The trade-off between privacy and free Internet services in the United States (US) continues to evolve in a complex legal environment. Unlike many other countries, the US lacks a comprehensive or baseline privacy and data protection regime and instead relies on piecemeal legislation regarding certain sectors, such as health care or financial institutions.
This paper examines several aspects of the evolving US privacy debate in the context of the history of the Fair Information Practice Principles (“FIPPs”) first articulated in 1973. The FIPPs, which gave rise to a “notice and consent” regime that attempts to adjust the balance between individuals and the enterprises that collect information about them, continue to influence privacy discussions and proposals, as seen by current US privacy proposals.
Although the FIPPs never gave rise to comprehensive legislation in the US, they have formed the basis for enforcement by the Federal Trade Commission (“FTC”), which is the US agency charged with consumer privacy matters. Utilizing its broad powers, the FTC has taken numerous actions against prominent companies that are alleged to have misrepresented their policies regarding protection of personal data. The FTC’s enforcement actions have raised the profile regarding privacy in the US and helped fill the void caused by the absence of comprehensive privacy legislation. They have also influenced two major federal privacy proposals in 2012.
The first of these - Consumer Data Privacy in a Networked World by the Obama Administration - proposed a consumer privacy bill of rights for online activities based on a modified version of the FIPPs. The White House report suggested rights of individual control, transparency, respect for context, security, access and accuracy, focused collection and accountability that would be incorporated into voluntary codes of conduct enforced by the FTC.
The second proposal - Protecting Consumer Privacy in an Era of Rapid Change from the FTC -- similarly does not propose specific legislation, but instead encourages companies to develop “best practices” to make “privacy the ‘default setting’ for commercial data practices” to give consumers greater control over the collection and use of their data. The FTC’s proposal encourages adoption of principles of “privacy by design” simplified consumer choice and transparency in data collection practices and is meant as a possible template for legislation.
Developing and implementing a comprehensive privacy regime in the US continues to face many challenges. First, the US law generally does not recognize monetary value in a consumer’s personal data to allow for damages in a civil lawsuit. There is also considerable debate as to whether a consent-based regime based on the FIPPs remains viable in the Internet era, where individuals readily provide personal information in return for free services. Finally, there is major opposition to privacy legislation from companies with vested financial interests in the status quo that profit from use of consumers’ personal information. Notwithstanding these challenges, it is likely that pressure for adoption of baseline privacy protections in the US will continue to grow given consumers’ concerns with the use of their personal information online, evolving expectations regarding privacy because of rapid technological change, and the need for interoperability and consistency of privacy protections in an increasingly interconnected world.