The Federal Trade Commission recently released a preliminary Staff Report that proposed a new regulatory framework for protecting privacy in the digital economy. The FTC is seeking comments on its proposed framework by January 31, 2011 and expects to issue a Final Report in 2011. The proposed regulatory framework described in the Staff Report has the potential for impacting virtually every digital media business that attracts advertising revenue online and through mobile devices, as it will doubtless result in new federal legislation and enforcement policies.
Problems with the Current System
The FTC staff cited numerous flaws in commercially available, privacy-related plug-ins and browser features with regard to the consumer tracking capabilities, and supports a more uniform and comprehensive consumer choice mechanism for online behavioral advertising than currently exists. In keeping with its “Do Not” line of consumer protection regulations, the proposed changes include a “Do Not Track,” mechanism, the adoption of which would address the following (as yet unresolved) issues:
- Scope: The proposed framework would apply to all commercial entities that collect or use consumer data that can reasonably be linked to a specific consumer, computer or other device.
- Consumer Privacy: The proposed framework would require companies to promote consumer privacy and security protections into their daily practices and to consider privacy issues at every stage of design and development of products and services. Suggested steps include: 1) providing security for consumer data; 2) limiting data collection to the relevancy of a specific business practice; 3) enforcing sound retention policies; 4) providing assurances of data accuracy; and 5) implementing comprehensive data management procedures throughout the lifecycle of products and services.
- Consumer Choice: The proposed framework calls for companies to provide consumers with a “notice-and-choice” mechanism at the point in a transaction when the consumer is first providing data to the company.
- Transparency and Access to Data: The proposed framework would require vastly- increased transparency with respect to data collection practices and allow for increased consumer access to data collected. As part of implementing this component, the Commission suggests a level of simplification and standardization for currently loosely governed website privacy policies.
What Happens Now?
The FTC commissioners will vote on whether to adopt the proposed changes sometime in 2011, and will then incorporate them into a Final Report to be presented to Congress. Before this happens, however, the FTC is requesting public comment on a variety of key related issues, including:
- Scope: Are there practical considerations that support excluding certain types of companies or businesses from the framework?
- Substantive Privacy Protections: What substantive protections should companies provide, and how should the costs and benefits of such protections be balanced?
- Comprehensive Data Management Procedures: How can the full range of stakeholders be given an incentive to develop and deploy privacy-enhancing technologies?
- Consumer Choice Issues: Several issues need to be resolved before a Final Report can be formulated, including: 1. How should a universal choice mechanism be designed for consumers to control online behavioral advertising? 2. What are the costs and benefits of offering a standardized uniform choice mechanism to control online behavioral advertising? 3. What is the likely impact if large numbers of consumers elect to opt out? 4. Should a universal choice mechanism include an option that allows consumers more granular control over the types of advertising they want to receive and the type of data they are willing to have collected about them?
- Data Practice Transparency: With respect to website privacy notices, is it feasible to standardize the format and terminology for describing data practices across industries? Should companies inform consumers of the identity of those with whom the company has shared data about the consumer, as well as the source of that data?
- Notifying Consumers: What is the appropriate level of transparency and consent for prospective changes to data-handling practices?
The FTC will be accepting public comments on the report until January 31, 2011. For those interested in filing one, please click here and follow the instructions.