Breaking ground on privacy rights

A Massachusetts bill would shield consumers from telemarketers, mailing lists.

Somewhere, there's probably a marketing firm that knows what brand of deodorant you use. Or a luxury condo salesman who knows when your individual retirement account will mature. Or a telemarketing company that knows the best time to catch you at home is from 6 p.m. to 9 p.m., except Thursdays.

If that feels like an invasion of privacy, you're in good company. Indeed, the practice known as "data mining" has become so pervasive that throngs of Americans have pressed lawmakers to regulate it.

Now, in a move being watched by privacy advocates and business groups nationwide, Massachusetts is considering the most comprehensive measure yet to bolster privacy protections for consumers, workers, medical patients, and even children.

"The Massachusetts proposal goes farther than anything else around," says Evan Hendricks, editor of Privacy Times, a newsletter published by the US Privacy Council in Washington. He adds that the giant bill has a fair shot at passage, possibly this fall.

If the measure becomes law it would, among other things, help consumers shield themselves from problems as serious as identity theft and as simple as annoying marketing calls during dinnertime. It would also prohibit sex offenders from holding data-processing jobs, in a bid to protect children, and require employers to notify workers about any electronic monitoring in the workplace.

But its most controversial provision, at least as far as businesses are concerned, would require firms that "mine" for personal data to get explicit permission from individuals to share that information with telephone solicitors, direct mailers, or any other marketing group. Companies would also have to give individuals access to information collected on them - and notify them whenever it is sold.

Debate over privacy rights versus marketing opportunity has escalated in recent years, as the Internet has revolutionized the science of data gathering. Privacy advocates frame the issue as one of human rights, "that individuals have a right to control information about themselves," says David Sorkin, a professor at the John Marshall Law School in Chicago.

BUSINESS groups, on the other hand, are aware of the need to protect consumers' privacy, but they are wary of big cos\ts they say are associated with many provisions of the Massachusetts bill.

If businesses are required to cull their record-keeping systems to give individuals access to all data collected on them, the expense could be "catastrophic," says Alan Westin, publisher of Privacy & American Business in Hackensack, N.J.

Moreover, he says, "you have to look carefully at the effect such bills could have on consumer choice." For instance, about 60 percent of Americans say they like it when a company tailors its offers to individual preferences and buying patterns, according to consumer surveys.

While some businesses have been pioneers in the field of privacy protection, consumer and privacy advocates do not believe industry self-regulation is enough.

"If something goes wrong, the individual needs a remedy," says Mr. Hendricks. "Industry is certainly doing more than it's ever done before, but that's because the threat of legislation is real."

As the nation struggles to achieve consensus on how much control individuals should exert over personal data, state legislatures have been quickest to act. Like Massachusetts, California and New York are considering broad privacy-protection packages. Other states, meanwhile, have taken up bills on individual privacy issues, such as the use of medical and driving records.

"There is more pressure than there ever has been in this country for privacy legislation," says Mr. Sorkin, who directs the Center for Information Technology and Privacy Law. "Until the last year, I would have said the public only cares when there's a horror story.... But we're seeing more of these instances ... and people are seeing how companies can track data about them."

Although there are some federal laws, including the Privacy Act and the Fair Credit Reporting Act, additional statutes from Congress have not come as quickly as the changes in data technology. Congress did pass a Driver's Privacy Protection Act in 1994 to restrict access to information collected for licenses. But that law may be overturned by a pending Supreme Court ruling, making state laws the only such protection available.

Not everybody agrees that control of personal data is a fundamental human right, says Mr. Sorkin. But the industry should brace itself for the possibility that it won't be as successful in state capitals at it has been in Washington. "It's going to be quite a shock to ... businesses if some of this legislation passes."

(c) Copyright 1999. The Christian Science Publishing Society