EPIC has filed a series of FOIA requests to obtain information from the Department of Defense and the agency's purchase of aggregate data on children's Internet browsing habits. The Department of Defense is paying $15,000 for data collected by N2H2. N2H2 collects data from children's Internet browsing behavior through the use of content filters installed at public and private schools and colleges across the country.
The FTC's fraud-fighting site, the Consumer Sentinel, is online. The page features access to complaint information, consumer tips, and an online fraud complaint page.
Senator Edwards (D-NC) re-introduced a bill on Monday to address online privacy and the use of cookies. The bill, S. 197, requires web sites to gain consent from users before tracking their movements with cookies.
The Australian Privacy Commissioner has given businesses a one year deadline to comply with the Private Sector Act of 2000. The Act regulates the collection, use, storage and disclosure of personal information.
Internet service providers in Australia will soon implement be repaid for costs associated with police investigations of Internet users. The payment schedule is a result of increased police investigations that require the participation of ISPs.
Following the end of the FTC's investigation of DoubleClick, the company may be implementing a new system for combining offline purchase data with clickstream information gained through the use of cookies.
In a response to a written question asked by Senator Herb Kohl (D-WI) regarding Carnivore, Attorney General nominee John Ashcroft responded that he would conduct a "�thorough review of Carnivore and its technical capabilities, and work closely with law enforcement to ensure that adequate measures are taken to secure personal privacy before the program is deployed."
A number of organizations submitted comments to the Administrative Offices of the US Courts Friday regarding public access to electronic case files. Case files sometimes contain sensitive personal information, such as Social Security numbers, medical information, financial information, and family-conflict information. Unhindered access to this information may result in risks to personal privacy.
The Federal Deposit Insurance Corporation released a privacy handbook for institutions attempting to comply with consumer financial information rules under the Gramm-Leach-Bliley Act (GLBA). Compliance with the GLBA provisions is required by July 1, 2001.
A survey of 751 web sites concluded that a high percentage of both US and EU web sites fail to protect users' privacy. The survey authors argue that existing governmental measures in place to protect privacy are inadequate.
A printing error by an American Express processing center that administers 401(k) accounts resulted in clients receiving other persons' account statements. Some clients received statements that included the Social Security Numbers, birth dates, and fund balances of coworkers and strangers. Andrew Shen, of EPIC, commented that: "More and more, the cause of privacy breaches isn't malicious intent but a programming mistake."
A Drug Enforcement Administration Agent has been charged with illegally accessing law-enforcement computer systems, wire fraud, and bribery for allegedly selling data from police databases to private investigators.
Representatives Cannon (R-UT) and Eshoo (D-CA) have introduced federal privacy legislation requiring notice and opt-out for collection of personally-identifying information. The Bill, H.R. 237, is titled the Consumer Internet Privacy Enhancement Act.
The National Association of Attorneys General (NAAG) will urge Congress not to pass federal privacy legislation that preempts state efforts to protect privacy. NAAG will argue that consumers and competition will benefit from a scheme where states play an active role in shaping privacy policy.
The Criminal Justice and Police Bill, currently being considered by the UK government, would broaden police powers to invade the privacy of citizens. The legislation allows an expansion of the DNA database, the copying and storage of computer hard drives, and allows the fining of suspects for certain misdemeanors without performing an arrest.
A security breach at Travelocity.com, a popular travel web site, allowed Internet users to view the names, addresses, phone numbers, and e-mail addresses of 51,000 members without a password. This security breach is the newest in a series of incidents involving popular web sites such as Egghead.com and Creditcards.com. Jason Catlett, President of Junkbusters, commented: "There's a rush to be first with a new feature and to get the promotion running rather than making sure all of the doors are locked before they open the front gate."
Senator Wyden (D-OR) predicts that Congress will send a privacy bill to the President this year. Wyden is calling for legislation that allows private sector initiatives and specifies opt-out choice for consumers.
Citing privacy concerns, President George W. Bush will not use e-mail while in office. Andrew Shen of EPIC commented: "E-mail is very permanent, and the executive office is not covered by the 1974 federal privacy act."
Marc Rotenberg, Executive Director of EPIC, writes in the current issue of the OECD Observer that governments have a role in protecting consumer and privacy interests but governments should not regulate content, information, or ideas.
The FTC ended its investigation into the business practices of DoubleClick, Inc., a large supplier of Internet advertising. The investigation was initiated after EPIC filed a complaint with the FTC alleging that DoubleClick engaged in unfair and deceptive trade practices for making representations of anonymity while attempting to link its database with personally-identifiable information from Abacus Direct. In its decision Monday, the FTC did not address EPIC's allegations.
Canada's privacy commissioner has received four formal requests for investigation under the newly enacted Personal Information Protection and Electronic Documents Act. The Act provides broad privacy protections for Canadians, including a requirement for express opt-in consent before businesses can collect, use, or transfer personal information and the right to access personal information held in private databases.
Update agents, programs that may track browsing habits, computer configuration, or the availability of software patches, may extract personal and other information from a user's computer. Often, the user is unaware of the information transfer, as consent to the use of update agents and "spyware" is usually buried in the fine print of a user agreement.
???�?ican Electronics Association (AEA), a trade association of high-tech companies, has announced support for federal privacy legislation. The AEA's principles call for legislation that supercedes the right of state legislatures to develop stronger protections than those set by the federal government.
In the second installment of an essay on technology and privacy, Jon Katz reviews U.S. and international privacy policies. Katz writes: "The U.S. codified the idea of constitutionally-guaranteed privacy, but other countries do a much better job of protecting it these days."
Rep. Holt (D-NJ) has introduced the Electronic Privacy Protection Act, which prohibits the manufacturing, sale, or use of information collection devices without proper labeling or notice and consent. The Act directs the FTC to establish rules for labeling and gaining consent from consumers using data-collecting devices.
The new federal medical privacy regulations allow the use of patients' information for marketing and fundraising purposes. Doctors, hospitals, and health services companies will be able to send targeted health information and product promotions to individual patients. Privacy Consultant Robert Gellman said that the rule "�authorizes a kind of behavior that was once viewed as unethical or improper."
The Judicial Conference of the United States has requested comments on the electronic case management system, which is to be adopted by the federal courts. The new system raises privacy challenges, as case information that had been previously stored in courthouses across the country may now be available to anyone with a computer. This information, including medical records, employment records, financial records, and social security numbers may be used for identity theft, data mining, and marketing.
Legislatures around the world are creating procedures for using legally-binding electronic signatures. The technology may bring convenience and security to e-commerce and business. However, EPIC's David Sobel notes: "If we get to the point where digital signatures are widely used, and everyone is expected to have one, it's likely to become a requirement for registering with Web sites�We're likely to get into a situation where you can't use the Internet anonymously any more."
eGames has settled a lawsuit alleging that the company failed to inform consumers of the presence of "spyware" in its programs. The company has agreed to stop producing software containing spyware, which included programs made by Conducent. The company has also agreed to post a privacy policy approved by the AG and provide a utility to remove the Conducent programs.
Grocery store savings cards offer discounts to shoppers in exchange for tracking consumer behavior. David Sobel, of EPIC, points out that shopping records could be obtained by court subpoena or purchased by a health or life insurance company to monitor lifestyle habits including smoking, consumption of alcohol, and consumption of unhealthy foods.
A media investigation into the security of state-run sex offender sites has shown that nine of the sites are insecure. Even inexperienced computer hackers could breach the security of some sites, raising the issue of whether criminals could erase their records or add the names of innocent persons to the offender databases.
German officials have established a education-oriented "Virtual Privacy Office" for consumers. In addition to privacy officials from Canada, Switzerland, and the Netherlands, all eighteen German Privacy Officers are affiliated with the site.
European Union officials are considering an enforcement scheme and other challenges presented by legislation that would prohibit the sending of unsolicited commercial e-mail. The officials favor the establishment of an opt-in system for the receipt of spam..
Under a new data protection ordinance, companies in the Netherlands can monitor their workers' e-mail and Internet activity. However, the ordinance requires employers to communicate details about monitoring with staff and labor unions.
Representative Holt (D-N.J.) has introduced legislation prohibiting the transmission of unsolicited commercial messages to wireless devices. H.R. 113 "would amend section 227 of the Communications Act of 1934 to prohibit the use of the text, graphic, or image messaging systems of wireless telephone systems to transmit unsolicited commercial messages."
EBay.com announced to customers that the company will change the privacy preferences of certain users who have opted out from receiving promotional materials. The company claims that the preference change will remedy a computer error that prevented new members from opting in to the receipt of promotional materials.
The U.S. Chamber of Commerce will oppose legislative efforts to implement federal standards for online privacy. Industry leaders say that legislation is unnecessary, and that the current self-regulatory scheme has not yet been given enough time to develop privacy protection.
Windows Whistler will contain "Microsoft Product Activation for Windows" (WPA). WPA links the program to the machine, preventing subsequent installations on different computers. Activation of the program requires registration with a Microsoft-run license clearinghouse.
Candice Miller, Michigan's Secretary of State, has filed suit against the federal government to block enforcement of a law that requires the State to collect social security numbers from seven million motorists. The federal requirement, part of a provision in the Welfare Reform Act of 1997, was intended to uncover citizens who owe child support payments.
The two British boys who killed a toddler in 1993 are now adults and are to be released from a detention center this year. As a result of publicity and public anger surrounding the killings, a British court has extended privacy protections to the boys, including issuing them new identities and placing restrictions on media coverage.
According to a bankruptcy settlement in the Toysmart.com case, a Disney subsidiary will offer $50,000 to Toysmart.com to eliminate its customer database. Toysmart.com's practices in regards to collecting personal identifying information from consumers were the focus of FTC privacy enforcement action in 2000.
Egghead.com, an Internet merchant, reported last month that a hacker gained access to its system, and possibly to its database of 3.5 million customers. Egghead.com spokespersons now claim that the hacker did not access customers' credit card numbers.
Hawaiian Airlines may have violated federal wiretap laws when an executive used a pilot's name to access a private web site that contained comments critical of the company. The 9th Circuit Court of Appeals ruled that accessing a private web site under false pretenses may constitute a violation of the Federal Wiretap Act and the Stored Communication Act.
In the current issue of the American Lawyer, EPIC's Marc Rotenberg
writes that privacy issues will be high on the agenda for the
incoming Administration. Key issues will include privacy safeguards
for electronic commerce, Carnivore, changes to the federal wiretap
statute, a privacy commission, and international standards for privacy protection. Rotenberg concludes, "The first President of the twenty-first
century is likely to have a big impact on the future of privacy in America."
Can We Keep A Secret?: From consumer protections to FBI surveillance, privacy will be among the next president's most pressing issues, American Lawyer, January 2001.
Many privacy policies do not inform users that their information may be shared with third parties as a result of a subpoena or a business merger. This article discusses a number of services that may share information with third parties, including highway toll-collection systems, online discussion boards, enhanced 911 service, and supermarket membership cards.
Canada's Personal Information Protection and Electronic Documents Act took effect this month. The Act provides broad privacy protections for Canadians, including a requirement for express opt-in consent before businesses can collect, use, or transfer personal information and the right to access personal information held in private databases.
Only 12 American businesses have joined the European Union Safe Harbor Agreement. The provision allows American businesses to make transfers of private data with EU citizens without violating the EU Privacy Directive.
John Ashcroft, the Bush administration�s nominee for Attorney General, has been a strong advocate of lifting export controls on encryption technology. This support for encryption may foreshadow his stand on the Carnivore system.
Representative Frelinghuysen (R-NJ) has introduced three privacy bills in the House. The first, H.R. 89, calls upon the FTC to prescribe regulations to protect the privacy of Internet users. The second, H.R. 90, prohibits telemarketers from shielding their identities from caller ID systems. The last, H.R. 91, would regulate the use of Social Security numbers and related personally identifiable information.
Representative Paul (R-TX) introduced the Identity Theft Prevention Act. The Act would require the Social Security Administration to reissue new tax identifiers to all Americans. The new numbers would be the legal property of the recipient.
Citing broad public support and a government study showing the ineffectiveness of industry self-regulation, a bipartisan group of senators and congressmen plan to introduce internet privacy legislation this year.
In a recent study 74% of respondents reported that they monitor employee's Internet use at work, 72% monitor e-mail, and 51% monitor phone calls. The survey, conducted by the Society for Human Resource Management and the West Group, was based on a sample of human resources workers from 722 companies.
The St. Petersburg Times has published an editorial arguing that the FBI cannot be trusted to use the Carnivore program within the bounds of law. The institutional editorial highlights weaknesses in the Carnivore system, and the FBI's use of the system without a warrant.
A Florida Sheriff has received a grant from the Clinton Administration to create a digital photograph lineup system. The system will assist police in identifying suspects by comparing images taken from crime scene surveillance camera with "mug shots" from arrest records and photographs from driver's licenses.
Boston University has cancelled a deal to sell its database of information on heart attack and stroke victims. Framingham Genomic Medicine had planned to sell access to the database to for-profit companies. The database, which was generated in part from public funds, includes 50 years of medical and behavioral information on 10,000 individuals.
