FTC Opposes Online Privacy Legislation

(July 13, 1999) The Federal Trade Commission released a report which concludes that "legislation to address online privacy is not appropriate at this time." It states that online companies have made progress towards self-regulation, as evidenced by new surveys showing increased adoption of privacy policies, and use of online seal programs.

The Federal Trade Commission report, titled "Self Regulation and Privacy Online," was released on Tuesday, July 13, 1999. It concludes that "self-regulation is the least intrusive and most efficient means to ensure fair information practices online, given the rapidly evolving nature of the Internet and computer technology."

The FTC issued a similar report in June of 1998, which recommended against general online privacy legislation. The 1998 report articulated four substantive "fair information practice principles." The four principles to guide web sites are:

• notice/awareness (provide consumers notice of their information practices: what information they collect and how they use it)
• choice/consent (offer consumers choices as to how that information is used)
• access/participation (offer consumers reasonable access to that information and an opportunity to correct inaccuracies)
• security/integrity (take reasonable steps to protect the security and integrity of that information)

The report just released assesses the progress made in self-regulation to protect consumers' online privacy since last June and sets out an agenda of Commission actions in the coming year to encourage industry's full implementation of online privacy protections.

The report was prepared for the Congress, and presented at a hearing of the House Commerce Committee's Telecommunications Subcommittee on July 13. Several Congressional Committees have held many hearing on the topic of online privacy. However, other than a statute regulating the collection of information from children on the web (Children's Online Privacy Protection Act), passed late last year, Congress has passed no online privacy bills.

However, there are currently numerous bills pending in the Congress that address online privacy. For example, Rep. Rick Boucher (D-VA) and Rep. Bob Goodlatte (R-VA) are cosponsoring HR 1685 IH, the Internet Growth and Development Act. This bill would require that "Any person operating a commercial Internet website shall clearly and conspicuously provide notice of its collection, use, and disclosure policies with regard to personally identifiable information nation ..."

Sen. Conrad Burns (R-MT) and Sen. Ron Wyden (D-OR) are sponsoring a bill in the Senate, S 809, the Online Privacy Protection Act. Rep. Edward Markey (D-MA) is likely to soon introduce a very demanding bill.

FTC Chairman Robert Pitofsky

The FTC report relied on a survey conducted by the FTC for its 1998 study, which found that only 14% of web sites post any disclosure regarding information practices, as well as two more recent surveys. These two new industry funded surveys of commercial web sites suggest that online businesses are providing significantly more notice of their information practices than they were last year.

64% of the sites in the Georgetown Internet Privacy Policy Survey post at least one disclosure about their information practices. 44% percent of these sites post privacy policy notices. 93% of the sites in the recent study commissioned by the Online Privacy Alliance provide at least one disclosure about their information practices.

The report also found that industry efforts towards self regulation is evident in the development of online seal programs, such as TRUSTe and BBBOnLine. TRUSTe, launched nearly two years ago, currently has more than 500 licensees. BBBOnLine, a subsidiary of the Council of Better Business Bureaus, which launched its privacy seal program for online businesses last March, currently has 42 licensees and more than 300 applications for licenses.

The report then concludes, at the bottom of page 14, that legislation is not now needed.

"Based on these facts, the Commission believes that legislation to address online privacy is not appropriate at this time. We also believe that industry faces some substantial challenges. Specifically, the present challenge is to educate those companies which still do not understand the importance of consumer privacy and to create incentives for further progress toward effective, widespread implementation."

The report was approved by all four members of the Federal Trade Commission: Robert Pitofsky, Orson Swindle, Sheila Anthony, and Mozelle Thompson. However, there was some dissention among the members.

Sheila Anthony also wrote a separate statement, concurring in part, and dissenting in part. She wrote "that the time may be right for federal legislation." In contrast, Orson Swindle wrote a separate opinion in which he argued that the online industry has made more progress than the report suggests.

Commissioner Anthony, who comes from Hope, Arkansas, is more inclined towards government regulation than the rest of the Commission. She wrote: "I disagree with the majority's opinion that 'legislation to address online privacy is not appropriate at this time.' As a whole, industry progress has been far too slow since the Commission first began encouraging the adoption of voluntary fair information practices in 1996.

She continued that "Notice, while an essential first step, is not enough if the privacy practices themselves are toothless. I believe that the time may be right for federal legislation to establish at least baseline minimum standards. I note that bipartisan bills are pending in both the House and the Senate and could provide a good starting point for crafting balanced protective legislation. I am concerned that the absence of effective privacy protections will undermine consumer confidence and hinder the advancement of electronic commerce and trade."

Orson Swindle, a Republican, is usually the member of the Commission most opposed to government regulation or intervention in the marketplace. He is satisfied with industry's effort to protect online privacy. He concurred with the report's conclusion that no legislation is needed at this time. However, he criticized three aspects of the report.

He objected to burying the recommendation against legislation at the end of the report. He thought it should have been "front and center."

He also objected that "the dated and unfavorable results of the 1998 FTC Study are prominently described in the first seven pages of the Report, while the current and favorable results of the 1999 Georgetown survey are relegated to a brief discussion in the middle of the Report. Thus, the Report does not present a clear and complete picture of the substantial progress industry has made in the past year."

He also stated that was unfair for the report to emphasize industry failure to sufficiently implement all four elements of its "fair implementation practices," when the FTC only articulated these one year ago.

Swindle also stated that "the Report only sparingly mentions the leadership on privacy issues that IBM, Microsoft, Disney, AOL, The Direct Marketing Association, privacy seal organizations, and many others in the private sector have continuously demonstrated. Faint praises tend to be damning. Industry's leadership in achieving progress should be lauded not buried."

He concluded that "significant progress has been made, but continued vigilance is needed because we are not where we want to be. The way to get where we want to be is not through more laws and regulation. Rather, industry, privacy and consumer advocates, and the Commission should be able to make further progress by continuing to work hard and work together. In the event that our joint efforts do not produce results, I would caution industry that there are many eager and willing to regulate. If industry wants to have the freedom to adopt privacy policies in response to market incentives and not government regulation, I encourage industry to continue to lead the way."