Page 101 - Privacy in a Cyber Age Policy and Practice

88 PRIVACY IN A CYBER AGE

5. Increased Public Regulation of Sensitive Information?

A limited approach to curbing the privacy merchants would entail expand-
ing the American patchwork of sectoral laws that limit privacy violations
in one specific area or another. As Gina Stevens catalogues, “Federal laws
and regulations extend protection to consumer credit reports, electronic
communications, federal agency records, education records, bank records,
cable subscriber information, video rental records, motor vehicle records,
health information, telecommunications subscriber information, children’s
86
online information, and customer financial information.” One could add
more areas to this long but seemingly arbitrary list.
The patchwork of laws can be viewed as being based on a rationale that
treats differently three main areas—private information gleaned from pub-
lic records (e.g., information about homeownership), relatively sensitive
information (e.g., medical and financial information), and information
that is in effect deemed less sensitive (e.g., most information about con-
sumer choices). One can see the patchwork as being largely based on the
level of sensitivity of the information. Public records, therefore, are open
for dissemination online because this information was not private in the
first place; less sensitive information is considered to need little protec-
tion because its use by third parties causes no or little harm; and sensitive
information is protected. If one finds that some area is not well-protected,
the argument runs, one can add another “patch” of legislation to cover it.
The patchwork approach has two serious defects, one that is oft-cited
and one that is less often noted. It is widely recognized that the patchwork
lags woefully behind technological developments in the private sector.
Thus, legislation that attempts to cover uncovered areas is often “proposed”
and “drafted” without ever being enacted. For example, as one pro-
posed bill called for a federal requirement of a “Do Not Track” option for
online advertising. Another suggested bill would deal with the relatively
87
new technology of geolocation and mobile privacy. The Federal Trade
Commission is reportedly working on a regulatory framework governing
social networking sites in the wake of high-profile FTC complaints against
Google Buzz and Twitter. The FTC also plans to target smartphones, which
88
is a market that regulation has thus far left virtually untouched. How-
ever, none of these laws were enacted and they lag considerably behind
technological developments employed by the privacy merchants, and,
given the current antiregulatory climate, they are unlikely to be enacted
in the foreseeable future.
Less often noted is that the distinction between “sensitive” and “less
sensitive” information is much less obvious than it seems and is likely to
further weaken in the near future. Even if sensitive information such as