FPF Responds to FTC Release of Final Privacy Framework Report
Please see below for FPF’s comments on today’s release of the FTC Final Privacy Framework Report. Today’s report follows a preliminary staff report that the FTC issued in December 2010.
Jules Polonetsky, Director and Co-Chair of the Future of Privacy Forum:
“Although the FTC calls for legislation, the focus of the report is a strong demand for an acceleration of industry best practices efforts. Whether it is finalizing Do Not Track, creating a central data broker opt-out site, or implementing standardized notices, the Commission is urging industry to take action itself.
Like the Commerce Department, the FTC also sensibly focuses on “the context of the consumers interaction with a business” to try to ensure new innovative uses of data are permissible. The Commission held to the basic ideas of the staff report, but responded to business and advocacy concerns by adding more nuance and flexibility.”
Christopher Wolf, Founder and Co-Chair of the Future of Privacy Forum:
“First, it is gratifying to see that the input provided by the Future of Privacy Forum was useful to the FTC, which repeatedly cites the Forum in the Report.
Second, the FTC’s definition of the scope of privacy protection is flexible and sensible, and allows for use of de-identified data.
Third, it is not surprising that the Commission joins in the call for baseline privacy legislation and data security legislation. There appears to be a groundswell of support for legislation. With that said, the FTC has called for legislation before, so by itself, this support will not necessarily lead to legislation anytime soon. Thus, improvements to the existing framework remain important.
On Do Not Track, the FTC correctly is prepared to wait for the ongoing self-regulatory efforts to proceed. A lot of progress has been made and can be expected.
On mobile, the FTC correctly supports further self-regulation, which makes sense given the complexity of the issues involved. The Future of Privacy Forum is convening an App Privacy Summit at Stanford University on April 25, related to this. On data brokers, the FTC is correct to call for protection proportionate to the sensitivity of the data. There is much work industry can do, and a self-regulatory approach makes sense given the complexities.
The reference in the Report to ‘Large Platform Providers’ is a welcome reference that focuses on functions rather than the specific technology used. For example, It has been a mistake in the past to focus solely on ISPs without considering other companies that collect and use (or could collect and use) as much information as ISPs.”
Mar. 26, 2012 – Consumer Privacy in Focus as Regulators Zero in on Mobile, Street Fight
Mar. 23, 2012 – Facebook addresses more privacy concerns; user doubts are still biggest threat to growth, Washington Post
Mar. 23, 2012 – Facebook takes steps to address privacy concerns, Atlanta Journal Constitution
Mar. 23, 2012 – Facebook takes steps to address privacy concerns, Huffington Post Tech
Mar. 23, 2012 – Nation and World: Facebook can't win on privacy issue, Star Telegram
Georgetown Hosts Lawful Access to the Cloud Seminar
On Tuesday, Georgetown’s Law School hosted a Seminar titled “Lawful Access to the Cloud.” The seminar’s panelists grappled with how to find the right balance between civil liberties and legitimate law enforcement needs to access data in the cloud;.
The morning’s first panel focused on lawful access to data in the U.S., and the second panel focused on law enforcement access to data in the E.U. Bruce Schwartz, Deputy Assistant Attorney General at the U.S. Justice Department began the day by pushing back at the widespread perception that the U.S. has less protection than the E.U. for data stored in the cloud. In fact, he said, the U.S. has higher greater protections for electronically stored data than the E.U. The Center for Democracy and Technology’s President and CEO, Leslie Harris, responded that the most important criterion for laws and practices regarding lawful access to data in the cloud is conforming to citizen’s expectations. Harris submitted that most users would be very surprised at the permissiveness of the current legislative structure in the U.S. regarding lawful access to data in the cloud.
Next, Mark Rasch, the Director of Cybersecurity and Privacy Consulting at CSC, examined several of the ways that the cloud is different from previous technologies and explained how much of the legal structure regarding lawful access to electronic communication is hopelessly out of date. The final panelist, Fred Cate, Professor of Law and Director of the Center for Applied Cybersecurity Research at Indiana University, talked about how U.S. lawful access statutes need to change more quickly. He also argued that the U.S. government needs to do a much better job being transparent and accountable about lawful access to electronically stored information.
Peter Swire, Senior Fellow at FPF and the C. William O’Neill Professor of Law at the Ohio State University, began the second panel by explaining that the widespread use of encryption has led law enforcement to increasingly rely on accessing data stored in the cloud. Widespread encryption makes it very difficult for law enforcement officials to access encrypted electronic communications as they are being sent, so law enforcement places greater emphasis on accessing the unencrypted, stored communications in the cloud. Swire then gave an overview of UK data protection laws and pointed out that the laws in the UK in many respects are more permissive than U.S. law.
Following Swire, Google’s Richard Salgado talked about the practices his company follows regarding lawful access. Salgado explained that Google’s policies are based on the reasonable privacy expectations of users. Google, he said, works hard to be transparent and, when legal, provides notices to consumers when their data is accessed by law enforcement. Emilio de Capitani, former Head of Unit at the Committee on Citizens’ Freedoms and Rights in the European Parliament, rounded out the day. He gave an overview of E.U. laws governing lawful access and discussed some of the challenges facing E.U. member states as they try to increasingly standardize their policies for lawful access to data.
Throughout the day, several themes emerged time and again. The seminar made it clear that there is a significant amount of uncertainty about the laws and practices of lawful access in both the U.S. and the E.U. Secondly, U.S. laws regarding lawful access are very outdated and need to be updated to take into account the technological changes that have emerged during the last several decades. Finally, many foreign companies and countries believe that U.S. laws regarding lawful access, especially the PATRIOT Act, allow the U.S. government very significant access to electronically stored data. Regardless of the validity, this fear is having an adverse effect on the ability of U.S. cloud providers to sell their services overseas.
-Peter Swire and Steven Beale
App Developer Privacy Summit – April 25th
FPF Responds to WH Announcement on Green Button Initiative
WASHINGTON – Today, the White House announced that 9 new utilities have committed to adopting the industry-led Green Button Initiative, joining 6 previously announced commitments, for a total of 27 million homes committed.
The statement below can be attributed to Jules Polonetsky, Director and Co-Chair of the Future of Privacy Forum.
“Offering consumers access to their data provides the kind of transparency that enhances privacy. By showing consumers the details of energy usage data, utilities are taking an important step to ensure that smart meters are a key benefit intended to help consumers be smarter about energy use.
With appropriate privacy programs in place, access to data will increasingly empower consumers to use their data to manage smart home devices that will advance innovation and consumer control.”
For any questions, or to schedule a phone call with Jules Polonetsky, please email [email protected].
The Future of Privacy Forum (FPF) is a Washington, DC based think tank that seeks to advance responsible data practices. The forum is led by Internet privacy experts Jules Polonetsky and Christopher Wolf and includes an advisory board comprised of leading figures from industry, academia, law and advocacy groups.
Swire Presents at FBI/DOD Sponsored Facial Recognition Forum
On Wednesday, March 14 FPF Senior Fellow Peter Swire gave a talk on “Facial Recognition by the Government: Privacy and Civil Liberties Issues.” The talk took place at the third installment in the U.S. Government Facial Recognition Legal Series. Wednesday’s forum was titled “Striking the Balance – A Government Approach to Facial Recognition Privacy and Civil Liberties.” The forum participants and speakers explored use cases for facial recognition across federal law enforcement and national security agencies, sought to deepen their understanding of the existing law and policy that governs facial recognition in these contexts, and identified gaps in legal/policy authority that may result in privacy and civil liberties vulnerabilities if left unaddressed The forums have been geared towards federal law enforcement and intelligence personnel.
Swire, a law professor at the Ohio State University, focused his presentation on the legal landscape surrounding privacy and facial recognition technology. To frame the discussion, he began by outlining two differing perspectives on facial recognition technology: 1) it has always been legal to observe people in public, and facial recognition technology is simply making this easier and 2) facial recognition technology allows an unprecedented ability to surveil and track people, and this information could be stored indefinitely and correlated with other personal information.
Next, he examined some of the constitutional issues surrounding facial recognition. Of particular importance in the facial recognition space is the fourth amendment. The fourth amendment requires warrants and probable cause for searches and prohibits unreasonable searches and seizures. Observing a person in public has traditionally not required a warrant. However, Professor Swire pointed out, the Supreme Court’s recent decision in U.S. vs. Jones may dramatically impact privacy by requiring law enforcement agents to obtain a warrant to conduct surveillance on suspects in public, something law enforcement has never had to do. However, the fourth amendment contains a consent exception; if an individual consents to a search, a warrant is not required. Professor Swire pointed out that some might argue that individuals consent to going outside or to other public places (i.e. a bank or mall) where security cameras are present.
Professor Swire also examined how several other laws might impact facial recognition technology. Some, including Justice Sotomayor, are worried that constant surveillance by the government could chill free speech and free association. Constant surveillance could also potentially lead to discrimination—while most Americans are familiar with the phrase “driving while black,” constant surveillance could lead to “walking while black.”
To finish his talk, Professor Swire advised the government attendees that not everything that is legal should be done. He recommended that law enforcement and intelligence agencies practice data minimization and conduct the New York Times test to determine whether or not a surveillance program is a good idea: if the program was detailed on the front page of the New York Times, would the public reaction be negative or positive?
Following Professor Swire’s talk, officials from government agencies including the FBI, OMB, DoD, and DHS presented on a range of topics including the impact of public perception on law and policy, biometrics privacy policies in different agencies, and gaps in facial recognition law and policy. The presenters and participants all agreed that they need to work hard to earn and maintain the public’s trust in their use of biometrics technology, including facial recognition services.
The presenters and government attendees showed a high degree of sensitivity to the privacy issues surrounding facial recognition technology. Additionally, they were aware that they are all in the same boat; as one government official put it, a big facial recognition privacy mishap by one government agency would tarnish legitimate facial recognition programs in every other agency. Conversely, any well-thought-out and run facial recognition program can help every agency build trust around facial recognition technology.
