The Federal Trade Commission said in a report and testimony to a U.S. House committee Tuesday that it is not recommending legislation to force Web sites to implement and follow privacy policies, even though more progress must be made.
While acknowledging that more should be done to protect the privacy of online users - including children - industry self-regulation is progressing and should be allowed to continue, the FTC told the House of Commerce, Telecommunications, Trade and Consumer Protection Subcommittee. In the meantime, the commission intends to continue monitoring the online industry.
In "Self-Regulation and Privacy Online: A Report to Congress," the FTC outlined recent studies finding that the majority of Internet users are concerned about privacy issues and are reluctant to provide personal information for fear it will be shared without their authorization with third parties. Those fears have stymied growth of electronic commerce.
The report commends the efforts of Web sites and companies that have taken the lead to promote privacy policies, but notes recent studies that "show that the implementation of fair information practices is not widespread among commercial Web sites."
In what might seem an odd juxtaposition, the report then says, "Based on these facts, the commission believes that legislation to address online privacy is not appropriate at this time."
FTC commissioners themselves, however, are not in accord on that point, based on testimony at the committee hearing.
"I am concerned that the absence of effective privacy protections will undermine consumer confidence and hinder the advancement of electronic commerce and trade," Commissioner Sheila Anthony said in a written statement. Anthony also testified at the hearing, saying that she believes it might be time to establish minimum privacy standards.
Anthony referred to the Georgetown Internet Privacy Policy Survey (GIPPS) and a survey of the top 100 most-visited Web sites commissioned by the Online Privacy Alliance (OPA), which found that nearly all of the sites surveyed collect personal information about consumers.
The GIPPS study looked at 361 Web sites from a list of the 7,500 busiest servers on the Web and found that 93% of the sites examined collect personal information. Sixty-six percent post at least one disclosure about that collection and 44% post privacy policy notices. The OPA study found that 99% of its surveyed sites collect personal information, with 93% posting at least one disclosure about that practice and 91% posting privacy policy notices.
However, GIPPS found that only 10% of its sample sites are using all four fair information practice principles supported by the FTC, while the OPA survey found 22% follow the guidelines. The FTC last year said the principles that should be followed for sound privacy practice are notice and awareness; choice and consent; access and participation; and security and integrity. Online users must be able to readily find privacy policies online; have the option to provide private information and give consent to collection of such data; have access to what is being collected about them; and also have assurances that Web sites they visit and use for e-commerce are secure.
So-called "seal programs" have begun "to offer an easy way for consumers to identify Web sites that follow specified information practice principles, and for online businesses to demonstrate compliance with those principles," according to the FTC study and testimony from commissioners. Officials lauded the efforts of Truste, a nonprofit organization started by the commerceNet Consortium and the Electronic Frontier Foundation, and BBBOnline, a subsidiary of the Council of Better Business Bureaus.
The programs allow sites that meet privacy policy criteria to post seals of approval. Truste also refers consumer complaints to the FTC when appropriate. The BBC program is newer, and the FTC said it will assess that program's enforcement mechanisms when they are in effect.
Today's FTC report is one in an ongoing series regarding online privacy. It also apparently is the last of its kind in its overview approach to industry self-regulation and progress in establishing policies.
"The next report is going to be different," FTC Chairman Robert Pitofsky told the committee this morning. Thus far, the FTC reports have focused on "just counting noses" to track which sites and companies are establishing and enforcing privacy policies.
Next, the FTC intends to "get at whether those privacy policies are worth the screens they're printed on," Pitofsky said. The commission will now begin to take a harder look at the merits of privacy policies and the sites and companies that adhere to their posted guidelines.
That harder look would apparently be welcome by some members of Congress. Relying on their penchant for giving letter grades to assess progress, members of the Commerce subcommittee today asked FTC commissioners to grade industry progress on privacy policies and use of the FTC principles. Commissioners noted that substantial progress has been made in the past year and tended to give a passing grade, even while noting that more must be done.
Rep. Edward Markey ( D-Mass.) suggested the grades are inflated. The industry overall, he said, deserves "a big fat F."
Most Web sites aren't going to move toward meaningful privacy policy until the Clinton administration forces the issue by establishing its own policies that industry must follow. The hearing started cordially, but Markey testily said that if Web sites will not be "100% compliant" in establishing privacy policies themselves, then legislation should be enacted to force compliance.
Pitofsky attempted to counter Markey's argument, saying technology is changing rapidly and flexibility is necessary.
"Technology is changing rapidly, so what?" Markey said angrily, adding that rapid change does not obviate the need for consumer protections because online users are becoming less comfortable, rather than more comfortable, with providing personal information to Web sites.
Pitofsky said the FTC will conduct a public workshop on how some sites gather and use information about consumers, gathered online and offline. The FTC also will create two task forces of industry representatives, privacy advocates and consumer groups to work on pushing the implementation of fair information practices online.
Another report tracking online privacy policies will be issued by the FTC in a year, but subcommittee members asked for updates on commission findings.
A full text of the FTC report, as well as additional information about online privacy issues, can be found at www.ftc.gov/. The Web site of the U.S. House Commerce Committee, whose telecommunications subcommittee conducted today's hearing, is www.house.gov/commerce/.
RELATED LINKS
