The House Subcommittee on Technology and the Internet released a discussion draft of an online privacy bill yesterday. The main function of the bill is to put limits on how web companies can track user data. Here's a summary from the New York Times:
The proposed bill would expand what information should be considered confidential. It would require companies to post clear and understandable privacy notices when they collected information. Such information could range from health or financial data to any unique identifier, including a customer identification number, a user's race or sexual orientation, the user's precise location or any preference profile the user has filled out. It could also include an Internet Protocol address, the numerical address assigned to each computer connecting to the Internet that many companies use now to aim particular messages at users, which the companies argue is not personally identifiable.
…The bill also requires companies to advise consumers even when they are collecting any of that information off line, which could include data houses and direct marketers.
The online and off-line privacy notices would have to include a description of the information being collected, why the company was collecting that information, how that information might be linked or combined with other data about the individual or computer, and why the company would disclose that information and to what types of other companies, among other requirements.
Even still, the proposal is already being criticized for being too lenient. I can certainly understand why individuals might be concerned about protecting their privacy online, and I think that if there's going to be regulation, disclosure requirements are probably the least onerous option. But I'm not convinced that we're better off with Congress setting privacy standards or predefining the terms of privacy agreements. As Adam Theirer and Berin Szoka of the Progress and Freedom Foundation point out, "privacy varies across users and depending on context, and…there's no escaping the trade-off between locking down information and the many benefits for consumers associated with the free flow of information." Disclosing personal data isn't always a good thing, but the upside—companies that know more about your preferences can serve you better—tends to get lost in these discussions.
Meanwhile, if members of Congress are so keen to look into privacy violations, they ought to look into incidents like this.