[Previous] [Next] [Title]

Part 1: Clickstream concerns

What is online `privacy'

The Australian Law Reform Commission has distinguished four distinct privacy interests
[1]. Adopting the Commission's terminology, two are engaged online, namely `information privacy' (concerned with the regulation of information relating to an identifiable individual or `personal information') and `surveillance and telecommunications privacy'. Tracking technologies ensure that personal data is collected with video-like precision, so that as Shaffer puts it `every purchase, page turned, call made, e-mail sent and key stroked can be archived, stored, filtered, correlated, networked, regressed, matched, connected, catalogued, categorized, compared and/or labelled'.[2] Consumers and commentators alike share concerns about the resultant lack of online privacy. There are, however, discernible differences in approach. In the context of the US debate Belgum[3] usefully characterises the main approaches as the `dossier society pessimists', `market opportunists' and `privacy peacemakers'.

`Dossier pessimists'

The dossier pessimists are concerned about the sheer quantity of personal data collected and stored and the increasingly sophisticated technologies developed to analyse this data. The resultant state of `dataveillance' is oppressive and impinges on human dignity. Belgum identifies as features of this approach an emphasis on imposing limitations on the collection and retention of personal data, and their use.

`Market opportunists'

For the market opportunist privacy is just another commodity:
Privacy market opportunists begin with the assumption that, even though privacy may be a `fundamental human right', that does not mean that individuals should not have the ability to decide for themselves how much that right is worth to them personally, and whether to sell, trade or give away their private information in their own self-interest.[4]

Belgum notes that the Internet is the ideal environment for marketing personal data by facilitating the documented offer and acceptance of the necessary contract terms. Shaffer[5] also notes a discernible trend of replacing the current liability regime with a property or contractual exchange of personal data for some benefit. The posting of website privacy notices is central to this process.

`Privacy peacemakers'

Belgum sees this approach as utilitarian:
This perspective focuses not on protecting society from the debilitating effects of loss of privacy, nor promoting a transfer of ownership rights in personal data from appropriators to data subjects, forcing markets in such information to develop. Instead, the main concern of the `privacy peacemakers' is to ensure that privacy fears-well founded or otherwise-do not impede the continued growth of online commerce.[6]
Belgum anticipates that this approach will focus on protection where it is most visible and therefore reassuring, such as privacy notices. Privacy notices accordingly perform a `peacemaker' role in that they are accessed mainly by a vocal minority who are savvy about such privacy issues as opt-out rights. (This article argues, however, that their role is likely to become increasingly salient to the average user).

Australia is a signatory to the International Covenant on Civil and Political Rights. Article 17 of the Covenant enshrines a broadly expressed right to privacy. This is noted in the preamble to the Privacy Act. It follows that in Australia privacy is indeed `a fundamental human right'. The position is complicated, however, by the recognised role of actual consent in delineating the scope of enjoyment of this right. To this extent the three approaches Belgum identifies are less inconsistent than may initially appear. In any event, website privacy notices play a key role for each of these three alternative approaches to online `privacy'.

Online privacy perils

Consumer concerns about online privacy are prompted by the sophistication of endemic tracking technologies applied to invade it. A distinction can be drawn between the log-files compiled by the website's Internet Service Provider (ISP) and the `cookie' software, which may be deployed by a site.

Whenever a visit to a website is made, the site's ISP records the visit and logs information on such `clickstream' data as the visitor's IP server address (the address enabling computers to know where to send the visitor data), the visitor's top level domain name (such as .com or .au), the date and time of the visit, and the pages accessed and documents downloaded. The website may utilise this information on interaction patters to reconfigure it or to sell advertising.

A `cookie' is data that the website servers send to the visitor's browser and is stored on her computer. That data automatically allows the website to recognise the visitor's computer as one that it has interacted with before and to recall details of such interaction with the site, such as search words previously used and time spent reading particular pages. This facilitates surfing by retaining screen preferences, storing passwords, and creating virtual shopping carts. The visitor may also be spared the same ad repeatedly during the visit. Paradoxically, this `personalisation' of the site has been championed by some as the implementation of traditional values. Thus the CEO of Amazon.com has described his philosophy of `mass customisation' as reflecting his desire `to transport online bookselling back to the days of the small bookseller who got to know you very well'.[7]

Whereas cookies may be sessional, they are often persisting. As such they may display a detailed list of each website visited during a specific period. The text of the cookie file may also reveal personal information previously provided and from what site the visitor came. In the case of banner ad cookies, this may extend to reading cookies sent by other banner ads from other sites if owned by the same direct marketing company. It has been pointed out that `since these advertisements are not really part of the web page but are provided by the advertiser's Web server, the advertiser is also able to exchange identifying information with the user's browser'.[8] In these circumstances the `advertisements' have been characterised as `spy links' whose objective is to gather information on the browsing habits of individuals. Rosen[9] points out that the exposure of browsing habits may easily distort an individual's public identity by focusing on data fragments that are peripheral yet easily exaggerated, such as the most salacious porn site visited. More generally, personal data culled from various sources are collated to compile detailed lifestyle profiles.

The Privacy Act and cookies

The Privacy Act regulates the collection and use of `personal information' which section 2 defines as:
information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can be reasonably ascertained, from the information or opinion.
An initial problem is that `information' is a concept that cannot be applied precisely to the online digital environment, the building blocks of which are `data'. Data are the online representations of information or concepts. `Information' is the interpretation of data. The potential lack of correspondence between the two concepts is indicated by a decision under the New Zealand Privacy Act to enforce access rights to `personal information' stored in a person's memory.[10] But while information is not necessarily data, in the online environment data effectively amounts to information and this article uses both terms.

The precise ambit of `personal information' online becomes even fuzzier due to the cookies' feature in browser software. Cookies do not collect `personal information' as such, insofar as they allow for the recognition of a computer's IP address. The identity of the operator of the computer will not be apparent unless that visitor voluntarily identifies herself, such as through registration. Even in the banner ad scenario described above, an individual must give out personal information in response to at least one of the `advertisements' if the data are to be exchanged through the user's browser. The precariousness of retaining online anonymity is nonetheless indicated.

The fragility of the distinction between cookies and personal data is further demonstrated by the DoubleClick controversy. Cookies enabled DoubleClick to send targeted ads. But following its purchase of Abacus Direct's database of names, addresses and buying habits, DoubleClick began collating the information, so that `suddenly shopping that once seemed anonymous was being archived in personally identifiable dossiers.'[11] (Subsequently the Electronic Privacy Centre (EPIC) filed a complaint with the Federal Trade Commission. The FTC eventually approved a set of self-regulatory guidelines negotiated with a group of online profiling companies.)

Other methods of linking virtual and real-world identities not involving cookies have provoked even greater consumer indignation. For example, in 1999 Intel Corporation introduced its Pentium 111 chip containing a serial number that allowed it to trace equipment. The subsequent outcry caused it to disable the numbers. Microsoft Word 97's embedding of invisible a unique identifier into documents produced a similar uproar and the resultant withdrawal of the feature.

Given the tenuousness of the distinction it seems sensible that the Privacy Commissioner's Guidelines appear to treat the simple deployment of cookies as collecting `personal information' insofar as his `tip' on this is that `If an organisation collects personal information using a cookie, web bug or other means, it could give the NPP1.3 information clearly available on the website; for example it could be linked directly from the homepage and other pages that make use of the devices.'[12]

Anonymity and the Internet

In the real world anonymity is the refuge sought by celebrities or scoundrels. Online everyone is accorded a degree of scrutiny that invites a similar respite. Lessig says that `whereas in real space-and here is the important point- anonymity has to be created, in cyberspace anonymity is the given'[13]. Cyberspace reveals no self-authenticating facts about identity, whereas in real space one reveal one's gender, age, and language spoken. Nonetheless, this `given' of online anonymity is being eroded more systematically than was ever feasible in the real world with the assistance of the technologies described above. Real world stores, publishers and broadcast media can only collect personal information with the participation of their customers or audience, but commentators have noted an increasing tendency of websites to require registration and to utilise tracing techniques to profile visitors.[14]

Most online activities such as reading news, shopping and searching for information can be efficiently delivered without the need to collect personal data from site visitors. To redress increased tracking activities EPIC has proposed a formal right to be anonymous online. The Australian Privacy Act provides this, stating that `wherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with an organisation.' (national privacy principle 8). The enforcement of this principle is necessary if the Net is to roll-back gratuitous registration programmes.

Consumer concerns about privacy online

The Internet is a relatively new phenomenon still `surrounded by an aura of both intrigue and scepticism'[15]. It has been observed that nervousness about the online solicitation of personal data may be enhanced by the fact that a website presents a purely electronic front that may disguise the identity of those behind it and hence their incentive to maintain a favourable reputation in the real world.

The US is replete with surveys demonstrating both a rising level of concern, increasing efforts by business to self-regulate. An American Express survey conducted last year of 11,000 consumers in 10 countries found that 79% identified privacy and security as major concerns in online shopping.[16] To similar effect is a comprehensive Business Week/ Harris Poll (2000)[17] that found that:

These concerns matter to individual e-tailors because online the balance of power has shifted from merchants to their consumers. Online the consumer can sample offerings and move on to those offered by competitors with a mouse click. Research at the University of Notre Dame has claimed that any two randomly selected pages on the World Wide Web are on average only 19 clicks away from each other.[18] More fundamentally, a collective failure of website sites to sufficiently address privacy concerns threatens the viability of the net as a trading medium. Reith[19] summarises these twin concerns:
Consumer reluctance to engage due to privacy issues is the largest obstacle to any venture's success in this new marketplace. The full benefits of electronic commerce may never be fully realised if federal governments worldwide do not work with both industry and consumers to establish a global online privacy policy.

Website privacy notice: few are adequate

Too few businesses appear to be listening to the documented role of privacy notices in reassuring customers and hence promoting e-commerce. Last year Consumers International conducted a comparative international study of online privacy assessing 300 European and US sites.[20] Interestingly it found that US based sites `tended to set the standard for decent privacy policies' rather than European ones. The report observes that lacking the legal protections present in Europe, US companies `have to make more effort to reassure their users that their privacy will be protected'. Other key findings of this international survey were that 67% of sites assessed collected personal information from visitors; 58% of such sites had a privacy notice, but only 32.5% of those sites alerted visitors to that policy at the point where the information was collected. Most importantly, Consumers International found that only a minority of those `privacy notices' actually gave visitors important information about the control they could have over their personal data.

Three years on and Australian websites continue to fail to publish their privacy policies, according to the most recent `Internet Sweep' conducted by the Australian Competition and Consumer Commission on 23 September 2001. The sweep of 250 Australian sites was part of a wider, international 48-hour sweep by 48 agencies in conjunction with the International Marketing Supervisory Network. 27% of Australian e-tailers had posted privacy notices.[21] An earlier Australian study by Macklin[22] indicates that a small minority of these `privacy notices' will be adequate.

Unless privacy concerns are alleviated not only will e-commerce be hindered but, it would appear, so too will the market in personal information. Two recent surveys show that 40% of Americans who registered at websites admitted to providing false information, mainly because of privacy concerns, whereas the figure for European registrants was over 58%.[23] The simpler expedient of not providing any personal information is also on the increase, to avert the otherwise increasing torrent of spam.[24] [1] Australian Law Reform Commission, Privacy (Report No 22), Canberra 1983, 21

[2] Shaffer, Gregory `Globalization and Social Protection: the Impact of EU and International Rules in the Ratcheting Up of U.S. Privacy Standards' 25 Yale Law Journal of International Law' Winter 2000

[3] Belgum, Karl `Who Leads at Half-time: Three Conflicting Visions on Internet Privacy

[4] Id

[5] Schaffer, Supra

[6] Belgum, Supra

[7] Spector, Robert Amazon.com Harper Business. 2000

[8] Hinamen

[9] Rosen, Jeffrey `The Eroded Self' New York Times Magazine

[10] Re Application by L (1997) HRNZ 716 (CRT)

[11] Rosen, Jeffrey `The Eroded Self' New York Times Magazine

[12] www.privacy.gov.au

[13] Lessig, Laurence Codes and Other Laws of Cyberspace Basic Books 1999

[14] Rotenberg, Marc `Testimony and Statement for the Record Before the Committee on Commerce, Science and Transportation, U.S. Senate' July 11, 2001 www.epic.org

[15] Bergerson, Supra

[16] Cited in Consumers International, Infra

[17] `Its Time for Rules in Wonderland' Business Week March 2000

[18] Spector, Supra, 231

[19] Reith, Thomas `Consumer Confidence: The Key to Successful E-commerce in the Global Marketplace' 24 Suffolk Transnational Law Review Summer 2001, 467

[20] Consumers International `Privacy@net: An International Comparative Study of Consumer Privacy on the Internet' January 2001

[21] www.accc.gov.au

[22] Macklin, Ben `Australian Privacy and Security Website Survey 1999 6 Privacy Law & Policy Reporter, 1

[23] Killingsworth, Scott `Minding Your Own Business: Privacy Policies in Principle and in Practice' 7 Journal of Intellectual Property Law, 57 Fall 1999

[24] Harman, Army `Spam: The E-Mail Annoyance Gets Harder to Avoid' New York Times 26 December 2001

[Previous] [Next] [Title]