cipation, integrity/security, and enforcement/redress . In other words, websites should notify consumers that they're collecting personal information and that the consumers can choose whether to provide it. The report—the result of a three-year study of 1,400 websites targeted at consumers—also censured the e-commerce industry for not adequately protecting private information, stating that "the vast majority of online businesses have yet to adopt even the most fundamental fair information practice...." It also criticized the industry's voluntary guidelines, stating that "with limited exception, contain none of the enforcement mechanisms needed for an effective self-regulatory regime."4 Only 924 of the 1,400 websites surveyed was found to have privacy policies. 87 percent of these notified customers that they collect information, and 77 percent offered customers refusal rights. However, only 40 percent gave customers access to their information; 46 percent promised security; and 49 percent provided contact information. There is also the question of how much these privacy promises are enforced. In June 1998, AdAge.com had transferred user information—including log-on names and passwords—to theGlobe.com, an unrelated site. Registered AdAge.com users had no idea that the site had done so until they received an e-mail note that welcomed them to theGlobe.com and contained their AdAge.com passwords. This incident provoked outrage from some AdAge.com users and embarrassed both companies. Although AdAge.com later apologized to its users, explaining that the data transfer was part of a community partnership between the sites and was designed to allow AdAge.com users easy access to theGlobe.com's community features, this is a glaring example of what can happen despite privacy promises. The lack of effective privacy protection is widely believed to be stunting the growth of e-commerce. Survey after survey has shown that more...
