From: Evan Hendricks evan@privacytimes.com
To: HQ.DCMAIL4(PROFILE)
Date: Tue, Oct 12, 1999 8:35 PM
Subject: Online Profiling Project - Request to Participate, P994809 / Docket No. 990811219-9219-01

RE: Online Profiling Project - Request to Participate, P994809 / Docket No. 990811219-9219-01

October 12, 1999

Dear Friends @ The FTC:

This is a request to participate in your workshop on Online Profiling, November 8.

I feel that I could contribute most effectively to the panel III, on self-regulation. I'd be happy to serve on the implications for privacy panel (II), but my clear preference would (III).

"Online profiling" potentially carries serious implications for privacy. Currently, Internet ad companies state that they only deal with "anonymous profiles," i.e., ones that don't actually identify the Internet user.

Yet there are concerns that, as a practical matter, this may not be true in the near future, or even today. Several security mishaps have demonstrated that personal data are vulnerable to exposure on the Internet (e.g. Hotmail, shopping carts). Are the profiles as anonymous as Internet ad companies claim?

Second, there is a practice in the medical research community known as "re-identifying" "de-identified" data. Overlaying various databases can permit identities to be established from otherwise "de-identified" data.

Third, why did DoubleClick, a major Internet ad company, purchase Abacus, the keeper of consumer profiles from the offline world? What do they plan to do with that data.

Your workshop hopefully will provide answers to these and other questions.

But given the lack of transparency in online profiling, it's difficult to see how self-regulation could effectively protect privacy. For starters, Internet users need to know how online profiling works. Internet ad companies likely will guard this as proprietary, thus leaving the Internet users guessing as to what happens with his or her profile and what can be done about it.

Moreover, online profiling is often done by companies with whom the Internet user doesn't have a direct relationship, much as consumers don't have direct relationships with credit bureaus. The existence of third parties trafficking in consumer data heightens the need for legal rights for Internet users.

Thank you for this opportunity to state my preliminary views and request participation in your workshop.

Sincerely,

Evan Hendricks, Editor/Publisher
Privacy Times
www.privacytimes.com