In the Press

InformationWeek

Is What's Good For Consumers Bad For Business? -- Opt-in laws could make it harder for companies to know their customers

By Eric Chabrow with Jennifer Maselli and John Rendleman

27 May 2002

From Washington to St. Paul, Minn., to Sacramento, Calif., and dozens of points in between, lawmakers in Congress and 36 state legislatures are advancing bills that would require businesses to get permission from consumers before personal information can be shared with others. If such opt-in laws are passed, there's concern that businesses may have to retool their IT systems to comply with stricter regulations in collecting data online-and, in some cases, through other means as well.

A bill signed into law last week by Minnesota Gov. Jesse Ventura may be the most lenient of the lot. It affects only Internet service providers that operate networks in the state, requiring them to place a "conspicuous" notice on their Web sites disclosing steps consumers can take to prevent disclosure of personal data. The law lets operators choose whether consumers grant permission before their data is distributed or whether permission is assumed unless consumers notify the company otherwise.

Other bills represent bigger potential changes. For instance, California's Financial Information Privacy Act of 2002, expected to be voted on soon, would require financial institutions to obtain the consent of customers before disclosing their data to third parties or affiliated companies, with certain exceptions. In the nation's capital, an online-privacy-protection bill sponsored by Senate Commerce Committee chairman Ernest Hollings, D-S.C., would require all companies to get permission from consumers before sensitive personal information collected online is shared. A competing measure in the House, sponsored by Rep. Cliff Stearns, R-Fla., assumes businesses have permission to share all personal data unless the consumer says otherwise.

If Congress chooses, any privacy law it passes can supersede those enacted by the states. That might be less confusing for businesses than if they had to comply with different state privacy rules, but there's no assurance a federal privacy law will be enacted soon.

The Senate bill's provision to let consumers sue for unauthorized data disclosure could dissuade companies from using the Internet as a sales channel. "I wouldn't say it would destroy Internet sales, but it clearly would chill the environment," says Kirk Herath, chief privacy officer at Nationwide Insurance Cos. in Columbus, Ohio. "If I were a company that didn't think my prospects of selling online were high, I wouldn't take the risk."

Many companies already have integrated their Web-site and call-center data. To avoid opt-in regulations for customer data, the sensitive personal information collected through the Internet would have to be stored in a physically separate database, as Michael Turner, president of the nonprofit Information Policy Institute, interprets the Hollings bill. Keeping the data separate could mean forfeiting a comprehensive view of customers who interact with a company through multiple channels.

Opt-in laws may also hamper a company's ability to market to customers who resemble their existing clients, Turner says. Companies often rely on third-party aggregators to fill out their understanding of customers with more data, such as income, and then use that information to purchase mailing lists of customers with similar characteristics.

By enacting an opt-in law, access to 95% of the data that aggregators provide potentially will be lost, Turner says. In one study for apparel retailers, Turner determined that costs would increase 3% to 11% if opt-in laws were adopted.

A senior Hollings aide says opponents are just trying to "muddy the waters." The aide says 99% of the information captured online isn't deemed sensitive and therefore won't fall under the opt-in statute. Also, businesses can include sensitive data in existing databases if consumers give their consent. "The industry is like Goldilocks," the aide says. "It can't find a bill it likes."

Even if the bill is enacted, and in an election year there's no guarantee that will happen, reputable businesses shouldn't worry too much, says Jonathan Zittrain, co-director of Harvard Law School's Berkman Center for Internet and Society. Many consumers don't hesitate to opt-in when dealing with companies they believe are legitimate. Says Zittrain, "Amazon.com can ask for your first child in a boilerplate statement and the consumer would still say, 'OK.'"

<< more articles