Feb. 29, 2012 – Google Privacy Policy Changing For Everyone: So What's Really Going To Happen?, Huffington Post

Privacy Update from Barcelona

I have just arrived in Barcelona for the Mobile World Congress.  More than 60,000 people focused on mobile technologies have converged at this annual event to hear and see the latest from carriers, device makers, platforms, app developers and more.  It is clear from the smart phones and tablets displayed on the show floor that the next generation of smart devices will be faster, more powerful and more integrated with consumers’ lives.  More than batteries or chips, our personal information is what truly powers these devices.  Our address books, location, network of friends, emails and text messages, when used wisely by these small computers, empower us to be smarter and to do more.  As additional sensors are added to capture new kinds of data and as the use of phones to make purchases spreads more widely, these machines will have more intimate data about us than any government or corporation ever did.

 

Who is the real custodian of these new rich data streams?  The ecosystem for the mobile consumer is quite complicated.  Mobile platforms, app developers, device makers, carriers, analytics companies, ad networks, social networks, chip companies and others are all part of the equation.  The battle between consumer tech titans like Google, Apple, Microsoft, Amazon and Facebook is being played out as each company seeks to link consumer identity and data across smartphones, desktops, search engines, email, social networks, ad networks, payment systems  and more.  Google’s privacy policy consolidation slated to become effective in a few days has captured the lion’s share of attention, but it is Apple that has been the most effective at linking consumer data across every aspect of its services.   European regulators have proposed a privacy law that seeks to put the data genie back in his bottle, but consumers have voted by expressing delight in Steve Jobs vision by making Apple the most valuable company in the world.  Yet at the same time, consumers continue to express alarm at the misbehavior of apps that grab too much information and many regularly clear cookies in the hope of protecting their privacy.

 

How can it be that consumers deeply love the brands that privacy critics single out for criticism?  Although Google now trails Apple in some measures of brand value, it too continues to be one of the handful of globally respected consumer brands.   Do the regulators and privacy advocates know something that consumers don’t?  Or do consumers value the benefits of these technologies and willingly make the privacy trade-off? I am looking forward to discussing this and more at my panel tomorrow.

— Jules Polonetsky

White House Announces New Privacy Framework Including Consumer Privacy Bill of Rights

Yesterday, the White House released its long-awaited Privacy “White Paper” that outlines the Obama Administration’s proposal for a new American privacy framework.  The more than year-long process that culminated in today’s release of the White Paper began in December 2010 when the Department of Commerce’s Internet Policy Task Force released a “Green Paper” entitled:  “Commercial Data Privacy and Innovation in the Internet Economy:  A Dynamic Policy Framework.”

 

The Internet Policy Task Force utilized a multi-stakeholder approach to create the policy paper, consulting with “stakeholders in industry, civil society, academia, and government” during the drafting process, as well as considering the numerous written responses it received pursuant to the publication of the Privacy and Innovation Notice of Inquiry.  The drafters stated that the majority of the written responses they received indicated that there is a “compelling need to ensure transparency and informed consent, to provide additional guidance to businesses, to establish a baseline commercial data privacy framework to afford protection for consumers, and to clarify the U.S. approach to commercial data privacy—all without compromising the current framework’s ability to accommodate customer service, innovation, and appropriate uses of new technologies.”  The earlier version of the paper included policy recommendations under four broad categories:

 

 

The White Paper released today by the Administration addressed many of the issues brought to light by and built on many of the recommendations set forth in the earlier version, the Green Paper, and the more than one hundred comments received in response to the publication of the Green Paper.  The Administration addressed those issues and recommendations by setting forth a new privacy framework that consists of four key elements:  (1) a Consumer Privacy Bill of Rights; (2) a multi-stakeholder process to determine how these rights will apply in specific business contexts; (3) an effective enforcement model; and (4) greater interoperability between the privacy frameworks of the United States and its international partners.

 

Consumer Privacy Bill of Rights

 

The cornerstone of the Administration’s privacy framework is the Consumer Privacy Bill of Rights, which adapts the decades-old Fair Information Practice Principles (FIPPs) to the interconnected and interactive world that we live in today.  The Privacy Bill of Rights applies to commercial uses of personal data and seeks to provide greater privacy protection for consumers and greater certainty for businesses.  There are seven core rights that comprise the Privacy Bill of Rights:

 

 

In a media teleconference about the White Paper, FPF’s Jules Polonetsky stated that a key point of framework is that the Administration calls on “consumer-facing companies [to] act as the stewards, as the ones responsible” for consumers’ privacy.  He noted that although this seems like a logical arrangement, it is not the way the online ecosystem has worked in the past.  By calling on consumer-facing companies to take responsibility for consumers’ privacy, the framework seeks to align business practices with consumers’ expectations about who will safeguard their privacy.

 

Multi-stakeholder Process

 

The Administration’s framework contemplates a multi-stakeholder approach that will produce enforceable codes of conduct that implement the Privacy Bill of Rights.  The multi-stakeholder approach is championed by the Administration due to the “flexibility, speed, and decentralization necessary to address Internet policy challenges.”  FPF’s other co-chair Chris Wolf, praised the Administration for eschewing a one-size-fits-all approach and instead opting for flexible codes of conduct, stating that “the call for enforceable codes of conduct is a sensible way to address privacy.”   In addition to flexibility, the speed with which the multi-stakeholder process can produce solutions—as compared to the regulatory or law making process—is also appealing due to the constantly-evolving nature of privacy issues.  Jules noted that “many [privacy] issues are moving so quickly that if you don’t achieve success in the short term, [they] can outrun you.”  The Administration has tasked the Commerce Department’s National Telecommunications and Information Administration (NTIA) with spearheading the multi-stakeholder process, and Polonetsky commented that he expects NTIA to start the process by releasing a Notice of Inquiry sooner rather than later, so that quick wins can be achieved.

 

Strengthening FTC Enforcement

 

In the White Paper, the Administration highlighted the importance of the FTC in maintaining a level playing field by ensuring that businesses adhere to their privacy commitments and punishing those that do not.  The Administration stated that a business’s commitment to adhere to a voluntary code of conduct will become enforceable under Section 5 of the FTC Act, analogizing the situation to the FTC’s power to enforce the promises and representations businesses make in their privacy policies.  However, the Administration also noted that one of the benefits of adhering to a code of conduct is that in “any enforcement action based on conduct covered by a code, the FTC will consider a company’s adherence to a code favorably.”

 

Promoting International Interoperability

 

Referring to the differences in national privacy laws that create challenges for businesses that wish to transfer data across national borders, the Administration stated that it is “critical to the continued growth of the digital economy that they strive to create interoperability between privacy regimes.”  The Administration expressed its desire to promote international interoperability by pursing mutual recognition of commercial privacy frameworks, international codes of conduct based on the multi-stakeholder process, and bilateral or multilateral enforcement cooperation.

 

Calls for Privacy Legislation

 

At the conclusion of the White Paper, the Administration called on Congress to adopt the Consumer Privacy Bill of Rights and provide the FTC and State Attorneys General with the power to enforce those rights.  However, Polonetsky pointed out that it is unlikely that Capitol Hill will act on this suggestion in the short term.

 

In addition, the Administration expressed support for creating a national standard for security breach notification, which would replace the state breach notification laws that are currently enacted in 47 states, the District of Columbia, Puerto Rico, and the Virgin Islands.  The Administration noted that the “patchwork of State laws creates significant burdens for companies without much countervailing benefit for consumers.”

Feb. 24, 2012 – Mobile Data Privacy Is Terra Incognita to Users and Developers, PC World

Feb. 24, 2012 – Why Google and Others Are On Board with Obama’s Privacy Bill of Rights, TIME Techland

Feb. 24, 2012 – White House Puts 'Consumer Privacy Bill of Rights' on Regulatory Agenda, Corporate Counsel

Feb. 24, 2012 – Do Not Track: 7 Key Facts, InformationWeek

Feb. 23, 2012 – California will make apps carry privacy policies, Politico

Feb. 23, 2012 – The Growing Problem Of Privacy-Invading Mobile Apps, Forbes

Feb. 23, 2012 – Mobile app stores to reveal privacy policies due to California ruling, TechWorld