THIS SEARCH THIS DOCUMENT THIS CR ISSUE GO TO
Next Hit Forward Next Document New CR Search
Prev Hit Back Prev Document HomePage
Hit List Best Sections Daily Digest Help
Doc Contents
(A) the Children's Online Privacy Pr otection Act of 1998;
[Page: S7670] GPO's PDF
(B) the Gramm-Leach-Bliley Act; or
(C) the Health Insurance Portability and Accountability Act of 1996.
(f) CIVIL PENALTY.--In addition to any other penalty applicable to a violation of section 2(a), there is hereby imposed a civil penalty of $22,000 for each such violation. In the event of a continuing violation, each day on which the violation continues shall be considered as a separate violation for purposes of this subsection. The maximum penalty under this subsection for a related series of violations is $500,000. For purposes of this subsection, the violation of an order issued by the Commission under this Act shall not be considered to be a violation of section 2(a) of this Act.
SEC. 4. ACTIONS BY STATES.
(a) IN GENERAL.--
(1) CIVIL ACTIONS.--In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates section 2(a) or (b), the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to--
(A) enjoin that practice;
(B) obtain damage, restitution, or other compensation on behalf of residents of the State; or
(C) obtain such other relief as the court may consider to be appropriate.
(2) NOTICE.--
(A) IN GENERAL.--Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Commission--
(i) written notice of that action; and
(ii) a copy of the complaint for that action.
(B) EXEMPTION.--
(i) IN GENERAL.--Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the attorney general determines that it is not feasible to provide the notice described in that subparagraph before the filing of the action.
(ii) NOTIFICATION.--In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.
(b) INTERVENTION.--
(1) IN GENERAL.--On receiving notice under subsection (a)(2), the Commission shall have the right to intervene in the action that is the subject of the notice.
(2) EFFECT OF INTERVENTION.--If the Commission intervenes in an action under subsection (a), it shall have the right--
(A) to be heard with respect to any matter that arises in that action; and
(B) to file a petition for appeal.
(3) AMICUS CURIAE.--Upon application to the court, a person whose self-regulatory guidelines have been approved by the Commission and are relied upon as a defense by any defendant to a proceeding under this section may file amicus curiae in that proceeding.
(c) CONSTRUCTION.--For purposes of bringing any civil action under subsection (a), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to--
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the production of documentary and other evidence.
(d) ACTIONS BY THE COMMISSION.--In any case in which an action is instituted by or on behalf of the Commission for violation of section 2(a) or (b) no State may, during the pendency of that action, institute an action under subsection (a) against any defendant named in the complaint in that action for violation of that rule.
(e) VENUE; SERVICE OF PROCESS.--
(1) VENUE.--Any action brought under subsection (a) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.
(2) SERVICE OF PROCESS.--In an action brought under subsection (a), process may be served in any district in which the defendant--
(A) is an inhabitant; or
(B) may be found.
SEC. 5. STUDY OF ONLINE PRIVACY. b>
(a) IN GENERAL.--Within 90 days after the date of enactment of this Act, the Commission shall execute a contract with the National Research Council of the National Academy of Sciences for a study of privacy th at will examine causes for concern about privacy in the information ag e and tools and strategies for responding to those concerns.
(b) SCOPE.--The study required by subsection (a) shall--
(1) survey the risks to, and benefits associated with the use of, personal in formation as sociated with information te chnology, including actual and potential issues related to trends in technology;
(2) examine the costs and benefits involved in the
collection and use of personal in
formation;
(4) examine the costs, risks, and benefits of providing consumer access to information co llected online, and examine approaches to providing such access;
(5) examine the security of personal in formation co llected online;
(6) examine such other matters relating to the collection, use, and protection of personal in formation on line as the Council and the Commission consider appropriate; and
(7) examine efforts being made by industry to provide notice, choice, access, and security.
(c) RECOMMENDATIONS.--Within 12 months after the Commission's request under subsection (a), the Council shall complete the study and submit a report to the Congress, including recommendations for private and public sector actions including self-regulation, laws, regulations, or special agreements.
(d) AGENCY COOPERATION.--The head of each Federal department or agency shall, at the request of the Commission or the Council, cooperate as fully as possible with the Council in its activities in carrying out the study.
(e) FUNDING.--The Commission is authorized to be obligate not more than $1,000,000 to carry out this section from funds appropriated to the Commission.
SEC. 6. DEFINITIONS.
In this Act:
(1) COMMISSION.--The term ``Commission'' means the Federal Trade Commission.
(2) COMMERCIAL WEBSITE OPERATOR.--The term ``operator of a commercial website''--
(A) means any person who operates a website located on the Internet or an online service and who collects or maintains personal in formation fr om or about the users of or visitors to such website or online service, or on whose behalf such information is collected or maintained, where such website or online service is operated for commercial purposes, including any person offering products or services for sale through that website or online service, involving commerce--
(i) among the several States or with 1 or more foreign nations;
(ii) in any territory of the United States or in the District of Columbia, or between any such territory and--
(I) another such territory; or
(II) any State or foreign nation; or
(iii) between the District of Columbia and any State, territory, or foreign nation; but
(B) does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).
(3) COLLECT.--The term ``collect'' means the gathering of personally identifiable information ab out a user of an Internet service, online service, or commercial website by or on behalf of the provider or operator of that service or website by any means, direct or indirect, active or passive, including--
(A) an online request for such information by the provider or operator, regardless of how the information is transmitted to the provider or operator;
(B) the use of an online service to gather the information; o r
(C) tracking or use of any identifying code linked to a user of such a service or website, including the use of cookies.
(4) INTERNET.--The term ``Internet'' means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio.
(5) PERSONALLY IDENTIFIABLE INFORMATION.-- The term ``personally identifiable information'' me ans individually identifiable information ab out an individual collected online, including--
(A) a first and last name, whether given at birth or adoption, assumed, or legally changed;
(B) a home or other physical address including street name and name of a city or town;
(C) an e-mail address;
(D) a telephone number;
(E) a Social Security number; or
(F) unique identifying information th at an Internet service provider or operator of a commercial website collects and combines with any information de scribed in the preceding subparagraphs of this paragraph.
(6) ONLINE.--The term ``online'' refers to any activity regulated by this Act or by section 2710 of title 18, United States Code, that is effected by active or passive use of an Internet connection, regardless of the medium by or through which that connection is established.
(7) THIRD PARTY.--The term ``third party'', when used in reference to a commercial website operator, means any person other than the operator.
Mr. KERRY. Mr. President, I am pleased to join Senators MCCAIN, BOXER and ABRAHAM in announcing that today we will be introducing a bill that takes a positive, balanced approach to the issue of Internet privacy. T here can be no doubt that consumers have a legitimate expectation of privacy on the Internet. Our bill protects that interest. At the same time, consumers want an Internet that is free. For that to happen, the Internet, like television, must be supported by advertising. Our bill will allow companies to continue to advertise, ensuring that we
[Page: S7671] GPO's PDF
If we recognize that the economy of the Internet calls for advertising, we must also recognize that it won't attract consumers if they believe their privacy is being violated. Finding this fine balance of permitting enough free flow of information to allow ads to work and protecting consumers' privacy is going to be critical if the Internet is going to reach its full potential. And I believe this bill strikes the right balance.
I think all of the bill's cosponsors were hopeful that self-regulation of Internet privacy wo uld work. And I think self-regulation still has an important role to play. But it seems that now it is up to Congress to establish a floor for Internet privacy. I have no doubt that many innovative high tech companies and advertisers will go beyond the regulations for notice and choice we provide here. A number of companies in my home state of Massachusetts already do, providing consumers with anonymity when they go online. I applaud and encourage those efforts and am certain that if Congress enacts this bill, they will continue.
But technology and innovation won't address all the concerns people have about Internet privacy. C ongress has the responsibility to ensure that core privacy pr inciples are the norm throughout the online world. We need to respond to the consumers who don't shop on the Internet because they are concerned about their privacy. T his is necessary not only for the sake of the consumers, but for every online business that wants to grow and attract customers.
The bill that we are introducing today will encourage those skeptical consumers to go online. This legislation will require Web sites to clearly and conspicuously disclose their privacy po licies. People deserve to know what information ma y be collected and how it may be used so that they can make an informed decision before they navigate around or shop on a particular Web site. They shouldn't have to click five times and need to translate legalese before they know what a site will do with their personal in formation. R equiring disclosure has the added benefit of providing the FTC with an enforcement mechanism. If a Web site fails to comply with its posted disclosure policy, the FTC can bring an action against it for unfair or deceptive acts. This is the bare minimum of what I believe consumers deserve and expect, and I don't think this would have any unintended or negative consequences on e-commerce.
In addition, this bill addresses the core principle of choice by requiring Web sites to offer consumers an easy to use method to prevent Web sites from using personally identifiable information fo r marketing purposes and to prevent them from selling that information to third parties. This bill empowers consumers and lets them make informed decisions that are right for them.
By ensuring consumers have the right to full disclosure and the right to not have their personally identifiable information so ld or disclosed, this bill addresses the most fundamental concerns many people have about online privacy. B ut I believe there are still a number of important questions that we need to answer. The first is whether there is a difference between privacy in the offline and online worlds.
Most of us hardly think about it when we go to the supermarket, but when Safeway or Giant scans my discount card or my credit card, it has a record of exactly who I am and what I bought. Should my preferences at the supermarket be any more or less protected than the choices I make online?
Likewise, catalog companies compile and use offline information to make marketing decisions. These companies rent lists compiled by list brokers. The list brokers obtain marketing data and names from the public domain and governments, credit bureaus, financial institutions, credit card companies, retail establishments, and other catalogers and mass mailers.
On the other hand, when I go to the shopping mall and look at five different sweaters but don't buy any of them, no one has a record of that. If I do the same thing online, technology can record how long I linger over an item, even if I don't buy it. Likewise, I can pick up any book in a book store and pay in cash and no one will ever know my reading preferences. That type of anonymity can be completely lost online.
This bill requires the National Research Council to study the issue of online versus offline privacy, a nd make a recommendation if there is a need for additional legislation in either area.
Likewise, this bill requires the Council to study the issue of access. While there is general agreement that consumers should have access to information th ey provided to a Web site, we still don't know whether it's necessary or proper for consumers to have access to all of the information ga thered about an individual. Should consumers have access to click-stream data or so-called derived data by which a company uses compiled information to make a marketing decision about the consumer? And if we decide consumers need some access to this type of information, i s it technology feasible? Will there be unforeseen or unintended consequences such as an increased risk of security breaches? Will there be less, rather than more privacy du e to the necessary coupling of names and data? I don't we are ready to regulate until we have some consensus on this issue.
Finally, it is important to add that this bill in no way limits what Congress has done or hopefully will do with respect to a person's health or financial information. W hen sensitive information is collected, it is even more important that stringent privacy pr otections are in place. I have supported a number of legislative efforts that would go far to protect this type of information. < p> Mr. ABRAHAM. Mr. President, today I rise to join with the Senator from Arizona, the Senator from Massachusetts, and the Senator from California in introducing the Consumer Privacy En hancement Act. This legislation will provide Americans with some basic--but critically important--protections for their personal in formation wh en they are online.
Privacy ha s always been a very serious issue to American citizens. It is a concept enshrined in our Bill of Rights. As persons from all walks of life become increasingly reliant on computers and the Internet to perform everyday tasks, it is incumbent upon policymakers to ensure that adequate privacy pr otections exist for consumers. We must ensure that our laws evolve along with technology and continue to provide effective privacy pr otection for consumers surfing the World Wide Web and using the Internet for commercial activities.
The American people are letting it be known that they have mounting concerns about their vulnerability in this digital age. They are very concerned about the advent of this new high-tech era we've entered and the new threats it potentially poses to our personal pr ivacy. A nd I believe there is a consensus building in Congress to begin to tackle the question of ensuring adequate privacy pr otections for individuals using the Internet.
Whether we can find a similar consensus on a particular legislative proposal remains to be seen. However, I think it is imperative that we begin to address this topic now and not simply wait until Congress reconvenes next year before we take the issue up. So I have joined my colleagues here in introducing legislation that I think accomplishes several important objectives.
The most important provision, I believe, is its most elemental concept: We require that before consumers are asked to provide personal in formation ab out themselves, they must be given an opportunity to review the website's privacy po licy in order to learn how their information wi ll be utilized. While many websites have privacy po licies, including the vast majority of those websites receiving the most traffic, there are still many websites out there that do not offer privacy po licies or adequate protections for consumers.
THIS SEARCH THIS DOCUMENT THIS CR ISSUE GO TO
Next Hit Forward Next Document New CR Search
Prev Hit Back Prev Document HomePage
Hit List Best Sections Daily Digest Help
Doc Contents