April 4, 2000

The Honorable Robert S. LaRussa

Acting Under Secretary for International Trade

Electronic Commerce Task Force

Department of Commerce

Room 2009

14^th & Constitution Ave., NW

Washington, D.C.20230

Dear Mr. Secretary:

The American Institute of Certified Public Accountants is the professional organization representing over 330,000 individual Certified Public Accountants (CPAs) in the United States.Our members are licensed to practice under the applicable laws of the various States and are organized into approximately 46,000 practice units.I am writing on behalf of our members to provide you with our views on the verification aspects of the recently released draft “International Safe Harbor Privacy Principles” issued by the Department of Commerce on March 17, 2000.

The hallmark of the public accounting profession is independence and is applied in our work in various contexts.While historically known for the independence standard associated with the auditing of financial statements, CPAs also apply that standard in the on-line world through independent verification of a Web site’s privacy practices.Independent verification of a company’s privacy practices is the device that can and should be used when the public policy objective is to give individual citizens the degree of comfort and confidence needed to share personal information on-line.

The Frequently Asked Question 7 (“FAQ 7”) on verification contains two approaches,

1)self assessment and 2) outside compliance reviews.We have reviewed the draft and believe both approaches can be materially strengthened through the following proposed wording:

• In the second sentence of the paragraph relating to the self assessment approach we suggest the following change “…, and that it has in place internal procedures that document the basis for its self assessment and have appropriate internal controls to ensure that periodic objective reviews of compliance with the above are conducted…”

• In the second sentence of the paragraph relating to outside compliance review we suggest the following change “…The methods of review should conform to recognized professional standards and may include without limitation independent auditing, random reviews, use of “decoys”, or use of technology tools as are appropriate…”

In both instances, it is our view that the public interest would be better protected by the adoption of the suggested language.The protection of individual privacy is extremely important and the stronger the protections, the better the result.

Thank you for the opportunity to submit our views.If you have any questions, please call me at (212) 596-6144.

Sincerely,

Alan W. Anderson

Senior Vice President - Technical Services

American Institute of Certified Public Accountants