As indicated in early March, the U.S. Federal Communications Commission yesterday adopted a Notice of Proposed Rulemaking, via 3-2 vote, that proposes the establishment of privacy guidelines for broadband Internet service providers, known as ISPs. According to an agency press release, the proposal aims for “meaningful choice, greater transparency, and strong security protections” for the personal information that ISPs collect in the course of doing business. 

Essentially, the NPRM would take the privacy requirements from Section 222 of the Communications Act, which already governs the way telecommunications firms have to handle personal data, and apply them to ISPs.

The proposed rules would create three separate kinds of data uses and outlines how each kind would have to be treated. First is data simply needed to provide purchased services. Collecting this data would require no consent beyond the creation of the customer-ISP relationship. Second is data used for marketing other “communications-related services” coming from the company or its affiliates. For this, ISPs would have to provide an opt-out, but would otherwise be allowed to use the data accordingly. Finally, for “all other uses and sharing of consumer data,” customers would have to affirmatively opt-in.

The rules would also create transparency requirements for ISPs to communicate clearly about data collection and use and how customers can change their privacy settings; a set of data security requirements for risk management, training, and the creation of a lead senior manager of data security; and “common-sense” breach notification requirements.

Explicitly, the FCC notes that these rules would not apply to web sites and other “edge services over which the Federal Trade Commission has authority.” Nor would the rules cover things like an ISP's operation of a social media site or law enforcement requests and surveillance.

In a statement accompanying the release, FCC Chairman Tom Wheeler was clear about his support for consumer privacy. “In the end,” he said, “this proceeding isn’t about any particular company or practice. It’s about providing baseline protections for consumers. After all, it’s our data. We all deserve information about and control over how our data is used.”

FCC Commissioner Mignon Clyburn expressed similar sentiments. “I am proud to stand on the side of the 90 percent of consumers who want the ability to control what happens with their very personal and private information,” he said. “Times have changed and we need to ensure our rules are updated to reflect these technological transformations.”

Of course, there are critics of the proposed rules. Former FCC commissioner Harold Furchtgott-Roth and Arielle Roth of the Center for the Economics of the Internet argue that the rules create a false sense of security for consumers. Because consumers engage with the Internet in myriad ways, and not through a single ISP, these rules will just confuse consumers, they argue, as “it is naïve to think that any single company or government agency can offer comprehensive protection. The commission ought to be forthright with respect to the flaws and limits of regulating broadband providers, and stop propagating a false sense of privacy.”

Similarly, Carol Wilson, editor-at-large at Lightreading, called the proposed rules a “waste of time.” Since the rules don’t cover web sites or apps, the rules only serve to confuse and create a further “regulatory morass.” Since consumers aren’t likely to notice much of a difference, she writes, “What’s the point?” Further, “to the extent that anyone thinks their online activity will become more private as a result, they actually do more harm” than good, she writes.

Consumer Watchdog, meanwhile, praised the vote to officially start the rulemaking process and agreed with the FCC that ISPs should be regulated like phone providers. One point the group raised that was not in the FCC’s initial release was a call for rules to restrict ISPs from charging more for “privacy-protecting plans.”

The official proposed rules have not yet been posted to the FCC’s site, as final edits are still being made, but once they are posted in the next couple of days, according to an FCC spokesperson, the comment period will last until May 27 for the initial comment round, with a deadline of June 27 for replies to comments.

To comment, find the proposed rulemaking document here, and then file a comment via the FCC site. The docket numbers listed with the privacy rulemaking are 11-42, 09-197, and 10-90.