Main Nav

The Federal Trade Commission Releases Its Final Report on Protecting Consumer Privacy

Today, the Federal Trade Commission (FTC) released its long awaited consumer privacy report entitled, “Protecting Consumer Privacy in an Era of Rapid Change.”  The report calls on companies to adopt best privacy practices.  Jon Leibowitz, Chairman of the FTC, and his staff held a press briefing to announce the release of the 112-page report and to answer questions.  "Your computer is your property and people shouldn't put things in it without your consent," Leibowitz said.  He went on to say that the FTC will work with Congress to enact “baseline” privacy legislation as well as legislation to prevent data breaches.  Leibowitz also said that the FTC will not be creating any new privacy rules of its own, other than an ongoing effort to update the Children’s Online Privacy Protection Act (COPPA).   

This report follows a preliminary report that the FTC issued in December 2010. The preliminary report proposed a framework for protecting consumer privacy in the 21st century by articulating a set privacy standards designed to make it easier for consumers to see and understand what information is being collected about them.  The three principles in the final report include:

  • Privacy by Design: Build in privacy at every stage of product development;
  • Simplified Choice for Businesses and Consumers: Give consumers the ability to make decisions about their data at a relevant time and context, including through a Do Not Track mechanism, while reducing the burden on businesses of providing unnecessary choices; and
  • Greater Transparency: Make information collection and use practices transparent.

At the briefing, Leibowitz expanded on the three principles saying that “by considering and addressing privacy at every stage of product and service development, companies can shift the burden away from consumers who would otherwise have to seek out privacy-protective practices and technologies.”  The report called on companies to give users more control over their information by offering a “do-not-track” feature to allow them block websites from tracking web browsing.  Leibowitz said he is hopeful that companies will institute “do-not-track” options on their own, but if they don’t, he doesn’t doubt Congress will act.  Finally, the report urges companies to streamline the way they explain their privacy policies. Long, convoluted privacy policies are “generally ineffective” in educating consumers, Leibowitz concluded.

The report also contains important recommendations regarding data brokers.  It notes that data brokers often buy, compile, and sell highly personal information about consumers. Consumers are often unaware of their existence and the purposes to which they use the data.  The report makes two recommendations to increase the transparency of such practices.  First, it reiterates the FTC's prior support for legislation that would provide consumers with access to information held by data brokers.  Second, it calls on data brokers who compile consumer data for marketing purposes to explore creation of a centralized website where consumers could get information about their practices and their options for controlling data use.

While urging Congress to pass baseline privacy legislation, the report urges individual companies and self-regulatory bodies to accelerate the adoption of the principles contained in the privacy framework, if they have not already done so.  The FTC will work in the coming year to encourage privacy protections in five main areas, which were highlighted in the report:

  • Do-Not-Track - The Commission commends the progress made in this area: browser vendors have developed tools to allow consumers to limit data collection about them, the Digital Advertising Alliance (DAA) has developed its own icon-based system and also committed to honor the browser tools, and the World Wide Web Consortium standards-setting body is developing standards.  "The Commission will work with these groups to complete implementation of an easy-to-use, persistent, and effective Do Not Track system," the report says.
  • Mobile - The FTC urges companies offering mobile services to work toward improved privacy protections, including disclosures.  To that end, it will host a workshop on May 30, 2012 to address how mobile privacy disclosures can be short, effective, and accessible to consumers on small screens.
  • Data Brokers - The report calls on data brokers to make their operations more transparent by creating a centralized website to identify themselves, and to disclose how they collect and use consumer data.  In addition, the website should detail the choices that data brokers provide consumers about their own information.
  • Large Platform Providers - The report cited heightened privacy concerns about the extent to which platforms, such as Internet Service Providers, operating systems, browsers and social media companies, seek to comprehensively track consumers' online activities.  The FTC will host a public workshop in the second half of 2012 to explore issues related to comprehensive tracking.
  • Promoting Enforceable Self-Regulatory Codes - The FTC will work with the Department of Commerce and industry stakeholders to develop industry-specific codes of conduct.  To the extent that strong privacy codes are developed, when companies adhere to these codes, the FTC will take that into account in its law enforcement efforts.  If companies do not honor the codes they sign up for, they could be subject to FTC enforcement actions.

Additionally, the FTC posted technology highlights of the report on its Tech@FTC blog.  It spotlights four sections within the report of possible interest:

  • De-identified data (pp. 18-22)
  • Sensitive data (pp. 47-48)
  • Mobile disclosures (pp. 33-34)
  • Do Not Track (pp. 52-55)

The FTC received more than 450 public comments in response to the preliminary report from various stakeholders, including businesses, privacy advocates, technologists and individual consumers.  A wide range of stakeholders, including industry, supported the principles underlying the framework, and many companies said they were already following them.  At the same time, many commenters criticized the slow pace of self-regulation, and argued that it is time for Congress to enact baseline privacy legislation.  At today’s press briefing, Commissioner Leibowitz said that the report addresses these comments and sets forth a revised, final privacy framework that adheres to, but also clarifies and fine-tunes, the basic principles laid out in the preliminary report.  Critics of the report, including the Electronic Privacy Information Center (EPIC), felt that the report does not go far enough in protecting consumers’ privacy.

The FTC panel vote approving the report was 3-1, with Commissioner J. Thomas Rosch dissenting.  His dissent on his four major concerns is included as an appendix in the report.  In short, he agreed with the findings that consumers ought to be given a broader range of choices, as well as the report's call for targeted legislation regarding data brokers and data security.  However, he wrote:

  • the report is based on the "unfairness" prong of the consumer protection statute rather than deception aspect;
  • the current state of "Do Not Track" still leaves unanswered many important questions;
  • "opt-in" will necessarily be selected as the de facto method of consumer choice for a wide swath of entities; and
  • although characterized as only "best practices," the report's recommendations may be construed as federal requirements.

The FTC report goes beyond the White House proposal, “Consumer Data Privacy in a Networked World:  A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy,” that called for a “privacy bill of rights” based on new legislation and self-regulation by the industry.   See February 23, 2012 blog post for further information on the Administration’s position.

The impact of this report on institutions of higher education is not clear at this point.  EDUCAUSE will continue to monitor developments and work with other higher education stakeholders to explore next steps.