Imagine your child in a shop. Suddenly a man walks up with a clipboard and a form. He asks your child her name, her address, her age, her phone number, maybe some questions about her interests and hobbies, all of which she gives him. You are not there at the time; you have no idea this has happened. Does this scenario worry you?
Transfer the scene above to the Web, and you have a snapshot of what happens all the time on the vast majority of child-oriented Websites.
That certainly worries the Federal Trade Commission, the US government organisation much in the news lately for having recommended that antitrust lawsuits be filed against technology monoliths Intel and Microsoft. One of the FTC's briefs is to ensure fair competition, but it is also in charge of looking after consumers. It doesn't like what's going on in cyberspace.
Last week, the FTC released a long-awaited report*, three years in the making, which criticised commercial Websites for gathering data from people particularly children without explaining what the information would be used for.
In compiling the report, the agency looked at 1,400 sites in March. Only 14 per cent told visitors their policy on information-gathering. Even more shocking, only 28 sites bothered to include a detailed privacy statement. Most of the 404 retail, financial and health-oriented Websites included in the report collect personal details from site visitors, but under 16 per cent of them indicated how such data would be used. But Web privacy and children's advocate groups were particularly appalled at the way data was culled from young children.
Of 212 sites for children surveyed, 89 per cent asked young Web surfers to divulge personal information. Less than a quarter of the sites 23 per cent recommended that children get the permission of a parent before filling in such details. And only 7 per cent said the site would tell parents that such information had been requested. As a result, the FTC asked the US Congress to pass laws to protect, at the very least, children's privacy online. They've recommended Websites and databases be prohibited from gathering information from children without explicit parental permission. Many Americans would like laws to control the use of data gathered online from adults as well: the Internet is the only electronic medium which has no privacy protections in the US. But technology companies and e-commerce supporters feel that the Net should be self-regulated. The White House seems to prefer such an approach, and right on the tails of the FTC report, the US Commerce Department has issued a report, Elements of Effective Self-Regulation for the Protection of Privacy **. The Commerce Department will hold a series of meetings in late July to ponder the issue and, it hopes, come up with a working proposal for the Web.
Partly, that's because the US government is worried about the tight European controls on data which will come into effect in October***, and wants some point of compromise. Over here, European Union data privacy laws are already strict legally, no organisation can collect data from you without your permission except in very carefully defined situations. Organisations cannot arbitrarily hold data either. But if you're giving data to US sites, you no longer fall under these protections.
If your business currently gathers information from site visitors through an online form, or stores the email addresses of site visitors in a database, be aware that this is probably illegal. Many Web design companies seem unaware of such restrictions when they are proposing site designs as well. If you're in doubt, contact the Irish Data Commissioner to find out where your company practices stand.
Web addresses * www.ftc.gov ** www.commerce.gov *** www2.echo.lu/legal (full directive)
Karlin Lillington is at klillington@irish-times.ie
The Reuters article on the World Trade Organisation ban on Net taxes mentioned last week is archived at C/Net's technical news site, www.news.com, not TechWeb (www.techweb.com)
