. Towns. You heard on the other panel, I think it was Mr.
Schwarz who said that, yes, eventually we need to pass
legislation, that laws should be in effect, but we do not know
enough now to do it. What is your response to that?
Mr. Rotenberg. Well, I would be happy to give him a couple
of copies of my books, but I think he has left the room. I
mean, I have been teaching privacy law for, you know, I said
more than 10 years. I have got a 500-page book that surveys
privacy law.
I think that Congress has done a good job over the years. I
mean, it was done for telephone. It was done for cable service.
It was done for electronic mail. There are a lot of good
principles in place, and I think we just need to take advantage
of them.
Mr. Stearns. Could we just have those two books brought up
to Mr. Towns and just let him quickly have access to them? And
then we will give them right back.
Mr. Towns. So the theory in terms of waiting and learning
more is ridiculous.
Mr. Rotenberg. Well, I don't see the benefit of waiting. I
see the caution about not passing legislation that creates
problems that might discourage innovation. But I do believe
that legislation can promote innovation, and that is the
approach I hope to end up with.
Mr. Towns. Yes. I was around in terms of the cable bill and
also the Telecommunications Act of 1996. And, of course, we
heard--some of the same arguments that are being put forth now
were put forth at that time, that we should not move forward
with the Telecommunications Act because things are just moving
too quickly, we need to wait and see.
But I don't think they are going to slow down. I think they
are going to continue to move. And I agree with you. I think at
some point in time that we have to come forward with some
legislation in order to make certain that the consumer is
protected. The question is in terms of, you know, how quick we
do it. I think that is something that we are dealing with.
But, here again, we are having a lot of hearings, and I
think we are collecting information. And then I hope that when
we do do it that we do not hurt a lot of folks. I think that we
want to help people, and that is the key.
The other issue is that, you know, what do we do with the
little folks out there that are providing information, that is
basically all they are doing. And this is, you know, their
business, and if we pass laws that a lot of them could be put
out of business. I mean, have you thought about that at all?
Mr. Rotenberg. Well, I think we need some standards in
place about how personal information is being collected and
used. I mean, I am concerned about these information brokers,
for example, that are getting access to a lot of very private
details. You know, and that stuff is being repackaged and sold.
There is a debate, as you probably know, taking place right now
about whether or not all court records should be put online.
Now, public trials in open courtrooms is critical to the
democratic system. But if you put in all of the information in
depositions, including, you know, psychologists who testify in
child custody cases, I mean, this has enormous implications for
personal privacy.
So I think we need to have, you know, a rule that will
apply to everybody--I mean, the big folks and the little folks.
Mr. Towns. Okay. Mr. DeVault, you talked about in terms of
the verification, and what are some of the things you think we
should do in order to verify whether or not a person is
actually--the consumer is protected?
Mr. DeVault. One of the things we do is we go much further
than, as I said, the veneer of the website. We really look past
just asking questions. And if a client is saying that they are
protecting data, we actually look at the data base, the machine
that the data resides on within that data base.
We determine whether it is approachable from the outside,
so we actually get into the process, we put together a robust
set of tests that we can then opine on and say that we believe
that that data has been protected in accordance with their
policies. And that is a level of testing that is much different
than I think people recognize has been occurring.
Mr. Towns. Yes. In your audit, they failed to come up to
standards. At what point in time would you say, okay, we are
not dealing with you anymore? I mean, how do you do that? I
mean, what do you do with this? I mean, I am not clear. It is
not clear to me what happens here.
Mr. DeVault. Well, if a company has engaged us to provide
them with a certification or an audit, and they are granted
that opinion, they can post a seal on their site which clicks
to our report, and a report from management that says we assert
that we are holding these promises to be true, and a report
from Ernest & Young which says that we have tested those
assertions.
If they fail to continue to maintain that posture, we will
take our report away. And so there is a consequence at this
point in time because it is voluntary. There isn't a signal
necessarily to any kind of a regulator or the government or
somebody else, other than the fact that if they had, in the
past, disclosed that they had passed the test, and afterwards
decided to not pass or fail, then our reports would come off
their website.
Mr. Towns. Thank you. I yield back. I don't have anything
to yield back, do I, Mr. Chairman? I am out of time.
Mr. Stearns. All right. Thank you, Mr. Towns.
The gentleman from Illinois, Mr. Shimkus?
Mr. Shimkus. Thank you, Mr. Chairman.
Mr. Rotenberg, you mentioned the Cable Act. I wasn't a
Member of Congress during that time. Can you tell me what the
cable industry was doing at that time to warrant this page and
a half on privacy that obviously you are very supportive of?
Mr. Rotenberg. Well, it is very interesting, sir. I have
actually studied the period. In the early 1980's when cable
television was being developed, people talked about it in a
very similar way that they talk about the internet today. You
are going to do online banking, you are going to be like
watching a football game and answer a poll question about what
the next, you know, play should be called.
People had a sense when cable television was being
developed in the early 1980's that it had interactive
capability. And there was consensus--and this is the key
answer--there was consensus then with the industry and with
Congress that because of this interactive capability, because
of the ability now with the television to collect information
from the viewer, which didn't previously exist because it is a
broadcast medium, that privacy safeguards should be
established.
And privacy safeguards, as I said, were very good, and I
don't believe that the cable industry in 1984 opposed them. So
when I come before you, sir, and testify and say basically that
I think people today for the internet should have similar
protections, it is partly because of this experience 20 years
ago that when faced with a very similar issue I think Congress
did the right thing, and I think it has worked out.
Now, people can say, well, you know, cable television isn't
doing all of those things that the internet might, but the
privacy is there.
Mr. Shimkus. I appreciate that historical look. But at the
time of the Act, the cable industry was not doing that. That
was just a forward-looking----
Mr. Rotenberg. Yes.
Mr. Shimkus. [continuing] response based upon what they
saw, the evolution. And as we see now, cable now is moving in
that shape or form somehow with interactivity, which is very
similar to high-speed internet service or the broad band
debate, and the like.
Obviously, last year we also talked about, debated, and
passed the electronic signatures and electronic records issue.
Because of that, we are transmitting actual legal documents,
signed, you know, through the vast unknown. We should still be
doing that, shouldn't we?
Mr. Rotenberg. I am sorry. Transmitting authenticated
documents?
Mr. Shimkus. Yes.
Mr. Rotenberg. I think so. I mean, I think the Digital
Signature Act provides some benefits for online commerce. That
is clear. But I don't think it resolves the privacy issue. I
mean, I think the privacy issue is still out there.
Now, I will say it was addressed in part by the past
Congress in the Children's Online Privacy Protection Act. And
there you looked at the situation involving kids under the age
of 13 and said, well, it would be nice for kids to be able to
go online and use some of these new services, but there are
justifiable concerns about the collection of their data. And so
you had legislation there to protect, you know, the privacy, so
I think that went part way.
Mr. Shimkus. I would like to turn to Mr. Cole and ask, in
reference to the compliance monitoring that you are attempting
to accomplish, first, the question is, how is that--first of
all, how is that going in that? And then I am going to really
then switch to Mr. DeVault to--in his testimony he talked about
the questions of compliance monitoring.
Mr. Cole. Yes, sir. We were talking earlier about trust and
verify. The Chairman mentioned that. And I want to make an
important distinction. Setting standards, whether it is a
voluntary organization doing it or the Congress doing it, it is
very different from verification, and we all need to take that
into account because finding out whether or not there really is
compliance with the standards requires a whole other set of
techniques than just writing the standards.
What we do is--I referred to it in my brief remarks is we
use a unique assessment device that over a period of weeks
brings the company through a series of questions that are
geared to determine whether it has set up the internal
processes it needs to comply with the promises it makes in its
privacy promise, whether it is training of staff in security
techniques within the company, and contracts with agents and
contractors with whom they may have to share information. So we
work with the company on the details of how it is implementing
its privacy policy.
Over the 2 years we have been running our program a few
hundred companies have failed to meet our requirements after
applying. They either decided they did not choose to meet them,
or we found that they were unable to meet them. We have not had
a need to withdraw a seal from a company that we granted one
to, and that is not surprising, because they have gone through
an intense process. They verified their procedures, and they
are willing to make corrections when we call it to their
attention.
Mr. Shimkus. Mr. Chairman, can Mr. DeVault respond?
Mr. Stearns. Sure. Go ahead. We will probably go another
round here, so----
Mr. Shimkus. Based upon the auditing aspect, you are
probably auditing some that have the seal and some who do not.
What is your--can you just give some input on that?
Mr. DeVault. I would just say that I think there is a bit
of expectation gap between what some of the seals may mean to a
consumer and what they are intended to do and what they
describe in the practices--what they are doing. And that has
been seen in some of the issues that have come up onsites that
have had seals on them.
We do see that there is some gap between the promises that
are being made and the actual actions within the people, the
processes, and the technologies, the real behind-the-scenes
processes. But I think that companies that are subscribing to
these seal programs really want to have good privacy policies.
Many of them are engaging us to come in and help them, make
sure that they can qualify for those seals, and then I think
that they are determining whether they want to go further and
make a public declaration of their compliance with that. And
that is what we are seeing in this next stage.
It is really an evolution from just making a policy that
has been read on a website to one that has been read and
conforms to some kind of a standard, and there is some inquiry
as to whether or not they are really doing what they say they
are doing, to the final step, which is some proof that says I
have engaged somebody independently to come in and really
robustly, in essence, rip my processes apart and determine
whether or not they are actually working.
And there are companies that are using that, not
necessarily just for a marketing purpose, but they are doing it
as a good internal practice, not publicly mentioned, as a risk
management approach to determine that the promises they are
making are promises that are kept.
Mr. Shimkus. Thank you. And I yield back, Mr. Chairman.
Thank you.
Mr. Stearns. Yes. I am just going to close here, and anyone
else can close with a question or two. Dealing with what is
called legacy data--and, Mr. Cerasale, this might be approach
for you. AT&T came in, and I was talking with them about my
cell phone.
And I said to them, ``When I delete a--when my answering
machine comes in on my cell phone and someone calls me and then
I delete it, where does it go?'' And they said, ``To a hard
disk.'' And I said, ``Well, how long do you keep that?'' they
said, ``The law has not determined how long.'' And I said,
``Are you going to keep it a year?'' They said, ``Well, right
now, we are not keeping it very long. We almost arbitrarily--in
30 days we get rid of it. But there is a possibility we might
have to keep it a longer period of time.''
So that goes to the point that if we today passed a bill,
what happens to all of the information that has been collected?
And how do we write a bill to allow today a U.S. citizen who
has all of their credit cards and all of this legacy data
protected? How do you do that? And is there much of that that
you think that would be a problem?
Mr. Cerasale. Well, keeping data is expensive, and, of
course, that is going to go--that will drop in time. But part
of the marketing process is that customers can go pretty freely
back to marketers they have dealt with before, and they have
information already on file, and so forth, that they use and it
can go quickly.
For example, purchasing online through Travelocity, I don't
have to enter a lot of data because it is already held in
there, including my credit card number. I think that the thing
that we have to focus on in this part of privacy, which I think
in the first panel we discussed security versus privacy, I
think the phone legislation is basically the security of
talking.
But if I call a catalog and give them my name and,
therefore, address and credit card number, so that they have
it, and then it goes to their privacy policy, it is totally
outside of that phone law, the law concerning telephones. You
have to--it is a problem that we do through self-regulation on
anything that you have already before. And if you go,
therefore, and change a privacy policy or have something
different, what do you do with the information beforehand? Is
it expensive to mark that data so that you treat it differently
than others?
Part of the situation that we look at is markers would
hold, in a sense, legacy data--is a customer, to try and see if
they can deal with that customer and how long it is to hold an
expense.
Mr. Stearns. How long do you hold information?
Mr. Cerasale. Well, DMA is not a marketer. It is an
association. So each----
Mr. Stearns. Well, I mean, your account, your clients.
Mr. Cerasale. The client----
Mr. Stearns. Just on the average.
Mr. Cerasale. Members will hold information--I don't think
there is any member that would hold customer information beyond
5 years, and that is probably less--it is probably less than
that because you have to try--20 percent of Americans move
every year. A phone number is good for only maybe 7 years, so
that information gets stale and it is useless after a certain
amount of time.
Mr. Stearns. Mr. Rotenberg, you know, if I want to look at
my credit report I can do that. Do you think there should be a
way for a consumer to take an active hand in tracking his or
her personal data in the marketer's data base, be able to
access and go in and to, you know----
Mr. Rotenberg. I think so. I think in particular where
personal profiles are credited. I mean, the issue of access
obviously is a question about how far do you go. Congress said
30 years ago if there are companies out there that are creating
these reports that are being used for credit determinations,
people should have the right to see those reports to make sure
they are accurate.
Now, if it is, you know, a single purchase, I think people
would say, well, maybe it is not so important. But what is
happening on the internet, and particularly with online
advertising, is companies are creating these profiles using
cookies very much like credit reports. But they don't have the
same obligation to tell you what is in that file about you, and
you don't know how that information is being used.
So I think the right of access to the profile would do a
lot to allow the individual to figure out how that data is
being used. It would keep the companies more honest. They could
still collect it. The Fair Credit Reporting Act doesn't say you
can't collect the information, but it does make the company
accountable to the person.
Mr. Stearns. Where would I go today to find out if somebody
was doing a composite of my personal information?
Mr. Rotenberg. I don't know the answer to that, sir.
Mr. Stearns. Does anyone know? Where would you go if--you
know, if I wanted to find who had a composite of my
information?
Mr. Cerasale. A great deal of information--marketing
information is held by the credit bureaus on the marketing
side, and all of them--all three major credit reporting
companies have--you go to them and see what they have in their
marketing side on them. And they all have that ability today.
Mr. Stearns. I want to thank the second panel for your
participation, and we know how busy you are, and also for
waiting through the first panel. And this is the--we have one
more internet privacy hearing, I think in July, but your
participation has been very helpful, and we look forward to
perhaps in the future calling you back--or calling you just
with any additional questions.
Thank you very much. The subcommittee is adjourned.
[Whereupon, at 1:14 p.m., the subcommittee was adjourned.]