Antitrust Law Daily Wrap Up, PRIVACY NEWS—FTC Commissioner Brill Speaks on Mobile Privacy Concerns, Calls for Increased Industry Participation, (Mar 7, 2013)

By Tobias J. Gillett, J.D., LLM.

FTC Commissioner Julie Brill has delivered a speech before the DLA Piper Privacy Symposium on March 6, 2013, in Washington, D.C., describing FTC efforts to address privacy issues in the mobile environment, and calling for increased industry engagement on those issues.

Brill began her speech, entitled “Privacy On the Go: Privacy Protections in the Mobile Environment,” by noting the rapid growth in use of mobile devices, and the consequent growth in the collection and use of consumer data generated through the devices. She observed that consumers are beginning to become aware of the privacy issues attendant upon their use of the devices, that they have begun selecting apps based on their privacy practices, and that industry players have begun to respond to this consumer reaction.

Having provided this background, Brill proceeded to discuss the role of the FTC in the mobile space. She noted FTC efforts to provide information to consumers, including “just in time” information, layered notices, and the FTC’s privacy reports and studies. She highlighted certain findings from the reports, such as that many mobile players still do not issue more traditional privacy policies, and that apps for children frequently do not provide parents information on what data is collected from children, how it is shared, or who will have access to it.

She also outlined steps the FTC has taken to increase its understanding of technology, including its hiring of Ed Felton as its chief technology officer, its later hiring of Steve Bellovin to replace him, its establishment of a Mobile Technology Unit of attorneys and technologists, and its creation of a mobile lab to assist FTC law enforcement efforts.

She then proceeded to discuss the FTC’s enforcement efforts in the area. She began with the enforcement actions involving Google and Facebook’s privacy practices, including a $22.5 million penalty levied against Google for evading Apple’s privacy protections, and the requirements that Google and Facebook develop privacy programs to be assessed by an outside auditor.

Other recent cases included its settlement with mobile device manufacturer HTC for failing to adequately provide security training to its engineers, failing to test its software for security vulnerabilities, and filing to follow common secure coding practices; its settlement with social networking app developer Path for collecting information from consumers’ address books without consent and collecting personal information from children without parental consent in violation of the Children’s Online Privacy Protection Act; and its settlement with Filiquarian for functioning as a credit reporting agency without proper consumer protection measures in violation of the Fair Credit Reporting Act.

She contended that the FTC’s enforcement cases “serve an important role in educating the technology community,” and described other efforts the FTC has made to establish best practices for the mobile space. She suggested that mobile developers should adopt a sense of shared responsibility regarding consumer privacy, and that some players in the “mobile ecosystem” could assist in developing privacy practices. She pointed to an initiative by California Attorney General Kamala Harris to work with mobile app platform providers “to give app developers the means to provide consumers with information about their privacy policies.”

In this vein, Brill outlined some best practices from the FTC’s recent mobile privacy report, released last month. For platforms and operating systems, these included providing “just in time” disclosures and affirmative express consent before permitting access to users’ sensitive content; “developing a consumer-facing one-stop ‘dashboard’ where consumers could review and manage the types of content accessed by the apps they have downloaded,” and implementation of a “do not track” mechanism so users can indicate their preferences regarding data collection.

For app developers, these included making their privacy policies available through app stores; providing “just in time” disclosures and affirmative express consent before permitting access to users’ sensitive content; and “improv[ing] coordination and communication with ad networks and other third parties.” For ad networks, analytics companies, and other third parties, these included communicating with app developers so they can provide accurate information regarding data collection and use.

Brill closed by calling for participation by all players in the mobile ecosystem. She “applaud[ed]” the efforts of some that had already begun to deal with privacy issues, but suggested that “others need to step up to the plate.” If not, she warned, “these players may face more proscriptive rules down the road, or they may simply be left in the competitive dust.”

News: Privacy FederalTradeCommissionNews