U. S. FTC holds first of three privacy roundtable events and signals policy shift

First FTC roundtable on privacy: December 7, 2009, in Washington, DC

The Federal Trade Commission (FTC) held the first in a three-part series of one-day roundtable meetings focused on privacy on December 7, 2009, in Washington, DC. These events are designed to bring together a variety of participants from industry, consumer advocacy organizations, trade associations, think tanks, academia and elsewhere, each with a strong interest in helping to shape the commission’s approach to privacy regulation and enforcement. The panel discussions during this first event featured vigorous debate and little consensus among industry, academic, and advocacy representatives. In sum, as explained in greater detail below, industry members urged continued self-regulation based on principles of notice and choice. They tended to consolidate around the Self-Regulatory Principles for Online Behavioral Advertising backed by the Direct Marketing Association (DMA), Interactive Advertising Bureau, Association of National Advertisers, the American Association of Advertising Agencies, and the Council of Better Business Bureaus (The DMA Program), which include enhanced notice coupled with increased consumer education, as well as principles addressing consumer control, data security, material changes, sensitive data, and accountability. Consumer advocates, on the other hand, largely argued that both self regulation and the notice-and-choice approach had failed, and most called for new laws or rules, either alone, as a baseline for those who do not adhere to strong self-regulation, or in addition to the DMA Program. Commission Chairman Jon Leibowitz opened the meeting by declaring that this is “a watershed moment in privacy” because companies continue to develop more and more sophisticated technologies to collect information from consumers and use it in new ways, without consumers necessarily understanding any of this. Accordingly, he said, it is an appropriate time for the commission to take a broad look at the subject. He went on to remark that the commission’s two prior approaches to privacy—the notice and choice regime and a harm-based approach—had not been as successful as the currently-constituted commission would like, and, accordingly, that the commission is searching for a new paradigm for privacy regulation and enforcement. The director of the Bureau of Consumer Protection (BCP), David Vladeck, echoed Chairman Leibowitz, but, at the same time, seemed to be more openly receptive to legislation or regulation.

Although it’s not yet clear how the commission will proceed, it was possible to glean some hints of where the commission could be heading. Based on this first roundtable event, it appears unlikely that the FTC will make any radical policy decisions at this point. The likely immediate result of the three events will be a staff report outlining a new framework, although it is possible that, as in 2000, the commission or its staff will prepare a report to Congress with certain recommendations, including, potentially, a call for new legislation. Were it to make a radical change in policy now, such as requiring opt-in for behavioral advertising or applying principles of the Fair Credit Reporting Act (FCRA) to databases not now subject to FCRA (as the World Privacy Forum and other advocates have called for), the commission may find itself not just ahead of the business community, but also Congress. As the commission learned nearly two decades ago, getting ahead of Congress is dangerous business. The last time the commission did so, in connection with a proposed trade regulation rule that would have curtailed television advertising to children, Congress reversed the FTC and ultimately reduced the commission’s authority and funding. For this reason, we think the commission will continue to build a record on privacy, especially where there appear to be gaps between consumer expectations and business practices, so that it is well-poised at the conclusion of the three-part series to adopt a new interpretation of the requirements of the FTC Act and an accompanying enforcement position or to recommend new legislation it thinks appropriate based on the record. In the meantime, we expect that the commission is likely to keep an eye on the roll-out of the DMA Program, including the extent to which it is adopted by industry, and to pursue enforcement actions against those that do not join, those that join and do not comply, and those that engage in fringe activity, such as collecting sensitive information like health, financial, or children’s data for use in behavioral advertising. We also expect the FTC to continue its program using its authority under Section 5 of the FTC Act to enforce against those who fail to disclose material information about (1) the collection, uses, and disclosure of data outside the privacy policy in a clear and conspicuous way, especially in the case of sensitive information, and (2) disclosures and uses of data for purposes other than that for which the consumer provides the information in the first instance.

We have structured our summary of the roundtable discussions around the two primary themes of the debate about where the commission’s approach to privacy should head: (1) whether the notice-and-choice regime remains viable; and (2) how to evaluate and respond to the harms associated with information practices.

Chairman Leibowitz stated that, in the commission’s view, the notice-and-choice approach to privacy has not succeeded. He explained that he has long been a proponent of opt-in (versus opt-out) choice to the collection of personal information, but he pointed out that even that can fail if notice is inadequate. He further explained the inadequacy of notice and choice with his statement that “we all agree” that consumers don’t read privacy policies or EULAs.

Many consumer advocates agreed with the chairman, taking the position that choice is illusory when consumers—even when given notice—have no way to fully understand the complicated technology used to collect information from them, the extent of the data collected, and the variety of uses and disclosures made of it, including, sometimes, undisclosed secondary uses. In their view, no notice can be sufficient in this context. They also argued that regulators and industry have focused on notice and choice when they should instead focus on the substance of information practices, i.e., ensuring that personal data is collected and processed fairly. For these reasons, consumer advocates largely encouraged reliance on a full set of Fair Information Practices principles (FIPs) (not just notice and choice) to craft legislation, regulation, or, at least, a regulatory policy framework. In their view, the FIPs require, among other things, opt-in consent to information collection and the consumer’s ongoing ability to control how his or her information is used and shared. Some advocates, such as the World Privacy Forum, also called for the protections of the Fair Credit Reporting Act to be applied to marketing databases that are not now subject to FCRA. BCP Director Vladeck noted that the data broker industry is largely unknown and may warrant attention; if the commission follows the recommendation of the World Privacy Forum, it would mark a dramatic departure from current industry practices.

Not surprisingly, industry representatives took an opposing view. They believe that industry has provided, and continues to work on ways to improve appropriate notice, as well as tools that consumers can use to exercise control over their data. They acknowledged the need to continue with consumer education efforts and noted the steps they are already taking in this direction, particularly the self-regulatory principles issued by the DMA and other trade associations in July and the development of an icon-based notice regime being developed by the Future of Privacy Forum. Moreover, industry representatives stressed that the provision of notice and choice is more effective than legislation or regulation in meeting consumer needs because privacy is a subjective value; some consumers may be willing to relinquish data in exchange for certain things, such as targeted offers, while others are not. Because it is extremely difficult to determine what choices consumers will actually make in any particular context, the industry representatives argued that the government should not attempt to dictate a one-size-fits-all choice on behalf of them. Moreover, the government’s attempt to “protect” privacy in such a way would impose significant costs in the form of stifled innovation and the reduction of funding for online content that is now offered to consumers for free.

As mentioned above, the commission has also relied on a harm-based approach to privacy, bringing enforcement actions when consumers have suffered tangible harm. Apart from saying that this approach has not been as successful as the commission would like, Chairman Leibowitz did not directly address the question of what harms arise in the privacy context and whether they should be actionable. Comments from BCP Director Vladeck suggest, however, that the commission may be moving away from only exercising its authority against tangible harms. In earlier interviews, he has taken the position that privacy-related harm can occur without tangible injury. Specifically, he has said that “harm” includes not just tangible injury, such as monetary loss, but also intangible harms such as “dignity violations.” Former BCP Director Howard Beales noted that there is nothing in the commission’s harm-based approach that says that harm must be tangible to be actionable, but he cautioned that the harms must be real and articulated. He also stressed that the government must find the most effective and least costly way to avoid the harms it identifies. Consumer advocates expressed their agreement with Director Vladeck’s thinking, saying, for example, that anonymity is an important social value and that consumers have the right to know what data is collected about them and how they are categorized based on the data. In its written comments to the roundtable, the Center for Democracy and Technology took this a step further by urging the commission to affirm that a violation of any one of the FIPs results in individual harm and to use the FTC’s unfairness authority under Section 5 of the FTC Act to pursue such violations. If the CDT’s recommendation were to become a reality, a company could face liability for, for instance, “harming” consumers by collecting even one element of data that is more than that “relevant” or “necessary to accomplish a specified purpose” (i.e., violation of the “data minimization” principle).

As discussed above, Chairman Leibowitz acknowledged the limitations of the commission’s notice-and-choice and harm-based approaches to privacy. He said that the commission is open to new approaches and that, over the next six months, it will be working to figure out the best approach. He did not express an inclination toward one approach or another. In his remarks closing the roundtable, BCP Director Vladeck echoed the chairman but also gave a hint that his views may be leaning toward regulation. He stated that consumers do not really understand privacy and that consumer disclosure as we currently know it does not work. He gave a nod to companies that are giving consumers better tools to learn about tracking. At the same time, he noted that few consumers use them and wondered whether consumers are making bad decisions even when they understand the harms. If the commission’s approach is shaped by this theory—e.g., in the form of a trade regulation rule—it will signify a drastic shift away from giving consumers the information they need to make their own choices to the government’s making choices for them.

In related news, the FTC Improvements Act passed the House of Representatives on December 11, 2009, on a vote of 223–202. If it passes the Senate in its current form, the bill will give the commission substantially more power. Specifically, the bill would:

It is not yet clear how the Senate will react. The bill has to move through the Banking Committee (the FTC provisions are just part the Wall Street Reform and Consumer Protection Act), but Senators on the Commerce Committee may also be trying for a seat at the table before the bill goes to the Senate floor—something Banking Committee members may resist. Democrats on the Senate Commerce Committee may be more inclined to support the extension of FTC authority than those on the Banking Committee, which does not have jurisdiction over the FTC. The bill faces substantive hurdles in addition to the jurisdictional ones described above. Some Democrats are uncomfortable with the underlying bill itself, and, of course, many Republicans are uncomfortable with not only the creation of an entirely new agency—the CFPA, which would be created by the Wall Street Reform and Consumer Protection Act—but also such sweeping new powers being granted to an existing agency (the FTC). There are so many moving pieces that it’s difficult to predict the provisions’ chances. In addition, with healthcare reform consuming so much of the Senate’s energy, few expect resolution soon. Nevertheless, this is a very important bill to watch, given the powers it would confer on the FTC.