Sequence of events: 1. Word leaks out, first in mailing lists, then confirmed by Ted Bridis, that Comcast is recording user browsing data. 2. Expected privacy fuss ensues, with Rep. Markey, always ready to pounce on suspected corporate miscreants, writing Comcast the traditional nastygram. 3. Whoops! Turns out federal law says a cable operator "shall not use the cable system to collect personally identifiable information concerning any subscriber without the prior written or electronic consent of the subscriber concerned." (Let's hope that Comcast's lawyers did their homework when writing their privacy policy, otherwise might we see a class action lawsuit asking for statutory damages of $1,000 per user?) 4. Comcast backs down.
Call me a curmudgeon, but all this doesn't seem that terribly alarming -- assuming Comcast is telling the truth when saying (a) data were retained for only a week, (b) their privacy policy permitted this, and (c) the info was used for performance purposes and not given to anyone else. Put another way, there are benefits to aggregating information on web use: It can help improve network performance and lower the cost of the service. So if Comcast's privacy policy permitted this, what's the big deal? Anyone looking for a more privacy-protective service (and the point about subpoenas for stored data is a good one) should have taken their business elsewhere. To Earthlink, for example, which seems to be offering just that. -Declan --- http://comcast.comcastonline.com/internetprivacypolicy.asp COMCAST STATEMENT ON INTERNET PRIVACY Philadelphia (February 13, 2002) - Comcast Cable Communications President Stephen B. Burke issued the following statement today regarding Internet privacy: "Comcast respects the privacy of all our subscribers and is committed to fully protect their rights. Comcast has not shared and will not share personal information about where our subscribers go on the Web, either for any internal purpose or with any outside party, except as required by law. Consistent with our subscriber agreement and our privacy policy, which every subscriber acknowledges before receiving our service, Comcast reviews information in aggregate form only for purposes of network performance management to ensure an optimal Internet network experience for our subscribers." "Since we launched our own Internet network six weeks ago in the wake of Excite@Home's bankruptcy, IP and URL information has been stored temporarily. This information has never been connected to individual subscribers and has been purged automatically to protect subscriber privacy. Beginning immediately, we will stop storing this individual customer information in order to completely reassure our customers that the privacy of their information is secure." --- http://www.washingtonpost.com/wp-dyn/articles/A5567-2002Feb13.html By Ted Bridis Associated Press Writer Wednesday, February 13, 2002; 2:14 PM WASHINGTON Comcast Corp., the nation's third-largest cable company, pledged Wednesday to immediately stop recording the Web browsing activities of each of its 1 million high-speed Internet subscribers. Comcast said in a statement that it will stop storing the information "in order to completely reassure our customers that the privacy of their information is secure." The Associated Press reported Tuesday that the company had started recording each customer's visit to a Web page as part of a technology overhaul to save money and speed up the network. [...] --- Date: Wed, 13 Feb 2002 09:30:33 -0500 From: "James Maule" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: News Item Declan, Article in Phila Inquirer about Comcast recording every move of its internet cable customers. Here's the link to the story. I'll let you write the introductory blerb and a Subject heading... you're quite adept at that. Note that the URL is responding rather slowly. http://www.philly.com/mld/inquirer/2661259.htm Posted on Wed, Feb. 13, 2002 Comcast tracks users' Web browsing The cable firm said it is being done to save money and improve service. It acknowledged it didn't notify customers. By Ted Bridis Associated Press WASHINGTON - Comcast Corp., the nation's third-largest cable company, has begun tracking the Web-browsing activities of its one million high-speed-Internet subscribers without notifying them. The Philadelphia-based company said yesterday that the tracking of each Web page a subscriber visits was part of a technology overhaul designed to save money and improve the speed of cable Internet service and was not intended to infringe on privacy. But technology experts cautioned that the data could be subpoenaed by law enforcement agencies or lawyers in civil cases, and they questioned whether Comcast's move reflected a more cavalier attitude toward online privacy after the Sept. 11 terrorist attacks. [rest of article not copied] --- http://www.epic.org/privacy/internet/markey_comcast.html February 13, 2002 Mr. Brian Roberts President, Comcast Corporation 1500 Market Street Philadelphia, PA 19102-2148 Dear Mr. Roberts: I am writing with respect to recent media reports regarding Comcast's use of cable facilities to gather personal data from consumers of Comcast's broadband telecommunications service. I have concerns about the allegations raised in these reports and the nature and extent of any transgressions of the law that may have resulted in consumer privacy being compromised. Consumer privacy in the digital era is fundamental to ensuring trust between citizens and the owners of nation's communications networks and services. The cable industry has a long history of safeguarding consumer privacy with respect to the television viewing habits of consumers through its provision of cable service. I believe that many consumers would be understandably concerned if our nation's cable operators begin to monitor Americans' use of cable systems for other services such as telecommunications services, including broadband access to Internet via cable modems. As you know, the cable industry has obligations to protect consumer privacy that are contained in Section 631 of the Communications Act (47 U.S.C. 551). It is clear that in enacting Section 631, Congress intended to place a high priority on consumer privacy and for that reason the applicability of Section 631 is very broad. The general requirement of Section 631 is that cable operators obtain "prior written or electronic consent" in order to utilize any personal information gathered from subscribers. These privacy obligations, however, are not limited to personal information gathered through a customers use of a "cable service." Rather, the privacy requirements of Section 631 apply to "any wire or radio communications service provided using any of the facilities" of the cable system, not solely a consumer's use of cable service. As part of the order by which the Federal Communications Commission (FCC) approved AOL-Time Warner merger last year, the FCC reiterated that, with limited exceptions, a "cable operator may not use the cable system to collect personally identifiable information nor may the cable operator disclose personally identifiable information without the prior Mr. Brian Roberts February 13, 2002 Page Two written or electronic consent of the subscriber." As part of the order, the FCC required AOL-TW to certify compliance with the legal privacy obligations contained in the law. (From AOL-TW Merger FCC Order (CS Docket 00-30), adopted 1/11/01, released 1/22/01, paragraphs 277-79.) I would greatly appreciate your response at the earliest opportunity. I also respectfully request a clarification of Comcast's current policy for collection and use of subscriber information and Comcast's position as to whether it intends to provide consumers of its telecommunications services, such as its cable modem service, with the right to affirmatively grant consent to data collection and use consistent with the consumer privacy requirements placed upon cable operators embodied in Section 631 of the Communications Act. I thank you in advance for your time and attention to this matter. If you have any questions with respect to these issues or my comments please feel free to call me or have your staff contact Colin Crowell in my office at (202) 225-2836. Sincerely, Edward J. Markey Ranking Democrat House Subcommittee on Telecommunications and the Internet --- http://www4.law.cornell.edu/uscode/47/551.html Except as provided in paragraph (2), a cable operator shall not use the cable system to collect personally identifiable information concerning any subscriber without the prior written or electronic consent of the subscriber concerned. (2) A cable operator may use the cable system to collect such information in order to - (A) obtain information necessary to render a cable service or other service provided by the cable operator to the subscriber; or [...] --- ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ -------------------------------------------------------------------------
