FTC Director of Consumer Protection Praises MLA Code
Politico reports this morning in Morning Tech that our guidelines for location analytics companies — announced yesterday — have been met with some kind words from FTC Director of Consumer Protection Jessica Rich. She said:
“It’s great that industry has recognized consumer concerns about invisible tracking in retail spaces and has taken a positive step forward in developing a self-regulatory code of conduct…Our staff appreciated the opportunity to provide feedback in the process of creating the code. This is a rapidly changing industry with critical consumer privacy implications, and the FTC is paying close attention how retailers are using these new technologies.”
via Politico Morning Tech.
Chris Wolf Asks Whether the LIBE Committee Torpedoed the Safe Harbor?
In a post on IAPP Privacy Perspectives blog, Christopher Wolf, FPF Founder and Co-Chair, suggests that the LIBE Committee has effectively called for the end of the US-EU Safe Harbor.
“Before abandoning the Safe Harbor, we urge the European Parliament and Council to take a deep breath, and to take a dispassionate view of the effectiveness of the Safe Harbor—especially in comparison to the enforcement tools that are or would be available if the Safe Harbor is blown up,” he suggests.
The Future of Privacy Forum and Sen. Schumer Announce Important Agreement to Ensure Consumers Have Opportunity to “Opt-Out” Before Stores Can Track Their Movement Via Their Mobile Devices
FOR IMMEDIATE RELEASE: October 22, 2013
The Future of Privacy Forum and Sen. Schumer Announce Important Agreement to Ensure Consumers Have Opportunity to “Opt-Out” Before Stores Can Track Their Movement Via Their Mobile Devices
FPF and Schumer Release New Code-of-Conduct Agreed to By Location-Technology Companies
Code Includes A Requirement of Clear, In-Store Signage That Tracking Technology Is Being Used And Instructions for How To “Opt-out” So Stores Can’t Track You
New York, NY – The Future of Privacy Forum (FPF), U.S. Senator Charles E. Schumer and a group of leading location analytics companies – including Euclid, iInside (a WirelessWERX company), Mexia Interactive, SOLOMO, Radius Networks, Brickstream and Turnstyle Solutions – today announced that they have agreed to a Code of Conduct to promote consumer privacy and responsible data use for retail location analytics. The companies responded to privacy concerns raised by Senator Schumer and the FPF about the use of this new technology. The code of conduct includes in-store posted signs that alert shoppers that tracking technology is being used, and instructions for how to opt out.
“Today, location analytics companies have introduced a comprehensive code to ensure they have data protection standards in place to de-identify data, to provide consumers with effective choices to not be tracked and to explain to consumers the purposes for which data is being used,” said Jules Polonetsky, executive Director of the Future of Privacy Forum. “These standards ensure that consumers understand the benefit of the bargain and have choices about how their information is used while allowing technology to continue to improve the shopping experience. As we quickly approach the holiday shopping season, this is not only the right move – but a timely one as well, adding a layer of trust, choice and transparency onto a shopping experience that in 2013 is more mobile and hi-tech than ever before.”
PHOTO: Senator Schumer, second from left, pictured with (L-R) Glenn Tinley (President & Founder, Mexia Interactive), Will Smith (CEO, Euclid), Jules Polonetsky (Executive Director, Future of Privacy Forum), and Jim Riesenbach (CEO, iInside Inc.).
“This is a significant step forward in the quest for consumer privacy,” said Senator Schumer. “This agreement shows that technology companies, retailers, and consumer advocates can work together in the best interest of the consumer. There is still much more work to be done and I will continue to push for privacy rights to be respected and strengthened, but this represents real progress and I thank the Future Privacy Forum and these tech companies for their hard work hammering out this agreement.”
Major national retail chains have been testing technology that would allow them to automatically track shoppers’ location through stores. The FPF worked with the technology companies to develop a Code to ensure that appropriate privacy controls are in place as retailers seek to improve the consumer shopping experience. These technology companies use mobile device Wi-Fi or Bluetooth MAC addresses to develop aggregate reports for retailers.
The Code puts guidelines in place to create best data practices that will provide transparency and choice for consumers. The Code calls for the display of conspicuous signage by retailers and for a central opt-out site for consumers.
Under the Code, companies that collect data through this technology must limit how the information is used and shared and how long it may be retained. The Code mandates that companies de-identify the data and explain in their privacy policy how they do so. Companies are required to get opt-in consent when personal information is collected, or when a consumer will be contacted. The Code calls for opt-out consent where the information collected is not personal. In addition, this data cannot be collected or used in an adverse manner for employment, health care or insurance purposes.
“We are just beginning to see the possibilities that in-store analytics can bring to shoppers and to retailers, and yet, as with any new technology, there is the chance for confusion about the intent and possible implications of such technology,” said Steve Jeffery, CEO, Brickstream. “We applaud the Future of Privacy Forum for taking the lead in bringing retailers and technology providers together to address these important issues.”
“We would like to thank Senator Schumer for his leadership on this issue,” said Will Smith, CEO, Euclid. “Privacy has always been a priority as we’ve designed and built our services, and we have been working diligently with FPF to release best practices for the retail analytics industry as a whole.”
“iInside and industry partners have made it a top priority to assure that consumers are well-informed and their personal privacy and identity are protected. The newly announced code is a major step forward in establishing and communicating clear and concise standards across our industry,” said Jim Riesenbach, CEO, iInside Inc.
“The release of a Code of Conduct to guide industry practice ensures that businesses and retailers are able to enhance their customers’ experience without compromising their privacy,” said Glenn Tinley, President & Founder, Mexia Interactive. “Business and consumers also can be assured that a company listed on the SmartStorePrivacy.org website has committed to following the code.”
“Proximity and location technology is evolving rapidly, and we want to make sure it’s deployed in an open, responsible and trustworthy manner. The retail location analytics Code of Conduct is a solid step in the right direction,” said Marc Wallace, Co-Founder & CEO, Radius Networks, Inc.
“SOLOMO sees privacy as an opportunity for retailers to build trust with customers,” said Liz Eversoll, CEO, SOLOMO. “We’ve collaborated to develop the Code of Conduct to ensure transparency and empowerment for retail customers. Indoor location technology will offer customers new in-store experiences, special deals, and localized services as retailers introduce it in their stores. Everyone wins.”
“Turnstyle Solutions is pleased to partner with the Future Privacy Forum in the development of this Code of Conduct. We are confident the code lays the foundation necessary to protect sensitive consumer information, while offering retailers and consumers services that enhance their shopping experience,” said Devon Wright, Co-Founder, Turnstyle Solutions.
About the Future of Privacy Forum
The Future of Privacy Forum (FPF) is a Washington, DC based think tank that seeks to advance responsible data practices. The forum is led by internet privacy experts Jules Polonetsky and Christopher Wolf and includes an advisory board comprised of leading figures from industry, academia, law and advocacy groups.
For more information on retail location analytics and the Mobile Location Analytics Code of Conduct, visit SmartStorePrivacy.org. For any further questions or to schedule an interview, please contact [email protected].
Privacy a Hot Topic at Place 2013 Indoor Marketing Conference, ITworld Reports
On the heels of this week’s Place 2013 Indoor Marketing Conference in San Francisco, ITworld has published a piece called ‘How location tracking will change the way you shop.’ Location tracking has become a key issue for FPF, and we were really pleased that privacy was a big part of the conversation at the conference, and the ITworld article. Our director Jules Polonetsky is quoted in the article emphasizing the need for company transparency, but also that retailers ought to promote the benefits of data gathering to their customers:
‘Companies need to be transparent about what they’re doing and why, said Jules Polonetsky, executive director and co-chairman at the Future of Privacy Forum.
“We’re never going to convince consumers that they should love data exchanges or marketing,” he said. But instead of burying their data gathering in a long privacy policy, retailers should promote the types of benefits Amazon offers with its recommendations, Polonetsky said, and tell customers, “We recommended this to you because you liked such and such.”‘
Location tracking creates so many possibilities to improve the consumer experience, and we’re hopeful that — if done right — these need not come at the cost of transparent and responsible data gathering.
Read the rest of the article at ITworld.
Safe Harbor Faces Scrutiny at Recent LIBE Committee Hearing
As we described in our previous post, the Safe Harbor is currently facing criticism in the EU in light of disclosures involving US surveillance programs. A recent hearing by the European Civil Liberties, Justice and Home Affairs (LIBE) Committee is demonstrative of this negative sentiment and shows that there is no sign that this backlash will subside.
On October 7, the LIBE Committee of the European Parliament held a hearing to examine the US-EU Safe Harbor framework as well as other mechanisms for lawful data transfers in light of the NSA revelations. At the hearing, all the speakers argued that data collection at the scale conducted by the NSA was inconsistent with EU law, and pressed for the enactment of Article 42 – a provision currently under consideration that would prohibit countries outside of the EU from accessing personal data in the EU where required by a non-EU court or administrative authority without prior authorization by a DPA.
Peter Hustinx, the European Data Protection Supervisor, offered the most positive review of the Safe Harbor framework, describing it as having merit but lacking a comprehensive overview. Isabelle Falque Pierrotin, President of CNIL, noted that the Safe Harbor and BCRs were not designed to address government requests for data transfers, instead arguing for strong agreements with non-EU countries in order to avoid conflicts of law, and the development of a European cloud system to create clear legal responsibility for companies.
Christopher Connolly, director of consulting firm Galexia and author of a 2008 report on the Safe Harbor, was most critical of the framework. He cited what he believed to be considerable flaws in the framework – many of the same criticisms he levied in his 2008 report – and advocated for its suspension. Despite only Connolly calling for a suspension of the Safe Harbor, at the end of the hearing, Claude Moraes, Labour MEP for London and a member of the LIBE Committee, stated that his draft report would recommend suspending the framework.
The rhetoric at this hearing is an example of why FPF is conducting its own objective assessment of the Safe Harbor framework. We believe that it is important to provide EU policy makers with a neutral review of the Safe Harbor that provides basic facts about the implementation and enforcement of the framework to best understand what is working, and what can be improved. By taking a balanced look at the current state of the Safe Harbor, FPF can provide input into the ongoing EU debate.
Solove and Schwartz Reconcile US-EU Privacy Law
In their new essay, Reconciling Personal Information in the United States and European Union, Professors Dan Solove and Paul Schwartz explore the divergence between European and US privacy law. The pair point to trans-Atlantic differences in the definition of personally identifiable information (PII) as one of the biggest challenges for harmonizing the the two legal systems’ privacy regimes.
“The differences in the definitions of PII in the two systems are caused by their disparate treatment of this situation: frequently, data is merely identifiable, but the people to whom the data pertains are not currently identified,” they write. In the United States, PII has a plethora of different and inconsistent definitions, while the EU approach is broad and vague. This fundamental difference presents serious compliance costs for companies doing business in America and Europe.
Solove and Schwartz build on their conception of PII 2.0 to address this challenge. PII 2.0 establishes two categories of PII — “identified” and “identifiable” data — and tailors legal protections to the level of risk to individuals. “PII 2.0 would enlarge the scope of some U.S. privacy laws, but it would not impede data flows within the United States or internationally. In the European Union, it would provide for more tailored and nuanced protections,” they conclude.
Terrell McSweeny Touches on Privacy Issues During Confirmation Hearing
During her confirmation hearing today, Terrell McSweeny briefly touched upon privacy issues. With her children in the background, she noted that she is particularly cognizant of the need to protect children’s privacy. Noting that her small children were already both “iPad and app proficient,” she recognized that mobile technology–and the ways that children are using this technology–is evolving rapidly in both good and bad ways. In response to a question by Senator Ed Markey (D-Mass.), McSweeny stated that she was interested in working with the Senator on protections for teenagers who fall outside of current COPPA rules.
On the topic of data brokers, McSweeny suggested that the FTC had an important mission to educate the public. “I’m often struck by how little most of us know about how information is collected and used online,” she said, adding that she thought there were lessons that could be learned from the various multistakeholder processes that have been pursued in the past few years.
