“The release of a Consumer Online Privacy Bill of Rights is a positive move and we think the bar has been raised for companies, asking them to make consumers’ privacy expectations a part of their everyday business practices,” said Michelle De Mooy, Consumer Action’s Senior Associate for National Priorities. “We are also very encouraged by Commerce’s call for baseline privacy legislation to protect consumers’ privacy.”

Among other key recommendations, the report calls for the development of a multi-stakeholder process bringing together members of industry and civil society to develop voluntary codes of conduct for companies regarding online privacy. These codes would be administered through a Safe Harbor program and would be otherwise enforceable through the Federal Trade Commission.

“It’s absolutely critical to make sure the codes of conduct come from a process that is truly representative of all stakeholders, fair, transparent, and credible,” De Mooy said.

In order to help define Commerce’s recommendation for this process, Consumer Action, along with other leading advocates, developed baseline principles to guide the process and provide the multi-stakeholder process with the legitimacy it needs to succeed.

Protecting the online privacy of consumers is crucial to ensuring the availability, utility, and vitality of the Internet.  For any approach to privacy to be meaningful, it must reflect fair information practices, including mechanisms to assure accountability. 

Signatories to the baseline principles include the World Privacy Forum, American Civil Liberties Union, Center for Digital Democracy, Consumer Action, Consumer Federation of America, Consumers Union, Consumer Watchdog, Electronic Frontier Foundation, National Consumers League, Privacy Rights Clearinghouse and U.S. PIRG.

Download the principles here or read them below.

Principles for Multi-Stakeholder Process

Civil society groups believe that protecting the online privacy of consumers is crucial to ensuring the availability, utility, and vitality of the Internet. For any approach to privacy to be meaningful, it must reflect fair information practices, including mechanisms to assure accountability. The US Department of Commerce is proposing a multi-stakeholder process for developing better applications of privacy principles. For the multi-stakeholder process to succeed, it must be representative of all stakeholders and must operate under procedures that are fair, transparent, and credible.

We believe the following baseline principles will provide the multi-stakeholder process the legitimacy it needs to succeed.

Principles:

1. No multi-stakeholder process can succeed unless consumer representation is robust and reasonably balanced. Only consumer representatives can determine who speaks for consumers.

2. To the greatest extent practicable, the multi-stakeholder process should occur in the open with public sessions and public documents. All substantial decisions must be made in open sessions.

3. Any stakeholder may submit proposals and those proposals must be addressed and resolved within the consensus process.

4. Participants, but not necessarily observers, must specifically identify their employer and/or the group, industry, or organization whose interest they represent.

5. There must be a fair opportunity for public engagement at all levels of the stakeholder process. Stakeholders must be allowed to communicate with members of their communities about the multi-stakeholder process in any way that the stakeholders see fit, including use of electronic processes such as web sites, social media, and other methods.
6. The formal publication of any consensus document or decision must include dissenting views and statements.

7. Decisions must be based on a fair and broad consensus among stakeholders rather than a majority vote by participants. The process should seek to resolve issues through open discussion, balance, mutual respect for different interests, and consensus.

8. A multi-stakeholder process needs to be fully informed by stakeholders from civil society. As such, in person meetings may only be scheduled if adequate resources are made available to facilitate in person participation by civil society. Otherwise, meetings may only be conducted electronically to facilitate equal participation by all stakeholders. Meeting locations must be chosen with robust input from civil society stakeholders.

9. All stakeholders must receive a copy of a draft document at least ten days prior to consideration or presentation of the document at any level of the stakeholder process.

10. At the end of 12 months or at any other time, civil society participants may decide to reevaluate the multi-stakeholder process and make recommendations for changes in rules, procedures, or process.