Privacy Matters: Leading CTOs and Lawyers on What Every Business Professional Should Know About Privacy, Technology & the Internet (Inside the Minds)

Praise for Books, Briefs, Journals & Guides: "Tremendous insights...a must read..." - James Quinn, Litigation Chair, Weil, Gotshal & Manges "Great information for business executives and employers of any size." - Judy Langevin, Employment Chair, Gray, Plant, Mooty, Mooty & Bennett "A rare peek behind the curtains and into the minds of the industry's best." - Brandon Baum, Partner, Cooley Godward "Intensely personal, practical advice from seasoned dealmakers." Mary Ann Jorgenson, Coordinator of Business Practice Area, Squire, Sanders & Dempsey "What C-Level executives read to keep their edge and make pivotal business decisions. Timeless classics for indispensable knowledge." Richard Costello, Manager-Corporate Marketing Communication, General Electric (NYSE: GE) "True insight from the doers in the industry, as opposed to the critics on the sideline." - Steve Hanson, CEO, On Semiconductor (NASDAQ: ONNN) "Unlike any other business books, Inside the Minds captures the essence, the deep-down thinking processes, of people who make things happen." - Martin Cooper, CEO, Arraycomm "The only useful way to get so many good minds speaking on a complex topic." - Scott Bradner, Senior Technical Consultant, Harvard University

Inside The Minds Minds Empowering Professionals of All Levels With C-Level Business Intelligence

www.InsideTheMinds.com

The critically acclaimed Inside the Minds series provides readers of all levels with proven business intelligence from C-Level executives (CEO, CFO, CTO, CMO, Partner) from the world's most respected companies. Each chapter is comparable to a white paper or essay and is a future-oriented look at where an industry/profession/topic is heading and the most important issues for future success. Each author has been carefully chosen through an exhaustive selection process by the Inside the Minds editorial board to write a chapter for this book. Inside the Minds was conceived in order to give readers actual insights into the leading minds of business executives worldwide. Because so few books or other publications are actually written by executives in industry, Inside the Minds presents an unprecedented look at various industries and professions never before available. For information on bulk orders, sponsorship opportunities or any other questions, please email [email protected]. For information on licensing the content in this book, or any content published by Aspatore, please email [email protected]. To nominate yourself, another individual, or a group of executives for an upcoming Inside the Minds book, or to suggest a specific topic for an Inside the Minds book, please email [email protected].

www.Aspatore.com Aspatore publishes only the biggest names in the business world, including C-Level leaders (CEO, CTO, CFO, COO, CMO, Partner) from over half the world's 500 largest companies and other leading professionals. By focusing on publishing only C-Level executives, Aspatore provides professionals of all levels with proven business intelligence from industry insiders, rather than relying on the knowledge of unknown authors and analysts. Aspatore publishes a highly innovative line of business intelligence publications including Inside the Minds, Bigwig Briefs, ExecRecs, Business Travel Bible, Brainstormers, The C-Level Test, and Aspatore Business Reviews, in addition to other best selling business books, journals and briefs. Aspatore focuses on publishing traditional print books with individuals, while our portfolio companies, Corporate Publishing Group (B2B writing & editing) and ExecEnablers (business intelligence stores) focus on developing areas within the business and publishing worlds.

CORPORATE PUBLISHING GROUP Outsource Your Company’s Writing & Editing To the World’s Best www.CorporatePublishingGroup.com Corporate Publishing Group (CPG) provides companies with ondemand writing and editing resources from the world's best writing teams. Our clients come to CPG for the writing and editing of books, reports, speeches, company brochures, press releases, product literature, web site copy and other publications. This enables companies to save time and money, reduce headcount, and ensure polished and articulate written pieces. Each client is assigned a CPG team devoted to their company, which works on their projects throughout the course of a year on an as-needed basis and helps generate new written documents, review and edit documents already written, and provide an outside perspective before a document “goes public” in order to help companies maintain a polished image both internally and externally. All projects outsourced to CPG are developed according to the strict specifications of the client, and delivered on a specific deadline. Clients have included companies in all industries and disciplines, ranging from financial to technology to law firms, and are represented by over half of the Fortune 500. For more information please e-mail [email protected] or visit our web site at www.CorporatePublishingGroup.com.

I N S I D E

T H E

M I N D S

Inside Inside The Minds: Privacy Matters The Future of Privacy and How Every Individual and Business Will Forever Be Affected

If you are interested in forming a business partnership with Aspatore or licensing the content in this book (for publications, web sites, educational materials), purchasing bulk copies for your team/company with your company logo, or for sponsorship, promotions or advertising opportunities, please email [email protected] or call toll free 1-866-Aspatore. Published by Aspatore, Inc. For corrections, company/title updates, comments or any other inquiries please email [email protected]. First Printing, November 2002 10 9 8 7 6 5 4 3 2 1 Copyright © 2002 by Aspatore Books, Inc. All rights reserved. Printed in the United States of America. No part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, except as permitted under Sections 107 or 108 of the United States Copyright Act, without prior written permission of the publisher. ISBN 1-58762-118-5 Inside the Minds Managing Editor, Carolyn Murphy, Edited by Jo Alice Hughes, Proofread by Ginger Conlon, Cover design by Kara Yates & Ian Mazie Material in this book is for educational purposes only. This book is sold with the understanding that neither any of the authors or the publisher is engaged in rendering medical, legal, accounting, investment, or any other professional service. For legal advice, please consult your personal lawyer. This book is printed on acid free paper. A special thanks to all the individuals that made this book possible. Special thanks to: Kirsten Catanzano, Melissa Conradi, Molly Logan, Justin Hallberg The views expressed by the individuals in this book (or the individuals on the cover) do not necessarily reflect the views shared by the companies they are employed by (or the companies mentioned in this book). The companies referenced may not be the same company that the individual works for since the publishing of this book.

Inside the Minds: Privacy Matters The Future of Privacy and How Every Individual and Business Will Forever Be Affected

CONTENTS William B. Wilhelm, Jr. MAJOR DILEMMAS FACING PRIVACY PRACTITIONERS

11

David Medine ORIGINS OF INTERNET PRIVACY REGULATION

27

Rodney A. Satterwhite PRIVACY AT WORK: ELECTRONIC MONITORING AND WORKPLACE TECHNOLOGY

43

William A. Tanenbaum NEXT-GENERATION LEGAL PRIVACY ISSUES

59

Michael J. Silverman PRIVACY CHALLENGES

73

W. Riker Purcell MANAGING PRIVACY Alan D. Boehme GLOBALIZATION, TECHNOLOGY, AND PRIVACY

91 107

Brad Slutsky 129 PRIVACY IN THE 21ST CENTURY: ADVICE TO COMPANIES AND CONSUMERS William Sterling THE MYTH OF PRIVACY

147

Ronald L. Plesser 167 PRIVACY ISSUES PAST AND FUTURE Timothy D. Casey PRIVACY CHALLENGES AND THE LOOMING TECHNOLOGICAL INTERSECTION

175

Dale M. Cendali CHALLENGES IN PRIVACY LAW

197

David M. Klein 215 PRIVACY: ADJUSTING TO CHANGES IN TECHNOLOGY

Gregory J. Glover 233 MAINTAINING THE PRIVACY OF INFORMATION NEEDED TO DEVELOP NEW BIOMEDICAL TECHNOLOGIES Acknowledgements and Dedications

259

Privacy Matters

MAJOR DILEMMAS FACING PRIVACY PRACTIONERS

WILLIAM B. WILHELM, JR. Swidler Berlin Shereff Friedman, LLP Partner

11

Inside The Minds

Deciding on Choice of Law The scope and direction of privacy law are changing so rapidly that the dilemmas facing a chief privacy officer or other privacy advisor are numerous. Some of the more significant issues facing privacy practitioners are in the area of choice of law, as well as the practical challenges facing those engaged in the development of corporate privacy policies. When first addressing privacy compliance matters, it is essential to determine what law to apply. The basic question of choice of law is significant because it identifies the proper legal framework to apply to a compliance question. In many cases lawyers apply the law of the jurisdiction in which a transaction occurs. The problem with electronic transactions is, of course, that there is often no physical location where goods are sold or documents signed. If, for example, the officer of a Delaware corporation buys goods from a vendor in France and electronically “signs” documents while on vacation in Germany, seeking delivery of the goods in Peru – what privacy law applies to the transaction? The analysis is further complicated by the fact that this information may be stored or carried by Internet service providers in other countries. If the officer submits personal financial information as part of the transaction, and she did not consent to the disclosure of this information to third parties without prior approval, can the Mexican ISP processing the transaction for the vendor nevertheless aggregate her information and sell it to others? If so, is the action a breach of contract, a tort, or some other claim? In answering these questions do you look to the law of Delaware or New York? If the state laws afford a right of action for violation of the officer’s privacy rights, are those laws preempted by a Federal statute or the law of another country? Further, can the bill of sale determine the

12

Privacy Matters

privacy rights of the officer, or are the contract provisions superseded by the rules of a particular regulatory body? While these questions are of significant interest to large law firms, law professors, and their sleep-deprived students, the proliferation of overlapping and conflicting laws is of little comfort to the thousands of large and small companies that would otherwise find electronic commerce a compelling and rewarding business medium. There is little doubt that despite the dot-com flameouts of the 1990s, electronic commerce is an extraordinarily efficient and compelling distribution channel. While the medium has created an extraordinary opportunity to collect, efficiently process, and harvest information, in my experience most companies are genuinely interested in complying with all of their legal and regulatory obligations concerning the use of this information. The current lack of legislative and judicial focus on choice of law doctrine for electronic commerce transactions has unfortunately made privacy law compliance an unavoidably complex and cumbersome endeavor for even the most knowledgeable practitioners. Setting Corporate Privacy Policy In addition to questions of choice of law, there is frequently a considerable dilemma when a lawyer or chief privacy officer must confront a first draft or revision to a corporate privacy policy. In addition to the work involved in first identifying applicable privacy laws, most practitioners are quickly confronted with drafting choices that highlight the tension of both trying to be a good corporate citizen and also satisfying marketing, sales, and legal department guidelines. This tension is further exacerbated by either the absence of any specific privacy law requirements – which can cause marketing and sales staff to exert undue or unhealthful influence in the privacy policy

13

Inside The Minds

drafting process – or by the imposition of significantly burdensome privacy law requirements, a fact that can impose cumbersome and costly procedures on data collection and sharing processes. This tension, not surprisingly, is at the heart of the legislative debate concerning privacy regulation. Federal and state legislators are grappling with the tension between freedom of speech and the public outcry over unseemly corporate data sharing and collection methods. In the United States, for example, federal legislators are struggling with whether to require opt-in or opt-out privacy schemes. In an optin framework, a person’s information cannot be shared unless he has expressly authorized disclosure. In an opt-out regime, collected personal data may be shared unless the data subject opts out of collecting and sharing practices. In the absence of formal legal requirements, a corporate privacy officer faces the dilemma of making these and other policy choices on her own. In creating a privacy policy, one of the worst things a company can do is to develop a policy that is not well thought out or that the company doesn’t have the capability to properly implement. It is a dangerous misconception that a privacy policy can be drafted with much forethought but no follow-up. In truth, it is better for companies to avoid creating voluntary privacy policies if they have no intention or ability to self-police compliance. To resolve these issues, most privacy officers would welcome, in the first instance, clear guidelines on what privacy laws are applicable to any given transaction. More specifically, where two inconsistent legal frameworks could arguably apply, it would be most helpful to easily determine which laws are preempted or how inconsistent laws are to be harmonized. In the absence of clear statutory rules, the highest courts must provide greater guidance. While recent decisions on choice of law have been encouraging, there is still no clear legal test to apply to every case. Most companies, large and small, want to do the right thing regarding customer privacy. The absence of clear rules

14

Privacy Matters

governing choice and conflicts of law severely complicates compliance efforts. In addition, there has to be a greater education effort on privacy law issues. Trade associations, federal and state regulators, corporate law departments, and outside counsel all have to be proactive. In our experience, fast-growing technology companies are eager to learn and apply privacy laws, and as a matter of course, we are constantly educating clients on privacy developments. There is no doubt that privacy is a rapidly changing field, and for that reason more than any other it is critical to have a chief privacy officer and perhaps other individuals tasked with staying current on legal and privacy policy developments, although a chief privacy officer himself cannot ensure compliance. Human resources, marketing, sales, legal, and other staff need to be educated – not only about legal requirements, but also about the company’s own internal policies and guidelines. Further, one person alone cannot be held responsible for all corporate privacy compliance requirements. Compliance must be a decentralized, shared responsibility and should be given to various departments, disciplines, and geographic locations. Furthermore, it is critical that companies think holistically about privacy and privacy policies: Corporate privacy practices are not just legal contracts; they are public relations statements, marketing documents, legal guidelines, statements of business practices, and corporate culture. In this regard it is critical to understand several overarching principles when drafting privacy policies. First, it is critical to acknowledge that privacy policies are not just consumer marketing documents. Privacy policies affect not only interactions with retail customers, but also relationships with third-party vendors and suppliers, as well as other corporate customers. For example, many corporations and government

15

Inside The Minds

buyers will refuse to do business with vendors or suppliers that do not abide by fair information practices. In this context, the failure to create, understand, implement, and enforce privacy principles will adversely affect individual purchasing decisions and may also have an impact on millions of dollars of government or corporate buying. In some industries, such as healthcare and financial services, vendors and suppliers may be required to have privacy policies; in other cases where legal requirements are not directly applicable, industries may be subject to such scrutiny that they place a substantial premium on information practices. In the final analysis, it is important to acknowledge that privacy principles affect buying decisions. Second, it is critical to understand that a privacy policy is not just a set of binding legal guidelines for information sharing and disclosure. The policies are also statements of corporate image, governance, and identity. As a result, these policies must be viewed as more than legal documents; they should also be forward-looking and should clearly contemplate future developments, as well as present data collection and sharing requirements. The failure to carefully contemplate current and future information-sharing practices can result in legal complications when companies confront the difficulty of obtaining retroactive consent to share data. Moreover, companies may find that they face public outcry when they make retroactive changes to their privacy policies. Often, these situations could have been prevented with some forethought. Companies have to carefully consider their business reputation and marketing practices when developing or changing policies. Misconceptions About Privacy Misconceptions with regard to privacy laws are many. First among them is that in America individuals believe they have a greater right to privacy than they are actually entitled to. Unlike

16

Privacy Matters

elsewhere in the world, generally speaking, Americans place great emphasis on freedom of speech. As a result, our government is restrained constitutionally in its ability to limit others from “speaking” about us, unless such speech is false. Indeed, if we willfully provide others with information about ourselves, outside of certain limited situations, there is little we can do to prevent the disclosure of that information to others. Although legislation promises to gradually expand our privacy rights, these rights are currently rather circumscribed. To many this does not seem fair; it’s a betrayal of the first degree when a survey company that called us for our “valued opinion” on foreign policy shares our personal information with telemarketers or for other purposes we didn’t originally intend. Notwithstanding our sense of betrayal, absent carefully tailored laws designed to protect our personal information, such sharing is rarely illegal in the U.S. Individuals should realize their personal information is a valuable commodity. All too often individuals are too eager to disclose personal information about themselves without recognizing the consequences. Recently people have become more aware of the value of their personal information by way of spam, junk mail, telemarketers, and identity theft. All those occurrences have started to make individuals realize we pay a price when we disseminate our personal information. Given our limited privacy rights, I have great concern about how the scope of our Fourth Amendment privacy rights seem to be contracting further with the advent of new technology that permits others to peer into our homes and offices, listen to our conversations, or read our correspondence. Our increasing dependence on technology has certainly made our hectic lives more convenient – but it has also made our behavior and communications more susceptible to oversight.

17

Inside The Minds

Recently there have been numerous legal decisions that have focused on new technology, and, in particular, the privacy rights granted to individuals using it. We are all aware that we have a reasonable expectation of privacy when we have a telephone conversion using a wired telephone, but recently legal decisions have narrowed these rights. For example, one no longer has a reasonable expectation of privacy when conducting cordless telephone conversations, nor do they have privacy from electronically-enhanced telephoto lenses. There are also limited privacy rights when you are chatting with another using an instant messaging product. Moreover, the U.S. Patriot Act allows government the ability to more easily intercept certain electronic communications. The scope of our privacy rights in the use of new technology is currently being narrowed by the courts and by Congress. Since our legal protections against unreasonable search and seizure are partly dependent on our expectations of privacy, judicial and Congressional narrowing of our rights will undoubtedly lead to even narrower individual expectations of privacy. The other significant misconception is that privacy laws and privacy policies are economically stifling and disadvantageous. I think several developments suggest otherwise. First, citizens of Canada and European countries have much greater protection of their personal information than Americans. Companies in these jurisdictions have had to contend with data and information regulation that far outstrips any comparable American scheme; yet this regulatory regime has not led to the collapse of these economies. Companies in these jurisdictions remain competitive both in their home countries and in America. Furthermore, data regulation will become a reality – if American policymakers don’t demand it, European regulators and the globalization of world economies require it. To this end, American companies that do not immediately confront privacy issues will be competitively disadvantaged, either when they expand into regulated countries or when – as I believe will occur in the next

18

Privacy Matters

several years – information collection and sharing practices become regulated in the United States. Indeed, companies that collect customer information today without express customer consent run the risk that future legislative and regulatory outcomes will require them to either expunge this valuable data, or they will be forced to retroactively obtain customer consent for the use of this data. Finally, while it is largely true that the Internet itself is unregulated, businesses and business transactions and personal data flows are increasingly subject to regulatory oversight. The lack of uniform privacy regulation in this country is actually impeding both online commerce and the adoption of new technologies. The obligation to comply with the patchwork quilt of state laws is cumbersome, if not impossible. In the absence of uniform rules, I believe the operative consumer assumption is becoming that personal information will be collected, used, disseminated, and otherwise sold to the highest bidder. The evidence that this chills commerce is more than anecdotal. Currently, when it comes to privacy in America, we don’t have a standard set of rules for the road. Today, we are largely unaware of how our information will be used, what will be collected, how it will be shared with third parties, and whether any current privacy policy might change unilaterally without notice. Although some efforts have been made to develop industry standards, there is currently no default privacy rule. The absence of uniformity is chilling individual and corporate adoption of technology that could increase productivity or otherwise improve lives or industry. When someone goes to the therapist, for example, they might be concerned about what information their insurer will share with their employer. This situation might make them hesitant to seek treatment. By having a standard set of rules that apply to privacy, society can address the privacy concerns of individuals and

19

Inside The Minds

companies efficiently. This would provide individuals greater daily comfort when presented with situations where information must be disclosed. Developments Affecting Privacy Although some technological developments, such as Platform for Privacy Preferences, or P3P, hold promise, the privacy landscape will be most significantly affected by the passage of any one of the numerous federal privacy bills currently under consideration. A number of different versions have been proposed, and they differ in many respects. One of the key issues being debated in the context of proposed privacy legislation is whether state law will be preempted. This is a particularly stormy topic, since many states have proposed more restrictive privacy regulation. Although Federal preemption would reduce administrative burdens, it would also eliminate the states’ ability to regulate commerce within their borders. A second issue affecting privacy is whether privacy legislation will adopt an opt-in or opt-out approach. Some bills under consideration right now propose a mandatory opt-out policy, meaning that a customer, once he or she provides information to a company, will have the opportunity to preclude that company from sharing the information. The other option is a mandatory opt-in, which is much more restrictive and would require companies to proactively obtain the consent of the individual before sharing information with a third party. Also proposed is a hybrid approach, where opt-in policies would apply only to “sensitive information,” including financial, medical, and other types of information. This hybrid approach is currently used in the telecommunications industry, depending on whom information is shared with and under what circumstances.

20

Privacy Matters

In addition to legal shifts, technologies such as P3P will be extraordinarily useful in helping implement any new legal privacy requirements. Right now people are frozen with indecision on privacy matters; businesses and consumers find privacy a complicated issue, partly because global economies don’t have a default rule. No one knows when they log onto a particular Web site if they will be given opt-in or opt-out rights. Furthermore, an individual needs to read every privacy policy if they want to fully understand information-sharing practices. This situation is not particularly efficient or helpful to online commerce. P3P should enable individuals to quickly and efficiently identify information collection and sharing practices. Technology will continue to create more privacy issues. Technology is obviously increasing the capability to gather and disseminate information, capabilities that are generally positive developments as our need to collect data, identify trends, and anticipate demand increases. What concerns most individuals is that this computer processing power can be used for purposes not intended by the party providing their personal data. Arguably, as a society, we need to not restrict technologies’ ability to collect this information and disseminate it or to use it in fascinating new ways that benefit our lives. Instead, we need to be able to feel secure in the information that is gathered by these devices. We haven’t let the genie out of the bottle yet; we do, however, need to develop greater legal guidelines on how information is collected and used. Technology should be allowed to continue along its developmental path, but legislators, judges, and lawyers must quickly develop laws to contain the collection and distribution of personal information contrary to an individual’s wishes. There has been an enormous debate about privacy over the past few years. It is somewhat amazing to me that it took the Internet revolution to get people to focus on privacy issues. Having engaged in this societal debate, I’m certain we will see some

21

Inside The Minds

privacy legislation that gives consumers and businesses some knowledge and control over how personal information is collected and shared. This legislation must include an individual right of redress if it is to be effective. I also believe these legal changes will drive a host of new technologies, whether P3P or something else, that will allow customers to inventory and keep track of their personal information and make sure it doesn’t go where it shouldn’t. My guess is as good as any – but I foresee technology and law coming together to give people a greater sense of comfort with respect to information privacy. Privacy Advice I went to a Jesuit undergraduate institution in New England. During my time there I took a business ethics class. In the morning we read the front page of a major newspaper, and the professor, a Jesuit ethicist, expounded on various business ethics issues that were related to the paper and the stories we read. At the end of the course he imparted the best piece of privacy advice I have ever received: “Don’t do anything you wouldn’t want to read about on the front page of the Washington Post the next morning.” In today’s environment, where we don’t have clear privacy laws, that is really the best piece of advice I can give to both individuals and companies. It is important for individuals, because without specific legislation, there is a limited level of comfort that your personal information and information about your activities won’t be disclosed to third parties without your consent. With respect to companies, they may very well have the right to collect personal information, disseminate it, use it for commercial purposes, change your privacy policy without notice, and sell collected personal information to the highest bidder – but just because you can do it, doesn’t mean you want to confront the outcry associated with the exposé on the front

22

Privacy Matters

page of The Washington Post. For both individuals and companies, it is good advice to step back and look your intended activities before undertaking them. For individuals this means working under the presumption that information you disclose may be shared without your knowledge. For companies this means looking at data collection practices and understanding both the legal and ethical repercussions of sharing or marketing this information. Once a company considers undertaking a privacy policy, it is important to make sure they are committed to implementing the policy. In the absence of a specific requirement, too many companies are eager to adopt privacy policies without ensuring that they have the internal mechanisms to enforce them. Also, all too often companies are not realistic with respect to the resources and the effort they will need to employ to make sure they can implement those privacy policies. Having an effective mechanism to implement a privacy policy involves committing time and resources. Development requires input from marketing, human resources, and legal, if not other departments. It also means ensuring that the sales teams, legal department, human resources group, Web site administrator, and others are all aware of and in compliance with these privacy guidelines. Furthermore, the company must make sure it has an ongoing mechanism to audit those various divisions. The risks of not having a privacy policy are great. But the risk of having a policy that is not implemented correctly is even greater. In considering who should handle privacy matters, I would suggest the responsibility be shared at different levels within a company, with one person performing oversight – the CPO. The chief privacy officer should be exclusively focused on these issues. Further, the CPO should have the authority to participate in decision-making on legal, marketing, and human resource issues, because privacy intersects with each of those areas in an organization. Marketing input is important to the development

23

Inside The Minds

and enforcement of privacy practices because information is collected, sold, and disseminated through marketing processes. The legal department should be included in this process, as well, because various contracts (either vendor contracts or contracts with third parties) may address issues related to information collected or information shared about customers. Obviously, human resources needs to be involved because a company may have sensitive personal data concerning employees, and this data may be subject to separate employment privacy laws. The choice of the people to lead corporate privacy initiatives does depend a lot on the size of the organization, but it also depends on the organization’s desire to address privacy issues and its commitment to incorporate privacy considerations throughout the sales, marketing, contracting, and hiring functions. Above all, good privacy officers must spot issues and implement solutions. For individual companies that do not have a chief privacy officer, it is very difficult, if not impossible, to stay on top of all the new developments in privacy. One good piece of advice is to focus on the issues that are specific to the company’s particular industry because, in the United States, much of our privacy legislation is directed at particular industry segments. Also, privacy audits by independent third parties should be conducted on an annual basis. Take a look at your existing privacy policies and contracts, and make sure your internal mechanisms are sufficient to ensure compliance with those policies. If you can’t keep up with every new rule, turn to third-party providers for advice. William B. Wilhelm is a partner in the Washington, D.C., office of Swidler Berlin Shereff Friedman. His practice specializes in the representation of telecommunications, Internet, and technology companies offering products and services that leverage software, computer hardware, or telecommunications

24

Privacy Matters

networks. His counsel includes advising companies on domestic and international privacy laws, telecommunications regulation, and telecommunications and Internet transactional matters.

25

Privacy Matters

ORIGINS OF INTERNET PRIVACY REGULATION

DAVID MEDINE Wilmer Cutler & Pickering Partner

27

Inside The Minds

Privacy Comes of Age The Federal Trade Commission recognized in 1995 that the Internet would raise major privacy issues because it provides an unprecedented opportunity to collect personal information. In dealing with merchants on the Internet, consumers would likely be concerned about how their information would be collected and used. Consumers always want to make sure they are shopping in a safe environment, whether that means that the parking lot of a shopping mall is lit or, on the Internet, that they have confidence that their credit card information will be transmitted securely, and their personal information will be handled properly. Starting in 1995, and continuing until I left the Federal Trade Commission in 2000, I led efforts to have the federal government address online privacy issues with the goal of encouraging the development of electronic commerce. The initial approach, in response to industry requests, was to encourage self-regulation: giving companies a chance to provide privacy protections themselves without the need for government intervention. This made sense because – especially in 1995 and the following couple of years – the whole electronic commerce market was changing dramatically almost every six months. Government regulation had the potential to stifle innovation and development; whereas, industry self-regulation would be far more able to adapt and modify itself as time went on, and still provide basic privacy protections. During the next several years, the FTC convened a series of workshops, typically resulting in reports that were presented to Congress with the goal of promoting online privacy protection through self-regulation. Each workshop advanced the debate on how to address online privacy.

28

Privacy Matters

In 1996 we defined privacy more specifically. It came down to four key principles: 1. Notice: telling consumers what information you are collecting about them and how you plan to use it and distribute it 2. Control: giving consumers control over their information, including choice as to whether to receive marketing solicitations 3. Access: giving people a chance to see what information you have collected about them and an opportunity to dispute and correct inaccurate information 4. Security: making sure there is no improper access to consumer information Once those principles were developed, starting around 1997, the Federal Trade Commission held a workshop demonstrating how Web sites could address these issues online. This could be done in a variety of ways, including drafting privacy policies and developing technologies, such as the early signs of what would become the Platform for Privacy Preferences (P3P), which has now been integrated into Microsoft’s Internet Explorer 6 browser. Instead of scheduling another workshop for 1998, the Commission announced in a letter to Congress that, starting in 1998, it wanted to see whether the encouragement of selfregulation was achieving the goal of protecting consumers’ privacy online. This led to the first Commission survey of Web sites, which was designed to determine whether sites were voluntarily posting privacy policies and addressing the key privacy principles, also know as Fair Information Practices. The results of the 1998 survey were disappointing. Relatively few Web sites even addressed privacy, not to mention having a privacy policy. While the Commission was troubled by this lack of implementation, in response the industry stepped up and created some industry organizations, such as TRUSTe and others, to try to improve Web site privacy practices and promote

29

Inside The Minds

self-regulation more vigorously. Because of these renewed efforts, the FTC decided to hold off on recommending legislation, choosing instead to wait and judge the effectiveness of these new measures. In 1999 Professor Mary Culnan of Georgetown University Business School did her own survey on behalf of the FTC to again assess the progress of self-regulation online. Her results showed improvement but were still disappointing. The Commission then took two steps. First, there was strong indication that Web sites directed at young children were collecting personal identifying information about kids without parental involvement. Accordingly, the Commission recommended that Congress adopt legislation to protect children online. In only four months, Congress had adopted the Children’s Online Privacy Protection Act, which basically prohibited collecting personal identifying information from children under 13 without prior verifiable parental consent. As to the interactions with Web sites by teenagers and adults, the Commission, while concerned, was still not ready to pull the plug on self-regulation. Until then, the FTC surveys were generous in their grading, so even a Web site that had a privacy policy that stated, “We don’t respect your privacy, and we do whatever we want with your information,” would have counted as addressing privacy. With the increasing national awareness of privacy issues, and with pressure growing on Capitol Hill to consider privacy legislation, the Commission decided to more rigorously assess Web sites’ privacy practices. The Commission made it known that the next privacy survey would look not only at whether a Web site had a privacy policy, but would also consider the extent to which the site addressed Fair Information Practices: notice, choice, access, and security. When the results of the 2000 Web privacy survey were announced – this survey conducted by Commission staff – the results were once again disappointing. In fact, only 20

30

Privacy Matters

percent of Web sites in a random sample addressed all four Fair Information Practices. Fewer than half the Web sites in the random sample gave notice and choice; fewer than half offered access; and only slightly more than half addressed security concerns. As a result of this survey, the Commission concluded that self-regulation alone would not achieve the goal of providing widespread online privacy protection and that legislation to complement self-regulatory efforts was called for. Congress, as well as a number of state legislatures, has been considering legislation to regulate online privacy. The Future of Privacy Consumers will always be concerned about how their personal information is handled by companies. At the same time, consumers will want to take advantage of new technologies that make life easier, make business transactions move more efficiently, and provide entertainment. Thus, as we move further into wireless, broadband, and even newer technologies, privacy issues will not only not go away – they will be heightened with companies’ increased ability to collect and use information, especially in digital format. The question is whether there will be a conflict between these new technologies and privacy, or whether there will be a way to balance privacy issues while encouraging the development of new technologies and the services they permit. An ideal solution would be for privacy features to become embedded into the products and services companies offer. One of the lessons we have learned is that the Fair Information Practices we have addressed (notice, choice, access, and security) are an excellent way to reconcile the range of consumers’ privacy concerns. Some consumers care a lot about their privacy and are very reluctant to have their personal information used. Others have no concerns about privacy and

31

Inside The Minds

wouldn’t mind if their information were published on the Internet and shared widely. The largest group consists of the people in the middle who are pragmatists. If you can give them a good reason they should give out their personal information, they’ll do it, whether it’s for a coupon, for some other benefit, or for processing a transaction; if you convince them there is a good reason, they will happily give up their personal information. The question, then, is how do you sort out those different groups? The answer is through notice, choice, access, and security. Tell people what you are doing with their information, and give them a choice. Those who don’t want their information used can exercise that choice and have it not used, and those who find it of value or don’t care will let it go forward. Pragmatists will tend to decide on a case-by-case basis whether a particular information use is sufficiently beneficial for them to give up their personal information. If you apply those privacy principles, whether it’s to wireless, broadband, or all the converging technologies, you have a mechanism to let people sort themselves out and still allow the technology to move forward. What bothers people most is the secret use of personal information, where there is no notice of information practices. If you create secret databases and other mechanisms for capturing information without letting people know about it, that is where you run into problems and trigger public-policy debates. Some people worry that we are about to experience an Exxon Valdez of privacy that will spur a dramatic public policy response from legislators. To date, instead, we have experienced a series of smaller incidents that collectively are creating a new level of consciousness about privacy. From the government’s point of view, that had translated into privacy issues polling off the charts for politicians. There are few issues about which constituents feel more strongly than privacy. We may not have one defining moment in the privacy debate, but we have seen many defining moments over the years. The FTC, for example,

32

Privacy Matters

brought a case against Eli Lilly for sending out an e-mail revealing the names of subscribers to a Prozac newsletter and a company called Toysmart.com went into bankruptcy and tried to sell its customer list, even though it had promised never to share that information with third parties. Over the years, these incidents, along with press accounts of Web sites that have been hacked into or firms that seek access to bank accounts through deception, have collectively created a new public consciousness about privacy. If you try to extrapolate, you start at a point six or seven years ago when privacy was not a major issue in people’s lives. But with the technological changes that have occurred over the past several years, privacy has become a major issue today – and we seem to be heading toward even more technological innovations and developments. So, over the next five years, privacy will continue to become more important in people’s lives. The question and challenge will be whether mechanisms will be put in place that make people comfortable with how their privacy is handled. Will people feel comfortable enough that companies or technologies are respecting their privacy that seamless transactions can occur without their having to spend time on whether their privacy has been sufficiently protected (because they have confidence that it has been)? Or will it be a constant battle? Hopefully a happy medium will be reached where people will feel comfortable about how their privacy is being handled. Technology and Privacy Issues In some ways, technology makes privacy easier to protect because you can build in technological solutions to privacy problems. For example, you can automate privacy preferences and even the ability to read the privacy policy of a Web site or a new technology. This allows consumers to exercise their choices automatically. On the other hand, new technologies develop and

33

Inside The Minds

offer greater ability to gather information. As we move forward, we may be talking about genetic information, profiling, or simply a greater and greater collection of personal information. So the technology that helps create the problem can also help solve it. One specific technology that will help businesses and consumers in privacy matters, mentioned earlier, is the Platform for Privacy Preferences, or P3P. It is a great way, in theory, to automate privacy choices, but we are discovering that it does have some drawbacks. One is that its initial iterations are not very nuanced: You end up with some very simple choices; whereas, life is much more complicated. So the challenge is to figure out a way to allow companies to innovate and have a broad range of offerings, and yet have a technology as robust as those offerings, so that people can interact with it automatically. We are just beginning to figure that out now. A long-term goal is to have privacy issues addressed without having to spend a lot of time on them. If consumers don’t want to spend time reading privacy policies, businesses don’t want consumers spending their time reading privacy polices, either. Both consumers and businesses want to spend time interacting with content and experience, but they want to do so while having the confidence that privacy issues have been addressed. This is where technology can play a very important role. It lets consumers know, and gives them confidence, that their privacy preferences are being respected. Obviously, though, we are not there yet. Some misconceptions create undue privacy concerns. One of the biggest such misconceptions is how safe it is or is not to transmit credit card information online. A substantial number of consumers are uncomfortable transmitting their credit card numbers to Web sites. This fear is unfounded because there has never been a case reported of a credit card number being stolen

34

Privacy Matters

in transit on the Internet. Yet, when consumers are surveyed, a high percentage state they are uncomfortable using their credit card number online to buy merchandise. Second, even if there were a problem, for a consumer there is typically no liability for misuse of a credit card. Federal credit card billing laws protect us from liability over $50, and in the vast majority of cases, credit card companies will waive the $50 maximum, or it might not even apply. So there is essentially no financial risk in using a credit card online. That a high percentage of consumers feel uncomfortable, however, suggests the need for better online payment mechanisms that enhance consumer confidence or better consumer education. These mechanisms must be secure, and people must understand that they are safe for conducting transactions. This is essential for the Internet, because for a commercial mechanism to be successful – whether via the Internet, interactive cable, or something else – people must have confidence in how it operates. One of the most important issues for the consumer is knowing what information is actually being collected about him or her, and this becomes a much more complicated proposition as technology develops. It used to be quite simple because if you filled out a form on paper, you knew exactly what information was being collected. But when you interact electronically, people may not always be aware of what information is being collected about them through things such as cookies, Web bugs, or other technological methods. Obviously, there are also concerns about how that information, once collected, is being used, whether it is used just to fulfill that transaction or provide the service requested, or whether it is being shared with others or used in unanticipated ways. A key privacy concern for consumers is how much control they have over marketing information being sent to them. There are growing efforts at the national and local levels to empower

35

Inside The Minds

consumers to control receipt of telemarketing calls and unwanted commercial e-mail solicitations (spam). Industry self-restraint may be required to prevent even more onerous restrictions being imposed. Many observe that they get few, if any, telemarketing calls on their cell phones. If that were to change, the utility of cell phones may change dramatically, as well. For example, if you are in the middle of a business meeting and get three telemarketing calls, you will change the way you use your cell phone. It would not be hard to envision a telemarketing law banning calls to mobile phones to prevent such disturbances. Over time, the there has been a shift in the types of privacy issues raising the greatest concerns. An issue emerging most strongly now is security; there has been a tremendous shift toward companies and law enforcers paying attention to security issues. An example underlining the importance of this shift is the e-mail Bill Gates sent to every Microsoft employee saying the company had to reorient itself to address security issues. An earlier e-mail directed reorientation to the Internet. Gates e-mails this massive companywide audience only when there are fundamental shifts in the way the company does business. The significance of this message is that as technology becomes more pervasive in our lives, not just as a mechanism of communication, people will not adopt new technologies unless the technologies are secure and consumers can have confidence that they will run properly. They must know, for example, if a computer controls most household functions, that outsiders will not be able to hack into their household operating system and wreak havoc, blasting the stereo at 3 a.m. or turning up the heat in the summer. We must recognize that for technology to become pervasive in people’s lives, it must be secure. Ensuring security is a challenge because many of these technologies have not been designed from a security perspective. They have been created as open systems, or simple systems that

36

Privacy Matters

have been built up over time. One of the biggest challenges in rolling out new technologies is to develop them in a way that not only makes it very difficult to get improper access to information, but provides a high level of operating efficiency, running properly virtually all the time. Unfortunately, it is impossible in most cases for any system to be 100 percent secure, because if someone on the other side is willing to spend unlimited amounts of time and money to hack into a system, there is at least a reasonable chance of success. You want to “up the ante” enough that it takes a huge amount of money and effort to do that, and in most cases that makes it not worth the effort. No one would ever lay claim to 100 percent protection. You want, instead, to be constantly reevaluating company security measures – constantly auditing what you are doing, testing what you are doing to see how secure it is, and paying attention to short-term security updates and patches and new long-term threats to security. A major threat to data security, which people often overlook, is internal to a company. The possibility of your own employees gaining improper access to your information poses a greater threat than hackers pose. One of the most important things a company can do is to develop internal procedures to limit access to sensitive information and to create audit trails, so there is accountability for who does have access to particular information. The companies that deal with privacy most effectively get leadership from the top. If the CEO is not concerned about privacy, then the message goes down to the rest of the company that privacy is not a priority. In companies where the CEO recognizes that privacy is an integral part of way they do business, or should do business, privacy becomes an important corporate priority. Beyond that, it depends on the size of the company and the way it is structured. One of the growing trends over the past few years is to create a new position called chief

37

Inside The Minds

privacy officer (CPO). Two years ago you might have found only a dozen CPOs in the country; now there are several thousand – and that number is growing. This is due to the recognition that a company needs to incorporate privacy measures into all aspects of its business. The CPO can play a number of roles. One is being aware of the growing number of legal requirements in privacy. If your company is a financial institution, there are financial privacy laws, or if you are a healthcare provider of any sort, there will soon be healthcare privacy laws. There is an ongoing debate about online privacy legislation, which could even extend to offline privacy, that could place every company in the country under some privacy-related restrictions. The location of the chief privacy officer in the corporate hierarchy depends on the company’s culture and structure. Some companies locate that position in the general counsel’s office; some locate it in the executive office. Ideally, though, the CPO should be part of the team developing products and marketing strategy, and should be involved in the process throughout. The CPO needs to be able to incorporate his or her views as the product is developed, rather than being brought in at the end as the naysayer. The CPO has a tough role to play. A CPO who does his or her job very well is never heard from, but if there is one little problem with the company’s security, they get called onto the carpet. So it is a very challenging position. A CPO does not necessarily have to be a lawyer, but he or she does have to be sensitive to the growing number of privacy rules and regulations, not only in this country, but throughout the world, as well. For example, the European Union has a very rigorous set of privacy rules in every European country that apply both in those countries and to cross-border data transfers.

38

Privacy Matters

Canada has a new privacy law, as do Australia and South America. So, particularly for a multinational company, the CPO has to be aware of legal requirements. Beyond that, even if it is not legally required, companies’ privacy practices have to be clear and open enough that they would not mind having them reported on the front page of The Wall Street Journal or The New York Times. Privacy Advice From a corporate standpoint, the first thing a company needs to do is to assess its current information practices. This can be a tremendous challenge because even a small company can have hundreds of databases. The company must find out what information is being collected, how it is used, and how it is stored, and then essentially audit their information practices. The next step is to determine what the company wants to do with this information, both today and in the near future. Third, they must craft a privacy policy that involves the technology people, marketing people, and the executives, encompassing what they are doing today, as well as what they want to do in the future. This should be done in the context of recognized privacy principles. Your privacy policy must accurately reflect your company’s practices. Sometimes companies get overly excited and make promises in their policies that they cannot keep because they want to respond to consumer concerns. This over-promising creates liability, among other problems. From the point of view of federal or state consumer protection laws, your privacy policy is a representation to consumers, and if it is found to be a false representation, you could be sued for fraud or deceptive trade practices. A company has to balance the desire to protect the privacy of its customers with its realistic ability to deliver on those policies.

39

Inside The Minds

How can a company keep up with the privacy issue? To help businesses stay on top of all these privacy issues, a growing number of publications track privacy developments, such as privacy newsletters and legal reporting services. As privacy grows in importance and touches more areas of people’s lives, there will continue to be more and more developments. It is a challenge to keep up with all the legislative developments; both the U.S. Congress and the many state governments have enacted privacy laws or are considering privacy laws. Newspapers, magazines, and television shows are constantly reporting on privacy issues. In many respects the general media have been very concerned about privacy and are probably responsible for making it as big an issue as it has become – often making it front-page news. All the individual consumer or businessperson needs to do to find out about privacy issues is to start reading the newspaper. Beyond that, you can subscribe to publications and newsletters (of which there are a growing number) that focus on online issues, financial issues, or legislative issues. It has become, however, almost impossible to keep up with all the developments. There are number of additional potential liabilities. With regard to spam, an increasing number of state laws regulate unsolicited commercial e-mail. If you fail to comply with those laws, which include giving consumers the ability to opt out and indicating that it’s an advertising message, you could be sued by the attorney general of the state into which you are sending messages or even by recipients of the messages. The FTC has authority over unfair and deceptive trade practices and has used that authority repeatedly to police companies’ privacy policies. A growing number of statutes in the financial, medical, and video-rental areas impose liability for privacy violations. So you could be facing fines or, probably what hurts companies most, adverse publicity, if you are not careful about privacy. Developing a reputation for not protecting privacy can have a

40

Privacy Matters

tremendous effect on a company’s goodwill and customer relations. This negative outcome could arise even if you are not doing something that is technically illegal, but is perceived as privacy invasive. There are a slew of privacy advocates constantly bringing to the attention of the press and the government practices that they believe violate people’s privacy. So there is your company’s reputation to consider, as well as criminal or civil actions that should raise corporate concern. David Medine is a partner at the Washington, D.C., law firm of Wilmer Cutler & Pickering. His practice focuses on consumer financial services, regulatory matters, privacy, electronic commerce, and consumer protection. From August 2000 to January 2001, Mr. Medine served as a senior advisor to the National Economic Council at The White House, where he advised both the President and the Assistant to the President for Economic Policy and coordinated administration policies on such issues as privacy, financial institutions, and expanding capital investment in underserved areas. He advised government agencies on implementation of electronic signature legislation and represented the White House in Congressional consideration of spam legislation. Before working at the White House, Mr. Medine was for more than a decade the Associate Director for Financial Practices at the Federal Trade Commission and led the Commission’s efforts to address online privacy. His responsibilities at the Commission included the development of policy and regulations, oversight of programs involving consumer financial services, privacy, and e-commerce, and enforcement activities in those areas. He participated in drafting the Gramm-Leach-Bliley financial privacy act and the Children’s Online Privacy Protection Act (COPPA) regulations.

41

Inside The Minds

Mr. Medine has testified before Congress on numerous legislative proposals relating to Internet, privacy, and consumer financial issues, and has been a frequent public speaker on related matters. He was named to the “100 Who’s Who in Business to Business” by BtoB magazine. Mr. Medine received his BA from Hampshire College in 1975 and his JD from the University of Chicago Law School in 1978. He taught law at both the Indiana University (Bloomington) School of Law, and at George Washington University National Law Center. Mr. Medine is admitted to the District of Columbia and Indiana (inactive) Bars.

42

Privacy Matters

PRIVACY AT WORK: ELECTRONIC MONITORING AND WORKPLACE TECHNOLOGY

RODNEY A. SATTERWHITE McGuireWoods LLP Chief Counsel / Knowledge Management

43

Inside The Minds

Who’s Watching Now? The idea that “change is the only constant” could not be more accurate than in the world of technology. More specifically, technology in the workplace will experience ongoing change in two key areas: First, the role of technology will continue to increase in employees’ day-to-day lives, and second, the nature of the available tools will evolve as technological improvements continue. Not surprisingly, both of these trends will have a fundamental impact on the way employers and employees interact. Maintaining a proper balance in the employer-employee relationship requires recognition of, and preparation for, these changes as they relate to workplace privacy. The increased use of technology in the workplace is a fundamental axiom: “By 2003, 140 million users will send 1 trillion emails,” according to Nick Usborne in “The Ignored 98 Percent” in Business 2.0 Magazine, December 2000. This kind of growth has a profound impact on the balance between the employer’s interest in protecting its business and the employee’s rights as an individual. Employers will face more difficulty in maintaining this balance as the distinction between workplace technology and personal technology blurs. According to a 2001 UCLA Internet survey, the UCLA Internet Report 2001 by the UCLA Center for Communication Policy, 60.7 percent of employees indicated they use the Internet at work for personal reasons. This number was up from 50.7 percent in 2000. Because employers are often liable for the acts of their employees, prudent risk management dictates that employers monitor employees’ activities to minimize this behavior. As the prevalence of technology in the workplace continues to increase, so, too, does the need for monitoring its use. Nearly 75 percent of major U.S. companies admitted recording and reviewing their employees’ electronic communications and activities – including phone calls, e-mail, Internet surfing, and

44

Privacy Matters

saved computer files – according to an April 2000 Electronic Monitoring and Surveillance Survey conducted by the American Management Association. The survey also found that one fourth of the surveyed companies had fired employees for misuse of telecommunications equipment. The survey results were reported by Jack Karp in an article, “Who’s Eyeing Your Email?” in the April 30, 2002, issue of Tech TV. The tension arises when employees expect that their personal communications will be private, even if sent or received on their office computer. This conflict will define the electronic battle lines of the future, as employers push for more monitoring to protect their business interests, and employees resist the perceived intrusion into their private matters. Liability for Employers Employers can be held responsible for the acts of their employees committed within the scope of their employment. (Martin v. Cavalier Hotel, 48 F.3d 1343, 1351 [4th Cir. 1995]: “An employer is liable at common law for the wrongful acts of an employee that take place within the scope of the employee’s employment.”) Inappropriate behavior, such as sexual harassment, that affects other employees is a particular area of concern. The legal standard is the same when employees use office technology to engage in that inappropriate behavior. For example, if an employee downloads a pornographic picture from the Internet and shows it to a coworker, that behavior may give rise to a harassment suit. (Luttrell et al. v. O’Connor Chevrolet, Inc., et al., 2002 U.S. Dist. Lexis 10036 [N.D. Ill., June 4, 2002], finding possible cause of action for sexual harassment where plaintiff alleged that “on nearly ten different occasions, [coworker] exposed her to pornography on his computer.”)

45

Inside The Minds

Similarly, if an employee circulates an e-mail containing racially derogatory humor that offends coworkers, that, too, can form the basis for a lawsuit. Of course, as with non-technology related acts, the behavior would have to rise to a certain level of severity and pervasiveness to be actionable under most laws. (Doe v. R.R. Donnelley & Sons, 42 F.3d 439, 443 [7th Cir. 1994]). However, the very nature of electronic communications makes this inappropriate behavior more likely. E-mails, for example, are less personal than face-to-face contact or even telephone conversations. As a result, employees are more likely to engage in such behavior over a medium that affords at least some sense of anonymity. Indeed, because of the faceless and seemingly private nature of the medium, people’s e-mails often reveal thoughts that they would be reluctant to say aloud, as reported by Ken Shear in “Electronic Evidence: It’s Not Cutting Edge Any More. Disregard It At Your Peril” in The Lawyer's PC, August 1, 1994. When coupled with the ease of misunderstanding or misinterpreting an e-mail, the risk of one employee offending another increases dramatically. Electronic communications lose nuances, such as humor or sarcasm, because tone and inflection cannot be conveyed. In other words, employees can send messages they think are harmless but actually are not. The result is the same: potential liability for the employer. This exposure is not limited to harassment. Employees who violate copyright laws by downloading protected material may vicariously impose liability on their employers. Similarly, obtaining another company’s trade secrets through some improper method may impose corporate liability under the Uniform Trade Secrets Act. Finally, employers must take steps to ensure their employees are not revealing or communicating their own confidential information and trade secrets across the Internet. In short, as technology grows at work, the opportunities for employee mischief increase exponentially.

46

Privacy Matters

Policing the Problem This combination of circumstances requires that employers take reasonable steps to prevent such inappropriate behavior by their employees. Indeed, the Supreme Court has held that a company defending against a claim of illegal harassment must show “that the employer exercised reasonable care to prevent and correct promptly any sexually harassing behavior.” (Faragher v. City of Boca Raton, 524 U.S. 775, 807 [1998]). When harassment is likely to occur via computer or other technological means, common sense requires that preventative measures include those avenues of communication. In a number of cases, harassment has occurred through such electronic means. For example, in Knox v. Indiana, a state employee sued for sexual harassment based in large part on electronic mail messages sent to her by her supervisor: Starting in December 1991, Stewart began sending Knox electronic mail messages asking her for sex. He often propositioned Knox using acronyms; for example, he frequently asked her whether she wanted to have a HGTWM, which was later translated as a “horizontal good time with me.” Stewart also repeatedly asked Knox out on dates, calling her on the telephone and leaving messages reminding her to check her e-mail…. Stewart initially denied any knowledge of why Knox would have filed a complaint against him, but his tune changed when he found out that the investigator had copies of the e-mails he had sent to Knox. (Knox v. Indiana, 93 F.3d 1327 [7th Cir. 1996]). The United States Court of Appeals for the Seventh Circuit affirmed a jury verdict for the employee based on her Title VII claims. That is precisely the kind of legitimate business reason for the employer to want to monitor in the first place. Often

47

Inside The Minds

employers have little time or interest in seeing employees’ e-mails for the sake of curiosity or some other intrusive motive; instead, there is a genuine risk-management concern on the part of the employer to prevent inappropriate behavior. Personal Means Private In stark contrast to these employer concerns, many employees take a different view: They should be allowed to use e-mail for personal matters, as long as they do not engage in inappropriate behavior and as long as it does not interfere with their work. This position is simply an extension of many office telephone policies that have existed for years: Employees may use the phone periodically for personal calls, as long as this use does not affect their job performance. Based in part on this premise, many employees assume their electronic communications are, or should be, private if they relate to private matters. This misconception defines the tension between employers and employees over workplace technology. Federal law, in fact, affords some legitimacy to the idea that electronic communications should be protected. Just as employees can abuse electronic mail, employers may also abuse their ability to monitor an employee’s use of such systems. Under federal and state laws, employers may be liable for intercepting their employees’ private electronic mail messages. The Electronic Communications Privacy Act, a federal wiretapping statute, provides that: “[A]ny person who – (a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication…shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).” 18 USCS § 2511.

48

Privacy Matters

Unauthorized access to stored electronic communications is also prohibited by federal law: “[W]hoever intentionally accesses without authorization a facility through which an electronic communication service is provided; or intentionally exceeds an authorization to access that facility and thereby obtains…access to a wire or electronic communication while it is in electronic storage…shall be punished….” Id. However, there is an exception for the provider of the service: “Subsection (a) of this section does not apply with respect to conduct authorized – 1) by the person or entity providing a wire or electronic communications service….” Id. This exception provides a safe haven for most employers, since they usually own the technology being monitored in the workplace. Other misconceptions about the private (or not so private) nature of the technology itself widen the gap between employer and employee. For example, many people assume that once an e-mail is deleted, it is gone forever and that no one, including their employer, can read it. This is incorrect. E-mails stored on an employee’s computer can be retrieved even if deleted. Other copies may exist on the company’s e-mail servers. Still more copies of a message can crop up on the recipient’s e-mail server if they work for a different employer. Finally, backups of these servers to tape or other media can preserve an e-mail message for years. So employees who assume that deletion prevents employer monitoring are mistaken. If their expectations have not been tempered by appropriate communications from their employer (see below), then discovery of such monitoring can

49

Inside The Minds

give rise to an employment dispute, at a minimum, and in the worst case, a lawsuit for invasion of privacy. Employees may also assume that if they take steps to secure their personal electronic communications, they have an inherent right to privacy in them. The law is unclear on this issue, and employers must be cognizant of future changes in court decisions or statutory language to avoid improper monitoring. One example is that employees may presume that, because their e-mails are password-protected, they are legally private and not subject to review by their employers. Some courts have rejected this idea: According to [plaintiff], his practice was to store e-mail messages in “personal folders.” Even so, any e-mail messages stored in [plaintiff’s] personal folders were first transmitted over the network and were at some point accessible by a third party. Given these circumstances, we cannot conclude that [plaintiff], even by creating a personal password, manifested – and [defendant] recognized – a reasonable expectation of privacy in the contents of e-mail messages such that [defendant] was precluded from reviewing the messages. (McLaren v. Microsoft Corp., 1999 Tex. App. LEXIS 4103, 1999 WL 339015, at *4 [Tx. Ct. App. 5th Dist. May 28, 1999]). Employers making the opposite assumption may also be mistaken. Many employers presume that because they own the technology or the computer, they automatically have a right to search it. One recent case suggests that a reasonable expectation of privacy as to the contents of one’s office computer may exist under certain circumstances. In February 2002, a Federal Appeals Court in Texas ruled that where an employee had a locked office and had password-protected his computer, then the

50

Privacy Matters

employee had a reasonable expectation of privacy with regard to the content on the computer: In the present case, Slalina clearly demonstrated a subjective expectation of privacy with respect to his office and office computer equipment. He had closed and locked the door to his office. To limit access to his computer files, he installed passwords, thereby making it more difficult for another person to get past the screen saver and reboot his computer. (United States v. Slalina, 283 F.3d 670, 675 [5th Cir. 2002]). Although Slalina was a criminal case involving possession of child pornography, the court’s recognition of a reasonable expectation of privacy, even in the context of an illegal search and seizure, will likely have a substantial impact on electronic privacy issues in the private sector. Where one court adopts the idea of passwords creating an expectation of privacy, and another court rejects the same notion, the result is to fan the flames of confusion over where to draw the line between employer concerns and employee privacy. Striking a Balance Through Communication There is no easy solution to this quandary. Until the law is clarified, the best approach, for both employer and employee, appears to be through open communication. Employers should develop and communicate policies addressing workplace technology issues, such as guidelines for acceptable use of e-mail and the Internet. The sophistication and complexity of these policies will vary with the employer. There are, for example, some employers who place a message on their e-mail system so that when an employee signs on to the system, they see a copy (or summary) of the policy, and to get to their e-mail they must first click on a button to indicate that they have read,

51

Inside The Minds

understood, and agreed to the policy. At the other end of the technology spectrum, written policies can accomplish much of the same result, although from an employer’s standpoint it is very important to document that you have informed your employees of the policy and expectations. Regardless of the medium, the message is the same: Create a policy regulating office technology use, and communicate that policy as clearly as possible to employees. Surprisingly, the responsibility for a company’s communications about privacy issues regarding workplace technology does not usually rest with the information technology department. The technical aspects of monitoring, such as how to do it and what to look for, certainly fall under the information technology domain. The IT department will also have a role in making sure policies and communications are accurate and fit correctly within the company’s technology infrastructure. When addressing privacy issues, however, the human resources department will, in the future, be expected to shoulder the burden of setting employee expectations and crafting employer policies. Privacy concerns will continue to be an important aspect of the employer-employee relationship. Employers must set their employees’ expectations appropriately, communicate the policies accurately, and manage the policies correctly and consistently. All these tasks are traditional functions of a human resources department, and will remain so even as technology changes and becomes more prevalent in the workplace. Regardless of technology changes, privacy issues are so closely integrated with employee relations that it will still be critical for human resources or management to deliver the message. For example, even in the Slalina case, which recognized a subjective expectation of privacy where there is a locked office and a password-protected computer, the court recognized that the existence of a clear policy would have tempered the employee’s privacy rights:

52

Privacy Matters

The city did not disseminate any policy that prevented the storage of personal information on city computers and also did not inform its employees that computer usage and Internet access would be monitored. See United States v. Simons, 206 F.3d 392, 398 (4th Cir. 2000) (holding that in light of employer policy to inspect and monitor Internet activity, employee had no reasonable expectation of privacy in files transferred from Internet). Accordingly, given the absence of a city policy placing Slalina on notice that his computer usage would be monitored and the lack of any indication that other employees had routine access to his computer, we hold that Slalina’s expectation of privacy was reasonable. Slalina, 283 F.3d at 676-77. An important complement to dissemination of a good policy is training employees, both managerial and hourly, about proper use of workplace technology. Specifically, managerial employees must understand what they can and cannot look at and how they can monitor employee activities without running afoul of privacy issues. As discussed above, this is quite difficult while remaining diligent and effective in monitoring for sexual harassment and other inappropriate behavior. If it is a difficult balance for courts to find, then certainly front-line supervisors should receive as much education as possible in managing these competing interests. Similarly, employers should train all employees to make it clear that the company can and will monitor electronic communications in the workplace. Employers must articulate their definition of “proper use” of the computer for business purposes. For example, one common issue is whether to allow employees to use computers for any personal reason whatsoever. The challenge for employers is that if one restricts e-mail to business use only, an employee who sends an e-mail to his child in college, or the employee who receives an e-mail from her

53

Inside The Minds

spouse about dinner plans, have violated the policy and should, technically, be subjected to disciplinary action. This scenario quickly becomes unworkable, as few employers are likely to devote the necessary resources to policing and correcting such innocuous behavior. Once these infractions are ignored, however, the integrity of the policy weakens, and those employees whose violations are more egregious can point to past leniency as an example of inconsistent enforcement. Such facts can often lead to claims of discriminatory treatment under federal equal employment opportunity laws. Employees also bear some responsibility for becoming familiar with privacy issues in the workplace. Employees can educate themselves by contacting their human resources department, reviewing the company policies, and making sure they understand what they can and cannot do with workplace technology. If no policy exists, employees should ask what is allowed and what is not. This is basic common sense: If both parties know the guidelines and expectations, the likelihood of misunderstandings and miscommunication is reduced. Changing With the Times These policies, however, cannot remain static. Employer policies and employer-employee relations need to be adjusted so they adequately keep up with changing technology. For example, statistics suggest that employers are becoming more aware of e-mail and Internet issues with their employees. In a recent study reported by the American Management Association in the “2001 Electronic Policies & Practices Survey,” 62 percent of employers said they monitor employees’ e-mail and Internet use, and 68 percent cite legal liability as the primary reason to monitor. Of those that monitor e-mails, 87 percent have a written e-mail policy, and 51 percent of employers have disciplined or terminated employees for violating such a policy. While these

54

Privacy Matters

statistics suggest a growing awareness of many of the concerns raised in this chapter, they do not reflect the potential for technology to outstrip both the policies and the law. By the time all employers establish e-mail and Internet policies, technology has already changed. With massive enthusiasm, employees are using instant messaging (IM) for personal business and legitimate business at work. More than 78 million people communicate thoughts and opinions through ICQ, and an additional 64 million use America Online’s other messaging service, Instant Messenger, according to Nick Usborne in his article mentioned earlier. E-mail policies prepared even one or two years ago have probably not been written to accommodate instant messaging, and therefore do not address how such technologies should be incorporated into the workplace. Policies, therefore, that were forward-thinking and progressive a year or two ago are already outdated because they do not account for changing technologies. Privacy in instant messaging will undoubtedly become an issue because of differences between IM and e-mail. Employees use IM in the workplace to chat with friends, so an immediate concern is whether employers can monitor that communication or whether employees have an expectation of privacy in those messages. In the e-mail context, the employer can claim ownership of the e-mail server, and e-mails stored on the server can be viewed by an employer, in part because they fall within an exception to the Electronic Communications Privacy Act. Instant messaging, however, may occur on the employee’s hard drive and on a Yahoo or Microsoft network server somewhere that the employer does not own. That could dramatically alter the employer’s ability to search instant messaging communications. However, the employer still has a legitimate need to review such communications to fulfill its obligation to prevent inappropriate behavior in the workplace.

55

Inside The Minds

These shifts in technology will likely mirror patterns in monitoring and privacy protection measures. In the future, as technology improves and the employer’s ability and need to monitor employees increases, monitoring will increase. The inevitable abuses in monitoring will, however, result in decisions such as Slalina that start to scale back the employer’s ability to monitor. New technology will then find its place among workers, and the cycle of monitoring and regulation will begin again. Given the pace of technology, this pendulum effect will be ongoing. Over the next few years, the pendulum seems to be moving in the direction of greater clarity of workplace monitoring. As conflicting court decisions are resolved, privacy issues will be more clearly defined in relation to electronics in the workplace. In other words, privacy law will necessarily evolve to address changing technology. The result will be better and more detailed guidance on what employers can and cannot do with employees. In the meantime, however, employers and employees must focus on voluntary communication to prevent and resolve workplace privacy issues. Resolving Differences Is Critical In defining goals for resolving electronic privacy issues in the workplace, employers seek sound risk management and productive relationships with their employees. Employers must balance the risk of a lawsuit from inadequate technology monitoring with a suit arising from too much monitoring. This is, without a doubt, a balancing act. Preventive medicine, however, is available: Employers can implement a policy and provide education that can substantially reduce the risk of lawsuits from both directions.

56

Privacy Matters

The same is true for employees. Employees who do not know the rules may be in a difficult position because of this lack of knowledge. Before using their computers for personal (or worse, inappropriate) reasons, they, too can take preventive medicine and review their company’s policies to learn the restrictions on computer use. Employees should think before sending an e-mail, and literally presume the text will end up on the front page of the local newspaper. Employees should find out what their employer’s expectations are as far as personal use of the technology is concerned, find out which technologies the policy addresses (voice mail, e-mail, computer files, instant messaging, handhelds, etc.), figure out the right person to talk to about potential questions, and talk to them. Failure to do so can result in disciplinary action that can be as serious as termination of employment. In short, both employers and employees have good reasons to resolve the conflicting interests associated with the use of workplace technology. No one doubts that technology is here to stay. Enhanced efficiency, improved communication, and a host of other benefits have secured technology’s position in business. Although predicting the exact nature of this position in the future is virtually impossible, privacy issues will continue to play a critical role in shaping the evolution of technology at work. Rodney A. Satterwhite is a partner in the Labor & Employment Department in McGuireWoods LLP’s Richmond Office, and Chief Counsel/Knowledge Management for the firm. He tries cases and counsels clients in equal employment opportunity law, sexual harassment, employment contracts, non-competition agreements, wrongful discharge, and employer trade secret protection. His specific areas of practice include Title VII of the Civil Rights Act, the Americans with Disabilities Act, the Age Discrimination in Employment Act, and the Family and Medical Leave Act. He has litigated claims in state, federal, and

57

Inside The Minds

administrative courts, including the United States Courts of Appeal for the First, Fourth, and Sixth Circuits. He has also represented corporate clients in responding to administrative charges filed with the Equal Employment Opportunity Commission, and in managing investigations conducted by that agency. Mr. Satterwhite also counsels clients on the drafting of employment agreements, non-competition agreements, employee handbooks, and related employment policies. Mr. Satterwhite’s practice also includes issues relating to the increased prominence of technology in both the workplace and the courtroom. He advises clients on labor and employment issues relating to technology in the workplace, including issues such as electronic mail and privacy concerns, employee misuse of electronic mail and Internet access, and the implementation of acceptable use policies for employers. As Chief Counsel/Knowledge Management, Mr. Satterwhite also assists clients in the application of technology to litigation management. He participates in the design and development of extranets for improved attorney-client collaboration and communication, in the context of both litigation and transactional work. As a litigator and a former technology consultant, Mr. Satterwhite draws on his experience in both areas to bridge the gap between technology and the practice of law. He can counsel companies on ways to improve efficiency in the delivery of legal services, such as the implementation of case management and litigation support systems. Mr. Satterwhite received his B.A. degree with honors from the College of William and Mary and his JD from the University of Virginia.

58

Privacy Matters

NEXT-GENERATION LEGAL PRIVACY ISSUES

WILLIAM A. TANENBAUM Kaye Scholer LLP Partner and Chair, Technology & E-Commerce Group

59

Inside The Minds

Privacy Compliance – Determining Which Law Applies Different privacy laws apply to different industries and different types of data in different countries. Thus the threshold question is which country’s – or, often, which countries’ laws – apply to a company’s operations. Privacy laws apply to collection and use of personal data and the consents required to collect or obtain access to private data. Generally speaking, the United States does not have one federal privacy statute that applies to all data. Instead, U.S. privacy law consists of a patchwork of state laws and a series of federal laws that apply to specific industries and data. The European Community, in contrast, has one general law implemented through the domestic legislation of individual countries that governs the collection and use of private data. Certain countries outside of Europe, notably Canada and Australia, have adopted national legislation that is similar to but somewhat less rigorous than European law. Moreover, privacy laws apply to all data and not just information collected online. For companies doing business in the United States, the first issue is whether the company is doing business in one of the three areas that are subject to specific federal laws and regulations. These are the financial industry and private financial information, the health care industry and private medical data, and online sales to children. If a company operates in one or more of these industries or uses one of these types of information, then it must comply with the specific laws and implementing regulations that apply to the collection and use of personal information. The point to remember is that it is often the nature of a company’s customers that determines which regulatory scheme applies. The second issue is whether the company is conducting any of its activities in a way that would attract the attention of the

60

Privacy Matters

Federal Trade Commission or the state attorneys general. This question is important even for companies that are not subject to one of the industry-specific federal regulatory schemes, and is of special concern for online businesses. The FTC has general jurisdiction over consumer protection, and attorneys general apply state unfair competition, deception, and privacy laws. Among other things, the agency and the attorneys general review Web sites to determine whether there is a privacy statement, whether the privacy policies are fair and fairly stated, and whether the company complies with its own privacy statement. A third and complicating issue is whether the company has contracted with a third party to handle all or part of personal information on an outsourced basis. If data processing (including such processes as data mining and data storage) is outsourced, then the company should conduct due diligence to make sure the outsource provider is complying with applicable laws and regulations and the company’s own privacy policies, especially those disclosed to its customers and business partners. Potential legal complications arise if the outsource provider is taking data that is treated by the company in accordance with applicable law (compliant data), but is commingling it with other data that has not been collected or used in accordance with applicable law (noncompliant data). The legal danger is that the noncompliant data will taint the entire database. In other words, the noncompliant data acts like a virus that “infects” compliant data and renders it noncompliant. The Intersection of U.S. and Foreign Privacy Laws This danger is especially true with regard to personal information that relates to citizens of European countries or is otherwise subject to European privacy laws. There is a different approach to privacy in the U.S. than there is in Europe. Although the approaches are converging, historically there have been fairly

61

Inside The Minds

strong differences that were reflected in the different legal regimes. In the U.S., historically the concern has been that the government will collect and do inappropriate things with information about individuals, and that the collection of personal information by companies did not pose a threat to liberty. In Europe, in contrast, it has been generally accepted, if not expected, that the government will maintain a dossier of personal information, and the concern has been that private companies would misuse personal information. In many respects, European law (often referred to in the privacy context as the EU Directive) and Canadian and Australian law provide a greater level of protection than U.S. law provides. As noted above, it applies to all data, not only data collected in certain industries. For U.S. companies, the EU Directive raises three broad areas of concern: R First, if a U.S. company collects data in Europe, it must comply with the EU Directive, which generally imposes a stricter legal standard than does U.S. law. R Second, the EU Directive applies to and often limits the transfer of data from the European Community to the U.S. (This will be discussed in greater detail below.) Similar results also apply under new Canadian and Australian law. R Third, if a company operates in the U.S. and Europe, it must decide whether, for purposes of convenience, it wants to adopt a single standard for its treatment of personal information. In that case, the standard will be the “highest common denominator,” and that will be the EU Directive. Adopting the EU Directive will usually require a U.S. company to change the practices it follows in the U.S. The key point is that a U.S. company using data transferred across international borders is subject to foreign data laws and risks the threat of

62

Privacy Matters

noncompliant data infecting “good,” or compliant, data if the company or its outsource providers fail to comply with applicable foreign law. Danger: Convergence of Privacy Law and Outsourcing The convergence of two trends is complicating life for U.S. companies and raising legal and financial risks for them. The first trend is the increase in privacy regulations that apply to the collection and use of personal information. This arises because of new privacy laws in the U.S., because a U.S. company is subject to the EU Directive or other foreign law or because of the transfer of data across international borders. Complying with new privacy law requirements often requires new hardware and software. The second trend is the increasing use of outsourcing, or external service providers, to handle a company’s data. Outsourcing can reduce a company’s costs and allow a third party to provide expertise that is not available within a company. The danger is that one part of the company will spend a lot of time and money to reengineer its technology infrastructure to outsource data functions, but that such IT (information technology) projects will be carried out without regard to the requirements of the applicable privacy laws (whether U.S. or foreign). For example, the company may not require its outsource provider to implement certain practices or use certain technology to protect the privacy of data or prevent the commingling of tainted and untainted data in accordance with emerging legal requirements. The IT or outsource system will then have to be reengineered at considerable additional expense to meet the legal privacy requirements that should have been addressed in the first place.

63

Inside The Minds

So privacy and outsource IT upgrade projects must be coordinated, even though they are often run by different parts of the company. If communication or management is poor, a company can end up with two parallel IT projects, and half of each will have to be redone to accommodate the converging trends of privacy and outsourcing. This leads to the obvious conclusion that a company should combine or coordinate its privacy and outsourcing IT projects. Outsourcing should not undo all the careful steps that a company put in place to collect and protect data in accordance with privacy laws. Alternatives for Handling Personal Data From Europe The EU Directive and its implementing legislation in individual European countries impose numerous requirements on how data can be collected from individuals, how that data could be used by the company that collected it, what consents need to be obtained from the individuals, and how that data could be transmitted across national borders. Transmission between European countries that have adopted the Directive should not be a problem because all countries have adopted the same privacy law. However, the EU Directive contains a provision limiting the transmission of private data to jurisdictions whose laws do not provide the same level of privacy protection the Directive provides. The position adopted under the EU Directive was that data collected under the new European privacy regime has a special status and a special set of protections applicable to it, and therefore that data could not be sent to another jurisdiction unless it is subject to the same set of protections the Directive provides. The EU took the position that U.S. laws do not provide adequate levels of privacy protection. The United States, however, was not going to adopt the kind of law that the Europeans had. This lead to years of high-level consultations to develop mechanisms to

64

Privacy Matters

allow the transfer of personal data from Europe to the U.S. Four alternatives have resulted. Safe Harbor The first is the so-called “Safe Harbor” alternative. Under this alternative, a U.S. company certifies to the U.S. Department of Commerce that its privacy practices meet certain requirements. In essence, certification means the company is, in effect, a “jurisdiction” that provides EU-level protection, and therefore EU data can be transmitted to it without loss of protection. This approach has worked for some U.S. companies, but not for others. One problem is that very large companies often cannot certify that the entire company has adopted adequate privacy policies across the board. In some of these cases, it may be possible to establish a legal entity that handles the data on behalf of the company and then certify that legal entity. So while the Safe Harbor alternative may work in theory, in practice it may not provide a viable solution. Model Contract Provisions A second alternative is to incorporate the so-called model contract provisions promulgated by the EU into contracts between the U.S. and European companies. The difficulty with this alternative is that the provisions are onerous and impose objectionable burdens on a U.S. company, such as being subject to lawsuits in foreign jurisdictions. Moreover, in the opinion of many legal commentators, the model provisions go beyond the EU Directive and impose conditions that are not provided in the Directive or implementing legislation. So for many U.S. companies the model provisions do not provide a workable solution.

65

Inside The Minds

Private Agreement A third alternative is to enter into a private agreement with the European company in which the U.S. company agrees to be bound by EU-level privacy practices. In Practice Without Agreement A fourth alternative is for the U.S. company to adopt EU-level privacy policies in practice, but not enter into a private agreement requiring their use or use the official model contract provisions. This does not have official sanction; the theory is that there is no damage because the actual practices followed provide sufficient protection of privacy rights. Experience to date has shown that for their own internal purposes, many European companies want their U.S. business partners to obtain Safe Harbor certification. In essence, these European companies treat the Safe Harbor certification as an official “seal of approval” that its American business partner has complied with the law, and therefore is safe to do business with. In other words, a Safe Harbor certification will satisfy a “due diligence” investigation that the U.S. company provides sufficient privacy protection and that a European company is not at risk in transferring private data to it. One thing to keep in mind is that not all European companies that transmit data to the U.S. are subject to the data transmission requirements of the EU Directive. As a result, it is important to conduct a proper legal analysis to determine the legal status of the European company that is proposing to transmit the data and whether it is subject to EU Directive restrictions.

66

Privacy Matters

Dealing With Privacy Issues As a company, the safest way to handle privacy issues from a legal perspective is to tell customers what the company is going to do with their personal information, obtain their consent to such use, and require that customers or other information providers “opt in” rather than “opt out” of the requirement to provide their personal information. For business reasons, many companies favor “opt out” provisions because that results in individuals providing consent unless they affirmatively take alternative steps. If these steps are followed, a company is likely to comply with all privacy laws, especially if an opt-in procedure is used. Regardless of whether an opt-in or an opt-out procedure is followed, there needs to be a clear statement of how the information will be collected and used, and what the individual can do to control the use of his or her personal information. Problems arise when there is no clear statement. One is the risk that there has been no unambiguous consent. One of the difficulties in this area has been that the first round of privacy notices from financial institutions has been hard to understand. Ironically, this sometimes occurred because companies were not sure of how to best state their privacy policy, so they adopted the language from regulations, and the regulations themselves were not models of clarity. Another problem is how privacy requirements comport with the use of “cookies” in online commerce because cookies collect personal information. To simplify, cookies are pieces of software that a Web site places on a computer user’s hard drive to identify that computer to the site. Every time an individual visits an Internet Web site and the home page says, “Welcome back, Mr. X,” a cookie has been responsible for recognizing Mr. X as Mr. X returning to the site. There are also cookie-equivalents in regular commerce (that is, commerce not conducted online). Examples of these cookie-equivalents are frequent-shopper cards

67

Inside The Minds

issued by grocery market or drug store chains. These cards with their bar codes serve the same purpose as cookies in online commerce, and allow the store to track the purchases made by particular individuals. The incentive provided to obtain an individual’s consent to have this information collected is the discount or other economic incentive provided to the customer when the card is used. By agreeing to the discount, the individual agrees to the collection and use of certain information. This illustrates the basic proposition that privacy requires a multilevel analysis. What is permissible under U.S. law in some circumstances may be impermissible in other countries. What is permissible for some companies may be impermissible for others, depending on their legal status under different regulatory schemes. This is further complicated because many U.S. companies transfer data between the U.S. and Europe or Canada (and to some extent Australia), which have limitations on data that can be transferred across borders. The Future of Privacy Five years from now, the biggest privacy issues we will be dealing with will be consent and use of personal information when multiple companies are involved in the handling of the information. As noted, this results from an increasing trend to outsource information technology functions. It will also result from business partnerships between different companies where the use of customer information is a valuable part of the business model. An individual will have a relationship with a particular company, Company A. The problems arise when Company A provides the information to Companies B, C, and D, and the individual may not know about or consent to the use of the information by those companies. In addition, the management challenge is that the

68

Privacy Matters

sales or other customer service division of a business will not know how the company uses third parties, and thus will not be aware of the consents that need to be obtained. This makes entering into proper “personal information transfer agreements” (PITAs) with business partners very important. In the future, outsourcing practices will be scrutinized, and companies will have to make sure all the privacy regulations they put together at the corporate level are not inadvertently undone by using third parties to outsource discrete business functions. Privacy Advice First, the best approach is not to treat privacy practices or information technology practices in isolation, but to consider them together and build an information technology infrastructure that uses technology that enables rather than hinders compliance with privacy requirements. Moreover, the technology used should be forward-looking, so that privacy laws on the horizon can be met without having to redesign a computer system. This is especially important for companies that do business internationally, as the earlier discussion of the EU Directive and Canadian law indicates. The information technology contracts used by a company with its business partners and with its technology service providers should be part of the solution to privacy problems, not a cause of privacy compliance problems. Second, one of the worst things a company can do is to be contemptuous toward the U.S. regulator and attorney general’s office. If a member of an attorney general’s office questions a company’s practices, it is better not to assume the government does not know anything about technology, and that the company can just tough it out and not pay attention to the inquiry. In many cases the best approach is for the company to explain what it is

69

Inside The Minds

doing with personal information and provide a tutorial on the technology used, if appropriate. Third, when dealing with business partners, be wary and make sure they have the proper transparency with regard to their privacy practices. Learn whether they use third-party service providers to provide their services to your company. A company does not want to be subject to government scrutiny because it picked a business partner involved in questionable activities. That means a new area of due diligence – privacy due diligence – will be required in many ordinary business arrangements. Enter into good contracts, spell out how the data will be treated in compliance with the law and your company’s privacy policies, and then add the specifics that need to be followed. That will create a legally binding measurement system for how the information will be treated. William A. Tanenbaum is the international chair of the Technology & E-Commerce Group at Kaye Scholer LLP and a partner in the firm’s New York office. He is an intellectual property and business technology lawyer, and his practice focuses on technology transactions, intellectual property protection, and technology litigation, with a particular emphasis on computer, outsourcing, privacy, and information technology. He is routinely involved in devising and implementing privacy compliance programs for large and small companies and in conducting privacy due diligence. Mr. Tanenbaum has been selected as outside technology counsel, outside privacy counsel, and outside intellectual property counsel by Fortune 500 and other leading companies. He is coauthor of a book entitled A Guide to the European Data Protection and Privacy Laws for U.S. Companies and has been selected the chair or co-chair of legal conferences on privacy,

70

Privacy Matters

outsourcing, electronic contracts, technology litigation, and related topics. In a recent survey, Mr. Tanenbaum was recognized as a “pioneer in the legal profession, identifying unique issues and drafting tech-savvy contracts,” and “veteran intellectual property and patent attorney.” He is a past president of the Computer Law Association and is listed in The Best Lawyers in America, The International Who’s Who of Business Lawyers, The International Who’s Who in Internet and E-Commerce Law, Guide to the World’s Leading Litigation Experts, Guide to the World’s Leading E-Commerce and IT Advisers, and Guide to the World’s Leading Patent Law Experts.

71

Privacy Matters

PRIVACY CHALLENGES

MICHAEL J. SILVERMAN, ESQ. Duane Morris LLC Information Technology and Telecommunications Practice Group Partner and Chair

73

Inside The Minds

The Level of Care Needed One of the biggest challenges a company faces today is something that the IT industry faces generally – the ability to integrate various IT systems and various repositories (or silos) of data within a company so that people understand how the data can be used, where it came from, and to what restrictions it might be subject. Another key issue is creating a level of understanding within an organization about how to use the organization’s data, how valuable that data is, and how risky it is to misuse it. Very often the organization’s data about its customers is one of its key assets, so it is widely used throughout the organization. Nevertheless, misusing that data can have very serious consequences. The concept of raising the level of understanding of privacy issues within an organization is quite important because many individuals throughout the organization will likely have access to data that should be subject to some level of privacy restrictions. For example, within an organization a marketing manager may work on a marketing campaign or project requiring the use of customer data. The personnel working on the project may have some data that was selected out of a larger database, which could have been sitting in their e-mail or elsewhere on their computer systems. Because the data is segregated from its original source and being used by people who may not know the circumstances under which it was collected, those individuals may end up using that data for some purpose for which it was not intended. Perhaps the data might be disclosed to a third party who is going to provide a service and work on this marketing program, or the data might be provided to someone who will send out e-mails to the people on this database. If employees throughout the organization are unaware that they have to treat that kind of

74

Privacy Matters

information carefully, the company could end up with a serious problem. So awareness is the second big issue. The third big issue is dealing with the advancements in technology, the increasing ease with which people can use it to access and manipulate data, and the risk that technology presents for unauthorized access, use, or manipulation of data. Policing the Data Many companies are policing their use of data themselves. Some companies are joining voluntary privacy organizations, such as TRUSTe, which prescribe some voluntary requirements that are to be included in privacy policies (www.truste.org), and agreeing to comply with TRUSTe’s set of practices and policies. The Federal Trade Commission and other governmental authorities are also policing companies. There have been some fairly highprofile examples recently of the government’s efforts to police privacy issues. These examples also provide a road map for companies for their future compliance efforts and provide a good example regarding the issues companies are facing now and will face in the future. One example is a fairly well-known bankruptcy case that involved the sale of Toysmart.com’s customer list and related customer information as part of the Toysmart bankruptcy proceedings. Toysmart wanted to sell its customer data because it was one of the company’s most valuable assets, but Toysmart’s privacy policy (in effect during the time it was collecting the customer data) stated that Toysmart would never share that data with third parties. The FTC sued Toysmart to prevent it from transferring customer data in a manner that violated Toysmart’s privacy policy. The FTC eventually settled the case, requiring that the customer data could be purchased only by a buyer that was in a market related to Toysmart’s

75

Inside The Minds

market and that would agree to abide by the Toysmart privacy policy that was in effect when the data was collected. Further, the data could be sold only as a package with the rest of the assets to a family-oriented Web site. And any attempts to modify the privacy policy would first have to receive explicit approval by the Toysmart customers on an “opt-in” basis. Recently the FTC sanctioned Eli Lilly for sending out e-mails that inadvertently disclosed the names of people taking Prozac. The case arose out of the FTC’s claim that Eli Lilly disclosed the identities of people taking Prozac as a result of an error in using information it obtained from its Web site, www.prozac.com. On the Prozac Web site, Lilly offered a service called “MediMessenger” that provided personalized e-mail reminders regarding medication. The reason the FTC sanctioned Eli Lilly was that a Lilly employee developed a computer program to access all the Medi-Messenger subscribers’ e-mail addresses to send them an e-mail that the Medi-Messenger service was being terminated. The e-mail did go out to nearly 700 subscribers, but it inadvertently included the e-mail addresses of the all the other subscribers in the “To” field of the e-mail. The FTC pursued Eli Lilly because of allegedly false or misleading representations made in Lilly’s privacy policies, which users reviewed during the Medi-Messenger sign up process. The privacy policy stated that Eli Lilly respects the privacy of those who visit its Web sites and that its sites have security measures to protect the confidentiality of information volunteered by users of the site. The FTC claimed these policies “represented, expressly or by implication that [Lilly] employs measures and takes steps appropriate under the circumstances to maintain and protect the privacy and confidentiality of personal information.” The FTC alleged that Eli Lilly failed to implement appropriate internal measures to protect sensitive consumer information. For example, the FTC alleged that Lilly failed to provide appropriate employee training regarding consumer privacy and information

76

Privacy Matters

security; provide appropriate oversight for the employee who sent out the e-mail; and “implement appropriate checks and controls on the process, such as reviewing the computer program with experienced personnel and pretesting the program internally before sending out the e-mail.” Lilly also violated some of its own internal security procedures by failing to implement appropriate measures regarding this situation. The consent decree between Eli Lilly and the FTC may represent some guidance as to the kinds of compliance efforts the government will consider appropriate in protecting private consumer data. The consent decree requires that Eli Lilly implement an information security program that will protect personal information in Eli Lilly’s possession. The FTC outlined the program as follows: Lilly would be required to establish and maintain a four-stage information security program designed to establish and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect consumers’ personal information against any reasonably anticipated threats or hazards to its security, confidentiality, or integrity, and to protect such information against unauthorized access, use, or disclosure. Specifically, Lilly would be required to: R Designate appropriate personnel to coordinate and oversee the program. R Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information, including any such risks posed by lack of training, and to address these risks in each relevant area of its operations, whether performed by employees or agents, including: (i) management and training of personnel; (ii) information systems for the processing, storage, transmission, or disposal of personal information; and (iii)

77

Inside The Minds

prevention and response to attacks, intrusions, unauthorized access, or other information systems failures. R Conduct an annual written review by qualified persons, within ninety (90) days after the date of service of the order and yearly thereafter, which shall monitor and document compliance with the program, evaluate the program’s effectiveness, and recommend changes to it. R Adjust the program in light of any findings and recommendations resulting from reviews or ongoing monitoring, and in light of any material changes to Lilly’s operations that affect the program. The procedures set forth above would likely require a significant effort by Eli Lilly or any other company. For example, the FTC order requires that Eli Lilly provide training to its personnel, a significant task for a large company. It is significant that the FTC ordered Lilly to identify and address risks in its operations, including risks relating to the “prevention and response to attacks, intrusions, unauthorized access, or other information system failures.” Perhaps in requiring such an analysis by Eli Lilly regarding the risks posed by bad acts of others, the FTC is indicating that Lilly and others might be liable for cyber attacks on personal information in their IT systems. It is unclear whether the FTC is requiring that companies have a legal duty to protect personal information in their custody, but it is likely that if a company did not take reasonable steps to protect such information, the FTC or others would pursue such a company for allowing personal information to be stolen. There are likely to be more and more claims of this sort in the future. Because of these cases and other recent developments, companies need to consider how they will develop, monitor, and enforce privacy, data, and information security issues. They need to determine how to identify the “private” nature of the data they have in their possession, determine how to tag data in some way

78

Privacy Matters

to identify the use that can be made of it, and determine how to train employees so that they can understand and identify the issues relating to privacy. Digital data is easily sliced, diced, and manipulated for various purposes, so it may be very easy to scramble data that is subject to significant privacy restrictions with other material that is not. The result could be that private data is misused merely because it loses its identification as data subject to privacy regulations (because it gets passed around on a CD, sent to a third-party service provider, or placed on an employee’s hard drive). So, for example, a data set that was created solely for internal review and stored on an employee’s computer may be used months later for an external mailing that violates the privacy policy. Clearly, one of the most effective ways to handle these risks is to educate a company’s employees. Companies should also consider creating a position for a privacy officer or a data security officer. As the FTC made clear, companies should also very seriously analyze the risks they face from physical or electronic intrusion, theft, or misuse by employees, as well as any other intentional misconduct relating to private information. Though it is obvious that even mistakes like that in the Eli Lilly case can subject a company to liability, it appears that the biggest risk is from intentional misconduct regarding private data. Also, boards of directors need to become more aware of the issues relating to security and privacy, and they may have to start examining these kinds of issues in the same way that directors are supposed to deal with auditors. Things are changing a bit, and the laws in different jurisdictions are somewhat different. The various states in the nation have a wide range of regulation relating to privacy. One of the more interesting issues to deal with is privacy practices in international commerce, particularly for companies that have operations, facilities, and personnel around the world. Companies that do

79

Inside The Minds

business outside the U.S. have to be aware of different levels of privacy regulation relating to data used or collected in the various locations in which they operate. The European Union and various other non-member countries have privacy regulations that differ significantly from those in the U.S. The varying regulatory environment is a difficult problem to address; that is one reason to have one person focused on privacy issues in a company. Transactions That Can Increase Privacy Violation Risk In bankruptcy scenarios, like the Toysmart case, or scenarios where one company purchases or combines with another, one significant operational problem is determining what rules or policies apply to consumer data that may be part of the transaction. The parties to such a transaction will have to determine what the privacy policies and rules were when consumers provided their personal data. If a company’s privacy policy has changed over time, it may be difficult to determine which version of the policy was in effect at the time the customer’s private data was captured. As the Toysmart case shows, however, a company will not be able to freely transfer its private consumer data if such a transfer would violate the privacy policy under which the data was originally collected. So it is important to determine the requirements of the privacy policy that covers the data at issue and to comply with it. Doing business with service providers, trading partners, or B2B partners also adds a difficult twist to handling private data. Any entity with which a company shares private consumer data can put the company that provided the data at risk. If the service provider, trading partner, or B2B network does not maintain effective information security, the company’s data could end up being improperly used, distributed to others, or stolen in a cyber attack. Imagine the customer relations nightmare (not to mention

80

Privacy Matters

the lawsuits) if a retailer’s business partner exposes the retailer’s customers’ private data. The customers will certainly be reluctant to do business with the retailer again, and the retailer will probably get sued for improperly entrusting its customers’ private data to others. Certain industries are also coming under more scrutiny for their privacy practices. For example, in the healthcare industry , the Health Insurance Portability and Accountability Act (HIPAA) imposes some very significant requirements about the use, protection, dissemination, and collection of personal data relating to individual healthcare-related information (including copies of bills from doctors that employees submit to employers, healthcare data transmitted to IT service providers, and the like). HIPAA applies to all sorts of transactions involving personal information regarding healthcare consumers, and it likely will apply to everyone who touches that data. Thus, it clearly applies to insurers and healthcare providers, but it also applies to companies that run their own healthcare plans and vendors providing certain services to entities covered by HIPAA. Moreover, HIPAA requires an information security regime for anyone handling data covered by the Act. Thus, the healthcare industry will have to be particularly careful about its business relationships, even when using outsourced service providers, a common practice today, to provide services that relate to management, manipulation, or transmission of data that contains information protected by HIPAA. That is a very big change in the healthcare industry, and it may portend changes in other areas. In the situations described above, where a company may be providing private data to a third party, the company should perform an analysis of the trading partner’s ability to protect the company’s data. So the company might review the third party’s information security practices (firewall use, training, antivirus

81

Inside The Minds

practices, incident response practices, and related matters) to determine whether the third party will protect the data sufficiently. Then, if a problem does arise, the company will have a stronger likelihood of proving it acted reasonably and should not be held responsible for the conduct of the third party. The various bodies of law that govern the recourse that would be available if data falls into the wrong hands are still developing. For breaches of privacy policies, a common claim against companies that may have misused customer data or allowed it to be misused, a court is likely to consider the privacy policy a contract between the consumer and the company. The contract (the privacy policy) would be enforced according to its terms. Further, as the FTC indicated in its actions regarding Eli Lilly, if data is collected and stored in a company’s system, and the company suffers a break-in, assuming an individual was damaged as a result the theft of his or her information, it is very likely the company could be held liable for the misuse of information by the thief, particularly if the company did not take reasonable measures to prevent such a theft. Certainly, having good information security and privacy practices will help reduce the risk of litigation and possibly mitigate the penalty that might be imposed if a company is found to be liable. Public Opinions Regarding Privacy Issues People express the opinion that their data is not secure if it is transmitted across the Web; however, it is likely that some of the people who fear transmitting data across the Web are not careful about tearing up their paper credit card receipts. Consumers may be putting their personal information at just as much risk in paper-based credit card transactions, if not more, than they would entering credit card numbers and personal information in a form transmitted over the Web using some of the more modern data transmission security technologies. Many people do not

82

Privacy Matters

realize that information they put in e-mail is totally available to anybody unless it is encrypted. People also do not pay enough attention to the way their information is used by companies and probably do not read the privacy policies to know how that data will be used. A recent survey demonstrated that employees believe they have more protection regarding their privacy at work than they actually have under the law. Employees do have some protection under the law. One example is the Electronic Communications Privacy Act, which addresses the monitoring of employee communications. It does not explicitly cover e-mail, but e-mail does appear to come under the authority of that statute. Employers, however, if they have a business purpose or have their employee’s consent, can generally monitor e-mail and see what employees are doing with the company’s computer systems. The better approach is to ensure that there is a policy within the company that informs employees that the company monitors employee e-mails, sees how they use the computer, reserves the right to access their computer to see what is on their hard drive, and reserves the right to track where they go on the Web to make sure they are not going to sites they should not visit. This is not just to protect companies from having their employees accessing Web sites that are vulgar, offensive, or strong in sexual content. Companies face a big risk of liability from the conduct of their employees. If their employees, for example, use e-mail or a computer system to try to obtain trade secrets of competitors or to perform economic espionage, that company can be held liable for that. So companies often have a strong interest in making sure employees are using their computer systems appropriately.

83

Inside The Minds

Corporate Privacy Policies There is an “opt-in/opt-out” regime for what purposes data can be used. Under this regime, consumers have an opportunity to indicate (by checking a box or clicking on a button on a Web page) whether they are willing to opt in or opt out of particular uses of their personal information, such as receiving advertisements, e-mails, etc. The most pro-consumer form of this practice is to actually require that the consumers take an affirmative act, such as checking a box or clicking a button, to indicate their assent to the use of their data. The other option is to require the consumers to take some active step to opt out of the use of their data. For example, in subscribing to an online newsletter, the subscription form on the Web page may include small type at the bottom that states that the newsletter company provides its data to others for a variety of reasons and that if consumers do not want their data transferred, they should uncheck a box. Many consumers probably do not notice this optout option, so it is likely to generate a higher level of participation than an opt-in regime (where the default is that the consumers allow no use of their private information). Congress has recently offered a lot of legislation trying to combat the problems arising from collection and misuse of consumer data. For example, Senator Hollings introduced a bill called the Online Personal Privacy Act, which provides that companies would have to offer consumers the opportunity to opt in to allowing their private, sensitive information (e.g., account numbers and balances, passwords, political affiliation) to be provided to others. The bill would also require that consumers be allowed to opt out of allowing their non-sensitive data, (e.g., phone numbers, addresses) to be provided to others. The bill also provides for a private right of action against companies that misuse consumer data, although it currently limits the amount of damages one could recover to $500. If the bill passes, there is likely to be a tremendous quantity of litigation regarding the

84

Privacy Matters

misuse of sensitive information. The result of this litigation may be a wide variety of standards developed in various courts across the country regarding the nature of a reasonable standard of information security and data protection. Only time will tell what level of privacy protection actually makes its way through Congress, but Senator Hollings’s bill is a recent example of the kinds of legislation being considered. Absent legislation, it is likely that courts will view these optin/opt-out regimes and the associated privacy policies in the same way they view online contracting. The “click-wrap” license is a good example of an online contracting process. A click-wrap license works as follows. When consumers download software from the Web, at some time during the download process, they are likely to see a window that pops up stating that their use of the software is subject to the license set forth in the pop-up window. The license appears in the small pop-up window on the Web page. Consumers then have to scroll down through a large block of text setting forth the software license, and at the bottom of the pop-up window or in a box in a frame around the license, the consumers will have to click “yes” to indicate they agree to the terms of the license. If they do not click “yes,” the download process terminates, and the consumers do not get the software unless they agree to the license and take an affirmative step demonstrating their assent (i.e., clicking on the “yes” button). Courts will enforce these kinds of click-wrap contracts when there is an actual, affirmative indication that the consumer consents to the terms of the contract. If a screen pops up and says, “This software is subject to this license,” and then disappears shortly thereafter (or does not include the terms of the license), the courts will probably not enforce that license. Courts do consider a number of factors in determining whether an online contract is effective; however, one of the key issues is whether the party to be bound by the contract actually took some

85

Inside The Minds

affirmative step to indicate his or her assent to be bound by the contract and whether the party actually had a meaningful opportunity to review the terms of the contract. Courts will likely look at a privacy policy as a contract between the person giving the information and the person or entity receiving it. So if a company wants to bind individuals who provide data to a privacy policy, it would be useful to have those individuals actually take some affirmative step to indicate they agree to the privacy policy. That positive step, indicating their consent to the privacy policy, may be an important touchstone for the courts to determine whether the privacy policy is enforceable against the individual who provided the data. Most privacy policies do not require this kind of assent; rather, there is often a statement on a Web site that the use of personal information obtained from the Web site is governed by a privacy policy that can be reached by clicking on a small link at the bottom of the Web page. In this circumstance, since the company that operates the Web site cannot show that the individual providing the data agreed to the company’s privacy policy, the company may not be able to enforce the privacy policy against the individual. Using click-wrap software licenses as the model for click-wrap privacy policies, the courts have not required that the parties have an actual printed piece of paper with the contract terms, but they have looked at the accessibility of the contract terms to a user. In this case those terms would be the privacy policy. The courts could take a look at whether it is easy to find the privacy policy on the Web site, or whether the privacy policy flashes up on the screen beforehand, and users cannot continue to use the Web site or software without clicking on something that indicates they agree to the privacy policy. Another issue might be how deeply buried the privacy policy is within other terms and conditions. The level of sophistication of

86

Privacy Matters

the particular user or the target audience may be part of the court’s determination of how enforceable those privacy policy terms are. There are some sites and deals between some companies where one company is providing or collecting data for another, and there is a tension between the two companies about how to actually implement a privacy policy. One company may want the privacy policy to be a link somewhere on a home page, but the company that is collecting or providing the data may have a stronger interest in making sure there is a more obvious, concrete privacy policy and a more straightforward process for making sure an individual who is giving personal information actually consents to the policy. If the company’s policy says they are allowed to use data in some specific way, and the company actually gets users to click on a button that says they agree to the policy, and the company has programmed a system in a way that that a user cannot go any further without clicking that button, they will have a strong argument that any use of that data in accordance with the policy is appropriate. How to handle the process of displaying a privacy policy and obtaining consent to it is an important business decision. The question is how much risk the company wants to take. These days, given that privacy is such a hot issue, many companies consider the risk of bad publicity a serious problem when it arises out of a breach of a privacy policy. Technology and the Future The more accessible data is, the more privacy issues there are. As technology advances, data will be more accessible to a wide range of users. The ubiquitous nature of the “Network” – the Internet and the devices connected to it – will create more concerns about privacy issues. However, one would hope that as

87

Inside The Minds

we develop more technological skill, ability, and effectiveness, we will also be able to create better security systems and better systems for safeguarding data. Advancements such as wireless networks and more ubiquitous access to the Internet and faster computer systems with bigger storage capacity will make the collection and use of data easier, but it will also make access to that data easier. If we are not doing a good job of keeping the data secure, then improved technology will present a much greater privacy risk. Certainly, many companies are trying to address the information security risks, particularly as privacy and information security have garnered such wide exposure in the media. The risks are real, and the consequences are severe. For example, criminals broke into the IT systems of a finance company and stole thousands of data files about individuals and their financial conditions. This conduct was made possible by fast computers and access to the Internet. These attacks and risks do not all arise externally. A company’s employees have tremendous access to the company’s resources, and the possibility certainly exists that hacking into a computer system could be done internally, as well as by third parties. Also, the easier it is to perform an operation, such as attaching a database of 50,000 names to an e-mail and sending it to a business partner who is working on a marketing campaign at another company, the more likely it will be that that data could be intercepted or harvested by a third party and used for improper or unauthorized purposes. Many people are involved in analyzing privacy policies and the collection of data on the Web; the biggest issue to focus on is protecting the data from improper access and use. Recently, there have been a number of positive developments in privacy, including a stronger focus on information and network security, widespread examination and dissemination of

88

Privacy Matters

acceptable privacy practices, and a greater understanding by the general public about the use of private and consumer data. The dark side of the future of privacy, however, is that for every advancement of computer security and technology, there will still be opportunities to hack into computer systems and very talented people who have the skill and desire to break into those systems. The increasing spread of malicious computer viruses and the increasing number of news stories about computer breakins and theft of consumer data demonstrate that advancing technology is both a blessing and a curse. If we continue to focus on security as an important issue that is intertwined with the advancement of information technology, then we will hopefully stay ahead of the people who are trying to defeat the security measures protecting that technology. Attorney Michael J. Silverman concentrates his practice on computer, e-commerce, and technology law and commercial litigation. Mr. Silverman is a partner in the international law firm of Duane Morris LLC, and he is chairman of the firm’s Information Technology and Telecommunications practice group. Mr. Silverman is a former member of the Mayor’s Council of Technology Advisors for the City of Chicago, and he is currently a member of the Information Technology and Telecommunications Working Group for the Metropolitan Planning Council. He served as special counsel for the City of Chicago regarding the Year 2000 computer problem. He is also a certified public accountant. Mr. Silverman represents clients in computer, e-commerce, and technology law matters, systems development disputes, business disputes, and shareholder disputes. Leveraging his accounting, information systems, and auditing background, Mr. Silverman

89

Inside The Minds

has counseled clients on negotiating and drafting systems development contracts and outsourcing agreements, domestic and international software license agreements, Web hosting and development agreements, and telecommunications service agreements. He also counsels clients regarding management of systems development projects, e-commerce risk management, information security and privacy, and all manner of Internetrelated agreements, policies, and practices. Mr. Silverman has litigated complex financial fraud, shareholder, and commercial dispute and systems failure matters in state and federal courts and before arbitrators. Writing and speaking frequently on a variety of legal topics, including those related to systems development contracts, software licensing, cybercrime prevention, and e-commerce, Mr. Silverman has acted as a legal source for various members of the press, including CNN’s “Burden of Proof.” Mr. Silverman earned his undergraduate accounting degree from the University of Illinois in Urbana-Champaign and his law degree from Northwestern University School of Law. Admitted to practice in the United States District Court for the Northern District of Illinois, Mr. Silverman is a member of the American Institute of Certified Public Accountants, the American Bar Association, and the Computer Law Association.

90

Privacy Matters

MANAGING PRIVACY

W. RIKER PURCELL LandAmerica Financial Group, Inc. Vice President and Regulatory Counsel

91

Inside The Minds

Task 1: Making the Privacy Program Work Gramm-Leach-Bliley (GLB) put tremendous pressure on financial institutions to get their privacy statements written and to start delivery to customers by July 1, 2001. To create an effective privacy program in such a short period of time, most people in the insurance industry knew it was vital to put a workable program into place with the intention of tinkering with it after the initial frenzy. As this company started to comply with GLB, there was a lot of mailing and passing of information as we tried to figure out how we do business, what the risks are, and how we would get the rules of the game and the policy statements themselves distributed through our branches, as well as through our agents who issue our insurance policies. We then had to make sure our own internal audit department put our program onto their list of things to check for when they conduct their audits. These and other early actions were aimed at making the program satisfy at least the minimum requirements. As soon as that was done, though, we began to get solid, practical questions from the field; we spotted some gaps to fill and delivered some clarifying instructions. In the title insurance industry, in the early stages, every company was on its own. Everyone thought the best way to do things was to read the rules, make a plan, survey the field, talk to management, and make a good-faith effort to comply. When I give anyone else advice, it is to make your very best effort to come up with a genuine good-faith plan. Sometimes we seek expert advice, and sometimes we make critical determinations ourselves. But we always try, in good faith, to comply with all of the requirements. The privacy officer has to be diligent in asking difficult questions and making sure that the company’s answers will hold water. My impression is that the regulators are going to look for goodfaith compliance. They won’t look for perfect compliance, and

92

Privacy Matters

they will not be too critical of small deviations and errors. Instead, companies that seem to have thought the issues through and seem to be making a continuing effort should be okay. Companies that fall under GLB have to understand the entire picture as completely as possible, try to put a good-faith program in place, and keep it working. The privacy officer must know the rules and the reasons for these rules, and know how to distribute these rules and reasons to the people who can implement. In a company like ours, with about 8,000 employees, I think this means literally keeping a list of names of people in the field who are willing to be concerned about privacy compliance. Again, we should aim for instinctive compliance. People must know the reasoning for the law. There is an important detail in the care and feeding of insurance privacy compliance programs. Although most state legislatures and insurance departments wound up with laws and regulations that are close to the federal standard, some states have adopted laws and regulations that take a different turn. For instance, a couple of states have adopted, and other states are considering, an opt-in standard instead of the more conventional opt-out standard, so that an insurer or insurance agent would need affirmative permission for certain types of sharing. When managers pose questions about a new plan or program, the privacy officer has to slow down and resist the temptation to give the answer based on the prevalent standard. Instead, the privacy officer should look at the sections of any state privacy laws that could govern the particular issue raised. The statutory and regulatory language differs, and because of this, it’s easy to make a mistake. In the end, I think that continuing, good faith efforts will satisfy regulators. We are not as concerned about private lawsuits because GLB and most of the state laws that follow GLB do not provide a private cause of action for violations – that is, only the

93

Inside The Minds

state can prosecute a failure to comply. There is some risk of private lawsuits, especially class actions suits, based upon the theory that violations of privacy laws are unfair trade practices under state insurance law. However, as long as companies exercise caution, the potential plaintiffs should have trouble proving they have suffered any damages. Task 2: Education There are two levels within the company that must be constantly aware of privacy issues, constraints, and laws: senior management and front line employees. First, it is important that senior management understands the company’s privacy limitations. In our company several practices or behaviors could be identified as tempting, but risky. Senior management has to recognize those behaviors and agree early in the game to avoid them. Every time a privacy issue comes up, I am confident that senior management will respond according to the rules. They know what they can and cannot do. I have tried to make them understand where our greatest risks are and why we have to adopt a policy that protects information, rather than disclosing it. If senior management doesn’t understand the issue, then a lot of energy is wasted as managers create information-sharing plans (or plans that have information-sharing as a by-product) that have no possibility of coming to fruition. This could be a plan to sell customer lists or a plan to arrange for software maintenance. When members of senior management are educated about privacy issues, they can recognize problems that arise and tell someone “no” early enough in the game. Second, we must also focus on those employees who actually deal face-to-face with customers. They must understand the rules, so when they confront an issue, they know instinctively what information should be protected. There aren’t many people in between these two levels who can actually mishandle

94

Privacy Matters

information, although mid-level management can certainly hatch ideas that would, if unchecked, lead to trouble. Beyond that, the challenge has been to get everyone in the company to understand the spirit and the intent of the law. Everyone, but especially senior management and front-line employees, needs to know what kind of information and which documents are supposed to be protected, so they can instinctively conform their behavior to comply with the law. That, to me, is the greatest challenge – we need people to understand the spirit of this law well enough that they don’t have to stop and think very hard, and if they do have to stop, they will quickly know the answer. Furthermore, when the insurance examiner comes to check on our compliance, our employees should know what they are supposed to do and demonstrate that they understand the rules and that they are actually complying. The greatest challenge is making sure that everyone who is supposed to know the rules does in fact know the rules. Title Insurance Industry Initiatives Because my company is mainly in the business of performing real estate settlements and issuing title insurance policies, there is a body of information we have to obtain from the public records, and also a body of information (deeds, mortgages, releases, easements, etc.) we have to put back into the public records. In 1982, when the first insurance privacy laws appeared, we thought everything we handled was public information. We would search the public land records and put the information we found into the title insurance policy. We then would handle the closing, and we believed the only thing we ever touched was public information. GLB, however, forced us to look at everything more closely. We realized there were some surprising things in the title insurance

95

Inside The Minds

policy that technically were nonpublic personal information, even though the information would not normally be considered sensitive. This meant, though, that we had to take extra care to prevent the policy from getting improperly into circulation because of the possibility that some bit of nonpublic information would be shared. Also, in the context of the closing, we do receive a quite a bit of important information. The title insurance business helps make sure a real estate closing goes smoothly. We deal mainly with real estate information, but also with some financial information. We don’t ordinarily have access to income figures, but it could happen. We could get our hands on a credit report, but most of the information in our system is real estate information related to the real property that the customer is buying or mortgaging. We often get nonpublic personal information we don’t want or need. GLB has caused us and a lot of other financial institutions to ask questions about the contents of our files and the protection the information deserves. Obviously, a well-tuned document retention/destruction program is an important part of a successful privacy program. Currently we are trying to make all of the pertinent information fit into a database so the information is entered one time, allowing the system to generate documents and make calculations without the necessity of further re-keying. We would also like to create a database that provides those people who are parties to the transaction access, but only to the information they need, so they can check the progress, as well as add to the posted information. Privacy concerns will affect the way we implement this goal. We obviously must worry about granting database access to the right people while ensuring that each person can read only the appropriate information. Not everyone involved in the transaction needs access to every piece of information. For

96

Privacy Matters

instance, we might want the person who supplies the appraisal for the real estate closing to be able to confirm that we’ve received it, but that person obviously doesn’t need to know the loan’s interest rate. So our concern becomes making sure they can get into the system but retrieve only the information they need. Technology is a versatile tool. It allows us to collect, sort, and retrieve information and documents. It also allows us to open the files to interested parties, while blocking access to certain information. In some very important ways, privacy policy is implemented by electronic means. Technology Trends There is no doubt advances in technology will lead to more opportunities for sharing. More computer programs and marketing firms will promise to describe the consuming public by name – who the consumers are, where they live, and what they want to buy – for a variety of marketplaces. On one hand, computers will make all of this information more available. On the other, computers will also make it theoretically more possible to screen and block out information in compliance with the laws and regulations. My guess is that these two trends will go hand in hand. Privacy demands and technology will develop together. As the business people who are responsible for making decisions actually determine how to slice, dice, and share information, they will also have a growing capacity to screen, block, and protect. This means technology will allow companies to individualize privacy protection. If a consumer indicates he wants more information about the types of products he has already bought, but doesn’t want to hear about other, unrelated products the company may offer, the company should be able to use technology to deliver

97

Inside The Minds

only the information the customer has indicated. In a perfect world, the legislatures would pick up this trend and pass laws that call on industry to tailor their programs to individual preferences. Companies that lack the hardware and software to tailor their programs will simply have to limit or eliminate any sharing. Two things we can’t predict are consumer tolerance and legislative concern. I don’t think anyone truly knows how the consumer in general feels about having his or her information sliced, diced, and shared. That is an unpredictable element. If consumers become furious about the way their information is shared (as a result of technology, mainly), then they may complain in large numbers to their legislators. This is a highprofile topic now. At least for the moment, consumers can get their legislators’ attention. There’s a question whether legislators will continue to be interested in the topic of privacy. For example, as a result of the September 11 terrorist attacks, Congress passed laws that favor the collection of private information over privacy concerns. Is privacy one of those concerns that remain for decades at the forefront, like civil rights, or is it more like antitrust enforcement, which drifts in and out of legislative favor? I would say most people don’t mind getting some junk solicitation via the Internet, by mail, or even over the phone. They don’t mind getting the junk as long as it doesn’t contain references to really private information. A cautious company will think about this before delivering solicitations. A very few people are adamant about the entire topic: They don’t want anything mailed to them, and they want their information completely private. There will always be some of those people, and their concerns need to be addressed. It seems to me that technology makes it possible to individualize the protections. Legislatures will ensure that virtually all

98

Privacy Matters

information can be blocked upon consumer demand, so businesses must weigh their ability to protect the rights of the adamant few. If a business doesn’t have the technology to block a customer’s information, then that business will probably have to abandon any plans to sell or to share information. In summary, technology will put powerful tools into industry’s hands to collect, sort, and retrieve information and to share or limit access to that information. The course of privacy will not be determined by that growing capacity, but by consumer concerns and legislative interest. The Personal Privacy Dilemma Privacy issues often go deeper than many people realize. For example, our company is a self-insurer for health insurance, which means we have to comply with HIPAA (Health Information Portability and Accountability Act), as well as with GLB. I am not sure every employee understands how much of their health information may be stored within their employer’s files. Every time they take medical leave, it is part of a company’s records. If the company administers a flex-spending account, the records are right there in the company. I am not so sure employees stop to think about that, but at the same time, most companies wouldn’t dream of doing anything with the information. This is a single example. The point is that most of us don’t spend time thinking about where our sensitive, personal information is stored or who may be transferring that information. I think most people are not very concerned about personal privacy. Certainly almost no one is bothered by the release of a lot of demographic information that has been purged of personal identifiers. If you subtract the name from the information, it becomes completely non-personal. It makes a lot of sense to me

99

Inside The Minds

for everyone to get used to having their buying patterns monitored, but without their names being involved. I am, however, personally bothered by all sales of individual customer information. I don’t think it is anyone’s business to know personal buying habits. Even the sale of customer lists irritates me. Fortunately, I do not buy anything that embarrasses me, but I can certainly imagine that it could happen. I am very opposed to all sales of personal customer information. On the other hand, I have tremendous confidence in the medical and financial establishments. Perhaps the confidence is misplaced, but I don’t believe they are selling the information I really care about. I am irritated, but not angered, by the sale of my name and address. However, it would bother me greatly to think they were selling my account size, my income level, or the prescription drugs I might be using. If I could make the law myself, I would prefer a system that allows all sharing necessary to accomplish the customer’s purpose and to prevent fraud or unauthorized transactions. For this sharing, no particular customer permission would be required. Any company would be allowed to share information with affiliates or even non-affiliates, as long as they were taking care of the business the consumer had brought in the first place and preventing fraud. This is pretty much the standard established by GLB and state laws. However, a company that means to use the information for any other purpose, such as marketing, or cross-checking files (except to prevent fraud), would have to get the consumer to opt in. I believe a company should be able to do everything it needs to do to handle the transaction and prevent fraud, but it shouldn’t be able to use the information for marketing or other purposes unless the consumer consents.

100

Privacy Matters

One frightening scenario that motivated the U.S. Congress to pass GLB was, in fact, permitted by the final law. Recall that GLB was not a privacy law, but instead was intended to replace the Glass-Steagall Act and other Depression-era laws that prohibited the common ownership of different types of financial institutions. Before GLB a bank and an insurance company could not fall under common ownership. After GLB, a lender and a life insurance or health insurance company may be owned in common. When you go to the bank for a business loan, the lender can check with the life or health insurer to find out your medical condition. Your loan application could be rejected because you are being treated for depression. The bank knows of the illness because their affiliated insurance company told them. Gramm-Leach-Bliley doesn’t prevent that because affiliated companies can share information freely. And yet that is exactly what the legislators were trying to guard against. This is one type of information-sharing I wish GLB had prohibited. In some ways GLB has done a good job of protecting personal information. In some ways, it has failed. It should make consumers aware of the business use of their information, and over time, the legislatures will react to public concerns. At the moment, I do not see an overwhelming level of public concern. Privacy Trends The widespread use of Social Security Numbers creates genuine problems for individuals, and I expect more direct protection of that information. California has adopted a law that prohibits many uses and transmissions of Social Security Numbers, and this law may become the model for laws in other states. In this regard, the problem of identity theft looms large in the public and legislative eye. Specific protection of Social Security Numbers is one probable legislative reaction, but other measures, similar to the more general GLB protections, will be enacted.

101

Inside The Minds

These measures will touch every business operation, including retail establishments. The California law has a feature that could signal a direction for privacy legislation. It prohibits any requirement to transmit a Social Security Number (employee or customer) unless the number is encrypted or the site is secure. This type of interplay between privacy and electronic security will be a part of privacy legislation, and again it suggests that businesses have to invest in a certain amount of electronic hardware, software, and expertise. “Customer relationship management” is a currently popular marketing theory that has achieved modest buzzword status. Each time a consumer has contact with a company, the company collects some information about the customer’s buying preferences and patterns. Theoretically, the company can interpret all of that information and offer the customer the exact product or information he or she wants. This customer relationship management will be affected by privacy issues, as well. Companies that make an investment in hardware and software will be able to practice relationship management, while those that don’t make the investment will be prevented. But beyond that, if privacy rules do trend toward individualization, then the laws may permit individuals to tell the companies to leave them alone. Then a company’s computers will need to be able to cut that customer out of the program. The privacy provisions of GLB pertain to the intentional sharing of personal information. GLB also has security provisions that relate to the susceptibility of our information systems to intrusion. The security provisions of GLB are an issue in the insurance industry at this moment because state insurance departments are adopting regulations that conform to GLB. This development directly affects only people who work for the insurance companies that will adopt new security measures. I mention it here because improved security enhances consumer

102

Privacy Matters

privacy, and those who work in industries that have information to protect can expect to see more security measures adopted. National security interests in the form of the recently enacted U.S.A. Patriot Act compete with privacy interests. This law expands an existing requirement that banks and securities dealers screen transactions for possible connections with terrorist or narcotics trafficking groups. Now other industries that handle funds must also screen transactions. Suspicious transactions must be reported. The natural result is that some innocent individuals will find their privacy rights have been overcome by competing national security interests. For the foreseeable future, national security interests will nibble at the edges of privacy. We are very likely to be affected in the U.S. by the privacy regime enacted by the European Union. The EU rules reach far beyond financial and medical institutions and require every industry to limit the sharing of personal information. Specifically, the laws prevent the transmission of personal data into a country whose laws do not offer certain protections for that data. If the complete regime were to be enforced, multinational companies, whether they sell insurance, chemicals, or soft drinks, won’t be able to transfer customer or employee data without being concerned about privacy. While it hasn’t hit yet, I suspect this is the next step. European companies may be prevented from doing business with U.S. companies unless the U.S. companies can guarantee they provide the same protections the European laws provide. Currently, this blockade is interfering with some international trade. Many U.S. companies that operate internationally have adopted the European rules. International trade groups and governments are negotiating over this issue, but the result will probably be that U.S. corporations will have to comply or accommodate because, while the European Union may soften its position, it will not give in completely. All U.S. companies, not

103

Inside The Minds

just financial institutions, that want to sell goods and services in Europe will have to put privacy programs into place. I expect more privacy protections for employees. Most companies have codes of ethics and conduct that protect the confidentiality of human resources files, but very few laws mandate confidentiality. If legislatures keep privacy on their agendas, then we can expect laws requiring companies to adopt a privacy program that protects the information that employers collect about their workers. Customer Sensitivity Is Critical When the privacy provisions of the Gramm-Leach-Bliley Act became effective, the immediate response was to get a program up and running. Soon, another more measured response emerged. Companies could use this as an opportunity to explain their concern for privacy and to offer appealing choices to their customers. Many businesses have been restrained and gracious, as opposed to greedy, in their exercise of the tantalizing datacrunching power of computers. This seems to me to be the correct approach. As more and more companies fall under some form of privacy regulation, this customer-sensitive approach is most promising. Companies first must develop substantial computer power so they can honor each customer’s interest in participating in or being left out of the menu of offerings. Then they may describe their capabilities to the public and offer the benefits. Most important, businesses must then ask each customer to make choices. If we use the power to satisfy consumer demand, rather than to squeeze another nickel onto the bottom line, there may be two results. First, we may forestall an angry public reaction that will lead to more laws. Second, companies that do this job well should increase their pool of happy customers.

104

Privacy Matters

W. Riker Purcell is vice president and regulatory counsel for LandAmerica Financial Group, Inc. He holds degrees from Virginia Military Institute (BA, Honors in English), the University of Virginia (M. Ed.), and Washington and Lee University (JD, managing editor of the Law Review). After a total of five years of private practice in Savannah, Georgia, and Roanoke, Virginia, Mr. Purcell joined Lawyers Title Insurance Corporation in 1984 and served as associate counsel-Claims for the Pacific states, as underwriting counsel, and as associate regional counsel-Middle Atlantic States. As regulatory counsel, he handles regulatory relations with state insurance departments and federal agencies, works with internal corporate matters, and is also involved with litigation and legislation. Since late 1999, he has been primarily responsible for the development and implementation of LandAmerica’s privacy policy. He is a member of the state bars of Georgia and Virginia.

105

Privacy Matters

GLOBALIZATION, TECHNOLOGY, AND PRIVACY

ALAN D. BOEHME GE Power Systems E-Technology Chief Information Officer

107

Inside The Minds

Privacy Meets Technology in the World The greatest changes with regard to privacy are the result of two trends: business globalization and the technological shift from local computing to network-based solutions driven by the use of the Internet and associated technologies. With the establishment of data protection laws in some 34 countries, including members of the European Union, Japan, Australia, and Canada, but not yet the U.S., conducting business in your own country or across borders has been changed forever. (This all started with an EU personal data protection initiative of 1998 – EU Directive 95/46/EC, protection of individuals with regard to the processing of personal data, and EU Directive 97/66/66/EC, concerning the processing of personal data and the protection of privacy in the telecommunications sector.) Individual privacy laws can now be applied to your employees, your contractors, your customers, and your suppliers, depending on their place of employment, nationality, or location of data input or access. Managing the multiple relationships among those individuals and roles – an individual may play multiple roles, a customer in one transaction and a supplier in another – is a very daunting task, both technically and from a process perspective. The first decision you must make is whether to look at the transaction from a lowest common denominator standpoint, adopting the most stringent interpretations from the various countries, such as those in the EU and applying them globally. Or will you try to maximize the availability of information within the laws for the various countries in which people work or reside? To add further complications to privacy issues, in the past we have even seen countries such as Canada consider applying data privacy laws governing their citizens extraterritorially. If such laws were ever passed, and even if a corporation could, technically and from a process perspective, comply with such a proposal, enforcement across boundaries by the governing state would be next to impossible. In the

108

Privacy Matters

meantime, we have quite enough to deal with today in differing laws, technical challenges and hurdles, and the ever-changing rules and regulations we have to comply with. Throw on top of that the export-control regulations the U.S. and other governments have on certain technologies and information, along with the consumer protection laws in the U.S. that vary by state, and it becomes a very complex task that needs to be managed carefully. You must be sure you are 100 percent of the time within the laws of the countries where you are doing business, while still being flexible enough that you don’t impede your ability to conduct business, reengineer your business processes, or work successfully with your customers in an electronically enabled, collaborative environment – all without going to jail or being fined out of existence. Individuals’ privacy is clearly being affected by technology. In the U.S. when you work for certain companies, every time you log onto your computer, you must acknowledge that you make an exchange for the ability to take advantage of the device for reasonable personal use (including browsing various Web sites). The organization’s computers and networks are the property of that company, and as such, the company has the right to restrict access to certain Web sites and monitor the usage of that asset (the computer). They can also monitor their employees’ time and productivity to determine what their employees are doing and what they are looking at. In many instances, employees sign a waiver when they join the company, providing the company the right to do this. As an in individual, you have only one option available if you disagree with this Big Brother–like activity: Resign your position and find another organization that is less restrictive in its approach to monitoring employee actions. If you are shocked by hearing about these monitoring activities for the first time, remember society, technological advances, and the freedoms we take for granted have historically been used

109

Inside The Minds

against many corporations through the filing of lawsuits regarding abusive work environments, etc., caused by careless individuals downloading inappropriate material. These actions by the few have left many corporations no choice but to apply advanced filtering technologies to block access to those sites considered offensive, and monitor employees’ activities to protect themselves and head off potential issues before they arise. This need to protect the corporation, however, needs to be handled carefully, as it is conceivable that, without proper oversight, a worker charged with implementing monitoring technology could go overboard in blocking access to useful sites and potentially affect the careers of others negatively. Technology giveth and technology taketh away. Corporations conducting business internationally have an entirely different set of issues to deal with, as privacy laws vary by country. Germany’s laws differ from those of France, which are different from Italy’s, which differ from Australia’s laws. Even within Germany, multiple data privacy authorities exist by state. As a result, to be in compliance, you really must understand the local laws. Because the U.S. has yet to establish privacy regulations similar to the European Community, for those U.S. companies conducting business in the 15 EU member nations, the U.S. Department of Commerce has implemented the Safe Harbor privacy program. In theory, if a U.S.-based company adheres to the principles set out by the DoC and receives certification, they should be in compliance with the EU regulations. Interested individuals or organizations should check with the DoC or a knowledgeable attorney for more information. Only a knowledgeable attorney, given your specific situation – i.e., your nationality and the country in which your organization is incorporated and operating – will be able to sort out all of the various laws that could apply to you today. Laws are changing quickly. Attorneys constantly have to keep up with new changes. Legislation is just now beginning to be

110

Privacy Matters

challenged in courts around the world, while new laws are continuing to evolve globally without any agreed-upon set of standards. In a globalized, connected business environment, to sort out these issues and provide a base set of laws that both protect personal privacy and facilitate commerce equally, it may take involvement of a neutral organization, such as the United Nations. Although we eventually had success with the structured introduction of EDI (electronic data interchange) and some success with the establishment of common global commodity codes, the amount of time it took to achieve these would never fly in today’s fast-moving, interconnected world. By the time a global organization addresses privacy issues in a consistent manner, most countries will have already put into effect a myriad of conflicting laws that will technically be impossible to implement and monitor (not to mention enforce) and that could threaten to undo many of the advances we have made in bringing down boarders to facilitate global commerce today. Perhaps greater hope lies in regional adoption of laws by groups such as the EU and other organizations, so business and technologists have a reasonable chance of succeeding in meeting the requirements, as opposed to trying to provide individualized solutions in more than 200 countries. While EDI did evolve through a cooperative effort, the Internet, on the other hand, has been evolving willy-nilly in many ways. The adoption rate differs by country and by region of the world (for a variety of reasons including local laws, telecommunication infrastructure, and education level), and many companies are finding it very difficult to keep up because of resource constraints, lack of knowledge, and other problems. I personally believe that from a technical perspective, privacy issues, along with copyright and content ownership issues, will become more pervasive in the future. Presently Europe is ahead of the U.S. in addressing these issues. One reason, other than historical privacy concerns of the various nations, is that Europe in many ways has

111

Inside The Minds

had to deal with different issues sooner than the U.S. because of the higher adoption rates of standards for mobile commuting, wireless, and peer-to-peer technology, such as Bluetooth and others. With the predicted wider usage and penetration of peerto-peer computing in the U.S., we will be forced to address similar issues shortly. Although we have seen copyright infringement cases brought against peer-to-peer-based companies such as Napster, since the U.S. does not have an electronic data privacy law, we have not yet addressed the issues that the technology itself presents – but it is coming. Once peerto-peer is as pervasive as Web browsing, and when it is used as frequently for the sharing of information as instant messaging services, the U.S. will have to consider yet another whole new level of privacy issues we have not had to deal with aggressively. This, combined with the growing multifunctional aspect of communication devices, means privacy laws as they relate to cell phones, PDAs, and the like, will need to be revisited, especially in light of text messaging and e-mail access, instant messaging, and other uses. These privacy concerns will continue to expand because technology is expanding so quickly, and the delivery mechanism of all of these things is expanding so quickly. Privacy Continues to Be an Issue From a legislative standpoint, many countries take privacy much more seriously than others. The question then becomes not whether you can actually legislate privacy, but if you can legislate it, how you can then practically enforce that legislation when the practical implementation of the technology itself may not be capable of doing it. And then, is it right to hold all companies responsible for enforcement, even those that are only a provider of basic services, such as wireless or ASP, and not actually party to the transaction?

112

Privacy Matters

Privacy and the issues around data protection and the way it has evolved have roots in the background or philosophies of how various personal rights in general have evolved in different parts of the world. Many European countries’ laws are based on the Napoleonic Code, where the individual’s rights are deemed to be protected by the state if not legislated illegal. The Napoleonic Code is very paternalistic in nature – the state guarantees your protection – whereas, U.S. law is quite the opposite. Our basic rights are guaranteed by the Constitution and the Bill of Rights, and restrictions to these evolve over time as laws are passed and cases are adjudicated in courts of law. Because of these different philosophies, many Europeans and Americans have differing views on what types of protection are needed. Historically, when the content and flow of information were constrained and held in a physical form, a country could legislate whatever it liked and could enforce these actions at its boarders. Today, because of technological advances and the interconnectivity of networks, combined with the increasingly global economies and interdependencies between countries for both financial and trade transactions, we find ourselves faced with questions regarding our basic legal rights. The European Community appears to be approaching this from an opt-in perspective; whereas, the U.S. approach has been opt-out. Data privacy certainly can be legislated, because anything can be legislated. From a practical standpoint, however, it will be very difficult for any company to provide technology that guarantees an individual unconditional privacy. If you are looking for total anonymity, the best way to guarantee privacy is to lock yourself in a room and not come out. As technology rapidly advances, in the short term, there will no doubt be many more privacy issues. In the medical field, where more and more patient information is being made available online, there are many issues emerging concerning who should

113

Inside The Minds

be able to share that information. Although in the U.S. this is regulated by HIPAA (U.S. Healthcare Portability Act of 1996), we must consider whether these regulations will be able to keep up with expanding use of technology to the benefit of the patient. Worse yet, could it inhibit the sharing of information that would otherwise save someone’s life? With the advancement of technology and possibilities of sharing information as individuals, we must constantly weigh the benefits of sharing information against maintaining our privacy. If we knew the sharing of information between a patient, his or her insurance carrier, a hospital, a pharmaceutical company, and an unrelated researcher or physician in a different part of the world would save one life at the expense of giving up someone’s individual privacy, would we do it? Who has the right to decide? More important, who ethically has the right to decide? These questions go back to trust: If you trusted the parties involved in the information exchange, few people would withhold the data to save a life. The problem is we do not trust the government, agencies, corporations, or other individuals we don’t know with our personal information, and neither legislative action nor the best technology in the world will change this reality. These human issues are as old as civilization itself; technology and globalization only offer additional complexities we have never before faced. The privacy concerns we are discussing today have become a reality because the Internet is an enabler and a facilitator of change, and its use is limited only by our imagination. Technology is advancing so quickly today, and its effective use or misuse is limited only by the creativity of the individuals involved and their moral and ethical standards. This is why we have newfound privacy concerns – which gets us back to trust. Since technology is the one thing that crosses enterprises, and individuals and their relationships cross enterprises every day, it will get worse before it gets better, until some type of

114

Privacy Matters

organization or some type of ruling comes out that establishes the ground rules for trust and reverses that direction. In the United States it will be difficult. We have constitutional protections for freedom of speech and freedom of expression. Who is to say what can and can’t be shared? If a hospital or a pharmaceutical company can collect certain information from you, what stops them from sharing that information? Yes, there are privacy acts, previously mentioned, that protect the sharing of some of this information, but there are other laws and moral standards we could be violating. In other countries, of course, it will be different. Protecting Yourself First of all, privacy is a fallacy. There is no such thing as public and private anymore, especially in the world of the Internet. Anything you put online, you must consider public information. It may not be legally right, and it may not be what you desire, but it is the reality. Online privacy is almost an oxymoron. The reality is that most of us gave up our privacy many years ago when we started answering questionnaires in school or for market research firms. Today’s privacy concerns are really just an extension of what has happened over the years. You could say those people who are involved in watching television shows with the Nielsen Ratings organization have also given up their privacy. The Nielsen company knows an awful lot about them. Yes, they can influence much of what is watched on American television and a lot of the related decisions, but at the same time, they have given up a lot of privacy to participate. The key is they elected to participate, and they have established trust with the company.

115

Inside The Minds

Consumers do have a choice with regard to privacy. If you want to remain very private, get an unlisted telephone number, and a post office box. If you want private e-mail, don’t relate your e-mail address to your name. If you want to be private, don’t sign any forms that allow information to be shared. It really is the consumer’s choice; yet most consumers, I believe, do not take the time to realize it’s their choice. As a result, they allow their information to be widely shared. Largely because of the Internet, it is easier and faster to share information today than ever before, and the sharing of information is how people, especially on Web sites in many cases, have built their products and provided personalized Web sites to consumers. All you have to do is look to Amazon.com for an example of how effective an organization can be at aggregating information about certain individuals and using this data to sell, cross-sell, and up-sell products and services. Technology makes it easy to share the information, and if used properly, reputable businesses can use the information to help the consumer wade through the ever growing and increasingly unmanageable amounts of online information. But if an unscrupulous company or individual gets hold of the information in the public domain, it is more difficult to reclaim your privacy. Many Web sites you visit place cookies on people’s computers on a regular basis. When you sign up for a site and knowingly or unknowingly accept its terms and conditions, the information collected may be used by the site for a variety of purposes. Based in part on offers I have received via e-mail, I believe many sites cross-reference information between other publicly available sources, so they can mine information. In many ways, this is no different from what the top direct-mail organizations have been doing for a number of years. In doing this, they are building databases of information – profiling people. If they can get demographic and other preference

116

Privacy Matters

information, then they can build a pretty good profile to targetmarket to you. The result here is in the electronic world this means we are evolving into the realm of “permission-based marketing,” where you either knowingly elect to participate or by virtue of not reading all the terms and conditions on various sites and just clicking through, you agree to participate by default. Although direct marketing is not new, the ease of sending out mass e-mail campaigns to individuals has caused a flurry of legislative actions in an attempt to control the flow. It is interesting that online e-mail campaigns are treated differently from direct physical mail campaigns that produce billions of pieces of “junk” mail every year. You now have the right to stop junk e-mails, but the same right does not apply to physical mail. One reason for this may be that the elimination or significant reduction of unsolicited mail may have a negative impact on the financial structure of the U.S. Postal Service. With the advent of online bill presentment and payment already reducing post office revenues, the outlawing of junk e-mail would undoubtedly be challenged by numerous corporations, and the policing cost and processes that would need to be put in place to support an opt-in policy would most likely not be practical. The postal service and government need to find a way of creating a viable long-term business model for the postal authorities, given the evolution of content and its delivery to a digital format. Perhaps one solution would be for the postal service to evolve into providing trust for privacy-related issues – but who would trust them? In some ways, the people who do a very good job at this sort of profiling are not the most problematic. Many times, it is the people who just get the names that are causing a lot of the problems. Because e-mail is so easy to send and can be sent from

117

Inside The Minds

a country outside of U.S. jurisdiction, many of the spam problems actually come from here. The global nature of the Internet works for the consumer in letting you find information and conduct commerce anywhere in the 24 x 7 world, but at the same time, it still is the Wild West, and it will be for a while. You must be very aware. Every time you go to a site, don’t just click through Terms and Conditions. Unfortunately, you have to read them. Sites do sell e-mail addresses, and unfortunately some personal information, on a wide scale, as well. To combat these abusers periodically clear out your cookies in your browser. Although most cookies are can be useful to the consumer – such as those from sites that plant a cookie so you do not need to enter your username and password each time you visit the site – some cookies are used by other sites to record your preferences as you transit the site, and this information is in turn collected and can be sold to other organizations. You can periodically go through, and whenever possible, remove yourself from mailing lists, though this is a daunting task, and the spam out there is worse than ever. I recently spoke with a friend in Belgium who took a two-week holiday and came back to find 840 e-mail messages in his inbox, of which 730 were unsolicited marketing offers for a variety of goods and services ranging from insurance offers to pornography. This problem is definitely global, and you need to do whatever you can to slow the spammers down. This is not so much a question of legality, as the rules and regulations vary from country to country, but it is just the pure harassment that will get to you over time. Unless you live in a country that will let you use anti-harassment laws against these organizations and people, and you have the financial resources to pursue them, I would take other actions first. I personally advise keeping a private e-mail account that you don’t use to register on any sites, and keep another account that you use when you do have to register on a site, and let all of the junk mail go to that one. Short

118

Privacy Matters

of buying or subscribing to various filtering software for home use, your options are limited. Again, if you want things to remain private, don’t talk to anybody. If you truly want to enforce 100 percent privacy, you can’t communicate with anybody. I think the best advice I have received over the years came to me a few years back, when I was out on a press tour promoting some new products we were launching. The PR people and the legal team told me to remember there is no such thing as “off the record.” Anything you say is on the record and can be used for you or against you at any time. So if you don’t want something to come back to you, keep your mouth shut, and do not share the information. Today this advice applies in an online environment, as well. At any given time, you never know whom you are dealing with. People can misconstrue information, and you really don’t have much recourse. Be very cautious. More damage can be done by providing too much information than can be done by not providing enough. From a business standpoint, businesses in general use firewalls, filtering technology, and other means to make sure inappropriate information is not readily exchanged. Data privacy applies to business to business (B2B), as well as business to consumer (B2C) transactions, and most corporations comply with the intent of the laws, which allow for the collection of personal data for the purposes of conducting contractual business dealings or rely on implied consent to complete transactions. In addition, businesses protect confidential information through technical means, such as restricting the file sizes that can be transferred across the Internet or access to certain sites, newsgroups, or the public Internet itself. As an individual you can obtain software from your ISP to perform similar services, purchase it online as a service – or even download freeware, so you can screen for known e-mail

119

Inside The Minds

addresses of abusers. In addition, you should take other steps to protect your privacy, such as cleaning your system regularly. This includes cleaning your URL history, browser history, cookies, and cache; changing your passwords regularly; clearing out auto complete forms and password data; and eliminating or deleting recently viewed documents. There is other software you can buy that will hide applications such as Word and Excel from unintended visitors, and hide open browser windows and instant messaging services such as those of AOL or MSN. If you own or operate a PC connected to the network or own a Web site with a dedicated static connection, you may want to consider taking additional measures to protect your privacy by protecting your computer’s IP address. (If you have a dial-up connection, you have less to worry about, since each time you log on, your IP address changes.) Your IP (Internet protocol) address contains basic information for where to find your computer on the Internet. Every Web site that connects to the Internet has a unique IP address. Your IP address is as valuable as your home address, and you should consider protecting it as you would other private data. If someone gets your IP address, they can attempt an assault on your PC and try to steal your personal data. Even with firewalls and the anti-virus programs that are readily available, given enough time, a hacker can break into almost anything. If you truly are concerned with these types of activities, you can buy software or subscribe to services that that will mask your IP address. At a minimum, ask your ISP provider for a dynamic IP address, so you can become a moving target for hackers. Clearly, there are many things you can do if you are concerned about your privacy and have the dollars to spend. Most large businesses have the advantages of large budgets and large staffs to be able to do just this. As an individual at home, you might not have the resources available, but if you do, you need to

120

Privacy Matters

decide whether you want to spend the money or deal with the aftermath of not being proactive. The easiest way to protect your privacy is to keep your e-mail address and other personal data private in the first place. Give it only to trusted family members and friends. Don’t enter it into Web forms or when shopping online. When a site asks you to enter your e-mail address, a good rule to follow is either to leave the field blank or to enter a secondary address you use for junk mail. This practice is the same as setting up a P.O. box for all your bills and magazines, while maintaining your home address for friends and family use only. Even with taking these precautions, e-mail messages still may not be safe from individuals who have the tools and wherewithal to intercept messages in transit. To help combat this potential invasion, encrypt the contents of the messages so only you and the intended recipient can read them. Again, these services can be purchased for a fee from various third parties, or you can download free software from various sites. Once you lose your privacy, it is possible to get back some of it, but other parts are much more difficult. You can change your email address, but people will find you. You are not always in control of your own destiny where, for example, viruses are concerned. If your e-mail address is in someone else’s online address book, and they are subject to a virus attack, it is conceivable that suddenly your e-mail address and information can quickly be shared all over the world, and the process starts all over. It is best never to venture “out there,” but this is neither practical nor any way to live. Today it is difficult to be anonymous – you just have to accept this as a fact of the “new economy.” If you give an interview to a publication, you don’t own the rights to it, so there is no way to retrieve that information.

121

Inside The Minds

However, if there is certain information that someone accesses illegally and then posts it, you do have some recourse. In this case, you can certainly write a letter or send an e-mail requesting its removal. Corporations do that when their information is used inappropriately. Unfortunately, whereas individuals obviously have the right to do the same thing, they most often do not have the resources to follow up if the people are not willing to agree to their request. Most people do not have the financial or other resources necessary to do that, unfortunately. Again, prevention of the spread of information is much better than trying to go back after the fact and clean it up; this will always be true. Protecting Your Company A company has to face many challenges: liability, employee privacy, and company privacy. Companies must look at privacy from an employee perspective, a customer perspective, and a supplier perspective; whereas, most of the time a consumer is simply looking at it as a purchaser of services, protected by various consumer protection statutes at the state level, without having to play all three roles. Because a business involves buyers, sellers, employees, contractors, and customers, the job of a business is many times harder and more complex. In our company, the person who is primarily responsible for dealing with privacy concerns is our chief privacy leader, who happens to be an attorney. This person interprets the laws and sets the rules, regulations, and standards by which we operate. As a CIO within the business, I am simply a consumer of their direction. I have to make the right technology choices and implement technology that enables the business to meet its objectives but falls in line with what these individuals say. At the same time, I certainly do not make the policy. That comes from our chief privacy leader.

122

Privacy Matters

For a company to protect itself, it must be flexible. Any system or process you design must be done (1) within the laws that exist at the time the decisions are made on how to develop, build, and implement the application, and (2) in such a way that allows you to easily change how you do things. If you build the flexibility in – and there are ways to do that technically by loosely coupling applications, separating the presentation layer from the business and application logic (and doing it that way up front, which is really just good, basic objectoriented design approach that many top IT organizations follow) – then as laws and regimes change, you can quickly adjust your applications. Also, you can protect your company via the use of a variety of tools, including security software, single sign-on tools, and directory services from a technical perspective. Whether it is Microsoft Passport in the consumer realm, or their active directory, or another company’s LDAP-based directories, which are used by a number of businesses, technology that is used for these services and those that control access, authentication, and various security models will play a more important role in the future. Another good rule to follow is not to talk about your specific IT architecture or infrastructure with anyone. Many times I have been approached by reporters and consultants seeking information on enterprise security, network infrastructure, or products used by the organization. They want to write a story or propose services. Keep in mind that your infrastructure should be treated no less securely than the government treats the infrastructure around Ft. Knox. The slightest leak of information can and will be used against you by malicious individuals seeking to penetrate your organization.

123

Inside The Minds

You also have to consider flexibility of the information and how you will be able to relate that information in the future. Think of it almost as an inference engine. Can you infer information and use it to help you maintain flexibility? Flexibility is the one thing a technologist or a technology-driven company really has to focus on in the future. We have built flexibility into our systems so we can change our system and our business roles as the roles around us evolve, regardless of whether change is driven by legal or commercial issues. We have built a very robust and flexible system. You need to invest in the flexibility because that is how you will prepare for the future. You don’t want to be in a position where you have to tear things apart because something changes. You must stay in constant contact with your legal counsel and with your advisors and committees working on these issues because you must be prepared on a moment’s notice to make changes. The Future Privacy issues will get worse before they get better. The importance will grow as less sophisticated users of the Internet come online, who are not necessarily aware of how this information will be used or shared, and as technology advances and more devices are interconnected. This has been a problem in recent years, and it will continue to accelerate as the penetration and the availability of Internet technology reach more and more of the global masses. Businesses are becoming more and more aware. Businesses that are reputable brand names with high integrity will do whatever they can to make sure that for any information these organizations use, permission has been obtained up front and usage fully disclosed. Unfortunately, there will also be unscrupulous people, individuals, and firms who will take

124

Privacy Matters

advantage of these privacy issues for their own personal gain. All you can do is be aware. From a business standpoint, I hope the world bodies, such as the United Nations, would be able to agree on a set of rules and regulations that would then be adopted by the various legislatures around the world (although this is highly unlikely). The fragmentation of the rules is what causes the technologist’s biggest problems and complications because you have to keep up with every variation. Like trade and commerce, where each country (or bloc of countries) historically sets its own tariff rates and rules and regulations on the import and export of products, goods and services, information and the use of the Internet and privacy is following along those lines. It would be great if the UN or some other governmental body could draft standards that everyone would be able to agree with, but the actual chances of that happening are probably nil, as technology continues to evolve and new, innovative ways to use it are applied in more and more creative ways. Consider the following plausible scenario. The technology exists today to make this situation a reality. The only things standing in the way are consumer acceptance of the service, mass production of the technology at a price point the average individual can afford, and trust – the same things needed when any new product or service is first introduced. Imagine the future for a minute. We may not be far away from a time when your refrigerator self-diagnoses a problem and orders service from a repair organization. The repair shop then performs remote diagnostics on the appliance, sending an electronic instruction to the appliance’s computer to adjust the motor. The repair service then bills you for the service with information provided by your refrigerator, which acts as a communication device networked to your home PC, which in turn provides payment instructions to your bank for the service call.

125

Inside The Minds

How many privacy issues could arise from this simple commercial transaction? Let’s look further at what could happen. What if the refrigerator of the future also keeps an inventory of the goods you purchase and use? Now the repair organization has access to this information and provides it to a third party, who uses it to market products and additional services to you. Privacy challenges from a machine-to-machine transaction – in the near future, this may not be that far-fetched. At the end of the day privacy is about trust, and trust is about access control and authentication and the security of information that an individual or entity believes to be private or confidential. As in any good capitalistic society, those who have assisted us in exposing our privacy through innovation are also working to put some order in place around it for the future. The Trusted Computing Platform Alliance, or TCPA, (180+ members, including Microsoft, IBM, Intel, and HP) has been working on industry specifications for the creation of what is being called a “Trusted Platform Module” that will be built into every PC’s motherboard in the future. Once implemented, TPM is supposed to assist us in protecting our privacy. This has been intended to be a consolidated approach by the computing industry to address issues ranging from secure logon to data integrity to pubic key infrastructure to digital signature and everything needed for a user to be able to create and work in a trusted environment. Such a solution will certainly go along way to creating an environment where we can worry less about security and more about conducting business. But wait! As of late June 2002, do we now have a competing proposal from Microsoft (code named “Palladium”), or is it complementary? For the average user, we will need broad agreement across the industry – similar to the need for LCs (letters of credit) – to act as a vehicle of trust and payment for

126

Privacy Matters

some global trades; we will need someone to step up and provide the trust for us (and thereby manage our personal data for us). Who will it be? The government? The computing giants – Microsoft, IBM, and others? The global banks – CitiGroup, Chase, and others? No, we will have to take responsibility for ourselves. Only each individual can determine what needs to be protected and what does not. The government may need to step in to help protect the uninformed, but most of us corporations or individuals will be left to fend for ourselves. It is better to get educated early than later in the world today. Again, privacy is an age-old question, whether it involves the Internet, people first using credit cards, or even as far back as 100 to 200 years ago, when people were first applying for credit from merchants in their local stores and passing on private information. The Internet globalizes this local issue, takes it out of our towns and villages and away from our natural and national boundaries, exposing it globally. This is nothing new; it’s been going on for years. Unless you crawl under a rock, hide under a bridge, or lock yourself in a room with no doors and no windows, you will never have true privacy. And if you do have this privacy, then you will be so tuned-out from what is happening in the real world that you will not be able to live your life to the fullest and enjoy yourself. This is the same topic: Trust is still the issue. It’s new technology at a new time, but the same concerns – just bigger and more visible. We are living in a different age, an exciting age, an interconnected age. Alan Boehme is currently the e-technology chief information officer for GE Power Systems, the largest industrial business within the GE portfolio of companies. In this role Mr. Boehme is responsible for defining and aligning the strategic architecture and technical direction for the global IT organization with the business objectives of the corporation, with special emphasis on e-business and the application of emerging technologies. Before joining GE, Mr. Boehme held a variety of positions at DHL

127

Inside The Minds

Worldwide Express, including director of Customer Automation, director of e-commerce, and director of Business Planning, and has held similar positions with other leading global organizations. Over his career Mr. Boehme has also become a leading voice regarding the use of technology and its role in building valueadded components across multiple businesses. His schedule has included many speaking engagements and interviews with major publications, such as The London Times, The Journal of Commerce, InfoWorld, and CIO magazine, among others. He has spoken at various conferences, including Fortune magazine’s “Most Admired Companies 2000,” Marcus Evans Ebusiness Summit 2001, and the Cranfield University (United Kingdom) executive forum on e-business. In addition he is a member of the InfoWorld magazine Corporate Advisory Board and a charter member of the CTO Forum and OSA Cross Roads Technology Conferences. He resides in Marietta, Georgia, and in his spare time serves in a advisory capacity to small technology start-ups. Alan Boehme is not an attorney, and the information contained in this chapter should be used only for information purposes. Only an attorney is qualified to fully interpret the various regulations and laws regarding privacy and the use of technology to enable compliance with the same.

128

Privacy Matters

PRIVACY IN THE 21ST CENTURY: ADVICE TO COMPANIES AND CONSUMERS

BRAD SLUTSKY King & Spalding Partner, Intellectual Property Group

129

Inside The Minds

The Challenges of Privacy One of the big privacy challenges that we as a society must address is that the privacy laws in the United States are not at all uniform. Not only are the laws in the U.S. very different from the laws in Canada and Europe, but even within and among U.S. states, privacy laws can vary significantly. On the federal level we have a very piecemeal approach to privacy. Specific privacy regulations and laws apply, for example, to financial institutions, healthcare providers, and companies that collect data from minors. That the federal laws are very specific for companies in some industries and not for those in other industries makes it a challenge to evaluate privacy concerns. Then there are various state laws that impose different requirements on different types of businesses, and those laws may be stricter in one state than in another. So in the U.S., companies must decide whether to adopt the lowest common denominator in terms of protecting privacy, create a general set of guidelines and make exceptions for certain states, or simply avoid doing business in states whose privacy laws are unusual or too restrictive. Another challenge in privacy law is that the laws and policies are constantly changing. Compliance today does not ensure compliance tomorrow – or a year from now or several years from now. The policies behind the laws are changing constantly, as well, so privacy is an area in which it is necessary to keep upto-date. You can’t just put a privacy policy on your Web site, assume you are done, and move on. You have to make changes as the laws change, as policies change, and as your business practices change. The combination of these things creates a lot of flux and makes privacy a truly dynamic area.

130

Privacy Matters

Privacy on a Global Scale In Canada and in European countries, specific requirements apply generally to companies collecting data from consumers. In those countries, consumers can reasonably expect privacy with respect to how their data will be treated, and consistency in terms of whether they can make changes to their data, ask to be deleted from databases, and so on. In the U.S., however, that may be true if you are dealing with a financial institution, but it is not necessarily true if you are dealing with a bookseller or an office supply store. For example, in the U.S. the actions a financial institution is required to take to protect consumers’ privacy are different from the actions a healthcare provider is required to take. The rules change again if a business is going to collect data from minors. Not only is there a great disparity between the U.S. and other countries in the amount of privacy protection consumers can expect, but even within the U.S. there is a great disparity, depending on the industry involved. There is no question in my mind that the U.S. is behind a number of other countries in terms of privacy laws and the protection of consumer privacy. Europe has been ahead of us for some time, following the adoption of the European Data Privacy Directive in 1995. If I could ask for one thing in the U.S. relating to privacy, it would be the enactment of a uniform federal privacy law of general applicability, so consumers and businesses would have one common place to look for standards. In the absence of special circumstances, such as being a financial institution and holding someone’s bank account, such a law could create a baseline set of expectations for people and businesses. European consumers have this, but U.S. consumers do not, so adherence to privacy laws in the U.S. is much more complicated. The European Data Privacy Directive creates a lowest common denominator of privacy expectations, and then each of the European member states can implement the directive in its own

131

Inside The Minds

way, as long as they are not less strict than the Directive. For example, all countries must require that businesses inform consumers if the business will collect certain types of information, and they must inform consumers what will be done with the information. The Directive also prohibits the collection of certain types of information (absent certain exceptions), such as information related to race. It also requires businesses to provide consumers access to the information and a method for them to correct the information, or at least an opportunity to request a correction if the information turns out to be incorrect. It also requires businesses to allow consumers to opt out of the collection of certain information about them. There are security requirements, as well, that relate to how you protect the information once it has been collected in an information system. That’s a broad-brush description of the regime in Europe. While pieces of it are present in the U.S. in various industries, you can’t easily tell an online bookseller what the minimum requirements will be for them because there isn’t a common standard. The Data Privacy Directive could be a good model for the U.S. Unfortunately the U.S. is far from achieving such a privacy standard. Before September 11, 2001, there was a lot of movement toward a common standard similar to the European one. Bills were proposed in Congress that would implement the FTC privacy fairness principles, which are: 1. Notice and awareness, which means the consumer has to be notified of the information being gathered 2. Choice and consent, which means the consumer should have the opportunity to opt out of the gathering of information, or in some cases that information cannot be gathered unless the consumer opts in to the collection of information 3. Access, so consumers can change the information if it is not correct 4. Integrity and security, so hackers cannot get into people’s records

132

Privacy Matters

5. Enforcement, so if the foregoing principles are not adhered to, consumers have a method of redress The proposed bills – for example, the Consumer Privacy Protection Act – received some attention but ultimately were not enacted. Those kinds of initiatives have lost a lot of momentum since September 11. The “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism” Act (a.k.a. the USA Patriot Act) – a law engendered as a result of the terrorist activities of September 11 – is designed to provide the U.S. government with more access to information about people. Much of the information the law permits the government to access pertains to the activities of foreign nationals; however, the law also applies to activities that may have indicia of terrorism associated with them. That diminishes people’s privacy a bit, at least as it relates to the government obtaining information about people. As a result, there has been less of a push in the business community to protect individuals’ privacy, and less stomach for that in Congress. I think the business community recognizes that, because of consumer demand for privacy, there is value in respecting people’s privacy. Many businesses feel that way, though certainly not all of them do. Nevertheless, the push for legislation along those lines has seen a dramatic decrease since September 11, and I don’t see us getting back to the point where we will adopt something along the lines of the European laws anytime soon. Privacy Advice for Companies I don’t think it is easy to decide whether a company is or should be responsible for protecting consumers’ privacy. Some businesses believe they should protect consumers’ privacy, and others believe it’s not their responsibility. I think you can make a

133

Inside The Minds

case for each side. I do think, though, that if you are doing business online, you should have a privacy policy on your Web site. Regardless of how you treat your customers’ information, you should explain to them how their information will be treated, and preferably require their consent as part of any transaction. If they don’t consent, you have a number of options, from not collecting their information to not allowing them to complete the transaction. The one thing that companies that have not thought about privacy ought to think about is a realistic privacy policy they can follow and adhere to. Beyond that, I suggest they consider drafting confidentiality agreements with the third parties with which they do business, consider following the FTC principles, and examine the adequacy of their data security. Communication also is critical. Adequately setting people’s expectations helps avoid problems down the road. Any online business – regardless of how they treat their customers’ information – needs to seriously consider adopting a privacy policy. Further, it is important that the policy be realistic. Many companies think they can just take the form privacy policy off the TRUSTe Web site, for example, change the names, and use that as their privacy policy. That is a good privacy policy, but there are some specifics in it about how you treat information, and if your company does not treat the information in that way, then it is not a good idea to adopt it as your company’s policy. You really have to focus on how your business treats data and whether that treatment is reflected in the privacy policy you choose. For example, a company should have a privacy policy that clearly lays out what the company does and does not do with customer data, and the policy should provide for permission to use the data to decrease the chance that a customer will be legitimately aggrieved if they take issue with how their data was used.

134

Privacy Matters

Business also should consider the all-too-rare practice of entering into data privacy agreements with third parties with which they do business and that receive data as part of a transaction. Such contracts make those companies promise to treat customer data as confidential. Doing that can be a big task. If your company sells widgets and you accept charge cards, then you have banks that process charge cards, intermediaries that process the charges, and the credit card companies themselves, all of which receive information about consumer purchases. Entering into agreements with this web of service providers is complicated, but I know from experience it can be done. There are various other steps a business can undertake to protect consumers’ privacy. After September 11, security has obviously taken on increased importance, and there probably will be support for more computer system security and legislation, particularly with the recent threats of cyber-terrorism. It is important to secure the systems that hold data, not only to keep outsiders from getting access to the data, but also to prevent access by people within the company who do not have a legitimate business reason to access the information. Another option is to follow the FTC’s privacy principles, as mentioned earlier. It’s better for businesses to address privacy problems themselves than to rely on laws, regulations, government enforcement, and private lawsuits to do so. Communication between employees and employers about privacy is also important. In states such as California, an employee has a reasonable expectation of privacy unless they are informed otherwise by their employer. In other states an employer does not have that obligation, and the default rule is that the employee does not have an expectation of privacy unless the employer promises privacy. If your company does business in more than one state, you may need to adhere to the lowest common denominator, and often the safest thing to do is to

135

Inside The Minds

inform employees whether and under what circumstances they can expect privacy. The practice of many employers is to tell employees they have no privacy in their communications that use company assets or that are made on company time. So employee e-mail, Web surfing, instant messaging, and the like are not private, and the better practice is to inform employees that that is the case. When it comes to multinational corporations, there are various means for companies to handle and protect data from different countries. One method is to physically separate what you do: work on European business on computers in Europe and American business on computers in the U.S., and keep all the data within its country of origin. That is obviously an oversimplification of the situation because, for example, an individual from the U.S. could go to Europe with a U.S. credit card and place a charge, and those types of events will complicate the situation. Another way to address multinational privacy issues is to use the lowest common denominator approach, following the requirements of the strictest country in which you do business. Most of the time this strategy will work, although sometimes one country may have strict requirements in one area and not in another. For example, security requirements may be stricter in one country; whereas, requirements for permission from the consumer may be less strict. In those cases, you end up with a combination of the strictest requirements from each country. If you send data from Europe to the U.S. – perhaps because you take credit card charges in Europe, but all the data comes to the U.S. to be processed – then you have a whole different set of issues. Under the European Data Privacy Directive, you are not permitted to ship data outside European countries unless the country to which you are shipping the data provides adequate protection for consumer privacy. The U.S. is considered a

136

Privacy Matters

country that does not provide adequate protection, so to get the data to the U.S., you have to follow one of several paths. One path is through a Safe Harbor that the European Commission and the Department of State have agreed to. Signing up for the Safe Harbor is a quick process, but it requires that you have certain programs in place to provide consumers access to data, and that you have enforcement procedures, verification procedures, a dispute resolution mechanism, and the like. These procedures are not appropriate for all businesses, so the Safe Harbor solution does not work in all industries. Various other types of contracts a business can enter into will permit the business to send data outside the European Union. For example, a European subsidiary and a U.S. subsidiary could have a contract that provides for the protection of the data when it is sent to the U.S. If you have entered into an approved contract, you are considered in compliance with the local interpretation of the European Data Privacy Directive, and you can send the data to the U.S. Various kinds of contracts satisfy these requirements – forms have been pre-approved by the European Commission, and you are also permitted to submit your own forms for approval. I have not read about any large-scale abuses involving European data coming to the U.S., but I assume they exist. An infrastructure is set up in Europe to prosecute and fine companies that violate the data privacy laws, and I assume that happens, although I have not heard of any widely publicized significant violations. In the U.S., one often hears about the FTC pursuing companies that do not comply with privacy laws and fair trade practices – particularly companies that do not adhere to their own privacy policies. There is the infamous case of a company called Toysmart that went bankrupt, and, as part of the liquidation of the company, wanted to sell their customer list. Their privacy policy, however, said they would not sell the data

137

Inside The Minds

about individuals. The FTC brought an enforcement action and was able to attach certain restrictions to the sale of that data. If the consumer has received specific promises of privacy from a company, and if those promises included not transferring the data to a third party, then the action of merging or selling stock or assets may be subject to sanctions from the FTC. As a practical matter, a fine may be imposed. Those are the kinds of lessons U.S. companies are learning the hard way. Now the common practice among lawyers who write privacy policies is that you need to address the potential bankruptcy of the company, or the sale of assets or stock by the company, which might put the data into the hands of a third party. If it is not in the privacy policy, it may not be permitted, and there may be government fines and other penalties associated with it. That is another example of how changes in the law can create problems. Before the Toysmart case, it was the exception rather than the rule for a privacy policy to include a provision addressing the bankruptcy of the company. Many companies probably have older privacy policies, drafted before the Toysmart decision, that need to be updated, particularly if the companies are dotcoms that may be having financial difficulty now and trying to sell their stock or assets to other companies. Advice for Consumers There was a cartoon in The New Yorker, perhaps 10 years ago, with a dog sitting before a computer saying, “On the Internet, no one knows you’re a dog.” I think that reflects one of the biggest misconceptions: People believe they have, and are entitled to, quite a bit of privacy in their online activities, when really the opposite is true. When I do privacy presentations, I remind people of that New Yorker cartoon and of a quotation that has been attributed to Scott McNealy, the CEO of Sun Microsystems. He has been quoted as saying, “You have zero

138

Privacy Matters

privacy anyway; get over it!” I think, particularly after September 11, Scott McNealy’s view may be a lot closer to the truth than the New Yorker cartoon. People have very little online privacy, particularly an employee at a company who is using an employer’s resources on the employer’s time to surf the Web or send e-mail or chat. Often those people have no right to privacy in the information they exchange and generate in those activities. People tend to be lulled into believing they have privacy protection because the Web site they are viewing has a privacy policy, or the site bears a seal from TRUSTe or the Better Business Bureau Online. That is not really the case. Often the consumer might find the privacy policy somewhat shocking if they actually read it. Privacy policies typically describe what kinds of information are being gathered, how the business shares that information with their business partners and third parties, and that the information may be resold, possibly in the aggregate. People see there is a privacy policy and think it is there to protect them. Typically, however, the policy is there to protect the business against claims that it may have misused people’s information. My advice is to be careful about the companies with which you do business, about the kind of information you provide, and about the e-mail address you use. Also be careful when giving out credit card numbers. Be very reluctant to give out your Social Security number, and seriously consider using one-timeuse credit card numbers. An ounce of prevention is worth a pound of cure. It is best to be cautious and avoid situations where you might need redress. Caution involves being careful about whom you do business with, buying from reputable companies (you can check a company’s reputation with the Better Business Bureau Online, ResellerRatings.com, and places like that), and reviewing company privacy policies. I have Yahoo! and Hotmail e-mail

139

Inside The Minds

addresses, and if I am uncertain about someone from whom I request information or with whom I do business, I may give them my Yahoo! or Hotmail e-mail address. Those are addresses where I expect to get a lot of spam and not a lot of useful information, so that mitigates the harm if they resell my e-mail address. There are also spam-filtering systems, such as www.despammed.com that you can use. For the more technically advanced, it also is interesting to register an Internet domain and then use a different e-mail address at that domain for different transactions. That allows you to track what spam resulted from each transaction. One other preventive measure of which I am a big proponent is one-time-use credit card numbers. If I do business with someone on the Internet with whom I have not done business before, and I question their reputation, I frequently will use a one-time-use credit card number. American Express, Discover Card, and perhaps other cards, as well, have programs whereby you can generate a card number that is good only for that transaction or only for a month. They work differently, depending on the credit card you use. After that use or that period of time, the credit card number is no longer valid, so if a company tries to issue further charges to the card, those unauthorized transactions will be rejected. One-time-use credit card numbers also protect against hackers and lax security. If a hacker gets access to a company’s customer list and customer credit card numbers, they won’t be able to use your one-time-use credit card number, which helps protect you against fraudulent charges. Once you have been aggrieved, particularly on the Internet, it is difficult to redress the situation. You should first complain to the company that caused the harm to see if they will do anything about it. Sometimes they will – particularly reputable companies – but often, especially with disreputable companies, they won’t. If they won’t, you should complain to your state’s attorney

140

Privacy Matters

general, particularly in cases where there has been some sort of widespread scam. Some state attorneys general have been pretty aggressive in pursuing Internet scams, and sometimes lawyers have brought class action cases in court. The FBI and your district’s U.S. Attorney’s office also may be able to help, but typically the matter will need to be fairly serious and widespread before federal authorities will get involved. You also should report the company to the Better Business Bureau, and go to a site like ResellerRatings.com and post feedback there to help others avoid experiencing the same kinds of problems. The Future of Privacy New privacy issues will continue to surface in the future. There have been a number of reported cases of identity theft in the past, and I think with the consolidation and further gathering of information about individuals, we will probably see more cases of that. There have been cases of improper charges on people’s credit cards, and credit card theft. I think the “bad guys” are finding that easier to do, so I think we will see that more often. I don’t know anybody who doesn’t get e-mail spam, and yet I don’t know anyone who would say they want spam in their email accounts. E-mail addresses are being harvested and sold, and some people would view that as an invasion of privacy. Similarly, computer programs can monitor your Web surfing and display ads relating to the goods and services you view on the Web. That kind of profiling has a lot of people concerned. One “cutting-edge” issue I foresee is that, with the gathering of information about people’s Web-surfing habits, purchasing habits, economic data, and so forth, I think we will start to see stratification in the information provided to people. For instance, if you go to XYZ Store’s Web site, based on the information they have in their database about you, you may see a different Web page than the one I might see when I go there. You already

141

Inside The Minds

see traces of that on sites such as Amazon.com, where they show you links for different books or item pages you have recently visited on that Web site, or suggestions for things you might like, based on things you have bought in the past. Another possible future trend is that one person may see a different price for an online shopping item than another person would see. This already exists in some stores that have physical locations around the country, with different prices in different cities. Some stores have figured out how to get their Web sites to reflect different prices, depending on which city the user states they are from. Also, even within the same city some stores send coupons to some customers and not to others, based on customers’ buying habits and other factors. These stores are trying to take advantage of the fact that their data shows certain people will buy an item at a certain price point, and others will buy it at a different price point. There very well may be legal issues associated with that. I see these types of issues multiplying, and at the moment I don’t think our laws are keeping pace with them. I would most like to see a federal law on privacy, so a company that is not doing particularly sensitive business (e.g., not marketing to children or gathering financial information) would be able to say, “Here are the five things that, in general, I need to do, and I know if I do these things, I will not be subjected to privacy suits or regulatory action.” The standards should probably be along the lines of the FTC privacy principles, which would make them somewhat similar to the European Data Privacy Directive. One of the reasons I look forward to that from a legal perspective is that we are seeing more and more gathering of sensitive information about individuals in the U.S. I see the benefits of that kind of standard. With Amazon.com telling me the CD-writer I looked at last week is now on sale for $20 less, that information could be useful to me, and I might want to buy it this week when I did not buy it last week. But it makes me

142

Privacy Matters

nervous that Amazon.com knows that I am looking to buy a CDwriter, and that they are able to do heaven knows what with that information. I have not examined their privacy policy, but maybe, for example, they would be entitled to sell my wish list to Staples, and Staples might then send me a flyer about their CD-writers, or flag me the next time I am in the store and try to sell me a CD-writer, or call my cell phone when I am near one of their stores and play a pre-recorded advertisement about their CD-writer. I am not interested in that kind of marketing. On the same level, the information can be used in ways that benefit me, and I think with adequate protections in place, people could share that type of information and feel comfortable about how it would be used, benefiting from it without the detriments that can result from disreputable companies, greedy companies, and hackers accessing information that could be harmful. Another changing trend involves who within companies is focusing on privacy issues. I see a slow trend toward companies appointing a chief privacy officer. There was more of a trend toward that before September 11 than afterward, but many companies are either looking at this or have already implemented it. I view that as a good development, and I hope that practice continues to expand. In the absence of a chief privacy officer, somebody in the information technology function probably is the natural person to whom that task should fall. It also would be a good idea if that person reported to an officer or director of the company, so there is some high-level interest in and support for privacy initiatives. Over the past decade privacy laws, policies, and customs have been in flux in the U.S. and throughout the world. We have not seen an end to the change. September 11 caused a retrenchment in U.S. privacy policy. Despite the current status of many dotcom companies, though, online commerce is here to stay and certainly will expand over time. As more and more consumers participate in the Internet’s global marketplace, privacy abuses

143

Inside The Minds

will draw more attention, and businesses are likely to seek solutions that will reassure consumers their privacy will be protected. I predict that reassurance will come in the form of some type of standardized privacy policy practices or rating system that will allow consumers to gauge quickly what type of privacy protection they can expect – something like a simplified version of the Platform for Privacy Preferences (P3P) Project (www.w3.org/P3P). That, in turn, will require businesses to implement the steps necessary to ensure that privacy. Now is actually a good time for businesses to take the initiative in this area to avoid overregulation and to fashion programs that are workable from a business perspective. Bradley A. Slutsky is a partner in the Intellectual Property Group at King & Spalding and has served as co-chair for King & Spalding’s Information Technology Practice. As a former computer programmer, Mr. Slutsky focuses on Internet and e-commerce legal issues, computer software and hardware litigation, technology transactions, and traditional intellectual property issues involving copyrights, patents, trademarks, and trade secrets. Mr. Slutsky is one of 213 attorneys in the world listed in An International Who’s Who in Internet and E-Commerce Law – an international publication listing experienced Internet and e-commerce attorneys selected through recommendations by in-house counsel and experienced practitioners. Mr. Slutsky also recently was selected by his peers for inclusion in Mondaq’s Guide to the World’s Leading E-Commerce and IT Advisors, and has served as an Advisory Board Member and columnist for the E-Commerce Law Journal. Mr. Slutsky has assisted clients in handling all types of technology transactions and disputes. He has served as an arbitrator for the Fulton County court system, as a barrister in

144

Privacy Matters

Atlanta’s Bleckley Inn of Court, and as a member of the committee that drafted Georgia’s Electronic Records and Signatures Act. He also was recently selected to serve on the World Intellectual Property Organization’s Internet Domain Name Dispute Resolution Panel. Mr. Slutsky recently stepped down from six years of service on the board of the Atlanta Volunteer Lawyers Foundation, an organization that provides pro bono legal services for the indigent. He was also an advisory board member for the Children's Information Trust and served as a member of the management team for the Manhattan Cyber Project. Before joining King & Spalding, Mr. Slutsky served as a law clerk for Judge Orinda D. Evans, currently the Chief Judge of the United States District Court for the Northern District of Georgia. Mr. Slutsky has published and spoken on numerous technology law topics, focusing in the past two years on electronic commerce, computer security, and Year 2000 issues. He also helped organize an in-house Internet and E-Commerce educational series at King & Spalding, moderating and teaching several of the courses in the series. Mr. Slutsky graduated from the University of Virginia School of Law in 1989. He was a visiting student at Harvard Law School from 1988-89, and graduated Magna Cum Laude from Brown University in 1986 with a BA in business economics. Before attending law school, Mr. Slutsky was a programmer and instructor for IBM, was a systems analyst for Vutec Systems in Providence, Rhode Island, and taught PASCAL programming at the Wellesley College Exploration Program. He has experience programming in C, Pascal, Basic, Lisp, Assembly, Javascript, and other programming languages, and has written and released several shareware and freeware computer programs and a commercial software package for IBM PC compatible

145

Inside The Minds

computers, IBM mainframe computers, and Apple Macintosh computers. In 1989 Mr. Slutsky founded Sky Software to market the software he develops.

146

Privacy Matters

THE MYTH OF PRIVACY

WILLIAM STERLING Island ECN Chief Technology Officer

147

Inside The Minds

The Myth of a “Right” to Privacy We think of privacy as a pretty straightforward concept. It is easily summarized, but it quickly becomes more complicated as we begin to dig deeper into examples. One of the most widely accepted definitions of privacy comes from Samuel Warren and Louis Brandeis, who described the right to privacy simply as the “right to be let alone.” This simple and eloquent description does a great job summarizing what many would argue is their indisputable right as members of a free society. Yet as the debate surrounding privacy shows, this right to privacy is much harder to agree on in the real world. The right to privacy is hard to agree on because privacy is not a right. Everyone values their privacy, but valuing something is very different from saying it is a basic right. The difference between a value and a right is more than just semantics. A right stays with us; no matter what we do, no one can take a right away from us, and we can’t do anything to lose our rights. Privacy is different. It’s very easy to give up your privacy. In almost every case where we claim a violation of our rights, a deeper look will reveal that we’re just doing a poor job protecting something that is valuable to us. Is it wrong to spy on someone in their own home? What if you do so from a public street? That would imply they have a right to not be seen, even if they’re in plain sight from a public street. If someone uses a high-powered telescope to look into someone else’s bedroom, most of us would call that a violation of their privacy. If someone is simply walking down the street and happens to see into another person’s home from the sidewalk, most of us would not find any fault there. That would suggest the difference between right and wrong is somewhere between glancing in a window from the street and staring into a window using a telescope. Could the difference that determines whether someone’s privacy is violated be in the telescope? Maybe it’s in how long someone looks in your window or in the intent of the person looking. The argument might seem clearer if we bring a

148

Privacy Matters

camera into the picture. Surely we have the right not to have pictures taken of us in our own home. Slight changes can turn a situation from publicly acceptable to an outright violation of privacy. Satellites have taken detailed pictures of virtually every square inch on the planet, and many of these pictures are now available through inexpensive or freely available services. A cool new Web site at www.earthviewer.com allows you to view satellite pictures of every major city, down to individual homes and buildings. Chances are, if you live in the continental U.S., I can type in your street address and zoom down to see if you have a pool in your backyard. This may seem like a far cry from the example of someone looking into your bedroom window, but the examples actually aren’t so different. The current satellite photos don’t have enough resolution to see individual people, but that will change over time. When better pictures are available, someone might see a picture of you in your own backyard. Does that violate your privacy? I wouldn’t really mind if someone took a picture of me in my backyard. I personally don’t think it would be very interesting, but I might feel differently if I weren’t wearing any clothes. I might not like someone having that picture, but where am I drawing the line? Maybe the satellite companies should be forced to scan through the photos and erase any indecent pictures of people. Someone else may feel strongly about any picture of them in their backyard, even if they’re clothed, so maybe the satellite companies should erase all pictures of people. You could even make an argument that you have the right not to have your backyard photographed at all, but would that mean you have some right to every picture taken of your backyard from space? Should the satellite company be forced to get every person’s permission before releasing pictures of homes and backyards?

149

Inside The Minds

Obviously, that would make the service impractical to offer, and it would cease to exist. In every case, the argument over privacy becomes an argument in degree rather than principle. This is what makes the right to privacy a myth. Taking low-resolution pictures from above in space might be okay, but taking high-resolution pictures into your window from the street is considered a violation of our privacy. Two fundamentally similar practices produce dramatically different responses. Without fundamental definitions of right and wrong when it comes to privacy, we are left in an ambiguous world with a piecemeal set of rules and regulations being patched together as technology enables new practices and creates new public concerns. We can’t classify privacy as a fundamental right when it is impossible to create universal definitions of right and wrong when dealing with privacy. I’m not suggesting privacy is an invalid desire, or even that we shouldn’t try to protect our privacy. If we truly desire to keep something private, then we shouldn’t give it out to anyone we don’t trust. Trust can come in many forms. We give private information to people we trust implicitly without any guarantee they will live up to that trust. If we don’t trust someone implicitly, then we can’t assume they will keep our information private unless they specifically agree to do so. If I give my phone number to you, and you give it out to a friend or even put it on a Web site, I can blame only myself. Of course, this doesn’t mean individuals or companies can say one thing and do another. If someone tells me they will not give out my information, and then they break that agreement by giving out that information, I have a legitimate claim that they violated a contract with me. While we may not have a right to the assumption of privacy, we do have the right to take someone to court if they break an agreement to keep something private. So we can defend our privacy by not giving out anything we value as private. If we

150

Privacy Matters

need to give out information and want it treated as private in some way, we must either trust the other party implicitly or agree with them on the specific limitations of what they can do with that information. If they violate that agreement, we can take them to court. Technology as a Red Herring Technology is a red herring when it comes to privacy. New issues arise as technical advances make practices possible that were never feasible without the efficiencies provided by technology. Cheaper data storage makes it possible for companies and individuals to create and store massive databases of information for relatively low costs. E-commerce makes it possible for retailers to easily track a customer’s buying habits over time. The Internet makes the process of accessing this information simple, fast, and very inexpensive. While none of these advances changes the basic way we interact with each other, by making certain practices easier and cheaper, they will end up being more widespread and therefore more widely contested. At first glance, technology seems to be the problem, since it’s the only thing changing, but in fact it’s enabling people to access information about us that we simply weren’t protecting. Technology gets the blame, but technology is not the problem. Improvements in technology constantly redefine the debate on privacy. As I mentioned, I can see a very detailed picture of your home from space. If I’m willing to pay more for the service, I can get a satellite company to take a recent picture of your home with incredible resolution. I could probably even tell if you had a barbeque that day. I can find out virtually anything I want about you; it’s simply a matter of money. Satellite photos are cheap and easy, but I could always just fly over your house in an airplane and take a picture of your backyard; it would just be more expensive. Your credit report, rental history, name,

151

Inside The Minds

personal stats such as age and height, and what kind of car you drive are all relatively easy facts to obtain online, but private investigators have always been able to obtain that same information for the right price. Technology doesn’t change the amount of information available; it only increases the ease and reduces the cost of obtaining it. We tend to see technology as a sort of anti-privacy tool that’s invading our lives and violating our privacy, but maybe this is because technology is harder to understand and less tangible than other forms of communication. Webcams make it easier to record someone or something in a digital format, but small portable video cameras and still cameras have the same basic ability. Digital storage and transfer make every step of the process so much more efficient than paper-based communications. Information can be tracked and stored without us seeing it happen. However, none of these technologies creates fundamental changes in the way we deal with each other; they just make everything easier. In virtually every case, technology isn’t creating a completely new practice, but optimizing existing ones. Just as technology has created some practices we feel are threatening to privacy, it also has the potential to provide us unprecedented protection of our privacy. As technology progresses, online forms of transacting will certainly become infinitely more private than comparable offline transactions. Through anonymous payment mechanisms and anonymous browsing tools, the Internet will provide a more private and secure mechanism for transactions than the offline world could possibly provide. Encryption technology can allow us to lock any digital e-mail or document so it can’t be read without a key. Even if someone can get to our e-mails or files, they won’t be able to read them unless they have the digital key. In the real world, if you can intercept a

152

Privacy Matters

letter, you can simply open it and read its contents. If you intercept an encrypted message in the digital world, it’s useless without a key. Encryption technology will become more seamlessly integrated in tools like e-mail, allowing us to communicate more privately than ever before. Encryption can also allow you to digitally sign messages, so no one can pretend they are you by just by forging your e-mail address. These technologies will provide us a level of privacy and accountability far beyond that which we had in a paper-based world, where physical access to a document was all you needed to read its contents, and forging another’s signature just meant you had a copy of their signature. These advances will allow everyone to operate with a heightened level of trust. If I send you a digitally signed e-mail, it can be considered a legally signed document by definition. If you transfer a file to me using strong encryption, you will have a high degree of confidence that no one else will be able to read that file without the key. As technology continues to advance, we will see new devices that make it easier to protect our privacy, as well as new devices that make it more difficult to protect our privacy. We should accept these opportunities to redefine the way we deal with each other. Technology is only the means of obtaining information. Instead of focusing on technology as the problem, we must focus instead on protecting information in ways that won’t be washed away by the next wave of technology. Online Privacy Perhaps the best known example of technology forcing the issue of privacy is the evolution of the Internet. The popularity of the Internet makes marketing and customer tracking practices easier. Even though these practices are fundamentally identical to

153

Inside The Minds

offline practices that have been going on for years, old-fashioned fear of technology has created a privacy outrage. One of the best examples of the clash between technology and privacy is the outrage that resulted from Double Click’s practice of tracking Internet users as they traveled among different Web sites using a technology called Internet cookies. A cookie is an Internet technology that allows a Web site to place information on a user’s computer and then subsequently retrieve that information when the user visits that Web site again. Since Double Click was actually serving the ads to users directly through links embedded in other Web sites, users were effectively visiting the Double Click site every time they visited any site that used Double Click’s service. If I go to a Web site that uses Double Click’s ad services, my browser gets directed to Double Click’s site, where it downloads an ad to display. When my browser is directed to Double Click for the first time, Double Click places a unique identification number inside a cookie on my hard drive. Double Click can then retrieve that cookie each time I visit any Web site that serves Double Click ads. By doing this, Double Click can track us as they visit different Web sites that serve Double Click ads. Double Click is able to demand more money for these ads because their network allows them to deliver the ads more effectively by sending a particular ad to customers who are more likely to respond to that type of ad. The process forms an economic arrangement that is beneficial to all participants. Consumers receive lower-priced (and often free) services because Double Click makes the ad business more profitable for everyone by delivering ads that specific consumers are more likely to respond to. Companies have been doing this same thing for years, just not quite as efficiently as Double Click. Many top retail companies track everything from personal information to buying habits

154

Privacy Matters

whenever and wherever possible. Mail-order catalog companies are a perfect example of this. Certain marketers have formed networks of catalog companies. Through these networks, a catalog company can agree to share information about who their customers are and what they purchase. In exchange for that information, those catalog companies receive information about customers who purchased from other catalog companies in that same network. The catalog companies are basically just sharing information about their customers with each other through a marketer. We’ve all ordered from a catalog and then received new catalogs from other companies the very next week. It wasn’t a coincidence. How are the catalog marketers different from Double Click? They have both created networks to share information between different companies and provide consumers access to products based on our history. But many consumers and privacy advocates were outraged at Double Click. Double Click was even the focus of FTC investigation and a number of class action law suits when they later purchased a catalog marketer to increase their information network. Everyone was upset because they were going to tie our online information with offline information about us. They weren’t doing anything new or different. They were doing basically the same thing marketers have always done, only better. We accept that a department store needs to have security cameras to help prevent theft, but we also expect them to keep our faces and actions while in their store private, and not to use them for any other purposes. Even though they make no guarantee these tapes will be kept private, many of us would be outraged if the department stores began selling these security tapes to other companies to do with as they please. What if these department stores had face-recognition technology that allowed them to track our movements through their stores?

155

Inside The Minds

The stores could uniquely identify our face each time we entered their store and track us as we traveled through it. They could then tie our face to other personal information. Now they know who we are, how often we come to their store, what sections we shop in the most, and what we purchased from their store. This could help them arrange their store more efficiently, so items we purchased in a single visit were closer together and easier to find. If they saw that we often looked at furniture in their store but never made any furniture purchases, they might decide to give us a coupon for 10 percent off any piece of furniture. These stores would eventually want to share information about their customers with each other so they could find new potential customers who shop at other stores in their area. A marketer might create a network of stores in Manhattan that would share information about other customers who shopped in that area. This would be fundamentally the same as the catalog companies and the Web sites that used Double Click. Face-recognition technology isn’t good enough to make this practical, but that will undoubtedly change at some point. As consumers, we are the ones who actually give up the information to these marketers, either directly or indirectly. Sometimes we don’t pay attention to what we give up or to whom, but we do know we’re giving out information. For some reason, we just assume no one will track us as we browse the Internet. We tend to have certain expectations of privacy in our daily lives, regardless of where we are or what we’re doing. We need to rethink our expectations. Maybe it isn’t reasonable to give information to someone with no agreement covering that information, and still have any expectation of what they will or will not do with that information. Both consumers and companies are finding an acceptable balance. Consumers felt certain practices were inappropriate, and the market reacted swiftly to eliminate, or at least limit, those

156

Privacy Matters

practices. Companies now weigh the profitability of certain practices with the sentiments of the consumers and their desire for privacy. It’s a learning process on both sides, but it seems to be progressing nicely. In the Double Click example, technology enabled consumers to give up information without realizing it. Consumers are now aware that a powerful technology exists with a detailed way of tracking us. Consumers reacted, and companies have become much more explicit about what they would do with that information. Software now gives us more control over how we browse the Internet, forcing companies to develop suitable privacy policies if they want to use cookies to track us. Company Policies Your company has the right to monitor everything you do on a computer at work. If an employee uses their company’s e-mail, even for personal correspondence, the company is perfectly within their rights to read that e-mail. As an employee, I probably wouldn’t want my company to read my e-mail, but I do respect that they own the system and may feel it necessary to monitor any communications over their systems. They may need to check for employees who are harassing coworkers or dealing with customers inappropriately. If a company feels the need to monitor its systems, regardless of the reason, as an employee I have no right to tell them to stop just because I don’t like it. The relationship between an employer and employee is no different from any other relationship. Employment is at will, which means an employee can quit at any time. Employee privacy tends to be a more sensitive topic because people are dependent on their jobs, which puts employers in a strong position when dealing with their employees. Quitting your job is a big deal, much bigger than changing where you buy groceries or furniture. However, that doesn’t mean employees have the

157

Inside The Minds

right to prevent their companies from monitoring their own systems. Disclosure is key. Employees should find out whether their company has a privacy policy, and if so, what it says. Companies may be able to monitor you, but they should also be willing to disclose their practices. If you ask, they can’t lie to you. If they won’t tell you what they do, then you should probably assume the worst. As an employee, you should know whether your company monitors or records everything from phone calls to your Internet use. Most employers are very reasonable in their practices and will probably be happy to tell you exactly what they do and why. There’s no reason for any company to keep monitoring practices secret. As an employer, my company has no desire to monitor our employees’ use of e-mail or the Internet. Some employers monitor how much time someone spends on certain Web sites, such as eBay or Yahoo, so they can try to judge employee productivity. An employee who spends two hours a day on eBay is probably not doing the best job in the world, but that’s a silly way to monitor productivity. If a company’s managers can’t judge their employee’s productivity without playing Big Brother, then the company has much larger problems. It’s important, though, to draw a clear distinction between silly and wrong. I may feel that monitoring Web or e-mail activity is a silly way to manage productivity, but that doesn’t mean it’s wrong. Employee privacy is still a delicate issue. As an employee, it’s scary to think your employer might be monitoring your phone conversations, Web usage, or e-mail correspondence. But you do have other options besides quitting. If you’re concerned that your employer is listening to your phone conversations, use a cellular phone. If you really need to send personal e-mail while at work, get a Blackberry or other wireless e-mail device the company doesn’t control. If you really need to browse the Internet at work,

158

Privacy Matters

don’t browse inappropriate Web sites. If you really need to spend two hours a day on eBay while at work, you might want to consider getting a new job. Government Protection While many people argue that we all have a fundamental right to privacy, the Constitution offers almost no protection in the realm of privacy. The closest thing to privacy law in the Constitution is the Fourth Amendment, which protects us from unreasonable search and seizure. The writers of the Constitution simply did not address privacy between individuals or offer any citizen a broader protection of privacy. Was this an oversight, or did our founding fathers simply not feel privacy was a constitutional right? Since the writing of the Constitution, the government has created hundreds of specific laws affecting our privacy, but nothing has been done to create a broader framework for privacy law. This is probably because there is no good way to create a broad framework for privacy law. By definition, privacy law can be based only on degree, not on principle. The only appropriate role for government in protecting our privacy is in protecting our information within the government itself. The government is in the unique position of being able to force us to provide information; therefore, it must provide some basic protections to ensure that information is treated appropriately. No other organization can force us to provide information. From local law enforcement to the IRS, the government has a need to obtain and keep information about us to operate effectively. We tell the IRS how much money we made so they know how much we should pay in taxes. The DMV needs to know our height, age, and other personal information to issue driver’s licenses. Numerous offices of the government have specific information about us that is necessary for them to perform their functions. I might argue that some of

159

Inside The Minds

these functions are unnecessary, or that there is too much information in too many places. But the government must force us to give some basic information to be able to operate effectively. The government must therefore protect us from itself by keeping that information as private as possible. Government does have a responsibility to protect us from itself when it comes to privacy, but what about protecting us from each other? The Video Privacy Protection Act was passed after a newspaper published a list of videos rented by a Supreme Court nominee, but there’s still no law addressing magazine subscriptions or book purchases. That means a bookstore can legally tell someone what books I bought, but it would be criminal for Blockbuster to tell someone what movies I have rented. There’s nothing unique about video rentals, but public outcry and politics create specific laws to fix specific problems. In this case, public outcry and political power put a law in place to protect consumer information at video stores. The consumer doesn’t have any more of a right to privacy than the video store has in this case. What if the video store decided they wanted consumers to keep private their store’s name and the movies that store rents to a consumer? I rent a video from a store, and I can tell people what movie I rented and from which store, but the store can’t legally tell anyone what I rented or who I am. What gives the consumer more of a “right” to that information than the video store? In this case the stores don’t care and the consumers do, but can that be how we determine what is legal and illegal? What legal protections do we need from each other that common law doesn’t already provide? The government protects us from fraud, so if someone claims they will keep our information private and then proceeds to give that information out, then that person (or company) has committed fraud. If we have a contract with someone regarding the use of our information and they violate that contract, you can take them to court, just as you could if they violate any term of a contract. Any other protection

160

Privacy Matters

we ask the government to provide will force the government to draw arbitrary lines between right and wrong based on the degree. Take the example of the Video Privacy Protection Act, where a video store gave a man’s video rental history to a reporter. When the man signed up, did the store pledge to keep that information confidential, or was the issue of privacy not even addressed? If the store committed to keeping that information private, then the man could sue the store for violation of their contract, and his damages would be his loss of privacy. If nothing was mentioned in their agreement, then the store didn’t really do anything wrong. As someone who rents videos, I would rather go to a store that keeps my information private than one that gives out that same information publicly, but that’s between the store and me. I do not need the government’s help in making that decision. The case where rental information was given out to the press caused public outrage. In that situation, the store would likely lose customers and change their policies as a result of that incident. The store had no real incentive to give out the information to the press in the first place. If a store did have a compelling reason to give out the information, the store may be more resistant to change. Perhaps they’d be willing to compensate the consumer by offering lower prices or an occasional free movie. Maybe they’d do nothing, but consumers could then go to other stores that did agree to keep their information private. Other stores may decide their customers are very privacy sensitive and offer an ironclad privacy policy for their protection. In other words, a natural balance would come as the businesses and the consumers voted with their dollars. In this case, it’s likely that most consumers would opt out of having their information shared, if given an option, or rent from a store that keeps rental information private because the customers value their privacy over getting a few free rentals.

161

Inside The Minds

This solution to the video rental problem is simply a free market scenario where the market, without any government involvement, solves the problem through changes in policies and practices to react to consumer demands. Since each consumer has the right not to deal with any given business or other individual, we all have the ultimate veto power in any exchange of information – we can simply decide to not deal with that business or person, thereby not giving up any private information. If the cost to your privacy is relatively small and the value you place on a particular service is very high, you may decide the benefit outweighs the cost and use the service despite your privacy concerns. Privacy is just another factor to take into consideration when determining how and with whom you do business. Some might argue that this free market solution is a dream, and that in reality we need the government to step in and offer more protections. They might argue that companies won’t really respond to consumer demand, and we’ll be left with too few choices and no privacy. History has consistently proven this view to be incorrect. There are too many choices out there to force us into doing business with any one company. Consumers will continue to value their privacy, and companies will be forced to be sensitive to that value. Many good changes continue to take place that help us protect our privacy, both offline and online. We now have better browsers that offer us more control over how we send information. Companies began releasing privacy policies well before Congress mandated the practice. Many companies that don’t have any legal requirement to do so post their privacy policies with a link right on their home page. People are sensitive about privacy, and too many people feel this way for any good company to ignore the issue. Government involvement in privacy between private individuals and companies is easily the biggest unknown in the future of privacy. Government could continue its attempts to protect our

162

Privacy Matters

privacy, or it could leave the market to provide the appropriate level of protection. Will the government stick to its job of protecting us from itself, or will it continue to try to protect us from each other? Real Privacy Protection Regardless of whether you agree with the view that you have no right to privacy, protecting your privacy through rules and laws can never be as effective as real protection for our information. Real protection exists everywhere, and these protections will continue to be improved as long as there is a market for them. New technologies will continue to offer increasing protection for our information. You can disable cookies on your browser to prevent marketers from tracking you on the Internet, or you can use anonymous browsing services, such as Anonymizer.com, that allow you to browse the Internet without giving up any information to anyone. At some point you’ll have access to anonymous payment services that will allow you to pay through them without disclosing your identity to the person you’re paying. It’ll be just like cash on the Internet. Encryption technology has already existed for years, but almost nobody encrypts their e-mail. Is that because we don’t care about privacy, or because we don’t think it’s our responsibility to protect our own information? Either way, once e-mail encryption is widely used, you’ll be able to trust the security of your e-mail. Other forms of anonymous communication will develop over time. Intermediaries, such as online bill payment services, could become our mask for all online payments and deliveries. They could act as our agent online, and we would only need to trust their privacy to ensure our identities are kept private in online transactions. No one would know who we really are, except the intermediary that acted as our online agent. A retailer simply needs a mailing address and money to transact with us. They

163

Inside The Minds

may want to know more about us, but they don’t need anything more than that. If consumers show an overwhelming demand for privacy and retailers don’t provide the appropriate protections, then intermediaries will step in to play that role. Imagine that your online name is “1156454321,” and your address is a P.O. Box owned by Paytrust.com (or another bill payment service). You can even change your online name every month, so no one can track your name for more than 30 days. Paytrust pays the retailer for you, and your retailer knows nothing more than your ID number and Paytrust’s address. That is just one example of a solution to a specific privacy concern; there are numerous parallel examples of real solutions for protecting our information. Through a combination of improving technologies, more privacy sensitive businesses, more privacy sensitive consumers, and intermediaries willing to mask our identities when dealing with any “untrusted” parties, we have a strong set of real solutions to protect our privacy without the help of anyone but ourselves and the market. If we protect our own information through real tools that prevent the information from getting out in the first place, then we don’t need any further protection. Protecting our information once it’s already in the wrong hands is much harder than protecting it from getting into those wrong hands in the first place. William Sterling is the chief technology officer of the Island ECN, an electronic marketplace that enables market professionals to display and match limit orders for stocks and other securities. He is charged with the development and operation of Island’s technology, as well as providing strategic direction. Mr. Sterling started with Island in 1997 as the company’s first employee. He began his career in financial services in 1995 at

164

Privacy Matters

Block Trading in Houston. In 1996, he opened and managed Block Trading’s first branch office in Tyler, Texas. He moved to the technical side of the business in 1996, where he was involved in the initial development of CyberTrader. Mr. Sterling resides in New York.

165

Privacy Matters

PRIVACY ISSUES PAST AND FUTURE

RONALD L. PLESSER Piper Rudnick Partner, Chair, Electronic Commerce and Privacy Practice Group

167

Inside The Minds

Practices Then and Now The Privacy Act of 1974 applied only to the federal government. Some of the basic concepts in the Privacy Act contain some of the basic principles of fair information practices. We certainly have adopted some of them, such as notice, consent, and fairness. Many of the concepts we worked with 25 years ago are similar to the concepts relevant to privacy now. Notice is clearly the most important element of privacy. The consumer needs to know what kind of information is being collected and that there is choice in how the information is used. We understood then that consumers need to have choice about how their information is used. There should be some kind of regulatory or self-regulatory oversight or accountability of privacy practices. To a greater or lesser extent, people are applying that today. Corporations should look at privacy as a compliance requirement – particularly online businesses, although it should apply to all. They need to implement privacy policies and educate their staffs and employees. Online companies should tell people what information they collect, how they use it, how they disclose it, and how long they keep it. There must be some things they agree never to do unless they have consent, but basically it should operate as an opt-out system. A collector of data should notify individuals about whom they collect data and give them the option to allow or stop use of their data. Notification and clarity of notice are essential. Some people think certain activities should be prohibited even if consented to. There may be a place for that in some areas, particularly in sensitive information areas such as medical records. Then you must have the consent of the person before you disclose their information.

168

Privacy Matters

The TRUSTe efforts, the BBBOnLine efforts, and the Direct Marketing Association self-regulatory program have all gone a long way to change the statistics, particularly online. Three years ago, compliance and privacy records, according to Federal Trade Commission surveys, were not very good. Today, most of the top 100 sites have privacy policies and some level of compliance. In the Toysmart case, Toysmart had said it would never transfer personal information about its customers, but then tried to sell this information when it went bankrupt. Most people who write privacy policies now include a sentence to get around that: “except in the disposition of the assets of the company.” You put in language that protects you. We recommend that policies travel with assets, so whatever promise a company made about a set of information is kept. We work with a couple of companies that have bought dot-com businesses out of bankruptcy, and inevitably they commit to the privacy policies of the original company. Challenges Faced in Privacy Matters It is easy for people to talk the talk, but it is more difficult to walk the talk. The biggest difficulty in privacy is the translation between the two. We often have clients who come in saying they want the best privacy policy, but once you lay it out, it becomes clear that what they really want is to stop being noticed – with neither a great nor a bad privacy policy, but an adequate one. The greatest stumbling block is that people promise things and then look back and decide they really can’t keep those promises. That’s where the difficulties develop. Privacy has many facets – technical aspects, legal aspects, and business and executive issues. Privacy also is related to marketing and the use of the customer database. These are core

169

Inside The Minds

issues in terms of how you use the information, and privacy concerns should be up at the same level. A chief privacy officer, or CPO, position is being developed in many companies. It’s unclear for now whether this will be a permanent position, like a CIO, or a more transitory position that will help companies get into compliance in the short run. I do not think that has been proved yet – there are a lot of CPOs out there, but whether the position becomes institutionalized remains to be seen. It’s a shared responsibility – a committee of people involved in the company – and it’s pervasive, with no one person in charge of everything. Common Misconceptions About Privacy Laws The public, to a large extent, thinks there are no privacy laws in place, but in fact there is a significant amount of privacy law in the U.S. This law tends to relate to things that are not immediately obvious, however. One of the arguments we use to convince people that there is a lot of privacy law is that often it is not labeled as such. For example, under the Equal Credit Opportunity Act, you cannot be denied credit on the basis of gender. One of the subparts says you cannot be denied credit on the basis of someone else’s credit; a woman cannot be denied because of her husband’s credit. This requires the company to tell you the reasons it turns you down. That is a basic privacy right. The Gramm-Leach-Bliley Act covers financial institutions, and the Health Insurance Portability and Accountability Act (HIPAA) covers medical records. Portions of the Cable Act cover privacy of cable records. There also is a fair amount of privacy law in connection with telephones and electronic communications. Over the past few years, a patchwork quilt of privacy laws has developed.

170

Privacy Matters

The U.S. does not have an omnibus law like the European law, but there is a significant amount of law and, where it is in place, it is remarkably strong. I do not think the U.S. will follow the European model. There may be some general law requiring notification of privacy practices, but I think the most effective privacy laws will be sectoral. That was the recommendation of the U.S. Privacy Commission 25 years ago. Dealing with the various privacy regulations is like dealing with tax regulation – you have to be compliant in each state in which you choose to do business. What’s unique about privacy is that you may have to centralize data or move it across borders. There are flexible solutions to address data flow between the European Union and the U.S. Some large credit companies, such as Visa, have large processing facilities in the U.K., so that a lot of European transactions go there to avoid data transfer out of the E.U. There are a lot of practical solutions – model contracts, interim company contracts, and so on. Guarding One’s Privacy Employees often are not aware of certain privacy issues. In our firm, employees understand that the e-mail system is provided for professional use and that individuals should not think they have individual privacy in that system. People need to know that. The government can obtain information through some legal processes. For e-mail, they need a court order or some level of subpoena. The USA Patriot Act tried to level the field a bit. The government can get information online, but it has to be through legalities. The FBI originally had some restrictions on public sites, but they have probably been dropped now. People need to be careful with information online. First and foremost, from personal experience, I can advise being careful

171

Inside The Minds

about disclosing your credit card number online unless you have confidence in the recipient and see an encryption lock onscreen. Also, guard your Social Security number. Do not ever put it in any kind of public area. The information you post is essentially in the public domain. I would be worried about putting personally sensitive information on the Internet. Unless you are talking about one-on-one e-mail, there is not a lot of confidentiality on the Internet. Outside of that e-mail concept, it is open to everyone. You also must be careful when someone sets up peer-to-peer systems with files being shared. People think they are just exchanging music files, and all of a sudden their credit card numbers are being splashed all over the Internet. As technology advances, there is a potential to implement some hardwired privacy protections to help individual privacy. We also will see some applications or software that will be more intrusive. Technology can make things either better or worse – it is inherently neutral. It is the choices we make in adopting technology that determine levels of privacy. There will be applications that will make the DoubleClick cookie issue seem like vanilla ice cream. With “spyware” or Gator-type software, consumers agree to have software applications on their computers that record preferences. The drive to obtain more information on the Net may follow more of a consent mechanism, but it will become more effective than in the past. There is a tremendous drive on the Net for personalization, and as that drive increases, the issues of privacy increase on the other side. I understand vulnerabilities, but I am not overly paranoid. I am careful with my credit card number and similar information. The rule of thumb for me is that I am more comfortable in any environment dealing with people I know and who have a good

172

Privacy Matters

reputation. Even if I walk into a store and make a transaction, I am more comfortable if I know that company and have had business experience with it before. Brand name and reputation are critical offline and online in terms of comfort level. I am much more comfortable dealing with IBM.com or eBay, and they do well because they have established brands and identities. There are not a lot of private causes of action that have been successful for consumers in the privacy area. Consumers can contact their state attorney general and the FTC. If the company is a seal (like TRUSTe or BBBOnLine) or a DMA participant, contact the seal program or Safe Harbor program. Lawyers Dealing With Privacy There are so many different problems and issues in privacy law. Any lawyer gives clients advice in terms of contracts: Be clear and be able to do what you say you are going to do. That is key. The most frequent thing I do with a client is make them understand that if they promise something, they have to do it. If you have a Gramm-Leach-Bliley issue, you tell the client what they have to do. However, if you are writing a privacy policy for a Web site, there are no legal requirements. There are some things we all know should be in it, but in the end you are writing your own laws; there is no statute dictating what you have to say. Once you write something, the FTC insists you do what you say you will do. Be careful in what you write, and be careful that you follow through on it; otherwise, you could be the target of a state attorney general action. Young lawyers are prepared for all this. Most law schools have classes in e-commerce and privacy as electives, although a few don’t yet. Privacy law is more a matter of experience; it’s becoming more and more common. If you have any clients who do marketing or selling or Web site design, then they will have

173

Inside The Minds

to know about these issues. More people are pursuing this type of law. Five years ago, there were maybe two or three law firms dealing with privacy, and that clearly is no longer the case. When you have a law like Gramm-Leach-Bliley, the attorneys who advise banks become experts in that area of the law because it applies to their clients. Ronald L. Plesser focuses on issues that concern international communications, telecommunications, Internet law, legislative matters, privacy, data base companies, publishers, information and software providers and users, marketers, and other companies affected by the emergence of new information technologies. This includes matters of wireless and terrestrial communications issues. Clients including trade associations and individual companies are represented before the United States Congress, federal agencies, and all federal and state courts. Mr. Plesser has also represented clients in world regulatory organizations. Mr. Plesser is past chair of the Individual Rights and Responsibilities Section of the American Bar Association. He has been an adjunct professor of law at George Washington University (1982-1986). He also was Deputy Director of the Science, Space and Technology Cluster of the 1992 ClintonGore Transition. He currently serves on Piper Rudnick's Diversity Committee. Mr. Plesser is listed as one of Washington’s Top HighTech/Telecommunications lobbyists in Influence – The Business of Lobbying (December 2000).

174

Privacy Matters

PRIVACY CHALLENGES AND THE LOOMING TECHNOLOGICAL INTERSECTION

TIMOTHY D. CASEY Fried, Frank, Harris, Shriver & Jacobson Chair, Intellectual Property and Technology Department 175

Inside The Minds

Challenges of the Past The most challenging aspect of privacy-related matters of the past has involved getting people to understand what privacy means in the first place. The term “privacy” means something very different to almost everybody. If you talk about privacy to a European, it means something very different than it does to an American. If you talk to Americans about privacy, some may think of it as not having someone peeking through their windows at night, rather than relating the term to the privacy of their personal information. Until very recently, many Americans did not seem to care whether someone had obtained their personal information. There may be many different explanations for this, but a popular one has been that many of these people were so used to providing that information and having it used in myriad ways that it never occurred to them that perhaps they should never have disclosed it or that they had a right to protect it. For example, it has been common to provide one’s Social Security number, address, mother’s maiden name, and other personal information to whoever asked for it without first finding out why they needed it and what they intended to do with it. People are slowly becoming aware of why divulging such information can become an issue. A significant number of negative press reports have helped publicize what can happen to an individual when a criminal gets access to their personal information: Their money, property, credit cards, and even identities can be stolen. The result of these press reports has, unfortunately, been some degree of public paranoia. People have become irrationally concerned about any potential violation of their privacy and are going to extremes to try to protect it. The problem, however, is that people often do not understand exactly what “privacy” they are protecting, so their efforts are stretched too far and wide to be effective. With their newfound focus on

176

Privacy Matters

privacy, they do not want anybody to be able to use any kind of information (including public information) about themselves in any way whatsoever. This has created an uneasy imbalance. On one side you have people who do not care about protecting any personal information and do not want new privacy laws created, and on the other side are those who care about their privacy almost too much, wanting strong state and federal protection. At the present time, in the U.S., our regulatory and technological privacy solutions do not satisfy either of these groups. Challenges of the Present and the Future In the U.S. there is currently no guarantee of privacy; it is entirely up to each individual to create a privacy wall around themselves. In this context, “privacy” means privacy of personal information. As such, each person in the U.S. has a right to have their personal information protected only if they have first entered into agreements to have it protected and have not otherwise made it available. If you walk out onto the street corner and start divulging information about yourself, everyone around you can do whatever they want to with it. In such a situation, you had no right to privacy, and even if you claim you did, no court would ever support your claim, as it was not reasonable under the circumstances. However, if you enter into an agreement with somebody requiring them to protect your personal information before you provide it, and they fail to do so, then you have a contractual right against them. The situation is a bit different on the Internet. If you go onto a Web site and fill out a form that requests your personal information, and you submit that information without any agreement regarding its treatment, then the situation is no different from standing on a street corner and talking out loud. Many Web sites, however, offer privacy policies that state what they intend to do with the information you provide. Even though

177

Inside The Minds

your provision of information and the privacy policy, taken together, do not create a contract, various states and the Federal Trade Commission will force Web site operators to abide by their policies. Yet, such enforcement measures are not based on privacy laws – they are typically based on consumer protection laws. If, on the other hand, the Web site had no privacy policy, and there is no state or federal law requiring Web site operators to have one, or the privacy policy permits the Web site operator to do what it wants with your information, then you have no rights against that operator. Few people realize this fact. They believe a federal or state law exists that will protect them, or they trust the operator of the Web site not to harm them. While Web site operators may not gather the information with any intention of harming the people who provide it (they may only intend to use it to market other products or services, or to improve their own), once the information is made further available to other entities, anything can happen. The Workplace Another good illustration of the challenges to privacy in the future involves electronic communications in the work environment. Many workers assume they have the same right to communicate electronically at work that they have at home. Most people have heard it is illegal to intercept e-mail messages, just as it is illegal to tap a phone conversation, so they deduce that there must be some level of acceptable protection for such messages, whether they are sent from home or from work. The reality is quite different. Employers have very broad rights to intercept and read messages sent to or from employees when they are at work and using the employer’s facilities. Although there are limitations on the level of “snooping” employers can do in other contexts – for example, employers cannot put cameras in restrooms, as that involves invasions of privacy of a different

178

Privacy Matters

sort – such limitations do not apply to many electronic communications. In the context of the work place, electronic communications are very different from telephone communications. When an employee has a telephone conversation, in many states, it is illegal to record that telephone conversation unless both parties to the conversation have agreed. This is why, when you call a customer service line, you will often hear an announcement that says, “This conversation may be recorded to monitor employee performance.” Such recordings are common where the company is obligated, by the laws of the state where the call center is located, to tell you in advance that they are recording. Other states do not have this notice requirement, so the fact that you do not hear an announcement does not necessarily mean your conversation will not be recorded. Companies can also limit their recording to the outgoing conversation, although the process is a bit more complicated, and the employee’s comments are out of context. The result may be a recording of somebody saying something really bizarre, though completely understandable, given the circumstances. All forms of electronic communications are protected from interception in accordance with the Electronic Communications Privacy Act (ECPA), but this protection does not apply to electronic communications between employees and third parties. So if you are a private individual communicating over the Internet or via e-mail, you may be well protected under ECPA, but this is not true when you are an employee using your employer’s equipment and facilities to communicate with others. The ECPA only requires that you have the authorization of one person to be able to capture an electronic communication, such as an e-mail or an instant message. In addition, the ECPA generally applies to the interception of a communication, rather than the retrieval of stored communications. Many employees have been embarrassed when their employers retrieved long-

179

Inside The Minds

forgotten e-mails from back-up servers that evidenced illegal or inappropriate behavior – e-mails the employees thought they had deleted out of existence. Most employees, when they begin employment at a new job, sign all kinds of forms. Traditionally, one of those forms gives the employer the right to access such information, and because it is the first day of employment, many people do not think to object – and even if they did, it probably would not do them any good. Then, the next time you are sitting at work Web-surfing or looking for a car, your employer can monitor all of those actions and come and talk to you about any of it – or simply fire you. There are myriad stories in the media about people getting in trouble for doing stupid things at work, and failing to safeguard electronic communications has become a major cause. Legislative Challenges As can be seen above, a few laws exist to protect individuals’ privacy, but many more laws exist that compromise privacy in other ways. Each of these laws may be appropriate in its original context, but its application to recent technology has led to inconsistencies. One of the hardest tasks right now, from a privacy policy perspective, is to draw a balance between various divergent interests in such a way as to allow rules and laws to be created that will reasonably control the actions of the people requesting the information, and that will also satisfy the protective interests of the people who care about the issue, as well as those who do not want anything done. It will not be possible to attain this balance without first better educating people about privacy. For example, we need to dispel the myth that people have a fundamental privacy right. In the U.S., you have a right to privacy only with respect to the government spying on you or someone peeking through your window, but that is not true in the private, person-to-person,

180

Privacy Matters

person-to-company, or company-to-company context – at least in the absence of a privacy contract. Nor will it be possible to reach this balance until certain actions are taken to change such practices developed in the past as requiring people to use personal information, such as a Social Security number, as an official form of identification. This is an important change that needs to occur. Consider this: In Virginia, your driver’s license number is often your Social Security number. Although drivers have an option to use a state-supplied number, this fact is not widely publicized. If you do not use the state-supplied number and want to try to protect your Social Security number and prevent it from being available to someone who may try to impersonate you, you cannot do so because you make it available every time someone needs to check your age or identity. It does little good to protect your Social Security number in other ways if the state you live in is constantly forcing you to disclose that number. There is also incredible inconsistency between how your privacy and personal information are dealt with on a local and state level, the national level, and a private and personal level. Much needs to be done to develop a consistent approach to dealing with privacy in all of its different forms. This does not mean that the President of the United States should create a privacy department dealing with privacy, as the President is attempting to do with homeland security. But certainly some effort should be made to deal with this situation. Since many people do not recognize this issue even exists, raising privacy concerns will not get anybody elected, so nobody in a position to change things is paying much attention. In fact, we have gone in the opposite direction. In the rush to try to collect as much information as possible about potential or suspected Al Qaeda members, privacy issues have been thrown aside. For example, people have been supporting the right to

181

Inside The Minds

anonymity for many years, especially the right to anonymity on the Internet, so as to enable people to freely criticize governments around the world. Yet there is little discussion of this subject now, in part because it is that very anonymity that created the opportunity for people like Osama bin Laden, and organizations such as Al Qaeda, to operate under code names and e-mail accounts that could not be readily traced to individual users. At the same time, the U.S. government has encouraged citizens under other governments, such as the Chinese government or Fidel Castro, to criticize those governments’ rules, and the only way this was possible over the Internet was through anonymous accounts. So in some ways we are encouraging anonymity when it suits our purposes and discouraging anonymity when it interferes with our purposes. Ultimately the biggest change that needs to occur is the adoption of a fairly consistent, well-thought-out federal policy that balances the rights and interests of the nation against the rights and interests of its people. Future of Privacy One significant question we will face in the future will be whether to establish federal laws that create minimum protections for all personal information. Given that consumers are not doing a good job of protecting it themselves, one might question whether people really want such a law. This will be a big issue. There are some activities the majority of people will be willing to stop. For example, right now a Web site can request all sorts of information from its users, establish a privacy policy that says it can do whatever it wants to do with the information provided, and proceed to sell that information to pornography marketers. Also, if an adult provides you with personal information, without restriction, you can do whatever you want to do with it and are not obligated to protect it in anyway. In both cases, the provider of the information has no right to take issue

182

Privacy Matters

with the distributor of that information because either the distributor has followed their policy, or the provider failed to create an obligation of protection. Demand has been growing, however, for some legislation that will create a baseline level of protection, even in the absence of a policy or an agreement. In other words, under such legislation, everybody will have to meet a minimal level of privacy protection. No such law will be passed anytime soon, and when it does, it will be highly controversial. The European Union has a law like this now, popularly called the Privacy Directive. All of the member states in the European Union have an obligation to implement this law in their countries, but are doing so in different ways and with highly inconsistent results. One of the provisions in the Privacy Directive is that, to the degree that you do business with a country in the E.U. where you transmit data back and forth, you have to implement policies that are in alignment with this Privacy Directive, or the E.U. can prevent you from being able to transmit this information out of Europe in the future. The E.U. has not enforced this provision against U.S. companies, in part because the U.S. has negotiated the terms of the Safe Harbor compliance program for U.S. companies to follow. A number of U.S. companies have agreed to comply with the Safe Harbor requirements, and the E.U. has not officially complained, even though the Safe Harbor requirements are quite different from what is required by the Privacy Directive itself. Naturally, the E.U. does not want to end up in a battle with the U.S. over this, so to some degree they are not forcing the issue. If the U.S. should decide to pass its own law, very similar to that of the E.U. Privacy Directive in terms of requiring reciprocity on behalf of other companies interacting with the United States, this could have an even more significant impact than the E.U. directive because the majority of the companies interact with the U.S., as

183

Inside The Minds

well. Such laws should be passed at some point, and it will be very interesting to watch them develop. Some people have reacted to this whole privacy issue by basically locking themselves in a metaphoric dark room. To them, any use of any of their information at all is a massive invasion of their privacy, even though that may be a completely irrational response. Other people have never cared, and so to them it does not really matter, so long as the invasion is not overt. The average person worries about the invasiveness of other people’s actions only when the actions have some obvious, negative impact on them. What happens in the future will largely depend on how invasive company practices become. There has been a fairly strong change in the poll of public opinion, from most people not caring at all to quite a few people really caring. This issue has come a long way in a relatively short period of time, and the future will bring even more change. One of the major drawbacks to dealing with this issue is that consumers will have a hard time giving up the conveniences associated with being able to provide private information to somebody else. For example, do you use one-click shopping on Web sites where you frequently make purchases? Do you give them a credit card number and billing address and let them store it all or save it as a cookie on your system so that you can go back and not have to enter all that information again the next time you buy something? Consumers find such systems to be very convenient, and it is highly unlikely that they will want to take away the rights of the providers of such services to use their information in this way. The desire for convenience comes at a price. Recently developed technology, called screen scraping, allows people to provide information about their personal accounts and finances. With this technology, you provide information about your 401(k) account, your various investment accounts, and your bank account, and

184

Privacy Matters

the information you have online or Internet access to. You provide your PIN (personal identification number) and get information about what happened to your accounts on that particular day. This may sound like quite a convenience, but your price is conceding control of important information that could allow someone to access your accounts and steal your money. People are willing to go only so far. Even though there is great convenience associated with this service, the convenience does not override the potential danger represented by providing the information in the first place. The same thing could be true of providing somebody with information on all of your doctors and an authorization to get all of your medical records. This may be very convenient if you have many different doctors, but it could be quite embarrassing if that information was made public by accident. How many times have you heard about this or that Web site accidentally sending personal information from someone to 35 other account holders? It is inconceivable that this happens in the first place, but it keeps on happening. So people will become more and more concerned about the potential dangers as more things go wrong and people see evidence of it. Over the next five to 10 years, privacy will become even more of an issue. It will become more complicated, and more laws will be passed, and it is almost inevitable that those laws will be inconsistent. Many of the laws will be poorly written and thus will probably be subject to constitutional challenge. So we will see many lawsuits and possibly Supreme Court decisions attempting to settle these issues. The Technological Intersection The biggest change in privacy in the future will be in the technology used to process, distribute, and protect information.

185

Inside The Minds

Technologies – both software and hardware – that process, store, and disseminate personal information are being marketed aggressively, particularly to facilitate electronic commerce. The “digital wallets” will likely contain value for purchasing products and services on the Internet, but will also contain a significant amount of personal information. The idea, of course, is to make it as convenient as possible for people to transact online so more and more people will do business there. If a device or a piece of software containing all the information we now arduously enter into Web sites or on paper forms could transmit the information seamlessly and effortlessly, that would be very appealing. The problem is that when people do not actually see their personal information being given out, it creates a kind of false sense of security. At the same time, as discussed, the public is becoming aware of the consequences of misuse of their personal information. As a result, people will also begin to rely on technology to control some of their information, such as making a credit card number available over the Internet. People have a tendency to overly rely on technology to solve problems for them, and that reliance often results in dire consequences. There is a tension between emerging technologies that are designed to increase the amount and frequency of information flow on one hand, and to control or restrict that flow on the other hand. As always, the development of technology on both sides is driven by the marketplace. For some time now, industry and the government have been hoping misuse of personal information could be controlled by self-regulation. On the company side, control amounts to self-restraint – being satisfied with the information you can acquire by reasonable means, and being willing to ask your customers and potential customers in very clear terms for more if you want it. Usually, this will necessitate convincing consumers their information will not be misused and that they can reasonably expect some value in return for giving

186

Privacy Matters

out their information – for instance, useful information about products or services they may be interested in. On the consumer side, it really amounts to being cautious – realizing your information can be misused, and that even when you give your information to someone you trust, once you’ve put it out there, the genie is out of the bottle, so to speak. Unfortunately, selfregulation efforts, at least on the industry side, have essentially been considered a failure. This has resulted in increasing calls for regulation in this area. Since technology will be at the end points of information use and abuse, it may be that the technology itself will be regulated in certain ways, instead of just regulating the practices of information use. The heightened personal and national security concerns in the U.S. make regulation of technology even more likely. It seems clear that the government wants, and perhaps needs, some level of access to personal information about individuals to enhance security. The trouble is that the same information used by people to conduct ordinary transactions and just live their daily lives can be used to identify dangerous individuals. So in reality, we cannot effectively seek out and use personal information in crime-fighting efforts without accessing and, inevitably in some cases, compromising the personal information of ordinary lawabiding people. People’s increased sensitivity to the need for information privacy will drive how technology used to protect information develops. We have already reached a point where it seems unlikely that people will abandon the convenience of electronic commerce with its applications and features that potentially compromise personal information, such as one-click and cookies. But people will still want choices about how their information is used. It seems fair to predict that technologies that allow consumers to customize their information-sharing practices will proliferate in the coming years.

187

Inside The Minds

As always, the technologies that are easiest to use will emerge ahead of the pack. If you could program your Internet browser, for example, to share certain information with certain people or entities under certain circumstances, it really becomes a proxy for your own behavior and sensibilities. Avid commerce consumers get used to giving out a lot of information, on the Internet especially, because they very freely give that information repeatedly for certain reasons. For instance, consumer electronics may be purchased on the Internet. Because there is so much price competition in that business, a real enthusiast might transact with dozens of sellers over time. Such a consumer may feel his information is all over cyberspace anyway, and may continue to give out information liberally when he is buying books, pricing cars, or looking for health information. As information privacy technologies get more sophisticated and easier to use, people will learn they have more control than they think. In turn, companies will have to work harder to earn the trust of consumers. That trust will be earned through a combination of technology and good practices. Another way in which technology will affect privacy of personal information is the growing use of wireless networks in the home, in the office, and on the street. The technology underlying cell phone networks has become more secure, and even when conversations are not encrypted, it takes some sophistication to intercept a conversation. But the open nature of the Internet makes a difference. And as more and more devices connect to the Internet wirelessly, information will be literally everywhere, instead of limited to the wires of a communication network. Furthermore, many wireless networks are now cobbled together by users piggy-backing on each other’s systems and devices. There are many potential holes in the dyke. It will take some time, but changes will come to the world’s communications networks that will address privacy on a system-wide scale.

188

Privacy Matters

The challenge may be taking technology that becomes available, trying to draw legal measures that enable that technology to be used, and enabling the underlying information associated with that technology to be protected – and, more important, ensuring that information, once it gets where it is going, will be treated with the same degree of protection at that point. The problem is that people get caught up in the idea that they will provide information only if there is a guarantee that the medium used to communicate it is secure and that the information is encrypted using very strong encryption, such as 192-bit. Even if this is done and the information gets to its destination, it is unencrypted and reconverted into English, but may get stuck in a file somewhere. Then someone who is working the night shift, and who may not have security clearance, now has access to that material in its unencrypted and unprotected form. What good does it do to make sure that – in the highly unlikely event somebody was intercepting e-mail traffic – the information was protected when, in fact, it is not protected on the other end? Or perhaps they went through all this trouble to use this technology to protect their transmission, but they never bothered to read the agreement they were entering into with the company to which they were providing the information. Strategies to Protect Individuals and Companies From a personal perspective, I look at privacy as a duel between convenience and potential danger. Unlike most consumers, I actually read privacy policies. I still have not gotten to the point where I actually read software license agreements for online software because they are too long, and I want to use the software anyway, or I would not have gotten to that point. For privacy, I am a bit more circumspect about whether or not I want to provide someone with information. I have repeatedly been online, seen something I want to do, and begun to go through the process of buying something or providing information. Usually

189

Inside The Minds

the first couple of screens will be innocuous, and then suddenly, when you get to the third screen, you wonder what they will do with that information. Then I look at their policy, and I don’t like what it says because they promise me nothing, and I don’t like what they would do with the information. So I back out of it. I take a strong stance on this issue; most people do not. People can employ protections that have been around since even before the Internet. In the U.S., the Telephone Consumer Protection Act gives consumers some options in directing how telemarketers and telefaxers use their personal information. People also may be surprised at some companies’ willingness to accommodate restrictions you impose on the use of your information, especially with growing media attention on abuses. This, of course, does not always have an effect, and largely depends on how seriously a given company takes privacy concerns and how well organized they are internally to place effective restrictions. When providing advice to companies, you have to understand what, from their perspective, they are actually trying to do. Are they trying to take advantage of people? I don’t think that’s a good idea, but here are the rules, and you decide what you want to do. If the company means well and is interested in trying to come up with a reasonable balance in terms of being flexible while at the same time providing you with a reasonable degree of protection for the information you provide, that’s very manageable. Your strategy is to try to get in and understand what the company currently does to address privacy. You are basically auditing all the practices and businesses they have, the types of information they use, and where they are headed. The solution then is to craft a policy around these variables and make sure they have the ability to change them. This last point is very important. Once companies begin to look at their information use practices, they often discover how much they vary among organizations within a company, and how often practices change.

190

Privacy Matters

Working to identify practices is only one step in the process. You also have to create a structure by which all decisions made by different groups within a company regarding the use of personal information of customers and potential customers conform to the company’s publicly available privacy policies, or that those policies are modified accordingly. This inevitably proves to be a greater challenge than the company anticipated, and, for some large companies, ultimately requires the appointment of a high-level official with the authority to direct privacy practices companywide. If companies want to complete transactions aimed at children, then privacy becomes much more complicated, because there are laws that deal with communicating with children on the Internet and collecting information from them. If a child is under the age of 13, there are very strict federal rules about not being able to collect any information about them at all, even their name, where they live, or how old they are, without parental authorization. Securing parental authorization is difficult in most cases, not because the parents care – more often than not, they are not paying attention in the first place – but because it is difficult to get the child to ask the parent. The other problem is that the law is not structured very well, in that you have only to ask someone if they are under 13 before you collect the information about them. If the person lies, you are free and clear, which undermines the goals of the law, to say the least. Sooner or later Congress will figure this out and close the loophole, so businesses are better off trying to develop a system that anticipates such change, rather than creating a system that relies on this loophole. When it does go away, you have to be careful about what you have done. When people do want to provide legitimate child-oriented Web sites, there is a lot of strategy involved in trying to figure out how to go about doing it, what type of technology they need to implement within the site to make it all work, and what information it is realistic to

191

Inside The Minds

request or not to request. Many complexities are involved, and businesses are guided through all of that. The most important element of helping clients protect themselves is educating them about the rules and misconceptions and about how to establish practices and policies and implement them to avoid getting into trouble. If you establish a privacy policy, you had better live up to it because the FTC goes out of its way to find people who are violating their own policies and takes action against them. You do not want to be at the other end of FTC enforcement. At the same time, though, you want to establish a privacy policy that provides you with sufficient flexibility to do what you need to do to make your business successful. Smart companies spend more time thinking about how to write a policy that sounds good to customers and provides them with reasonable assurances so the company can live up to the policy over an extended period of time. The policy should also take into account potential changes in the business environment for the company, where it is headed, and its goal. Many privacy regulations cover certain areas, but there is not one that broadly applies to all practices. The Gramm-LeachBliley Act applies to financial services; however, the definition of “financial services” in that Act appears to cover a wide array of activities, many of which most people would not associate with financial activity. A number of other laws apply more narrowly to banks and credit card issuers. Telecommunications companies are moderately restricted in what they can do with customer information, and medical records are protected to some extent, although many people would argue not sufficiently. Until privacy law improves in strength and consistency of application, individuals and businesses alike will do well to remember that privacy is a myth.

192

Privacy Matters

Timothy D. Casey is a partner in Fried Frank’s Washington, D.C., and New York offices, where he is chairman of the firm’s Intellectual Property & Technology Department. He joined the firm in 2000. Mr. Casey counsels clients in negotiating business and technology-related transactions; developing, managing, and using intellectual property (“IP”) and technology assets; analyzing and valuing IP and technology in license and corporate transactions; planning and managing IP and technology litigation; and creating and advocating IP and technology policy. Before joining Fried Frank, Mr. Casey was chief technology counsel, senior vice president, and assistant secretary for WorldCom, Inc. (previously MCI) from 1995 to 2000. In that capacity, he was head of all legal aspects of the worldwide technology and IP operations of WorldCom and its predecessor, MCI Communications Corporation. During this period, Mr. Casey was a key participant in many of the operational and corporate transactions contemplated or executed by MCI and WorldCom, including various acquisitions, mergers, joint ventures, and investments. Mr. Casey initiated and oversaw the development of a trade-secret protection program and of a patent operation that went from fewer than 10 issued patents in 1995 to many hundreds of issued patents in 2000. He directed the reorganization of MCI’s trademark operations to substantially streamline costs and maximize protection, including the complete re-branding of the company twice in as many years. He drove the company into the forefront of technology and IP policy development and advocacy as a result of his pivotal role in the development of both the Digital Millennium Copyright Act and the European Union’s Directive on Electronic Commerce. In particular, Mr. Casey is recognized as the originator of the idea of using a notice-and-takedown

193

Inside The Minds

process as a statutory, expedited remedy for disputes involving content available on the Internet. As chief technology counsel, Mr. Casey also oversaw the establishment of, provided the strategic direction for, and managed the work of a technology transactions group that succeeded in significantly reducing WorldCom’s exposure to IPrelated claims in sales transactions, enhancing the company’s ownership in or rights to technology developed by or on behalf of the company for use in its operations, and leveraging a vast array of transactions (including outsourcing, joint venture, and development agreements) that helped to materially reduce the company’s cost of doing business and increase its profitability. During his tenure as chief technology counsel, Mr. Casey became an international authority on the legal, technical, and practical issues associated with attempts to regulate and otherwise control content flowing through the Internet. His book, ISP Liability Survival Guide: Strategies for Managing Copyright, Spam, Cache and Privacy Regulation (John Wiley & Sons, 2000), sponsored and reviewed by Vinton Cerf (codeveloper of the TCP/IP protocol and known as the “Father of the Internet”), explains such laws and the history and thinking behind them and what any entity offering services over the Internet needs to do to comply, in a simple and understandable fashion. Before 1995, Mr. Casey was director of Intellectual Property at Silicon Graphics, Inc., in Mountain View, California, where he established SGI’s intellectual property operations, and divisional patent counsel at Apple Computer Corporation, where he serviced the needs of Apple’s Advanced Technology and Advanced Product Groups. Earlier in his career, he was a patent lawyer in private practice and an engineer for a disk-drive company now owned by Western Digital.

194

Privacy Matters

Mr. Casey has spoken and published extensively on IP and technology matters, including testifying before both Houses of Congress on a number of occasions; served as chairman of the Intellectual Property Committee of the Information Technology Association of America; served as an Adjunct Professor of Law at Santa Clara University School of Law; and lectured at a number of other universities. Mr. Casey is editor-in-chief of Patent Strategy & Management, a monthly publication by American Lawyer Media. He is currently serving on the Advisory Board of BNA’s Electronic Commerce & Law Report; as a domain name panelist for the World Intellectual Property Organization Arbitration and Mediation Center; and is on the National Academy of Sciences, Computer Sciences and Technology Board’s Internet Navigation and the Domain Name System Committee. Mr. Casey received his JD in 1988 from Santa Clara University School of Law, where he was the editor-in-chief of the Computer & High Technology Law Journal (Volume 4) and where he was also the first part-time student at the school ever to serve as the head of a law review. He received his B.S. in electrical engineering in 1984 from the University of Nevada, Reno. He is admitted to the bar in California and the District of Columbia and to practice before the U.S. Patent and Trademark Office. Mr. Casey is a co-founder of CHIBB Foundation, a non-profit organization that provides supplemental support services to other children’s charities. In cooperation with Fried Frank’s extensive pro bono program, CHIBB has provided legal services to numerous children’s charities. Mr. Casey serves as CHIBB Foundation’s representative on the Steering Committee for First Things First, a campaign to increase awareness of children’s issues in the Commonwealth of Virginia, and as an advisor to the board of directors of a number of child-oriented charities.

195

Privacy Matters

CHALLENGES IN PRIVACY LAW

DALE M. CENDALI, ESQ. O’Melveny & Myers LLP Partner, Chair, Copyright, Trademark and Internet Practice Group

197

Inside The Minds

Privacy Complexities Privacy is a Hydra in that, first, unlike many other areas of law, no single body of privacy law exists in the U.S., which makes it difficult to spot issues and to stay abreast of all relevant developments. Also, there are many competing policy issues regarding privacy law, all of which are constantly evolving. All of this presents significant challenges to people attempting to plan their privacy strategy. It is important to remember that a consolidated, settled body of law does not exist regarding privacy issues. Privacy lawyers have to exercise a great deal of judgment to determine what laws might apply to a certain situation. In the U.S., privacy law consists of a mixed assortment of federal and state statutes and regulations, as well as common-law judicial decisions. Some federal statutes relate to particular industries, such as telecommunications, while some statutes are overarching, such as mail and wire fraud statutes, that could apply to everyone. Similarly, the Federal Trade Commission has issued both general regulations regarding privacy, and many specific privacy regulations that apply to discrete areas, such as securities or alcohol, tobacco, and firearms. In addition to federal statutes and regulations, different state laws have been enacted across the country that a practitioner must keep in mind, such as Minnesota’s ISP Privacy Law that limits the use of data collected by ISPs. Further, non-statutory common laws exist that have been developed over time by our system of case law serving as precedent in other cases, such as common-law invasion of privacy. Thus, when advising clients in the United States, one must consider federal and state statutes, as well as common law precedents. This complexity is compounded by the implication of foreign privacy laws in certain situations, especially if one is dealing with issues involving the Internet or multinational corporations.

198

Privacy Matters

So privacy lawyers must be aware of developments in international privacy law to best advise their clients. While most practitioners are familiar with some of the major European Union directives and rules on privacy, which generally are stricter in protecting privacy than the laws in the U.S., many other countries in the world have differing privacy law regimes. For example, unlike the U.S., some countries have attempted to codify a single uniform privacy law to avoid a complicated assortment of privacy laws. Obviously, it is very difficult for a lawyer to be an expert on all of the privacy laws in the entire world. As a result, it is very important to recognize when an expert regarding some particular aspect of foreign privacy law is needed in a particular situation, especially knowing lawyers in the U.S. are prohibited from practicing law outside the U.S. without a license. The varied assortment of domestic and international privacy laws makes it very challenging for lawyers practicing in this area to stay abreast of new developments. Privacy law is far from settled, and the landscape is constantly changing, but lawyers and their clients must be attentive to new developments in all of these areas. At any given time, there is a lot of pending legislation regarding privacy issues. For example, in 2001 alone, almost 50 federal bills were introduced in the United States Congress that include the words “privacy” and “Internet,” such as the Consumer Internet Privacy Enhancement Act, the Online Privacy Protection Act of 2001, and the Consumer Privacy Protection Act. The second major challenge in privacy law is determining what the law should be, as there are many competing privacy interests and numerous ways to construct a body of law regarding privacy. There is no “natural law” of privacy. Everyone inherently understands why we have the law, “Thou shall not steal,” because if people went around stealing from others, our society would break down very quickly. But in privacy, there are

199

Inside The Minds

many different ways to create an appropriate legal framework, depending on how society values certain principles. Some of the primary concerns affecting the formation of our privacy laws include protection of personal information, promotion of business interests, facilitation of the Internet, and protection of the public from criminal activities, such as consumer fraud and terrorist acts. Balancing these concerns may depend on myriad factors, such as the type of information collected, who collects it, the method of collection, costs associated with collecting it, the purpose of collecting it, and whether notice is given to individuals that the information is being collected and how it will be used. The appropriate balance of factors and concerns, moreover, may differ across industries and between the public and private sectors. For example, in the commercial world, many consumers are willing to allow companies to collect information about them in a number of situations. On one hand, no one wants to have his or her personal privacy violated and personal information disseminated to others without permission. On the other, the public appreciates the ability to enjoy certain Web sites essentially for “free” because such sites are sustained by selling information to others and by tracking their visitors to determine who is visiting the site. Further, studies show that while many people are concerned about privacy, they are often not willing to spend extra money to implement software that would protect their personal information. There are a lot of consumer-oriented privacy tools available today, such as cryptography software and technology to disable cookies, but many people do not use them. Business models in which companies have tried to sell the public devices that could protect an individual’s personal privacy or even do something as simple as electing to activate a cookie or not have not been very successful. While the public overwhelming agrees that privacy protection issues are important in commercial

200

Privacy Matters

contexts, it is evident that the public is not always “putting their money where their mouth is” – possibly because they are not fully aware of the extent to which their personal information may be used or because they do not feel it is their responsibility. All of this makes it difficult to figure out exactly how privacy should be protected in the commercial context and who should bear the cost of paying for it. Another privacy issue of particular importance to the business world is whether the U.S. should conform its laws to privacy laws in other countries, such as the European Union or its other major trading partners. This issue will become increasingly important as cross-border business transactions become even more frequent, and with them the potential increased call for “harmonization.” In the public sector, privacy issues often hinge on balancing privacy and security interests. Specifically, one of the major issues involves the gathering of information by the government to combat terrorism, as well as all other types of criminal activities, such as consumer fraud and mail and wire fraud, and even street-level crimes, such as theft at ATMs. While no one wants to be monitored or to have their actions tracked by the government, the public also understandably demands that the government successfully detect and apprehend criminals, or ideally stop criminal acts in advance. This classic tension between security and privacy has been exacerbated by the 9/11 terrorist attacks. In response to the attacks, Congress passed the USA Patriot Act, which includes several “Enhanced Surveillance Procedures” that expanded law enforcement’s authority to monitor individuals’ Internet activities. The primary purpose of these procedures is to combat terrorists’ use of the Internet as a means of communication. These new surveillance powers include amending the federal wiretap statute to include electronic communications and

201

Inside The Minds

expanding the scope of subpoenas for records of electronic communications. Critics of the USA Patriot Act fear that these enhanced powers are overly broad and can be applied to nonterrorist-related activities, thereby infringing upon individuals’ constitutional rights. While many people are concerned about these expanded powers of law enforcement, privacy advocates wonder if privacy law still exists, because at least a significant percentage of the public seems to be more than willing to allow the government to track their activities if it will reduce crime or terrorism. Clearly, there are strong tensions between these different concerns. An important task of privacy policymakers in the future will be trying to find a balance between protecting individual and civil liberties and preventing criminal activities and terrorism, as well as promoting business interests and e-commerce. There is no doubt that it will be challenging to find that balance. Keep up With Technology Technological developments will lead to many changes in privacy law, particularly in the online world. Technology has already been developed to enhance the protection of an individual’s privacy on the Internet, such as devices that can disable cookies or shield individuals from a significant amount of the commercial monitoring for which the public has expressed concerns. However, at the same time that technology is being developed to protect an individual’s personal information, new technology is being developed to monitor and track individuals’ activities more accurately. So in the future, our increasing ability to prevent privacy intrusions via technology might be negated by different technological advances that will make it easier to monitor individuals and gain their personal information.

202

Privacy Matters

It is very important that privacy lawyers become aware of these different technological tools to resolve their clients’ privacy issues. Indeed, many clients who are concerned about a certain privacy issue will often be so focused on a legal solution to resolve it, that they might overlook available technological solutions. Lawyers practicing in the privacy field should be mindful that there may not only be a legal solution to their client’s issues, but technological solutions may also exist, such as software to disable cookies or new advances in security firewalls. For example, the proliferation of e-mail as a means of communication in the business world has raised some concern in the legal community. In general, e-mails are written more casually and quickly than traditional letters, which have more opportunity to be “sanitized” before being mailed. Many people are concerned about the production of e-mails in litigation, either because e-mails are often too candid in nature or because the sheer number of e-mails makes it too burdensome for a company to respond to discovery requests. In response, software has been developed to make e-mails “disappear” by eliminating them from a computer system automatically after a given time period. This software, however, does not fully resolve the legal issues regarding e-mails for a variety of reasons. First, e-mails can be printed and saved. Further, it is unclear how such a system would be viewed by courts, given the obligation to retain documents in a litigation context. So while technology may not resolve all of a client’s privacy issues, this example illustrates why it is good practice to know of the existence of relevant technology. Pay Attention to Brick-and-Mortar Issues Also Although much attention has been focused lately on Internet privacy issues, such as the security of credit card information for

203

Inside The Minds

online purchases or the collection of purchasing behavior information by online retailers, it is important to remember there have long been and continue to be similar attempts to collect personal information in the non-Internet environment. For example, credit card information that is divulged to a waiter in a restaurant can be misused. Charitable institutions can transfer their donor information to other institutions for solicitation purposes. Certain retailers, such as supermarkets and drug stores, offer their customers shopping cards with which they can receive a discount at the store when used. Many people are unaware that the customers are effectively funding these programs because they are in essence selling information about themselves and giving the retailers the ability to collect purchasing information about them in return for cheaper prices. Further, it is quite common for retailers who advertise their goods in catalogs and receive telephone orders for them to disclose their customers’ personal information to other businesses. In fact, many people are aware of the practice of catalog retailers to buy and sell their mailing lists. It is not unusual, for example, for a customer who receives unsolicited catalogues or junk mail to try to figure out who gave their information to the sender by tracking a misspelled name or merchandise code. While consumers can have their names removed from these mailing lists, and services exist that specialize in helping consumers do so, many people do not take these steps, apparently acquiescing to the practice of buying and selling such lists. While these brick and mortar privacy issues have not received as much attention in recent years as Internet privacy issues, various lawmakers are continuing to pay attention to them. For example, in August 2002, the Federal Communications Commission released an order requiring telephone companies to gain their customer’s affirmative consent before using or disclosing Customer Proprietary Network Information (CPNI). CPNI

204

Privacy Matters

includes information about customers’ telephone calls, such as duration, destination, and length. This information could be used to market other services the carrier offers its customers, such as credit cards. The “affirmative consent,” or “opt-in,” requirement mandated by the FCC provides that CPNI is not used or disclosed to others unless the customer explicitly allows it. This order creates strong privacy protections for individuals and rejects the “opt-out” alternative, which would allow for CPNI to be used and disclosed unless an individual expressly objects to it. In addition to the exchange of personal information by companies for commercial purposes, many people do not fully appreciate the extent to which law enforcement agencies are able to monitor individuals. In some cities, such as Washington, D.C., video cameras have been installed on certain streets to monitor passersby. The theory is that any crime that occurs will be caught on videotape, thereby making it easier to identify and apprehend the perpetrators. The public is seemingly used to these surveillance cameras in some places, such as in ATM kiosks or at gas stations, and is presumably aware of examples in which the footage resulted in the arrest of a criminal. Similarly, it is not unusual to hear of a criminal being placed at the scene of a crime because of a cell phone call, a credit card transaction, or an automatic toll plaza payment. Many people are glad these techniques exist to apprehend criminals and do not seem to mind that they are being videotaped or that their activities could be similarly monitored, if they realize it at all. However, the public may become more troubled by the increase in law enforcement’s use of surveillance cameras over time. As more cameras are installed, more questions may arise: Who will have access to the footage? How can it be used? Will access be limited to law enforcement agencies? Or will it be acceptable to use these tapes as evidence in civil cases, such as divorces? Another question will be where surveillance can cameras be placed. If you are one of five million people who go through a

205

Inside The Minds

turnstile or pass a videotaped street corner, you might not necessarily mind that a surveillance camera is monitoring you. However, if there were video cameras in hotel rooms or even hotel lobbies, you might feel differently. Even more concerns might be raised if the video cameras were used to monitor attendees at political functions. Corporate Privacy Policies Corporate privacy policies are a very important component of modern privacy planning and vary dramatically from company to company. Some companies expressly inform their customers that they will use the customer’s personal information they gather only for their own internal purposes. These companies, however, do not always explain what their internal purposes are. Some companies promise their customers they will not use the information to solicit the customers. Some companies specifically tell their customers they will use the information to solicit them or to inform them about other opportunities that may interest them. Some companies specifically promise they will not sell or give their customers’ personal information to a third party. Conversely, other companies tell their customers explicitly that they will share such information. Even today, some companies have not developed privacy policies. At one time, this strategy was not a bad idea because nothing required them to do so. But newer laws now strongly suggest that companies develop privacy policies and expressly notify customers about how their personal information will be treated by the company. Developing a privacy policy, however, is just the first step. Companies must also make sure they adhere to the privacy policy that has been posted to the public. If a company fails to do so, it can become involved in litigation in which it is accused of

206

Privacy Matters

breaching a contract with customers by promising to treat their personal information in one way and doing something else. At one time, numerous class action lawsuits had been filed to protest just such actions – although they were largely unsuccessful. In addition, companies should be particularly vigilant in the mergers and acquisition context. Complications can arise when two companies with different privacy policies try to merge or when a company tries to acquire another with an inconsistent policy. In extreme cases, the inconsistent policies have resulted in the frustration of the merger or sale. In other cases, the acquired company must be run as a separate unit for a period of time – perhaps indefinitely. Awareness of potential litigation and merger issues has led to many companies stating in their privacy policy that the policy is subject to change without notice. Inevitably though, litigation will determine whether it is legally permissible for a company to state its privacy policy can be subject to change. Another important part of creating and adhering to a corporate privacy policy is ensuring that the company has a security system to maintain it. It is becoming increasingly clear that a privacy policy without adequate security measures to support it is not sufficient. Companies cannot simply promise that their customer’s personal information is secure; they must take steps to ensure it is secure. In fact, in addition to being liable for the intentional release of information to third parties, companies that collect data from their customers must be wary of accidental release of information and must ensure that their employees are properly trained to keep information private pursuant to the company’s policy. In 2001, for example, the FTC brought an action against Eli Lilly for accidentally releasing nearly 700 e-mail addresses that identified customers of Eli Lilly who had signed up for an alert service on Prozac.com. Litigation was avoided, and the FTC and

207

Inside The Minds

Eli Lilly entered into a consent order that requires Eli Lilly to institute an information security program that would develop and maintain reasonable safeguards to protect its customers’ personal information. In particular, Eli Lilly will have to designate employees to coordinate and supervise the program, identify reasonably foreseeable risks to the security of personal information, conduct an annual written review to monitor compliance with the program, and adjust the program accordingly. Clearly, a company’s obligation to maintain confidentiality of its customers’ information extends beyond the obligation to post its privacy policy. In addition, a company must monitor its employees to ensure that they adhere to the company’s privacy policies. In the future, companies will have to expend more resources to assess and monitor their internal privacy practices and train their employees to make sure they can properly comply with such policies. As privacy law continues to evolve and companies continue to develop the use of the Internet for business purposes, they will need to become more attentive to the privacy policies posted on their Web sites. Privacy Audits Due to having myriad federal, state, and international laws concerning privacy matters, it is very difficult for a company to stay abreast of new developments in privacy. Some companies have created the position of chief privacy officer to designate someone to be in charge of monitoring privacy law developments and ensuring the company is in compliance with those laws. Other companies, especially smaller businesses, will appoint an employee, often from the legal department, to stay abreast of privacy issues. And others may look to outside lawyers or consultants to help them ensure compliance with privacy laws.

208

Privacy Matters

One tool that is used increasingly by companies to ensure compliance with privacy law is a privacy audit. While the nature of a privacy audit may vary with the nature of a company’s business and the amount of money it is willing to spend on the project, a privacy audit will focus on certain issues, such as the company’s Web site and posted privacy policy, employee privacy issues, computer system security, security of customer information, and privacy-related provisions in contracts. A privacy audit will typically involve issues regarding the client’s information retention practices – how it stores such information, whether the information is stored securely, or if storage allows for overly broad access. The audit may also include an examination of the client’s technology and suggest new technology the client might buy or license. If a client is concerned with security, many different types of firewalls and security measures are available that the client might want to consider implementing, as well as various filters the client could consider using. In addition, there are tools a client may want to consider implementing that will prevent the tracking of its confidential information. Conversely, if the client is a retailer or transacts business over the Internet, it may want guidance regarding how to legally obtain customer information, because that may be how they sustain their business. A privacy audit can encompass both Internet privacy issues and brick-and-mortar issues relating to privacy. Finally, this analysis may be multi-jurisdictional, depending on whether a company transacts business in one or more states or countries. Expectation of Privacy in the Workplace Privacy in the workplace is one of the hottest issues in privacy law. Virtually everyone has a job (or a family member with a

209

Inside The Minds

job). In addition, many people are spending more time in the workplace. However, while people are aware of privacy issues in the workplace, they often do not completely understand their right to privacy in the workplace or the nature of the employeeemployer relationship. For example, many people may believe that their office, locker, or desk is their personal space and that they can use it for any purpose. Many people also believe that the computer in their office is their personal property and will treat it as such. In fact, some employees prefer to use their office computer for personal use, such as downloading MP3 files or surfing the Web, because these computer systems are often more sophisticated and high-speed than home computers. Further, they believe the information on their computer is “private,” so they can send and receive sensitive e-mails (perhaps even e-mails critical of the companies they work for) that will remain confidential. Whether or not an employee has a reasonable expectation of privacy in the workplace depends on the particular facts and circumstances of the case. To clarify the issue, many companies have taken steps to expressly inform their employees they should not have an expectation of privacy in the workplace. In some cases, a company will publish an employee handbook that specifically explains to its employees that they are not supposed to use the computers or other company materials for personal use. Further, most companies notify their employees that they should have no expectation of privacy whatsoever with regard to the use of a company computer or any other company asset. This notification is not always just in the employee handbook; instead, some companies alert their employees to this fact every time they log onto their office computer with a prompt screen that tells them there is no expectation of privacy and that the computer should not be used for personal use or to send hate mail or other derogatory material.

210

Privacy Matters

When a company notifies its employees there is no expectation of privacy in the workplace, most courts will find there is no reasonable expectation of privacy. As a result, the company has the right to monitor its employees’ e-mail and to track what its employees have been downloading from the Internet. For example, a company may be interested in determining whether an employee has been downloading infringing MP3 files or whether an employee has been visiting pornographic Web sites or hate Web sites. Companies often track such activities to determine whether their employees are being productive, or they may be concerned that their employees could be subjecting them to potential contributory or vicarious liability. In the old days, a supervisor could tell whether someone was working or not by walking by to see if he or she was on the telephone or hanging out by the water cooler. Today, it is not as simple to determine whether employees are working on their computer for business purposes or surfing the Web for personal purposes. Many of these issues are exemplified in a recent court case. In United States v. Simons, 206 F.3d 392 (4th Cir. 2000), a government employee was convicted of viewing child pornography in his office. Despite the many rules that the government agency in question had that made clear there should be no expectation of privacy, the employee argued he had an expectation of privacy, as he had his own computer and office. The courts rejected this argument, ruling the government had the right to monitor the employee’s Internet activities. Further, the courts ruled the government had the right to enter the employee’s office and replace his office computer’s hard drive with a different hard drive to investigate the matter in more detail. So the employee did not have an expectation of privacy in his office, despite his apparent subjective belief that he did.

211

Inside The Minds

Rights of the Government to Monitor Individuals While the Fourth Amendment to the U.S. Constitution is the primary limitation on the government’s power to review historical information contained in a computer, the government’s right to monitor individuals’ recent and ongoing online activity is governed primarily by the statutory privacy laws set forth in the wiretap statutes, the Electronic Communications Privacy Act, and the Pen Register and Trap and Trace Device statutes. These statutory privacy laws both empower the government to investigate various activities and monitor individuals online and limit the government's right to invade the public’s privacy. Although there may be limited exceptions (such as companyauthorized monitoring of company systems to track a hacker), it is generally true that the government will be required to obtain court approval, including search warrants, pen registers, wiretap orders, or other orders, before it can lawfully monitor a person’s online activity. The court approval process is in part designed to ensure that law enforcement’s need for information justifies and outweighs and individual’s right to privacy. As new technology is developed to monitor online activity, the government’s right to use such technology to apprehend criminals will be tested. One of the most controversial Internet surveillance tools that law enforcement uses is the Carnivore Diagnostic Tool. This Carnivore program is installed by law enforcement at the office of a suspect’s ISP during a criminal investigation to monitor “to and from” information in e-mail messages. The government has argued that the Carnivore program is similar to, and no more intrusive than, traditional telephone pen registers or trap-and-trace devices, and that its use is limited by the requirement of prior court approval. Critics of the Carnivore program, however, argue that the program has broader capabilities and could be used to monitor all traffic passing through an ISP, not just the suspects’ traffic. As such, they argue the Carnivore program is not as narrowly tailored as

212

Privacy Matters

traditional surveillance methods and is overly invasive of the privacy rights of the public. Though controversial, the Carnivore program is being used increasingly as a law enforcement tool. The initial uproar over the use of the Carnivore program subsided substantially after the 9/11 terrorist attacks, as public and law enforcement attention focused on newer and better ways of detecting terrorism, even at some loss of individual freedom. In fact, while watchdogs continue to express concerns about the invasiveness of the Carnivore program, the law enforcement community is expressing skepticism about whether the Carnivore program is powerful or sophisticated enough to effectively detect terrorist activities. It seems clear that law enforcement officials will continue to attempt to use such technological devices as the Carnivore program in their investigations, and that the use of these tools will continue to test the importance of online privacy rights of individuals. The Future of Privacy As people continue to use electronic devices, such as cell phones, ATM machines, credit and debit cards, electronic tollbooth passes, and a variety of computers, it is likely that there will be an increased ability to monitor these activities. There is also a heightened awareness of the danger of such monitoring to basic civil liberties. The future is likely to see more debate about the proper balance among individual privacy, business needs, and law enforcement objectives. Rather than being a static balance, however, it is likely that the weight given to these interests may change over time and may be tailored to specific situations and industries. In any case, privacy is likely to remain a hot issue for decades to come.

213

Inside The Minds

Dale M. Cendali was named by the National Law Journal as one of America’s Top 50 Women Litigators. She is a partner in O’Melveny & Myers LLP’s New York office and is head of the Copyright, Trademark and Internet Practice Group firmwide. She is a nationally recognized leader in the field of intellectual property litigation, having successfully litigated and tried numerous high-profile cases, particularly for leading media, computer, and entertainment companies in litigations involving household name properties. Ms. Cendali’s practice spans copyright, trademark, patent, and trade secrets, as well as defamation, right to publicity, false advertising, and privacy. She was chair of O’Melveny’s Privacy Task Force. She is also very active in the Bar, having been cochair of the ABA Litigation Section’s Intellectual Property Litigation Committee, as well as a division director of the Section. She is also a member of selective committees in both the New York State Association and the Association of the Bar of the City of New York. Ms. Cendali writes prolifically on IP topics for such publications as The Harvard Journal on Legislation, The New York Law Journal, The Trademark Law Reporter, and The National Law Journal and has published chapters in various books. She is also a frequent speaker on numerous IP and litigation-related topics including privacy.

214

Privacy Matters

PRIVACY: ADJUSTING TO CHANGES IN TECHNOLOGY

DAVID M. KLEIN Shearman & Sterling Partner

215

Inside The Minds

Privacy Perspectives I began my practice as a patent lawyer working in a very small law firm specializing in patent prosecution. In that practice, I worked closely with individual inventors and small companies, which enabled me to understand many of their business concerns and fears. Since then, I have worked for more than 10 years at large and medium-size law firms handling intellectual property matters for many different types of clients. Early in my practice, I represented primarily smaller companies, handling a variety of technology issues. More recently, as a partner at Shearman & Sterling, I have represented a broad array of clients, ranging from Internet startups to very large investment banks, consumer banks, and other financial institutions. The work I do for these companies includes licensing and outsourcing, patent and trademark counseling, advising on Internet issues, such as privacy policies and terms of use, and handling the intellectual property aspects of large corporate transactions, such as mergers and acquisitions and public offerings. My practice has changed considerably over the past five years as the Internet has become increasingly more important to society. For example, issues such as privacy, which previously were considered relatively esoteric areas of the law, have pushed to the forefront and required companies to modify their practices to carefully consider and understand privacy- and Internet-related issues. However, privacy laws and privacy-related regulations have been changing so rapidly that attempts at compliance are like trying to hit a moving target. Because I represent a broad array of clients, I must view privacy issues from many different perspectives. For example, a small Internet service provider servicing non-commercial customers must look at privacy issues from the perspective of maximizing

216

Privacy Matters

the value of information it receives or collects, while meeting the individual and collective expectations of its customers. On the other hand, a small Internet service provider servicing commercial customers will be less concerned with maximizing the value of information it receives or collects, and more concerned with meeting the compliance obligations of its commercial customers. In contrast, large financial and medical institutions are faced with an array of statutory and regulatory guidelines mandating the handling of privacy issues. As such, these types of companies are concerned with maximizing the commercial value of the information they collect from their customers, while balancing the reasonable expectations of their customers in terms of how that information will be used, all while still meeting their regulatory requirements. Perhaps more important, I am a regular Internet user, often viewing privacy issues through the eyes of an ordinary consumer of services on the Internet. In this capacity, I am faced with the challenge of maximizing the utility and enjoyment of my Internet surfing experience, while dealing with various commercial entities trying to collect my personal information. Some of these entities are reputable financial institutions with clear privacy policies, so I am comfortable sharing private information with them. On the other hand, I have little information about many of these other entities and am concerned that my private information might be used in ways I would not approve. The balancing of interests between consumers and commercial enterprises with respect to the use of personal information is what lies at the heart of the debate over privacy issues. There is a very delicate equilibrium that needs to be maintained, and it is difficult, at best, to balance these competing interests.

217

Inside The Minds

Privacy Legislation – The Need for Harmonization We’ve all been there – the moment when we are about to make a purchase of one kind or another, when someone suggests we price the item online. As we find an even more reasonable price for the same item, we are tempted to fill in those small boxes on the checkout page with our credit card information and our mailing address. Yet something stops us. Some kind of gnawing feeling somewhere deep in our subconscious makes us pause as we wonder who exactly will have access to this personal information. Is saving a few dollars worth taking the chance that our information will be circulating somewhere out in cyberspace? In the wrong hands, the information certainly could wreak havoc on our finances. Maybe the use of this information would only be as detrimental as someone gaining access to our e-mail address and filling our mailbox with spam or other unwanted mail. Either way, there is a strong likelihood that we will face repercussions from having entered our personal information on the Internet. This thought causes me to carefully consider my available options before entering any information and, in some respects, takes the fun out of my Internet surfing. There is always a lingering trepidation, and I find the more I am exposed to privacy issues, the more I validate my fears about sharing my personal information. In an age where Internet use has risen so dramatically, government regulation and the courts have severely lagged behind the technology with regard to privacy issues. These and other issues are emerging at an alarming rate as the use of the Internet continues to spread to mainstream society from what was once the province of computer geeks with pocket protectors. Historically, privacy cases have always been subject to much debate. There is no basic right to privacy, as many would

218

Privacy Matters

believe. Rather, it is a right that is implied from the delineation of other specified rights. It is only from the entirety of the basic rights laid out by our forefathers that the courts have inferred an “implied right” to privacy. Privacy legislation, then, is actually a patchwork of rules and regulations, all of which are designed to prevent the misappropriation of private information. This patchwork of legislation includes threads of federal regulation, such as HIPAA (the Health Insurance Portability and Accountability Act of 1996), the USA Patriot Act, and the Gramm-Leach-Bliley Act, as well as state laws dealing with privacy issues and a myriad of other privacy-related concerns, such as identity theft. Adding to this intricate weave of government regulations are multiple overlapping jurisdictional levels, resulting in an overwhelming amount of sometimes confusing regulations. Different levels of government provide different standards on privacy issues. This issue of protection of one’s personal privacy needs to be addressed in a clear and concise manner by governmental authorities at all levels, and it is imperative that it be resolved by means of a universally applicable standard. I believe that in time there will be harmonization of the law of privacy at the local, regional, and federal levels, as well as the international level. This harmonization should greatly simplify the handling of many privacy issues. As with any regulation, clear procedures need to be laid down for businesses, and there must be a clear system set up for prosecuting wrongdoers. Consumers Versus Industry One obstacle that must be overcome before the protection of privacy can be resolved through legislation is the divergence between business and consumer privacy concerns. Bear in mind that privacy issues were often slippery and complex before the

219

Inside The Minds

rise of the Internet and have always been subject to vigorous debate. With the proliferation of the Internet came rising consumer fears regarding privacy issues. These fears have legitimately spread from Internet users to healthcare patients concerned that their medical information would be released into the wrong hands. On one hand, many legitimate businesses seek to collect personal information from their customers, and these businesses believe they are entitled to use the information they gather. Consider for a moment a consumer shopping on the Internet who is asked to enter demographic and personal information to complete a particular transaction. The retailer can then use this information to drum up more business by sending the customer additional solicitations based on this private information. This type of business practice has been used for many years with little objection. Businesses have traditionally kept lists of their customers or clients, and consumers have surrendered such information willingly and without objection. It becomes problematic, however, when this information is misappropriated or used for purposes outside the consumer’s expectations. On the other hand, consumers and consumer groups are trying to limit the use of this private information to the greatest extent possible. Their gripes are essentially that they enter private information for “limited” purposes, which is then used by a service provider without their permission for purposes they never contemplated. For instance, Internet users surfing through a chat room can unknowingly allow third parties access to their e-mail information, which can then trigger the receipt of spam. Many people are plagued with spam. It is annoying enough to receive unsolicited mail at our homes in our mailboxes. I need not remind anyone of the time-consuming daily chore of sifting through all the “junk” mail to sort out the important mail. Now we are subject to the same sort of intrusive overload in our e-mail accounts. Wireless users consume their bandwidth

220

Privacy Matters

downloading junk mail. Consumers view spam as a tremendous problem that is further complicated by the sensation that it is a problem they feel powerless to deal with. Adding to this confusion is the government’s approach to regulating privacy issues, which has been scattershot at best. The government is clearly regulating away – trying to implement measures designed to curtail consumer fears and to ensure proper prosecution of those accused of misappropriating information. Unfortunately, their efforts, while genuine in intention, are not well focused. This may be due in part to the discrepancy between what consumers perceive as the existing problem and what the government is seeking to remedy. For example, one government attempt to rectify issues concerning the privacy of financial information is the GrammLeach-Bliley Act, which requires financial institutions to send out annual privacy notices to consumers indicating the terms of their privacy policies. I have seen statistics that indicate a majority of consumers never read these privacy notices. My own wife simply tears them up when they arrive in our mailbox. They are typically written in language meant to comply with the terms of the statute, in boilerplate language that the average laymen finds wordy. The businesses that send out these notices are aware of these statistics; yet they continue to print and mail them, often at considerable expense, to comply with the statute. My own law firm is required to send out such notices despite that the lawyers in our firm are already subject to more stringent privacy obligations under state laws regulating attorneys. It is a relatively easy measure for the government to require these notifications. In doing so they are able to create the appearance that they are actively attempting to remedy some perceived privacy problem. But I am hard pressed to believe that this is what the consumer groups had in mind when they pressed for changes in the privacy arena. If I had to guess, I would say

221

Inside The Minds

that passage of this statute was considered, at best, a minor victory for consumer groups. From my readings and my own feelings on the matter, the problem is not with major financial institutions. That is not to say that at times these institutions do not cross an imaginary line with respect to safeguarding people’s information. Rather, the bigger problem lies with those scofflaws who refuse to comply with laws generally, not just privacy regulations. It is an unpleasant fact that there are, and always have been, bad people out there. What has changed is that in this new age of computers and advanced technology, these “bad” people can now wreak havoc from the comfort of their own living rooms, with very little real fear of being tracked down. Making the large financial institutions comply with notification regulations does little to bolster consumer confidence regarding their privacy matters, since relatively few consumers likely are concerned with their bank or financial institution being cast as “the leak.” I believe that as privacy issues continue to come into greater focus, and as privacy concerns move to the forefront of public debate, the government will stop going after the easy targets – those companies that will comply with government regulations because they are legitimate companies that value their customer relationships. It would be far more beneficial to the average Internet user if the government would instead pursue the abuser who maintains lower visibility, but causes much more damage. Privacy Advice for Companies These days, it is critical for companies to keep track of the latest privacy regulations and to implement an active compliance program to ensure compliance with these regulations. For financial institutions, the Patriot Act and the Gramm-LeachBliley might be the most important. For healthcare institutions,

222

Privacy Matters

HIPAA might be most important. Companies must be aware of the various privacy laws and regulations with which they must comply, and that they will eventually run into problems, either with consumers or consumer groups, government enforcement agencies, or class-action lawyers if they do not act in accordance with these laws and regulations. Further complicating the existing maze of legislation is the question of multiple jurisdictional concerns. It is imperative that companies bear these issues in mind. For example, consider a company doing business in Florida whose employees are required to make phone calls to Indiana. These employees are collecting information from their customers. The company must realize there are different laws in different states, and that these various out-of-state laws may well apply to them, despite that their employees never leave the beautiful sunny skies of Miami Beach. The telephone and Internet really do cross borders, and companies must understand the legal and regulatory ramifications of conducting business across those borders. Companies must focus on privacy issues. It is very important for companies to have privacy policies and terms of use on their Web sites, which provide clear, plain-English written guidance on how they intend to use the information they gather from their customers. They must then follow through with these stated intentions without deviating from them in any material respect. Businesses must begin to get away from standard boilerplate language, which they presumably know the average user does not read. They must also create incentives within the company to follow privacy procedures and make privacy a concern to all employees of the company. With respect to privacy policies, it is important that corporate procedures achieve the appropriate balance between what the company wants and what the customer wants. What information is really needed? How will this information be collected? How

223

Inside The Minds

will it ultimately be used? What safeguards can be put into place to ensure that it is stored safely? They must strike a balance and see to it that this balance is carefully monitored and maintained. Companies must also have employee handbooks to make sure all employees are aware of the company’s policies regarding the use of private information of customers, company e-mail, and company Internet accounts. The fact is that when an employee is using a company’s computers or e-mail system, the employee has very little in the way of privacy rights. Employees must be aware that if they are surfing the Internet on their employer’s equipment, their employer can, and is legally permitted to, track them. If they are sending personal e-mail on the company computer system, the company can read that e-mail. While this may sound like an invasion of their privacy, it has long been held that employers may monitor and regulate how their employees behave while on the job or using company equipment. Consider someone working in a dangerous occupation that leaves an e-mail trail implying that the person is a recreational drug user. If their employer gains access to this information, it certainly would be in the employer’s best interest to fire the person, and the law has been very clear that they are able to do so. “Wait!” shout the privacy activists. “How dare you fire me based on knowledge you obtained while snooping through my e-mails!” Despite such protests, nothing laid out here is contrary to anything that has not long been the established practice in this country, and adding that practice to e-mail and the Internet is a natural extension of existing law. Unfortunately, this is not common knowledge among employees. So it is very important for companies to have employee handbooks that clearly indicate how company equipment can be used, including computers, Internet, and e-mail. These policies need to be clearly written and communicated to all employees, kept up-to-date, and enforced.

224

Privacy Matters

A business that collects personal information and uses it in ways that may raise privacy concerns should have a chief privacy officer. The chief privacy officer should be the central figure in the organization responsible for handling privacy-related issues. This employee’s role should be to keep abreast of the various government regulations and state laws and to implement procedures within the company that are designed to deal with these regulations and laws. This person must be accountable for creating and maintaining privacy policies, as well as for dealing with privacy issues relating to consumers. The chief privacy officer must identify others within the organization who should also be aware of privacy issues and must create a team within the company that is responsible for handling privacy issues. Today, companies are also increasingly adding chief security officers, who are responsible for complying with government regulations and other best practices for dealing with security of computer systems. For companies that handle sensitive consumer information, it is probably a good idea to have a full-time executive-level employee on staff to deal with security issues. The policies and procedures implemented by companies in dealing with privacy issues demonstrate the great monetary outlay involved in complying with privacy-related government regulations. Companies are paying a lot of money to deal with privacy and security issues, and it is not entirely clear whether consumers are getting an adequate bang for their buck. Common Misconceptions Regarding Privacy Consumers must be aware that when they are surfing the Internet, information about them is being collected. People often think that when they are surfing the Internet, they have a degree of anonymity. It is clear, however, that many companies track the movement of consumers, with or without their knowledge. For example, companies that want to track the movement of, or

225

Inside The Minds

collect information on, their customers can place a cookie on their customers’ computers to store customer movement information, or they may use other types of tracking software (sometimes called spyware). These devices act as roadmaps to delineate the information and Web sites their customers have viewed. I am not sure that this tracking is necessarily a bad thing, if done for legitimate purposes by legitimate companies. People must be made aware that information about them is being collected, whether or not they even realize their movements are being tracked. Consumers also must realize there is no certainty as to whether the information they give out to third parties on the Internet is being shared. Many reputable companies share information with their affiliates and their third-party service providers. Even my children’s school has been known to share its parent body list for commercial use by third parties. If you go into chat rooms, information is collected about you that can be shared for good or bad purposes. The fact is you never know if the information you put out there is being shared with third parties. Even more troubling is that you do not know who those third parties may be. Additionally, there is no way of knowing definitively how that information will be used. In the simplest example, your e-mail address may be collected and used to send mass solicitations for various purposes. On one hand, your e-mail address may be used for targeted e-mail from legitimate companies that know you are interested in a particular field. On the other hand, you may receive mass unsolicited e-mail for products or services in which you have no interest, or may even find offensive, such as sex sites and prescription drugs. There are also more extreme cases where information is used for identity theft, or where people are injured or killed because personal information about them is being made available on the Internet. It is important for consumers to be well-educated and cautious and to always

226

Privacy Matters

investigate the purposes for which collected information will be used. Often when an Internet consumer is damaged by misuse of private information, there will be no recourse – not unlike the damage caused by boiler room penny-stock operations. We have all heard of people whose Social Security numbers were somehow obtained in a fraudulent manner and the chaos that resulted. Imagine, if you will, the devastation that could ensue from having the essence of your being reduced to a few digits that are accessible to anyone with the knowledge and skill to hack into your records. This may be as innocent as an 18-yearold computer whiz playing a prank, or as complex as a bona-fide scam artist who chooses to manipulate your identity for his own agenda. If your identity has been stolen, often the best thing you can do is to try to correct the problem and clean up what may be a very bad situation. There also may be instances where legitimate companies misuse consumer information. In those cases, there may be some redress in the form of lawsuits and government actions against companies that have violated their own privacy policies or existing privacy laws or regulations. I remember one of the characters on the TV show, Hill Street Blues, would end each roll call with, “Let’s be careful out there.” I think this is the best advice for consumers with respect to the Internet. We need to better educate the public to have them understand with whom they are dealing, what information is being collected, and how this information may ultimately be used. There will always be companies that do not abide by their own privacy policies, but people must keep their eyes open and exercise common sense. Read the privacy policies. Don’t freely give out personal information about yourself. Be cautious when downloading software to be sure it does not include spyware. As long as consumers are well-educated and careful, they can protect their personal information. The moment the screen comes up asking for a credit card number is the time to click over to the

227

Inside The Minds

link that explains who the company is, their privacy policy, and their terms of use. A year ago, I personally might not have done that, but these days I do. The more you learn in this arena, the more cautious you will ultimately become. Each customer has a different personal comfort level. If a particular Internet vendor does not meet that comfort level, the customer should understand there are usually alternatives. They can and should go somewhere else. One good thing about the Internet is that there are always at least two vendors. It is not unlike the traditional marketplace in this country. Continued competition does in fact prove to build a better mousetrap. In cyberspace too, there is much in the way of a competitive marketplace, and this competition should ultimately ensure an arena that frowns upon the misuse of personal information. Privacy: Past, Present, and Future It is important to recognize that privacy is not a new issue, and the concept of commercial enterprises collecting personal information on their customers also is not new. For example, 15 years ago, if you ordered a product or service from a reputable mail-order company, that company collected personal information on you. It may even have commercially exploited that information, such as by selling customer lists. Yet, at that time, consumers were much less concerned about their privacy, despite that sensitive information was being collected. The difference is that a technological revolution has taken place. The Internet simply makes it easier and much less expensive for companies to exploit the information they collect. When companies incur printing and postage costs in making unsolicited mailings, they have an economic interest in carefully targeting their marketing. With the Internet, however, there are almost no transaction costs for a company to send unsolicited e-mails. In making it easier and less expensive to market over the Internet, it

228

Privacy Matters

has begun to occur far more frequently. Also, because customers enter information electronically, the information is much easier to compile and to “mine,” by identifying specific information of interest, such as customers in certain age groups or demographics. Clearly, consumers have always given out private information, which was shared and sold commercially, but the use of that information did not pose as great as a problem to society as it does today. Privacy law now seems to be in its adolescent stage, grappling with and trying to adapt to rapid changes in technology. On the regulatory side, the government is trying to balance the conflicting desires of consumers on one hand, who want to maximize the protection available for private information, with the desires of commercial enterprises on the other hand, who want to derive maximum commercial value from private information. In time, these issues will begin to resolve themselves, and the law will become more settled. I believe that personal information will be better protected in the future than it is today. Privacy law is actually going through a change that is similar to the changes that have occurred in trademark law over the past five years. When Internet use first became widespread, we all remember hearing instances of cybersquatting, in which the domain names similar or identical to famous brand names were misappropriated. Over the course of time, new statutes and dispute resolution mechanisms were implemented that addressed this problem, largely ending the problem of cybersquatting. Despite that government regulation of privacy issues has to date been scattershot, I am confident that new statutes and regulations dealing with privacy issues will eventually be implemented that will catch up with the rapid advances in technology that have taken the area of privacy law by surprise.

229

Inside The Minds

In addition to these changes, consumers are becoming better educated and have begun to take evasive maneuvers to protect their own privacy. For example, many people are now using spam filters, which minimize, but do not eliminate, the effects of unsolicited e-mail. Other users are adopting multiple e-mail addresses, including addresses that are made available only to other people and companies who are trusted not to send spam. Users who have been affected by, or wish to avoid, violations of their privacy, now read privacy policies more closely and will deal only with organizations that use their personal information in ways in which they feel comfortable. Consumers are beginning to pay greater attention to privacy issues and are developing their own views on the appropriate use of their personal information. This shift will naturally evolve into a greater comfort level over time. Significant technological changes also may affect how privacy issues are viewed and handled. For example, the emerging P3P standard is an industry standard that provides a simple, automated way for users to gain a certain degree of control over the use of personal information on Web sites they visit. P3P provides a standardized set of multiple-choice questions covering many aspects of a Web site’s privacy policies. P3Penabled Web sites make the site’s privacy information available in a standard format, so P3P-enabled browsers can compare the Web site’s privacy policy to the consumer’s set of privacy preferences. As a result, consumers will be in a better position to release personal information only to companies that have privacy policies consistent with the user’s desired level of comfort. Finally, companies that collect information also are likely to make changes to assuage the fears of their customers. After all, many legitimate enterprises collect information from their customers. It would be beneficial to these companies to retain their customers by keeping them comfortable. To achieve this end, they will probably assure their customers that all

230

Privacy Matters

information being collected will be used only in ways approved by the customer. In other words, maintaining adequate privacy procedures will become a good business practice. There will, however, always be bad actors and illegitimate companies that prey on the unsuspecting. They will misuse private information to the detriment of consumers regardless of technological improvements and government regulation. Hopefully, through governmental regulation and enforcement proceedings, the damage to a person’s privacy caused by such bad actors can be minimized. I believe legislative harmonization will ultimately settle some of the competing issues between consumers and businesses, and between conflicting governmental authorities. For example, providing a global (or at least national) consensus on whether the use of information by companies should be on an opt-in or optout basis would certainly prove helpful. If there were more uniform agreement on many privacy-related issues, people would feel more comfortable using the Internet. Allowing people to feel that they have a sense of control would allay many fears. Like the issue of cybersquatting, I believe most privacy issues will be settled over time, and an appropriate balance will be reached between businesses and consumers. In time, the laws will be harmonized; consumers will become better educated and will understand their own comfort levels; and businesses will become more careful with the private information of, and establish better privacy-related communication with, their customers. I look forward to this time, as I will then be able to become less paranoid with respect to these issues. I am mindful, however, that just because you are paranoid, does not mean that people are not out to get you. So, to some degree, I think it will always be important to bear in mind the Hill Street Blues admonition, “Let’s be careful out there.”

231

Inside The Minds

David M. Klein is a partner in the Intellectual Property Group at Shearman & Sterling and leads the Group’s transactional practice. Mr. Klein’s practice encompasses patent, copyright, trademark, Internet, e-commerce, and trade secret law, with an emphasis on licensing, outsourcing, corporate transactional matters, strategic counseling, and patent and trademark prosecution in the fields of Internet, e-commerce, financial services, computer hardware and software, electronics, and medical devices. He is an expert on licensing and transactional matters related to the Internet and e-commerce. Mr. Klein received a degree in electrical engineering from The Cooper Union for the Advancement of Science and Art in 1986, and received his law degree from New York University School of Law in 1992. Before attending law school, Mr. Klein worked as an avionics systems engineer on the B-2 bomber program developing automatic target recognition systems. Mr. Klein’s recent clients include Merrill Lynch, Citigroup, Salomon Smith Barney, The Thomson Corporation, Cadbury Schweppes PLC, and Morgan Stanley & Co. Mr. Klein is admitted to the New York and Connecticut bars and is registered to practice before the U.S. Patent & Trademark Office. Mr. Klein has drafted and is awaiting publication of a book about the handling of intellectual property issues in M&A transactions tentatively titled Intellectual Property in Mergers & Acquisitions.

232

Privacy Matters

MAINTAINING THE PRIVACY OF INFORMATION NEEDED TO DEVELOP NEW BIOMEDICAL TECHNOLOGIES

GREGORY J. GLOVER, M.D., J.D. Ropes & Gray Partner

233

Inside The Minds

Advances in Medical Research Over the past few decades, biomedical researchers have made substantial strides that produced a revolution in scientific and medical knowledge. We are now moving into a stage where information has become an important driving force for how far and how quickly we can continue to progress. The increasing need for patient-specific information raises particular concerns about patient privacy. Our challenge is to ensure that we secure patient privacy while continuing to gather the information needed to achieve the kinds of advances we have made over the past 40 or 50 years. The dramatic increase in knowledge over the past decades is largely the result of the investments the country made in the 1940s and 1950s to further biomedical research generally, and in the 1960s to fight cancer. In the 1950s and 1960s, the government increased funding to academic and private research institutes, and that funding continued into the 1970s and 1980s. We began to see the fruits of that investment in the 1990s, and those benefits are continuing into the new millennium. We now have a substantially more sophisticated understanding of various diseases, and as a result of biomedical research and development, many more treatments are available to address diseases that were responsible for many deaths and illnesses in the past. The development of the biotechnology industry in the 1980s added yet another aspect of the advancement in biomedical research that has occurred in the past decades. As research and development continues, we are moving toward very sophisticated treatments for much more subtle and complex diseases. The kinds of treatments researchers are working on with respect to individualized patient treatments are quite exciting because they suggest that some techniques that may have failed in the past in large populations can actually work for

234

Privacy Matters

some individuals. For example, we know that the development of certain types of breast cancer depends on whether there are one or more genes (which can be detected) and whether there are certain kinds of receptors on the surfaces of the breast cancer cells. As we become more sophisticated, we will find many more ways to distinguish diseases that will help us to treat patients more effectively. As we learn more about the genetic makeup of humans, we are understanding better why certain humans react to certain drugs more than they do to other drugs. This realization has facilitated a push toward individualized medicine. Through individualized medicine, we can actually create treatments designed to target a patient’s specific type of cancer cells, for example. These trends toward individualized medicine are very important in that they will improve public health and scientific knowledge. Thanks to information we are gathering, for example, from the Human Genome Project, we now know some important information about the entire human genome. We also know more about single nucleotide polymorphisms (SNPs), single base-pair variations in DNA that distinguish one individual from another, and may very well affect whether one individual responds to a certain treatment as opposed to another. Tandem nucleotide repeats (small DNA sequences that are repeated) are also useful in identifying related individuals and might contain other useful genetic information. In pursuing these approaches to modern pharmaceutical and biomedical research and development, there is a concurrent recognition of the value of having additional data resources containing patient-specific information. Access to patient populations that carry certain diseases, for example, is useful in developing both treatments and diagnostic tests. Access to patient information that may have been collected over a large number of years in various teaching hospitals, research institutes,

235

Inside The Minds

and other health manufacturers is also very valuable. Often such information includes individual sample data that had been saved some time ago, but have only now become useful because of new scientific techniques that rely on such data. By relying on such sample data, we can use information from the past and make new and improved treatments and diagnostic tests for the future. Fortunately, we have additional tools to help us effectively use this information, including data-mining techniques and algorithms for the detection of hidden patterns in data sets, that include, for example, the selective expression of clinical data from individuals who show the symptoms of a specific disease. These techniques can be applied to analyze and manage this information. The need for patient-specific data increases the importance of the interaction of healthcare service providers with biomedical research and development. These centers provide not only clinical expertise and continuing clinical training for physicians, but also a specialized patient population and database of clinical information. These specialized databases are essential for the development of new tests and cures. Medical specialties and specialized medical centers lead to the creation of information from unique and rare patient populations. A challenge for hospitals and other care providers is to find ways to manage access to these data and their use. Privacy Issues in Medical Research A tension exists as we try to balance privacy concerns and the benefits of using and sharing information about individual patients. In the medical field, there will often be a need to rely on patient data in pursuing biomedical advancements. The need to

236

Privacy Matters

rely on patient data will often be in tension with the need to continue to maintain patient privacy. Useful patient population data have patient-identifiable information attached to them. In many cases, to develop a diagnostic test or treatment, it is necessary to know as much about the patient as possible, including information that would, under many rules, be considered patient-identifiable data, even if they did not include the patient’s name. So access to the resources needed to further biomedical research and development raises numerous privacy protection issues. Many provisions are already in place to protect patient privacy. Among them is the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, which applies to research funded by several federal agencies. Similar rules apply to any research, whether it is federally funded or not, if that research is intended to be submitted to the Food and Drug Administration (FDA) for product approval, labeling changes, or other determinations. Other federal statutes address the privacy of records for living persons who are treated in federal facilities, as well as living or dead persons who are treated for certain diseases, such as sickle-cell anemia, HIV, and alcohol or drug abuse. There are also state provisions that offer some degree of protection; however, these provisions vary from state to state across the country. New protections relevant to the issue of patient privacy and biomedical research and development now exist under the Health Insurance Portability and Accountability Act of 1996, known as HIPAA. This act relates to the privacy of patient data and provides a uniform electronic transaction format to allow data to be easily shared among healthcare providers. It also mandates the security of individually identifiable health information. That is, there must be procedures in place to make sure patient-

237

Inside The Minds

identifiable data are protected. HIPAA has multiple requirements and detailed regulations that have been finalized recently. There is a recognized concern that these hefty regulations under HIPAA will stifle biomedical research and development. A complex set of authorization and notification requirements may hinder biomedical research by restricting or simply chilling the use and disclosure of protected health information and by limiting retention of research and data. This could impair a research center’s ability to conduct clinical trials, as well as epidemiological and outcome studies. Moreover, this could significantly affect genetic research. In addition, the HIPAA standard for de-identification of medical information could result in data’s being made substantially useless for research and development purposes. Developing treatments for small patient populations or for niche diseases requires knowing as much about the patient as possible. There may be medical or clinical differences among patients based on factors such as age, national origin, ethnicity, or other concurrent diseases they may have. However, if that information is provided in sufficient detail, it might be considered patient-identifiable information, and therefore its disclosure might violate HIPAA rules. Similarly, with respect to disclosure of health information for research, the minimum necessary standard for data disclosure may create circumstances in which data that are disclosed are not useful. The privacy rule under HIPAA generally requires covered entities to take reasonable steps to limit the use or disclosure of protected health information to the minimum necessary to accomplish the intended purpose. However, the disclosure of the minimum data necessary by the healthcare provider might not provide enough information. This issue could probably be managed over time, but in the short term may very well slow down valuable research and development.

238

Privacy Matters

Hospitals, health plans, and providers may also determine that the risk associated with liability for noncompliance with HIPAA would not justify their participation in biomedical research and development. Of course, if that were to occur, it would have a substantial negative impact on the ability of companies to move forward with developments, and it would harm consumers because those innovations would take longer to become available, if they were to be achieved at all. Fortunately, there are ways to resolve these tensions by allowing research and development to continue in a productive, as well as responsible, manner. For example, proposals have been made to rationalize and address redundancies in authorization and notification obligations and procedures. Proposals have also been made to set more workable de-identification standards, removing obvious information such as names, addresses, phone numbers, and Social Security numbers, but leaving the information necessary to distinguish one patient’s susceptibility to a disease from another’s. In fact, the Department of Health and Human Services published amendments to the HIPPA rules in early August 2002 that address a number of these potential concerns. Among other adjustments, these new rules streamline authorization requirements for research and allow for disclosure (subject to protective data use agreements) of limited patient data that do not include direct, patient-identifiable information. Further, the HIPPA regulations can be expected to evolve over time as experience informs regulatory judgments. There will likely be ongoing, periodic efforts to amend the HIPPA regulations, to make such adjustments.

239

Inside The Minds

Privacy Issues Facing Research Companies At least part of my sensitivity to some of the privacy issues arises from being a licensed physician. Having been to medical school and in an internship program, I recognize that physicians have access to immensely private information – information that patients often do not even share with their spouses or families. It is essential to recognize that by virtue of having that information, one also has the responsibility to take extreme care of that information. Companies and research institutions may need help in complying with regulations or in working around sensitive issues in a way that allows them to protect patient privacy but still move forward with their research and development programs. Every company that does biomedical research and development should be aware that where any patient-specific information – that is, a sample of tissue, a sample of blood, a sample of serum, or data in a patient’s medical history – is required, they need to be concerned about how to protect the information they access. When conducting clinical trials on a product, a company needs to be concerned about the protection of patient-identifiable information. Then, as it looks into the marketplace to track its products, future product developments, or patients who have been treated in the marketplace with its drug or its product, it should make sure provisions are in place to ensure that such information is protected. An important part of this effort is the development and effective implementation of compliance programs, so that companies do not make inadvertent disclosures of information about their employees, participants in clinical trials, or users of their products, to unauthorized third parties. In short, these programs help them maintain compliance with the relevant regulations and laws that are in place. Not only must they establish standard operating procedures, but they also need to train the management

240

Privacy Matters

and staff to understand where they may have access to confidential information, when they might inadvertently disclose it, and how to alter their behavior so that they do not do so. For example, in a hospital setting, where there is a substantial amount of private health-related information, one must be concerned about conversations that occur, for example, in the elevator or in the hallway. Even what is said about patients when presenting them in rounds could, in theory, have privacy implications. Similarly, businesses must train their employees to view the private information they have as if it were personal information about themselves that they would not want to have disclosed to the public. These practices will help employees internalize a basic set of principles to guide appropriate accessing and protecting of data. Privacy Issues Facing Individuals Individuals need to be aware of several issues relating to the privacy of their healthcare information. First, they need to recognize where and when they are consenting to the disclosure of information, such as in consent forms they sign when they register at a hospital. Second, they need to recognize that even outside the healthcare setting, there are patient privacy issues to consider. For example, when they fill out various forms for insurance purposes or permission forms for their children, people need to understand they are providing what is otherwise private information to another party. If possible, they might want to ask certain questions about the need for the information, how it might be used, and with whom it could be shared.

241

Inside The Minds

Third, they need to appreciate the importance of the availability of patient data to enable biomedical research and development advances now and in the future. People should recognize how important the sharing of this information is, not only to ensure their diseases are diagnosed and treated effectively, but also to make possible medical advances and develop new treatments and cures for the future. Merely increasing people’s awareness of all the types of organizations, including hospitals and research institutions, that maintain sensitive information and why they do so, may be quite helpful. This will allow people to be more informed about the appropriateness and management of information disclosed to these institutions. It is important to be a well-informed consumer, and for those who have a particular interest in privacy issues, trade associations and not-for-profit organizations spend a substantial amount of time following these issues and reporting on them. Interested consumers can contact organizations that track developments in the privacy arena, at both federal and state levels. The Future of Privacy As a result of increasing concerns about terrorism, it has become even more obvious that the need to obtain information about people and their activities can mean a loss of privacy. We will sacrifice certain privacy protections, at least in the short term, in exchange for the comfort associated with additional security or other significant benefits. However, it is not clear how long we will be willing to tolerate these sacrifices. As with any policy, the pendulum is likely to swing too far in the other direction. In the long run, there may very well be a public outcry that says we need to go back to protecting privacy rights as we have done historically.

242

Privacy Matters

In the next five to 10 years, we will find that, in medicine and in other fields, technology is likely to advance faster than our ability to draft effective laws to protect personal privacy. It is likely that people will become accustomed to – though not necessarily comfortable with – having information revealed that we thought was private in the past. For example, as we gain an understanding of the types of information people can find on the Internet, we have changed our expectation of privacy. These changes in expectations will likely continue for the foreseeable future. To say that we should not pursue medical and scientific advancement because there may be a “slippery slope” does not seem to be a compelling argument. To the extent that we know that advancement of medical science may have a substantial impact on patient privacy, we need to make sure we put rules in place to deal effectively with those issues. Avoiding the development of innovations on the grounds of privacy issues may be extremely shortsighted and negligent. The potential of a particular technology, let alone medical science in general, to help society compels us toward progress in biomedical research. Remarkable opportunities exist to use our knowledge of ourselves to help find and apply new, more effective ways to protect and heal ourselves. If we progress thoughtfully and responsibly, we can continue to protect our privacy as we enhance our health. Gregory J. Glover, MD, JD, a partner in the Washington, D.C., office of Ropes & Gray, is a licensed physician and registered patent attorney with experience in food and drug law, intellectual property law, and technology licensing. His practice focuses on providing advice to biomedical technology companies and trade associations on the strategic interaction of Food and Drug Administration (FDA) regulations, intellectual property law, and technology licensing. Dr. Glover represents the

243

Inside The Minds

research-based pharmaceutical trade association on market exclusivity strategies and domestic intellectual property issues. He has particular expertise in the patent and non-patent market exclusivity provisions of the Drug Price Competition and Patent Term Restoration Act of 1984 (the Hatch-Waxman Act). Dr. Glover has represented and advised established and development-stage pharmaceutical and medical device manufacturers and distributors in a wide range of matters, biomedical technology companies and trade associations on strategic intellectual property issues, and established and development-stage biomedical technology companies and trade associations on a range of technology licensing matters. Dr. Glover is a frequent speaker at professional and academic conferences around the country, including conferences and meetings of the Food and Drug Law Institute, the Biotechnology Industry Organization, the Licensing Executives Society, the Berkeley Center for Law and Technology, the ABA Section of International Law and Practice, the American Intellectual Property Law Association, and the Boston Bar Association. He has also published articles on such topics as the market exclusivity implications of patent and non-patent market exclusivity and the effect of the patent infringement exemption (35 U.S.C.) on biotechnology products. Serving as a lecturer at the University of California School of Law (Boalt Hall), Dr. Glover teaches a course entitled “Exclusive Rights in the Biotechnology and Pharmaceutical Industries.” He previously served as an adjunct professor at Georgetown University Law Center, where he taught a course entitled “Innovation in Biomedical Technology.” He also serves as an ABA-appointed member of the National Conference of Lawyers and Scientists, a joint Committee of the American Association for the Advancement of Science, and the American Bar Association.

244

Privacy Matters

Dr. Glover received a BA, magna cum laude, in biochemical sciences from Harvard College in 1981 and a JD, cum laude, from Harvard Law School in 1986. Following law school, he completed medical school at Duke University in 1987, and served as an intern in internal medicine at New England Deaconess Hospital in Boston.

245

Give Us 5 Minutes, We’ll Give You An Edge Spend 5 minutes on the phone with one of our Business Editors and we can guarantee we will identify a way to give you or your company an edge, or find a more time efficient way to help you stay ahead of the curve on any business topic. For more information and ideas on how we can help you stay ahead of the curve, please call an Aspatore Business Editor at 1-866-Aspatore.

Call 1-866-Aspatore

To Order or For Customized Suggestions From an Aspatore Business Editor, Please Call 1-866-Aspatore (277-2867) Or Visit www.Aspatore.com

Business Intelligence Publications & Services The C-Level Library Empower yourself and your company with an expansive web-based library featuring hundreds of books, briefs and articles - all available in multiple formats written by C-Level executives, and published by Aspatore. Available exclusively from Aspatore, The C-Level Library is the largest of its kind, and featuring the most extensive collection of C-Level content in the world, it is the ultimate reference tool. Such a resource enables you and your team to speak intelligently with anyone from any industry, on any topic. Every year, Aspatore publishes C-Level executives from over half the Global 500, the fastest-growing 250 private companies, MP/Chairs from over half the 250 largest law firms and consulting firms, and leading executives representing nearly every industry. Content is updated weekly and available for use in various formats - as-is online, printed, copied and pasted into a PDA, and even emailed directly to you. Another benefit of subscribing to The CLevel Library is access to an Aspatore Business Editor dedicated to your company, who can serve as an extension of your staff and help your team with any research needs. Drawing from all content within The C-Level Library, as well as the collected works of 30,000 other publications, including the products of every major business book, magazine, newspaper, journal, web and other publisher in the world, your Business Editor will deliver specialized services such as ExecEnablersTM packets of information to get up to speed for new deals, clients, projects, hires, and can even provide 24-hour deal research assistance. The C-Level Library enables you and your team to quickly get up to speed on a topic, understand key issues driving an industry, identify new ideas for business opportunities, and profit from the knowledge of the world’s leading executives. Titles in One Industry Only i) Electronic access to publications in one specialty area (Select from: Technology, Legal, Entrepreneurial/Venture Capital, Marketing/Advertising/PR, Management/ Consulting, Health, Reference) (Via Password Protected Web Site) Individual Pricing - $99 a month (1 Year Minimum) Corporate Pricing - $499 a month (1 Year Minimum), $399 a month (2 Years Minimum), $249 a month (5 Year Minimum), Price includes up to 20 user seats (individuals that can access the site, both employees and customers), Each additional seat is $25 a month

Access to All Titles

ii) Electronic access to receive every publication published by Aspatore a year. Approximately 60-70 books a year and hundreds of other publications Individual Pricing - $149 a month (1 Year Minimum) Corporate Pricing - $999 a month (1 Year Minimum), $899 a month (2 Years Minimum), $699 a month (5 Year Minimum), Price includes up to 20 user seats (individuals that can access the site, both employees and customers), Each additional seat is $35 a month

Access to All Titles With Additional Navigation

iii) Same as ii, however all publications are arranged by different divisions of your company, each with its own web site. Upon order, you will receive an email from our editors about setting up a time to discuss navigation for your business. Corporate Pricing - $1999 a month (1 Year Minimum), $1799 a month (2 Years Minimum), $1399 a month (5 Year Minimum), Price includes up to 20 overall user seats and up to 10 different web sites, Each additional seat is $45 a month

To Order or For Customized Suggestions From an Aspatore Business Editor, Please Call 1-866-Aspatore (277-2867) Or Visit www.Aspatore.com

The Focusbook TM – Your Customized Book In Print Receive a custom book based on your Business Intelligence Profile, with content from all new books, essays and other publications by Aspatore from the quarter that fits your area of specialty. The content is from over 100 publications (books, essays, journals, briefs) on various industries, positions, and topics, available to you months before the general public. Each custom book ranges between 180-280. Up to 50 pages of text can be added in each book, enabling you to further customize the book for particular practice groups, teams, new hires or even clients. Put your company name on the front cover and give your books a title, if you like. For Individuals $129 One Time, $99 a Quarter (1 Year Minimum) (Includes 1 Book a Quarter) For Corporations and Multiple Books, Please call 1-866-Aspatore (277-2867) or Visit www.Aspatore.com for pricing

ExecEnablers TM – Get up to Speed Fast! ExecEnablers help you determine what to read so that you can get up to speed on a new topic fast, with the right books, magazines, web sites, and other publications (from over 30,000 business publishing sources). The 2-step process involves an approximately 30 minute phone call and then a report written by Aspatore Business Editors and mailed (or emailed) to you the following day (rush/same day options available-please call 1-866Aspatore). Only $49 Perfect for new projects, deals, clients…

Aspatore C-Level Research TM Aspatore Business Editors are available to help individuals, companies, and professionals in any industry perform research on a given topic on either a one-time or a consistent monthly basis. Aspatore Business Editors, with their deep industry expertise at getting access to the right information across every medium, can serve as an external librarian/researcher for all your research needs. Aspatore Business Editors can conduct in depth research and prepare a detailed report on any topic of interest (same day turnaround available). For more information, please call us at 1-866-Aspatore.

Establish Your Own Business/Reference Library TM Work with Aspatore editors to identify 50-5,000 individual books from all publishers, and purchase them at special rates for a corporate or personal library. Employ Aspatore as an external librarian for all your research needs. For more information, please email [email protected] or call us at 1-866-Aspatore.

PIA (Personal Intelligence Agent) TM – Custom Reading Lists PIA Reports provide you, your company, or a division/group within it, with information on exactly where to find additional business intelligence from newly published books, articles, speeches, journals, magazines, web sites and over 30,000 other business intelligence sources (from every major business publisher in the world) that match your

To Order or For Customized Suggestions From an Aspatore Business Editor, Please Call 1-866-Aspatore (277-2867) Or Visit www.Aspatore.com

areas of interest. Each 8-10 page report features sections on the most important new books, articles, and speeches to read, descriptions of each, approximate reading times/ page counts, and information on the author and publication sources, so you can decide what you should read and how to spend your time most efficiently. Please call 1-866Aspatore to speak with an Aspatore Business Editor to identify your areas of interest so the PIA Report can be customized specifically to your areas of interest. For Individuals, $99 a Year for 4 Quarterly Reports, Copies Not Permitted For 1 Report For Entire Company, $499 a Year for 4 Quarterly Reports, Copies Permitted (Reports arrive within two weeks of start of each quarter.) For Multiple Reports For Same Company, Please call 1-866-Aspatore (277-2867)

The C-Level Review TM The C-Level Review is an essay based review that helps you maximize your strengths as a professional through the personal recommendations of leading CLevel executives (CEOs, CFOs, CTOs, CMOs, Partners, Lawyers (Chairs and MPs). Perfect for professionals of all levels and in all industries, the review takes one to three hours to complete, and you remain anonymous to the panel members, each of whom reviews your answers and provides a critical analysis of areas where you should focus your career efforts. Your results are compiled in a 10-20 page report, with separate reviews written by three C-level executives. The C-Level Review Panel, a highly prestigious group of authors published by Aspatore, includes CLevel executives from some of the world's largest and most respected companies. As they review your essay answers, they will identify ways to help you enhance your strengths, eliminate your weaknesses, and pinpoint where to focus your talents. Anonymous to both sides, the C-Level Review is an exceptional opportunity for professionals of all levels to get personalized, insider career guidance and recommendations from the world's most respected executives. Only $499-Books are mailed within 3 days of purchase and can be completed in print-right in the book- or electronic format-in email or in Microsoft Word. Once the test is completed and mailed back to Aspatore, please allow 4-6 weeks for review to be mailed back.) Separate tests are available for management, consulting, technology, law, marketing, advertising, public relations, and entrepreneurship.

License Content Published by Aspatore For information on licensing content published by Aspatore for a web site, corporate intranet, extranet, newsletter, direct mail, book or in another format, please email [email protected].

Bulk Orders of Books & Chapter Excerpts For information on bulk purchases of books or chapter excerpts (specific chapters within a book, bound as their own mini-book) or to develop your own book based on any content published by Aspatore, please email [email protected]. For orders over 100 books or chapter excerpts, company logos and additional text can be added to the book. Use for sales and marketing, direct mail and trade show work.

To Order or For Customized Suggestions From an Aspatore Business Editor, Please Call 1-866-Aspatore (277-2867) Or Visit www.Aspatore.com

Best Selling Books (Also Available Individually At Your Local Bookstore)

REFERENCE Business Travel Bible (BTB) – Must Have Information for Business Travelers Business Grammar, Style & Usage – Rules for Articulate and Polished Business Writing and Speaking ExecRecs – Executive Recommendations For The Best Products, Services & Intelligence Executives Use to Excel The C-Level Test – Business IQ & Personality Test for Professionals of All Levels The Business Translator-Business Words, Phrases & Customs in Over 90 Languages

MANAGEMENT/CONSULTING Leading CEOs – CEOs Reveal the Secrets to Leadership & Profiting in Any Economy Leading Consultants – Industry Leaders Share Their Knowledge on the Art of Consulting Recession Profiteers – How to Profit in a Recession & Wipe Out the Competition Managing & Profiting in a Down Economy – Leading CEOs Reveal the Secrets to Increased Profits and Success in a Turbulent Economy Leading Women – What It Takes to Succeed & Have It All in the 21st Century Become a CEO – The Golden Rules to Rising the Ranks of Leadership Leading Deal Makers – Leveraging Your Position and the Art of Deal Making The Art of Deal Making – The Secrets to the Deal Making Process Empower Profits – The Secrets to Cutting Costs & Making Money in ANY Economy Building an Empire – The 10 Most Important Concepts to Focus a Business on the Way to Dominating the Business World Management Consulting Brainstormers – Question Blocks & Idea Worksheets

TECHNOLOGY Leading CTOs – The Secrets to the Art, Science & Future of Technology Software Product Management – Managing Software Development from Idea to Development to Marketing to Sales The Telecommunications Industry – Leading CEOs Share Their Knowledge on The Future of the Telecommunications Industry Know What the CTO Knows – The Tricks of the Trade and Ways for Anyone to Understand the Language of the Techies Web 2.0 AC (After Crash) – The Resurgence of the Internet and Technology Economy The Semiconductor Industry – Leading CEOs Share Their Knowledge on the Future of Semiconductors Techie Talk – The Tricks of the Trade and Ways to Develop, Implement and Capitalize on the Best Technologies in the World Technology Brainstormers – Question Blocks & Idea Development Worksheets

VENTURE CAPITAL/ENTREPRENEURIAL Term Sheets & Valuations – A Detailed Look at the Intricacies of Term Sheets & Valuations Deal Terms – The Finer Points of Deal Structures, Valuations, Term Sheets, Stock Options and Getting Deals Done Leading Deal Makers – Leveraging Your Position and the Art of Deal Making The Art of Deal Making – The Secrets to the Deal Making Process Hunting Venture Capital – Understanding the VC Process and Capturing an Investment The Golden Rules of Venture Capitalists – Valuing Companies, Identifying Opportunities, Detecting Trends, Term Sheets and Valuations

To Order or For Customized Suggestions From an Aspatore Business Editor, Please Call 1-866-Aspatore (277-2867) Or Visit www.Aspatore.com

Entrepreneurial Momentum – Gaining Traction for Businesses of All Sizes to Take the Step to the Next Level The Entrepreneurial Problem Solver – Entrepreneurial Strategies for Identifying Opportunities in the Marketplace Entrepreneurial Brainstormers – Question Blocks & Idea Development Worksheets

LEGAL Privacy Matters – Leading Privacy Visionaries Share Their Knowledge on How Privacy on the Internet Will Affect Everyone Leading Lawyers – Leading Managing Partners Reveal the Secrets to Professional and Personal Success as a Lawyer The Innovative Lawyer – Leading Lawyers Share Their Knowledge on Using Innovation to Gain an Edge Leading Labor Lawyers – Labor Chairs Reveal the Secrets to the Art & Science of Labor Law Leading Litigators – Litigation Chairs Revel the Secrets to the Art & Science of Litigation Leading IP Lawyers – IP Chairs Reveal the Secrets to the Art & Science of IP Law Leading Patent Lawyers – The & Science of Patent Law Leading Deal Makers – Leveraging Your Position and the Art of Deal Making Legal Brainstormers – Question Blocks & Idea Development Worksheets

FINANCIAL Textbook Finance – The Fundamentals We Should All Know (And Remember) About Finance Know What the CFO Knows – Leading CFOs Reveal What the Rest of Us Should Know About the Financial Side of Companies Leading Accountants – The Golden Rules of Accounting & the Future of the Accounting Industry and Profession Leading Investment Bankers – Leading I-Bankers Reveal the Secrets to the Art & Science of Investment Banking The Financial Services Industry – The Future of the Financial Services Industry & Professions Empower Profits – The Secrets to Cutting Costs & Making Money in ANY Economy

MARKETING/ADVERTISING/PR Leading Marketers – Leading Chief Marketing Officers Reveal the Secrets to Building a Billion Dollar Brand Emphatic Marketing – Getting the World to Notice and Use Your Company Leading Advertisers – Advertising CEOs Reveal the Tricks of the Advertising Profession The Art of PR – Leading PR CEOs Reveal the Secrets to the Public Relations Profession The Golden Rules of Marketing – Leading Marketers Reveal the Secrets to Marketing, Advertising and Building Successful Brands PR Visionaries – PR CEOS Reveal the Golden Rules of PR Textbook Marketing – The Fundamentals We Should All Know (And Remember) About Marketing Know What the VP of Marketing Knows – What Everyone Should Know About Marketing, For the Rest of Us Not in Marketing Marketing Brainstormers – Question Blocks & Idea Development Worksheets Guerrilla Marketing – The Best of Guerrilla Marketing-Big Marketing Ideas For a Small Budget The Art of Sales – The Secrets for Anyone to Become a Rainmaker and Why Everyone in a Company Should be a Salesperson

To Order or For Customized Suggestions From an Aspatore Business Editor, Please Call 1-866-Aspatore (277-2867) Or Visit www.Aspatore.com

Inside The Minds: PRIVACY MATTERS

Dedications & Acknowledgements Michael J. Silverman, Esq. “I dedicate this chapter to my family and thank them for their love and support.” Alan D. Boehme “I would like to dedicate this chapter to my technology team (the mercenaries of Silicon Valley) who have tolerated my crazy ideas, helped educate me on technology, and played a key role in our joint successes over the past seven years. I would also like to thank my wife Alisa and son David, who have provided me with inspiration and put up with by globe-trotting and extensive work hours over the years, and my co-author. Without everyone’s support, I would not be having as much fun or be able to contribute to this book.” Brad Slutsky “To Karen, Isaac, Lauren, and Sarah – my inspiration.” Timothy D. Casey “I would like to acknowledge the assistance of Jeff L. Magenau and Arianne H. De Govia of Fried, Frank, Harris, Shriver & Jacobson in producing and editing this chapter.” Dale M. Cendali “I would like to acknowledge the substantial assistance of Johanna Schmitt, as well as the valuable efforts of Aaron Dyer, Samantha Hetherington, and Sandra Cohen, in writing this chapter.” David M. Klein “I would like to acknowledge the grateful support of my wife, Debra Lynn Weinrib, Esq., for her wisdom, thoughtfulness and assistance in preparing this paper.”