Senator Hollings, of South Carolina, has introduced a bill (S. 2201, the
Online Personal Privacy Act) which may have an impact on my web site, The
Political Graveyard.  The bill is on a VERY fast track: it was introduced
last week, and hearings are scheduled for tomorrow.

Below is the text of a letter I plan to send to him and the other members
of the Senate Commerce Committee.


=======================================================================

I'm writing with regard to the Internet privacy bill (S. 2201, the Online
Personal Privacy Act) introduced by Senator Hollings.  I have reviewed the
text as posted online at
http://www.cdt.org/legislation/107th/privacy/oppa.pdf

I am the creator and webmaster of "The Political Graveyard" --
http://politicalgraveyard.com -- a database of U.S. political history and
cemeteries.  The site, which I started in 1996, lists and contains brief
biographical information about more than 80,000 political figures, living
and dead.  It has received 35 awards, favorable press coverage in national
news media, and get approximately 200,000 visits per month (or about two
million file hits per month).  Thousands of other sites have linked to it,
including libraries, news media, political parties and advocacy groups,
historians, political scientists, and genealogists.

It's my own personal project, and I don't do it for profit.  But since the
site does contain advertising banners, which generate a small amount of
revenue, and because PoliticalGraveyard.com bumper stickers are available
for purchase through the site, it surely qualifies as a commercial web
site under the proposed Act.

In January 2002, I published a privacy policy for The Political Graveyard
-- http://politicalgraveyard.com/privacy.html -- a codification of what I
was already doing.  I do not gather personally identifiable information
from those who visit the web site, nor use "cookies" in any way.  Email
addresses (e.g., those who contact me about the site) are never disclosed
without the explicit consent of the addressee.

All of this is very much in line with the letter and spirit of the
proposed legislation.  However, the bill as written is so broad in its
language that it could adversely affect legitimate online speech -- such
as my web site.

What concerns me most directly is Section 203, which creates a private
right of action against a webmaster who "collects, discloses OR uses the
sensitive personal information of ANY person" (emphasis added).

"Sensitive personal information" is defined, in Section 401, to include,
among other things, health information, race or ethnicity, political party
affiliation, and religious beliefs.

My web site does indeed publish health information (usually cause of
death), race or ethnicity (lists of African-American, Asian-Pacific,
American Indian, and Hispanic politicians), political party affiliation
(candidacy on party tickets and delegateships to party conventions), and
religious beliefs (lists of Catholic, Presbyterian, Lutheran, Jewish,
etc., politicians).  Thousands of these political figures are still
living, and presumably some number of them have visited my web site and
become "users".

I contend that each and every one of the more than 80,000 politicians
listed on my web site, living and dead, are "public figures" within the
meaning of New York Times v. Sullivan and following cases.  Moreover, the
large majority of the information on my site is not only public
information, but collected "offline" through legislative manuals,
biographies, campaign literature, published obituaries and news reports,
and so on.

However, there is no question that the Political Graveyard web site (1)
"discloses", (2) the "sensitive personal information" (as defined above),
(3) of "any person" (including public figures living and dead).

Therefore, anyone listed who is aggrieved with me for any reason could go
to court and potentially obtain an injunction and a judgement of $5,000
against me.  Probably not an already widely known figure, of course, but
perhaps someone who ran for state or federal office twenty years ago and
for some reason doesn't want that fact known today.  I have heard from
such a person already.

There is more.  The term "collect" in the bill, as in collecting personal
information, is defined so broadly that information I might obtain from an
online edition of a newspaper, and incorporate into an individual's entry
on my web site, would be included, if that person should at any time visit
my web site and become a "user".

On the other hand, as a small-time politician myself (I'm a county
commissioner), I would rather not see online privacy rights be stripped
from public figures!  A United States Senator who visits a web site or
uses an online service should be accorded the same information security
privileges as anyone else.  Any exception should be carefully tailored to
keep public information public, and private information private.

I support the effort to protect privacy online, but I urge that the
provisions of this bill be carefully considered.

---
Lawrence Kestenbaum, polygon@potifos.com
Washtenaw County Commissioner, 4th District
The Political Graveyard, http://politicalgraveyard.com
Mailing address: P.O. Box 2563, Ann Arbor MI 48106

22 responses total.

As usual very clearly and concisely written.  I hope this reaches someone
intelligent who puts in a provision about it being okay to include information
which is already public.  Would hit have helped to mention that you have a
legal background?

Does the law explicitly include dead people?

I think the chances are 90%+ that a Washtenaw County Commissioner would
have a law degree.  It's certainly true for most higher visibility
political positions.

It sounds like this might have an even greater impact on grex.

I think it's safe to assume that the Supreme Court will throw
out any law which burdens on-line publication of information
any more than dead-tree editions.  OTOH, being the test case
would be tedious, expensive and nerve-wracking.

I do believe that information you have about anyone that you have found in
the public record cannot be reclaimed as sensitive personal information at
a later time.  Also, information that you get offline is specifically excluded
from the act--even if online information lead you to that information or
allowed to infer the existance of such information.

I don't see that this bill has anything to do with what you do.  Yes, I did
read #0.  Several times, I might add.  Nevertheless, I don't see threat that
you see, given the overall intent of the bill.

Re 3.  Currenty, the odds of a random Washtenaw County Commissioner
being an attorney are 1/15.

Re 5.  Where in the bill is information obtained offline specifically
excluded?  And what about information obtained from public online sources? 

The "overall intent" is not necessarily controlling.  The intent of the
Racketeering Influenced Corrupt Organizations (RICO) law was to put
Mafiosi in jail, but now, RICO figures so commonly in corporate lawsuits
that one lawyer commented to me that it would be malpractice not to charge
your adversary with a RICO violation.

Federal prosecutors could certainly be malicious and abusive, but I'm more
concerned about the fact that ANYBODY could bring a lawsuit under this
law.

Larry, are you sure it includes dead people?

I got the impression he had information on his site about people who
aren't dead yet, so it doesn't matter if it excludes dead people.

Right.  Many thousands of still-living people are listed on my site.

Would getting the geneology folks to write help the cause?  While many of them
are searching for dead relatives online, they often are also searching sites
for information about living relatives.  Seems like anyone who posts family
information about  another family member, even if it is public, like
birth/death/marriage, might be at risk.

Seem to me the US Census department might be at risk given its
recent release of 1930 census info.

#6>  Title IV - Miscellaneous
Sec.401.Definitions
(11) Personally Identifiable Information
(B)  INFERENTIAL INFORMATION EXCLUDED--Information about an individual
derived or inferred from data collected online but not actually collected
online is not personally identifiable information.

I don't think it's likely that the bill will go through as written.  If it
does, it will get fast-tracked through the courts because of sites like
Larry's and will get narrowed.

good grief! what are these 'law'makers smoking these days? nothing
i ever heard about - except from stalin.

Hey, at least they're thinking about privacy outside the narrow areas of
medical records and finances for a change.  I'd be pretty pissed off if
someone put details of my life on a website, and I'd want a law to let me shut
them the hell down.

Of course, I'm not a public figure, and the people Larry's writing about are
(or were), so the rules should be different for them.

I've concluded that I was unduly alarmed about this.

You were unduly alarmed, but TS appears to be running for his tinfoil hat.

The intention behind this law is good, and exemptions for stuff like what
you're doing should be a no-brainer.

What this law does is bring us closer to the EU Data Protection Directive in
some respects.  The Europeans remember better than we do why it's important
to watch out for collections of data that include religion and political
affiliation.  Without collections of data like that, a hell of a lot more
Dutch Jews would have survived WWII.  I'm not saying this to be inflammatory,
I'm saying it because most Americans don't understand why anyone would care
about that being listed somewhere.

This response has been erased.

Not as upsetting as you would.  ;-)

This response has been erased.

Good move. 

Heh, long as ye spells me name at least accurately enough that
I can rekinize it.

Response not possible - You must register and login before posting.

- Backtalk version 1.3.30 - Copyright 1996-2006, Jan Wolter and Steve Weiss