Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC staff comments on FCC’s proposed privacy rulemaking, (May 31, 2016)

By Linda O’Brien, J.D., LL.M.

The staff of the FTC’s Office of Consumer Protection supports a focus on the core privacy values of transparency, consumer choice, and data security, according to a comment provided on May 27 to the Federal Communications Commission (FCC) regarding its proposed privacy rulemaking for broadband Internet access service (BIAS) providers.

The staff comment outlines the FTC’s extensive history of privacy enforcement, policy initiatives, and consumer and business education, and notes that many of the agency’s privacy initiatives have consistently emphasized the core privacy principles. Additionally, the comment responds to questions from the FCC and offers recommendations regarding the proposed regulatory text based on the FTC’s experience protecting the privacy and security of consumers’ data.

The suggested changes address a number of issues in the FCC’s notice of proposed rulemaking. First, the proposed rule would define “personally identifiable information” (PII) as any information that is reasonably linked or linkable to a consumer or a consumer’s devices and treat names, postal addresses, and phone numbers as PII. Next, regarding the structure of privacy notices, FTC staff suggests that the FCC consider: developing a standardized or “model” notice using consumer testing, use of which is a safe harbor for notice; translating privacy notice into the language the customer uses to transact business with the BIAS provider; and requiring opt-in consent for material retroactive changes to privacy notices.

For practices for which consent is implied, FTC staff recommends: (1) to protect consumers from abusive family members, share PII in emergency situations only with family members the consumer designates; (2) allow sharing of data needed to identify and trace abusive, unwanted, or illegal calls (the called consumer’s number should be shared on an opt-out basis); and (3) ensure data is used only for the enumerated purposes that do not require consent.

For practices that require choice, the comment suggests that opt-in consent should be required for use and sharing of contents of consumer communications and sensitive data for purposes other than those for which consent is implied. Opt-out is sufficient for use and sharing of non-sensitive data. Under the proposed sharing regime, opt-out consent should be permitted for sharing of non-sensitive information with affiliates only where the affiliate is co-branded with the BIAS provider or the relationship is otherwise clear to the consumer; sharing with other affiliates should be permitted on the same basis as any other third-party.

The staff comment also recommends that the proposed regulations on data security require a written comprehensive information security program, require safe disposal of PII, and develop robust security safe harbors with appropriate safeguards and enforcement. Regarding breach notification, third parties should be required to report breaches to BIAS providers, and BIAS providers should be required to provide the breach notification to consumers; breach notification should be given to consumers between 30 and 60 days after discovery of the breach; and information about consumer reporting agencies should be included in breach notices only when relevant, and provide contact information for the FTC and the address of its IdentityTheft.gov website.

Ohlhausen statement. In a separate statement, Commissioner Maureen Ohlhausen emphasized the differences between the FTC’s approach and the proposed approach of the FCC to consumer privacy. The FTC’s privacy program, built on the legal principles of unfairness and deception, focuses on the sensitivity of consumer data and particular promises made about data collection and use rather than on what type of entity collects or uses that data. By contrast, the FCC’s three-tiered “implied consent / opt-out / opt-in” framework focuses on whether the holder of the data is a BIAS provider, an affiliate, or a third party. This framework does not account for the sensitivity of the consumer data involved, according to Commissioner Ohlhausen. While the FCC would require opt-in consent for many uses of non-sensitive consumer data by BIAS providers—yet require no consent at all for certain uses of sensitive data by those providers—the FTC recommends opt-in consent for unexpected collection or use of consumers’ sensitive data, in Ohlhausen’s view.

Ohlhausen cautioned that the FCC’s approach may not best serve consumers’ interests. Exercising and obtaining consent can be burdensome for consumers and businesses and regulations should impose such costs in a way that maximizes the benefits while minimizing the costs, according to Ohlhausen. “Therefore, opt-in or opt-out defaults should match typical consumer preferences, which means they impose the time and effort of making an active decision on those who value the choice most highly,” the Commissioner noted. To meet the laudable goal of protecting privacy and data security of BIAS consumers, the FCC’s proposed rulemaking should base its requirements on consumers’ preferences about sensitive information and set opt-in and opt-out defaults accordingly as well as permit consumers to make well-informed choices about discounted broadband, she concluded.

News: Privacy ConsumerProtection FederalTradeCommissionNews