Redress For Online Privacy Complaints

Jean Ann Fox, Director of Consumer Protection
Consumer Federation of America

Redress For Online Privacy Complaints Congress [pdf]

Redress for consumers is an essential feature of any law or regulation addressing the Internet or electronic commerce. Problems to be redressed range in seriousness and complexity from fraud, theft of identity, and security breaches at the severe end, to undelivered merchandise, billing errors, and intrusive online marketing. Although the Internet provides unique capabilities for consumers to shop the world, the fundamentals of providing consumers with the tools to redress grievances in the real world must carry over to the virtual world. Consumers need low cost, easily accessible and effective dispute resolution mechanisms to solve the inevitable problems that arise when using the Internet.

Consumer confidence in using the Internet to communicate, to search for information, or as a shopping venue must be built on a comprehensive framework of clear and accurate disclosures, security and privacy protections, and fundamental consumer protections. New technology permits online companies to collect information about individual consumer surfing and purchase behavior in ways that infringe on consumer expectations of privacy and security of personally identifiable information. Distance and cross border differences in consumer protection can make resolving consumer complaints more difficult than consumers would experience at the neighborhood mall. The United States does not have an Internet privacy law or specific rules governing electronic commerce.

This paper will consider alternative dispute resolution as a tool for resolving problems encountered by consumers related to the privacy and sharing of their personal information. The paper will first discuss the kinds of alternative dispute resolution available to consumers generally in the online environment. It will then examine the benefits and limitations of alternative dispute resolution as they apply to consumers who avail themselves of these mechanisms, and outline the fundamental characteristics of robust, effective alternative dispute resolution mechanisms. Finally, it will point out reasons why alternative dispute resolution may be particularly limited in its ability to address consumers' online privacy concerns.

Depending on the type of problem, consumers can file complaints with the Federal Trade Commission, turn to their state attorney general's consumer protection office or local government consumer protection agency, or use the legal system to resolve disputes. Law enforcement agencies are better equipped to handle cases that involve fraud or practices that violate a company's posted privacy policy. If online purchases are charged to credit cards, consumers can seek redress through the payment card protections provided by the Truth in Lending Act. Consumers can also file complaints with the dispute process provided by privacy seal programs such as TRUSTe or BBBOnline, or use commercial online alternate dispute sites.

Alternative Dispute Resolution (ADR) systems for online transactions have received a great deal of attention in international venues, at Federal Trade Commission and Department of Commerce workshops, and in negotiations between business interests and consumer groups. ADR provides an extra-judicial method to resolve disputes and encompasses a range of methods including mediation, arbitration, and complaints assistance. The debate around the proper role of ADR focuses on whether arbitration should be mandatory for consumers, whether governments should set the standards for ADR systems, whether ADR decisions should be binding on the consumer and under what circumstances, and whether the results of arbitration should be made public.

Consumers International (CI), an organization comprised of 250 organizations in 115 countries whose mission is to support consumer organizations and to campaign internationally for consumer rights, studied 30 online ADR services in 2000. CI found that none of the services met their criteria for effective online dispute resolution between business and consumers in the global marketplace. A recent CI study, Disputes in Cyberspace, reported that few online ADR sites help consumers deal with uncooperative merchants and that ADR services are disproportionately expensive. The CI report concluded that consumers cannot and should not trust that alternative dispute resolution systems available online can offer adequate redress.

The Trans Atlantic Consumer Dialogue (TACD), an association of over 65 consumer organizations in the European Union and the United States, provides a blueprint for the implementation of ADR programs that can offer true benefits to consumers. TACD and Consumer Federation of America agree that these fundamental principles must guide the resolution of consumers' e-commerce related complaints by ADR:

• Frameworks for ADR systems should be set by legislation.
• ADR should be a voluntary option for consumers, not a legal or contractual requirement.
• ADR systems should be easily accessible and convenient. Information about procedures, costs, the basis for decisions, and the enforceability of decisions should be provided to consumers prominently and clearly.
• ADR systems should be free or low-cost and operate in an expeditious manner.
• ADR systems should be independent, operated by reputable third parties. Personnel should have no direct interest in the disputes or the parties involved.
• Decisions on behalf of consumers should be binding on the other party, except that appeals could be brought on grounds of mathematical mistake or other technical issues.
• Decisions arrived at by ADR must be enforced in a meaningful manner.
• Consumers who submit disputes to ADR systems should not be asked to waive their legal rights, nor should they be restricted or blocked from resorting to other avenues of recourse that would normally be available.
• Consumers' use of ADR systems should not prevent law enforcement authorities or others from using their cases in actions to stop fraud or abuse.

Some nations have already instituted privacy redress methods. The governments of Canada, Korea and New Zealand have government-run or funded ADR schemes in the privacy area. In Canada, the Privacy Commissioner can encourage complainants to resolve disputes directly or he can initiate his own investigations. The Canadian official can also publicize privacy practices and take complaints to the federal court of Canada. The United States has not enacted an Internet privacy law and has not set standards for alternate dispute resolution systems or other informal redress mechanisms for disputes arising from consumer use of the Internet.

Although ADR should be one option for resolving consumer complaints, it is less likely to be effective for resolving privacy cases. The effectiveness of currently available ADR processes for privacy complaints is subject to question. In columns published in the Direct Marketing News in late 2000, Robert Gellman, a privacy consultant, examined the dispute resolution programs employed by TRUSTe and BBBOnline. He found that TRUSTe did not provide statistics, formal decisions or rules that would make it possible for anyone to review the effectiveness of its dispute resolution program. It was not apparent who made decisions or whether TRUSTe was unduly influenced by the corporations who support the seal program. The evaluation of BBBOnline's dispute program found better public accountability for dispute resolution than that provided by TRUSTe, but raised questions about forum shopping when companies belong to two seal programs with different dispute resolution systems.

Further, online privacy and security violations are likely to be systemic and are unlikely to involve only an individual consumer. If a website collects information contrary to its privacy policy from one consumer, it is probably doing so with all consumers who visit that site. Such a violation is not adequately addressed by ADR, which would respond only to the concerns of one consumer. Further, bad actors, such as a hacker stealing credit card numbers from businesses' or consumers' computers are not likely to agree to arbitrate each individual consumer's complaint. Until Congress provides new protections, consumers should seek legal help or file complaints involving privacy and security breaches with the Federal Trade Commission and their state attorneys general. The FTC can screen a high volume of complaints for patterns of abuse and take action to stop privacy practices that involve fraud or violate the website's stated privacy policy.

As Congress frames legislation to protect consumer privacy and security on the Internet, a full range of redress and enforcement tools must be provided. Consumer advocates support the provision of voluntary alternative dispute resolution mechanisms that meet congressionally legislated standards as an option for resolving individual disputes. But a federal privacy law must provide a full range of redress options including a private right of action and class action lawsuits, as well as enforcement by state attorneys general and the Federal Trade Commission and/or any new entity established to implement the law.