While lawmakers continue to debate the appropriate standard for obtaining individual consent, the research industry also continues to examine these options as they relate to research practices.
Due in part to the proliferation of the Internet and other emerging technologies, privacy issues have come under close scrutiny in the last few years. Most recently, however, the debate has gone beyond privacy to specifically address the issue of consent. In response to consumer concerns, lawmakers have focused greater attention on the ability of individuals to have a say in who contacts them and how information about them is collected, used, and disseminated.
The privacy debate has now gone public as the widely accepted fair information privacy principles of notice, choice, access, and security have been incorporated into international laws. These laws include the European Community Directive on Data Protection (EU Directive), the Personal Information Protection and Electronic Documents Act (the new Canadian privacy law), as well as U.S. law and proposed legislation.
The subject of consent has generated the most attention on the U.S. legislative and regulatory front. Specifically, the debate has centered on the appropriate consent standard to adequately allow individuals the ability to express their consent. One proposed standard is the “opt-out” standard. Under this standard, individuals are given the opportunity to indicate their preference not to be contacted again and/or to limit the manner in which their information is used, collected, or disseminated. Put simply, it lets them opt out of certain activities.
The alternative proposed standard is the “opt-in” standard, which requires individuals to specifically and affirmatively consent to a specified activity. Privacy advocates and some lawmakers have asserted that the opt-in standard, often referred to as “active consent,” is more appropriate because it allows individuals full control over their information and future contacts. Meanwhile, other lawmakers and many businesses have taken a different point of view. They contend that opt out or to allow an individual to request a specific action not be taken or their information not be used in a specific way (also referred to as “passive consent”) confers a more than adequate amount of control to an individual.
Applying Legislative Standards
The opt-in and opt-out consent standards have been incorporated into legislation and statutes across the United States. These measures regulate and propose to regulate all mediums, including the telephone, general data collection, as well as the Internet. For example, the opt-out standard has been applied to telemarketing do-not-call laws, under which individuals indicate their preference not to be contacted in the future by a telemarketer. Additionally, legislation has been introduced and enacted nationwide to require individuals to affirmatively consent before a telemarketing call can be initiated or a recorded telephone message can be played.
Much of the current legislative debate on the appropriate consent standard has focused on the subject of data privacy. Throughout this debate, legislators have introduced hundreds of bills to prohibit disclosure of personal information without the affirmative consent of the individuals involved (opt in). These measures have included bills to prohibit telecommunication companies and magazine publishers from disclosing the personal information of their subscribers without consent. Also included has been legislation prohibiting supermarkets from collecting or disseminating a customer’s personal information without prior written consent.
Most recently, lawmakers have explored the consent standards in the newest legislative arena—Internet privacy. Legislation has been introduced across the country to require Web sites that collect, use, and/or disseminate personal information via the Internet to post and implement privacy policies. Included among these measures have been bills, such as the federal Consumer Online Privacy and Disclosure Act, requiring Web sites to provide notice of their information practices and to allow individuals the opportunity to opt out of the disclosure of their information.
Alternatively, other legislative proposals have required affirmative consent before personal information about a Web site visitor could be used or disseminated (opt in). Although Internet privacy legislation has become quite prolific in last two years, the debate and disagreement among lawmakers as to whether opt in or opt out should be the mandated consent requirement has been a driving force in delaying enactment of any such legislation.
Although similar debate regarding the appropriate consent standards has surrounded the collection and use of e-mail addresses, the sending of e-mails already has been regulated across the country. Hundreds of bills have been introduced, and some have been enacted, requiring unsolicited e-mails to include the ability for individuals to opt out of future e-mails. Whether or not this opt-out standard will ultimately be applied to other aspects of Internet privacy remains to be seen.
How Does It Affect Research?
While lawmakers continue to debate the appropriate standard for obtaining individual consent, the research industry also continues to examine these options as they relate to research practices. The research industry has long established opt in as its self-regulatory standard for disclosure of respondents’ personally identifiable information collected through the research process. In recent years, the research industry has discussed the appropriate standard to include in industry codes to address online research.
The recently revised Code of Standards and Ethics for Survey Research of the Council of American Survey Research Organizations (CASRO) applies one of these consent standards to the new methodology of the Internet. In its new language regulating the sending of e-mail for research purposes, CASRO requires researchers to offer respondents the ability to opt out of future e-mails. This should expand the options for research participants and help assuage some of their privacy concerns.
The debate among the research industry and lawmakers regarding the appropriate consent standard will continue for years to come and will evolve along with technology.