FTC Releases Long-Awaited Privacy Report: "Protecting Consumer Privacy in an Era of Rapid Change"

The FTC today released a long-awaited Staff Report (though in preliminary form) that examines the status of privacy law and enforcement by the agency and proposes a framework for greater  consumer privacy protections in the products and services developed by businesses.   The Report, which follows a series of public roundtable discussions on privacy held by the FTC over the past year, is comprehensive in identifying many pressing privacy issues.

Continue Reading...

Forbes Interview Explores Current Hot Topics in Privacy

In this interview with Forbes, I share some perspectives on

(1) the prospects for an online privacy bill passing this year;

(2) some of the issues raised by the Rush privacy bill currently pending in Congress;

(3) the efficacy of FTC enforcement;

(4) the problems with the concept of a "Do Not Track" list, which has been proposed; and

(5) the need for reform of the Electronic Communications Privacy Act.

Carnegie Mellon Study Claims Thousands of Web Sites Misrepresent Privacy Settings

The Platform for Privacy Preferences Project, or P3P, involves browser technology that allows a user to set privacy conditions and state what personal information may be seen by websites.     Websites usuing P3P are supposed to respect the user's settings.  Heralded as a privacy enhancing technology when the World Wide Web Consortium recommended it in 2002, adoption of the automated tool, it has never caught on and the vast majority of consumers don't use it.

Nevertheless, a just-released study by Pedro Giovanni Leon, Lorrie Faith Cranor, Aleecia M. McDonald and Robert McGuire of the Carnegie Mellon Cy Lab has concluded that large numbers of websites are misrepresenting their P3P privacy practices, "thus misleading users and rendering privacy protection tools ineffective."  From the Abstract:

"Platform for Privacy Preferences (P3P) compact policies (CPs) are a collection of three-character and four-character tokens that summarize a website's privacy policy pertaining to cookies. User agents, including Microsoft's Internet Explorer (IE) web browser, use CPs to evaluate websites' data collection practices and allow, reject, or modify cookies based on sites' privacy practices. CPs can provide a technical means to enforce users' privacy preferences if CPs accurately reflect websites' practices. Through automated analysis we can identify CPs that are erroneous due to syntax errors or semantic conflicts. We collected CPs from 33,139 websites and detected errors in 11,176 of them, including 134 TRUSTe-certified websites and 21 of the top 100 most-visited sites. Our work identifies potentially misleading practices by web administrators, as well as common accidental mistakes. We found thousands of sites using identical invalid CPs that had been recommended as workarounds for IE cookie blocking. Other sites had CPs with typos in their tokens, or other errors. 98% of invalid CPs resulted in cookies remaining unblocked by IE under it's default cookie settings. It appears that large numbers of websites that use CPs are misrepresenting their privacy practices, thus misleading users and rendering privacy protection tools ineffective. Unless regulators use their authority to take action against companies that provide erroneous machine-readable policies, users will be unable to rely on these policies."

Just as a recent University of California-Berkeley study about flash cookies and privacy prompted a series of lawsuits recently against Quantcast and Clearspring and users of their technology, there is speculation that the Carnegie Mellon study may inspire new lawsuits and investigations.  The websites using P3P compact policies are not without their defenses however, so it remains to be seen whether the study serves as a sturdy "platform for plaintiffs' preferences."

If the Online Notice is Too Complex, Does That Open the Door to Tort Claims?

In an opinion piece appearing in today's Wall Street Journal, available here, Eric Felten describes an ongoing case in which a tort claim seeks to escape the limitation of liability language contained in an End User License Agreement (EULA):

A federal judge in Hawaii ruled last month that a man claiming to be addicted to a videogame can sue the game's maker for gross negligence in not warning him he could become a joystick junkie. Craig Smallwood alleges in his lawsuit that, as a result of playing the online game "Lineage II," he has "suffered extreme and serious emotional distress and depression, and has been unable to function independently in usual daily activities such as getting up, getting dressed, bathing, or communicating with family and friends."

Felten continues:

Silly as the suit may be, it isn't without legal ramifications. Steven Roosa, a lawyer doing research at Princeton's Center for Information Technology Policy, sounded almost giddy this week at the prospect that a court might chip away at the enforceability of End User License Agreements, or EULAs. These software license agreements often radically limit how, and for how much, customers can sue if they feel harmed by an electronic product.

Mr. Roosa cheered on his blog that the judge in Hawaii has opened an avenue for escaping the tyranny of these one-click, liability-limiting contracts. He called the judge's refusal to throw the case out in its entirety a "stunning defeat" not only for the maker of Lineage II, but for the whole business of locking customers into contracts that consist of miles of electronic fine print that hardly anyone ever reads.

Felten observes in his Journal article that "[n]o doubt we do live in a time of kudzu legalese, with weedy contractual tendrils crawling into every electronic transaction. It's alarming to think about everything we sign off on these days, with endless demands to click "I agree" as the non-negotiable price of entry into our electronic worlds. Alarming, because few of us ever peruse the legal documents to which we so regularly and glibly affix our electronic signatures."

Last April, the British retailer Gamestation set out to prove the point by including in its boilerplate some Mephistophelean contractual language: "By placing an order via this Web site," read the clause, "you agree to grant us a non-transferable option to claim, for now and for ever more, your immortal soul." In just one day, some 7,500 customers "agreed" to hand over their souls for a mess of virtual pottage. (emphasis supplied)

In the context of privacy policies, two weeks ago I was a panelist at the Privacy, Identity and Innovation 2010 conference in Seattle in the session "Competing on Privacy: Trade-offs, Transparency and Trust."  At the session, I observed  that privacy policies often are dense because companies need to protect themselves, but that alongside the legalese of the privacy policies can be layered notices with simple declarative sentences and even videos of people explaining in plain English how personal information is collected and used.

A blogger in the Seattle audience yelled out at me for admitting that I draft lengthy privacy policies, and I tried to get this concept across, explained in today's Journal article:

The proliferation of annoying and obnoxious license agreements has been driven, primarily, not by companies' desire to abuse their customers, but by a need to keep their rather more litigious customers from abusing them (and the legal system). As Jonathan Zittrain, who teaches both law and computer science at Harvard, puts it, "EULAs are, for most companies, a shield not a sword."

(I did not admit nor do I mean to suggest that the policies I draft are "annoying and obnoxious," just lengthy.)

So it is a given that legal notices almost inevitably will be complex but supplemental, simplified notices, even video notices, alongside the legalese will better inform consumers.  And it should thwart tort claims where a plaintiff claims "I had no idea this could be the result of my interaction with the web site."

 

Should governments do more to protect online privacy?

The Economist magazine is hosting an online debate on whether governments should do more to protect online privacy.  The series can be found here.  Marc Rotenberg, President and Executive Director of Electronic Privacy Information Center (EPIC) is squaring off against Jim Harper, Director of Information Policy Studies at the Cato Institute.  Today, Jules Polonetsky, Co-Chair and Director of the Future of Privacy Forum (the privacy think tank that I founded and co-chair with Jules) made this contribution to the debate:

The struggle over business use of our personal digital data has now been raging for decades. Each new technological advance has kicked off a frenzy of new concerns about the risks created by new types of data collection and use. Cookies, behavioural ads, RFID tags, social networks and mobile geolocation are ubiquitous and essential to many consumer products and business models. Yet many data regulators and policymakers around the world maintain that the common ways they are used violate current privacy laws. Others are pressing for new laws to constrain the collection and use practices that are in question.

American data and tech companies are focused on new bills proposed in Congress, as the latest battle in the long inside-the-Beltway privacy war continues. Washington insiders have been following the manoeuvring between competing privacy proposals on the House side and are awaiting an impending report from the Federal Trade Commission that could indicate whether the agency has decided to call for legislation. All year long, businesses have struggled to defend revenue models like behavioural advertising that are primarily based on using the history of users' web activity to show them ads. For nearly a decade, kicked off by DoubleClick's plans to link catalogue purchases to online web-surfing profiles, these practices and related data uses have been the subject of withering criticism from advocates, regulators and often the media. Recent privacy missteps such as Google's collection of personal data through its Street View software and the flap over Facebook's privacy changes have put privacy issues under an even more intense spotlight.

In Europe, companies are considering the impact of the updated Telecoms Directive, which calls for express consent before a user is served a cookie. In addition, a new consensus opinion from the European privacy regulators has declared that behavioural advertising relies on personal information and thus must also require a level of express consent that users do not get today.

The industry claim is that the use of online marketing data supports free content and provides users with a more relevant online experience. Privacy advocates and regulators insist that such data use should be barred unless users expressly opt in to targeting or tracking. The brickbats continue to fly.

How can businesses turn the corner in this struggle? Adopting the restrictive data-use perspective would end the ad-supported free web-publishing model as it exists today. Fully locking down Facebook privacy settings would put an end to the unexpected but invaluable social opportunities that continue to spring up. But accepting the status quo where users are uneasy about behavioural targeting or uncertain about their social media settings is also not an option.

The debate may soon be cut short by the advance of technical solutions that give users more insight and control over online data use. Venture capitalists have taken note of the increased consumer interest in online privacy and have started funding companies offering privacy tools like Abine, Ghostery and TRUSTe. Datran Media has created a tool that can be used by users to centrally manage opt-out preferences and profiles across many ad networks. And although the browser companies have long offered cookie-handling options, Microsoft's Internet Explorer's new InPrivate Filtering setting will now blacklist any interaction between a user and potential tracking sites. This feature is currently off by default, but will privacy competition with Chrome and Firefox lead to it being more widely promoted in future IE versions? And will Chrome or Firefox up the ante?

What are businesses to do?

Solving the privacy dilemma online may be as simple as companies just acknowledging the truth, telling users more directly that "we are here to help connect you to other people and to help sell you things you may like". Today, most users do not find their online experience noticeably enhanced by the passive tracking that is widespread across websites. But they do value the personalisation provided by the likes of Netflix and Amazon. The difference is that these companies have made data use and personalisation a key part of the consumer experience. By shouting from the home page "we are using your information to help you find things you may want to buy", businesses may find that they solve privacy concerns while meeting business needs.

The use of ad labels and icons, such as the one that the Future of Privacy Forum has consumer tested and leading industry groups have adopted, is a serious step in this direction.

If businesses do not provide users with the transparency and control they want, users may not wait for new laws. They may simply take advantage of the tools that are increasingly available to just take control themselves.

 
 

UK's ICO Issues Code of Practice on Online Privacy

This month saw the launch of the ICO's first code of practice on online privacy, following extensive consultation earlier in the year. The code provides good practice advice for organisations providing goods and services using the web and explains how the Data Protection Act applies to the collection and use of personal data online.

The code is divided into the following 7 chapters, and also includes a helpful annex and glossary of terms, for those less familiar with online jargon. You can read on to see our summarised highlights of the code, but we also recommend reading the full guidance document on the ICO website, through the link provided above. It should be of particular interest to businesses engaged in behavioural advertising, online sales and cloud computing.

 

Continue Reading...

FCC Releases National Broadband Plan, Promotes Consumer Control Over Personal Information

The Federal Communications Commission released its long-awaited National Broadband Plan today, providing an aggressive roadmap for advancing affordable broadband deployment and adoption; stimulating economic growth; and boosting the nation's capabilities in education, healthcare, homeland security, and other areas.  The Plan also appears to confirm that the FCC is looking to take an expanded role in privacy-related consumer protection issues.

In the Plan, the FCC discusses a number of broadband privacy and data security issues focused on the protection of and consumer control over personal information.  For example, the FCC states 

 

[t]he collection, aggregation and analysis of personal information are common threads among, and enablers of, many application-related innovations...

 

and the Plan notes the value of services such as customized suggestions for movie rentals or books and more targeted and relevant advertising.  It cautions, however

 

many users are increasingly concerned about their lack of control over sensitive personal data.

 

The FCC then remarks:  

 

Innovation will suffer if a lack of trust exists between users and the entities with which they interact over the Internet.  Policies therefore must reflect consumers’ desire to protect sensitive data and to control dissemination and use of what has become essentially their “digital identity.”  Ensuring customer control of personal data and digital profiles can help address privacy concerns and foster innovation.

The FCC also makes several broadband privacy and data security recommendations in the Plan, including:

  • Encouraging Congress and the Federal Trade Commission (as well as the FCC) to clarify the relationship between users and their online profiles, including disclosure and consent requirements and data collection, sharing, storage, safeguarding, and accountability responsibilities;
  • Suggesting that Congress consider helping spur the development of trusted "identity providers" that can help consumers maximize the privacy and security of their data;
  • Having the FTC and FCC jointly develop principles to require that customers provide informed consent before broadband service providers share certain information with third parties (including account and usage information and other personally identifiable information); and
  • Prompting the federal government to put additional resources into combating identity theft and fraud and enhancing consumer online security.

In addition, the Plan includes several privacy and data security recommendations in the smart grid and cybersecurity areas, including a recommendation that states require utilities to "provide consumers access to, and control of, their own digital energy information, including real-time information from smart meters and historical consumption, price and bill data over the Internet."  If states fail to do so within 18 months, the Plan recommends that Congress consider national legislation.

Media & Communications Briefing Highlights Privacy Issues

The fifth edition of Hogan & Hartson’s Media & Communications Briefing, whose editor-in-chief is Hogan Partner Winston Maxwell , has arrived!  (Winston also is a member of the privacy and data security practice group.) This quarterly briefing updates our clients on legal and regulatory developments from around in the world in the Telecommunications, Media and Entertainment and High Technology sectors.  This edition features stories (bolded below) of particular privacy interest. 

The briefing includes articles on the following topics:

  • New Commission, New Framework
  • The Digital Dividend Auction in Germany
  • Bloggers Beware: The FTC is Watching
  • EU Reform Brings New Cookie Rules
  • U.S. Universal Service Reform: Is 2010 the Year?
  • Online Music Retailing: Towards Borderless Business
  • French Government Releases Decree on Motion Picture Tax Credit
  • Smart Grids
  • Interview: French Copyright Law
  • Digital Switchover
  • Middle East International Film Festival and the Circle Conference

For a copy of the briefing, click here

FCC Seeks Comment on Numerous Broadband Privacy Issues

The Federal Communications Commission released a Public Notice this week seeking further comment on numerous privacy issues as part of its National Broadband Plan proceeding.  Based on questions raised in a recent Center for Democracy & Technology filing, some of the broad issues that the Notice seeks comment on include:

  • Consumer expectations of privacy, and how to meet those expectations as new technologies are deployed;
  • Building Privacy by Design;
  • Concerns surrounding the collection, use, and storage of transactional data; and
  • The regulation of third-party applications.

The FCC, which is working to complete the Plan and submit it to Congress by March 17, has thus far not focused extensively on how to protect consumer privacy and personal information in the broadband ecosystem.  This Notice, however, indicates that the FCC may be planning to highlight a number of privacy-related consumer protection issues in the Plan.  Moreover, depending in part on the comments received in response to the Notice, it could also open the door to future privacy and data protection proceedings at the FCC.

Comments are due on January 22, 2010, just over a week after the Commission issued the Notice.

FTC Issues Guidance on Blogging-for-Pay, Testimonial Disclaimers, and Celebrity Endorsements in First Revision of Endorsement Guides in 29 Years

We have distributed a Hogan & Hartson Privacy Update on the FTC's October 5 revisions to its Guides Concerning the Use of Endorsements and Testimonials in Advertising, the first modifications to these key advertising guidelines since 1980.  While the Guides are advisory in nature, they reflect situations in which the FTC may exercise its prosecutorial discretion to enforce Section 5 of the FTC Act, which prohibits unfair and deceptive trade practices.

Key among the revisions is the guideline that bloggers and other Internet users who are compensated to endorse products must disclose this connection in their endorsement, and both the blogger and advertiser are responsible that factual claims about the product made by the blogger are substantiated.  Another key provision states that advertisers, when using an endorser whose experience does not reflect generally expected results when using the product, should issue a clear disclaimer communicating the generally expected results, departing from earlier enforcement policy that allowed advertisers to simply display a disclaimer stating that the endorser's results were not typical.  The FTC also added many examples to guide advertisers in their use of endorsers.

The update can be accessed here.

Eye-Spy: CCTV on the Internet

It sounds like an ‘April fool,’ but the story this week that people can sign up to a new internet game where they spot crimes on CCTV cameras posted in Britain and earn points for doing so might actually be true.  Both the Daily Mail and the Guardian’s online news pages featured stories about this bizarre game, which may be launched in November 2009 following a trial in Stratford-upon-Avon.

Customers have the opportunity to sign up to the service and have their CCTV monitored by the public in return for a fee.  Footage from the camera would be streamed on to a website to be used in the game.  Shopkeepers are an obvious target market for the service, but the police, local authorities and home owners may also be encouraged to sign up.

According to press releases, the service provider ‘Internet Eyes,’ offers users (players of the game) the chance to “earn reward money, have a chance at reducing crime, potentially become a hero and save lives.”  Users would compete to earn up to £1,000 per month, collecting points for viewing live CCTV footage and pressing a button whenever they see any suspicious activity.  If and when a crime is suspected, these alerts will be sent, by SMS, to the customer, in real-time, allowing them to take immediate action, or no action, as they wish.  Apparently it is possible to lose points for a false alarm and a ‘3 strikes and you’re out’ rule will apply.

The website also promises to feature a so-called ‘rogue’s gallery’ of ‘criminals,’ with details of their offenses and details of the user responsible for spotting them.

Internet Eyes says its service aims to reduce crime, but civil liberties campaigners and the assistant information commissioner have their doubts about the legality of the idea itself.  Disclosing images of identifiable individuals on the internet for entertainment raises serious issues under the Data Protection Act and the Human Rights Act.  The Guardian reports that the ICO will be ‘talking to’ Internet Eyes shortly.  Watch this space!