BISSEX: Free-Market Privacy

For a country that gorges daily on the personal details of celebrities and politicians, America sure is a privacy-minded place. According to a recently released Lou Harris Poll, 82 percent of Americans are worried about their privacy. From June 11th to 14th in Washington, DC, the Federal Trade Commission held a public workshop on online privacy as part of its ongoing investigation into the possibility of national privacy laws. Privacy activists and civil libertarians came armed with stories of corporate information abuse and examples of international privacy precedents (including one currently under discussion in the European Community) that the US would do well to follow.Though the FTC has not been specific about what kinds of regulations it might create, data gatherers are assuming the worst. Therefore attending representatives from companies with an interest in data-gathering had a delicate task before them. With the specter of government regulation hanging over their heads, they needed to prove their ability to self-regulate. The biggest of these recently unveiled attempts at staving off regulatory action is the Open Profiling Standard (OPS), which has garnered the support of more than 100 companies -- including Netscape and Microsoft, who rarely cooperate on anything. In addition, the standard has been endorsed by the Center for Democracy and Technology and the Electronic Frontier Foundation, two prominent public-interest groups.OPS is designed to make it easy for individuals to give personal information to Web sites, but also addresses common privacy concerns. Instead of re-typing your name at every site that requests it, for example, you could agree to let sites retrieve it from your OPS profile -- but you can demand to see a privacy policy endorsed by a third-party auditing organization first. And if you don't want to give them any info from your profile, they can't take it.It's an exciting proposal, in many ways. It is far above anything in use today in terms of flexibility and potential for privacy protection. But there are problems.The first is in that word "potential." OPS is so new that it isn't yet ready to be used. While it's fairly well defined, whether it flies depends on how rapidly and enthusiastically it is adopted by users and Web site owners. While one of the core companies supporting OPS has plans to release software that helps Web sites manage the complex flow of information that OPS would enable, right now it's all hypothetical. "Vaporware" as they say in the industry.The second problem is that OPS is being presented as a substitute for privacy laws. Supporters envision that it will enable a "market for privacy" wherein individuals exchange their personal information for "added value" from companies. While the thought of free-market privacy may make libertarian capitalists hot, I think it leaves a great deal to be desired. As Andrew Shapiro points out in a recent The Nation cover story, "As companies are able to charge increasingly higher rates for finer shades of privacy, poorer customers who can't afford these premiums will be left more exposed simply by dint of economic disadvantage."But the economically disadvantaged aren't really the concern of OPS promoters. One endorser told me that a survey by the Boston Consulting Group showed that consumers were willing to spend an additional six billion dollars per year if their online privacy and security were assured. Now that's a market!It will take the FTC a few weeks to digest what it has seen during these public workshops and to issue a formal report. OPS supporters are bullish that there will be no call for regulation. I hope they are wrong. A technical infrastructure (such as OPS) for supporting privacy online is a great thing,but it needs to have teeth. And no matter what those companies say, with their eyes locked on a potential multi-billion-dollar market, real protection of privacy -- for everyone, regardless of the impact on profits -- is going to be the last thing on their minds.***Sites in my SightsWho will audit these privacy policies? If TRUSTe has its way, they will, and you will see their marks all over the Web. To learn what they mean, check out the site (www.truste.org). The best site for privacy information is the Electronic Privacy Information Clearinghouse {www.epic.org). Don't Just Sit There, Sit There and Do SomethingOne of the best things you can do to protect your own privacy online is to use encryption to protect your data whenever possible. You may think it's too complicated, paranoid, or geeky, but I guarantee you'll be using crypto online in the years to come. Even if, like me, you rarely use it now, getting familiar with the basics is a good idea (www.crypto.com).If you want to enter the special fun Cyberia privacy contest, just send your credit card number, expiration date, and mother's maiden name to me. Send mail in care of this publication, drop a line via e-mail (pb@well.com), or visit the Cyberia website (www.well.com/user/pb/cyb).©1997 by Paul Bissex