White House Consumer Privacy Bill Starts an Important Conversation

This afternoon the White House released a discussion draft of its Consumer Privacy Bill of Rights Act. Jules Polonetsky and Chris Wolf issued the following response:

Today’s release of the text of Consumer Privacy Bill of Rights demonstrates the U.S.’s continuing commitment to advance privacy protection for consumers.

Although the current system of FTC enforcement actions and strong sectoral laws provide important tools to address privacy harms, the ideas proposed in the bill are certain to help frame the discussion about privacy practices by companies and not-for profits in the future.  International data regulators should recognize that this bill is not a critique of the current system, but the opening of a nuanced conversation that seeks to balance benefit and risk, while being considerate of consumer rights.

The impact of the bill is not likely to be legislative, but the ideas it raises will have impact on the privacy debate.  Key concepts in the bill that will advance the privacy discussion in a very practical way include the focus on context to shape appropriate uses of data, the recognition that assessing benefit and risk is important, and the consideration of Privacy Review Boards as internal or external structures that could help assess beneficial uses of data that would otherwise be constrained by law.

What Privacy Papers Should Policymakers Be Reading?

Each year, FPF invites privacy scholars and authors interested in privacy questions to submit articles and papers to be considered by members of our Advisory Board, with an aim toward showcasing those articles that should inform any conversation about privacy among policymakers in Congress, as well as at the Federal Trade Commission and in other government agencies. For our fifth annual Privacy Papers for Policymakers, we received a record number of submissions covering topics ranging from data use in elections, government surveillance, the always-present cloud, and even the emergence of app stores for the brain.

However, in a year where the White House launched a review into the privacy implications of “Big Data,” scholars and privacy advocates were particularly focused on looking at how algorithms are changing our society – and what that means for individuals’ privacy. Our Advisory Board selected papers that addressed this challenge head-on. It also selected papers that describe how information about consumers is being collected, gathered, and used across the Internet, and what role the FTC should specifically play in policing the privacy and data security practices around those activities.

Our top privacy papers for 2014 are, in alphabetical order:

Big Data’s Disparate Impact

Solon Barocas & Andrew Selbst

Four Privacy Myths

Neil Richards

Free: Accounting for the Costs of the Internet’s Most Popular Price

Chris Jay Hoofnagle & Jan Whittington

The Scope and Potential of FTC Data Protection 

Woodrow Hartzog & Dan Solove

The Scored Society

Danielle Citron & Frank Pasquale

The Scoring of America: How Secret Consumer Scores Threaten Your Privacy and Your Future 

Pam Dixon and Robert Gellman

These papers illuminate concerns that will continue to drive privacy debates in 2015. Already in the new year, we have seen the White House push new proposals to address student privacy and identity theft. The Internet of Things has made headlines, moving from something that is coming to something that is here.

We want to thank EY for their special support of this project. And we thank the scholars, advocates, and Advisory Board members that are engaged with us to explore the future of privacy. We look forward to celebrating the formal release of FPF’s Privacy Papers for Policymakers digest at an event the evening of March 3rd, ahead of the IAPP Global Privacy Summit. If you are interested in attending, please reach to us at [email protected].

The Student Privacy Pledge and Security

We know it is critical for ed tech companies to get security right.

The Student Privacy Pledge developed by FPF and SIIA requires signatories to maintain “a comprehensive security program that is reasonably designed to protect the security . . . of personal student information . . . appropriate to the sensitivity of the information.” “Reasonableness” in this context is not a subjective standard, open to interpretation by each company, but rather a standard used and interpreted across a range of contexts by the Federal Trade Commission. It is also the basis of California’s new Student Online Privacy Protection Act.

A company’s security and other commitments made under the Student Privacy Pledge are legally enforceable. Under Section 5 of the Consumer Protection Act, the Federal Trade Commission (FTC) can take action against companies that commit deceptive trade practices. It is a form of deception to make a public statement such as signing the Student Privacy Pledge but then implementing practices that do not conform to those public statements. The FTC and various State Attorneys General have brought enforcement actions against companies that made privacy promises to their consumers and then violated those promises.

Companies with security practices that fall short can therefore face legal liability. The pledge does not designate specific security technologies, because those measures need to be tailored to the service, context and sensitivity of the protected information.  What constitutes reasonable may depend on the specific company and nature of the data that it handles, and must evolve over time as new threats and solutions emerge.

For services that hold sensitive student data, login password encryption or equally protective measures are basic measures that companies must implement. Of course, effective security requires ongoing training of company employees, and toward that end, we have also kicked off a series of workshops starting next week to help companies further hone their security and privacy practices.

When a company signs the Pledge, they publicly commit to its responsible and appropriate standards for student privacy and data security, and the pledge allows the public – the media, parents, educators and federal regulators – to hold these companies accountable. It’s exactly this sort of public scrutiny that makes the pledge an effective means for ensuring data accountability. This accountability requires that all stakeholders understand its security standard, enforceability and other elements of the Student Privacy Pledge.

-FPF and SIIA

White House Return to Big Data Focuses on Price Discrimination

Today, the White House released an interim progress report detailing the Administration’s efforts on privacy in big data since its landmark report last spring. The update highlights the President’s recent calls for new privacy legislation, including efforts on student privacy and the Consumer Privacy Bill of Rights, and also calls for deeper understanding of differential pricing — or what is commonly called price discrimination. The White House Council of Economic Advisors released a companion report, exploring how companies can use the information they collect to more effectively charge different prices to different customers.

The nineteen-page report notes that industry is already using big data for targeted marketing and beginning to experiment with personalized pricing. According to FPF Senior Fellow Peter Swire, the report is “a readable discussion of price discrimination from an economists’ perspective. In a non-ideological way, it explains the terminology used by professional economists.”

Much of the report summaries existing concerns about the use of big data and price discrimination in general. Most economists, the report notes, consider price discrimination in the context of differences among consumers in their willingness to pay for good. While the report focuses on this sort of value-based pricing, it also notes the need for further discussion about the impact of big data on “risk-based” pricing, where sellers charge prices based on differences in the cost of serving different groups.Without much elaboration, the report cautions that “[b]ig data encourages risk-based pricing by enabling more fine-grained measurement of various risks,” citing the ability to track individual driving behaviors as a potential example.

As for the rise of value-based pricing, the report concedes that “current knowledge is mainly anecdotal.” It suggests that companies are either “moving slowly or remaining quiet, perhaps due to fears that consumers will respond negatively, but also because the methods are still being developed.”

It concludes that many concerns about price discrimination could be addressed through existing antidiscrimination, privacy, and consumer protection laws, and it recommends that companies provide more transparency about industry data practices. Swire further explained that two quotations distill the report’s key takeaways:

 (1) “The challenge for policy in this area will be to promote the application of big data where it can discourage excessive risk-taking and help solve adverse selection problems, while preventing unfair discrimination against consumers who have little control over newly-measureable risk factors.”

(2) “However, given the speed at which both the technology and business practices are evolving, commercial applications of big data deserve ongoing scrutiny, particularly where companies may be using sensitive information in ways that are not transparent to users and fall outside the boundaries of existing regulatory frameworks.”

 While further conversation about the potentially negative impacts of big data are warranted, the report takes a bullish approach toward concerns about price discrimination. As our digital footprints grow, the report states that broad trends suggest price discrimination is not yet having a negative impact on online consumer activities, and instead, consumers “are making use of the Internet and the variety of choices and tools it provides to ensure that they get a good deal.”

-Joseph Jerome, Policy Counsel

 

 

Student Privacy Pledge Crosses Milestone with 100 Signatories

Media Contacts:

FPF: Nicholas Graham, (571) 291-2967, [email protected]

SIIA: Sabrina Eyob, (202) 789-4480, [email protected]

PR Agency: Farrah Kim, (202) 568-8986, [email protected]

 

STUDENT PRIVACY PLEDGE CROSSES MILESTONE WITH 100 SIGNATORIES

Responsible Privacy Practices Affirmed by  

Growing Number of Ed-Tech Companies

 

WASHINGTON, D.C. – Wednesday, February 4, 2015 – The Future of Privacy Forum (FPF) and the Software & Information Industry Association (SIIA) today announced that the groundbreaking Student Privacy Pledge now has 108 signatories. The pledge is a list of 12 commitments that school service providers have made to affirm K-12 student information is kept private and secure.

 

The Pledge was launched in October 2014 with 14 signatory companies, grew to 75 by early January, and has now reached a milestone – surpassing 100 signatories. The recent increase was fueled in part by President Obama’s strong support of the Pledge, announced on January 12th as part of a suite of policy proposals designed to further student privacy.

 

Unlike proposed legislative or regulatory actions, which may not go into effect for some period of time, the Pledge is binding and enforceable as soon as each company signs it. Signatory companies are listed online at www.studentprivacypledge.org.

 

“Passing 100 signatories to the Student Privacy Pledge is a clear affirmation of the industry’s commitment to the responsible use of student data,” said Jules Polonetsky, executive director, FPF. “We are grateful to the President for championing the Pledge, and we applaud the companies on the Pledge for their leadership on this issue.”

 

“The Pledge has strong momentum, with more than 100 high-tech companies signing to articulate their safeguarding of student information,” said Mark Schneiderman, SIIA’s senior director of education policy. “Along with existing laws and school agreements, the Pledge is part of a strong legal framework that ensures teachers and students can feel safe about technology use in school.”

 

In addition to the Pledge, SIIA and FPF continue other student privacy leadership efforts. On February 17-18 in Washington, D.C., FPF – in partnership with ReThink Education and with participation from SIIA – is organizing and hosting its first-ever Student Privacy Boot Camp for start-ups, small, and medium-sized ed-tech companies. Similarly, SIIA has provided an analysis of existing and new student privacy laws for its member companies. These and related programs help ensure vendors handling student data understand and comply with privacy laws and best practices.

 

The Student Privacy Pledge outlines a dozen commitments regarding the responsible collection, maintenance, and use of student personal information. The Pledge was developed by FPF and SIIA with guidance from school service providers, educator organizations, and other stakeholders following a convening by U.S. Representatives Jared Polis (CO) and Luke Messer (IN). The Pledge has also been endorsed by the National PTA and the National School Boards Association, among others.

The full text of the Pledge, more information about how to support it, and a list of current signatories are available at studentprivacypledge.org.

About FPF

The Future of Privacy Forum (FPF) is a Washington, DC based think tank that seeks to advance responsible data practices. The forum is led by Internet privacy experts Jules Polonetsky and Christopher Wolf and includes an advisory board comprised of leading figures from industry, academia, law and advocacy groups.  For more information, visit fpf.org.

About SIIA

SIIA is the leading association representing the software and digital content industries. SIIA represents approximately 800 member companies worldwide that develop software and digital information content. SIIA provides global services in government relations, business development, corporate education and intellectual property protection to the leading companies that are setting the pace for the digital age. For more information, visit www.siia.net.