| |
Chairman Stearns, Mr. Towns, and members of the
subcommittee, my name is Paul Misener. I
am Amazon.com’s Vice President for Global Public Policy.
Thank you very much for inviting me to testify today.
Amazon.com is the Internet’s leading retailer.
As I described in detail in my testimony before this subcommittee last
year, Amazon.com uses consumer information to personalize the shopping
experience at our online store and, thus, to help our customers find and
discover anything they may want to buy. At
the same time, Amazon.com is pro-privacy: we
make every effort to provide our customers outstanding privacy notice, choice,
access, and security.
Mr. Chairman, through your steadfast leadership, and the
dedicated efforts of the members and extraordinarily talented staff of your
subcommittee and the full committee, you have amassed what likely is the
world’s most comprehensive legislative record on consumer information privacy.
You have held seven highly informative hearings and countless meetings
with company and association representatives, public interest advocates, and
academics. Your willingness to
listen impartially to all parties is well known and greatly appreciated.
It is not surprising, therefore, that you have introduced,
with bipartisan support, such an excellent bill, H.R. 4678.
The essential purpose of your bill, if I may summarize it, is to provide
consumers a baseline of information privacy protection, regardless of the
specific type of information involved; regardless of the medium through which it
is collected; and regardless of where a consumer is located in the United
States. This approach works very
well with existing U.S. privacy law, which provides additional protections for
particularly sensitive information (such as medical and financial records) and
particularly hazardous situations (such as unsupervised children online).
As I will describe in detail momentarily, H.R. 4678
includes the three indispensable components about which I testified to your
subcommittee last year. Specifically,
your bill would address consumer information uniformly among all methods of
collection; it would establish a national system that avoids a hodgepodge of
state rules; and it would employ the consistency and balance of a public
enforcement mechanism. H.R. 4678
goes even further by addressing head-on the issue consumers often cite as their
principal “privacy” concern: identity
theft. It also wisely would begin
the process of examining how best to harmonize privacy protections worldwide.
All in all, Mr. Chairman, H.R. 4678 is an excellent bill.
I must explain, however, that Amazon.com is not actually
seeking privacy legislation. For
several reasons, we believe it would not be proper for us to do so.
First, if we were to argue that a bill must be passed, we might
incorrectly be viewed as suggesting that a bill is necessary in order to make
our company protect consumer privacy. But
as I briefly outlined earlier, and described in detail in my testimony last
year, Amazon.com already provides excellent privacy protections to our
customers. In fact, H.R. 4678 likely would not require Amazon.com to
alter its privacy practices in any substantial way:
we simply do not need a new law to force us to provide outstanding
consumer privacy protections.
Second, Amazon.com arguing that a bill must be passed could
be misinterpreted to mean that we want Congress to force other companies to
offer privacy protections at the level that we already do.
After all, it is a centuries-old tradition for market-leading companies
to seek regulations that mirror their current practices, if for no other reasons
than to impose additional costs on existing competitors and market entry costs
on potential competitors. Frankly,
however, we think other companies neglect consumer information privacy at their
peril: Companies simply must offer excellent privacy practices or
else they will lose business, regardless of whether a law requires it.
Third, if we actively seek passage of a federal bill, it
might be said that we merely wish to preempt state legislation in this area.
Although it is true that state-by-state legislation of consumer
information privacy easily could produce an untenable and unconstitutional
“crazy-quilt” of rules with which online companies might find it difficult
or impossible to comply, states thus far have heeded our warnings in this
regard. A national privacy scheme,
based on explicit preemption of state laws, is an essential component of any
federal legislation but, obviously, until state laws are passed, no such
preemption is necessary.
Finally, by arguing that a bill must be passed,
Amazon.com might mislead some observers into thinking that we believe a bill is
necessary to improve consumer confidence on the Internet. Although we are aware of intuitive and compelling arguments
that legislation is necessary to boost consumer confidence, we are not nearly so
sure this is true. Just as in the
offline retail world, consumers know there are both safe and unsafe places to
shop.
In sum, Mr. Chairman, we do not come before you today
requesting privacy legislation. Others
have made a strong case for a new law but, for the reasons I have just
articulated, Amazon.com is not prepared to make the same case.
Nonetheless, Mr. Chairman, if you and your colleagues
determine that general consumer information privacy legislation is needed,
Amazon.com fully supports H.R. 4678 to meet this need.
This bill is an excellent vehicle by which Congress could address the
consumer information privacy concerns various parties have raised, and
Amazon.com could continue to serve our customers well if it were enacted.
In my remaining time, I would like to offer
Amazon.com’s support for three particular and essential aspects of H.R. 4678.
Without any one of these components, Amazon.com – and, I suspect, many
other companies – could not support this bill.
First and foremost, H.R. 4678 addresses consumer
information privacy holistically, without regard to the medium through which the
information is collected. This
parity among media is both wise and fair. It
is wise because the personal consumer information collected offline (to the
extent the terms “offline” and “online” have any meaning in today’s
world of communications convergence) is as sensitive as or, often, is more
sensitive than, information collected online.
There is no reason for legislation to treat, for example, the privacy of
a person’s mailing address differently if it were collected at an online
website instead of at a mall kiosk or over the phone.
This parity also is wise because online transactions often
provide more consumer privacy protections than offline transactions.
Indeed, brick-and-mortar retailers know their customers’ physical
characteristics, including race, sex, weight, complexion, et cetera, but online
retailers cannot. And unlike their online competitors, brick-and-mortar
retailers also know their customers’ geographic location; we online retailers,
on the other hand, do not know from where our customers access our Website.
Parity also is fair to online businesses, because the
information privacy practices of competitors that happen to operate through
different communications media would be treated the same.
And, most importantly, parity is fair to consumers, because it would
address 100% of their retail transactions rather than the mere one or two
percent conducted online. Significantly, parity also would address the privacy concerns
of those persons on the unfortunate side of the digital divide, not just those
people who shop online. This bears
repeating: an online-only bill
would have the perverse effect of providing no privacy protections to those on
the unfortunate side of the digital divide.
In sum, H.R. 4678
wisely and fairly addresses consumer information privacy without regard to the
medium through which it is collected.
Amazon.com also
supports H.R. 4678’s national approach to consumer information privacy.
It would be difficult or impossible for nationwide entities such as our
company to comply with a “crazy-quilt” of state consumer privacy
legislation. The inherent
interstate nature of Web-based commerce – a single Web page is viewable from
anywhere in the world – demands a national solution; your bill recognizes this
fact by preempting relevant state law.
Finally, Amazon.com
supports the bill’s faith in the consistency and balance of a public
enforcement mechanism. Consumers
need readable, not legalistic, privacy notices.
Only a regulatory body such as the Federal Trade Commission is well
positioned to balance the competing goals of legal precision and readability.
Indeed, despite the bill’s emphasis on the readability of privacy
notices, private litigants would have no interest in protecting readability.
If private enforcement were authorized, companies like Amazon.com might
be forced to adopt Balkanized, legalistic privacy notices at the expense of
consumer accessibility. Only a
public enforcement mechanism, such as that included in H.R. 4678, would foster a
tenable balance between the competing goals of accuracy and readability.
Let me summarize by saying that although we are not
explicitly seeking privacy legislation, Amazon.com is, on behalf of our company
and customers, proud to support H.R. 4678, which wisely and fairly addresses
consumer information uniformly among all methods of collection; establishes a
national system that avoids a hodgepodge of state and local rules; and employs
the consistency and balance of a public enforcement mechanism.
As I mentioned earlier, it also sensibly addresses consumer identity
theft and the international aspects of privacy policy.
Thank you again, Mr. Chairman, for your attention to the
facts and details of consumer information privacy. On behalf of our company and customers, Amazon.com sincerely
appreciates your perspicacity.
Lastly, thank
you for inviting me to testify; I look forward to your questions.
|
|
