An online privacy bill introduced in the U.S. Congress this week received mixed reviews at a subcommittee hearing Thursday, with representatives of two trade groups saying the bill would put unnecessary regulations on the Internet advertising industry.
The Best Practices Act, introduced Monday by Representative Bobby Rush, an Illinois Democrat, would require websites to get opt-in permission before sharing commonly collected consumer data with partners such as advertising networks, payment processors and Web analytics firms, said Mike Zaneis, vice president for public policy at the Interactive Advertising Bureau.
"The Internet is nothing but a series of third-party relationships," Zaneis told the House Energy and Commerce Committee's subcommittee on commerce, trade and consumer protection. "Virtually every website requires third-party data sharing."
The bill would also allow consumers to opt out of any data collection, and Zaneis suggested that would be unworkable for many online businesses. "I think it's impossible to take information out of the information age," he said. "If you do that, you're going to get less relevant advertising, and less relevant advertising, by definition, is spam."
Rush's bill would require websites to get customer permission to change the way they use collected personal information. The bill would allow private lawsuits against companies that violated the privacy law, as well as enforcement by the U.S. Federal Trade Commission and state attorneys general. The legislation would require Web companies collecting personal data to allow consumers to correct that information.
The legislation would also allow Internet companies that participate in a self-regulatory program approved by the FTC to be exempt from private lawsuits and some other provisions in the bill.
Some Republicans on the subcommittee raised concerns that the bill would lead to many privacy lawsuits. "I'm always concerned about private rights of action because I know, in some instances, it can really create a cottage industry for lawyers seeking to manufacture privacy concerns," said Representative Ed Whitfield, a Kentucky Republican.
But many consumers don't understand what information Web firms are collecting, he added. Privacy legislation will need to balance consumer privacy with legitimate business practices, Whitfield said.
Some subcommittee Democrats and privacy advocates voiced support for the bill. The Best Practices Act "significantly advances the discussion" about the need for new privacy rules, said Leslie Harris, president and CEO of the Center for Democracy and Technology. David Hoffman, global privacy officer at Intel, said his company also supports much of the Rush bill.
But Ed Mierzwinski, consumer program director at the U.S. Public Interest Research Group (US PIRG), said the bill doesn't go far enough. Right now, U.S. Web firms can act like vacuum cleaners and suck up all the personal data they can get, he said.
"The current digital marketing system does not meet consumers' expectations of privacy," Mierzwinski added. "Most consumers believe that the government already protects their privacy. It does not."
The bill's safe harbor provisions for companies that participate in self-regulatory groups will not slow massive data collection, he said. "Self-regulation has not worked," he said. "The Federal Trade Commission ... has failed in self-regulation [efforts], as has the industry. We think we need greater oversight, greater statutory protections."
Mierzwinski disputed the concerns from some lawmakers that the bill would lead to large numbers of lawsuits. He called for a broader right for consumers to sue Internet firms than is in the Rush bill. "We don't think private rights of action enrich trial lawyers -- we think private rights of action deter lawlessness," he said. "They encourage companies to comply with the law."
But Jason Goldman, technology and e-commerce counsel at the U.S. Chamber of Commerce, said the bill, in allowing private lawsuits and enforcement by the FTC and state attorneys general, would create confusion and potentially multiple standards for companies to comply with. The bill would set up new rules for nearly all U.S. companies, because of the widespread use of the Internet to communicate with customers, he said.
"We are concerned that these additional mechanisms will serve to impose duplicative and potentially inconsistent findings of liability, as well as excessive damage awards," Goldman said.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantusG. Grant's e-mail address is grant_gross@idg.com.