A recent White House report on consumer data privacy forecasts a multifaceted approach to fulfilling public expectations regarding the protection of consumer’s personal information. Although it is uncertain if the report will result in new legislation in the near future, the report could have long-term implications for the current regulatory landscape.
In February 2012 the White House released a report detailing the current administration’s position on consumer privacy, entitled Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy. Although it is uncertain if the report will result in new privacy legislation in the near term, the report may still have long-term implications for the current regulatory landscape.
As explained in the report’s Executive Summary, the consumer privacy framework proposed by the administration consists of four key elements: (1) a Consumer Privacy Bill of Rights; (2) a “multistakeholder” process to specify how the principles in the Consumer Privacy Bill of Rights apply in particular business contexts; (3) effective enforcement; and (4) a commitment to increase interoperability with the privacy frameworks of international partners.1 Below we examine each of these elements.
1. Consumer Privacy Bill of Rights
Building upon Fair Information Practice Principles that were first promulgated by the U.S. Department of Health, Education, and Welfare in the 1970s, the Consumer Privacy Bill of Rights is intended to affirm consumer expectations with regard to how companies handle personal data.2 Although the administration recognizes consumers have “certain responsibilities” to protect their own privacy, it also emphasizes the importance of using personal data in a manner consistent with the context in which it is collected.
In a press release accompanying the release of the report, the White House summarized the basic tenets of the Consumer Privacy Bill of Rights3:
Transparency—Consumers have a right to easily understandable information about privacy and security practices.
Respect for Context—Consumers have a right to expect that organizations will collect, use and disclose personal data in ways that are consistent with the context in which consumers provide the data.4
Security—Consumers have a right to secure and responsible handling of personal data.
Access and Accuracy—Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data are inaccurate.
Focused Collection—Consumers have a right to reasonable limits on the personal data that companies collect and retain.
Accountability—Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.
The outline for the Consumer Privacy Bill of Rights is largely aspirational, in that it does not create any enforceable obligations. Instead, the framework simply creates suggested guidelines for companies that collect personal data as a primary, or even ancillary, function of their business operations. As the administration recognizes, in the absence of legislation these are only “general principles that afford companies discretion in how they implement them.”5
Nevertheless, as consumers become more invested in how their personal information is used, a company that disregards the basic tenets of the Consumer Privacy Bill of Rights may be doing so at its own peril. Although the Consumer Privacy Bill of Rights has not been codified, companies should expect that some iteration of the same principles will ultimately be legislated, or voluntarily adopted by enough industry leaders to render them enforceable by the FTC. Therefore, companies would be welladvised to make sure they have coherent privacy policies in place now in order to avoid running afoul of guidelines imposed by whatever regulatory framework is implemented later.
2. The “Multistakeholder” Process to Develop Enforceable Codes of Conduct
The report also encourages stakeholders—described by the Administration as “companies, industry groups, privacy advocates, consumer groups, crime victims, academics, international partners, State Attorneys General, Federal civil and criminal law enforcement representatives, and other relevant groups”—to cooperate in the development of rules implementing the principles outlined in the Consumer Privacy Bill of Rights. Of all the elements comprising the administration’s consumer privacy framework, it is this “multistakeholder” process that will likely see the most activity in coming months.
The report identifies several benefits attributable to this approach6: First, an open process reflects the character of the internet itself as an “open, decentralized, user-driven platform for communication, innovation and economic growth.” Second, participation of multiple stakeholders encourages flexibility, speed and creativity. Third, this approach is likely to producesolutions “in a more timely fashion than regulatory processes and treaty-based organizations.” Finally, the multistakeholder process allows experts to focus on specific challenges, rather than relying upon centralized authority.
The report contemplates that the multistakeholder process will be moderated by the U.S. Department of Commerce’s National Telecommunications and Information Administration (NTIA), a view echoed by the press release accompanying the report.7 This process will likely present companies whose operations involve the collection of consumer data online—a rapidly expanding category that encompasses far more than just internet businesses—with an opportunity to shape future internet privacy legislation.
NTIA has already initiated the conversation through the issuance of a Request for Public Comments on the administration’s consumer privacy framework.8 NTIA has suggested the first topic for discussion should be a “discrete issue that allows consumers and businesses to engage [in] and conclude multistakeholder discussions in a reasonable timeframe.”9 As one example, NTIA has suggested stakeholders discuss how the Consumer Privacy Bill of Rights’ “transparency” principle should be applied to privacy notices for mobile applications. When one considers that by some estimates the revenue generated by the mobile application market is expected to reach $25 billion over the next four years, it is clear that even this “discrete” issue alone could result in a significant regulatory impact.10
3. Effective Enforcement
The report further suggests that the Federal Trade Commission (FTC) will play a vital role in the enforcement of the consumer privacy protections outlined by the administration and developed during the multistakeholder process. The administration admits, however, that in the absence of new legislation, the FTC’s authority in the area of consumer privacy may be limited to the enforcement of guidelines adopted by companies voluntarily.
According to the administration, enforcement actions “by the FTC (and State Attorneys General) have established that companies’ failures to adhere to voluntary privacy commitments, such as those stated in privacy policies, are actionable under the FTC Act’s (and State analogues) prohibition on unfair or deceptive acts or practices.”11 Therefore, in the administration’s view, the guidelines developed during the multistakeholder process would be enforceable under the existing statutory framework.
In light of the current election cycle and the resulting political landscape, it seems unlikely Congress will pass new consumer privacy legislation in the near term. Nevertheless, companies should remain mindful that the FTC—and even state Attorneys General—may become more aggressive in addressing flagrant violations of consumers’ privacy expectations. For instance, California’s Attorney General has explained that her office intends to enforce an agreement that California reached with Apple and other industry leaders earlier this year. The agreement would require developers of mobile applications to post conspicuous privacy policies that explain how users’ personal information is gathered and used.
Moreover, the increased attention directed at privacy issues by consumer groups and the public at large suggests an inevitable groundswell of support for new privacy legislation. As Jon Leibowitz, the chairman of the FTC, explained earlier this week, we could see new privacy legislation early in the term of the next Congress.12
4. A Commitment to Increased Operability
Recognizing that other countries have taken different approaches to data privacy issues, the report also encourages the development of interoperability with regulatory regimes implemented internationally. The administration has suggested a three-pronged approach to achieving increased operability: mutual recognition, development of codes of conduct through multistakeholder processes and enforcement cooperation.
With respect to mutual recognition, the report identifies existing examples of transnational cooperation in the privacy context. For example, it cites the Asia-Pacific Economic Cooperation’s voluntary system of Cross Border Privacy Rules and also the European Union’s Data Protection Directive. It appears that the administration, at least for now, will depend upon companies’ voluntary adoption of these international frameworks.
Just as the administration will rely upon the multistakeholder process to develop domestic codes of conduct, it will adopt the same approach to developing globally applicable rules and guidelines. Although the administration contemplates this process will be directed by the U.S. Departments of Commerce and State, the report does not provide any details.
Finally, the report explains the FTC will spearhead the U. S. Government’s efforts to cooperate with the FTC’s foreign counterparts in the “development of privacy enforcement priorities, sharing of best practices, and support for joint enforcement initiatives.”13
1 Report at 1.
2 Although businesses are also “consumers,” the report appears to focus on protecting individuals’ personally identifiable information.
3 We Can’t Wait: Obama Administration Unveils Blueprint for a “Privacy Bill of Rights” to Protect Consumers Online, February 23, 2012, Office of the Press Secretary.
4 To illustrate the “context” principle, the report provides the example of a hypothetical social networking provider. Users expect that certain biographical information will be collected in order to improve the service; however, if the provider sells the same biographical information to an information broker for advertising purposes, that use is more attenuated from users’ expectations. Therefore, the latter use is not consistent with the “context” in which the biographical information was provided.
5 Report at 2.
6 Report at 23.
7 We Can’t Wait, February 23, 2012, Office of the Press Secretary (“In the coming weeks, the Commerce Department’s National Telecommunications and Information Administration will convene stakeholders … .”).
8 Docket No. 120214135-2135-01, February 29, 2012.
9 Moving Forward with the Consumer Privacy Bill of Rights, Lawrence E. Strickling, Assistant Secretary for Communications and Information, February 29, 2012.
10 According to Markets & Markets, a market research company and consulting firm.
11 Report at 29.
12 U.S. Agency Seeks Tougher Consumer Privacy Rules, The New York Times, March 26, 2012.
13 Report at 33.
© 2012 McDermott Will & Emery