FTC gives up on Net self-regulation

by Robert Lemos, ZDNN

23 May 2000 - Along with the recommendation, the report outlines the latest results of a study of major Internet sites that collect information on Web surfers.

The FTC, citing the fact that only 20 percent of sites with 39,000 or more unique visitors a month protect consumers' privacy, said this was proof positive that the industry's calls for self-regulation are not working.

"A majority of the Commission finds that self-regulation alone, without some legislation, is unlikely to provide online consumers with the level of protection they seek and deserve," said Robert Pitofsky, chairman of the FTC, in a statement.

Of the five commissioners, three voted for the recommendations in the report, with Commissioner Orson Swindle strongly disagreeing with its conclusions and Commissioner Thomas B. Leary concurring in part and dissenting in part. The five commissioners will testify in front of the Commerce Committee on Thursday.

It's about time
It's about time, said privacy advocates.

"They have all arrived at the inevitable conclusion," said Jason Catlett, president of pro-privacy service Junkbusters Corp., "that three years of industry self-regulation has not arrived at the goal that most consumers want."

"They have all arrived at the inevitable conclusion that three years of industry self-regulation has not arrived at the goal that most consumers want,"said Jason Catlett, Junkbusters Corp. According to an October 1999 survey by market researcher Forrester Research Inc., 90 percent of consumers want to control how the information collected by others is used.

A Business Week/Harris poll conducted in March 2000 found that 57 percent of respondents favored laws to protect privacy, and 56 percent would opt out of any collection scheme, if given the choice.

The report points out that the Internet industry has failed to implement all four parts of the Fair Information Practice Principles set out by the FTC. According to the federal agency's statistics, only 20 percent of all companies -- or 42 percent of the 100 most-trafficked Web sites -- follow these guidelines:

Notice
Clear and conspicuous notice of what information is collected and how it will be used;

Choice
Let consumers choose whether their information can be used for any purpose besides fulfilling the transaction.

Reasonable access
Consumers should be able to access the information collected on them and have a reasonable opportunity to correct any errors or delete the data.

Adequate security
Companies should insure proper handling of consumer information to prevent unauthorized access or identity theft.

Fighting 'Big Brother' rap
Such revealing polls have given the industry the increasingly dubious reputation as the "Big Brother" of the Internet.

Yet in its report, the FTC was careful to not blame the industry for a lack of effort.

"The question is not whether industry self-regulation passed or failed a test," added Pitofsky. "The question rather is whether the progress ... continues to suggest that no legislation is warranted."

In fact, progress has definitely been made in at least notifying consumers of companies' info-gathering practices. All the top 100 sites on the Internet included at least one privacy disclosure posted on their site, and all but three of those sites posted a full privacy policy, according to the report.

Critics: FTC too soft
But the report, seemingly tiptoeing on eggshells around the industry, has some questioning the FTC. For Junkbuster's Catlett, a whole new watchdog agency is in order.

"The FTC is the default privacy agent in the U.S. Almost every other country in the whole world has a body exclusively dedicated to privacy," he said. "I think it is something that needs to be remedied. We need an independent body."

Otherwise, consumers run the risk of becoming impersonal statistics, he said.

"You cannot justify all privacy decisions in terms of a cost-benefit analysis."