Is It Time for EU-U.S. Consensus on Online Privacy?

Privacy online shouldn't be an impossible challenge -- it's an interactive environment where disclosures and options can be given right at the point where consumers are asked for information, or at the point where consumers enter sites that will automatically collect information about them.  Notice and consent are touchstones of fair information practices on both sides of the Atlantic. 

Of course, there are often questions about exactly what information must be divulged to achieve "fair" notice and "informed" consent.  As Tanya says, that is a risk management issue for individual website operators, as requirements and expectations change over time. 

Recently, there has been some convergence of legal requirements and public expectations for online privacy.  This is driven in part by the the FTC's approach to fair trade practices online and also by California's Online Privacy Protection Act, which requires a website privacy notice disclosing the categories of personal information collected through the site and the categories of third parties that receive the information.  (What commercial website operator in the US can afford to ignore California?)  Similar obligations arise under Canada's PIPEDA privacy law, so there is an emerging practice of website privacy statements and options in North America.

Overseas, national laws based on the EU Data Protection Directive still require more, however, such as disclosure of all the actual parties who will use the data, limitations on data retention, rights of subject access and objection, and an opt-out for any marketing uses of personal information.  Unless and until US laws address those issues across the board, we will probably continue to see commercial websites featuring little US and EU flag icons linking to separate sites and separate privacy policies. 

But the more controversial practices online involve the covert collection and use of personal information, as in some forms of undisclosed behavioral marketing.  That's become a popular concern in Europe as well as in the US and Canada, and it is possible to conceive of an international agreement on standards for disclosure, as well as for cooperation in enforcement across borders, where there is automated data collection across websites or based on search history.