Senator John Kerry (D-Mass.), Chairman of the Commerce Subcommittee on Communications, Technology and the Internet, today issued the following statement at a hearing on, "The Need for Privacy Protections: Is Industry Self-Regulation Adequate?"
"Until we enshrine in law Americans' right to determine for themselves whether a firm can collect their information and how it can be used commercially, then people will have only the rights that the collectors are willing to give them," said Sen. Kerry. "Industry self-regulation, though improved under the pressure of agency and policymaker advocacy, remains inadequate and can only cover those who volunteer to participate, not all collectors of our personal information."
In April 2011, Senators Kerry and McCain introduced legislation aimed to safeguard consumer privacy, the Commercial Privacy Bill of Rights.
Senator Kerry's full statement, as prepared for delivery, is below:
In the recent reports on privacy that the FTC and Department of Commerce issued, both agencies called for legislation to require companies collecting people's information to respect a set of commonsense privacy rights. Still, neither agency has endorsed either an existing bill or presented draft legislative text for the Congress to consider.
As a result, we are still reliant on industry self-regulation to give people the choices and control over their information that they should have a right to expect. Yet industry self-regulation, though improved under the pressure of agency and policymaker advocacy, remains inadequate and can only cover those who volunteer to participate, not all collectors of our personal information.
Senator McCain and I introduced comprehensive commercial privacy legislation, S.799 the Commercial Privacy Bill of Rights, close to a year and a half ago. The specific legislative language we have proposed seeks to incorporate all of the fair information practice principles as a requirement under the law but would also create a safe harbor mechanism by which industry could seek approval for different ways to implement those principles.
We have had the opportunity to work with some of the sharpest minds in business and the privacy community, as the FTC and Department of Commerce has, on what they can be doing without new law to improve Americans' sense of trust in the market. As a result of dialogue, work, and pressure, some in industry, including many in advertising, have made strides toward making real some of the rights that we proposed for consumers.
Still, we believe that even under the best self-regulatory proposals, industry is still not granting the individual real control and real choices. Some in industry have agreed not to use a person's information to target advertising to them, but they still fully intend to track consumers and their behavior and draw conclusions about them. They still intend to use that information with or without people's consent for purposes unrelated to any specific transaction or service.
Beyond choice, the issues of access to collected information remains unresolved in most voluntary initiatives. Also unaddressed are the right to sever ties to a collector and restrict his or her continued use of an individual's information. Lastly, none of the private sector initiatives cover all collectors of people's information. They only cover those willing to participate. And where rights are concerned, that is insufficient. On June 16, 2012 a New York Times story described how a data broker company - Acxiom - compiles information on individuals and has built a database of 500 million people with 1,500 data points per person. There is no simple way for those half a billion consumers to know how their information is being used, that they are being classified and targeted in specific ways, and no easy way to have the data broker remove them from those files. Those are rights we believe people should have.
And that is just one recent example the market treating people as if their personal information belongs to the companies collecting it. Until we enshrine in law Americans' right to determine for themselves whether a firm can collect their information and how it can be used commercially, then people will have only the rights that the collectors are willing to give them. I appreciate the hearing we have held and the years of work that our expert agencies put into investigating the need for a new law and reaching the conclusion that a new law is necessary. I hope that legislators will continue to support private efforts toward making privacy rights real but also do our job and make a baseline level of respect for those rights mandatory in law.