US privacy bill aims to tighten data collection and storage rules

US SENATORS John Kerry and John McCain introduced a privacy bill on Tuesday that if passed would require companies to disclose when personal data is collected and force them to keep it under wraps.

The bill would mean companies will have to notify users in clear terminology why they are collecting data, who would be able to view it and how the firm will keep it safe. Kerry and McCain's bill comes a week after thousands of Internet users had their personal data stolen through a security breach suffered by the online marketing firm Epsilon.

As part of the bill, companies that collect data must allow customers to opt out of some data collection and, for some types of data, such as medical conditions, collection will be opt-in. The intention is to pressure businesses to only collect data needed for a particular transaction.

Kerry said that companies actually agreed with the proposals put forward in the bill, saying, "These companies agree with us that it doesn't just make good business sense to protect their customer; they know it's the right thing to do." McCain said that the bill tries to balance the needs of advertisers and customer privacy, "Our bill seeks to respect the ability of businesses to advertise, while also protecting consumers' personal information."

Not surprisingly marketeers were somewhat more apprehensive about the bill, with Linda Woolley, VP of the Direct Marketing Association (DMA) saying, "[the] DMA is wary of any legislation that upsets the information economy without a showing of actual harm to consumers".

Consumer rights groups and privacy advocates expressed disappointment because they believe the bill is not tough enough. Jeff Chester, director of the Center for Digital Democracy said in a blog post, "This bill has so many loopholes - including one to please Facebook - that it will not really help consumers and citizens", while John Simpson of Consumer Watchdog  a group that has lined up with other privacy aware organisations to pen a letter to McCain and Karry, added "We cannot support it today."

That organisation was equally scathing about the treatment offered to Facebook, and in its letter wrote, "We oppose the bill's special interest treatment of Facebook, and other social media marketers, that permit them to gather data on their users without sufficient safeguards."

Big technology firms such as HP, Intel, Microsoft and even Ebay all support the bill, however.

There's little doubt that some concrete rules governing how firms collect, store and protect information is needed after the Epsilon data theft. Whether or not Kerry and McCain's bill is tough enough is up for debate but at least it's a step in the right direction. µ