Online Social Networks and E-Commerce - MIT Computer Science ...

Clarence Lee and Shirley Fung
Similar to Title V of GLBA, our proposed accountability structure should serves four purposes: 1) inform
consumer about the types of information stored, 2) allow user to have control over what data to be
released, 3) standardize and require all businesses to draft protection plan, and 4) establish enforcement
authority.
Inform Consumers About Information Stored
While the Financial Privacy Rule holds business accountable to educate the user about privacy protection,
one of the biggest complaints is that there is no standardized way of displaying that information to the
user. GLBA leaves the burden of deciding the format in which the privacy policy is present on the
business, and hence many businesses would often present the privacy policy in a long and convoluted
manner in order to discourage the consumers from reading it. This defeats the purpose and we propose
that an easy to understand structure to be established to educate the user.
One possibility would be to leverage the Platform for Privacy Preferences (P3P) Project. Developed by the
World Wide Web Consortium, the P3P Project “enables Websites to express their privacy practices in a
standard format that can be retrieved automatically and interpreted easily by user agents (Platform for
Privacy Preferences (P3P) Project).”
Another possibility would be to use a simple visual chart to display the kinds of information stored on
third party Web sites. Similar to the Nutritional Facts chat found on all packaged foods in the United
States, a simple, standardized chart like that can effectively educate the user about information stored.
Allow User to Control Data Released
Another improvement upon the GLBA system would be to provide a simple way for users to opt-out.
While the current GLBA system allow users to opt-out from having their Financial information shared
with non-affiliated companies, the opt-out description is often confusing to read and hard to understand.
This places the burden of decision on the consumer to learn about the possible opt-out options and
actually going through the complicated procedures of opting-out. While this sounds like it is trying to
protect the consumer on paper, in reality the rule is not very effective. Companies can do whatever they
want with the consumer data as long as the user does not opt-out, hence this creates an incentive for
businesses to make the opt-out procedure to be as complicated as it can be.
Having an easy-to-understand opt-out description would actually give consumers the power of decision.
While we could have proposed an opt-in system where users have to opt-in to allow companies to share
any consumer information at all, we feel that this would be too restricting on businesses in that almost no
consumer would actually volunteer to have their information be shared. Since we believe that this option
will garner much resistance from businesses, we feel that the clear opt-out approach would be a better
compromise.
Page 34