MYRNA L. WIGOD, ESQ.

McCarter & English LLP

Newark, New Jersey

mwigod@mccarter.com

Pace University Law Review Symposium

March 20, 1998


 
 





PRIVACY IN PUBLIC AND PRIVATE E-MAIL AND ON-LINE SYSTEMS

Introduction
 
 

With the convenience and ease of sending information via electronic mail (e-mail), its use is expanding at an exponential rate. However, the same technological strides that have made e-mail possible also represent a significant threat to privacy. Electronic eavesdropping, recording, and dissemination of private information can be accomplished with relative ease and thus legal and technical means of protection are coming to the forefront of attention. This discussion addresses the interests in, threats to, and the existing and projected protections of the privacy of e-mail communications and other information as provided by both the public Internet Service Providers (ISPs) and private employers.
 
 

What is Privacy?
 
 

To ultimately evaluate protections of e-mail privacy, it is helpful to analyze the conflicting interests involved. Identification of these interests facilitates an understanding of the policy goals of various protections as well an assessment of how well those goals are being met. At its most basic level, a balance must be struck between the needs of individual privacy and autonomy, and the legitimate needs for access to potentially private information. An understanding of what privacy is may be aided by analyzing the interests and arguments on the sides of both privacy and non-privacy.

  1. Interests in Privacy
  1. Privacy of Information.
Individuals have a strong need to protect their personal information. This need manifests itself in three primary areas.
 
 
  1. Privacy of Autonomy
Compromises in the security of on-line activities also raises traditional privacy concerns:
 
 
  1. Interests in Non-privacy

Notwithstanding the strong interest in protecting the privacy of individuals, there are legitimate reasons why such protection should not be absolute.

  1. Law enforcement
  1. Employment
  1. Marketing
  1. On-line Commerce
Parties may need to give up protection of certain types of information to promote on-line commerce. This will include disclosure of name, address, credit card, and demographic information. Examples of on-line transactions include:
 
 
 
 

Who might violate On-Line Privacy?
 
 

  1. Government
Most law enforcement intrusion is in the form of gaining access to ISP or employer stored data, monitoring communications, tracing communications trails and habits, and accessing encrypted data.
 
 
  1. Employers
As private e-mail service providers, employers have access to all stored employee communications data. They may also have the ability to monitor employee live communications and usage habits (subject to possible legal restrictions discussed below).

A 1993 MacWorld survey showed that 22% of American businesses that responded to the survey indicated that they have searched employee files, e-mail, or other communications. For companies with more than 1000 employees, the number increased to over 30%. This monitoring is often without notice to the employees and few companies have a formal policy on the issue.
 
 
  1. ISPs
ISPs can increase their revenues by collecting and disclosing profile data on their customers. They also have the technological ability to access, monitor, intercept, and disclose both live and stored e-mail communications on their systems. Such disclosure might be legally permitted either in response to law enforcement directives or to reasonably protect against liability caused by customer misuse of ISP property (as discussed further below).

AOL recently changed its privacy policy to add subscriber phone numbers to the list of personal information that it sells to direct marketers. Previously, AOL's privacy policy prevented the disclosure of subscriber telephone numbers, while allowing the company to sell member names and addresses. The new policy took effect on July 31, 1997.

While AOL will generally not disclose "navigational" or "transactional" information (such as where you go or what you buy through AOL) to third parties, it may use such information to develop member lists for companies with which AOL has a contractual marketing relationship.
 
 
  1. Site Providers
Web site providers can closely monitor the activities of individuals that access their sites. Web sites may require a user to "sign in" in order to access the site and the site providers may aggregate and disclose such profile data (including e-mail address). In addition, site providers may store and disclose any communications made with that site, and may trace and store a user’s movements and preferences within the pages of the site.
  1. Other Users
Other users both on public and private networks may attempt to access e-mail communications and other private information. This may be to further criminal activity or simply out of curiosity. Such invasive activity may include accessing past user discussions, searching for confidential stored information, and hacking into an ISP site.
 
  Manner of Violation
 
 
  1. Threats against Privacy of Information
  1. Collecting Clickstream data
Because a user's connection to the Internet is made via an ISP, the ISP can monitor the user's activities and record every website visited. The observable trail of the web travel is called the user's "clickstream." In addition, websites can also gain information regarding web movement. Based on analysis of the "packets" of data that are used to carry information within the Internet, it is possible to determine certain information from a given user’s packet data (e.g. source location, e-mail address). In this way a web site can observe which pages a user visited within the current site, and can also identify the previous and next sites visited by the user. This "clickstream" data of electronic markers generated by a user’s browsing activities can be aggregated, stored, and reused. Note that this aggregation of data is particularly telling if done by a site host an Internet search engine (e.g., Yahoo). The search engine site can monitor both the type of information that a user is seeking (patterns of research), and the websites visited to obtain that information.
 
 
  1. Cookies / Web site monitoring
    1. Cookies. A web site’s server computer can track a user’s activity (e.g., pages visited) within that site and collect / save that data in a file. Then during the communications interchange between the server and the user’s computer, the server may request that this file or "cookie" be placed on the user’s hard disk. The "cookie" may then be reused to identify the user’s preferences based on this historical data the next time she accesses that site. The web site may then present particular advertising targeted at the user, or may route the user through particular pages on the site. In response to this practice, some newer web browsers (e.g., Netscape 3.0) detect when the "cookie" request is made and alert the user. If the user declines acceptance of the cookie, its transmission will be blocked. Cookies, as simple text files, do not contain executable code that could be used to transmit a computer virus or to read information residing on a user's hard disk. However, any information disclosed by a user while visiting a site (e.g. name, address, credit card number) could be stored in a cookie for later access by the web site. A cookie deposited by a particular server generally cannot be accessed or read by a different server.
    1. Monitoring. Analysis of packet data can also reveal the "IP Address" of the user’s computer as assigned by the user’s ISP. A request may then be sent to an Internet "name server" computer to map this IP Address to the alphabetic name assigned to a user’s computer. This information may reveal the identity of the user’s ISP and may be used to help ascertain a user’s e-mail address.
  1. Collection of data by users via on-line search engines
A number of on-line services or "search engines" are readily available to help find information on the web. While these services are essential to make productive use of the network, they may also reveal private information. In particular, some search engines are specialized to assist in gaining specific information about other users. Examples are:
 
  As an example of use of this service, the New York Times reported that a search made on privacy / cryptography advocate Tim May yielded his phone number, e-mail address, and 527 messages he had posted over the previous 18 months on various topics.
 
  Although most web users believe that their activities are largely anonymous, this is very likely a mistaken assumption.
  1. ISP monitoring
As the focal point of a user’s Internet activity, the ISP stands in a unique and powerful position to access information about a person, control and monitor usage, and disclose this information to others (e.g., law enforcement, marketers). As the user’s gateway to the net, it is technically possible for an ISP to monitor each mouse click & keystroke made during a session. The ISP also has complete access to any stored data or message characteristics passing through its facility, and is permitted to exploit this access within few legal limits under the ECPA. In addition, user profile data is usually collected upon sign-up for the service and could later be disclosed unless expressly agreed otherwise.
  1. Collection of data via voluntary means
  1. Federal Reserve Board.
In March 1997, the Federal Reserve Board published a study to determine the public availability of "sensitive identifying information" about consumers, such as social security number, mother’s maiden name, and date of birth; and is presently seeking public comment. This initiative was triggered by the well-publicized Lexis-Nexis P-TRAK service that made this type of information readily available but that has discontinued the service due to public outcry. The report's conclusions stated that "fraud related to identity theft appears to be a growing risk for consumers and financial institutions, and the relatively easy access to personal information may expand the risk." While the FRB was requested to provide recommendations to Congress regarding legislation, the report merely stated that "In considering whether any legislation is desirable, the Congress must carefully evaluate whether the availability of sensitive information poses a sufficient risk to consumers and institutions to justify new laws."
  1. Federal Trade Commission.
The FTC is also looking into this, and last year published a report titled "Public Workshop of Consumer Privacy on the Global Information Infrastructure". This report examined consumer privacy issues in the on-line context to promote education about the use of personal information on-line. More recently, in response to a request by Congress to investigate "possible violations of consumer privacy rights by companies that operate computer data bases," the FTC published a December 1997 report titled "Individual Reference Services." This report investigated the IRS industry, and for the most part endorsed industry guidelines that restrict access to non-public information such as social security numbers. The report did criticize the IRS industry noting that consumers do not have access to the information collected concerning them, and have no means to correct inaccuracies. The report was criticized by privacy advocates for its acceptance of industry guidelines.
  1. Social Security Administration.
In March 1997, the SSA had offered its Interactive Personal Earnings and Benefits Estimate Statement (PEBES) service to provide citizens with access to their Social Security payment information. However, the service was suspended on April 9, 1997 following public concerns about the risk of improper access to personal information held by the agency. The SSA now offers a modified version of the service that uses Secure Sockets Layer (SSL) technology to allow on-line requests of the PEBES, however the statement will be sent back only by paper mail.

The SSA is still researching the full Interactive PEBES capability and conducted a series of national forums to hear from experts in the areas of privacy and computer security, as well as members of the public. The public forums ended on June 16 and the full report was released on September 4, 1997.

Privacy experts expressed support for the SSA recommendations, saying that the agency has done a good job meeting with the public, consulting with experts, and developing sensible standards to protect personal information. The SSA experience with Internet service delivery is being watched closely by other federal agencies as well as private companies who hope to take advantage of the Internet and avoid public concerns about privacy.
 
 
  1. Compromise of Medical Records.
While leveraging modern advances in information technology, the health care industry's placement of patient medical records in computer databases has created a potential for abuse of individual privacy. The ease of electronic networking and sharing of information has caused concern that sensitive data will be accessed and misused. Negative results of the proliferation of private data may include loss of job, denial of insurance, and commercial exploitation or "data mining."

At present, there is no federal statute for blanket protection of the confidentiality of medical records, although there is an initiative in the works to pass such a law (see below). However in 1996, Congress did pass the Health Insurance Portability and Accountability Act (HIPAA) to regulate the health insurance industry to combat waste, fraud, and abuse. The law also contains particular provisions to assure that medical information is utilized in a manner that appropriately protects the confidentiality of the information and the privacy of individuals receiving health care services and items. It established standards for confidential transmission of electronic records, levied criminal sanctions for wrongful disclosure of individual's identifiable health information, and required the Secretary of Health and Human Services (HHS) to recommend to Congress, standards for protection of privacy of individually identifiable records. These recommendations were made in September 1997 and proposed to: 1) permit patients to copy records and propose corrections, 2) require health care organizations to explain how records will be disclosed, 3) allow patients to control access to information, 4) permit patients to control the use and disclosure of information, and 5) make unauthorized disclosure a crime.

Notwithstanding these recommendations, also determined a number of situations in which health care information will be disclosed without the patient's consent. These disclosures may be:

 By comparison, the European Union has enacted an omnibus, continent-wide Data Protection Directive that goes into force in October 1998. Under this law, any personally-identifiable data flowing in or out of the EU is subject to strict regulation. Thus, any American health care institution that shares data with European contemporaries may have to provide contractual assurances of data protection that meet the requirement of the EU data protection law.
  1. Threats to Communications
  1. Access to private communications
Beyond exposure of collected personal information, one’s on-line communications do not enjoy the level of privacy that is generally afforded other communications means such as public telephone and traditional mail. As noted, private e-mail messages may be monitored, stored, and disclosed by ISPs and employers (however, subject to some ECPA limitations as discussed below).

In addition, e-mail messages to web sites, vendors, or virtually any other party may be stored and later disclosed. In contrast to telephone communications that are rarely recorded for later use, e-mail messages are always recorded unless the recipient affirmatively destroys them. Computer technology provides a simple means to reproduce, edit, or disclose such messages.
  1. Anonymity
Again, in contrast to some traditional venues, on-line technology makes it difficult to speak anonymously. Controversial speech or ideas may not be able to be disseminated without the speaker’s identity being clearly known. Thus, this infringement on privacy spills over into the area of the First Amendment (but see discussion of technical methods of gaining anonymity below).

It is also difficult to purchase items on-line without leaving an audit trail identifying who the purchaser was. This may be contrasted with familiar cash transactions whereby the trail of hands through which money has passed is unknown.
  1. Intrusion
    1. Junk E-mail or "Spamming". While "cookies" and other unauthorized access to one’s computer are obvious forms of intrusion, junk e-mail "bombings" or "spamming" may be a primary threat to the overall usefulness of the e-mail system. In addition to clogging or slowing down the entire system, mass mailings of unwanted messages could distract users from important messages and ultimately make an individual’s e-mail account impractical to use. Junk e-mail may also increase a user’s per minute on-line or telephone charges. While junk e-mail is a potential threat, recent cases have curtailed its use:
    1. Usenet Spamming. Another type of on-line advertising spamming abuse occurs when an advertiser posts a commercial message to a large number of Usenet news groups or to the members of an e-mail mailing list. When a pair of lawyers did this to advertise their "Green Card" services for immigrants, the outraged Usenet readers retaliated by publishing protest messages, implementing software to erase future messages by the lawyers, and placing fake pizza orders to the lawyers’ address. While there was never a legal action involved, the on-line social pressure forced the lawyers to cease their activity.

Legal Protections & Limits

  1. Federal Constitution
Any privacy protections afforded by the federal Constitution are limited by the state action requirement. Constraints on access to private information and communications arising from the Constitution apply only to Government entities and not to private parties like ISPs or employers. There are three potential sources of protection:
  1. 1st Amendment. Protections here limit the government’s ability to seize data where such intrusiveness would interfere with the ability to publish or distribute speech. The Privacy Protection Act (PPA), discussed further below, was enacted in 1980 to protect publishers’ First Amendment right to freedom of the press against government interference.
This protection was enforced in Steve Jackson Games, Inc. v. U.S. Secret Service, 816 F. Supp. 432 (W.D. Texas 1993), aff’d Steve Jackson Games, Inc. v. U.S. Secret Service, No. 93-8661 (5th Cir. 1994). In this case, the Secret Service in pursuit of a hacker group seized the computers and other materials of a company’s electronic bulletin board system (BBS). Since the PPA protects persons "reasonably believed to have a purpose to disseminate to the public a newspaper, broadcast, or other similar form of public communication...," the court awarded damages for lost business caused by such seizure of First Amendment materials. See 42 U.S.C. § 2000aa(a).
  1. 4th Amendment. The primary source of protection in the on-line context stems from the Fourth Amendment prohibition against unreasonable searches and seizures. As a threshold matter, the Fourth Amendment can only afford protection to e-mail communications if the affected party has a reasonable expectation of privacy in such communications.
  1. 2nd Amendment. While the government has placed restrictions on the export of encryption software, it can be argued that this is a violation of the right to bear arms. Since encryption software has been classified as "munitions," it is arguable that this places such software under Second Amendment protection. There is no case law on this issue to date.
  1. State Constitutions
While the state constitutions typically provide provisions similar to those of the federal, the states are free to add additional protections above the "floor" of the federal Constitution. These additional protections may further be extended to private actors.
 
 
  1. Federal Statutes
  1. ECPA (Anti-Wiretapping Statute), 18 USC § 2510 et seq.
    1. Basic Provisions of the ECPA. The Electronic Communications Privacy Act of 1986, which amended Title III of the Omnibus Crime Control and Safe Streets Act of 1968, is the only federal statute that specifically addresses interception and access of electronic communications. The ECPA prohibits the unauthorized interception, access, disclosure, and use of the contents of electronic and wire communications subject to certain exceptions discussed below. These provisions apply to both government and private actors, and violation may result in criminal, civil, and attorney fee liability. Evidence seized by the government in violation of the ECPA is subject to the exclusionary rule.
However, the ECPA extends only to the contents of the communications and thus transactional information associated with electronic communications, such as the existence of the communications, identities of parties, message length, duration of communications, and e-mail title headers, are not protected. The ECPA also distinguishes between "live communications" and "stored communications" as further discussed below.
    1. Title I - Access to Live communications. Title I of the ECPA regulates "interception" of oral, wire, and electronic communication by government, ISPs, and employers (as well as other third parties). In the absence of consent, interception of content is restricted except as a necessary incident to:
Thus random monitoring / managing of message streams is not restricted because it furthers the rendering of service. Interception is also permitted under reasonable suspicion of violation of ISP’s rights or property. The ISPs and employers have much more latitude than government, since government may only intercept communications with a warrant under probable cause. Note, however, that all interception is permitted with consent of one of the parties to a communication.
    1. The Ordinary Course of Business Exception. Intercept under the ECPA is defined to mean "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device." In turn, "electronic, mechanical, or other device" is defined to mean "any device or apparatus which can be used to intercept a wire, oral, or electronic communication other than ... any telephone or telegraph instrument, equipment or facility, or any component thereof, (i) furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of its business and being used by the subscriber or user in the ordinary course of its business or furnished by such subscriber or user for connection to the facilities of such service and used in the ordinary course of its business; or (ii) being used by a provider of wire or electronic communication service in the ordinary course of its business, or by an investigative or law enforcement officer in the ordinary course of his duties..." (emphasis added).
Because the statute focuses on telephone or telegraph devices, it is not clear if these definitions are applicable to e-mail. To date, this exception has only been applied to telephone monitoring, however the results may cross over to e-mail privacy disputes. The major cases interpreting this provision are not entirely consistent in their interpretation of whether devices are used in the ordinary course of business. These cases are summarized as follows: As noted, the statutory definitions and the court cases are specifically oriented to telephone conversation monitoring. The extent to which the business use exception will be extended to employee or Internet e-mail is unknown at this time.
    1. Title II - Access to stored communications. In contrast to Title I, Title II regulates access to communications that are "stored" within ISP or employer facilities. The basic rule for stored communications is that there are virtually no protections or restrictions on ISPs or employers regarding access. A problem here is that this provision essentially overshadows any protections available under Title I. When considering e-mail and other on-line communications, virtually all on-line communications may be technically classified as "stored" at one point or the other. Even during an interactive "chat" session, the communications are generally placed in storage while the session is occurring.


      2. One recent case has provided some guidance with regard to the distinction between interception of live communications under Title I, and access to stored communications under Title II. In United States v. Moriarty, 962 F.Supp. 217 (D. Mass. 1997), the court held that an individual that listened to stored voice mail messages could only be prosecuted under Title II and not Title I. The fact that the defendant had "listened to the human voice" was not sufficient to implicate the interception provisions of Title I, and the court held that charges under both Title I and II were multiplicitous in violation of the double jeopardy clause.

    2. Disclosure under the ECPA. In addition to access, both Title I and II regulate the disclosure of wire and electronic communications by ISPs and employers. Under the statute, such accessed communications may be disclosed:
  1. Privacy Protection Act of 1980, 42 USC § 2000aa
    1. Basic Provisions of the PPA. The PPA was enacted for the purpose of protecting the First Amendment right of freedom of the press so that publishers can investigate and develop sensitive news stories without fear of government interference. It establishes safeguards protecting "publishers" from government search and seizure of materials in their possession in the absence of probable cause. Probable cause here requires a stricter standard than under Fourth Amendment jurisprudence. Under the PPA, a warrant will only issue if there is probable cause to believe that information materials themselves are involved in the commission of a crime. The PPA protects both "work product" (meaning materials prepared by the publisher or author), and "documentary materials" (meaning supporting records, photographs, interviews, and the like).
    2. Application to On-line Systems. On-line systems and users are protected by the PPA if they provide publishing services (e.g., electronic newsletters) or engage in publishing related activities (e.g., collection of documentary information via e-mail). Protection extends to the entire on-line system on which publishing materials are kept.
    3. Remedies and Defenses. Violation of the PPA can be sanctioned by an award of money damages; however, illegal evidence so seized is not subject to the exclusionary rule. Law enforcement may defend a violation under a claim of a "good faith belief" in the propriety of the seizure. In the Steve Jackson Games case, at least with regard to the initial actions by the Secret Service, the court accepted the defense that the agents did not know that the PPA applied to ISPs. Note that in Steve Jackson Games, the plaintiffs successfully sued under both the PPA and ECPA.
  1. Telephone Consumer Protection Act of 1991,
47 USC § 227(b)(1)(A)(iii) The TCPA was enacted to address consumer concerns regarding privacy intrusions from the telemarketing industry. Under this statute, the FCC may direct a company to maintain "do not call" lists so that customers on such lists may not be contacted. The TCPA further makes it unlawful to solicit with an automated dialing system where the consumer is charged for the call. This provision has a potential application to intrusion via junk e-mail since consumers typically pay for connect time during receipt of such messages. This issue was raised by a CompuServe customer in a suit filed regarding a Compuserve / VISA advertisement received by e-mail; however, the dispute was settled out of court.
  1. Federal Records Act, 44 USC §§ 2101 et seq.
This act was passed in 1950 to establish the National Archives and Records Administration for the purpose of creation, maintenance, management, and disposal of the official records of federal agencies. The act prohibits the disposal of records by agencies without the approval of the Archivist. It is important with respect to privacy because government e-mail messages have been held to be official federal records subject to the act. The case of Armstrong v. Executive Office of the President, Office of Administration, 1 F.3d 1274 (1993) found that computer back-up tapes containing e-mail messages from the Reagan / Bush era were official records that could not be erased. Thus government employees should be aware that any personal information that they include in office e-mail messages are archived and may be available for public scrutiny.
  1. Communications Assistance for Law Enforcement Act (CALEA)
(Digital Telephony Law), 47 U.S.C. § 1001 et seq.

Traditionally, law enforcement has been able to "tap" analog telephone lines under a proper wiretap order for the purpose of investigating crime. But the nation’s telephone lines are rapidly shifting from analog to digital technology and, with this shift, comes an increased technical difficulty in the ability to eavesdrop on conversations. In the analog world, simple access to the wires through which a telephone conversation flows provides the opportunity to "listen in" on the conversation. However, when voice communications are digitized, they are sent as discrete packets of data that are multiplexed in with other data and possibly routed through different paths before being reassembled at the destination site. Thus, from a technical perspective, it becomes much more difficult to perform surveillance of communications made via digital telephony.

In response to this development, the FBI successfully lobbied Congress to pass a new law to facilitate "wire tapping" of digital communications in order to restore the status quo. The 1994 CALEA (Digital Telephony Law) thus requires the telephone industry to conform its networks to allow for wiretapping via advanced switching equipment. At the same time, the law requires that government pay for any advanced features that are not readily available. The FBI is presently developing rules and proposals on how to implement the law.

As related to e-mail, the law has significant provisions whereby it:

 This last point is important because even if law enforcement has the capability to tap digital phone lines, they would be frustrated if messages passing through these lines are protected by strong encryption. This means that law enforcement will continue to exert support for measures such as Clipper that provide government with the technical means to de-encrypt private messages.

Since the enactment of CALEA, there have been continued delays in its implementation due to disputes between the FBI and industry. The discussions had broken down after industry negotiators concluded that the FBI was seeking to significantly broaden its surveillance powers and require many more technical changes than CALEA envisions. However, following a meeting with Attorney General Janet Reno and FBI Director Louis Freeh on March 6, industry executives agreed to resume negotiations over implementation of the act. The impasse has delayed implementation of CALEA, which requires new wiretap-friendly technology to be in place by October 28, 1998.
  1. Privacy Act of 1974, 5 U.S.C. § 552a
    1. Background. The Privacy Act of 1974 was an amendment to the Freedom of Information Act (FOIA), 5 U.S.C. § 552, aimed at increasing the privacy protections of the FOIA. While the FOIA primary goal is to make government information available to the public, it also contains exceptions that restrict disclosure of certain information in an effort to protect privacy. The Privacy Act was created to further prevent government from disclosing computer database records maintained on an individual for any other purpose than that originally intended without consent. The act was amended by the Computer Matching and Privacy Act of 1988, 5 U.S.C § 552a (1994) which limits government use of database "matching" techniques to aggregate information on individuals and then terminate benefits without notice and a hearing.
    2. Basic Provisions. As stated, the Privacy Act restricts government disclosure of information within its databases. It also allows individuals to examine, correct, and copy their records kept in government databases. The existence of such databases of personal information must be made known to the public. The Privacy Act does allow information in these databases to be disclosed to law enforcement, credit reporting agencies, and to protect the health / safety of the individual. However when information is requested on an individual, that person must be informed of the purpose of the disclosure, and the uses to which the information will be put. The individual may request review and amendment of such records, and disclosure must only be with written consent, unless disclosure is for a "routine use". This "routine use" exception tends to negate much of the act’s privacy protection by allowing an agency to disclose a record concerning an individual, if such disclosure is for a purpose that is specifically compatible with the purpose for which the information was gathered. Violations of the Privacy Act may be redressed by money damages and injunctive relief. However, the Privacy Act is only effective against government disclosure of private facts; it has no effect on private entities.
    3. Critics of the Privacy Act. Privacy advocates have criticized the effectiveness of the Privacy Act and have called for stronger protections especially in light of expanding computer networking. The American Civil Liberties Union (ACLU) has charged that the Privacy Act only mildly deters government exploitation of private information. They argue that social security numbers are being increasingly misused and as an example point to the mandatory reporting of children’s Social Security Numbers (SSNs) on tax forms. The act is also criticized because of its specific exception that allows government disclosure without consent if the disclosure is a "routine use" of the information.
  1. Acts Protecting Financial Information
    1. Fair Credit Reporting Act (FCRA). Although the Privacy Act of 1974 does not provide protections against privacy incursions by non-government actors, other statutes do provide protection in the area of financial information. The Fair Credit Reporting Act of 1970, 15 USC §§ 1681 - 1681t, regulates disclosure of personal information by credit reporting agencies, but not the collection of this information. Under the FCRA, credit bureaus must maintain procedures to protect against reporting inaccurate / obsolete credit information, and allow consumers to review their records and correct inaccuracies. Credit reports may only be disclosed with permission, under court order, or for certain enumerated purposes (e.g., credit, insurance, employment, government benefits eligibility, legitimate business needs). A major weakness of the act from a privacy perspective is that agencies are not required to notify individuals of the existence, content, or use of financial records. Thus enforcement of the FCRA may actually provide little privacy protection.
    2. Right to Financial Privacy Act of 1978, 12 USC § 3401 et seq. (1994). This act was passed to overturn United States v. Miller, 425 U.S. 435 (1976), which held that an individual had no reasonable expectation of privacy in records held by a bank. The RFPA response was to set procedural restrictions on federal agency access to a bank’s records of its customers. However, the financial institution may notify law enforcement if it has a suspicion of crime. Disclosure may then be authorized by warrant, subpoena, or consent. The act has no applicability to disclosure to non-government entities.
    3. Related Statutes. Other related acts that regulate disclosure and consumer reporting of financial information are the Fair Credit Billing Act of 1974, 15 U.S.C. § 1666 (1994); Fair Debt Collection Practices Act of 1977, 15 U.S.C. § 1692 (1994); Equal Credit Opportunity Act of 1974, 15 U.S.C. § 1691 (1994); and the Electronic Fund Transfer Act of 1978, 15 U.S.C. § 1693 (1994).
  1. Acts Protecting Medical Records
At present there is no federal statute that protects the confidentiality of medical records, however there is an initiative in the works to pass such a law (see below). Some states have confidentiality statutes, but these laws offer varying degrees of protection and many states have no laws at all. The medical profession treats improper disclosure of sensitive data as an ethical violation but for the most part this is an unwritten and unenforceable rule.

New Jersey has no specific statute governing the disclosure of medical records. The New Jersey courts have treated cases involving disputes over disclosure within a general duty of confidentiality imposed on the health care profession based on a patients right to privacy (see e.g., Estate of Behringer, v. Med. Center at Princeton, 249 N.J.Super. 597 (1991)). This obligation of confidentiality applies to patient records and information, and applies not only to physicians but to hospitals as well.
  1. Other Acts Protecting Private Information
    1. Family Educational Rights and Privacy Act of 1974, Pub. L. No. 93-380, 88 Stat. 571 (codified in scattered sections of 47 U.S.C.). This statute regulates the disclosure of and access to educational records and allows students to review their records and prevent disclosure.
    2. Driver’s Privacy Protection Act of 1994, 18 U.S.C. § 2721 (1994). This statute makes it a criminal act for state motor vehicle offices to release driving record, age, or address information without a legitimate purpose.
    3. Cable Communications Policy Act of 1984, 47 U.S.C. § 551 (1988 & Supp. V 1993). This act imposes restrictions on cable TV systems regarding collection, use and disclosure of subscriber information including the viewing habits of customers. The cable systems must notify customers regarding information collected and may only disclose such data if the customer has first been given the opportunity to prohibit or limit such disclosure.
    4. Video Privacy Protection Act of 1988, 18 U.S.C. §§ 2710 - 2711 (1994). This act prohibits the disclosure of information regarding what videos individuals have rented. However, customer lists arranged by subject matter (but not specific title) may be released if the customer has an opportunity to prohibit such disclosure. This law was passed after the public disclosure of Judge Robert Bork’s video rental history while under consideration for the U.S. Supreme Court.
    1. Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191 (1996). The main focus of this act is to regulate the health insurance industry to combat waste, fraud, and abuse. It also contains particular provisions to assure that medical information is utilized in a manner that appropriately protects the confidentiality of the information and the privacy of individuals receiving health care services and items.
  1. Proposed Legislation
  1. Medical Information Privacy and Security Act, S. 1368
This bill was sponsored by Sen. Leahy (11/04/97) to provide individuals with access to health information of which they are the subject, ensure personal privacy with respect to personal medical records and health care-related information, impose criminal and civil penalties for unauthorized use of personal health information, and to provide for the strong enforcement of these rights.

The bill requires that persons that are the subject of protected health information be given access to that information. It further requires specified parties to establish safeguards to ensure the confidentiality, security, accuracy, and integrity of protected health information; and imposes restrictions on use and disclosure. The bill also establishes the Office of Health Information Privacy, specifying its duties to receive and investigate violation complaints and conduct audits. Criminal and civil sanctions are imposed for violations. The bill is generally more restrictive than the HHS proposals (see above) and it is likely that any final law passed will be somewhat less protective of privacy.
  1. Fair Health Information Practices Act of 1997, H.R. 52


    2. This bill was sponsored by Rep. Condit (01/07/97) to establish a code of fair information practices for health information. The bill requires, subject to exceptions, health information trustees (e.g., health care providers) to permit individuals to examine their protected health information such as physical or mental health records created or received by health care trustees. Under the bill the trustees may use protected information only for a purpose: (1) that is compatible with and directly related to the purpose for which the information was collected or received by the trustee; or (2) for which the trustee has received disclosure authorization. The bill does make exceptions regarding: (1) next of kin and directory information; (2) public health; (3) health research; (4) emergencies; (5) judicial and administrative purposes; (6) law enforcement; and (7) subpoenas, warrants, and search warrants.

  2. Consumer Internet Privacy Protection Act of 1997, H.R. 98
This bill was sponsored by Rep. Vento (01/07/97) to prohibit interactive computer services from disclosing to a third party any personally identifiable information provided by a subscriber without the subscriber's informed written consent. The bill permits the subscriber to revoke such consent at any time and requires the service to cease disclosing such information, and permits enforcement by private civil actions.

It further requires, at a subscriber's request, such service to: (1) provide such individual with his or her personally identifiable information maintained by the service; (2) permit the subscriber to verify and to correct such information; and (3) provide to the subscriber the identity of the third party recipients of such information.

The FTC is also granted the authority to: (1) investigate whether a service has been or is engaged in any act or practice prohibited by this Act; and (2) if so, issue a cease and desist order as if such service were in violation of specified provisions of the Federal Trade Commission Act.
  1. Federal Internet Privacy Protection Act of 1997, H.R. 1367


    2. This bill was sponsored by Rep. Barrett (04/17/97) and prohibits any Federal agency from making available through the Internet any record with respect to an individual. The bill permits a civil action to be brought against an agency by an individual suffering harm as a result of any case in which an agency makes available through the Internet a record with respect to the individual (including a case in which a record was made available through the Internet before enactment of this Act).

  2. Communications Privacy and Consumer Empowerment Act, H.R. 1964


    3. This bill was re-introduced by Rep. Markey (06/19/97) to require the FTC to determine ways for consumers to stop unauthorized on-line use of, personal information. The bill also directs the FCC to assess whether ISPs adequately protect against unauthorized interception of communications and personal information. It requires ISPs to offer customer screening software designed to limit access to material that is inappropriate for children. Finally, it prohibits the Federal Government or State governments from: (1) restricting or regulating the sale in interstate commerce of encryption or other products for improvement of data security; (2) conditioning the issuance of certificates of authentication or authority upon any escrowing or sharing of private encryption keys; or (3) establishing a licensing or other regulatory scheme that requires key escrow as a condition of regulatory approval.

  3. Social Security On-line Privacy Protection Act, H.R. 1287
This bill was sponsored by Rep. Franks (04/10/97) to prohibits an ISP from disclosing SSN or related personal information without prior written consent. It requires the ISP to permit an individual to revoke any consent at any time, upon

which revocation the ISP shall cease disclosing such number or information to a third party. Under this bill, the Federal Trade Commission has enforcement authority.
 
 
  1. Internet Freedom & Child Protection Act, H.R. 774


    2. This bill was sponsored by Rep. Lofgren (02/13/97) to repeal restrictions on transmitting obscene materials to minors using telecommunications or computer equipment. The bill requires an ISP to offer customer screening software to limit access to material that is unsuitable for children.

  2. Unsolicited Com’l E-Mail Choice Act of 1997, S. 771


    3. This bill was sponsored by Sen Murkowski (05/21/97) to require a person who transmits unsolicited commercial e-mail to prominently display the word "Advertisement" along with the sender’s name, e-mail address, and phone number. The bill will not be applied to ISPs unless it was the ISP that initiated the transmission. Consumer requests for termination of unsolicited mail must be honored within 48 hours. The bill empowers the FTC with regulatory authority over such unsolicited e-mail, although the bill authorizes a private right of action within 1 year after receipt of the transmission.

  3. Electronic Mailbox Protection Act of 1997, S. 875
This bill was sponsored by Sen. Torricelli (6/11/97) and it levies a $5,000 civil penalty on any person who transmits an unsolicited e-mail message and uses a technical procedure to disguise the source. It applies to senders who fail to comply with the request of the recipient to cease sending e-mail messages. The bill empowers the FTC with regulatory authority over such unsolicited e-mail, but does not provide for a private right of action.
  1. Netizen Protection Act of 1997, H.R. 1748
This bill is sponsored by Rep. Chris Smith (R-NJ) and was introduced on May 22 1997. The bill is an extension of the Telephone Consumer Protection Act of 1991, which created a cause of action against "junk faxes." The bill extends the protection against junk faxes to unsolicited commercial e-mail or "spam", essentially creating a scheme through which potential recipients must "opt-in" to receiving unsolicited commercial e-mail. E. Common Law & State Statutes 1. Privacy Torts Tort law is a traditional means of redressing violations of privacy interests in the private sector, as discussed in the Restatement (Second) of Torts, §§ 652A-652E (1977). In particular, employee privacy is recognized as a protected interest under state common law. In the context of e-mail and on-line privacy, there are four torts of potential importance.
    1. Intrusion Upon Seclusion. This tort creates liability against one who intentionally intrudes (physically or otherwise) upon the seclusion of another or his private affairs where such intrusion would be highly offensive to a reasonable person. Electronic means of intrusion would fall within the ambit of this tort. Actions here could be brought regarding access to private communications (e-mail), and intrusion via junk e-mail.
This tort is limited in that: The few cases based on this tort in the employee e-mail context have dismissed the claim and are summarized as follows:
    1. Publicity Given To Private Life. This tort creates liability against one who gives publicity to private, personal information if the disclosure would be highly offensive to a reasonable person, and if the matter is not of legitimate public concern. Like defamation, this tort is limited by First Amendment concerns regarding the freedom of speech / press to publicize true facts. Since publicity here essentially means disclosure to a large number of people, dissemination of private information via the Internet would qualify. The tort is limited in that the matter must be private and the behavior offensive as noted above.
    2. Placing a Party in a False Light. This tort creates liability against one who gives publicity to a matter concerning another that places the other in a false light if the false light would be highly offensive to a reasonable person, and if the actor had knowledge or acted in reckless disregard as to the falsity. This tort could be applied to misinformation published on the web subject to the offensiveness and scienter limitations.
    1. Right of Publicity. This tort creates liability against one who appropriates, to his own use or benefit, the name or likeness of another. It is recognized that one has a privacy interest in the exclusive use of his own identity. This interest is restricted however when inconsistent with First Amendment principles as when a newspaper publishes a the name or photograph of someone in connection with a newsworthy event. This principle was tested in the on-line context in Stern v. Delphi Internet Servs. Corp., 626 N.Y.S.2d 694. In this case, radio personality Howard Stern sued the Delphi system for using his photograph without permission in an advertisement for an on-line debate regarding Stern’s candidacy for governor of New York. The court held for Delphi on First Amendment grounds because of the newsworthy quality of the event.
  1. Intentional Infliction of Emotional Distress
This tort might be applicable in the employer / employee context whereby the employer intentionally or recklessly caused severe emotional distress to the employee by extreme and outrageous conduct. However, liability here would only seem to attach in extreme situations. Ordinary employer monitoring of an employee’s communications on an employer-owned system would not likely constitute "outrageous" conduct. Misuse or threatened unprivileged dissemination of acquired information or more extensive monitoring of personal messages than the business purpose requires would need to be shown. Further, the employee would have to show actual injury in order to establish employer liability.
  1. Conversion
The tort of conversion has been recognized in the on-line context in the Cyber Promotions case where the excessive storage of junk e-mail on CompuServe’s computers represented a "taking". In relation to ordinary consumers, forced downloading of junk e-mail / files that is paid for by the consumer in access fees may, likewise, be actionable.
  1. Trade Secret Laws
A tort action will lie for misappropriation of trade secrets if there is an actual trade secret, and if there is either a breach of confidence regarding that secret or the secret is accessed by improper means. The first element here is that the information must be secret whereby the owner has taken sufficient measures to maintain that secrecy. If company private information is communicated by businesses on-line, then the company must take steps (e.g., encryption) to protect it. A company might also form an agreement with an ISP regarding the secrecy of its data kept within an ISP database. Under such a confidential relationship, the ISP would be liable for damage to the company if the data were disclosed. A trade secret claim could also be made against any hacker that damaged a company through gaining unauthorized access to its data.
  1. New Jersey Wiretapping Statute, NJSA 2A:156A et seq.
Most states have enacted wiretap statutes which provide comparable protection to that of the ECPA. State statutes are generally not preempted by the ECPA if they afford greater privacy protection than the ECPA. As such, it is possible for activities of ISPs and employers that are exempt under the ECPA to, nevertheless, create liability under state statutes. However, privacy protection under these statutes is generally not much greater than that afforded by the ECPA. In fact, New Jersey has a provision expressly favoring law enforcement, which states that a court order may require ISPs to create and release backup copies of private communications for preservation as evidence. Self Regulation
  1. The Industry View


    2. Beyond legal regulation of privacy issues, non-mandatory guidelines and self interest may provide a framework for privacy protection in the on-line world. Government intervention may not be the appropriate solution because of the difficulty of keeping laws current with the technology and because of the possibility of inhibiting technological and commercial progress. In support of this view, industry has argued that: market pressures will force self regulation regarding privacy of information as users make their privacy preferences known. In light of the universal interest in promoting the benefits of networking technology, it is argued that ISPs, employers, and other players will not engage in activity that is so invasive as to frustrate use of e-mail and other systems.

  2. The Privacy View
In opposition to this, privacy advocates (e.g., Center for Democracy and Technology (CDT), Electronic Privacy Information Center (EPIC)) argue that in light of the actual privacy violations that have already occurred, self regulation has already failed. The argument is further made that, under non-mandatory guidelines, the companies that respect privacy and adhere to guidelines will be at a competitive disadvantage in comparison to those that do not. AOL's changed privacy policy (mentioned above) may be an indication that industry's self-regulation is on the decline, causing concern for on-line users.
 
  Self Help

Many individuals and businesses are turning to self-help approaches for solving their privacy and security needs. While the primary technique of ensuring the confidentiality of e-mail information is encryption, other means of hiding identity and transactional information are also in use.

  1. Encryption
Encryption has long been employed by the military establishment to secure information from hostile forces. But with the advent of ubiquitous digital communications in the commercial world has also come readily available and extremely powerful encryption software that rivals the effectiveness of military capabilities. The strong encryption schemes are for all practical purposes "unbreakable."
 
 
  1. Symmetrical Encryption
This type of encryption has been in use since ancient times. The approach here is that a sender uses a particular code key to encrypt a message. The receiver must be in possession of the same key to de-encrypt the message. The problem with this scheme is that it is impractical to distribute a confidential key to more than a small number of trusted parties. The U.S. military has used this approach under the Defense Encryption Standard (DES) in conjunction with complex key management schemes to control how keys are transmitted / distributed to maintain the integrity of the system. 2. Asymmetrical Encryption A more recent approach is asymmetrical encryption whereby separate Private and Public Keys are used to encrypt / de-encrypt messages. Although the private and public keys are mathematically related, knowledge of one is insufficient to allow computation of the other. With asymmetric encryption, the sender will use a private key to encrypt a message that may only be de-encrypted with the corresponding public key possessed by the receiver. The private key must be kept confidential and is only possessed by its owner. The public key, in contrast, can be possessed by any number of arbitrary persons since it is of no value except as the complement to the private key.

A potential flaw in this scheme is that individuals using the public key need to be assured that this key is indeed associated with the bona fide sender and not an impostor. One solution is to employ trusted Certification Authorities (CAs) that can vouch for and verify the binding between public keys and their proper owners. There are a number of commercial software packages providing asymmetrical encryption capabilities (e.g., Secure Messenger, RSA, PGP, Viacrypt). In addition, companies like Verisign and GTE are providing CA services.
  1. Confidential Communications on the Internet
The use of encryption to ensure confidentiality is of special concern for attorneys because of their special ethical responsibilities. Specific considerations that should be weighed by attorneys in deciding to communicate without encryption over an unprotected network (such as the Internet) include possible:
  1. Legislation
    1. Current U.S. Policies


      2. In the United States, up until December 1996, the export of cryptographic products was controlled by the Department of State via the Arms Export Control Act under the department's International Traffic in Arms Regulations (ITAR). Under the ITAR, no cryptographic product could be exported without an export license issued by the Department of State, and licenses were generally not granted for products that provide "strong" encryption (e.g., greater than 40 bit codes). However, in December 1996 under Executive Order 13026, President Clinton transferred the responsibility for control of export of cryptographic products to the Department of Commerce. To this end, the President amended the Export Administration Regulations (EAR) as part of a plan to implement a worldwide key management infrastructure featuring key escrow and key recovery provisions.

      To provide for a transition period for the development of this key management infrastructure, the present EAR rule permits the export and re-export of 56-bit key length DES or equivalent strength encryption items under the authority of a License Exception, if an exporter makes satisfactory commitments to build and/or market recoverable encryption items, and to help build the supporting international infrastructure. This policy applies to both hardware and software.

      Both privacy and electronic commerce advocates are now calling for legislation to change these restrictive policies.
       
       
       
       
       
       

    2. U.S. Government Clipper Initiatives
In the face of inexpensive commercial encryption packages that are essentially bullet-proof, law enforcement has argued that its ability to control crime will be seriously degraded. Thus the "Clipper" initiatives have been proposed as a means of implementing private security while at the same time allowing law enforcement to decrypt secure data for legitimate purposes. Over time, three different plans have been proposed:
    1. Clipper I. This was a 1993 proposed hardware solution where communications would be uniquely identified using keys permanently embedded in hardware (i.e., the clipper chip). This was intended to provide a "back door" to government to permit legitimate eavesdropping of otherwise confidential communications.
    2. Clipper II. This was a 1995 proposed mandatory Commercial Key Escrow (CKE) framework for public key encryption that would allow businesses to select their own encryption algorithms but which also would provide the government with means to gain access to encrypted data.
    3. Clipper III. This is also called the Electronic Data Security Act of 1997 (3/12/97) draft legislation, and is a proposal for a Key Management Infrastructure (KMI) for public key encryption whereby private CA and key escrow entities would operate under government policies. To participate in the system, users would have to make sure their private keys were deposited with trusted agents that would be permitted to release the keys to the government for purposes of law enforcement.
To date, none of the Clipper proposals have been formally approved or made mandatory in the commercial sector. Conformance with Clipper policies is only mandatory at present for contracts with government.
    1. Secure Public Networks Act, S. 909
This bill was sponsored by Sen. McCain (6/16/97) to allow the use of any encryption desired, except as otherwise provided by the bill or by law. The bill would prohibit the Federal Government or a State from requiring the escrow of an encryption key with a 3rd party. Key recovery agents would be required to disclose recovery information to government for specified lawful purposes.

Regarding the export of encryption, the Secretary of Commerce is granted jurisdiction over the export of commercial encryption products and the sole duty to issue export licenses on such products. The President is authorized to increase the encryption strength for products permitted to be exported. The bill criminally prohibits export if the Secretary finds that a product would be: (1) used in acts against the national security, public safety, transportation systems, communications networks, or essential systems of interstate commerce; (2) diverted to a military, terrorist, or criminal use; or (3) re-exported without authorization.
    1. Security and Freedom Through Encryption (SAFE) Act of 1997, H.R. 695


      2. This bill was sponsored by Rep. Goodlatte (02/12/97) and is intended to relax U.S. export controls on encryption. Several amendments have been proposed The original Goodlatte language has been substantially amended by five House committees to provide law enforcement with easy access to encrypted information. Rep. Solomon (R-NY), chairman of the House Rules Committee, has indicated that he will not send the legislation to the House floor unless it contains domestic controls providing law enforcement access.

    2. Encrypted Communications Privacy Act of 1997, S. 376
This bill was sponsored by Sen. Leahy (02/27/97) to allow any person to make non-criminal use of encryption, regardless of algorithm or key length. The bill prohibits Federal or State Government from requiring that a decryption key be given to another person.
    1. Computer Security Enhancement Act of 1997, H.R. 1903
This bill was sponsored by Rep. Sensenbrenner (06/17/97) to amend the National Institute of Standards and Technology Act to require NIST to: (1) assist in establishing voluntary interoperable standards and guidelines to facilitate the establishment of non-Federal public key management infrastructures that can be used to conduct transactions with the Federal Government; and (2) provide assistance to Federal agencies in the protection of computer networks. The bill was passed in the House and is under consideration by the Senate.
 
 
 
 
    1. Promotion of Commerce On-Line in the Digital Era (Pro-CODE) Act of 1997, S. 377
This bill was sponsored by Sen. Burns (2/27/97) to prohibits the Secretary of

Commerce (acting through NIST or otherwise) from promulgating or enforcing regulations, or otherwise carrying out policies: (1) that result in encryption standards intended for use by businesses or entities other than Federal computer systems; or (2) or that have the effect of imposing Government-designed encryption standards on the private sector by restricting the export of computer hardware and computer software with encryption capabilities.
  1. Pseudonyms
To protect their interest in anonymity, on-line users frequently use pseudonyms in making public statements. Many ISPs allow users to adopt pseudonyms in "signing" public messages posted on the electronic bulletin boards provided by the ISP. Although laudable in its promotion of free speech, unfortunately this practice has also been abused by some users in perpetrating child pornography, defamation, and copyright infringement.
  1. Anonymous Remailers
Anonymous remailers are special on-line services that receive messages from users, strip their identifying information and then forward them to their intended destination. In this case, the source of the message can only be traced back to the remailer and not to the original sender. This provides the same free speech benefits as for pseudonyms with the same dangers for abuse.

D. Use of Digital Cash

One of the primary benefits of using ordinary cash in a commercial transaction is the fact that it cannot be traced back to the purchaser. Digital "cash" schemes are now being used to provide this same privacy attribute. Although it might appear as though the only people with a real need for the ability to spend anonymously are criminals, this is not really true. It is also desirable to many people to be able to conduct anonymous transactions in the interest of protecting a variety of personal data, a privacy interest already compromised in the context of credit card purchases.

E. ISPs, Firewalls, the Anonymizer, and Cookie Killers
  1. If a user accesses the Internet through an ISP such as AOL, CompuServe and others, the ISP’s proxy server acts as an intermediary to protect the user’s identity and e-mail address. Web sites that try to trace the user’s location will only be able to do so as far as the proxy server. In this case, only the ISP could trace the user’s "clickstream" data. Intranets that are protected by firewalls will likewise provide this same protection. A firewall is a piece of software operating on the computer that acts as the gateway from a private network to the Internet. The firewall software provides an intelligent "filter" between networks that monitors message traffic and screens out unauthorized data.
  2. The Anonymizer is a special web service at www.anonymizer.com that may be used to block web sites from collecting user information. The user simply goes to that site, and then makes all subsequent links from there. It prevents collection of source and other data, or the introduction of cookies onto the user computer. The only disadvantage is that it will slow down the access time involved in surfing from site to site. The Anonymizer also provides a sample service whereby it can display to you the type of information that can be collected as a result of your visiting that site. For example, it may display your site provider, approximate geographic location, and browser type.
  3. There are also software programs available to control the placement of cookies on a user’s computer. As mentioned, browsers such as Netscape and Internet Explorer allow users to set options to provide notice when a web site is attempting to place a cookie. Further, there are programs such as "Cookie Cutter", "Cookie Crusher", and "Cookie Master" that both permit removal of existing cookies and prevent the placement of new cookies.
Other Means to Enhance Privacy
  1. Universal Registration Systems (I/Code system)
This is a system proposed by the Internet Profiles Corporation whereby users register personal data with the I/Code system and then receive a unique identifier that allows anonymous browsing. This approach attempts to protect both privacy and market interests in that anonymity is protected, while aggregate demographic information may still be collected for marketing analysis. The aggregate data could not, however, be traced to an individual.

B. Cookies

A use beneficial to privacy has actually been proposed for the much maligned "cookie". Instead of being used as an information gathering tool, a cookie could be used to store privacy preference data. Once the user communicated his privacy preference to the web site, the site would honor requests for consent and notice regarding collection of information. The only catch here is that voluntary compliance by the web site would be required.

Another beneficial effect of cookies is to prevent exposure to unwanted or repetitious advertising. Since the cookie stores user preference information, it may be used to filter advertisements that are irrelevant to the user or to keep track of whether a given advertisement has already been viewed.

C. Platform for Internet Content Selection (PICS)

This system was initially developed by the WWW Consortium at MIT for the purpose of allowing parents to block children’s access to sites that were deemed "objectionable" in terms of pornographic, violent, or hateful content. Under this approach, when a user attempts to access a given web site, the PICS software first checks with a central database to determine if the site has been marked as "objectionable". If so, the user’s access to the site will be blocked. However, because the system itself is "viewpoint neutral," it could also be used to rate sites regarding the privacy protections that they make available. Using this system, those sites not listed as secure would be blocked from access. Like any censoring approach, PICS is however subject to abuse in the "ratings" system.

 Conclusions

The problems involved in maintaining personal privacy will continue to be issues of debate and dispute and the impetus for new laws for the foreseeable future. As society progresses further into the information age, personal data will be collected and exploited at an ever expanding rate. In addition, the technological means to accomplish this will continue to evolve at a pace that will challenge and perhaps confound the legal profession. Our present privacy laws, already out of date, will be further stretched and likely made even less effective in providing protection. As seen, laws like the ECPA have already been severely weakened by on-line communications technology. For example, because the ECPA allows access to stored communication, this means from a practical perspective that all e-mail is accessible by employers and ISPs. Other legal approaches such as tort law have been held to provide little, if any, protection.

At least from the communications perspective, the self help remedy of public key encryption appears to be the best near term solution to privacy concerns. Efforts to limit domestic encryption thus far have failed, and a number of effective and inexpensive software and service packages are now available. The strong societal interest in fostering electronic commerce will likely cause continued support for and a ubiquitous presence of encryption. However, law enforcement will continue to demand a means for access to encrypted data as no satisfactory compromise with privacy advocates has yet been proposed.

Threats to privacy of personal information are not easily solved by self help, and further legal protection is needed. While the PPA and the proposed Consumer Internet Privacy Protection Act are steps in the right direction, stronger regulation must still be considered. Given the propensity and incentives for entities to probe into the personal affairs of the private individual, the need for protection will continue to be critical. The very existence of web sites such as "The Stalker’s Home Page" make this point abundantly clear.
 
 

Sample Company Policies for Control of Computer Information, Voice Mail, E-mail and the Internet

  1. Sample Policy: Introduction
  1. Prohibited Uses and Communications
Computer Systems are not to be used to send or store any material of a personal character, other than occasionally and incidentally. The following types of communication are strictly prohibited:
  1. Monitoring of Computer Systems
  1. Internet Policy: Permitted Uses
  1. Internet Policy: Prohibited Uses