The late November settlement reached between Facebook and the Federal Trade Commission may be a benchmark moment for data privacy in the U.S. To date, the U.S. has not adopted any comprehensive data privacy regulations, but the volume of online data is now so great and our national dependence on the internet so extensive that I believe legislative intervention is inevitable. The question is – how soon?
The Facebook case, which arose from complaints filed in 2009 by the Electronic Privacy Information Center, invoked specific FTC regulations that are unknown to the majority of consumers, and I’d venture to bet, given my Silicon Valley upbringing, to most online marketers as well. Whether Facebook was conscious of these rules before it transgressed or not, who knows. It certainly should have been. And, well aware that they angered many of their users, they are now claiming significant changes to protect privacy and honor disclosure policies.
Still, the selling of personal information by any number of entities who collect it, which nowadays can go anywhere in the world within minutes of data capture, pretty much ensures a collision course between users and vendors. It is quite possible that Facebook, with its massive user base, is the poster child for this issue, but there are many, many others in this mix.
This situation has garnered considerable attention in the U.S. Congress, with various proposals under discussion such as mandating ‘do not track’ options on web sites, providing ‘opt in ‘or ‘opt out’ options for data collection, compelling full disclosure of how gathered data is collected and used, and special considerations for highly sensitive data such as social security numbers, passport numbers and geo-location information.
There is no specific bill currently under debate, but we may see some real legislation considered within the next 12-18 months that will impose general restrictions on corporate and government use of citizen data. Such legislation will undoubtedly impose hard-wired technical adjustment as well as changes to business practices. If Congress doesn’t act, I would expect to see watchdogs invoking the Facebook case as the new yardstick.