The Federal Trade Commission (FTC) is expected to take a more aggressive approach in a number of consumer privacy protection areas, as new leadership brings a more skeptical attitude toward recent "hands-off" policies. Possible legislation and a series of agency-sponsored workshops may be laying the groundwork for additional consumer privacy protection regulations. There is much afoot, and businesses should pay close heed.
One critical change is in the roster of the FTC itself. New Chairman Jon Leibowitz has now settled into office, having served nine months as Chairman, after 4 1/2 years as a Commissioner. Recently, President Obama nominated two new commissioners, who, when confirmed, will put the FTC at full strength. The nominees are Julie Brill and Edith Ramirez. Brill currently serves as senior deputy attorney general and chief of consumer protection and antitrust for the North Carolina Department of Justice, and Ramirez is a business and intellectual property litigator from Los Angeles.
As for consumer privacy online, Chairman Leibowitz has not awaited a full Commission before expressing skepticism about the effectiveness of the current reliance on industry self-regulation. In a number of statements over the summer, he continued to voice support for self-regulation, but also made clear that he expected greater vigor and improved results from the industry, and that he intends to update the Commission's approach to online consumer privacy protection.
More inklings of where the Commission may be heading on consumer protection law may emerge from three roundtable discussions that the agency is holding with industry and advocacy groups during the next few months. The agency has said these workshops will provide "a public dialogue . . . on the risks and benefits of information sharing practices, consumer expectations regarding such practices, behavioral advertising, information brokers, and the adequacy of existing legal and self-regulatory frameworks."
The first roundtable, held on December 7 in Washington, focused on risks in collecting, using and retaining consumer information, consumer expectations, behavioral targeting, information brokers and current regulatory frameworks. The second roundtable will be held on January 28, 2010, at the Berkeley Center for Law and Technology at the University of California. It will focus on how technology affects consumer privacy. Topics should range from cloud computing and social networks to mobile marketing. The third roundtable will take place on March 17, 2010, in Washington. Watch these carefully for signs of what the FTC may be thinking.
Many interested parties staked out initial positions in comments filed with the agency in November, leading up to the December workshop. The comments reveal dramatically different views between industry and consumer advocates regarding the value of marketing on the basis of behavioral targeting, customer expectations, and whether and how current regulatory policy should change.
Is "Notice and Consent" Enough?
One paramount question today is whether the "notice and consent" paradigm that has served as the hallmark of U.S. regulatory policy regarding online privacy remains the proper approach. Advocates of the current policy point to the valued role advertising plays in supporting free Internet content, the actions of industry in recent years to help consumers better understand how data are collected, used and stored, and the harm that additional regulation might cause.
Advocates of greater privacy protections for consumers argue that the notice and consent approach has proven to be inadequate. Claiming that consumers are unaware of current uses of "their" personal information and are displeased when they learn about current practices, privacy advocates seek new restrictions on the use of personal information (including web browsing behavior) for marketing purposes. To this end, they have urged the FTC to rely more on its jurisdiction over "unfair" business practices, and to determine that "harm" can be caused by certain practices regarding intangible personal information. They have also urged the agency to emphasize other "Fair Information Practices" recognized by the Organization for Economic Cooperation and Development and other entities, including use restriction and limits on data retention.
Critics of the current model may also have an ally in the current Consumer Protection Bureau Chief, David Vladeck, who has expressed considerable skepticism about the usefulness and informative value of written privacy policies found on many websites. Perhaps not coincidentally, on November 17, the FTC released a model financial privacy form that is designed to give financial consumers more understandable information about what financial institutions and creditors do with their personal information. The model form, based on the FTC's authority under the Gramm-Leach-Bliley Act, may foreshadow Commission recommendations regarding online privacy as well.
The FTC Staff Guidelines
One issue sure to be addressed is the industry's response to the FTC's staff's recommended self-regulatory guidelines for behavioral targeting. Since the release of the guidelines in February 2009, industry groups have announced several initiatives generally responsive to the staff's suggestions. In particular, the Network Advertising Initiative, the Interactive Advertising Bureau and the Privacy Group Coalition have each set forth principles to which they urge online advertisers to adhere. See generally "Behavioral Targeting: Advertising Industry Proposes New Self-Regulatory Principles," (Privacy In Focus August 2009); "The FTC Releases Its Staff Report on Online Behavioral Advertising," (Privacy In Focus March 2009) However, implementing these initiatives takes time, and while they offer promise, their effectiveness has yet to be shown.
On a somewhat related issue, the FTC has indicated that in 2010 it will conduct a review of the Children's Online Privacy Protection Act (COPPA) and its implementing regulations. Among the issues likely be to covered in that review are mobile marketing to teenagers, and whether the current threshold age of 13 should be raised (particularly in light of efforts by states, such as Maine, to extend COPPA-like protections to older teens).
Congress at Work
Additional impetus may come from Congress. For two years, members of the House Commerce Committee, led by Rep. Bobby Rush (D-IL) and Rep. Rick Boucher (D-VA), who, respectively, chair the subcommittees on Commerce, Trade, and Consumer Protection and on Communications, Technology, and the Internet, have held hearings on online advertising and the tracking of consumers. Their subcommittees held a joint hearing on November 19 focused on the collection and retention of consumer information both online and offline. While the Congressmen present were aware of the problems that regulation can cause, it is also safe to say that few expressed enthusiastic endorsement of current practices. Rep. Ed Markey (D-MA) said in his opening remark: "We've moved from an era of privacy keepers to one of privacy peepers."
Fairly soon, Reps. Boucher and Rush are expected to circulate draft legislation regarding online advertising and, quite likely, offline also. The bill will likely provide direction for the FTC in this area as well. Formal introduction is not likely until 2010. The bill almost certainly will receive substantial legislative attention and be the focus of considerable interest over the next year.
Separately, the House Commerce Committee has approved new rulemaking and enforcement authority for the FTC, including the use of notice and comment rulemakings and the collection of fines. As that provision is part of the far larger financial services reform bill, its future is unclear. However, if the FTC is granted greater rulemaking and enforcement powers, look for it to become more aggressive on consumer privacy issues as well.
These developments forecast an active year in Congress and the FTC regarding consumer privacy protection. Companies reasonably may anticipate having to change some practices over the course of the next couple of years as the process unfolds.