Online Privacy Alliance Announces Enforcement Mechanisms To Assure Privacy Protection In Cyberspace

WASHINGTON, D.C. – The Online Privacy Alliance today released a framework for enforcing the protection of consumer privacy in cyberspace. The policy was presented Monday to Administration officials and this morning to a House Subcommittee holding hearings on electronic commerce and privacy.

Christine Varney, a former FTC commissioner and advisor to the more than 50 global companies and associations that are members of the Alliance, presented the policy to the House Commerce Committee Subcommittee on Telecommunications, Trade and Consumer Protection. She said the enforcement policy calls for objective third parties to monitor and evaluate a web site’s compliance with clear policies for protecting privacy and to provide consumer complaint mechanisms if a violation is found.

“To increase consumer confidence in cyberspace, companies need to have an independent and trusted third party validate compliance with clearly stated policies and confirm that companies are engaged in credible self-regulation,” Ms. Varney said. “Alliance member companies are taking this step and moving the entire Internet industry forward.”

The release of the enforcement framework fulfills ahead of schedule a commitment made to the Administration by the Alliance in June to have an enforcement policy drafted by September.

The enforcement framework states: “Whether administered by a third-party privacy seal program, licensing program or membership association, the effective enforcement of self-regulation requires: 1.) verification and monitoring, 2.) complaint resolution, and 3.) education and outreach.”

The Alliance endorsed third-party enforcement programs that award identifiable symbols to signify to consumers that the owner or operator of a web site, online service or other online area has adopted a privacy policy that reflects the privacy guidelines announced by the group last month. The symbols would also tell consumers that procedures are in place to assure compliance with the policies and that a complaint resolution process is available.

The guidelines governing privacy policies among Alliance members address the collection, use and disclosure of individually identifiable information, choice, data security, data quality and access. The Alliance also adopted a special policy requiring parental notification designed to protect the privacy of children online.

Members of the Alliance represent a broad array of industrial sectors including high-technology, telecommunications, financial services, Internet and online service providers, database services, retail, entertainment, marketing and publishing. The privacy practices and the enforcement policy adopted by the companies and associations are expected to influence the way business is conducted on the Internet for years to come.

The enforcement framework sets out in detail the criteria for a credible program of privacy seals to be used in alerting consumers about a web site’s privacy policy. The seal programs that will be used by Alliance members must comport with the privacy principles endorsed by the Alliance.

Several such seal programs already exist or are under development by TRUSTe, the Better Business Bureau and others. Many Alliance members already are part of one of these two programs and others plan to use these or similar programs soon.

The Alliance called on seal programs to maintain objectivity and build legitimacy with consumers and use a governing structure that solicits input from the business community, consumer/advocacy groups and academics. Seal programs should be “independent and should endeavor to make receipt of the seal affordable for and available to all online businesses,” the document states. Seal programs should be ubiquitous, comprehensive, accessible and affordable.

Seal programs should cultivate a reputation for integrity and have the ability and mechanisms to handle consumer inquiries and complaints about potential violations of online privacy policies.

The framework adopted by the Alliance allows seal programs to recognize self- assessment, but states that if such self-assessment is used it must follow a publicly disclosed seal program methodology and be rigorous, uniform and clearly articulated. Periodic reviews should be required by any credible seal program.

A copy of the enforcement framework, a list of Alliance members and other documents can be found at www.privacyalliance.org.

The Online Privacy Alliance represents the most widespread effort ever undertaken by business to create an online environment that respects privacy.

“Alliance members have made a remarkable effort to find common ground on some very complex issues and provide leadership in setting standards for protecting privacy,” Ms. Varney said.