Technology moves faster and more efficiently than law or politics.

BBC reported today (hat tip to Techmeme) that the world’s market leader in internet browsing software, Microsoft, will integrate more sophisticated privacy features into IE8.  This is on the heels of other browsers seeking Microsoft’s market share in part by offering better privacy features–Safari already offers this kind of protection, and Firefox soon will officially (but probably already does unofficially through one or more user-created add-ons).

You can already search and browse the Internet almost totally anonymously, so circumstances where legislation is necessary to protect user privacy should be pretty limited.  Gmail’s privacy filters (and those of its competitors) do ever-better jobs of protecting consumers from spam and phishing atatcks.

You do eventually get to a place where the free market bumps up against privacy–how web sites handle data you enter.  Should a web site have the legal right to sell data you provide?

Tough one.  On the one hand, the FCC has stated that if a web site provides a privacy policy that they have to comply with it (presumably the one in place when you entered your information . . . you saved a copy of that, right?).  So you certainly have the right to review a site’s privacy policy before entering your information and submitting it.  Sites do not have to have a privacy policy–should the law fill one in with default terms regarding the handling of data if one is not provided?  The law already fills terms into contracts that are silent on certain points.  And it isn’t as if sites like Facebook or Amazon.com are so important that they represent an essential public service that must be provided to everyone under privacy terms explicitly set by the government.  More than that, if sites are generating revenue through some limited data selling, prices will increase for consumers if that revenue stream is cut off.

On the other hand, who is actually going to sue based on the FCC’s statements, and how easy is it going to be to prove that one particular web site violated a user’s privacy?  Is it really fair to put such an onus on the average consumer to protect his/her personally identifying information and online activity?

I work in the software industry for a vendor whose software may handle credit card transactions and other types of sensitive data.  While some people may decry large corporations (I have my own conceptual issues with the legally-created fiction that is the corporate entity), it is those large corporations that have the leverage to push out non-legislative initiatives like the Payment Card Industry Data Standards.  It’s not going to protect the pictures you put up on Facebook, but it is a system designed to integrate safeguards regarding the handling of transactional information.

I’d like to see legislators take a light, measured touch in these areas.  Technology, and the market, is going to move faster than legislature, so look for those areas where the market is making adjustments, and seek to only provide a net underneath that, ideally, will be rarely, if ever, necessary.