Large private companies are compiling databases of information about Americans without their knowledge or consent. Over the last several years, an entire information trading industry has emerged, with little or no transparency with regard to data handling practices, access control and permitted uses. The use of these databases by law enforcement further exacerbates the problem. The lack of accountability by all actors, public and private, has created serious difficulties for people whose employment, credit and freedom are threatened by private actors managing secret and often inaccurate stores of knowledge. One possible solution would involve reinterpreting the constitution to create a broad privacy right. This paper advocates a different solution--a new regulatory regime modeled after the Fair Credit Reporting Act. First I will first detail the components of this new regime and then I will discuss why a statutory solution is superior to a constitutional revolution.

The enabling legislation for this proposal will have four components. The first is a definitions section that specifies who will be subject to regulation. The act will define:

Private Information Custodian: Any individual or organization who possesses Private Records about more than one hundred persons who are not employees of the individual or organization.

Private Records: Any collection of information that contains one or more of the following:

• Social Security Numbers
• Drivers License Numbers
• Arrest or Conviction Records
• Credit Reports

The second component of the act empowers the creation of a federal agency (Federal Privacy Commission) charged with overseeing the act. All Private Information Custodians will be required to register and be licensed by the FPC. The FPC will have the power to promulgate regulations governing the storage and handling of private data. The FPC will also have the power to issue subpoenas and assess civil fines for violations of the act or any of its regulations. It will also have standing to sue in District Court to obtain injunctive relief for any violations of the act.

The third component of the act is a disclosure requirement. Any Private Information Custodian who releases any information contained in Private Records to a third party must file a report with the FPC within thirty days. The report must contain the name of the third party, any information released to that third party, any fees paid for that search, and a complete copy of any Private Records from which information was obtained. These reports would be available upon request to any individuals whose Records were named.

The fourth component of the act is a correction requirement. Any individual who feels that their Record contains incorrect information may file a correction request with the FPC. The FPC will record the date of the request and forward the request to the Private Information Custodian. The custodian will then have thirty days to correct their records or declare that they are correct as is.

Any Private Information Custodian who maintains incorrect records more than thirty days after being put on notice by the FPC will be subject to civil fines by the FPC of not more than $1000/day. Any individual who suffers an injury by reason of a violation of the act may file suit in District Court. They may seek injunctive relief as well as treble damages and attorneys fees.

This is obviously a skeletal outline. However a regulatory regime like the one detailed above has a number of advantages over a constitutionally mandated right to privacy. The first is that it is implementable within a relatively short period of time. Constitutional changes require either a difficult amendment process or the persuasion of five Supreme Court Justices, most of whom are presently hostile toward the creation of new expansive rights. In contrast, an act enabling a regulatory regime could be passed tomorrow.

A second advantage is ease of modification and correction. By delegating power to promulgate regulations to an expert body, individuals can be quickly protected against new threats to personal data. Even if an entire provision in the act is defective, it can be modified by a simple majority in Congress. In contrast, changes in constitutional doctrine are difficult. They require new cases to emerge and work their way through the courts. And unlike an expert agency, courts do not have the time, resources or expertise to make policy in response to new threats.

A third advantage is stability. Constitutional rights are enforced by the will of the judiciary. When the judiciary is unwilling or unable to enforce rights, they cease to exist. By empowering a regulatory agency, this regime creates an entity with incentives to ensure that the laws are followed.

A fourth advantage is clarity. Agencies generate regulations that can be read and understood. Constitutional doctrine is hampered by the fact that courts often say things that they do not mean, mean things that they do not say, and decline to answer important questions when they are not crucial to the precise dispute in front of them.

A fifth advantage is portability. A regulatory regime that works in the United States can be exported abroad in any country with a sufficiently strong central government. The constitutional structure of American Law is an anomaly in the world stage. Constitutional Privacy protections would be more difficult to reintroduce elsewhere.

A sixth advantage is the creation of serious penalties for non-compliance. A new constitutional right to privacy could not create the kind of powerful economic incentives that treble damages and enormous administrative fines would provide. Individuals may not always respond to economic incentives, but any corporation that ignores this act will be quickly driven out of business.

The last advantage to this proposal is the empowerment of individuals. This system would allow all people to monitor their Personal Records for free. It would create an agency charged with informing people of their rights under the act. Many of the most important and hard-won constitutional rights are frequently unutilized by people who either do not know about them or cannot afford lawyers to vindicate them.