White House Report May Have Long-Term Effect on Consumer Privacy and How Companies Do Business

Transcription

1 White House Report May Have Long-Term Effect on Consumer Privacy and How Companies Do Business April 10, 2012 Boston Brussels Chicago Düsseldorf Houston London Los Angeles Miami Milan Munich New York Orange County Paris Rome Silicon Valley Washington, D.C. Strategic alliance with MWE China Law Offices (Shanghai)

2 A recent White House report on consumer data privacy forecasts a multifaceted approach to fulfilling public expectations regarding the protection of consumer s personal information. Although it is uncertain if the report will result in new legislation in the near future, the report could have long-term implications for the current regulatory landscape. In February 2012 the White House released a report detailing the current administration s position on consumer privacy, entitled Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy. Although it is uncertain if the report will result in new privacy legislation in the near term, the report may still have long-term implications for the current regulatory landscape. As explained in the report s Executive Summary, the consumer privacy framework proposed by the administration consists of four key elements: (1) a Consumer Privacy Bill of Rights; (2) a multistakeholder process to specify how the principles in the Consumer Privacy Bill of Rights apply in particular business contexts; (3) effective enforcement; and (4) a commitment to increase interoperability with the privacy frameworks of international partners. 1 Below we examine each of these elements. 1. Consumer Privacy Bill of Rights Building upon Fair Information Practice Principles that were first promulgated by the U.S. Department of Health, Education, and Welfare in the 1970s, the Consumer Privacy Bill of Rights is intended to affirm consumer expectations with regard to how companies handle personal data. 2 Although the administration recognizes consumers have certain responsibilities to protect their own privacy, it also emphasizes the importance of using personal data in a manner consistent with the context in which it is collected. In a press release accompanying the release of the report, the White House summarized the basic tenets of the Consumer Privacy Bill of Rights 3 : Transparency Consumers have a right to easily understandable information about privacy and security practices. Respect for Context Consumers have a right to expect that organizations will collect, use and disclose personal data in ways that are consistent with the context in which consumers provide the data. 4 Security Consumers have a right to secure and responsible handling of personal data. Access and Accuracy Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data are inaccurate. Focused Collection Consumers have a right to reasonable limits on the personal data that companies collect and retain. Accountability Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights. 1 Report at 1. 2 Although businesses are also consumers, the report appears to focus on protecting individuals personally identifiable information. 3 We Can t Wait: Obama Administration Unveils Blueprint for a Privacy Bill of Rights to Protect Consumers Online, February 23, 2012, Office of the Press Secretary. 4 To illustrate the context principle, the report provides the example of a hypothetical social networking provider. Users expect that certain biographical information will be collected in order to improve the service; however, if the provider sells the same biographical information to an information broker for advertising purposes, that use is more attenuated from users expectations. Therefore, the latter use is not consistent with the context in which the biographical information was provided

3 The outline for the Consumer Privacy Bill of Rights is largely aspirational, in that it does not create any enforceable obligations. Instead, the framework simply creates suggested guidelines for companies that collect personal data as a primary, or even ancillary, function of their business operations. As the administration recognizes, in the absence of legislation these are only general principles that afford companies discretion in how they implement them. 5 Nevertheless, as consumers become more invested in how their personal information is used, a company that disregards the basic tenets of the Consumer Privacy Bill of Rights may be doing so at its own peril. Although the Consumer Privacy Bill of Rights has not been codified, companies should expect that some iteration of the same principles will ultimately be legislated, or voluntarily adopted by enough industry leaders to render them enforceable by the FTC. Therefore, companies would be welladvised to make sure they have coherent privacy policies in place now in order to avoid running afoul of guidelines imposed by whatever regulatory framework is implemented later. 2. The Multistakeholder Process to Develop Enforceable Codes of Conduct The report also encourages stakeholders described by the Administration as companies, industry groups, privacy advocates, consumer groups, crime victims, academics, international partners, State Attorneys General, Federal civil and criminal law enforcement representatives, and other relevant groups to cooperate in the development of rules implementing the principles outlined in the Consumer Privacy Bill of Rights. Of all the elements comprising the administration s consumer privacy framework, it is this multistakeholder process that will likely see the most activity in coming months. The report identifies several benefits attributable to this approach 6 : First, an open process reflects the character of the internet itself as an open, decentralized, user-driven platform for communication, innovation and economic growth. Second, participation of multiple stakeholders encourages flexibility, speed and creativity. Third, this approach is likely to produce solutions in a more timely fashion than regulatory processes and treaty-based organizations. Finally, the multistakeholder process allows experts to focus on specific challenges, rather than relying upon centralized authority. The report contemplates that the multistakeholder process will be moderated by the U.S. Department of Commerce s National Telecommunications and Information Administration (NTIA), a view echoed by the press release accompanying the report. 7 This process will likely present companies whose operations involve the collection of consumer data online a rapidly expanding category that encompasses far more than just internet businesses with an opportunity to shape future internet privacy legislation. NTIA has already initiated the conversation through the issuance of a Request for Public Comments on the administration s consumer privacy framework. 8 NTIA has suggested the first topic for discussion should be a discrete issue that allows consumers and businesses to engage [in] and conclude multistakeholder discussions in a reasonable timeframe. 9 As one example, NTIA has suggested stakeholders discuss how the Consumer Privacy Bill of Rights transparency principle should be applied to privacy notices for mobile applications. When one considers that by some estimates the revenue generated by the mobile application market is expected to reach $25 billion over the next four years, it is clear that even this discrete issue alone could result in a significant regulatory impact Effective Enforcement The report further suggests that the Federal Trade Commission (FTC) will play a vital role in the enforcement of the consumer privacy protections outlined by the administration and developed during the multistakeholder process. The 5 Report at 2. 6 Report at We Can t Wait, February 23, 2012, Office of the Press Secretary ( In the coming weeks, the Commerce Department s National Telecommunications and Information Administration will convene stakeholders. ). 8 Docket No , February 29, Moving Forward with the Consumer Privacy Bill of Rights, Lawrence E. Strickling, Assistant Secretary for Communications and Information, February 29, According to Markets & Markets, a market research company and consulting firm

4 administration admits, however, that in the absence of new legislation, the FTC s authority in the area of consumer privacy may be limited to the enforcement of guidelines adopted by companies voluntarily. According to the administration, enforcement actions by the FTC (and State Attorneys General) have established that companies failures to adhere to voluntary privacy commitments, such as those stated in privacy policies, are actionable under the FTC Act s (and State analogues) prohibition on unfair or deceptive acts or practices. 11 Therefore, in the administration s view, the guidelines developed during the multistakeholder process would be enforceable under the existing statutory framework. In light of the current election cycle and the resulting political landscape, it seems unlikely Congress will pass new consumer privacy legislation in the near term. Nevertheless, companies should remain mindful that the FTC and even state Attorneys General may become more aggressive in addressing flagrant violations of consumers privacy expectations. For instance, California s Attorney General has explained that her office intends to enforce an agreement that California reached with Apple and other industry leaders earlier this year. The agreement would require developers of mobile applications to post conspicuous privacy policies that explain how users personal information is gathered and used. Moreover, the increased attention directed at privacy issues by consumer groups and the public at large suggests an inevitable groundswell of support for new privacy legislation. As Jon Leibowitz, the chairman of the FTC, explained earlier this week, we could see new privacy legislation early in the term of the next Congress A Commitment to Increased Operability Recognizing that other countries have taken different approaches to data privacy issues, the report also encourages the development of interoperability with regulatory regimes implemented internationally. The administration has suggested a three-pronged approach to achieving increased operability: mutual recognition, development of codes of conduct through multistakeholder processes and enforcement cooperation. With respect to mutual recognition, the report identifies existing examples of transnational cooperation in the privacy context. For example, it cites the Asia-Pacific Economic Cooperation s voluntary system of Cross Border Privacy Rules and also the European Union s Data Protection Directive. It appears that the administration, at least for now, will depend upon companies voluntary adoption of these international frameworks. Just as the administration will rely upon the multistakeholder process to develop domestic codes of conduct, it will adopt the same approach to developing globally applicable rules and guidelines. Although the administration contemplates this process will be directed by the U.S. Departments of Commerce and State, the report does not provide any details. Finally, the report explains the FTC will spearhead the U. S. Government s efforts to cooperate with the FTC s foreign counterparts in the development of privacy enforcement priorities, sharing of best practices, and support for joint enforcement initiatives. 13 * * * In sum, the White House report on consumer data privacy forecasts a multifaceted approach to fulfilling public expectations regarding the protection of consumer s personal information. Although the report is necessarily scant on details regarding the implementation of new legislation, it nevertheless portends future developments that will have a profound effect on how a broad range of companies do business. McDermott s Global Privacy and Data Protection Group will continue to monitor developments in this and other related areas. 11 Report at U.S. Agency Seeks Tougher Consumer Privacy Rules, The New York Times, March 26, Report at

5 For more information, please contact your regular McDermott lawyer, or: Jason Casero: Heather Egan Sussman: Jennifer Geetter: For more information about McDermott Will & Emery visit The material in this publication may not be reproduced, in whole or part without acknowledgement of its source and copyright. White House Report May Have Long- Term Effect on Consumer Privacy and How Companies Do Business is intended to provide information of general interest in a summary manner and should not be construed as individual legal advice. Readers should consult with their McDermott Will & Emery lawyer or other professional counsel before acting on the information contained in this publication McDermott Will & Emery. The following legal entities are collectively referred to as "McDermott Will & Emery," "McDermott" or "the Firm": McDermott Will & Emery LLP, McDermott Will & Emery AARPI, McDermott Will & Emery Belgium LLP, McDermott Will & Emery Rechtsanwälte Steuerberater LLP, MWE Steuerberatungsgesellschaft mbh, McDermott Will & Emery Studio Legale Associato and McDermott Will & Emery UK LLP. These entities coordinate their activities through service agreements. McDermott has a strategic alliance with MWE China Law Offices, a separate law firm. This communication may be considered attorney advertising. Prior results do not guarantee a similar outcome