Momentum building for US privacy policy

Privacy advocates in Washington, D.C., have been busy in recent months.

Groups such as the Center for Democracy and Technology (CDT), the Center for Digital Democracy (CDD) and the Electronic Privacy Information Center (EPIC) have sounded alarms on several privacy-related issues before the U.S. Congress and federal agencies.

CDT, more recently joined by Microsoft and Google, has long pushed Congress to pass comprehensive privacy legislation that would set the ground rules for businesses that handle personal information. Several lawmakers have recently called for a broad privacy law.

Representative Joe Barton, a Texas Republican, complained about targeted advertising campaigns during a speech at a forum on Internet privacy earlier this month. Although there have been recent privacy complaints about a targeted ad service offered by NebuAd, other online ad networks put cookies on computers without telling the owners, he said.

"Nobody in the world has a right to know anything about me unless I let them," Barton said.

No one expects Congress to pass a major privacy bill this year -- passing major legislation is difficult in the months approaching a national election, and a comprehensive privacy bill hasn't even been introduced. But several privacy advocates say momentum for a new privacy law seems to be building, with a real push likely in 2009.

"There is a perfect privacy legislation storm developing that should propel a bill in the next Congress," said Jeffrey Chester, CDD's executive director.

Among the privacy issues debated recently in Washington:

-- Privacy groups, including CDD and EPIC, raised concerns about Google's late 2007 acquisition of online advertising network DoubleClick, and some have also questioned the privacy implications of Google's recent advertising deal with rival Yahoo.

-- Privacy groups and some lawmakers have protested experiments by a handful of broadband providers to use a targeted ad service from NebuAd. The NebuAd service tracks the Web habits of broadband users in an effort to deliver more relevant ads, but during the past couple of months, privacy groups have complained that NebuAd uses common Internet attacks to track users and that some broadband providers didn't notify their customers.

-- Congress debated and passed an extension to a controversial U.S. National Security Agency surveillance program that targets suspected terrorists and people communicating with them. The new surveillance law, given final approval this month, provides some additional court oversight to the NSA program, but it also will likely give legal immunity to telecom carriers that participated in the program while it was not under court oversight.

-- Several other privacy-related issues are before Congress: How to ensure privacy of electronic health records, whether to require private companies to report data breaches to customers whose personal information has been compromised, and how to improve the cybersecurity of government agencies.

A series of data breaches reported in early 2005 created a push for a data-breach notification law, but Congress has failed to pass legislation. However, the controversy over broadband providers, including Charter Communications, testing NebuAd's targeted ad service has brought privacy issues back to the forefront.

The IDG News Service is a Network World affiliate.