Cyber Privacy Act

Last week, Congressman Thaddeus McCotter (R-MI) introduced a bill that would require certain Internet websites that contain personal information of an individual to remove such information at the request of the individual.

This bill potentially affects “[a]ny Internet website that makes available to the public personal information of individuals.”

The bill also defines “personal information” as “any information about an individual that includes, at minimum, the individual’s name together with either a telephone number of such individual or an address of such individual.”

Megan’s Law. If this bill passes, the first class of persons that will be seeking relief under the bill would be the people on California’s Megan’s Law website. Interestingly, not all the offenders subject to Megan’s Law qualify. Those with names and addresses listed do, but those with addresses denoted as “Specific address not subject to disclosure”, “transient” or “unknown” do not meet the minimum threshold set forth in the Cyber Privacy Act.

Barack Obama. I did not realize that there were so many Barack Obamas in the United States. Spokeo lists a Barack H Obama in Illinois. The listing displays Michelle Obama as a member of the household, but the profile states “Children: No” and “[i]s not interested in politics,” which should give you a hint about data quality. Spokeo also has a listing for Barack Obama on Pennsylvania Avenue NW in Washington DC. Would this be 1600 Pennsylvania Avenue NW? The data for this Obama is no better: “[i]n a relationship”, no children, and “[i]s not interested in politics.” So, can President Obama get his personal information removed from Spokeo? Well, even though the website does not display his full address, it does make such data potentially available if you sign up to view full results, which may include the name, address, home phone, mobile phone and other personal information. So, Spokeo qualifies as an Internet website that contains personal information. However, like the prior example, not every individual may request to have their information removed from the website, such as if Spokeo is missing the full address or phone number of the individual in their records.

Credit Reports. For credit reporting websites, such as Equifax, Experian, or TransUnion, the Cyber Privacy Act presents a real nightmare. The credit reporting bureaus qualify under the Cyber Privacy Act because they “make available to the public personal information of individuals” in the form of credit reports. These reports definitely contain your personal information, including your name, address (past and present), as well as your phone numbers, unless you fear killer robots from the future and are truly living off the grid. The problem for credit reporting bureaus will occur when people with bad or poor credit start requesting that their credit reports be removed from these databases. Fun! And, so long as the report meets the minimum threshold (i.e., name + phone number or address), the individual may request that all the personal information be removed. No more online credit reports. Back to faxes.

State Bar. If the State Bar has disciplined an attorney, and the attorney does not want the State Bar to publish his or her disciplinary record, the attorney can seek relief under the Cyber Privacy Act because the State Bar of California publishes an attorney’s address, phone number and fax number.

HR 5108 IH

111th CONGRESS

2d Session

H. R. 5108

To require certain Internet websites that contain personal information of individual’s to remove such information at the request of such individuals.

IN THE HOUSE OF REPRESENTATIVES

April 22, 2010

Mr. MCCOTTER introduced the following bill; which was referred to the Committee on Energy and Commerce

A BILL

To require certain Internet websites that contain personal information of individual’s to remove such information at the request of such individuals.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Cyber Privacy Act’.

SEC. 2. REMOVAL OF PERSONAL INFORMATION REQUIRED OF CERTAIN WEBSITES.

(a) In General- Any Internet website that makes available to the public personal information of individuals shall–

(1) provide, in a clear and conspicuous location on the Internet website, a means for individuals whose personal information it contains to request the removal of such information; and

(2) promptly remove the personal information of any individual who requests its removal.

(b) Definition of Personal Information- As used in this Act, the term `personal information’ means any information about an individual that includes, at minimum, the individual’s name together with either a telephone number of such individual or an address of such individual.

SEC. 3. ENFORCEMENT BY THE FEDERAL TRADE COMMISSION.

(a) Unfair or Deceptive Acts or Practices- A violation of this Act shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.

(b) Powers of Commission- The Federal Trade Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates such regulations shall be subject to the penalties and entitled to the privileges and immunities provided in that Act.