Changes: Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace

Revision as of 01:23, 16 November 2013

Citation

Government Accountability Office, Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace (GAO-13-663) (Sept. 25, 2013) (full-text).

Overview

The current statutory framework for consumer privacy does not fully address new technologies — such as the tracking of online behavior or mobile devices — and the vastly increased marketplace for personal information, including the proliferation of information sharing among third parties. With regard to data used for marketing, no federal statute provides consumers the right to learn what information is held about them and who holds it.

In many circumstances, consumers also do not have the legal right to control the collection or sharing with third parties of sensitive personal information (such as their shopping habits and health interests) for marketing purposes. As a result, although some industry participants have stated that current privacy laws are adequate — particularly in light of self-regulatory measures under way — the GAO found that gaps exist in the current statutory framework for privacy. And that the framework does not fully reflect the Fair Information Practice Principles, widely accepted principles for protecting the privacy and security of personal information that have served as a basis for many of the privacy recommendations federal agencies have made.

Views differ on the approach that any new privacy legislation or regulation should take. Some privacy advocates generally have argued that a comprehensive overarching privacy law would provide greater consistency and address gaps in law left by the current sector-specific approach. Other stakeholders have stated that a comprehensive, one-size-fits-all approach to privacy would be burdensome and inflexible. In addition, some privacy advocates have cited the need for legislation that would provide consumers with greater ability to access, control the use of, and correct information about them, particularly with respect to data used for purposes other than those for which they originally were provided.

At the same time, industry representatives have asserted that restrictions on the collection and use of personal data would impose compliance costs, inhibit innovation and efficiency, and reduce consumer benefits, such as more relevant advertising and beneficial products and services. Nonetheless, the rapid increase in the amount and type of personal information that is collected and resold warrants reconsideration of how well the current privacy framework protects personal information. The challenge will be providing appropriate privacy protections without unduly inhibiting the benefits to consumers, commerce, and innovation that data sharing can accord.

The GAO was asked to examine privacy issues and information resellers. This report addresses (1) privacy laws applicable to consumer information held by resellers, (2) gaps in the law that may exist, and (3) views on approaches for improving consumer data privacy.

The GAO recommends that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the increased market for consumer information. Any changes should seek to provide consumers with appropriate privacy protections without unduly inhibiting commerce and innovation.

@@ Line 7: / Line 7: @@
 The current [[statutory]] framework for [[consumer privacy]] does not fully address new technologies &mdash; such as the [[tracking]] of [[online behavior]] or [[mobile device]]s &mdash; and the vastly increased marketplace for [[personal information]], including the proliferation of [[information sharing]] among [[third parties]]. With regard to [[data]] used for [[marketing]], no federal [[statute]] provides [[consumer]]s the right to learn what [[information]] is held about them and who holds it.
-In many circumstances, [[consumer]]s also do not have the legal right to control the [[data collection|collection]] or [[data sharing|sharing]] with [[third parties]] of [[sensitive personal information]] (such as their shopping habits and health interests) for [[marketing]] purposes. As a result, although some industry participants have stated that current privacy laws are adequate--particularly in light of self-regulatory measures under way--GAO found that gaps exist in the current statutory framework for privacy. And that the framework does not fully reflect the Fair Information Practice Principles, widely accepted principles for protecting the privacy and security of personal information that have served as a basis for many of the privacy recommendations federal agencies have made.
+In many circumstances, [[consumer]]s also do not have the legal right to control the [[data collection|collection]] or [[data sharing|sharing]] with [[third parties]] of [[sensitive personal information]] (such as their shopping habits and health interests) for [[marketing]] purposes. As a result, although some industry participants have stated that current [[privacy law]]s are adequate &mdash; particularly in light of [[self-regulatory]] measures under way &mdash; the [[GAO]] found that gaps exist in the current [[statutory]] framework for [[privacy]]. And that the framework does not fully reflect the [[Fair Information Practice Principles]], widely accepted principles for protecting the [[privacy]] and [[security]] of [[personal information]] that have served as a basis for many of the [[privacy]] recommendations federal agencies have made.
-Views differ on the approach that any new privacy legislation or regulation should take. Some privacy advocates generally have argued that a comprehensive overarching privacy law would provide greater consistency and address gaps in law left by the current sector-specific approach. Other stakeholders have stated that a comprehensive, one-size-fits-all approach to privacy would be burdensome and inflexible. In addition, some privacy advocates have cited the need for legislation that would provide consumers with greater ability to access, control the use of, and correct information about them, particularly with respect to data used for purposes other than those for which they originally were provided. At the same time, industry representatives have asserted that restrictions on the collection and use of personal data would impose compliance costs, inhibit innovation and efficiency, and reduce consumer benefits, such as more relevant advertising and beneficial products and services. Nonetheless, the rapid increase in the amount and type of personal information that is collected and resold warrants reconsideration of how well the current privacy framework protects personal information. The challenge will be providing appropriate privacy protections without unduly inhibiting the benefits to consumers, commerce, and innovation that data sharing can accord.
+Views differ on the approach that any new [[privacy]] [[legislation]] or [[regulation]] should take. Some [[privacy]] advocates generally have argued that a comprehensive overarching [[privacy law]] would provide greater consistency and address gaps in law left by the current [[sector-specific]] approach. Other [[stakeholder]]s have stated that a comprehensive, one-size-fits-all approach to [[privacy]] would be burdensome and inflexible. In addition, some [[privacy]] advocates have cited the need for [[legislation]] that would provide [[consumer]]s with greater ability to [[access]], control the use of, and correct [[information]] about them, particularly with respect to [[data]] used for purposes other than those for which they originally were provided.
+At the same time, industry representatives have asserted that restrictions on the [[data collection|collection]] and use of [[personal data]] would impose compliance costs, inhibit [[innovation]] and [[efficiency]], and reduce consumer benefits, such as more relevant [[advertising]] and beneficial products and services. Nonetheless, the rapid increase in the amount and type of [[personal information]] that is [[data collection|collected]] and resold warrants reconsideration of how well the current [[privacy]] framework protects [[personal information]]. The challenge will be providing appropriate [[privacy protection]]s without unduly inhibiting the benefits to [[consumer]]s, commerce, and [[innovation]] that [[data sharing]] can accord.
+The [[GAO]] was asked to examine [[privacy]] issues and [[information reseller]]s. This report addresses (1) [[privacy law]]s applicable to [[consumer information]] held by [[information reseller|resellers]], (2) gaps in the law that may exist, and (3) views on approaches for improving [[consumer]] [[data privacy]].
+The GAO recommends that Congress consider strengthening the [[consumer privacy]] framework to reflect the effects of changes in [[technology]] and the increased market for [[consumer information]]. Any changes should seek to provide [[consumer]]s with appropriate [[privacy protection]]s without unduly inhibiting commerce and [[innovation]].