|
Server : Apache/2.4.62 System : FreeBSD fbsdweb2.web.rcn.net 14.1-RELEASE FreeBSD 14.1-RELEASE releng/14.1-n267679-10e31f0946d8 GENERIC amd64 User : www ( 80) PHP Version : 8.3.8 Disable Function : NONE Directory : /domains/sinrod/ |
Upload File : |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <!-- saved from url=(0044)http://www.hrblaw.com/artdocs/article_18.htm --> <HTML><HEAD><TITLE></TITLE> <META content="text/html; charset=windows-1252" http-equiv=Content-Type> <META content="MSHTML 5.00.3013.2600" name=GENERATOR></HEAD> <BODY aLink=#ff0000 bgColor=#ffffff link=#0000ff text=#000000 vLink=#551a8b> <P align=center><STRONG></STRONG>� 1999 Eric J. Sinrod, Jeffrey W. Reyna, and Barak D. Jolish<STRONG></STRONG></P> <P align=center><STRONG>THE NEW WAVE OF SPEECH AND PRIVACY</STRONG></P> <P align=center><STRONG>DEVELOPMENTS IN CYBERSPACE</STRONG></P> <P align=center>Eric J. Sinrod,<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_1_"><SUP>(1)</SUP></A> Jeffrey W. Reyna<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_2_"><SUP>(2)</SUP></A> & Barak D. Jolish<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_3_"><SUP>(3)</SUP></A></P> <P><STRONG>INTRODUCTION</STRONG> </P> <P>The Internet offers a myriad of new avenues for human interaction as varied as the people who are on line. The number of creative uses for the Internet has grown as the number of people on the Internet increases exponentially.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_4_"><SUP>(4)</SUP></A> But, for all the people currently found on line, there are many who still view the Internet with a wary eye. Concerns over personal privacy and government censorship are often at the forefront of many Internet users' minds.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_5_"><SUP>(5)</SUP></A> As with any other medium of information, the Internet has the potential to be used as a tool for businesses, individuals, and government to peer into people's personal lives. Conversely, many are concerned that the Internet can also be used to deliver objectionable or obscene information to minors. Caught in the balance is an ongoing debate over whether and how to regulate the Internet to protect the privacy and speech concerns implicated by its many uses.</P> <P>The last half of 1998 and beginning of 1999 saw some important developments in the area of Internet regulation by government and the private sector. Much of the legislative activity related to the Internet has focused on protecting children from exposure to objectionable material and preventing unwanted invasions into children's on-line privacy. At the same time, Congress, the courts, the European Community, and a coalition of Internet industry members, took several decisive steps-usually in different directions-in an effort to focus the ever-changing policy implications related to privacy and speech in the Internet. The aim of this article is to provide a brief overview of these recent developments as they fit into the ongoing policy debate on speech and privacy issues on the Internet.</P> <P><STRONG>BLOCKING ACCESS TO CONTENT AND FILLING BANDWIDTH WITH SPAM</STRONG></P> <P><EM>BLOCKING CONTENT</EM><STRONG></STRONG></P> <P>While many individuals have expressed a desire to keep the Internet an open marketplace of ideas subject to minimal censorship by the government,<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_6_"><SUP>(6)</SUP></A> they also advocate strong protections for children to shield them from exposure to objectionable material. The initial salvo in Congressional efforts to protect children from exposure to pronographic or sexually explicit material on the Internet was the Communications Decency Act (CDA).<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_7_"><SUP>(7)</SUP></A> The CDA sought to outlaw the transmission of "indecent" and other sexually explicit material to children over computer networks.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_8_"><SUP>(8)</SUP></A> The Act further defined indecent as that which is "patently offensive" by "contemporary community standards."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_9_"><SUP>(9)</SUP></A> In a 7-2 decision, the Supreme Court in <EM>Reno v. ACLU</EM> (<EM>Reno I</EM>)<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_10_"><SUP>(10)</SUP></A> struck down the Act's "indecency" provisions on the ground that they violated the First Amendment's guarantee of freedom of speech.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_11_"><SUP>(11)</SUP></A></P> <P>After the <EM>Reno I</EM> decision, Congress returned to the drawing board and renewed its efforts to regulate Internet content by enacting the Child Online Protection Act (COPA)<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_12_"><SUP>(12)</SUP></A> (or "CDA II" as it is called by its opponents). COPA attached criminal and civil liability for the distribution "in interstate or foreign commerce by means of the World Wide Web . . . any communication for commercial purposes that is available to any minor and that includes any material that is harmful to minors."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_13_"><SUP>(13)</SUP></A> The Act provided that a person would be considered to make a "communication for commercial purposes" "only if such person is engaged in the business of making such communication."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_14_"><SUP>(14)</SUP></A> The Act further stated that a person was deemed to "engage in the business" if that person "devotes time, attention, or labor to such activities, as a regular course of such person's trade or business, with the objective of earning a profit," irrespective of whether a profit was actually made.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_15_"><SUP>(15)</SUP></A> The Act than defines material that is "harmful to minors" as</P> <P>any communication, picture, image, graphic image file, article, recording, writing, or other matter of any kind that is obscene or that-</P> <UL> <LI>the average person, applying contemporary community standards, would find, taking the material as a whole and with respect to minors, is designed to appeal to, or is designed to pander to, the purient interest; <LI>depicts, describes, or represents, in a manner patently offensive with respect to minors, an actual or simulated sexual act or sexual contact, an actual or simulated normal or perverted sexual act, or a lewd exhibition of the genitals or post-pubescent female breast; and <LI>taken as a whole, lacks serious literary, artistic, political, or scientific value for minors. <A href="http://www.hrblaw.com/artdocs/article_18.htm#N_16_"><SUP>(16)</SUP></A> </LI></UL> <P></P> <P>Finally, the Act provided an affirmative defense for those individuals who, in good faith, restricted access to minors through the use of a credit card, adult access card, a digital certificate that verifies a user's age, or "any other reasonable measures that are feasible under available technology."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_17_"><SUP>(17)</SUP></A></P> <P>Privacy groups, including the ACLU and the Electronic Privacy Information Center (EPIC), filed suit in the U.S. District Court for the Eastern District of Pennsylvania, challenging COPA on constitutional grounds.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_18_"><SUP>(18)</SUP></A> We will refer to this case as <EM>Reno II</EM> for purposes of this discussion.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_19_"><SUP>(19)</SUP></A> On February 1, 1999, the court issued a 50-page Memorandum and Order granting plaintiffs' motion for a preliminary injunction, effectively barring enforcement of the Act until the resolution of the case, either by appeal or by a trial on the merits. Though this Memorandum is not binding precedent and is subject to appellate review or modification in further trial proceedings, it is worth discussion as yet another step towards defining the constitutional parameters of regulation of Internet speech by the government.</P> <P>In granting plaintiffs' request for a preliminary injunction, the court in <EM>Reno II</EM> focused its analysis on plaintiffs' claim that COPA was unconstitutional on its face as a violation of the First Amendment rights of adults. The court stated that "as a content-based regulation of [nonobscene sexual expression], COPA is presumptively invalid and is subject to strict scrutiny."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_20_"><SUP>(20)</SUP></A> According to the court, the content of such protected speech could be regulated only if such regulation is narrowly tailored as the least restrictive means to further a compelling government interest.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_21_"><SUP>(21)</SUP></A> The court proceeded to analyze whether COPA met strict scrutiny by considering: the burden on speech it imposes, whether COPA furthers a compelling government interest, and whether COPA was narrowly tailored and the least restrictive means to achieve its goals.</P> <P>The court concluded that COPA imposed a burden on speech for several reasons. The court used the discussion in <EM>Reno I</EM><A href="http://www.hrblaw.com/artdocs/article_18.htm#N_22_"><SUP>(22)</SUP></A> regarding the prohibitively high economic burden of implementing age verification systems, as one factor in the analysis of the burden COPA imposes on speech. However, the court held that, though the economic burden imposed on Web site operators who would incur out-of-pocket expense to comply with COPA's age verification provisions or lose revenue through decreased web site traffic was certainly real, other factors weighed in favor of a finding that COPA imposed an unconstitutional burden on speech. Namely, the court found that plaintiffs may self-censor the content of their Web sites based on the economic disincentives that COPA presented. The court also found that there is </P> <P>no way to restrict access of minors to harmful materials in chat rooms and discussion groups, which the plaintiffs assert draw traffic to their sites, without screening all users before accessing any content, even that which is not harmful to minors, or editing all content before it is posted to exclude material that is harmful to minors. . . This has the effect of burdening speech in these fora that is not covered by the statute.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_23_"><SUP>(23)</SUP></A> </P> <P>As a result, the court found that plaintiffs were likely to prove that COPA imposed a burden on speech that was otherwise protected for adults.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_24_"><SUP>(24)</SUP></A> </P> <P>Next, while the court found that Congress has a compelling government interest in protecting minors from harmful materials, including material that may not be considered obscene by adult standards, it found that COPA failed to use the "least restrictive means" to achieve its goal.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_25_"><SUP>(25)</SUP></A> The court pointed out that even with COPA in effect, minors might be able to access harmful material on foreign Web sites, non-commercial sites, and on-line using protocols apart from http such as ftp.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_26_"><SUP>(26)</SUP></A> Moreover, the court found there was some evidence presented that Internet "filtering software" could be used as an alternate, and least restrictive means, for protecting minors from exposure to obscene material on the Internet.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_27_"><SUP>(27)</SUP></A></P> <P>The decision in <EM>Reno II</EM> marks the second time in as many years that courts have struck down federal content-based restrictions on speech-both instances dealing with material deemed to be offensive and harmful to minors. This decision reaffirms the implication that any regulation affecting speech on the Internet, particularly any content-based prohibition on speech, must be narrowly tailored and use the least restrictive means in achieving its purpose.</P> <P><EM>STOPPING SPAMMERS</EM></P> <P>"Spam," also known as junk e-mail or unsolicited commercial e-mail, is an unsolicited and often unwelcome mass mailing to electronic bulletin boards, newsgroups, or lists of e-mail addresses harvested through a variety of means.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_28_"><SUP>(28)</SUP></A> The vast majority of spam messages are used as a form of advertising products and services ranging from "get rich quick" schemes, to phone sex lines and adult web sites, and quack health products.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_29_"><SUP>(29)</SUP></A> Despite its analogy to conventional junk mail, spam differs from junk mail in fundamental ways. First, mailers of conventional junk mail have to bear the cost of paper, printing and postage, whereas spammers bear negligible costs. The costs of spam are instead borne by the ISP, or Internet Service Provider, that has to accommodate the increased volume over its system. The costs and problems associated with spam can range from having to purchase additional bandwidth and devote employee time at a cost that can range into the millions of dollars for large ISPs, to disruptions in service caused by system crashes that affect paying customers.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_30_"><SUP>(30)</SUP></A></P> <P>The problem is exacerbated by the fact that no centralized system exists for identifying and dealing with unsolicited spam. A recipient of a spam message cannot make a request to be removed from a spam mailing list, and making such a request via a return e-mail often only accomplishes verifying the validity of one's e-mail address to spammers for their future use. Finally, even if an individual is able to remove herself from an e-mailing list or effectively use rudimentary software to filter out spam messages, the ISP is still left with the burden and havoc spam creates on its servers.</P> <P>With these problems in mind, ISPs have mounted increasing legislative lobbying efforts and court battles against spammers to try and alleviate the problem. In the area of litigation, the first notable victory in favor of ISPs and against spammers came in <EM>CompuServe v. Cyber Promotions, Inc.</EM><A href="http://www.hrblaw.com/artdocs/article_18.htm#N_31_"><SUP>(31)</SUP></A> Although the case ended with the parties reaching a consent decree wherein Cyber Promotions agreed to cease spamming targeted toward CompuServe's subscribers, the court noted that nothing in either the federal or applicable state constitutions required that a private property owner tolerate a trespass "whenever the trespasser is a speaker, or the distributor of written speech, who is unsatisfied with the fora which may be available on public property, and who thus attempts to carry his message to private property against the will of the owner."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_32_"><SUP>(32)</SUP></A></P> <P>In late 1998, ISPs scored another victory against spammers in <EM>America Online, Inc. v. LCGM, Inc.</EM>,<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_33_"><SUP>(33)</SUP></A> (<EM>AOL</EM>). In this instance, AOL sued several spammers to stop a practice that the court found included the sending of over 300,000 unsolicited spam messages to AOL subscribers on a daily basis.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_34_"><SUP>(34)</SUP></A> AOL based its case on several theories, including: false designation under the Lanham Act<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_35_"><SUP>(35)</SUP></A> where the spammers used the "aol.com" designation in their spam e-mail headers;<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_36_"><SUP>(36)</SUP></A> dilution of a service mark under the Lanham Act;<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_37_"><SUP>(37)</SUP></A> exceeding the terms or AOL's access agreement by harvesting AOL subscribers' e-mail addresses in violation of the Computer Fraud and Abuse Act;<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_38_"><SUP>(38)</SUP></A> impairing computer facilities by "intentionally accessing a protected computer without authorization . . . caus[ing] damage," which is also a violation of the Computer Fraud and Abuse Act;<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_39_"><SUP>(39)</SUP></A> in addition to violations of Virginia common law and statutory law. </P> <P>Though the court declined to rule on the issue of the extent of damages suffered by AOL as a result of the spammers' actions, the court did immediately enjoin the defendants from "further distributing unsolicited bulk e-mail messages to AOL members," prohibited them from further using the "aol.com" header or harvesting the e-mail addresses of AOL members, and ordered them to terminate any outstanding AOL memberships.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_40_"><SUP>(40)</SUP></A></P> <P>Though some of the spamming practices at issue in the <EM>AOL</EM> case are uncommon, particularly with respect to the unlawful appropriation of AOL's trade name, the case presents a prime example of the development of the law to deal with emerging problems presented by the Internet. Internet Service Providers are increasingly deploying a myriad of tools to combat what by all accounts is a potentially disruptive marketing practice that affects not only the ISP's business, but the subscribers' rights to unfettered access to the Internet without interruption or unsolicited advertising.</P> <P><STRONG>PRIVATE VS. PUBLIC REGULATION OF INFORMATION MINING: ADDRESSING INTERNET PRIVACY</STRONG></P> <P>Information about the habits, preferences, buying capacity, and other demographic data about Internet users is a hot commodity. How valuable is it? So valuable that on-line marketers have recently announced a program whereby they will give consumers for <EM>free</EM> a new personal computer and Internet service.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_41_"><SUP>(41)</SUP></A> Well, not really <EM>free</EM>. In exchange for the $1000 PC and the Internet access usually valued at around $20 per month, the customer will provide a questionnaire full of detailed demographic data, including age, income, marital status, and information about personal tastes and interests.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_42_"><SUP>(42)</SUP></A> In addition, the company will "monitor which Internet sites the users visit." <A href="http://www.hrblaw.com/artdocs/article_18.htm#N_43_"><SUP>(43)</SUP></A>This enterprise is the latest spin on continuing efforts by Internet marketers to gather and disclose private information about Internet users (read: potential Internet <EM>consumers</EM>).</P> <P>Web sites routinely gather data from visitors using on-line registration forms, mailing lists, surveys, user profiles, and other fulfillment forms.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_44_"><SUP>(44)</SUP></A> In addition, Web sites have the ability to <EM>covertly</EM> collect information about the habits of its users. Any Web site can discover, for instance, visitors' e-mail addresses, from where and to where they link, which pages they view, how long they stay, and what they purchase on line.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_45_"><SUP>(45)</SUP></A> The range of things done with this information is unclear, but at a minimum, this information has been collected, used and/or sold for purposes of targeted marketing. In 1998, the Federal Trade Commission investigated, and eventually settled with GeoCities, based on allegations of "unfair and deceptive practices" associated with the disclosure of information collected from individuals, including children.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_46_"><SUP>(46)</SUP></A> Another well-documented case dealing with the gathering and disclosure of private information involved AOL's unauthorized disclosure of personal information about US Navy Petty Officer Timothy R. McVeigh (including information about a his stated marital status) to the Navy without a warrant.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_47_"><SUP>(47)</SUP></A> This disclosure effectively terminated Officer McVeigh's illustrious Navy career based on the Navy's "don't ask, don't tell" policy on gays in the military.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_48_"><SUP>(48)</SUP></A></P> <P>These examples illustrate the different ways an individual's privacy can be compromised in the Internet, by private and government entities alike. Policymakers from both US and foreign governments have undertaken various efforts to secure the privacy of Internet users through legislation aimed at protecting the on line privacy of both adults and children. At the same time, an Internet industry coalition, the Online Privacy Alliance, has recently released a "White Paper" outlining its positions on Internet privacy, with a heavy emphasis on industry self-regulation. These different approaches are discussed in turn.</P> <P><EM>ONLINE PRIVACY FOR CHILDREN</EM></P> <P>The protection of children has always been of paramount concern in the public policy debate on government regulation of the Internet. In addition to the series of Congressional proposals meant to protect minors from access to obscene content on the Internet, Congress has recently enacted legislation aimed at protecting children's on line privacy. The Children's Online Privacy Protection Act (COPPA) was enacted by Congress in October of 1998.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_49_"><SUP>(49)</SUP></A></P> <P>In essence, COPPA strictly governs the circumstances under which Internet marketers or web sites gather and use data from children<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_50_"><SUP>(50)</SUP></A> The Act requires that the FTC promulgate regulations that "require the operator of any website or online service directed to children that collects personal information from children or the operator of an online service that has actual knowledge that it is collecting personal information form a child" provide notice of the nature of such data collection, the uses for the data, and the data disclosure practices.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_51_"><SUP>(51)</SUP></A> The Act further requires that such online service or website obtain "verifiable parental consent for the collection, use, or disclosure of personal information from children."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_52_"><SUP>(52)</SUP></A> Such parental notification and consent must be obtained <STRONG>before</STRONG> the information is collected from the child.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_53_"><SUP>(53)</SUP></A> </P> <P>The Act has wide-ranging implications for the privacy interests of children who use the Internet. For example, if a web site does not first obtain "verifiable parental consent," it cannot set any information-gathering "cookies" on the child's computer, nor can the site ask the child any questions about his or her toy or video game preferences. Though the Act only applies to the gathering and disclosure of information about children by commercial web sites,<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_54_"><SUP>(54)</SUP></A> it nevertheless provides both children and parents a strong line of defense against the unwanted gathering and disclosure of information about children who are using the Internet.</P> <P>Contrasted with this narrow approach to privacy protection, the European Community has taken a much broader approach toward protecting the on line privacy of all individuals in its member states.</P> <P><EM></EM><EM>EUROPEAN COMMUNITY PRIVACY DIRECTIVE AND U.S. RESPONSE</EM></P> <P>The European Community has taken aggressive steps toward safeguarding the privacy rights of individuals with respect to the processing of personal data. With this objective in mind, the European Parliament and the Council of the European Union enacted the "European Community Privacy Directive," which became effective on October 25, 1998.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_55_"><SUP>(55)</SUP></A> The Directive treats the protection of personal privacy with respect to personal data a "fundamental right."<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_56_"><SUP>(56)</SUP></A> To achieve the goal of protecting personal data, the Directive provides:</P> <P>Member States shall provide that personal data may be processed only if:</P> <UL> <LI>the data subject has unambiguously given his consent; or <LI>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or <LI>processing is necessary for compliance with a legal obligation to which the controller is subject; or <LI>processing is necessary in order to protect the vital interests of the data subject; or <LI>processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed;, or <LI>processing in necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_57_"><SUP>(57)</SUP></A> </LI></UL> <P></P> <P>Therefore, unless the Internet user "unambiguously" gives consent for the use of personal data, or another narrow exception applies, the Web site is barred from using or collecting that data.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_58_"><SUP>(58)</SUP></A> Given the global nature of the Internet, this Directive could have wide-ranging implications for American Internet companies. Article 25 of the Directive explicitly restricts the transfer of data to third countries unless that country guarantees "an adequate level of protection" is afforded to personal data.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_59_"><SUP>(59)</SUP></A> Based on the current state of American privacy law, it is uncertain whether the transfer of personal data between the U.S. and the European Community would satisfy the requirements of Article 25.</P> <P>In an effort to comply with the European Community Privacy Directive, and in particular Article 25, the U.S. Commerce Department, pursuant to discussions with the European Commission, has promulgated a set of "safe harbor" principles that would apply to American companies that choose to voluntarily comply.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_60_"><SUP>(60)</SUP></A> The safe harbor provisions essentially state that, in order to comply, an organization must:</P> <UL> <LI>provide notice about its information collection practices in clear and conspicuous language; <LI>"give individuals the opportunity to choose . . . whether and how personal information they provide is used". . . <LI>be "given the opportunity to choose whether and the manner in which a third party uses the personal information they provide". . . <LI>"take reasonable measures to assure" the reliability of information for its intended use and "take reasonable precautions to protect [the information] from loss, misuse, unauthorized access or disclosure, alteration, or destruction" . . . <LI>keep complete, accurate and current data records and ensure they are kept only for the purpose it has been gathered; . . . <LI>give individuals "reasonable access" to such information and allow them to amend or correct the information in case it is inaccurate; and <LI>include effective enforcement mechanisms for the principles outlined above, including giving individuals recourse for enforcing these directives.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_61_"><SUP>(61)</SUP></A> <BR WP="BR1"></LI></UL> <P>Whether or not these self-regulatory principles governing the transmission, accumulation and storage of personal information will be effective in protecting the privacy of Internet users' personal data is yet to be seen. If the Internet industry adheres to these principles, they would become a substantial first step toward safeguarding privacy in personal data collected from individuals on the Internet. At a minimum, adherence to these "safe harbor" provisions is likely to minimize any liability under Directive 95/46/EC for American companies who are in voluntary compliance and transact business with European consumers over the Internet.</P> <P><EM>THE RESPONSE FROM PRIVATE INDUSTRY</EM></P> <P>In response to both the public's concern over Internet privacy, and increasing Congressional willingness to enact regulatory legislation in this arena, the Online Privacy Alliance (OPA) has promulgated several on-line privacy proposals.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_62_"><SUP>(62)</SUP></A> OPA takes a decidedly self-regulatory approach to protecting individuals' online privacy.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_63_"><SUP>(63)</SUP></A> The Alliance has released two primary policy statements regarding self-regulation of online privacy by its member organizations. The first of these calls for Web sites to use a third-party licensing program or a membership association to monitor company compliance with company privacy policies. Among the third-party monitoring organizations the OPA named are BBBOnLine<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_64_"><SUP>(64)</SUP></A> and TRUSTe.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_65_"><SUP>(65)</SUP></A> Both sites provide a version of a privacy seal that can be placed on a website, and which indicates that the website adheres to each respective organization's privacy guidelines. The alliance released its second major policy statement on November 19, 1998, which is a broad analysis of the OPA's positions regarding a multi-layered approach to online privacy, where self-regulation takes the helm, while governmental regulation and private civil actions take a secondary role.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_66_"><SUP>(66)</SUP></A></P> <P>Such efforts at industry self-regulation have faced strong skepticism from privacy and civil rights organizations. For example, the Electronic Privacy Information Center has noted that, even in the midst of enforcement actions by the FTC against GeoCities based on its information disclosure practices, GeoCities was a member of TRUSTe.<A href="http://www.hrblaw.com/artdocs/article_18.htm#N_67_"><SUP>(67)</SUP></A> The question of on-line self-regulation remains very much contingent on the ability of the Internet industry to persuade its members to follow robust privacy guidelines. In addition, the on-line industry must also convince consumers concerned about Internet privacy, and the government, that it is protecting the privacy rights of all individuals.</P> <P><STRONG>CONCLUSION</STRONG></P> <P>The incredible and continuing growth of the Internet has led to many new and innovative ways to share information across national borders. The growth of this information exchange has brought with it the ability for individuals, governments and corporations to collect, use and even sell personal information about Internet users. It has also led to growing willingness on the part of parents and government to implement measures intended to block minors' access to objectionable content-often running head-on into constitutional limitations. Recent legal and policy developments in the search to address these concerns merit continued attention in a manner that is mindful of the Internet's promise and potential perils.</P> <P><A name=N_1_>1. </A>Eric J. Sinrod, a partner in the San Francisco office of Hancock Rothert & Bunshoft LLP, practices commercial litigation and Internet, information and communications law, and can be reached at [email protected] or [email protected]. </P> <P><A name=N_2_>2. </A>Jeffrey W. Reyna, an associate in the San Francisco office of Hancock Rothert & Bunshoft LLP, practices commercial litigation and Internet law, and can be reached at [email protected]. <P><A name=N_3_>3. </A>Barak D. Jolish is a third-year student at the University of California Hastings College of the Law and will be joining Hancock, Rothert & Bunshoft LLP as an associate in 1999. He can be reached at [email protected]. <P><A name=N_4_>4. </A>A 1998 survey by Network Wizards shows that the number of hosts tabulated in the Internet Domain Name System grew from roughly 25,000,000 in mid-1997 to nearly 37,000,000 by July of 1998. <EM>See</EM> Network Wizards, Internet Domain Survey, July 1998 (visited Feb. 9, 1999) <<A href="http://www.hrblaw.com/artdocs/<http://www.nw.com/zone/www/report/html>.">http://www.hrblaw.com/artdocs/<http://www.nw.com/zone/www/report/html>.</A> With some variation, one host = one computer connected to the Internet. In recent years however, "virtual hosting" has necessitated the modification of this definition, since one computer can, in turn, have multiple domain names and IP addresses. <EM>See</EM> Network Wizards, Internet Domain Survey FAQ (visited Feb. 9, 1999) <<A href="http://www.hrblaw.com/artdocs/<http://www.nw.com/zone/WWW/faq.html>.">http://www.hrblaw.com/artdocs/<http://www.nw.com/zone/WWW/faq.html>.</A> "An IP address is a set of four numbers (each between 0 and 255, with some restrictions) separated by periods that uniquely identify that address on the Internet." <EM>See</EM> Web Sites, Hostnames and IP Addresses, Oh my (visited Feb. 5, 1999) <<A href="http://www.hrblaw.com/artdocs/<http://www.mit.edu/people/mkgray/net/terminology.html>.">http://www.hrblaw.com/artdocs/<http://www.mit.edu/people/mkgray/net/terminology.html>.</A> </P> <P>These figures only count the number of computers connected to the Internet. An estimate of the number of people using the Internet is more difficult to come by. According to one estimate, 108 million adults in the U.S. alone used the Internet during the last three months of 1998. <EM>See</EM> Web Hits Growth Spurt in Q4, Cyberatlas (visited Feb. 9, 1999) <<A href="http://www.hrblaw.com/artdocs/<http://www.cyberatlas.com/big_picture/demographics/q4.html>.">http://www.hrblaw.com/artdocs/<http://www.cyberatlas.com/big_picture/demographics/q4.html>.</A> <P><A name=N_5_>5. </A><EM>See 8<SUP>th</SUP> WWW User Survey</EM>, Graphic, Visualization & Usability Center (GVU), Dec. 12, 1997, <<A href="http://www.hrblaw.com/artdocs/<http://www.gvu.gatech.edu/user_surveys/survey-1997_10>;">http://www.hrblaw.com/artdocs/<http://www.gvu.gatech.edu/user_surveys/survey-1997_10>;</A> <EM>A Little Net Privacy, Please</EM>, Business Week Online, Mar. 16, 1998 <http://www.businessweek.com/199811/b3569104.htm>. <P><A name=N_6_>6. </A><EM>See</EM> <EM>e.g. Credit Card Security Greatest Internet-Related Concern Concludes Lycos Web User Study</EM>, Cyber Dialogue (March 5, 1998) <<A href="http://www.hrblaw.com/artdocs/<http://www.cyberdialogue.com/frame.html>">http://www.hrblaw.com/artdocs/<http://www.cyberdialogue.com/frame.html></A>. <P><A name=N_7_>7. </A>The Communications Decency Act, 47 U.S.C. � 223(a), (d) (1996), was signed into law by President Clinton as part of omnibus legislation that addressed the entire landscape of American communications law. <EM>See</EM> The Telecommunications Act of 1996, Pub. L. 104-104, 110 Stat. 56. <P><A name=N_8_>8. </A><EM>Id.</EM> <P><A name=N_9_>9. </A><EM>Id.</EM> <P><A name=N_10_>10. </A>521 U.S. 844 (1997). <P><A name=N_11_>11. </A>While the scope of the <EM>Reno</EM> <EM>I</EM> opinion has been discussed at depth in other fora, a brief summary is useful here. Specifically, the Court held that material published over the Internet deserves the same high level of constitutional protection as books or magazines, as opposed to the lower level afforded to broadcast media. <EM>Id.</EM> at 895-897. The Court went on to state that the Internet is "the most participatory for of mass speech yet developed," and is entitled to "the highest protection from governmental intrusion." <EM>Id.</EM> at 892. From this perspective, the Court viewed the CDA as a content-based blanket restriction on speech that did not to provide any definition of 'indecent' and omitted any requirement that 'patently offensive' material lack socially redeeming value. <EM>Id.</EM> at 898-899. The Court also expressed concern that the decentralized nature of the Internet made it particularly difficult to apply the "community standards" test of obscenity law. <EM>Id.</EM> <P><A name=N_12_>12. </A>47 U.S.C. � 231 (1998). <P><A name=N_13_>13. </A>47 U.S.C. � 231(1). <P><A name=N_14_>14. </A>47 U.S.C. 231(e)(2)(A). <P><A name=N_15_>15. </A>47 U.S.C. � 231(e)(2)(B). <P><A name=N_16_>16. </A>47 U.S.C. � 231(e)(6). <P><A name=N_17_>17. </A>47 U.S.C. � 231(c). Age verification on adult web sites was also promoted by the drafters of the Internet Tax Freedom Act. The Act used age verification as an incentive by subjecting Web sites to potential Internet taxation if they do not adequately block access to adult content by minors through the use of age verification programs. <EM>See</EM> Internet Tax Freedom Act, Section 1101(2) et seq. The act was passed as part of the 1998 Omnibus Consolidated Appropriations Bill. <P><A name=N_18_>18. </A><EM>American Civil Liberties Union, et al. v. Janet Reno</EM>, 98-5591 (1998), United States District Court for the Eastern District of Pennsylvania, available at <<A href="http://www.hrblaw.com/artdocs/<http://www.paed.uscourts.gov/opinions/99D0078P.htm>.">http://www.hrblaw.com/artdocs/<http://www.paed.uscourts.gov/opinions/99D0078P.htm>.</A> <P><A name=N_19_>19. </A>For a sampling of the reaction to the COPA injunction, see Declan McCullagh, <EM>Judge: COPA Went Too Far</EM>, WIRED NEWS, Feb. 2, 1999 <<A href="http://www.hrblaw.com/artdocs/<http://www.wired.com/news/news/politics/story/17670.html>;">http://www.hrblaw.com/artdocs/<http://www.wired.com/news/news/politics/story/17670.html>;</A> <EM>Trial Possible on Web Porn Law</EM>, CNN Interactive, Feb. 2, 1999 <http://www.cnn.com/US/9902102/internet.decency>. <P><A name=N_20_>20. </A><EM>Id.</EM> (citing <EM>Sable Communications of California, Inc. v. FCC</EM>, 492 U.S. 115, 126 (1989) and <EM>R.A.V. v. City of St. Paul</EM>, 505 U.S. 377, 381 (1992)). <P><A name=N_21_>21. </A><EM>Id.</EM> (citing <EM>Sable</EM>, 492 U.S. at 126, which states that "[i]t is not enough to show that the Government's ends are compelling; the means must be carefully tailored to achieve those ends."). <P><A name=N_22_>22. </A><EM>Reno I</EM>, 117 S.Ct. at 2347. <P><A name=N_23_>23. </A><EM>Reno II</EM>, at Part A1. <P><A name=N_24_>24. </A><EM>Id.</EM> <P><A name=N_25_>25. </A><EM>Id.</EM>, <EM>see also Reno I</EM>, 117 S.Ct. at 2349. <P><A name=N_26_>26. </A>"Ftp" stands for "file transfer protocol," and describes a way of accessing information from the Internet by downloading files from indexes, rather than loading a Web page, which is in turn normally written in the computer language "html." For a more detailed description of these and other Internet-related terms see visit <http://www.cnet.com/Resources/Info/Glossary/Terms>. <P><A name=N_27_>27. </A><EM>Reno II</EM> at Section A4. Interestingly, some in the Internet industry do not favor the alternative of using filtering software because such software has the potential to block access to a wider range of content than that prohibited by COPA. <EM>See</EM> Neil Munro, <EM>The Web's Cornucopia</EM>, The National Law Journal, Jan. 9, 1999, at 38. <P><A name=N_28_>28. </A><EM>See</EM> <EM>CNET Glossary</EM>, CNET.COM (visited June 26, 1998). <<A href="http://www.hrblaw.com/artdocs/<http://www.cnet.com/REsources/">http://www.hrblaw.com/artdocs/<http://www.cnet.com/REsources/</A> <P><A name=N_29_>29. </A>"About the Problem," Coalition Against Unsolicited Commercial e-mail (visited July 27, 1998) <<A href="http://www.hrblaw.com/artdocs/<http://www.cauce.org/problem.html>.">http://www.hrblaw.com/artdocs/<http://www.cauce.org/problem.html>.</A> <P><A name=N_30_>30. </A><EM>See</EM> Chris Oakes, <EM>Well-Done Spam Cooked Pac Bell's Email</EM>, Wired News, April 15, 1998 <<A href="http://www.hrblaw.com/artdocs/<http://www.wired.com/news/news/technology/story/11684.html>.">http://www.hrblaw.com/artdocs/<http://www.wired.com/news/news/technology/story/11684.html>.</A> <P><A name=N_31_>31. </A>962 F.Supp. 1015 (S.D. Ohio 1997). <P><A name=N_32_>32. </A><EM>Id.</EM> at 2027. <P><A name=N_33_>33. </A>1998 U.S. Dist. LEXIS 20144. <P><A name=N_34_>34. </A><EM>Id.</EM> at *7. <P><A name=N_35_>35. </A>15 U.S.C. � 1125(a)(1) of the Lanham Act makes it unlawful to use in commerce:</P> <P>any false designation of origin . . . which . . . is likely to cause confusion, or to cause mistake, or to deceive as to the affiliation, connection, or association of such person with another person, or as to the origin, sponsorship, or approval of his or her goods, services, or commercial activities by another person.</P> <P></P> <P>Other courts have held that the sending of spam constitutes a violation of this section of the Lanham Act. <EM>See</EM> <EM>America Online, Inc. v. IMS</EM>, 24 F.Supp.2d 548 (E.D. Va. 1998); <EM>Hotmail Corp. v. Van Money Pie, Inc.</EM>, 1998 U.S. Dist. LEXIS 10729 (N.D. Cal. 1998). <P><A name=N_36_>36. </A><EM>AOL</EM>, at *11. <P><A name=N_37_>37. </A>15 U.S.C. � 1125(c)(1). <P><A name=N_38_>38. </A>18 U.S.C. � 1030(a)(2)(c). <P><A name=N_39_>39. </A>18 U.S.C. � 1030(a)(5)(C). <P><A name=N_40_>40. </A><EM>AOL</EM>, at *23. <P><A name=N_41_>41. </A><EM>See</EM> <EM>Web entrepeneur to give away PCs, make money on ads</EM>, CNN Interactive, Feb. 8, 1999 <<A href="http://www.hrblaw.com/artdocs/<http://cnn.com/tech/computing/9902/08/freepc.reut/>;">http://www.hrblaw.com/artdocs/<http://cnn.com/tech/computing/9902/08/freepc.reut/>;</A> <EM>see also</EM> Craig Bicknell, <EM>For Sale: Your Tastes, Interests</EM>, WIRED NEWS, June 24, 1998 <http://www.wired.com/news/news/politics/privacy/story/13212.html> (outlining plans to sell/trade information gathered from Internet user's habits on-line). <P><A name=N_42_>42. </A><EM>Id.</EM> <P><A name=N_43_>43. </A><EM>See</EM> <EM>Over 500,000 apply for free PCs</EM>, MSNBC.COM, Feb. 10, 1999 <<A href="http://www.hrblaw.com/artdocs/<http://www.msnbc.com/news/239946.asp>.">http://www.hrblaw.com/artdocs/<http://www.msnbc.com/news/239946.asp>.</A> <P><A name=N_44_>44. </A>A 1997 study by the Electronic Privacy Information Center (EPIC) found that 49 of the top 100 most visited Web sites collect personal information through such methods. <EM>See</EM> <EM>Surfer Beware: Personal Privacy and the Internet</EM>, EPIC, June 1997 <<A href="http://www.hrblaw.com/artdocs/<http://www.epic.org/reports/surfer-beware.html>.">http://www.hrblaw.com/artdocs/<http://www.epic.org/reports/surfer-beware.html>.</A> <P><A name=N_45_>45. </A>To get a demonstration of the types of information a Web site may discover about its visitors, visit the Center for Democracy and Technology's "Who's Watching You?" page, at <<A href="http://www.hrblaw.com/artdocs/<http://www.13x.com/cgbin/cdt/snoop.pl>.">http://www.hrblaw.com/artdocs/<http://www.13x.com/cgbin/cdt/snoop.pl>.</A> <P><A name=N_46_>46. </A><EM>See</EM> <EM>GeoCities Form S-1 Registration Statement under the Securities Act of 1933</EM>, Securities and Exchange Commission, June 12, 1998 <http://www.sec.gov/Archives/edgar/data/1062777/000101706298001328.txt>. <P><A name=N_47_>47. </A>McVeigh v. Cohen, 983 F.Supp. 215 (D. D.C. 1998). <P><A name=N_48_>48. </A><EM>Id.</EM> <P><A name=N_49_>49. </A>The Children's Online Privacy Protection Act (COPPA) was enacted as Title XIII, sections 1301 through 1308, of the 1999 Omnibus Appropriations Bill. <P><A name=N_50_>50. </A>COPPA defines "child" as "an individual under the age of 13." COPPA � 1302(1). <P><A name=N_51_>51. </A>COPPA � 1303(b)(A)(i). <P><A name=N_52_>52. </A><EM>Id.</EM> at � 1303(b)(A)(ii). The Act defines "verifiable parental consent" as:</P> <P>any reasonable effort (taking into consideration the available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a child receives notice of the operator's personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclousre, as applicable, of personal information and the subsequent use of that information <STRONG>before that information is collected from that child</STRONG>.</P> <P>COPPA at � 1302(9). <P><A name=N_53_>53. </A><EM>Id.</EM> <P><A name=N_54_>54. </A><EM>Id.</EM> at � 1302(2)(A) (website must be maintained for a "commercial purpose" in order to be covered by the Act). <P><A name=N_55_>55. </A>The full title of the directive is "Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data." The complete text of the Directive is available at <http://europa.eu.int/comm/dg15/media/dataprot/law/dir9546.htm>. <P><A name=N_56_>56. </A><EM>See</EM> Directive 95/46/EC, Article 1. <P><A name=N_57_>57. </A>Directive 95/46/EC, Article 7. <P><A name=N_58_>58. </A>An exception is provided if the processing of data is done solely in the interests of "journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression." Directive 95/46/EC, Article 9. <P><A name=N_59_>59. </A>Directive 95/46/EC, Article 25. <P><A name=N_60_>60. </A><EM>See</EM> "International Safe Harbor Privacy Principles," U.S. Department of Commerce, International Trade Administration, Nov. 11, 1998 draft. The text of this draft is available at <<A href="http://www.hrblaw.com/artdocs/<http://www.epic.org/privacy/intl/doc-safeharbor-1198.html>.">http://www.hrblaw.com/artdocs/<http://www.epic.org/privacy/intl/doc-safeharbor-1198.html>.</A> <P><A name=N_61_>61. </A><EM>Id.</EM> <P><A name=N_62_>62. </A>The Online Privacy Alliance is an industry group describing itself as "an alliance of global companies and associations committed to promoting privacy online." <EM>See</EM> Online Privacy Alliance, Privacy Guidelines, Nov. 19, 1998. The text of the guidelines is available at <<A href="http://www.hrblaw.com/artdocs/<http://www.privacyalliance.org>.">http://www.hrblaw.com/artdocs/<http://www.privacyalliance.org>.</A> <P><A name=N_63_>63. </A><EM>See</EM> Online Privacy Alliance Mission Statement, <EM>id.</EM> <P><A name=N_64_>64. </A>BBBOnLine is a wholly-owned subsidiary of the Better Business Bureau, and features a privacy "seal" program which "incorporates the pertinent guideposts and self-regulation requirements outlined by the Federal Trade Commission and the Department of Commerce." <EM>BBBOnLine Privacy Program Created to Enhance User Trust on the Internet</EM>, BBBOnLine, June 22, 1998, <<A href="http://www.hrblaw.com/artdocs/<http://www.bbbonline.org/bolprivacy.shtml>.">http://www.bbbonline.org/bolprivacy.shtml>.<U></U></A> It is important to note that not all Better Business Bureau members will be required to comply with the program, only those members who sign up with BBBOnLine. <P><A name=N_65_>65. </A>TRUSTe has been running its "trustmark" seal program since 1997. A "trustmark" signifies that a Web site has made a commitment to disclose its privacy practices. <EM>See</EM> TRUSTe, (visited June 27, 1998) <<A href="http://www.hrblaw.com/artdocs/<http://www.truste.org/users/program.html>.">http://www.hrblaw.com/artdocs/<http://www.truste.org/users/program.html>.</A> <P><A name=N_66_>66. </A><EM>See</EM> <EM>Legal Framework White Paper, Submitted with the Comments of the Online Privacy Alliance On the Draft International Safe Harbor Principles</EM>, Nov. 19, 1998, available at <<A href="http://www.hrblaw.com/artdocs/<http://www.privacyalliance.org>.">http://www.hrblaw.com/artdocs/<http://www.privacyalliance.org>.</A> <P><A name=N_67_>67. </A><EM>See</EM> <EM>Industry Floats Plan on Privacy</EM>, CNET News.com, July 21, 1998 <<A href="http://www.hrblaw.com/artdocs/<http://www.news.com/News/Item/o,4,24434,00.html?st.ne.ni.lh>.">http://www.hrblaw.com/artdocs/<http://www.news.com/News/Item/o,4,24434,00.html?st.ne.ni.lh>.</A> </P></BODY></HTML>