The Collection, Dissemination and Tagging of Personally Identifying Information

Abstract

Listen

Translate article

As the twenty-first century bustles forward, the e-commerce becomes an ever more dangerous place. On a daily basis, websites collect vast amounts of personally identifying information (PII) and mine it in sophisticated databases to discover consumer trends and desires. This process provides many benefits - such as tailored websites and relevant marketing - that few Web surfers would care to do without. However, serious threat lurking in cyberspace and consumers continue to submit vast amounts of information in a state of relative unawareness. Not wanting to miss out on their Web surfing experience, visitors submit their personal information without glancing at a company's privacy policy. In 2008, 100% of the most highly trafficked websites in the United States collect PII while just over 60% have privacy polices that clear explain PII practices. Instead, of offering explanations, e-commerce companies obfuscate and exacerbate the serious threats surrounding PII collection and dissemination. This occurs most often via inconspicuously posting privacy policies written in small font and filled with legalese and loopholes. The United States legal system allows such obfuscation unless a company breaks a privacy promise. This article argues for a federal PII Tagging law where companies face a choice. They must: (1) post a clear and conspicuous privacy policy drafted in plain English or (2) associate (tag) their name to each piece of data they disseminate. Over time, consumers will tire of solicitations beginning with the phrase Hi, I represent company X and we purchased your telephone number, etc. from company Y. Such social pressure will lead companies to take the simple and nearly costless step of drafting better privacy policies. At the end of the day, Tagging legislation represents a middle-ground solution that protects PII without excessively hindering e-commerce efficiency.