Privacy Continues to Dominate the Agenda at Several Agencies and Congressional Committees; MPA Comments to Federal Trade Commission and Commerce Department on Publishers Uses of Data Both Online and Offline
Following major reports on privacy by the Federal Trade Commission (FTC) and the Department of Commerce – and hundreds of comments submitted to the agencies by interested parties, including MPA – the Senate and House Commerce committees are holding hearings and preparing legislation that could have a major impact on publishers’ data collection and use, both online and offline. With the Agencies’ recommendations expected to influence the hearings and legislative proposals, MPA submitted comments on both privacy reports – joint comments with other media and advertising trade associations to Commerce on January 31, and individual MPA comments to the FTC on February 18.
MPA’s comments on the FTC’s privacy report, “Protecting Consumer Privacy in an Era of Rapid Change”, supported the Commission’s recommendation for an exemption from notice and choice requirements for “commonly accepted practices”, including first party uses of data for marketing purposes. With respect to transfers of data to third parties, MPA suggested that data transfers for traditional offline and online marketing purposes are also commonly accepted and well understood, and that current notice and choice procedures provide the right balance between privacy protection and practical business realities.
First Party Marketing - The Commission’s important conclusion that choice need not be provided before collecting and using consumers’ data for commonly accepted first party marketing practices builds on the FTC’s earlier reports on Online Behavioral Advertising. In those reports, the FTC was careful to define behavioral advertising as limited to tracking of consumer activities across web sites and time – a structure that excludes “first party” behavioral advertising and targeting. As we have in previous comments on the matter, MPA voiced strong support for protecting first party uses of data both in the behavioral advertising and broader privacy arenas, as well as clear exemptions for contextual advertising on publishers’ web sites. Responding to related questions included in the most recent report, MPA reiterated our long-standing position that first party marketing should include affiliates as long as there is transparent notification regarding the relationship. We also suggested that the FTC consider publisher/advertiser cobranded sites to be first party sites and that database enhancement, a common practice for publishers, fits consumers’ expectations with respect to first party marketing and need not trigger a notice and choice requirement.
Transfers of Data to Third Parties - Since the FTC’s proposed privacy regime would apply to both offline and online data collection and use, MPA discussed both in its comments with regard to third party transfers of data. MPA pointed out possible problems for publishers with the Commission’s recommendation that choice should be provided at such time when a consumer is making the decision about providing their data. For offline subscriptions, which may be sold through the use of blow in cards, providing notice and choice on that limited piece of “real estate” is not realistic. We suggested that notice and choice could be provided with greater clarity in a subsequent communication with the subscriber. We also pointed out that customary uses of consumer data offline, such as for list rental, are well understood and accepted by subscribers, as are our well established choice mechanisms – offline, opt-out information is generally included in a prominent location in the magazine, and online, opt-out information is included in our privacy policies.
In contrast to the detailed nature of the FTC privacy report and our magazine media-specific comments filed in response, the Department of Commerce’s privacy report was more general and preliminary. As such, MPA responded to the Commerce Department Green Paper through coalition comments, signed on to by thirteen advertising and media associations. Commerce’s main recommendation was for a privacy approach relying on Fair Information Practice Principles (FIPPS). The Coalition agreed that a FIPPS based approach is useful for companies to analyze their privacy practices, but that such an approach should not be mandated on a legislative or regulatory basis. As an example, the comments pointed out that mandatory data access and correction standards are unnecessary for data collected and maintained for marketing purposes since there is no harm to the consumer if data is wrong. The one area where the coalition comments suggested governmental intervention could be appropriate is in the area of data security. The comments noted general industry support for a national standard for notifications following security breaches involving personal information. This would reconcile the current patchwork of inconsistent state laws.
Following the Agency reports and comments, activity has shifted to Congress, where the Senate Commerce Committee held the first in a planned series of hearings on March 16. Witnesses included FTC Chairman Leibowitz, Commerce Assistant Secretary for Communications and Information Lawrence Strickling, Microsoft General Counsel Erich Andersen, and ACLU Legislative Counsel Chris Calabrese. Touching on the FTC’s much-discussed “Do-Not-Track” proposal, Chairman Leibowitz said that any regulatory or self-regulatory opt-out system for behavioral advertising would need to incorporate five principles: (1) universal implementation; (2) be easy to find and easy to use; (3) be a persistent choice; (4) provide an opt out of tracking, not just advertising; and (5) be effective and enforceable without loopholes. With regard to persistent choice, Chairman Leibowitz mentioned a recent FTC enforcement action and agreement with Chitka, a behavioral advertising ad network. Leibowitz explained that unbeknownst to users, Chitka’s opt-out choice expired after 10 days. Under the terms of the settlement agreement, Chitka is now required to maintain opt-outs for at least five years. Strickling’s testimony was notable in that he asked Congress on behalf of the Administration to enact legislation setting forth a “consumer privacy bill of rights” consisting of a comprehensive set of FIPPS. He suggested legislation should also provide the FTC with authority to enforce the FIPPS and to provide incentives for self-regulation by offering safe harbors. No date has been set for the next hearing.
In other Congressional action, in the Senate, Sen. John Kerry (D-MA) is close to introducing a broad privacy bill for which he is seeking bipartisan support from Sen. John McCain (R-AZ), and highlighting the interest in the issue, the Senate Judiciary Committee has created a subcommittee on Privacy, Technology and the Law, led by Sen. Al Franken (D-MN) and Sen. Tom Coburn (R-OK). In the House, Rep. Cliff Stearns (R-FL) is working on a privacy bill that may be introduced this month and Rep. Mary Bono Mack (R-CA), Chairman of the Subcommittee on Commerce, Manufacturing and Trade, is expected to hold a hearing on the issue in May or June. On the minority side, Rep. Jackie Speier (D-CA) has introduced a do-not-track bill and Rep. Bobby Rush (D-IL) has introduced an opt-in behavioral advertising bill.