Privacy bill could outlaw my web site

Apr 24 20:09 UTC 2002

Senator Hollings, of South Carolina, has introduced a bill (S. 2201, the
Online Personal Privacy Act) which may have an impact on my web site, The
Political Graveyard.  The bill is on a VERY fast track: it was introduced
last week, and hearings are scheduled for tomorrow.

Below is the text of a letter I plan to send to him and the other members
of the Senate Commerce Committee.


=======================================================================

I'm writing with regard to the Internet privacy bill (S. 2201, the Online
Personal Privacy Act) introduced by Senator Hollings.  I have reviewed the
text as posted online at
http://www.cdt.org/legislation/107th/privacy/oppa.pdf

I am the creator and webmaster of "The Political Graveyard" --
http://politicalgraveyard.com -- a database of U.S. political history and
cemeteries.  The site, which I started in 1996, lists and contains brief
biographical information about more than 80,000 political figures, living
and dead.  It has received 35 awards, favorable press coverage in national
news media, and get approximately 200,000 visits per month (or about two
million file hits per month).  Thousands of other sites have linked to it,
including libraries, news media, political parties and advocacy groups,
historians, political scientists, and genealogists.

It's my own personal project, and I don't do it for profit.  But since the
site does contain advertising banners, which generate a small amount of
revenue, and because PoliticalGraveyard.com bumper stickers are available
for purchase through the site, it surely qualifies as a commercial web
site under the proposed Act.

In January 2002, I published a privacy policy for The Political Graveyard
-- http://politicalgraveyard.com/privacy.html -- a codification of what I
was already doing.  I do not gather personally identifiable information
from those who visit the web site, nor use "cookies" in any way.  Email
addresses (e.g., those who contact me about the site) are never disclosed
without the explicit consent of the addressee.

All of this is very much in line with the letter and spirit of the
proposed legislation.  However, the bill as written is so broad in its
language that it could adversely affect legitimate online speech -- such
as my web site.

What concerns me most directly is Section 203, which creates a private
right of action against a webmaster who "collects, discloses OR uses the
sensitive personal information of ANY person" (emphasis added).

"Sensitive personal information" is defined, in Section 401, to include,
among other things, health information, race or ethnicity, political party
affiliation, and religious beliefs.

My web site does indeed publish health information (usually cause of
death), race or ethnicity (lists of African-American, Asian-Pacific,
American Indian, and Hispanic politicians), political party affiliation
(candidacy on party tickets and delegateships to party conventions), and
religious beliefs (lists of Catholic, Presbyterian, Lutheran, Jewish,
etc., politicians).  Thousands of these political figures are still
living, and presumably some number of them have visited my web site and
become "users".

I contend that each and every one of the more than 80,000 politicians
listed on my web site, living and dead, are "public figures" within the
meaning of New York Times v. Sullivan and following cases.  Moreover, the
large majority of the information on my site is not only public
information, but collected "offline" through legislative manuals,
biographies, campaign literature, published obituaries and news reports,
and so on.

However, there is no question that the Political Graveyard web site (1)
"discloses", (2) the "sensitive personal information" (as defined above),
(3) of "any person" (including public figures living and dead).

Therefore, anyone listed who is aggrieved with me for any reason could go
to court and potentially obtain an injunction and a judgement of $5,000
against me.  Probably not an already widely known figure, of course, but
perhaps someone who ran for state or federal office twenty years ago and
for some reason doesn't want that fact known today.  I have heard from
such a person already.

There is more.  The term "collect" in the bill, as in collecting personal
information, is defined so broadly that information I might obtain from an
online edition of a newspaper, and incorporate into an individual's entry
on my web site, would be included, if that person should at any time visit
my web site and become a "user".

On the other hand, as a small-time politician myself (I'm a county
commissioner), I would rather not see online privacy rights be stripped
from public figures!  A United States Senator who visits a web site or
uses an online service should be accorded the same information security
privileges as anyone else.  Any exception should be carefully tailored to
keep public information public, and private information private.

I support the effort to protect privacy online, but I urge that the
provisions of this bill be carefully considered.

---
Lawrence Kestenbaum, polygon@potifos.com
Washtenaw County Commissioner, 4th District
The Political Graveyard, http://politicalgraveyard.com
Mailing address: P.O. Box 2563, Ann Arbor MI 48106

response 2 of 22:

Apr 25 02:41 UTC 2002

Does the law explicitly include dead people?

response 4 of 22:

Apr 25 03:18 UTC 2002

I think it's safe to assume that the Supreme Court will throw
out any law which burdens on-line publication of information
any more than dead-tree editions.  OTOH, being the test case
would be tedious, expensive and nerve-wracking.

response 6 of 22:

Apr 25 12:28 UTC 2002

Re 3.  Currenty, the odds of a random Washtenaw County Commissioner
being an attorney are 1/15.

Re 5.  Where in the bill is information obtained offline specifically
excluded?  And what about information obtained from public online sources? 

The "overall intent" is not necessarily controlling.  The intent of the
Racketeering Influenced Corrupt Organizations (RICO) law was to put
Mafiosi in jail, but now, RICO figures so commonly in corporate lawsuits
that one lawyer commented to me that it would be malpractice not to charge
your adversary with a RICO violation.

Federal prosecutors could certainly be malicious and abusive, but I'm more
concerned about the fact that ANYBODY could bring a lawsuit under this
law.

response 8 of 22:

Apr 25 14:22 UTC 2002

I got the impression he had information on his site about people who
aren't dead yet, so it doesn't matter if it excludes dead people.

response 10 of 22:

Apr 25 16:22 UTC 2002

Would getting the geneology folks to write help the cause?  While many of them
are searching for dead relatives online, they often are also searching sites
for information about living relatives.  Seems like anyone who posts family
information about  another family member, even if it is public, like
birth/death/marriage, might be at risk.

response 12 of 22:

Apr 26 12:47 UTC 2002

#6>  Title IV - Miscellaneous
Sec.401.Definitions
(11) Personally Identifiable Information
(B)  INFERENTIAL INFORMATION EXCLUDED--Information about an individual
derived or inferred from data collected online but not actually collected
online is not personally identifiable information.

response 14 of 22:

Apr 27 06:44 UTC 2002

good grief! what are these 'law'makers smoking these days? nothing
i ever heard about - except from stalin.

response 16 of 22:

Apr 27 14:38 UTC 2002

I've concluded that I was unduly alarmed about this.

response 22 of 22:

Apr 28 06:39 UTC 2002

Heh, long as ye spells me name at least accurately enough that
I can rekinize it.