FTC Wants More Regulatory Authority to Police Internet Privacy

(July 22, 1998)  FTC Chairman Robert Pitofsky testified Tuesday before the House Telecommunications Subcommittee that the Congress should enact legislation giving it power to regulate and enforce Internet privacy, if the industry has not begun adequate self regulation by January 1, 1999.

Rep. Billy Tauzin (R-LA), who presided at the hearing, stated: "If privacy is the number one consumer issue with respect to engaging in electronic commerce, then it is critical to the future success of the medium to strike the right balance between protecting the right to privacy and supporting the development of commerce over the net."

The FTC and its officials have been active in issuing reports, staging press conferences, testifying to Congressional committees, and forming alliances with interest groups and trade organizations, not only on privacy issues, but also regarding Internet fraud and unsolicited commercial bulk e-mail, in an effort to expand its regulatory authority over the Internet.

All four members of the Federal Trade Commission appeared at yesterday's hearing, and testified: Chairman Robert Pitofsky, Orson Swindle, Sheila Anthony, and Mozelle Thompson.

However, some committee members expressed opposition to further government regulation.   Rep. Tom Bliley (R-VA), the Chairman of the House Commerce Committee, stated that: "Poll after poll show that online users are concerned about the amount of information being gathered and collected on the Internet, and then how that information is being used."  But, he continued that, "I think many of my colleagues would agree that we should allow industry the opportunity to develop a self regulatory model for protecting personal privacy.   Industry has an obvious interest in making sure that their customers feel comfortable shopping or browsing their websites."

Bliley concluded that "the FTC will be recommending some proposed legislation to establish privacy standards for all Internet users.  ...  Ultimately, however, I believe that the private sector needs to establish leadership in developing strong and easy to understand privacy protections."

Pitofsky testified to the Committee, and submitted a written Testimony on behalf of the FTC.  He stated that "the Commission has been committed consistently to the proposition that industry self regulation in this area is preferable to a detailed legislative mandate.   However, when the Commission surfed the net last March to determine levels of self regulation, we found that self regulation, so long promised, was quite disappointing."  He continued that, "if effective industry regulation is achieved, we can only applaud.  But if it does not work out, we believe that Congress should seriously consider legislation."  He proposed January 1, 1999, as a deadline.

His prepared Testimony also outlined what such legislation should look like.  "We believe any Internet privacy statute should incorporate the following four basic information practices."

(1) notice/awareness -- Web sites would be required to provide consumers notice of their information practices, i.e., what information they collect and how they use it;

(2) choice/consent -- Web sites would be required to offer consumers choices as to how that information is used beyond the use for which the information was provided (e.g., to consummate a transaction);

 

(3) access/participation -- Web sites would be required to offer consumers reasonable access to that information and an opportunity to correct inaccuracies; and

 

(4) security/integrity -- Web sites would be required to take reasonable steps to protect the security and integrity of that information.

Pitofsky also recommended more stringent legislation dealing with children's websites.  He proposed that legislation requiring "commercial Web sites that collect personal identifying information from children 12 and under to provide actual notice to the parent and obtain parental consent as follows.

(1) Where the personal identifying information would enable someone to contact a child offline or where the personal identifying information is publicly posted or disclosed to third parties, the site would be required to obtain prior parental consent (opt-in).

 

(2) Where collection of an e-mail address is necessary for a child's participation at a site, such as to notify contest winners, and is not posted or disclosed to third parties, the site would be required to provide notice to parents and an opportunity to remove the e-mail address from the site's database (opt-out)."

Rep. Tauzin expressed some skepticism.  "What we often hear is that the role of government is to provide the back stop against the bad players.  ...  Fly by night operators, which are the excuse for massive federal regulatory regimes, and state regulatory regimes, sometimes encouraged by the industry providers, who want to lock out the small players.  And you have to careful in whatever model you design, that it does not create that effect: it doesn't lock out small entrepreneurs, small providers, who perhaps cannot afford to be part of some larger more expensive organizational structure."

Christine Varney also testified.  She represents Internet industry interests.  She is the head of the Internet practice group at the Washington mega law firm of Hogan & Hartson, and consultant to the Online Privacy Association.  The OPA is a large industry group which is trying to promote consumer confidence in electronic commerce through industry self regulation, and to head off government regulation.

Varney, who until recently was a FTC Commissioner, reviewed the ongoing efforts of the OPA.  She argued that businesses ought to be allowed to lead on this issue.  She also pointed out that the FTC already has regulatory authority in this area.   If a website announced a privacy policy, and then violated it, the FTC could prosecute it under existing law for a deceptive practice.

The Members who participated in all or part of the hearing included, Billy Tauzin (R-LA), Tom Bliley (R-VA), Brian Bilbray (D-CA), Mike Oxley (R-OH), Bart Gordon (D-TN), Tom Sawyer (D-OH), and Al Wynn (D-MD).