Privacy market opportunists begin with the assumption that, even though privacy may be a `fundamental human right', that does not mean that individuals should not have the ability to decide for themselves how much that right is worth to them personally, and whether to sell, trade or give away their private information in their own self-interest.[4]
Belgum notes that the Internet is the ideal environment for marketing personal data by facilitating the documented offer and acceptance of the necessary contract terms. Shaffer[5] also notes a discernible trend of replacing the current liability regime with a property or contractual exchange of personal data for some benefit. The posting of website privacy notices is central to this process.
This perspective focuses not on protecting society from the debilitating effects of loss of privacy, nor promoting a transfer of ownership rights in personal data from appropriators to data subjects, forcing markets in such information to develop. Instead, the main concern of the `privacy peacemakers' is to ensure that privacy fears-well founded or otherwise-do not impede the continued growth of online commerce.[6]Belgum anticipates that this approach will focus on protection where it is most visible and therefore reassuring, such as privacy notices. Privacy notices accordingly perform a `peacemaker' role in that they are accessed mainly by a vocal minority who are savvy about such privacy issues as opt-out rights. (This article argues, however, that their role is likely to become increasingly salient to the average user).
Australia is a signatory to the International Covenant on Civil and Political Rights. Article 17 of the Covenant enshrines a broadly expressed right to privacy. This is noted in the preamble to the Privacy Act. It follows that in Australia privacy is indeed `a fundamental human right'. The position is complicated, however, by the recognised role of actual consent in delineating the scope of enjoyment of this right. To this extent the three approaches Belgum identifies are less inconsistent than may initially appear. In any event, website privacy notices play a key role for each of these three alternative approaches to online `privacy'.
Whenever a visit to a website is made, the site's ISP records the visit and logs information on such `clickstream' data as the visitor's IP server address (the address enabling computers to know where to send the visitor data), the visitor's top level domain name (such as .com or .au), the date and time of the visit, and the pages accessed and documents downloaded. The website may utilise this information on interaction patters to reconfigure it or to sell advertising.
A `cookie' is data that the website servers send to the visitor's browser and is stored on her computer. That data automatically allows the website to recognise the visitor's computer as one that it has interacted with before and to recall details of such interaction with the site, such as search words previously used and time spent reading particular pages. This facilitates surfing by retaining screen preferences, storing passwords, and creating virtual shopping carts. The visitor may also be spared the same ad repeatedly during the visit. Paradoxically, this `personalisation' of the site has been championed by some as the implementation of traditional values. Thus the CEO of Amazon.com has described his philosophy of `mass customisation' as reflecting his desire `to transport online bookselling back to the days of the small bookseller who got to know you very well'.[7]
Whereas cookies may be sessional, they are often persisting. As such they may display a detailed list of each website visited during a specific period. The text of the cookie file may also reveal personal information previously provided and from what site the visitor came. In the case of banner ad cookies, this may extend to reading cookies sent by other banner ads from other sites if owned by the same direct marketing company. It has been pointed out that `since these advertisements are not really part of the web page but are provided by the advertiser's Web server, the advertiser is also able to exchange identifying information with the user's browser'.[8] In these circumstances the `advertisements' have been characterised as `spy links' whose objective is to gather information on the browsing habits of individuals. Rosen[9] points out that the exposure of browsing habits may easily distort an individual's public identity by focusing on data fragments that are peripheral yet easily exaggerated, such as the most salacious porn site visited. More generally, personal data culled from various sources are collated to compile detailed lifestyle profiles.
information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can be reasonably ascertained, from the information or opinion.An initial problem is that `information' is a concept that cannot be applied precisely to the online digital environment, the building blocks of which are `data'. Data are the online representations of information or concepts. `Information' is the interpretation of data. The potential lack of correspondence between the two concepts is indicated by a decision under the New Zealand Privacy Act to enforce access rights to `personal information' stored in a person's memory.[10] But while information is not necessarily data, in the online environment data effectively amounts to information and this article uses both terms.
The precise ambit of `personal information' online becomes even fuzzier due to the cookies' feature in browser software. Cookies do not collect `personal information' as such, insofar as they allow for the recognition of a computer's IP address. The identity of the operator of the computer will not be apparent unless that visitor voluntarily identifies herself, such as through registration. Even in the banner ad scenario described above, an individual must give out personal information in response to at least one of the `advertisements' if the data are to be exchanged through the user's browser. The precariousness of retaining online anonymity is nonetheless indicated.
The fragility of the distinction between cookies and personal data is further demonstrated by the DoubleClick controversy. Cookies enabled DoubleClick to send targeted ads. But following its purchase of Abacus Direct's database of names, addresses and buying habits, DoubleClick began collating the information, so that `suddenly shopping that once seemed anonymous was being archived in personally identifiable dossiers.'[11] (Subsequently the Electronic Privacy Centre (EPIC) filed a complaint with the Federal Trade Commission. The FTC eventually approved a set of self-regulatory guidelines negotiated with a group of online profiling companies.)
Other methods of linking virtual and real-world identities not involving cookies have provoked even greater consumer indignation. For example, in 1999 Intel Corporation introduced its Pentium 111 chip containing a serial number that allowed it to trace equipment. The subsequent outcry caused it to disable the numbers. Microsoft Word 97's embedding of invisible a unique identifier into documents produced a similar uproar and the resultant withdrawal of the feature.
Given the tenuousness of the distinction it seems sensible that the Privacy Commissioner's Guidelines appear to treat the simple deployment of cookies as collecting `personal information' insofar as his `tip' on this is that `If an organisation collects personal information using a cookie, web bug or other means, it could give the NPP1.3 information clearly available on the website; for example it could be linked directly from the homepage and other pages that make use of the devices.'[12]
Most online activities such as reading news, shopping and searching for information can be efficiently delivered without the need to collect personal data from site visitors. To redress increased tracking activities EPIC has proposed a formal right to be anonymous online. The Australian Privacy Act provides this, stating that `wherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with an organisation.' (national privacy principle 8). The enforcement of this principle is necessary if the Net is to roll-back gratuitous registration programmes.
The US is replete with surveys demonstrating both a rising level of concern, increasing efforts by business to self-regulate. An American Express survey conducted last year of 11,000 consumers in 10 countries found that 79% identified privacy and security as major concerns in online shopping.[16] To similar effect is a comprehensive Business Week/ Harris Poll (2000)[17] that found that:
Consumer reluctance to engage due to privacy issues is the largest obstacle to any venture's success in this new marketplace. The full benefits of electronic commerce may never be fully realised if federal governments worldwide do not work with both industry and consumers to establish a global online privacy policy.
Three years on and Australian websites continue to fail to publish their privacy policies, according to the most recent `Internet Sweep' conducted by the Australian Competition and Consumer Commission on 23 September 2001. The sweep of 250 Australian sites was part of a wider, international 48-hour sweep by 48 agencies in conjunction with the International Marketing Supervisory Network. 27% of Australian e-tailers had posted privacy notices.[21] An earlier Australian study by Macklin[22] indicates that a small minority of these `privacy notices' will be adequate.
Unless privacy concerns are alleviated not only will e-commerce be hindered but, it would appear, so too will the market in personal information. Two recent surveys show that 40% of Americans who registered at websites admitted to providing false information, mainly because of privacy concerns, whereas the figure for European registrants was over 58%.[23] The simpler expedient of not providing any personal information is also on the increase, to avert the otherwise increasing torrent of spam.[24] [1] Australian Law Reform Commission, Privacy (Report No 22), Canberra 1983, 21
[2] Shaffer, Gregory `Globalization and Social Protection: the Impact of EU and International Rules in the Ratcheting Up of U.S. Privacy Standards' 25 Yale Law Journal of International Law' Winter 2000
[3] Belgum, Karl `Who Leads at Half-time: Three Conflicting Visions on Internet Privacy
[4] Id
[5] Schaffer, Supra
[6] Belgum, Supra
[7] Spector, Robert Amazon.com Harper Business. 2000
[8] Hinamen
[9] Rosen, Jeffrey `The Eroded Self' New York Times Magazine
[10] Re Application by L (1997) HRNZ 716 (CRT)
[11] Rosen, Jeffrey `The Eroded Self' New York Times Magazine
[12] www.privacy.gov.au
[13] Lessig, Laurence Codes and Other Laws of Cyberspace Basic Books 1999
[14] Rotenberg, Marc `Testimony and Statement for the Record Before the Committee on Commerce, Science and Transportation, U.S. Senate' July 11, 2001 www.epic.org
[15] Bergerson, Supra
[16] Cited in Consumers International, Infra
[17] `Its Time for Rules in Wonderland' Business Week March 2000
[18] Spector, Supra, 231
[19] Reith, Thomas `Consumer Confidence: The Key to Successful E-commerce in the Global Marketplace' 24 Suffolk Transnational Law Review Summer 2001, 467
[20] Consumers International `Privacy@net: An International Comparative Study of Consumer Privacy on the Internet' January 2001
[21] www.accc.gov.au
[22] Macklin, Ben `Australian Privacy and Security Website Survey 1999 6 Privacy Law & Policy Reporter, 1
[23] Killingsworth, Scott `Minding Your Own Business: Privacy Policies in Principle and in Practice' 7 Journal of Intellectual Property Law, 57 Fall 1999
[24] Harman, Army `Spam: The E-Mail Annoyance Gets Harder to Avoid' New York Times 26 December 2001