Working For Privacy
     After complaints from consumers about the amount of information they were required to disclose for simple purchases and questions about what was done with the data, Washington Attorney General Christine Gregoire launched the Consumer Privacy Workgroup. The group, which includes industry representatives from companies such as Microsoft and Internet service providers as well as vendors, consumers and state regulators, began work in September and aims to have a report suggesting appropriate legislation by the beginning of December. Jenny Durkan, an attorney who is heading up the group, said that even if a consensus is not reached, Gregoire likely will sponsor legislation regulating some aspects of consumer privacy.
     "I think that everyone agrees that consumers believe there is a problem, that they're very concerned with how their information is being used by different entities," Durkan said. She added that the issue is so ripe in the state that a citizen initiative on privacy issues would likely result without legislation working to protect data. "And a citizen initiative would be much more drastic to business," she said.
     Maryland and Maine also have established similar working groups, with much of the focus pointing to securing medical record confidentiality. In some industries, such as the mental health field, confidentiality is an issue "all the time," according to Katie Fullam Harris, an assistant to the commissioner of Maine's Department of Mental Health, Mental Retardation and Substance Abuse. The legislature recently passed a bill that required the department to conduct a study on whether current confidentiality statutes, which allow almost no information to be shared between departments, are appropriate.
     Further complications arise as the department also oversees substance abuse services, covered under more stringent federal confidentiality statute. The group, which includes health care providers, consumers, family members of those receiving services and the department, is charged with the task of sorting out how services can best be rendered to those whose treatment may benefit from several entities sharing their medical records.

Answering The Call
     Massachusetts also has seen a slew of privacy-related measures pass through the legislature, with more than six bills currently pending that deal with the issue. Medical record privacy remains the hottest topic, with several pieces of legislation that would prohibit the sharing of predictive genetic testing results with insurance companies and other businesses that could potentially use that information to deny coverage or employment, explained Roz Jordan of the House Committee on Science and Technology. Another bill, H.B. 4105, would establish a special commission to investigate the use of private information. Rep. Douglas Petersen, D, who sponsored the measure, said his interest in confidentiality issues was spawned from his work as a psychotherapist, but added the current interest in privacy measures is a direct result of information technology advances.
     "It's the fact that information can end up in so many hands so quickly," Petersen said. "I want to protect Joe Q. Citizen from unwarranted intrusions on his privacy."
     Petersen said he worried that without the right type of information, he would be unable to craft appropriate legislation protecting consumers, and so he formed the idea for a policy working-group to study the matter. His bill remains in committee while others, such as those protecting medical records, have moved swiftly through both houses in the Commonwealth.
     Other states, such as Arizona and Oklahoma, have organized study commissions to tackle many Internet and high-tech issues, privacy included. John Kelly, director of Arizona's government information technology agency, said the group plans to consider a host of issues, from the concept of self-regulation for online merchants and their privacy policies to spam controls and how they relate to existing telemarketing regulations. "We want to also make sure tax records and drivers' records are protected to the extent that public records will allow," Kelly said.

Gaining Momentum
     Protecting those records earned states like California, Illinois and Massachusetts a spot among the top 10 states in privacy protection, according to a survey released last week by Privacy Journal, a magazine covering privacy news. It rated the states on several factors, including whether they have privacy provisions in their constitutions, and if they have laws protecting medical, financial, library and government files. Publisher Robert Ellis Smith, who conducted the survey, said that the states which ranked highest were those that are traditionally willing to legislate and are not shy about enacting state laws. He also noted a correlation between those states housing high-tech industry areas and their privacy policies.
     "If a state is more technically savvy and the people there are too, there is more recognition of privacy," Smith said. "If it's the site of high-tech, like California, Washington and Virginia, you see more protections. (States such as these) have anti-spam laws, and that's not coincidental."
     But others housing high-tech hotbeds, like Texas, didn't even register on Smith's radar screen. He said that he couldn't find a single law in the Lone Star State protecting privacy, leading him to wonder if the lack of those provisions could have repercussions for the state's governor, George W. Bush, in his quest for the presidency. Privacy traditionally has been embraced by civil libertarians, liberals and conservatives as a consumer protection issue that sees no party lines, and Smith acknowledged that Democratic frontrunner Vice President Al Gore has a spotty record when it comes to privacy. "It's been predicted that it will be an issue but it hasn't yet," Smith said. "But neither one can claim the privacy mantle."
     But Texas didn't perform quite as badly as South Carolina in the rankings. Even laws protecting library records and permitting arrest records of innocent persons to be destroyed couldn't save the state from the Image Data license photo scandal — leaving South Carolina as the only state to earn a negative score.
     States working toward improving their privacy records may take comfort in the fact that the current tide has made it relatively easy to gain support for related legislation. The issue has gained more public attention and it is a relatively palatable subject that resonates with consumers — piles of junk mail and in-boxes full of spam give politicians real-life examples of why reform is needed. And as USIC's Rhodes says of most legislation, "If it just has the word privacy attached to it, it's gonna pass."
—by Stephanie Lash