Chairman Allen, Members of the Task Force:
It is a pleasure to appear before you to discuss Internet privacy today. I am Jim Harper, the Editor of Privacilla.org, a Web-based think-tank devoted exclusively to privacy. I started the Privacilla project a little less than a year ago out of personal dissatisfaction with the quality of the privacy debate in Washington.
Privacilla attempts to capture "privacy" as a public policy issue from top to bottom. Anyone may submit ideas, information, and links for inclusion on the site. The site represents the thinking of many people and I would refer you to the Privacilla "Support" page to get an idea of the groups that I have worked with — as soon as the site is back online. We are transferring to a new ISP, so the site is unavailable as I speak to you today. I expect we will be up again before the week is out.
When discussing Internet privacy legislation, you often hear that the devil is in the details. I disagree with that. On the contrary, the devil is in the fundamentals.
My assessment is that privacy is best regarded as an individual condition, like happiness or piety. Privacy is a condition people maintain by controlling who receives information about them, and the terms on which others receive it. Importantly, privacy is a personal, subjective condition. I cannot decide for you what your sense of privacy should be. Nor can you decide that for me. Each person’s sense of privacy reflects individual, cultural, and social norms that can change.
An important conclusion flows from this observation. That is that government regulation of the private sector in the name of privacy can only create confidentiality or secrecy rules based on the guesses of politicians and bureaucrats about what privacy should look like.
Even requiring Web sites to give "notice and choice" of their information practices, which seems like the least burdensome way of promoting privacy, begs an important question: "Notice of what?"
None of us — not the privacy advocates, not the Federal Trade Commission, not direct marketers, none of us — knows what the privacy expectations of the public will be when a new, settled understanding of the Information Economy emerges.
The better way to protect true privacy is to distribute decisions about how personal information is used to the people affected. The marketplace does this.
Consumers who care about privacy can and do refuse to deal with companies that do not offer privacy protections satisfactory to them. Over the course of billions of daily transactions in the American economy, businesses that fail to deliver privacy on the terms consumers want will be refused dollars and they will find themselves shunned and ignored right out of business. That is as it should be.
The marketplace is not working perfectly. There is not enough variety and diversity. This is often because regulations prevent new competitors from entering the field and challenging the information practices of established firms.
There is room in market processes for the self-appointed consumer advocates. They should encourage consumers to patronize businesses that have good information practices and to boycott those that do not. If they can not motivate consumer action, though, they should not come to Capitol Hill pretending to know what consumers want.
One of the most important facets of the privacy debate that has not been discussed enough is the fact that consumers are not being harmed. The newness of the Internet has made the public nervous about information practices, though these practices have been evolving for decades. But I challenge the pro-regulation activists to identify a harm that is being done legally to consumers today.
There was one Senate hearing on the Children’s Online Privacy Protection Act before it was passed. No child had ever been harmed and there was no credible threat of harm from the people who wanted to put educational and entertaining content online for children. The result has been reduced access to healthy, educational content for children, particularly children at risk.
The House Commerce Committee has held a series of very informative hearings on privacy, but a hole remains in their consideration of the issue. They have yet to identify a single American who has been harmed by practices that are not already illegal. If they need to put up screens to shield the identity of witnesses, as they did in the Senate’s famous IRS hearings a few years ago, they should. We need to learn whether anyone has suffered identifiable harms from practices that are now legal.
Speaking of the IRS, if the Congress wants to improve privacy in America, the largest collectors, users, and sometime abusers of personal information are right here in your back yard. I am speaking of the Internal Revenue Service, the Social Security Administration, the Health Care Financing Administration, the Veteran’s Administration, and all the other agencies that routinely deprive Americans of power to control information about themselves — at the behest of Congress. Social Security reform and tax reform should go forward, with re-establishing privacy as a primary goal.
The Internet offers consumers more opportunity to protect privacy than they ever had before. As a society, we are engaged in a short but difficult struggle to comprehend this exciting new medium and discover all the benefits it has to offer.
I know it is a short struggle, because the generation coming up behind us understands how information moves online. They know that things like "cookies" are inert sets of ones and zeroes that we can accept on our computers or refuse. They are entitled to laugh at us: our shock and horror looks pretty silly to them.
We should not pass laws to protect ourselves from exaggerated fear of the unknown, especially laws that will hobble the Internet long after we are gone. Our laws should protect consumers from identifiable harms, and do no more. Because it pits businesses against each other to serve consumers, the market is the best option for delivering robust privacy on the terms consumers truly want.
Thank you for the opportunity to share my views. I look forward to answering any questions you may have.