FTC: Congress should regulate online privacy

In a long-awaited report on online privacy released Monday, the Federal Trade Commission (FTC) urged Congress to enact legislation to protect consumers’ information.

The FTC said Congress should regulate “data brokers” — groups that buy and sell personal data — and said consumers should be able to access the information that brokers collect on them.

{mosads}The report recommends that Congress require companies to meet minimum standards for how they handle sensitive data, and says lawmakers should ensure that customers are notified if their information is stolen in a data breach.

Although many states already require data breach notifications, there is no national standard.

The FTC also outlined voluntary standards that companies should adopt to protect users’ privacy. 

The agency said it would work with Web browsers and advertising agencies to implement a “Do Not Track” button that would allow users to opt-out of online tracking.

“We are confident that consumers will have an easy to use and effective Do Not Track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don’t,” FTC Chairman Jon Leibowitz said.

The FTC first proposed a Do Not Track button in its draft privacy report, which was released more than a year ago.

The FTC report urges cellphone and mobile application companies to develop “short, meaningful” disclosures about privacy. FTC officials will host a workshop on May 30 to discuss how companies can disclose their privacy policies in way that is easy to read on cellphone screens. The commission said it hopes the workshop will spur companies to adopt self-regulations to govern mobile privacy.

The agency plans to host a workshop later this year on tracking by “large platform providers,” such as Internet service providers, operating systems, browsers and social media companies, which all have access to the personal information of millions of users. 

The FTC plans to work with the Commerce Department and companies to develop codes of conduct tailored to specific industries. Although the FTC cannot force companies to adopt the privacy standards, the agency does have the power to sue companies that promise to abide by the rules and then violate them.

“The Commission will also continue to enforce the FTC Act to take action against companies that engage in unfair or deceptive practices, including the failure to abide by self regulatory programs they join,” the commission said in the report.

The FTC report is more specific and detailed than privacy recommendations released by the White House earlier this year.

The White House report, dubbed a “Privacy Bill of Rights,” included broad declarations about how companies should protect consumers’ privacy. 

Advocates of tough privacy regulations argue that consumers will spend more money online if they feel secure about how their information will be used. But tough regulations could cut into the profits of Web giants including Facebook and Google, which rely on targeted advertising to be able to offer their services for free.

The FTC, under Leibowitz, has made privacy protection one of its top priorities. Last year, the FTC brought charges against both Google and Facebook for allegedly violating their own privacy policies.

The Software & Information Industry Association “welcomed” the FTC report for clarifying its policies on privacy, but said legislation is unnecessary.

“This clarification is especially important because of the FTC’s substantial authority to bring cases against the companies it claims are in violation of its policies,” Ken Wasch, the association’s president, said in a statement. “SIIA has long supported a collaborative, public-private approach as the best way to ensure consumer privacy, and we cannot endorse the report’s call for new legislation. In light of the FTC’s substantial authority in this area, we do not believe there is a need for new privacy legislation.”

But the American Civil Liberties Union said the report “underscores” the need for more regulation to protect privacy.

“As we live more of our lives online, we need bright-line protections and standards safeguarding our most personal information,” ACLU legislative counsel Christopher Calabrese said.

“Since the FTC can’t act on its own, it’s clearer than ever that Congress needs to act.”