Federal Law Must Supplement Administration’s Privacy Proposal, Lawmakers Say

"American consumers can’t wait any longer for clear rules of the road that ensure their personal information is safe online,” President Barack Obama said in a written statement. “As the Internet evolves, consumer trust is essential for the continued growth of the digital economy. That’s why an online privacy bill of rights is so important. For businesses to succeed online, consumers must feel secure. By following this blueprint, companies, consumer advocates and policymakers can help protect consumers and ensure the Internet remains a platform for innovation and economic growth.”

The Consumer Privacy Bill of Rights applies seven general principles to data that can be linked to a specific individual, the White House said. It said they are: Individual control; transparency; respect for context; security; access and accuracy; focused collection; and accountability. The bill of rights should serve as a blueprint for future legislation that codifies these principles into federal law. NTIA plans to work with Internet companies and consumer groups to develop enforceable codes of conduct, the White House said. Once established companies can adopt the rules into their privacy policies, which will then be enforceable under Section 5 of the FTC Act, the administration said.

Senate Communications Subcommittee Chairman John Kerry, D-Mass., warned industry members that online privacy legislation is still necessary to fulfill “Americans’ wishes not to be tracked.” “Voluntary compliance does not replace the need for a new law,” he said. “Until Congress gets its act together and does its job, Americans won’t have the guaranteed protection of industry-wide compliance. We'll instead continue operating in an online wild west.”

Senate Commerce Committee Chairman Jay Rockefeller, D-W.Va., sees the privacy bill of rights as a “critical public policy proposal,” he said. “I believe consumer privacy is a right, not a luxury,” he said. “It is absolutely crucial that, as we move forward in an evolving online and mobile world, consumer choice is protected and preserved. I will work to do just that.” Senate Privacy Subcommittee Chairman Al Franken, D-Minn., will begin working with the administration to pass online privacy legislation “as soon as possible,” he said. “I believe that consumers have a fundamental right to know what information is being collected about them and to control whether they want to share that information, with whom they want to share it and when.” However, this right “won’t be a reality until Congress takes action to pass privacy legislation.” Franken, Kerry and Rockefeller wrote various privacy bills.

House Commerce Manufacturing Subcommittee Chairman Mary Bono Mack, R-Calif., plans a hearing soon to go through the White House report “in more detail,” she told reporters at the White House event. With the election coming up in November, “it’s definitely a tougher year to get much accomplished, unfortunately, but an issue like this needs to be thoroughly vetted,” she said. “I don’t know if we need to rush it before the election. ... We don’t want to become the EU and have something rushed out there that we're trying to undo years and years later.” She plans to hold the hearing sometime in “mid to late March,” a spokesman said. Rep. Marsha Blackburn, R-Tenn., said any privacy legislation should be cautiously crafted to “avoid unintended consequences that will end up costing America jobs."

The co-chairmen of the Congressional Privacy Caucus, Reps. Ed Markey, D-Mass., and Joe Barton, R-Texas, said the administration’s proposal lacks teeth and urged the passage of their “Do Not Track Kids” legislation (HR-1895). “Voluntary, self-regulatory efforts are not a substitute for laws that keep consumers’ information safe from prying eyes,” Markey said in a joint statement released with Barton. “Children and teens are particularly vulnerable, and added protections for this group must be included in stringent, legally-enforceable safeguards.” Barton said the absence of an enforcement mechanism in the administration’s proposal “means consumers remain unprotected.”

The FTC confirmed that once a company agrees to voluntarily incorporate the administration’s privacy principles into their own privacy policy they will then be subject to FTC enforcement if they subsequently violate their own policies. If a company pledges to do “one thing and [then] do another, it’s deceptive, in violation of Section 5 of the FTC Act,” an FTC spokeswoman told us. The agency currently maintains consent agreements with Facebook and Google that ban the companies from violating their privacy policies subject to $16,000 in civil fines for each violation.

The administration should “not have to wait for legislation” to advance privacy goals, said National Economic Council Director Gene Sperling at the White House event Thursday. Commerce Secretary John Bryson agreed: The administration will “be working with Congress to implement this through legislation. We're also moving forward now. We feel we just cannot wait.”

"Comprehensive privacy legislation would be ideal, and we're going to work to that end,” Consumers Union Federal Policy Director Ellen Bloom said at the White House event. “But this action today puts us on a path to getting greater control of how our information is collected and used online.” Consumers Union was “encouraged” by the White House paper but is “not ready to rest,” Bloom said. “We definitely are on the right track, but we need to stay committed” to educating consumers on online privacy, she said.

Separately, groups representing the largest online ad companies committed to implement do-not-track technologies into most major Web browsers to enable greater user control over online tracking. The Digital Advertising Alliance said the proposed browser mechanism will be “simple to use” and implemented “in a clear manner that describes to consumers the effect of exercising such choice.” The group, which represents the American Association of Advertising Agencies (4A’s), Association of National Advertisers (ANA), American Advertising Federation (AAF), Direct Marketing Association (DMA), Interactive Advertising Bureau (IAB) and Network Advertising Initiative (NAI), said the functionality will be implemented within nine months. Rockefeller welcomed the industry’s proposal and said he would “closely monitor implementation of the new industry effort to make sure that consumer expectations are, in fact, being met.”

FTC Chairman John Leibowitz also supported the industry’s voluntary effort. “It’s great to see that companies are stepping up to our challenge to protect privacy so consumers have greater choice and control over how they are tracked online,” he said Thursday. “More needs to be done, but the work they have done so far is very encouraging.” Leibowitz would not confirm that the agency was investigating whether Google’s new privacy policies violate the FTC’s 2010 consent agreement following the company’s privacy violations. “We take compliance with consent orders seriously and we look at violations seriously,” he said in a news conference Wednesday evening.

DAA members jointly said the administration’s endorsement “marks not the end of a journey, but the beginning of an important collaboration” among government, business and consumer groups. The 4A’s, ANA, AAF, DMA, IAB and NAI sought to connect their effort to ad-supported small Internet businesses such as Askthebuilder.com and FamilyTravelForum.com. “There are tens of thousands of stories like theirs in every state, in every Congressional district,” comprising 2.1 percent of U.S. gross domestic product as calculated by a Harvard Business School study, the groups said.

Internet companies, trade groups and think tanks each found something to like in the administration proposal, though their statements Thursday were less than full-throated endorsements. Yahoo said it was “pleased” the administration is giving “high level attention” to privacy frameworks. But the company emphasized the “incredible strides” the industry has made through self-regulation “in just a few years,” such as through the Ad Choices opt-out icon and the DAA code, of which Yahoo was a “key advocate” of several provisions.

The Center for Democracy & Technology thinks “legislation will likely be necessary to achieve” privacy protections, though it supports the development of “consensus rules,” said President Leslie Harris. The Association for Competitive Technology said it was “particularly pleased to note that the words ‘internet’ and ‘online’ do not appear in the proposed enumerated Bill of Rights” and that the administration included mobile app developers in the process. USTelecom President Walter McCormick said it’s “encouraged” by the Commerce Department’s “recognition that federal laws should not treat similar technologies within the communications sector differently."

Several consumer groups signed on to a document titled “principles for multi-stakeholder process” Thursday, responding to the administration plan. They include “only consumer representatives can determine who speaks for consumers,” “all substantial decisions must be made in open sessions,” participants “must specifically identify” their employer or group they represent, stakeholders must have “fair opportunity for public engagement” with their communities through social media and other methods, and decisions must be made on a “fair and broad consensus,” not through “majority vote.” The document (http://xrl.us/bmuabv) was signed by the ACLU, Consumer Federation of America, Electronic Frontier Foundation, Consumers Union, U.S. PIRG, Center for Digital Democracy and others.

Not everyone was thrilled with the White House proposal. TechFreedom President Berin Szoka and Senior Adjunct Fellow Larry Downes called the report a “missed opportunity” that represents a “constitutional sleight-of-hand.” The report “recommends no reform whatsoever for outdated laws that have facilitated a dangerous expansion of electronic surveillance,” they said. “That is the true threat to our privacy.”