---

Published: January 2010

Privacy and Fair Information Practices should guide FCC

Consumer Action and other consumer advocates sent comments to the Federal Communications Commission describing the collection and use of personal data by companies, problems with industry self-regulatory models, and principles and standards that should serve as the foundation of consumer privacy protection.

Below is an excerpt from the comments:

In these comments we will explain: (1) There are significant problems concerning the collection and use of personal data by companies, especially sensitive data and children’s data; (2) The FCC should not rely on industry self-regulatory models because they do not adequately protect consumer privacy; and (3) The principles and standards that should serve as the foundation of consumer privacy protection should be the Fair Information Practices, especially as they are implemented in the OECD Guidelines on data privacy. 

The issue of consumer privacy protection is vitally important. The FCC should consider all avenues it may use to protect consumers, including exercising its ancillary jurisdiction to address broadband privacy issues, and working with Congress and the Federal Trade Commission (“FTC”), which has substantial expertise in consumer privacy protection.

A. Consumers Remain Confused About Data Collection by Companies and Privacy Risks Inherent in Such Data Collection, Use and Distribution

Studies show that consumers are concerned about online privacy, eschewing intrusive data collection and sharing, and customer-profile creation, when they learn of such practices. However, most consumers do not know about these types of data collection and sharing, nor do they understand the privacy and security risks that are part of online commerce. And young consumers especially have difficulty understanding these risks, as children and adolescents are at a developmental disadvantage to give meaningful and informed consent to collection of their personal data. 

B. Widespread Personal Data Collection in Broadband and Mobile Industry Underscores Need for Strong Consumer Privacy Protections

The online advertising business has witnessed dramatic consolidation over the last several years; major interactive giants have combined with leading data targeting companies. Google now operates DoubleClick; Yahoo acquired Blue Lithium and Right Media; Microsoft bought aQuantive, Screen Tonic and ADECN; Time Warner’s AOL acquired Tacoda and Third Screen Media; and Adobe acquired Omniture. As a consequence of this consolidation, a handful of companies engaged in data collection that track, profile, and target users across Web sites, mobile applications, online games, virtual worlds, and search engines are playing an important role shaping the Internet’s future. Given the tremendous data collection capabilities inherent in digital marketing, and the growing concentration of influence by a few companies, there is a strong need for regulatory or legislative action to protect consumer privacy.

II. FCC Should Not Use Industry Self-Regulatory Models Because the Online Marketing Industry’s Practices Do Not Adequately Protect Consumer Privacy
The U.S. Interactive Advertising Bureau (“IAB”), the online marketing industry’s principal trade and lobbying group, has pointed to self-regulatory principles, released in July, which the online marketing industry says shows an effort to improve consumer privacy protection by following the FTC’s promulgated self-regulatory principles. However, for several reasons, these industry-imposed self-regulatory principles do little to protect consumer privacy.

A. Industry’s Self-Regulatory Principles Do Not Ensure Proper Protection of Consumer Privacy
The only change of note in the revised IAB self-regulatory principles seems to be an “enhanced notice” proposal. “Links to consumer notices will be clear, prominent, and conveniently located,” for any businesses that voluntarily follow these principles. Though we support improved transparency, this is not enough. The online marketing industry is merely providing an easier way for consumers to reach long and difficult-to-understand notices. Unless the notices are easier to understand, it will not matter if there are larger links to them on Web sites. Before any consumer data is collected, the users need to be candidly informed about the process – how their profile is created; how their profile evolves as more personal data is collected; how tracking and data gathering occurs site to site; and what data can be added to their profile from outside databases. 

B. Marketing Industry Hides Behind Cloak of “Anonymization,” but “Anonymized” Data Has Been Linked Back to Individuals
As we explained above, the online and mobile advertising industry has narrow definitions of “sensitive data” and “personally identifiable information,” which do not adequately encompass the reality of consumer data collection and consumer profile creations. “Personally identifiable information,” as defined by the advertising industry, is restricted to names, addresses, ID numbers, or other traditional personally identifiable information. 

III.  Fair Information Practices Should Be Foundation of FCC’s Standards for Consumer Privacy Protection
Privacy is a fundamental right in the United States. For four decades, the foundation of U.S. privacy policies has been based on the Fair Information Practices promulgated in 1973 by the U.S. Department of Health, Education and Welfare. As applied under the 1980 OECD Guidelines on data privacy, the Fair Information Practices include: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability.                                                                                                              

Lead Organization

Center for Digital Democracy

Other Organizations

The American Civil Liberties Union | Center for Digital Democracy | Consumer Federation of America | Consumer Watchdog | Privacy Lives | Privacy Rights Clearinghouse | Privacy Times | U.S. PIRG

Download PDF

No Download Available