Privacy concerns and technological change: the legislative option

In the recent Supreme Court case where all nine justices agreed that placing a GPS tracking device on a car without a warrant violated the Fourth Amendment, Justice Alito observed that "in circumstances involving dramatic technological change, the best solution to privacy concerns may be legislative." But since there was no GPS tracking device law for guidance, Justice Alito and his colleagues looked to Fourth Amendment precedent to analyze warrantless use of the new(ish) GPS technology and to create a privacy solution. Henceforth, as a matter of Constitutional law, police need a warrant before they attach a GPS tracking device to someone's car. The Supreme Court came up with the right result even without a specific statute.

Justice Alito is not alone in thinking that privacy legislation is the best way to deal with technological change. Last year, dozens of bills were introduced in Congress to regulate online tracking, to create rules for the collection of geolocation data, to protect children's privacy and to regulate the collection and use of personal data generally. None were passed, but attention to privacy issues reached a new high and included a series of high-profile Congressional
hearings.

Recently, the Obama Administration finalized its study of privacy issues and called for the passage of a consumer legislation which it dubbed a "Privacy Bill of Rights." And across the Atlantic, the European Commission unveiled a proposal for a EU-wide regulation to replace the current privacy law framework, with very specific restrictions and very significant penalties for non-compliance.

Do all of these proposals for new laws confirm Justice Alito's dictum that with "dramatic technological change, the best solution to privacy concerns" is legislative? Maybe, but the answer depends on what kind of legislation.

Many believe that the proposals coming from Europe are too detailed, too strict and too draconian, with the result that technological innovation will suffer.

And on both sides of the Atlantic, technology advances much faster than laws can be drafted, compromised and passed. Moreover, technology-specific laws may be outmoded as soon as they come into force. Congress is grappling right now with an electronic privacy law passed in the 1980s that never contemplated e-mail or cloud computing, but nevertheless is the only law dealing with government access to our remotely-stored data. And a privacy law intended to address video rental stores sharing customer records (passed at a time when streaming online video was not on the horizon) has created the perverse situation under which Facebook users can freely share with their friends what music they are streaming from online services but cannot easily share the videos they are streaming from Netflix.

The Administration's legislative proposal contemplates a Safe Harbor for companies that participate in enforceable privacy codes of conduct approved by the Federal Trade Commission, thereby allowing the codes to be flexible and nimble as technology evolves. Meanwhile, great strides in privacy protection already have been made through industry efforts to do better.  Last year, there was intense scrutiny of online tracking to deliver targeted advertising -- the so-called "Do Not Track" issue. This year, we see browser controls for online tracking, dashboard for consumers to make tracking choices and catchy icons appended to online ads that can be clicked through for more information and control over tracking. The right result, even without a specific statute.

New privacy issues are raised each week. The latest controversy is over changes to the Google privacy policy. The existing privacy framework is available to deal with that, especially since Google is under the FTC's jurisdiction. No new legislation is needed for every controversy du jour.

Smart privacy legislation is legislation that flexibly covers changes in technology, that does not stifle innovation and that promotes industry-initiated progress in coming up with privacy solutions. Surely that is the kind of guiding legislation Justice Alito, and privacy advocates, would appreciate.

Christopher Wolf and Jules Polonetsky are co-chairs of the Future of Privacy Forum.

---