CASRO's Cautious Welcome for Rush Bill
December 10 2010
CASRO has issued a statement responding to the 'Rush Bill', the federal privacy legislation currently under review in the US. The 'sorely needed' framework holds no nightmares for researchers, the association believes, but has room for improvement and clarification.
According to Duane Berlin, CASRO's General Counsel the bill, introduced in July by Congressman Bobby Rush, would 'create the first overarching federal privacy regime in the United States, a framework sorely needed to eventually replace the patchwork of overlapping and inconsistent state and federal privacy laws with which research organizations must currently comply'.
CASRO believes that 'for the most part, the Bill establishes requirements with which the market research industry will be able to comply without unreasonable difficulty' - indeed is already complying - and which are largely in line with existing CASRO Code of Standards, US Safe Harbor and other international privacy and security laws.
The body welcomes the similarities with the EU's 'highly successful' Data Privacy Directive and says it should help in getting the EU Data Commission to 'finally deem the US as having an adequate data privacy regime' and should thereby assist US research firms doing business in Europe.
Among the key provisions CASRO highlights in the Bill are:
- the requirement for companies with a certain level of personal data (including nearly all MR companies) to have a detailed privacy policy
- the general sufficiency of an opt-out and a published privacy policy for the collection and use of generic personal data, but also the requirement for an explicit opt-in in order to disclose personal information to third parties or to collect so-called 'sensitive data' including 'normal demographic information that is collected by market research companies, such as race and sexual orientation, as well as financial information and Social Security number'; and
- codification of the existing FTC requirement that an explicit opt-in be received before using hardware or software that would monitor a subject's browsing or computer activity.
Any opt-out preference would not apply to information that is collected and used for an 'operational purpose', and CASRO believes that market research generally falls under the intent of the exception, but says it will take steps to try to improve this definition to more explicitly include market research.
From its understanding of the Bill's current definition of 'sensitive information', CASRO believes MR firms 'will still be required to receive an express opt-in from most panelists, 'though it feels that this opt-in 'could readily be built into the panelist registration process'.
Provisions on security of data should not cause additional problems for most MR providers, while use of aggregated or anonymised ('redacted') information are generally excluded from the Bill entirely.
One likely area for MR industry input is in amending the definition of 'sensitive information' so as to exclude basic demographic information or to except market research from opt-in requirements for the collection, use and disclosure of sensitive information.
Web site:
www.casro.org .
All articles 2006-23 written and edited by Mel Crowther and/or Nick Thomas, 2024- by Nick Thomas, unless otherwise stated.
