|
In the News:
For information about Parry's media appearances
and articles about her, visit Parry's blog
Check out Parry's Blog on Internet
Safety , and download her Podcast to your iPod from iTunes.com or the
MP3 files
|
|
|
COPPA: Parry Aftab's testimony before
the House Commerce Committee on Children's Online Privacy Matters Commerce Committee Testimony. Reprinted from the Federal News Service October 11, 2000, Wednesday ... sections redacted unrelated to Ms. Aftab. CAPITOL HILL HEARING. HEADLINE: SUBJECT: CHAIRED BY: LOCATION: WITNESSES: REPRESENTATIVE BOB GOODLATTE (R-VA) LINDA D. KOONTZ, DIRECTOR, INFORMATION MANAGEMENT ISSUES, U.S. GENERAL ACCOUNTING OFFICE; SALLY KATZEN, DEPUTY DIRECTOR FOR MANAGEMENT, OFFICE MANAGEMENT AND BUDGET; ROGER BAKER, CHIEF INFORMATION OFFICER, U.S. DEPARTMENT OF COMMERCE; ROBERT PITOFSKY, CHAIRMAN, FEDERAL TRADE COMMISSION; JODIE BERNSTEIN, BUREAU DIRECTOR, FEDERAL TRADE COMMISSION; LARRY CHIANG, CHIEF EXECUTIVE OFFICER, MONEYFORMAIL.COM; GLEE HARRAH CADY, VICE PRESIDENT FOR GLOBAL PUBLIC POLICY, PRIVADA; PARRY AFTAB, SPECIAL COUNSEL, DARBY AND DARBY, P.C.; MIKE GRIFFITHS, CHIEF TECHNOLOGY OFFICER; ANDREW SHEN, POLICY ANALYST, ELECTRONIC PRIVACY INFORMATION CENTER. BODY: Few issues in this industry generate such strong emotions as how to deal with the enormous amounts of personal information that are collected, distributed, stored every day by the Internet. This morning, later, we will hear from two of our colleagues -- Representative Clay Shaw and Representative Bob Goodlatte. Representative Shaw will explain to this subcommittee his legislation, H.R. 4857, the Privacy and Identity Protection Act of 2000, which has been reported out of the Ways and Means Subcommittee on Social Security and is currently awaiting action in the subcommittee. In addition, the subcommittee will hear from Representative Goodlatte about the Lansdowne Privacy Summit, which the National Chamber Foundation hosted for House Republicans in May of this year, and what has come from that. I understand the foundation also scheduled a similar session with the House Democrats and unfortunately got cancelled, I believe. Representative Goodlatte co-hosted, along with my colleagues Chairman Bliley, Representative Ehrlich and myself, this privacy summit and I personally want to thank him for his efforts in this endeavor. I also want to thank both of our colleagues for coming this morning and for sharing their views with us. This subcommittee has been a keen observer, for many years, of this debate -- holding hearings on this issue both in 1998, 1999 and, again, in 2000. Over the last year we have seen consumer concerns over privacy heightened and, as a result, specific federal responses. Congress has adopted two federal laws to deal with specific areas of concern -- the Graham- Leach-Bliley law, in which financial privacy laws are written, and the Children's Online Privacy Protection Act. In addition, Americans have witnessed the development of a new private sector technology -- in fact, many technologies -- to help consumers as well as voluntary standards by industry to self-police and educate consumers. In certain areas the federal government and commercial entities have come together to achieve cooperative standards to govern their online conduct. Privacy was not created with the advent of the Internet. In fact, we have been passing privacy laws, I believe, for the past 30 years. But the Internet adds a level of dissemination beyond what Americans had ever thought possible and in many circumstances beyond which they feel comfortable. While the Internet is still relatively new the issue of privacy, of course, is not. Prior to the adoption of the GLB and the COPPA laws, Congress had enacted privacy protections in a dozen other circumstances, indeed, over that past 30 years, with the Fair Credit Reporting Act in 1970 starting that process. The sharing of personal information did not begin when the Internet was established but many people remember party-line telephones and can recall door-to-door salesmen plying their wares using neighborhood directories. Businesses for decades have bought and sold their business assets including their valuable information databases about their customers. There's nothing new in that. As I've said many times before, personal information has value to both consumers and to an information economy. We live in an Internet information age and obviously information is the lifeblood of that system. A consumer's purchasing patterns, online behavior, is indeed valuable information to marketers. But at the same time I believe that consumers should have the ability to control that information or at least to be potentially compensated for giving away personal information if it indeed is a valuable asset. One of our witnesses, who will testify later this morning, has a business model that operates on consumers being compensated for sharing their personal information. The issues as we move forward in this debate in coming years are these: has industry done enough to protect consumer privacy or should government step in to establish minimum standards to protect against the bad player? And if there are standards that work for private industry should they also be applied to government's collection of personal information? After all, I can choose whether to give information to a private company but in many government agencies I don't have a choice. I'm obliged to provide them with personal information. Does the government have a higher standard in play here to protect the privacy of my information? Well, hopefully this morning we'll shed some light on these matters. While a tremendous amount of attention over the past year has been paid to the privacy of consumers in dealing with private industry, very little has been paid to the federal government's collection of personal information. The last time I checked very few consumers, indeed, were providing information to the IRS strictly voluntarily. Consumers, indeed, can vote with their feet in the private sector and go to another business if they don't want to share private information with them. But can you refuse to do business with the IRS or the EPA or the Medicare program, for that matter? And if you do can you refuse to provide them with information they require of you in order to do business with them? Earlier this year,
Representative Dick Armey and I asked the GAO to conduct a survey of the
privacy policies of federal websites and then compare it to the fair
information practices recommended by the FTC for commercial websites. Well, from the results of the survey -- which we will discuss today -- it appears that the federal government does not practice what it preaches. Our report is not the only GAO report that has produced failing grades for government websites and databases. The Horn report on database security and the Lieberman report on OMB privacy requirements have also both shown that the government is not doing an adequate job of protecting America's personal information. On just two issues in recent weeks the government has flunked. On the placement of cookies on government websites, the results are troubling. Despite OMB memoranda in 1999, in June of 2000, prohibiting the placement of cookies on federal websites, the practice continues today at the IRS and possibly at other government websites. In fact, we learned in the GAO report, I think, that 14 percent of the websites surveyed potentially permit cookies on their federal websites. And just last Friday the AP reported that the White House website itself violates COPPA by collecting personal information from children. While government websites can hide behind different standards, in these two instances they certainly do not live up to the spirit of the laws that apply in the commercial world. Chairman Pitofsky of the Federal Trade Commission has graciously agreed to testify today about the many FTC reports and activities in the past year dealing with privacy. We'll also hear from private sector witnesses who will discuss online profiling and Children's Online Privacy Protection Act and the use of technology in protecting privacy. And we will hear from one entrepreneur with an interesting take on privacy. In short, we'll be looking at both the government sector and the private sector today and we will examine just how well we stack up. In short, while there's no obvious time this year for this committee to engage probably in legislation, the remaining days of this session, this hearing will be preparatory to activities next year in which we will continue our efforts to guarantee that both the federal government and the private sector respect the privacy of American citizens. I want to close by inviting you -- I understand the website is down this morning but -- to visit the EPA website. Our staff visited the EPA website, I believe, yesterday and discovered that there is on the EPA website a section called "explorers' club" which invites children to give information about themselves to the EPA. Nowhere on this website is there a disclosure that children should first get the permission of their parents before sharing their private information with a government agency. There's something wrong when federal agencies can't obey the law that we impose on private citizens.... REP. TAUZIN: And now we'll hear from Ms. Parry Aftab, the special counsel for Darby & Darby of New York, New York. Ms. Aftab? MS. PARRY AFTAB:
Thank you very much, Mr. Chairman, and thank you for
inviting me to testify here today. REP. TAUZIN: This is the book you're talking about, right, that you've authored? MS. AFTAB: It is, Mr. Chairman. Thank you very much. REP. TAUZIN: Thank you. MS. AFTAB: There are roughly 25,000,000 children on line in the United States. These are children under the age of 18. There are websites that are very valuable to children. They can help them with education. They can give them games. They can be very entertaining. Children can have websites where terminally and seriously ill children can communicate with each other and can talk to children around the world. We're here to talk about problems, but I'd like all of us to remember that the internet is a wonderful place, especially for children, and the greatest risk our children face with connection with the internet is being denied access. No one cares more about children than the children's internet industry except perhaps the FTC, who I would like to compliment during my testimony here today for being always available, always listening and always trying to help the internet industry as a whole. They're willing to speak at all of the conferences. They're willing to do many things, and in fact today I bear an invitation from the government of Singapore for the FTC to come and teach them about regulating privacy in the area of children. But there are serious problems that the children's internet industry is facing. This morning on Good Morning America they talked about .gone and the problems with the internet industry generally. The children's internet industry is facing even greater problems because they have no generally accepted, viable business model. Advertising isn't working because children aren't directly engaging in e-commerce. There are lots of problems in this area, and one of the things we need is more flexibility on the part of the FTC to have greater discretion and exceptions under COPPA (ph). Today there's been a lot of discussion about parental consent. One of the biggest problems that we face is that parents, although they want their children to do these things, are not taking the time to actually give the consent to the website, and the choice is then locking children out of these interactive tools. It's not merely a matter of children sharing personally identifiable information. It's a matter of whether or not they can send e-postcards or whether or not they can get a picture from Elmo. It's important that we get parents involved and find compelling reasons for them to be using the internet. We need several things that Congress, especially this subcommittee and your expertise, can help us with. Number one, we need research on how children are actually using the internet. We need research on what parents really want and what it will take to get them to be active in the kids' space. We also need educational programs teaching children how to surf the internet safely, how to use the best filter that exists, which is the one between their ears, Mr. Chairman, and teaching them how to use critical judgment when they're communicating with strangers on line. We also need to give a lot more flexibility and discretion to the FTC in carving out exceptions or special rules under COPPA (ph) for companies to put children's safety and privacy first for word innovation rather than putting extra strain on the industry. What we need to do is to work together to make sure that the expertise that each of us brings to the table is used to help children, to help the internet industry and to help everyone preserve their privacy and keep children safe at the same time. We are also creating the children's internet industry trade association -- it's called KITA, the Kids Internet Trade Association -- to help members of the kids' internet industry come up with solutions, work together and work together with regulators and legislators on coming up with solutions that work. The greatest problem we have in the area of privacy is unexpected consequences when legislation has not been as thoroughly thought out as Mr. Chairman has been looking at here, so I welcome the ability to help in any way I can at any time, and thank you very much. REP. TAUZIN: Thank you, Ms. Aftab. There's several things we've learned today that I think are important. One is that we can have all the privacy notices required in the world, and the bottom line is people are not necessarily going to read them. They do get changed, and they are confusing, and most consumers will not be adequately served if that's the way we solve this problem. Two is that there are some things that do help a lot. I mean, you've brought some to our attention, some software, some hardware technology and seals. We know seals work pretty good. We heard from Chairman Pitofsky today that only eight percent of the companies surveyed, the websites are using seals. Why is that so low? That would seem to be a real easy thing for consumers to build confidence in websites and in advertisers and in commercial enterprises if they saw and recognized the seal on a site without having to go read all this policy and understand it and opt in or opt out or what have you. If what we're looking for is a user friendly world on the internet in the area of privacy, would not seals, some simple way of understanding what I'm visiting and what my rights are here without having to learn it all and understand all those terms, wouldn't that seem to be a very positive and sort of appreciated thing on the web, and why is so small a percentage of websites choosing to get an approved seal on their site? Anyone? MS. AFTAB: Mr. Chairman, if I may, Parry Aftab. What we're finding is consumers don't recognize the viability of certain seals. There is no one Good Housekeeping seal of approval that has emerged -- REP. TAUZIN: There's a bunch of them. MS. AFTAB: -- that's recognized generally by consumers. REP. TAUZIN: Yes. MS. AFTAB: Once consumers can find various seals that mean something to them, then the seals will become a market issue. REP. TAUZIN: Let me give you an example, for example. Instead of having the problem you cited where parents have to always consent to let their kids visit a site and share information, if there was a kiddy seal that parents knew and recognized to be representative of a site where in fact their kids are not going to be abused and information is not going to be mishandled and what have you, if they knew that wouldn't parents appreciate that instead of having to constantly okay a child's visit to a site? MS. AFTAB: Absolutely, Mr. Chairman. REP. TAUZIN: Are we going to ever get there? MS. AFTAB: We have a seal that's going to be coming out under Wired Kids, which is safety and privacy, a quality site, which is a subjective test, but put together by librarians and teachers and child advocates that say this is a good site. Trust us. We can brand it for you. That will be coming out of the Wired Kids non-profit group. REP. TAUZIN: And I suppose the same thing could happen with software and hardware; that if at some point the private sector were to build consumer awareness of software and hardware technologies that are available that parents and consumers generally would prefer that than reading extensive notices and constantly checking to see if the terminology has changed or the notice has changed. Is that right? Mr. Griffiths? Any one of you? MR. GRIFFITHS: Yes. I would -- REP. TAUZIN: Ms. Cady? MR. GRIFFITHS: Being a technologist, I have some faith that technology will provide part of the answer. I mean, I think there's a reason why people don't read a lot of privacy policies either. Even if we encourage every website on the planet to have privacy policies, the nature of the web is very fluid, and it's very dynamic. If you're searching you don't stop and read the privacy policy -- REP. TAUZIN: Well, you can't. MR. GRIFFITHS: -- at the top of the page. REP. TAUZIN: You don't have time. MR.
GRIFFITHS: Exactly. MR. GRIFFITHS: Exactly. So I believe that technology such as P3P that allowed for automated negotiation of preferences with respect to a site policy are part of the answer. REP. TAUZIN: They're all part of the answer, but the concern I have -- Ms. Cady, I want you to come back because I know you wanted to answer my question, too. Part of my problem is when do consumers really understand which of the solutions works for them and have the confidence in them? I don't see that happening yet. I don't see people generally saying you know, there is a good seal out there. There is a good software. There is a good -- MR. GRIFFITHS: Right. REP. TAUZIN: -- program that I can attach to and feel comfortable with without having to study and read and constantly update my permission, if you will, on a site. MR. GRIFFITHS: I think the answer today is that the internet is still changing. REP. TAUZIN: Yes. MR. GRIFFITHS: It's ever changing. It's ever expanding. REP. TAUZIN: It's too little too late, as someone pointed out to me. MR. GRIFFITHS: Well, I think we see approaches from a regulatory perspective, from a self-regulatory perspective, from a technology and an awareness perspective, but then I think it will take some time for this to work through. I really do. REP. TAUZIN: Ms. Cady, you wanted to come in. I'll get you next, Mr. Shen. MS. CADY: I do. I want to say -- first of all, I want to give a personal response -- REP. TAUZIN: Okay. MS. CADY: -- rather than a corporate response to why I think there is a lack of understanding of seal programs on the part of people who are in business. Not on the consumer end. REP. TAUZIN: Okay. MS. CADY: On the consumer end we have the branding problem, and we all know that consumer branding of anything takes time and -- REP. TAUZIN: It takes time. MS. CADY: -- money and effort. Certainly the seal programs are working toward that. From the other perspective of businesses, it's hard to know which seal might be relevant, and then it's can I actually participate because there is a cost involved to the website owner, and if they are a very small organization they may deem that joining a seal program is not something they could do at some point. REP. TAUZIN: But if legislation, for example, provided safe harbor from government regulation if you were sealed properly -- MS. CADY: That certainly would help with the branding problem. REP. TAUZIN: That certainly would help, wouldn't it? MS. CADY: Yes. REP. TAUZIN: That's one of the things we're looking at and one of the things -- MS. CADY: Right. REP. TAUZIN: -- that might help a great deal. MS. CADY: On the issue of expanding protections, what Privada is working towards, quite frankly, is to not have to have you worry about a seal if you are a consumer or not have to worry about knowing where the technology is, but what we're trying to do is build in down another layer so that it will be with you all the time. So our vision is that privacy is provided for you by your financial service provider and/or your internet service provider and/or other service providers that are available to you and which you use, and you use it in conjunction with the tools that you're already using, your current browser, your current e-mail clients, so that you have that protection if you want, and it's available to you easily. Now, we again have a sales and branding and growth problem so that we can't say to you that today, Mr. Chairman, we can do this for everyone in this room and everyone listening to this hearing, but that's certainly where we're going. Thank you. REP. TAUZIN: Mr. Shen, you wanted to add something? MR. SHEN: Yes. I just want to add on to your other comments, Mr. Chairman. Obviously I think what we're trying to address here are really the needs of the consumer, and I think consumers, while they have appreciation for the fluidity, the dynamic nature of the internet, really don't want that fluidity and dynamic nature to touch their personal information. They want guarantees. They want standards. REP. TAUZIN: Yes, but let me tell you something about that. We're having a hard time gauging what consumers really want in this area, and I'll tell you why. We found this out in a lot of our political surveys. When you ask consumers questions about this, they often tell you what they think they should want rather than what they really want. They often answer these questions by what I'm supposed to want to protect my privacy, as opposed to yes, I would take all these efforts to go, you know, operate all these consents and these opt in and opt out. What they really want is comfort, ease. They want to be able to use these systems with some confidence, but also with ease, and user friendliness is a huge consumer desire we're finding in our meetings and town hall meetings and discussions and everything else about this. When you really pin people down they say yes, indeed, I want my privacy protected and protected at all costs, but they'll also tell you when you really get away from any kind of public surveys where they're answering what they think you want them to say is do you know what I really want? I just want this to be easy. I don't want all this trouble. I don't want to have to work too hard to be able to use these systems. I don't want to have to work too hard to access, for example, credit or to access the store that sells me what I want on the web and to get the information I want. I am willing to take some risk and do that. If you can make it, you know, reasonably secure for me, reasonably, you know, comfortable that I'm not going to get burned on this, if you make it easy I'm pretty happy. That's what we're hearing. I mean, it's a real tension and so it's hard to understand what the consumers really want in the way of legislation and/or, you know, even regulation in this area. I hear you and I know what you're saying because whenever we do surveys obviously, number one, everybody wants protection at all costs. Then when you really get down to it they say yes, I really want my kids to go and visit those good websites. Yes, I really want the advertisers to know enough about me to target ads for my tastes and my wants and my desires. Yes, I don't want to have to read big notices. I don't really want to have to decide which seal is a good seal and which program is a good program. I mean, we get real conflicting signals about this stuff. As much as we think we understand it, we constantly realize we don't. The other thing I want to get into with you is the question of bankruptcies, mergers, acquisitions, change of leadership. Here we are collecting data. I may indeed agree that your company, your website, can collect all my data because I trust you with it. I trust you're going to manage it well. Next week you die. Somebody else takes over the company. The next week the company merges with another company. You mentioned merging the personally identifiable data with non-personally identifiable data problems, but you've got a range of issues here, not just bankruptcy, but issues where we changed the management of the company. The stockholders may change. They may merge. They may sell the company, all sorts of different ways in which different people come into control of the information I trusted with a certain group of people or a company that I trusted only to find out that company is a new company tomorrow because it merged or it was acquired or because it went bankrupt and is selling all its assets, including my information. There are all sorts of different scenarios you can paint where information I thought was secure with this group of people in this company brand name that I trusted is all of a sudden now potentially under somebody else's control. How do we deal with that? Anybody? MS. AFTAB: Mr. Chairman, I'll put my bankruptcy practitioner hat on because before I started doing internet law I started doing Chapter 11 bankruptcy. There's a problem here in that there's a tension between the bankruptcy laws, which try to maximize the value of any asset -- REP. TAUZIN: Of any asset. MS. AFTAB: -- of a company and the ability of a trustee or the debtor in possession and the Bankruptcy Court to permit any contract to be modified so that you can say it will never happen, but under the bankruptcy law -- REP. TAUZIN: It can happen. MS. AFTAB: Right. REP. TAUZIN: A .com company's physical assets are very often much less valuable than the information assets, the intangible assets. In fact, there's a huge debate over how to properly assess the value of a company. How do you measure intangible assets? As you know, FASB has got a big debate on its hands. We've engaged them on that very question. But the point is in that .com companies the information base is the asset, and if we say as a matter of law that because you've collected that on a confidential basis with your consumer base that you can't ever transfer your company with that asset. You're basically devaluing that company significantly in commerce, are you not? MS. AFTAB: You absolutely are, Mr. Chairman. I think that's part of the tension. Part of what can be done is people can actually reach out to the members of that list through e-mail and say we're moving this, or this list is up. Not an answer, certainly not an answer, but something that at least will raise additional questions. REP. TAUZIN: But it's something we may have to address, right? MS. AFTAB: Absolutely. REP. TAUZIN: It gets down to whether or not in this case the rights of the consumer is a matter of contract or we make it a matter of law. If we take it from whatever the contract provided, whatever agreement I have with the company, and we start making law on it, it could dramatically affect the value of .com companies, the way in which .com companies are financed and the way the stock performs and everything about them. It could dramatically affect the whole .com economy MS. AFTAB: Mr. Chairman, I think also in the ToySmart case there were children involved. REP. TAUZIN: Yes. MS. AFTAB: I think there's this fear the parents have and knowledge that they have their eight-year-olds know more than they do about what's going on with the computer and the internet. REP. TAUZIN: And they do. MS. AFTAB: And they absolutely do. I mean, if you have to have something fixed, you call the eight-year-old. In this case, children were sharing information at the site, and the concern was about the parents not even knowing what the kids may have shared and that now being sold to third parties is what had frightened people as much as anything. REP. TAUZIN: We used to be afraid. I mean, when we were growing up parents used to be afraid of what we'd tell our teachers about our parents. MS. AFTAB: That's it, and the most we had was, you know, the birthday club at Howard Johnsons. REP. TAUZIN: Now we can tell people we totally don't know about anything. It's a totally different world. Thank you very much. We could keep this going a long time, I think, and we probably will before we come to some conclusions, but I will invite you to do several things. Number one, the record stays open for 30 days. If something we've said here or something you've heard here provokes some good thought and some good comment from you, please submit some more information to us. As I said, this is an extraordinary learning process. Mr. Shen, you're right. It's one reason I love this work, too, is because it's extraordinarily fascinating. I don't know where it all comes out yet. I do know that we've got enormous tensions here, and you've heard from a lot of members how we need to proceed very judiciously here and carefully here because obviously we can make some rules that don't work. We can do like that bank. We can impose some conditions on people that we think people want, only to find out not only they don't want it, but it didn't work very well for us. Finally, we obviously need some real world thought and experience from those of you working with consumers in trying to find solutions that work for them. The record will stay open. We may have some questions. We may want to submit one or two to you. I apologize for the lack of members here. That's the reason why I've always hated second and third panels because the members all leave, and I'm the only one left with you, but it's been a good experience for me. I've learned a lot, and we will try to make sure other members pick up your material and read it and learn from it as well. Thank you very much. MS. AFTAB: Thank you so much. REP. TAUZIN: If you've got something timely you want to tell me, there's a good chance. MS. AFTAB: I would just like on behalf of the entire panel to offer all of our continuing expertise to anyone who is willing to listen here on the committee. REP. TAUZIN: Thanks so much. The hearing stands adjourned. |
|
|