http://cyberlaw.stanford.edu/node/5775 (Coming Soon: Smell, Touch, and Dead People)
http://cyberlaw.stanford.edu/node/6144 (The True Danger of the Internet: What Occurs To Us)

Michael, I completely agree with you that too many people equate the mere existence of a privacy statement with strong privacy practices.
Unfortunately, the purposefully dense language of privacy policies exacerbates apathy and remains inaccessible to the most vulnerable consumers.
While I am a big fan of privacy education and consumer literacy, I believe such efforts will only do so much.
This is actually one of the most difficult problems with privacy protection regimes based solely on consumer notice and consent.
Such issues illustrate the need for comprehensive consumer privacy legislation — so that strong safeguards will apply regardless of whether consumers read the privacy statements.
But either way, you’re right, consumers should still examine such policies before submitting sensitive information.

Even if consumers don’t read them, however, it is definitely worthwhile for companies to develop and publish privacy policies.
Some people will read and analyze them, including consumer protection and education groups like CDT.
Companies are also required to adhere to their published policies under Section 5 of the FTC Act.

Most importantly, publishing a strong privacy policy would demonstrate a commitment on behalf of the company to the safekeeping of sensitive information.
Part of the point of such a policy is to spur companies to develop safeguards that reduce the risk of a data breach.
In the case of digital signage privacy, demonstrating this commitment will become increasingly important as the industry seeks to proliferate digital signs with tracking technology.
Without such a commitment, the industry will find it more difficult to gain public acceptance, which ultimately will reflect poorly upon the advertisers themselves.

While publishing a privacy statement is not the same thing as maintaining strong privacy practices, it is a crucial first step.

Thanks for the comments, Michael and Jon-Michael!

Sincerely,

Harley Lorenz Geiger
CDT

http://www.theregister.co.uk/2003/04/18/office_workers_give_away_passwords/

http://www.tgdaily.com/content/view/21550/118/

Great Article! I completely expect to see this as a US Federal Trade Commission issue shortly. They attack companies for privacy agreement violations under deceptive trade practices, recently announced Digital Rights Management interest, and are rumored to begin examination of End User License Agreements, those pesky things you click on when you install software.

As you pointed out, the US takes an industry by industry approach to privacy. The EU is probably the largest “nation” that sees a citizen’s privacy as a fundamental right – however, even one of our European correspondents believe privacy rights are eroding (http://blog.cippguide.org/2008/10/30/thoughts-about-ip/).

For people interested in a more in-depth treatment of the sectoral privacy policies of the US (such as HIPPA, GLBA, SOX, etc..), the Congressionally assigned duties of the FTC and the alternate tact of privacy as a fundamental right, please take a look at the International Association of Privacy Professionals and their Certified Information Privacy Professional product.

Best of luck, and keep up the education!

JC