|
Article Excerpt
This Article will examine the new Internet privacy law passed by the Minnesota state legislature. The law restricts an Internet service provider's disclosure of information that identifies a consumer by physical or electronic address or telephone number, by a history of Internet or online sites visited by the consumer, or by information stored on any of the consumer's data storage devices. The law is narrow in scope, but represents an important first step in protecting personal privacy online. In addition, the law anticipates the passage of a federal law, as it specifically expires on the effective date of any federal legislation that preempts state regulation of personally identifiable information. This Article thus will compare the Minnesota law to a proposed Senate bill that is far greater in scope.
I. INTRODUCTION
In a scene from Steven Spielberg's futuristic film, "Minority Report," the main character walks through a commercially enhanced shopping mall. (1) Holographic billboards greet him every few seconds: "Stressed out John Anderton? Need a vacation? Come to Aruba."; "Challenge yourself, John! Push harder, John!"; and "It's not just a car, Mr. Anderton. It's an environment." (2)
While the film is set in the year 2054, when sophisticated iris scan technology provides instant recognition of people by machines that scan their eyeballs, (3) we presently have the similar capability to identify and monitor the habits of online users. By tracking personal information like social security numbers, telephone numbers or e-mail addresses, individuals can be immediately identified. Unlimited amounts of information can be tied to those identifiers.
When someone buys an item in a store and is asked for his or her phone number at the cash register, all the information about that transaction can be permanently associated with that person. When one uses a grocery store's discount card, all of the purchases can be recorded. On the Internet, whenever someone visits a website, requests information, or performs a search, that information can be saved and linked to that person.
In the brick and mortar world, one can choose not to divulge a phone number to a clerk at the cash register, or refuse to shop at stores that require the use of a special card to receive discounts. On the Internet, however, it is becoming increasingly difficult to retain much anonymity.
If someone entered a store at a shopping mall and was greeted with a voice saying, "Hello, Mr. Yakamoto! Welcome back. How'd those assorted tank tops work out for you?" he might think twice about returning to that store. While some people might enjoy a personal welcome with ready service, others might prefer to shop more anonymously. In the non-electronic world, one always has the option of leaving the store.
One of the enticing characteristics of the early days of the Web was its aura of anonymity. Even today, many people who might be hesitant to participate in a live, face-to-face environment might feel more comfortable contributing in an electronic chat room, where they do not have to deal with traditional nuances of social interaction. The pervasive collection, sharing, and selling of personal information on the Internet threatens to undermine this essential feature of the medium.
The evolution of the Internet has seen the technology of data collection far surpass the ability of the law to protect the information collected. While an individual can refuse to disclose personal information in a store or over the telephone, it is virtually impossible to prevent the compilation of information online that one may not even be aware is being collected.
While the tragedy of September 11, 2001, temporarily pushed many concerns about privacy to a back burner, efforts are again underway to improve the personal privacy protection of Internet users. Minnesota has taken an important step by passing the nation's first Internet privacy law. (4)
II. MINNESOTA'S INTERNET PRIVACY LAW
Minnesota's Internet Privacy Law, which took effect March 1, 2003, regulates the disclosure of personally identifiable information ("PII") by Internet service providers ("ISPs"). (5) The law mirrors the federal Video Consumer Privacy Act (6) and the state videotape rental privacy laws of New York (7) and Minnesota. (8) These laws generally prohibit the disclosure of the video rental habits and PII of individuals who rent videotapes. (9) Similarly, Minnesota's new law prohibits the disclosure by ISPs of the browsing habits and PII of individuals who purchase services enabling them to gain access to the Internet. (10)
Under Minnesota's law, ISPs are prohibited from disclosing PII except when the PII is specifically required to be disclosed (11) or is specifically permitted to be disclosed. (12) An ISP may obtain the authorization of a consumer to permit disclosure using either an opt-in or opt-out scheme. (13) The law expires on the effective date of any federal legislation that preempts state regulation of the release of PII by ISPs. (14)
A. Definitions
Section 1 of Minnesota's new law defines an ISP as "a business or person who provides consumers authenticated access to, or presence on, the Internet." (15) Significantly, the scope of the law does not include operators of websites. A consumer is "a person who agrees to pay a fee to an Internet service provider for access to the Internet for personal,...
|
