FTC Issues Final Commission Report on Protecting Consumer Privacy

The Federal Trade Commission, the nation's chief privacy policy and enforcement agency, issued a final report setting forth best practices for businesses to protect the privacy of American consumers and give them greater control over the collection and use of their personal data.
Author:
Updated:
Original:

The Federal Trade Commission, the nation's chief privacy policy and enforcement agency, issued a final report setting forth best practices for businesses to protect the privacy of American consumers and give them greater control over the collection and use of their personal data. In the report,"Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers,"the FTC also recommends that Congress consider enacting general privacy legislation, data security and breach notification legislation, and data broker legislation.

"If companies adopt our final recommendations for best practices – and many of them already have – they will be able to innovate and deliver creative new services that consumers can enjoy without sacrificing their privacy," said Jon Leibowitz, Chairman of the FTC. "We are confident that consumers will have an easy to use and effective Do Not Track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don't."

The final privacy report expands on a preliminary staff report the FTC issued in December 2010. The final report calls on companies handling consumer data to implement recommendations for protecting privacy, including:

  • Privacy by Design- companies should build in consumers' privacy protections at every stage in developing their products. These include reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy;
  • Simplified Choice for Businesses and Consumers- companies should give consumers the option to decide what information is shared about them, and with whom. This should include a Do-Not-Track mechanism that would provide a simple, easy way for consumers to control the tracking of their online activities.
  • Greater Transparency- companies should disclose details about their collection and use of consumers' information, and provide consumers access to the data collected about them.

The final report notes that the FTC received over 450 comments on the staff's preliminary recommendations. Based on technological advances and industry developments since the December 2010 staff report and in response to the comments, the agency is revising recommendations in three areas.

The final report changes the guidance's scope. The preliminary report recommended that the proposed framework apply to all commercial entities that collect or use consumer data that can be linked to a specific consumer, computer, or other device. Recognizing the potential burden on small businesses, the report concludes that the framework should not apply to companies that collect and do not transfer only non-sensitive data from fewer than 5,000 consumers a year. The report also responds to comments filed by organizations and individuals that, with technological advances, more and more data could be "reasonably linked" to consumers, computers, or devices. The final report concludes that data is not "reasonably linked" if a company takes reasonable measures to de-identify the data, commits not to re-identify it, and prohibits downstream recipients from re-identifying it.

The report refines the guidance for when companies should provide consumers with choice about how their data is used. It states that whether a practice should include choice turns on the extent to which the practice is consistent with the context of the transaction or the consumer's existing relationship with the business or is required or specifically authorized by law. These practices include product fulfillment and fraud prevention.

The report also contains important recommendations regarding data brokers. It notes that data brokers often buy, compile, and sell highly personal information about consumers. Consumers are often unaware of their existence and the purposes to which they use the data. The report makes two recommendations to increase the transparency of such practices. First, it reiterates the Commission's prior support for legislation that would provide consumers with access to information held by data brokers. Second, it calls on data brokers who compile consumer data for marketing purposes to explore creation of a centralized website where consumers could get information about their practices and their options for controlling data use.

While Congress considers privacy legislation, the Commission urges individual companies and self-regulatory bodies to accelerate the adoption of the principles contained in the privacy framework, to the extent they have not already done so. Over the course of the next year, Commission staff will work to encourage consumer privacy protections by focusing on five main action items:

Do-Not-Track- The Commission commends the progress made in this area: browser vendors have developed tools to allow consumers to limit data collection about them, the Digital Advertising Alliance has developed its own icon-based system and also committed to honor the browser tools, and the World Wide Web Consortium standards-setting body is developing standards. "The Commission will work with these groups to complete implementation of an easy-to-use, persistent, and effective Do Not Track system," the report says.

Mobile- The FTC urges companies offering mobile services to work toward improved privacy protections, including disclosures. To that end, it will host a workshop on May 30, 2012 to address how mobile privacy disclosures can be short, effective, and accessible to consumers on small screens.

Data Brokers- The Commission calls on data brokers to make their operations more transparent by creating a centralized website to identify themselves, and to disclose how they collect and use consumer data. In addition, the website should detail the choices that data brokers provide consumers about their own information.

Large Platform Providers- The report cited heightened privacy concerns about the extent to which platforms, such as Internet Service Providers, operating systems, browsers and social media companies, seek to comprehensively track consumers' online activities. The FTC will host a public workshop in the second half of 2012 to explore issues related to comprehensive tracking.

Promoting Enforceable Self-Regulatory Codes- The FTC will work with the Department of Commerce and industry stakeholders to develop industry-specific codes of conduct. To the extent that strong privacy codes are developed, when companies adhere to these codes, the FTC will take that into account in its law enforcement efforts. If companies do not honor the codes they sign up for, they could be subject to FTC enforcement actions.

The vote approving the report was 3-1. Commissioner J. Thomas Rosch dissents from the issuance of the Final Privacy Report. He agrees that consumers ought to be given a broader range of choices and applauds the Report's call for targeted legislation regarding data brokers and data security. However, Commissioner Rosch has four major concerns about the privacy framework because he believes: 1) in contravention of our promises to Congress, it is based on "unfairness" rather than deception; 2) the current state of "Do Not Track" still leaves unanswered many important questions; 3) "opt-in" will necessarily be selected as the de facto method of consumer choice for a wide swath of entities; and 4) although characterized as only "best practices," the Report's recommendations may be construed as federal requirements. See Dissenting Statement of Commissioner J. Thomas Rosch, Final Privacy Report at Appendix C.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s onlineComplaint Assistantor call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety ofconsumer topics. Like the FTC onFacebookand follow us onTwitter.

Related

FTC Offers Tutorial for Businesses on Protecting Personal Information

Protecting the personal information of customers, clients, and employees is good business. The Federal Trade Commission has a new online tutorial to alert businesses and other organizations to practical and low- or no-cost ways to keep data secure.The tutorial, “Protecting ...read more

FTC Warns 78 Retailers, Including Amazon.com, REI, Backcountry.com, and "Sports Authority, to Stop Labeling and Advertising Rayon Textile Products as "Bamboo"

Seventy-eight companies nationwide have received Federal Trade Commission letters warning that they may be breaking the law by selling clothing and other textile products that are labeled and advertised as “bamboo,” but actually are made of manufactured rayon fiber. The letters, ...read more

GoreTex.jpg

FTC closes Gore-Tex investigation; EU Commission inquiry continues

The Federal Trade Commission has closed its two-year investigation of W. L. Gore & Associates, saying it will take “no further action” against the company for alleged exclusionary practices related to its Gore-Tex waterproof-breathable membranes. The decision to end the ...read more

Trade Commission Report Supports OIA, SIA Position

Outdoor Industry Association's (OIA) and SnowSports Industries America's (SIA) assertion that no commercially viable production of performance outerwear pants and jackets in the United States was confirmed by a U.S. International Trade Commission (ITC) report released July 27, ...read more

OIA Awarded Portland Development Commission Grant

Outdoor Industry Association Awarded Portland Development Commission Grant for Development of Industry Eco Index BOULDER, CO, January 13, 2010 –OutdoorIndustry Association® (OIA) has received a $10,000 grant from the Portland Development Commission (PDC) that will allow OIA to ...read more

Image placeholder title

Made in USA Brand, LLC Agrees to Drop Deceptive Certification Claims

A company that provides a “Made in USA” certification seal to marketers has agreed to settle Federal Trade Commission charges that it deceived consumers by allowing companies to use the seal without either independently verifying that those companies’ products were made in the ...read more

Rumney’s Final Frontier Permanently Protected

Rumney Climber’s Association (RCA) and Access Fund are excited to announce they have completed the second phase of protecting Rumney’s Northwest Crags (aka the Final Frontier). In just under a year, the climbing community rallied to raise over $100,000, and RCA now owns the ...read more

Online Apparel Retailer Settles FTC Charges That It Failed to Safeguard Consumers’ Sensitive Information, in Violation of Federal Law

Credit Card Numbers, Expiration Dates and Security Codes of Thousands of Consumers Compromised.An apparel company that collected sensitive consumer information and pledged to keep it secure has agreed to settle Federal Trade Commission charges that its security claims were ...read more

Osprey Packs Issues 2009 Sustainability Report

Osprey Packs, Inc., a leader in creating top-quality, high-performance, innovative packs to comfortably and efficiently carry gear, just issued its 2009 Sustainability Report. The six-page quarterly report outlines the independent pack manufacturer's continuous efforts to explore ...read more