Electronic
commerce offers unique opportunities to collect, store, and "mine"
information about consumers, and to use that information to make the
interaction between consumer and vendor more efficient. For example,
the consumer's subsequent visits to a website can be streamlined and
tailored. This is made possible by using stored information from
one or more typical sources:
- information furnished originally by the consumer on a registration page,
- data automatically recorded in a "cookie" file that is stored on the consumer's computer (which might include identification, hardware and software capabilities, passwords and access codes),
- information automatically collected online by reviewing other files on the consumer's computer,
- a transaction record of the consumer's purchases, payments, license and warranty registrations, and e-mail communications,
- "clickstream" data automatically recording the sequence of the consumer's visits to pages and links on the site,
- possibly consumer-specific or psycho-demographic modeling data obtained from third parties, such as individual reference services or marketing companies, to match with site-generated data.
Such
information allows the vendor to reduce delays during site visits and
eliminate the need for re-entering personal data on successive pages
or in successive visits. Personal data may be necessary to authenticate
the identity of a customer, process electronic payments, extend credit
online, or to allow the consumer to track product delivery or verify
account activity. Stored personal data may also be used to provide
appropriate after-sale service, such as responding to technical questions,
furnishing warranty service, and providing information about product
upgrades or alerts. Analysis of individual transactions and preferences
allows vendors to fine-tune their product offerings and advertising,
and to target their direct marketing to the elusive "market of
one." Not surprisingly, consumer data has become a prime
asset in electronic commerce.
At
the same time, polls and informal surveys repeatedly show that consumers
are often troubled by concerns that their stored personal data will
be intercepted or misused, leading to embarrassment, harassment, fraud,
credit card theft, erroneous judgments of their credit standing, or
a flood of unwanted solicitations. Such concerns (which arise
from both online and offline consumer profiling techniques) have motivated
diverse legislation designed to protect aspects of informational or
data privacy, as well as voluntary, contractual, and self-regulatory
practices designed to reassure prospective customers.
These
data protection insurance measures, however, vary considerably from one jurisdiction
to another, and often from one business sector to another. Consumers
online frequently deal directly with vendors located in distant states
or countries, where privacy laws and expectations differ from their
own. In those cases, whose data protection laws and which enforcement
mechanisms should govern the collection and use of personal information?
Our
analysis starts in Part I with (A)
a summary of the relatively new legal protections of informational or
data privacy and rights to control direct commercial solicitations,
as reflected in the laws of the United States, the European Union, and
a sampling of other countries. We describe (B)
how courts and regulators are likely to resolve conflicts of data protection
law offline and (C) how traditional conflicts analysis is likely
to be applied (and possibly modified) in the context of cross-border
electronic commerce. In Part II we consider whether these
results are likely to be predictable, fair, or efficient, and how they
might produce adverse consequences for consumers and vendors in electronic
commerce. Finally, in Part III, we offer some suggestions
as to how conflicts analysis should be applied to data protection in
cyberspace, and how viable alternatives to judicial or regulatory enforcement
actions could evolve that would render the jurisdictional analysis irrelevant
in most cases.
0 Komentar untuk "Data Protection Laws and Jurisdiction "