Commissioner Lays Down Terms for Industry Opt-Out from FTC Fight for Do Not Track Law
BERKELEY, Calif. -- An FTC commissioner made explicit the iron fist of federal legislation beneath the velvet glove of industry self-regulation that the commission left open in a recent privacy report supporting a Do Not Track system for online information. “We will go to Congress to take up this issue” if industry “doesn’t move quickly and sufficiently,” Commissioner Julie Brill said late Wednesday at a Berkeley Center for Law and Technology conference. The December preliminary report left open whether Do Not Track should be required by law.
Sign up for a free preview to unlock the rest of this article
If your job depends on informed compliance, you need International Trade Today. Delivered every business day and available any time online, only International Trade Today helps you stay current on the increasingly complex international trade regulatory environment.
"Ferment and fervor” over online data -- including media attention and differing approaches offered by the three major browser companies -- make this is an “interesting time for privacy policy and politics,” said Peter Swire, an Ohio State University law professor. He was on the administration transition review of the FTC and then was the National Economic Council’s lead on technology. Business likes to think that this period is a rerun of the 1990s, and it can turn aside broad federal privacy legislation as it did then, he said. But important measures were enacted on the issue in the ‘90s, and times are different now, Swire said.
Dick Armey and other tea party supporters support privacy protection, Swire said. He said House Commerce Committee Chairman Fred Upton, R-Mich., has started sounding more receptive to legislation on the subject than he had.
Privacy advocates should sharpen their theme, Swire said, and he proposed raising a “right to read anonymously” developed by Professor Julie Cohen of the Georgetown University Law Center, and the related chill on dissent from government access to information about reading habits. The Center for Democracy & Technology has offered a similar theory, he said. Supporters of Do Not Track legislation should keep in mind the exceptions for nonprofits and political campaigns that saved Do Not Call from First Amendment issues, and they should avoid criminalizing digital tinkering by including encryption-cracking in any ban on what’s called re-identification of anonymized information, Swire said.
The extended comment deadline on the FTC report is Feb. 18, Brill pointed out. Congress has received more than 200 filings, and “we expect that on the 18th our server may shut down,” she said. The commission remains committed to issuing its final report this year, Brill said.
The FTC will judge the adequacy of self-regulatory set-ups on five yardsticks laid out in the report, Brill said: Ease of use, effectiveness and enforceability, universality, whether choices made persist rather than expiring or being subject to deletion, and the choice of opt-out or opt-in for the collection as well as use of information. “A lot of discussion” has centered on the commission’s position that a Do Not Track system must cover the collection of information, not just its use for customized ads, she said.
"There are some enforcement issues” with using a persistent browser setting, as the FTC recommends, or cookies as the way for a user to express preferences, Brill acknowledged. This kind of system depends on the willingness of advertisers and ad networks to “honor the consumer’s choice,” she said. A commitment to go along with preferences expressed through Do Not Track and otherwise would show that “we've moved the self-regulation effort a long, long way toward being acceptable,” Brill said. The FTC’s “enforcement hook becomes a lot clearer” with a company that has signed on to an industry pledge and then ignores a user’s stated choice, she said.
The FTC’s patience isn’t boundless, Brill indicated. The commission has been after companies for two years to exercise responsibility concerning behavioral advertising, and “industry has been kind of slow to deal with this issue,” she said. With the report, “we seem to have industry’s attention” and increased interest in action, Brill said.
It’s important that the report’s other main themes not get lost in the shuffle, Brill said. “Everybody talks about Do Not Track,” she said. “That’s clearly where all the buzz is.” Another point is privacy by design, the principle that protections should be baked into technology and business decisions rather than bolted on, and the third is that data practices be “transparent, Brill said. “Simplified choice,” which the FTC embodied in Do Not Track, “really works hand-in-glove with transparency."
It’s “incredibly important that we think about information that data brokers are providing to financial firms,” Brill said. She pointed to Wall Street Journal reporting that companies have used information “scraped and sniffed from social networks” in deciding “whether and at what price” to offer insurance coverage. “This raises some pretty serious issues,” Brill said. The Fair Credit Reporting Act should reach this kind of activity but probably doesn’t, because of the way it defines credit information, she said. “That to me is a huge, huge problem.”