October 2011 Newsletter (Vol. 2.0)
October 24, 2011
Rules on Internet Privacy: E.U. and U.S.A.
By: Francine Prewitt
Rules improving privacy for internet users were first laid down in the European Union Directive 2002/58/EC commonly referred as the “Directive on Privacy and Electronic Communications”. The Directive was later amended by the ePrivacy Directive (2009/136/EC) as part of a package of new European Union Telecoms rules.
In the United States, the Federal Trade Commission was the first government agency to raise awareness on a need for legislation on internet privacy in a report published in December 2010. Following, Senators John Kerry and John McCain introduced “The commercial Privacy Bill of Rights Act of 2011” in April 2011.
The ePrivacy Directive and the Kerry-McCain Bill aim to provide conditions for a better enforcement of privacy rules; more specifically, they provide for regulations that protect and control personal information of internet users.
Both legislations adopt similar approaches with regard to the key elements of the reform but diverge for most part in their regulatory approach.
In substance, these legislations include:
The Right to Security: The ePrivacy Directive requires telecom operators and internet service providers to take strong security measures to protect the names, email addresses and bank account information of their customers, as well as data about every phone call and internet session they engage in. Similarly, in the Kerry-McCain bill, internet operators would be required to implement security measures to protect the information they collect and maintain.
The Right to be Informed: While the Kerry-McCain bill emphasizes on providing consumers with clear notice on the information collection and the purpose of such collection, the Directive focuses on providing internet users with better information about data stored and accessed in their computer, smart phone, or other devices connected to the internet. Moreover, the EU rules require operators, in case of a breach of security and/or loss (or theft) of personal data to inform the data protection authorities and their customers without undue delay.
The Right to Consent: In the Commercial Privacy Bill of Rights Act, collectors of information must provide internet users with the ability to opt-out of any unauthorized information collection. The bill also provide for express consent (opt-in) for the collection of sensitive information. On the other hand, in the EU rules, recipients of direct marketing communication must give their prior consent when those communications are sent through fax, automated calling system or e-mail. However, the user consent is not required in the case of cookies that directly relate to the provision of services requested by the user.
The E.U Directive goes a step further than the Kerry-McCain bill by prohibiting the direct marketing practice of sending electronic mail while concealing the identity of the sender on whose behalf the communication is made, or the address to which the recipient may send a request to stop these communications, or encouraging recipients to visit websites that contravene article 6 of Directive 200/31/EC. On the other hand, the Kerry-McCain bill allows internet providers to collect data only necessary to process a transaction, deliver a service unless the information is collected for research and development to improve the transaction or service.
Neither legislation has been, so far, as successful as intended. The ePrivacy Directive was supposed to be implemented by all EU
members by May 25, 2011. However, they have yet to be enforced by the vast majority of the EU member states (exceptions are Denmark, Estonia and the U.K, who have notified measures to implement the rules). This slow implementation of the Directive highlights difficulties encountered by European authorities in framing rules to protect consumer rights in all member states.
For its part, the Commercial Privacy Bill of Rights Act was introduced in the senate on April 12, 2011 and referred to the commerce, science, and transportation committee. However, as of the publication of this article,
the bill has yet to be adopted by the senate.
This publication is distributed with the understanding that the author, publisher and distributor are not rendering legal, accounting or other professional advice or opinions on specific facts or matters, and, accordingly, assume no liability whatsoever in connection with its use.