Proclaiming itself "the nation's chief privacy policy and enforcement agency," the Federal Trade Commission today released a 72-page final report establishing best practices for protecting consumer privacy in the digital era.
The report, which mirrors many provisions of the "Consumer Privacy Bill of Rights" released by the White House with the FTC last month, is intended to give consumers more choice and control over the information that is collected about them online and how it is used, including a Do Not Track option.
“Simply put, your computer is your property; no one has the right to put anything on it that you don’t want,” said FTC chairman Jon Leibowitz speaking at a press conference this morning.
He applauded ongoing industry efforts to put in place the foundations of a Do Not Track system allowing people to opt out of third-party tracking, calling it “the right thing to do.” But he also warned, “If Do Not Track has not come to fruition by the end of the year... there will be a lot of support for the notion of Do Not Track [legislation] in Congress.”
Reed Smith associate Amy Mushahwar, who specializes in data privacy and security and is based in Washington, said it was “a very positive sign,” that the FTC is continuing to work with industry on the the issue.
“We agree with the FTC that industry's self regulatory efforts concerning the development of a Do Not Track browser standard have come a long way during the past year, and we also agree with the FTC that the significant progress already made by the Digital Advertising Alliance will likely obviate the need for legislation on this issue,” she said via email.
The FTC report urged Congress to enact legislation addressing data security and data brokers — “companies that, without the consent or even knowledge of most consumers, collect and traffic in the data we leave behind as we travel through virtual and brick-and-mortar worlds,” Leibowitz said, as well as baseline privacy legislation.
The three basic privacy principles outlined in the report are “privacy by design,” where basic privacy protections are incorporated into products as they are developed; consumer choice over how personal data is used; and transparency — giving better explanations of how data is used.
The report comes after an initial draft that was released in December 2010 and prompted more than 450 comments. To alleviate burdens on small businesses, the final report’s provisions will not apply to companies that collect but do not transfer non-sensitive data from fewer than 5,000 consumers a year.
FTC Commissioner J. Thomas Rosch voted against the final report. He objected that the report evaluates information gathering practices under the “unfair” prong of the FTC’s authority under Section 5 of the FTC Act, and not whether the practices are deceptive. Unfairness “is an elastic and elusive concept,” he wrote. “What is ‘unfair’ is in the eye of the beholder.”
Rosch, a Republican who was previously a partner at Latham & Watkins, also questioned the motivations behind the major browser firms’ willingness to enact Do Not Track, wondering “to what extent those major browser firms will act strategically and opportunistically (to use privacy to protect their own entrenched interests).”
He also questioned whether industry and consumer groups will be able to agree what Do Not Track even means. “It may be that the firms professing an interest in self-regulation are really talking about a ‘Do Not Target’ mechanism, which would only prevent a firm from serving targeted ads, rather than a ‘Do Not Track’ mechanism, which would prevent the collection of consumer data altogether,” he wrote.
While the report is presented as recommendations for best practices, Rosch continued, “I am concerned that the language of the report indicates otherwise, and broadly hints at the prospect of enforcement.”
Recent Comments