The Electronic Messaging Association (?EMA?) welcomes the opportunity to participate in the Federal Trade Commission?s (?FTC? or ?Commission?) exploration of the effectiveness of self-regulation as a means of protecting consumer privacy interests online. EMA commends the Commission for seeking the input of the organizations and companies that depend on online communications and the Internet to accomplish their business goals and looks forward to continued cooperation between industry and government in formulating industry guidelines regarding online information practices.

EMA?s Unique Perspective

EMA is a trade organization that represents almost 500 corporate ?users? and ?providers? of electronic messaging and commerce. ?User? members of EMA participate in a wide variety of electronic messaging and electronic commerce and represent a number of industries including the aerospace, finance, health care, and petroleum industries. ?Provider? members offer a wide range of telecommunications and computing services including electronic mail, networks, directories, computer facsimile, electronic data interchange, paging, groupware, voice mail, software development, and mainframe and mini computer manufacturing.

On behalf of its members, EMA promotes electronic messaging and electronic commerce services in three primary ways: first, EMA assists in the definition, endorsement, development, demonstration, and implementation of all messaging standards, related operating conventions, and practices for electronic messaging and electronic commerce; second, EMA serves as an advocate for public policies that are favorable to electronic messaging and electronic commerce development; and third, EMA develops and hosts programs that promote a greater understanding and appreciation for all electronic messaging and electronic commerce services and technologies.

EMA has been a long-time advocate for the development of industry privacy guidelines in cooperation with its members, other user and provider groups, and government. In developing policies, EMA has found itself to be in a unique position because its ?user? and ?provider? members typically fall on both sides of any privacy issue. Drawing on the experiences and knowledge of its diverse membership, EMA has found that industry self-regulation is the most effective way to ensure a proper balance between individual and industry interests, so that privacy interests are met without compromising the benefits of online technologies and services for consumers.

EMA hopes to develop model privacy principles for its members. As a first step in this process, privacy will be a topic at EMA?s April 1998 Annual Meeting where EMA?s staff and member-company representatives will join together to discuss industry issues. Later in its Government Affairs Committee, EMA will examine surveys regarding members? current privacy rules, develop positions on what privacy protections and disclosures should be included in new and updated privacy guidelines, and determine how EMA can best help its members develop privacy practices that achieve consumer protection.

This process will address what EMA currently considers the five most important issues in developing privacy guidelines: self-regulation, notice and opt-out provisions for consumers, special considerations regarding children, the use of privacy-enhancing technologies, and international concerns.

EMA?s Development of Model Privacy Guidelines

Self-Regulation Is Preferable to New Legislation or Regulation

EMA believes that the Commission should allow companies and trade associations to develop privacy guidelines in lieu of mandated rules. Government regulation in this area is likely to be ineffective, given the ever-evolving nature of the computer marketplace. In fact, it could be counterproductive -- stifling the development of new technologies.

As has been demonstrated in past FTC hearings and workshops, the online community strongly supports privacy protection for various forms of personal information. Although the problem of protecting consumer privacy interests while conducting business online is challenging, EMA believes that industry has both the incentive and ability to meet this challenge. The online industry has a history of creatively solving complex problems by rapidly assessing consumer demands and utilizing evolving technologies to meet these demands. Companies that fail to be responsive to consumer needs will not be able to remain competitive. EMA believes that the online industry will answer the call to protect consumer interests by using its knowledge of the online marketplace and harnessing the ?creativity and innovation that have marked the development of interactive media to date.?

The numerous efforts of various companies and trade organizations to develop privacy rules and guidelines, and educate the online community about privacy issues, demonstrate that industry is already headed in the right direction. The Direct Marketing Association, Interactive Services Association, Coalition for Advertising Supported Information & Entertainment, Information Industry Association, Ingenius, and others, have already developed self-regulation policy examples. With the help of the Commission and privacy and consumer organizations, industry can build on these first efforts and create workable and effective standards for online information practices.

In addition to industry, the FTC will continue to play an important role in ensuring that consumers? needs are met. Although ?command and control? style privacy rules could never keep up with technological developments or adapt to the constantly evolving online marketplace as rapidly or efficiently as industry self-regulation, the Commission has, and should retain, the authority to intervene where online data collection is found to be fraudulent or deceptive. Online practices that violate the Federal Trade Commission Act and the FTC?s regulations should be investigated by the FTC, and parties should be sanctioned, where appropriate.

EMA believes that the cornerstones of any privacy policy are notice and opt-out provisions. Companies that collect information online should notify consumers of their activities and describe how they intend to use gathered information. Currently, all EMA members are encouraged to develop and use corporate email and computer system policies that notify employees if employers will monitor employee activities and use the information gathered through monitoring. Notice allows users to make individual choices about what email or computer activities they should undertake on the system. Similarly, EMA believes that consumers should be informed of online information collection practices and uses when conducting business or communicating online so that they can make informed choices about their online practices.

In addition to providing notice, EMA supports the development of industry guidelines that incorporate an ?opt-out? mechanism. Opt-out mechanisms enable personal information to be collected online and used, unless consumers specify otherwise. Opt-out mechanisms, when coupled with adequate notice, best enable consumers to make choices regarding their personal information, while at the same time allowing for the development and use of emerging technologies and services that benefit these consumers. As such, notice and opt-out mechanisms should be the method by which consumers are both informed of their rights and empowered to make choices regarding their personal information.

EMA believes, however, that the key to the success of notice and opt-out procedures is ensuring that consumers have been adequately informed of their rights and educated as to how to use the opt-out mechanisms. Accordingly, EMA supports the development of privacy guidelines that discuss ways in which such education will take place.

EMA also believes that industry should be particularly sensitive to the privacy interests of children and that the relevant industry should develop policies and guidelines that address specifically online information practices that affect children. EMA believes that guidelines should help ensure that parents are provided with the information that they need to protect their children. Industry guidelines should incorporate specific requirements for Web sites that are geared toward children. For instance, minors should be encouraged in language that is easily understandable to obtain parental approval before providing any personal information to a Web site geared to children. As discussed further below, EMA also supports the development and use of technology to protect children?s privacy.

EMA strongly supports the development and use of technology to provide privacy solutions. Existing technologies such as the Internet Profiles Corporation?s (?I/PRO?) I/CODE system and other anonymity enhancing systems enable consumers to make personal choices regarding whether their personal information can be collected online. Similarly, ?cookie? technology has been adapted to store a consumer?s privacy preferences for any given Web site on that consumer?s hard drive, and the Platform for Internet Content Selection (?PICS?) technology could be modified to help consumers assess a given Web site?s privacy protection. These technological solutions demonstrate that industry is quite capable of meeting consumer demands for privacy, and EMA supports continued innovation in this area.

Industry guidelines must take into account the global nature of the Internet. As other nations begin to address online privacy, U.S. industry must take into consideration these developments. For instance, the European Union?s Personal Data Directive, 95/46/EC, scheduled to come into effect in October 1998, requires that the United States have ?adequate protection? in place before personal data may be exported from European Union member states to the U.S. Hong Kong has developed a similar law. New international laws and policies can provide guidance as U.S. industry formulates its own policies and, in some situations, may affirmatively shape the end result.

Conclusion

Although the issues surrounding privacy and the online collection of data are complex, the online industry, through the cooperative efforts of EMA and other trade associations, consumer and privacy groups, and government, is poised and ready to answer the challenges. Indeed, industry has already demonstrated its ability to address privacy concerns by developing first-generation policies and technologies that provide workable solutions for both consumers and industry. EMA looks forward to contributing to the solution in the upcoming months as it seeks online information privacy guidelines, by capitalizing on its experience with electronic message privacy policies, that address the interests of consumers and industry alike.

If EMA can be of any assistance to the Commission or its staff as it strives to find effective ways to provide consumers with a reasonable expectation of privacy in their use of the Internet, please do not hesitate to contact me.

Respectfully Submitted,

Kerry Stackpole
President
Electronic Messaging Association