Google action and implications:
In the recent action against Google, Part III of the proposed order requires the company to establish and maintain a comprehensive privacy program, and identifies several requirements. Is the FTC attempting to send a message that the type of program identified in the order is, as a practical matter, a compliance requirement, such that the failure of a company to implement the requirements could constitute a violation of the FTC Act?
Part III of the proposed order in Google Buzz requires the company to establish, implement, and maintain a comprehensive privacy program that is reasonably designed to: (1) address privacy risks related to the development and management of new and existing products and services for consumers, and (2) protect the privacy and confidentiality of covered information. Given the allegations in the complaint, including allegations about the ways that Gmail users’ information was shared in many instances without prior notice or the opportunity to consent, this provision is necessary relief related to the alleged law violations in this case and should deter future violations. The order requirements do not apply to third parties. Still, Part III provides a template that other companies that collect consumer information should consider implementing so that privacy concerns are integrated at all stages of the product cycle and are not just an afterthought.
Transparency:
How can companies be more transparent regarding their treatment of personally identifiable information?
In December, FTC staff issued a preliminary report, Protecting Consumer Privacy in an Era of Rapid Change (“the Report”),1 that emphasized the importance of transparency in communicating to consumers how information that is collected about them is used, and suggested a range of approaches to improve transparency. Despite the shortcomings of most privacy policies in current use in the marketplace today, privacy policies can still be an important communication tool as long as they are clear, concise, and easy-to-read. Another practice that aids transparency is getting information about the company’s privacy practices – and choices about sharing information – out of the privacy policy, and presenting them to consumers at the time that the consumer is asked to provide information. Consumers should get notice and the opportunity to consent to retroactive changes to the privacy policy. Depending on factors such as the sensitivity and uses of the information collected, providing consumers with access to the information that is maintained about them can be another way to give consumers more of a window into the types of information that is collected about them and how it is used. In addition, consumer education to help consumers understand, for example, how their information is used in connection with particular industry practices is also helpful. We have been reviewing public comments on the preliminary report’s proposals and expect to issue a final report later this year.
Accountability:
What should companies do to verify that they are adhering to their privacy policies and principles?
The first step is to assess what types of information the company collects from consumers and how the information is being used, and confirm that the privacy policy describes the company’s practices accurately. When designing new products or services, taking privacy into account at this initial stage – so-called “privacy by design” – can pay dividends down the road. A company may discover, for example, that instead of putting security measures in place to protect a particular type of consumer information, the product can be designed so that the information need not be collected in the first place. At the other end of the product cycle, companies should assess whether information must be retained and, if so, for how long. Employee training about privacy and the company’s policies – and assigning an individual who is accountable within the company for ensuring that privacy rules are followed – are also important steps.
Privacy Policies:
What criteria should companies use to evaluate their privacy policies?
The Report highlights some of the problems with privacy policies. They are often designed to limit liability rather than to inform consumers, and so tend to be long documents written in legalese. Still, privacy policies do serve important accountability and other purposes. Some tips to improve them:
Ask whether you are using plain language – could a non-lawyer understand it? Could a high school graduate understand it?
Does the policy clearly state that you are collecting consumer data, what types of data are being collected, why you are collecting it, and how the data will be used?
Don’t bury important information. In the Sears case, for example, the Commission alleged that the company inadequately disclosed the extent of information collection. (See Sears, available at http://www.ftc.gov/os/caselist/0823099/090604searsagreement.pdf ).
The Report also calls on industry to explore setting standard definitions to make it easier for consumers to compare different companies’ practices.
Codes of Conduct:
What are the essential ingredients for privacy codes of conduct that are created by industry groups?
Broadly, meaningful self-regulatory approaches should be comprehensive – comprising a significant percentage of the relevant industry – and enforceable, with sanctions for non-compliance. They should also be effective and robust. The essential ingredients may vary depending on the particular conduct addressed by the code. In the Do Not Track context, for example, Bureau Director Vladeck has talked about five essential elements that should be included in an industry-designed mechanism: the mechanism must be, first, easy for consumers to use and understand; second, effective and enforceable; and third, universal. Fourth, the mechanism must allow consumers to opt out not only from the use of tracked data, but also from its collection. Finally, an effective Do Not Track mechanism will ensure that consumers’ choices will be persistent.
Determination of “harm:”
From the FTC’s perspective, how is consumer “harm” or “injury” defined with respect to privacy? Is it more than economic or the potential for identity theft? If so, what is the evidence or legal support for such an expanded determination?
The Commission has authority to challenge deceptive or unfair acts or practices. For purposes of deception, the key inquiry is whether a misrepresentation or deceptive omission is material to consumers – that is, whether it is likely to affect a consumer’s choice of or conduct regarding a product or service. An act or practice is unfair if it causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition. As stated in the FTC Policy Statement on Unfairness, the Commission is not concerned with trivial or merely speculative harms. In most cases a substantial injury involves monetary harm, as when sellers coerce consumers into purchasing unwanted goods or services or when consumers buy defective goods or services on credit but are unable to assert against the creditor claims or defenses arising from the transaction. Unwarranted health and safety risks may also support a finding of unfairness. Emotional impact and other more subjective types of harm, on the other hand, will not ordinarily make a practice unfair.
In the policy context, the Report notes that in addition to harms that cause physical or economic injury (such as identity theft or fraud) or unwarranted intrusion into consumers’ daily lives (such as the unwanted calls from telemarketers addressed by the Do Not Call Registry), “for some consumers, the actual range of privacy-related harms is much wider and includes reputational harm, as well as the fear of being monitored or simply having private information ‘out there.’” Report at 20. Thus, in the Report, Commission staff proposed a new policy framework for addressing privacy writ large. This effort is solely a policy initiative, however, and has not changed the legal standards applicable to the Commission’s authority.
Self-regulation:
What expectations does the FTC have concerning a meaningful role for self-regulation?
The Commission has indicated its support for self-regulation over many years and in many different contexts. In 2008, for example, the Commission staff proposed a set of principles on which self-regulatory efforts in the online behavioral advertising space could be based. We continue to encourage self-regulation in the privacy area. In fact, the Report was “intended to inform policymakers… and guide and motivate industry as it develops more robust and effective best practices and self-regulatory guidelines.” The FTC staff specifically supported the development of a “comprehensive consumer choice mechanism” for online behavioral advertising either by legislation or “robust, enforceable self-regulation.” Report at 66.
Data Security Breach Notification Law:
The Department of Commerce paper recommends the consideration of a federal commercial data security breach notification law that establishes standards. Does the FTC have a position on such a law?
In testimony before Congress, the Commission has stated:
[Breach] notification in appropriate circumstances can be beneficial. Indeed, various states have already passed data breach notification laws which require companies to notify affected consumers in the event of a data breach. These laws have further increased public awareness of data security issues and related harms, as well as data security issues at specific companies. Breach notification at the federal level would extend notification nationwide and accomplish similar goals.
See Prepared Statement of the Federal Trade Commission Before the S. Comm. on Commerce, Science, and Transportation, Subcomm. on Consumer Protection, Product Safety, & Insurance, 111th Cong. (Sep. 22, 2010), available at http://www.ftc.gov/os/testimony/100922datasecuritytestimony.pdf, at 11. This recommendation is consistent with previous Commission recommendations. See Prepared Statement of the Federal Trade Commission Before the S. Comm. on Commerce, Science, and Transportation, 109th Cong. (Jun. 16, 2005), available at http://www.ftc.gov/os/2005/06/050616databreaches.pdf; Prepared Statement of the Federal Trade Commission Before the S. Comm. on Commerce, Trade, and Consumer Protection, 111th Cong. (May 5, 2009), available at http://www.ftc.gov/os/2009/05/P064504peertopeertestimony.pdf.
