A Network Operator Sells Personal Information (Sample Scenarios from the CSTB)

A commercial network operator collects information about the interests and purchases of its users by keeping track of the forums and bulletin boards they use and the purchases they make; it then sells this information to other merchandisers. Users are not asked if they wish to participate in redistribution of such information.

Questions

1. To what extent are such practices permitted today under existing laws and codes of behavior?
2. What constitutes "informed consent" for the user to agree to the redistribution of personal information?
3. For example, is it sufficient to give users the option of not participating in the redistribution of personal information? May users be offered financial incentives (e.g., reduced rates for using the system) if they agree to participate? How comprehensively should possibilities be described to users to illustrate the ramifications of redistribution?
4. How are secondary and tertiary redistribution to be controlled, if at all?
5. Once users have granted permission for redistribution, should they have the option to revoke it? How does revocation apply to secondary and tertiary uses?
6. With what granularity should various characteristics (e.g., cigarette and alcohol purchases, regular sign-ons to the gay and lesbian bulletin board) be associated with the user? (At one extreme, the individual is in a group of one. At the other, every user of the service is a member of the group.)
7. How is this situation similar to and/or different from supermarkets that track customer purchases and preferences through scanners and check cashing, credit cards, and personalized coupons?