Is there a wolf outside the door? While predictions of significant privacy legislation have been lurking for years, some believe it's all just “huffing and puffing.” Yet somehow, that wolf has managed to gobble up significant data elements like age and vehicle information. Even if you believe the wolf is locked out, I predict the next Congress will blow the house down. After discussing the reality of those big, sharp teeth, my colleague Fred Cate and I identified the top 10 reasons passage of privacy legislation by the next Congress is no fairy tale.
10. The 2003-2004 Congress will be the third consecutive edition to make a run at online privacy legislation. Typically, the third Congress to take an active interest in a consumer issue is the one that passes laws.
While the issue starts online, current legislation in the House and Senate makes it clear that it will encompass all mediums. That means direct marketers will be covered by comprehensive privacy legislation.
9. Mission “Creep Around Homeland Security” will begin to irritate the civil liberties nerve receptors that reside in all Americans. The lack of real checks and balances in government will lead to hearings on how to create those balances within the executive branch. And this process could easily be merged with online and offline legislation.
8. Increasing European enforcement of their national data protection laws — including expanding that enforcement to Internet applications based outside of the European Union — will fuel the myth that privacy matters in Europe but not in the United States. Privacy might not be better protected in Europe, but it certainly feels that way.
7. Business will lose confidence that being rescued by the courts is probable. While each court case lost over the past five years is explainable, the trend is to give deference on privacy to the states, Congress and the agencies. This means companies will increasingly look to cutting their own legislative deals to protect narrow interests, making the enactment of legislation more likely.
6. Federal Trade Commission Chairman Tim Muris has empowered his agency to look for and pursue enforcement actions, and has increased his staff to meet those goals. Greater enforcement creates the impression there are more problems that need Congress' attention. Furthermore, the staff approach encourages business to seek legislated solutions they see as more moderate.
5. We have more and more state do-not-call lists and a new federal one as well, but consumers are still being bothered at dinner time. Telemarketing often is the most cost-effective way to sell services, raise money and get people out to vote. Yet people hate it and legislators know that. The friction between a highly effective marketing medium and huge consumer angst will continue to create a legislative catalyst.
4. Regulation begets regulation. Gramm-Leach-Bliley Act examinations, Fair Credit Reporting Act rules, new focus on the FCRA by the FTC and FCRA examinations will all lead to greater knowledge by regulators about how information is used in this marketplace. Fraud prevention, fulfillment, underwriting, market research and selling all require robust use of information. The sheer information-use volume will surprise regulators. This will lead to a greater sense that information collection and use is out of control and needs to be fixed.
3. ID theft continues to be a volatile — if misguided — public issue. ID theft creates consumer radicals. Everyone knows a victim and knows how much time it takes to clean up the mess. The fraud costs rest with the victimized lender, yet the angst resides with the victimized consumer. And, of course, the sympathy resides with the consumer.
2. A CEO angel — a man running a successful online lender — has put up $1 million in seed funds for a California privacy ballot initiative, and issued a challenge for the California legislature: Give me a law in 2003 or I will give you an initiative in 2004. He believes this is the best approach for his business. This ups the odds that California will pass privacy legislation covering 20% of the U.S. economy. Recently, voters in North Dakota passed a referendum demonstrating that better than 70% of the American public doesn't understand why opt-in is a bad idea, and wants more personal control. As we can see, that message wasn't lost on the politically astute outside of North Dakota.
1. And our No. 1 reason is the Jan. 1, 2004 expiration of the affiliate-sharing pre-emption of the FCRA. Why? There's a deadline for legislation. Deadlines create the need for deals. While FCRA covers only a portion of industry, it will spur the momentum for broader legislation.
Folks, there's a common theme here. Whether it's FCRA, California legislation or bad court decisions, the push by businesses for the best privacy deals will be the final legislative catalyst. Rather than resisting bad legislation, responsible users of information are now going to Congress seeking legislation. Beyond stirring up momentum for legislation, this runs two risks. It could (a) become a Christmas tree with ornaments for every regulator or advocacy organization, or (b) become a special-interest bill that meets the needs of one powerful industry, while selling out the interests of a market that uses information and technology to solve business problems. This rarely works for companies or their customers.
MARTY ABRAMS is executive director of the Center for Information Policy Leadership at Hunton & Williams, Atlanta.
