The Federal Trade Commission (FTC) recently released its long-awaited final report, “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policy Makers” (the “Report”) after considering over 450 public comments submitted in response to its preliminary report released in December 2010. The Report is intended to serve as a best practices guide and a call to Congress to create baseline privacy legislation as well as legislation governing data brokers. The primary provisions of the Report remain the same as they were in the preliminary report and include: (1) Privacy by Design, (2) Simplified Choice, and (3) Greater Transparency.

The Three Focuses
Many of the principles set forth in the preliminary report are still present in the final Report. As stated above, the primary ideas set forth in the Report are (1) Privacy by Design, (2) Simplified Choice, and (3) Greater Transparency. For Privacy by Design, the FTC encourages companies to incorporate privacy considerations into their business structure and create comprehensive data management plans. For example, data protection considerations should be at the forefront of business discussions, including agreements with service providers, to ensure that each individual that interacts with consumer data is trained and aware of how the data must be collected, used, and stored. For Simplified Choice, companies should make it easier for consumers to choose how they want to share their information and for what purposes it can be used. This choice should be provided at a time and in a context in which consumers are making a decision about their data. Further, “opt-in” consent should be obtained prior to using data in a materially different manner than the purpose for which it was collected and in many instances where sensitive data is involved. The FTC is also encouraging the industry to develop a Do Not Track mechanism. For Greater Transparency, the FTC promotes shorter, clearer privacy policies and encourages companies to permit consumers to have reasonable access to stored data. This access would also apply to data brokers. Finally, the FTC encourages consumer education about commercial privacy practices.

Changes from 2010 Report to Final Report
In response to public comments, the commission made several changes to its earlier report. Primarily, however, it made changes to the scope of the proposed framework and the exception to the choice requirement for “commonly accepted practices.” First, the scope of the proposed framework set forth in the Report has been narrowed to alleviate the burden on small businesses. In the preliminary report, the scope covered all commercial entities that collect or use consumer data that can be reasonably linked to a specific consumer, computer, or other device. Now, the proposed framework does not apply to businesses that collect only non-sensitive data from fewer than 5,000 consumers in a year as long as those businesses are not sharing the data with third parties. In clarifying consumer data, the Report also addresses de-identification of information and the definition of “reasonably linked” to a consumer. The Report clarifies that data is not “reasonably linked” to a consumer where a company takes reasonable steps to de-identify the data, makes a public commitment not to try to re-identify the data, and contractually requires its service providers and individuals that receive the data from attempting to re-identify the data.

Second, the commission has traded its “commonly accepted practices” for a more context-specific approach. In the preliminary report, the FTC suggested five commonly accepted practices during which businesses would not be required to obtain consent from consumers to share their information. Those practices included “product fulfillment, internal operations, fraud prevention, legal compliance and public purpose, and first-party marketing.” Now, in response to public comments, and in line with the recent White House report, the FTC now encourages businesses to focus on the context of their interaction with consumers in determining whether or not notice and consent is required when collecting and using consumer data. This new context focus, however, often overlaps with the “commonly accepted practices.” For example, where a consumer orders goods from a website, it is understood that address information will be shared for product fulfillment. Therefore, the five commonly accepted practices still apply, but the new Report has broadened the language to provide additional flexibility and to include other areas where consent will not be required based on the context of the interaction.

FTC’s Current Focuses
While the proposed framework detailed in the Report is still considered best practices and optional where it has not been implemented by relevant laws, the FTC makes a commitment in the Report to press Congress and the industry to implement the framework. Specifically, within the three primary categories set forth above, the FTC has five primary focuses over the course of the next year, including:

1. Do Not Track. Do Not Track is a proposed mechanism that would permit consumers to choose what information is collected about them online and how that information is used. It primarily applies to third party marketing and the collection of consumer information across multiple websites as opposed to the use of cookies and marketing in a “first party” business relationship. While the FTC is pleased with some of the Do Not Track efforts that have been created in the industry, including the DAA’s advertising options icon that permit consumers to opt-out of tracking by online behavioral advertisers, it encourages industry groups to develop better Do Not Track mechanisms and makes a commitment to work with groups to create one. According to the FTC, an ideal Do Not Track Mechanism would (i) allow consumers to limit data collection, (ii) work on all websites, (iii) be easy to use, (iv) have staying power (i.e., not deleted by deleting cookies), and (v) be enforceable. If an appropriate mechanism is not created over the course of the year, the FTC will likely attempt to push Congress to step in.
    
2. Mobile. The mobile industry is an ever-evolving industry. The FTC is committed to ensuring that proper privacy disclosures are provided on mobile devices. To that end, the FTC is considering updating its “Dot Com Disclosure” Rules to better cover mobile devices and the advertising disclosures that must be provided on them.
    
3. Data Brokers. In its report, the FTC expressed concern regarding data brokers, companies that collect and compile consumer information online and offline despite the fact that most consumers do not realize that they exist or that they have access to their information. The Report encourages data brokers to become more transparent by identifying themselves and their data collection and use practices, as well as providing consumers with information about the rights they have to their data. One proposal involves the creation of a centralized website for data brokers. The FTC also calls on Congress to pass legislation governing the activities of data brokers.
    
4. Large Platform Providers. The FTC intends to explore how large platforms such as Internet Service Providers, operating systems, browsers, and social media platforms track and use consumer data and the privacy concerns inherent in that use.
    
5. Promoting Enforceable Self Regulatory Codes. As detailed in the White House report issued in February of this year, the FTC will be working with the Department of Commerce in multistakeholder processes to create codes of conduct for businesses to adhere to when dealing with consumer data. While the codes of conduct will not have the force of law, the FTC will use its power under the FTC Act take action against businesses that commit to abide by a code of conduct and do not honor that commitment. This is the same power that it uses to take action against companies that do not abide by the provisions of their own privacy policies. For more information about the White House report, please see our previous alert.

* * *

It should be noted that the Report does not set forth legal requirements. Instead, the measures set forth in the Report should be considered best practice. All businesses are encouraged to incorporate the framework set forth in the Report into their structure and privacy practices. For more information about the Report and best practices with respect to consumer information and data security, please contact the attorneys listed at right.