PRIVACY BEAT: Where's the Law on the World Wide Web?

HACKERS AND CYBERTHIEFS HAVE PROVEN their ability to enter, abuse and sometimes destroy even the most secure sites. A recent study by the Computer Security Institute found that 70 percent of Fortune 500 companies had their security invaded in 1999. Those companies and countless others like them maintain personal information about their clients. When their security is breached, so is yours.

Yet a greater threat to your privacy comes not from these well publicized cases but from what seems like a harmless activity, surfing the Web. According to a May 2000 Federal Trade Commission (FTC) study, during 30 days of surfing the hottest web sites there is a 99 percent chance that some of your personal information will be captured, usually without your knowledge.

What are these sites doing with your information? Consider this example:

You participate in an online survey while registering for a healthcare newsletter, and check that you once suffered from hypertension. A few weeks later a brochure from a hypertension clinic shows up at your work address. Your boss sees it and you get turned down for that high stress promotion. All because the company you thought was collecting your information anonymously sold it to the highest bidder.

If this happened to you, you would want the offender to be punished. In fact, according to an August 2000 study by the Pew Internet and American Life Project, 94% of Internet users want privacy violators to be disciplined, with 11% voting to send the owners of violating companies to prison. But where are the laws that punish privacy pirates? Like most internet standards, legal protection of online privacy is still being debated.

The most significant piece of online privacy legislation to pass Congress is the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA requires all Web sites to get a parent's consent before they can collect, use, or disclose personal information from children under 13, and to post clear policies about how that information is used.

COPPA is one of the few pieces of Internet privacy legislation to clear Congressional hurdles and become law. Scores of other bills have been introduced over the past several years and failed, due to the lack of a focused debate on the issue. But a high-profile bill introduced in the Senate in July 2000 by a bi-partisan group of senators including John McCain is currently gaining steam. The Consumer Internet Privacy Enhancement Act would legally require web sites to follow the four standard practices of Internet privacy protection: notice, choice, access and security.

Though many leading online companies already follow these four principles, they have been vocal in their opposition of Internet regulation. They argue that regulation would hinder commerce and place an unfair burden on online companies that brick and mortar businesses don't have to bear. Free speech advocates such as the American Civil Liberties Union also oppose regulation, fearing that it could lead to censorship and even further privacy invasions.

And the private sector has made progress on its own. According to the FTC, the number of top sites posting a privacy policy has increased from 71 percent to 100 percent since 1998. In addition, 45 percent of the most visited sites have some form of privacy certification seal such as TrustE or BBBOnLine. IBM, Microsoft, America Online and others released shared guidelines in the spring of 2000 that they believe should be used to allow self-regulation of ecommerce.

The FTC agrees that self-regulation plays a critical role in protecting consumer privacy. But they argue that such efforts don't go far enough in giving consumers the choice about how their personal data is used, access to that data, and the confidence that it's being protected. Also missing from industry efforts and privacy seals is the critical component of enforcement.

Privacy watchdogs such as the Electronic Privacy Information Center (EPIC) and Junkbusters are fighting for stronger government control. EPIC has brought multiple suits against the FTC, the FBI, and the National Security Administration to challenge their investigation of privacy abuses, as well as the potential misuse of data collected by the government.

Protection of online privacy will continue to be hashed out in the courts, in the Congress, and in the corporate world. In the meantime, how can you protect yourself from cybercrime?

• If you use a cable modem, you need a personal firewall. Hackers target cable modem users, enter your computer through the connection, and use your computer to attack others. A personal firewall blocks these dangerous attacks.
• If you receive threatening email, contact your local law enforcement agency and report it to the Cyber Tipline at (800) 843-5678.
• If a company shares your information in a way that you have not authorized, contact the Federal Trade Commission or the Better Business Bureau.
• Request periodic checks of your credit. These will reveal any misuse of your name or financial information.
• Carefully review a web site's privacy policy before intentionally sharing personal information or completing a financial transaction.
• Check the security status of sites that you frequent. PerfectlyPrivate.com conducts independent appraisals of the busiest sites to see how they are living up to their privacy claims.