As the FTC gathers comments on its proposed privacy rules, including a “Do Not Track” proposal, FTC Commissioner Julie Brill told a crowd of privacy researchers and policy wonks gathered at UC Berkeley that her agency was willing to go to Congress if online advertisers and analytics companies don’t clean up their act.
While Do Not Track has become a buzz phrase that has been getting a lot of attention, there’s more that’s needed beyond implementing a good no-tracking option, Brill said. First, companies need to start considering “privacy by design.” That means that companies building new products need to think about privacy from the get-go, not just “retrofitting” privacy features once there’s a problem. Online companies also need to think about collecting less information about their users and holding it for a shorter period of time, Brill added. That’s a suggestion that puts the FTC in direct conflict with the data-retention policies desired by the Department of Justice and law-enforcement agencies.
Second, privacy choices need to be simplified for consumers. Privacy policies are too cluttered and confusing, and tend to be full of information that’s barely relevant to the consumer. For example, an online shopper already knows that his address will be shared with FedEx or another shipper when he buys something.
Privacy policies need to address the collection of the data itself, not just how the data is used. For example, plenty of companies, such as ad networks, are holding large amounts of consumer data and could stop using it for behavioral advertising if consumers opt out. But they might be less willing to not collect the info at all. That’s because they can still sell or share that data with others.
Finally, data practices need to be transparent. Not only should consumers know what kind of data companies are collecting about them, but the FTC is actually proposing that consumers should get access to that data, Brill said.
While the commission originally called for an approach that involved a persistent “header” alerting websites to the data-collection preferences of users who visit those sites—exactly the mechanism that Mozilla just unveiled in its new Firefox browser—the FTC is open to considering other strategies, she said.
Brill also addressed a question she’s been getting frequently: what does she think about industry response to the FTC privacy report so far? Her answer: It’s nice to be getting some reaction at all. The commission called for industry to self-regulate back in February of 2009, she noted. “Industry has been kind of slow to deal with this issue… We’ve been very pleased that since we released our report two months ago, we seemed to have caught industry’s attention now.”
If the self-regulation proposals coming in aren’t sufficient to protect consumers, “we will ask Congress to take up the issue,” Brill concluded.
http://paidcontent.org/article/419-ftc-commissioner-if-companies-dont-protect-privacy-well-go-to-congress/
Thursday, February 10, 2011
Monday, February 7, 2011
Survey: The best privacy advisers of 2010
This year's survey finds law firms still tops
Jay Cline Computerworld February 3, 2011
Who are the best people and firms at providing privacy advice? It's a question I've been asking since 2006, before privacy was cool. Since then, a plethora of new privacy rules and penalties and a tsunami of new technologies and risks have placed privacy among the top handful of corporate concerns. Doing privacy wrong now takes a bigger bite off the bottom line than it did when I first started asking this question. So have the answers changed?
Not when the question is which type of outside privacy practice you prefer. Lawyers are still the top choices, with law firms grabbing six of the top 10 spots in the survey. And for the fourth consecutive time, Hunton & Williams garnered the most votes. This may be a case of success breeding more success: Hunton attracted more than twice as many votes as its nearest challenger.
Second-place Morrison & Foerster still is highly regarded, followed by Foley & Lardner and Privacy & Information Management Services. Hogan Lovells and Covington & Burling round out the law firms ranking in the top 10 of all firms.
What does this say about the corporate privacy agenda? Two things, I think: Regulatory compliance is still the first step to take for many companies, and the firms that were the best at assisting with this first step five years ago are still the go-to destinations for in-house privacy officers.
Other firms gaining ground
Even though law firms took six of the top 10 places, that was down from the last survey, in 2008, when they accounted for eight spots. Indeed, consulting firms now account for half of the top 12.
Which were the top consultancies? As in past years, it was a mix of large audit and accounting firms, such as PriceWaterhouseCoopers and Ernst & Young, and boutique shops.
The stronger showing of consultancies may reflect the emerging consensus in the privacy profession that doing privacy right is bigger than regulatory compliance. Particularly for industries such as healthcare and technology, which involve an intensive use of personal information, creating privacy-friendly products and services involves meeting customer and social expectations. "Organizations need to 'do' privacy better, faster and cheaper," noted Brian Tretick, managing director for Athena Privacy, a new boutique firm. "That means more formal, repeatable processes, automation and active monitoring."
The survey also showed that firms may be looking for services beyond traditional advice from experts. New entrants to the list of top vote-getters include service providers, a certification firm and a professional association. Among them:
• San Francisco-based Truste is the provider of the popular Web-privacy seal and a number of other privacy-verification products and services.
• Portland, Ore.-based ID Experts and Austin-based Debix provide data-breach response services.
• Toronto-based Nymity provides an information portal for privacy content.
•Seattle-based MediaPro offers computer-based training for privacy and security.
The International Association of Privacy Professionals organizes the best-attended privacy conferences and offers the CIPP certification for the privacy profession.
Jay Cline Computerworld February 3, 2011
Who are the best people and firms at providing privacy advice? It's a question I've been asking since 2006, before privacy was cool. Since then, a plethora of new privacy rules and penalties and a tsunami of new technologies and risks have placed privacy among the top handful of corporate concerns. Doing privacy wrong now takes a bigger bite off the bottom line than it did when I first started asking this question. So have the answers changed?
Not when the question is which type of outside privacy practice you prefer. Lawyers are still the top choices, with law firms grabbing six of the top 10 spots in the survey. And for the fourth consecutive time, Hunton & Williams garnered the most votes. This may be a case of success breeding more success: Hunton attracted more than twice as many votes as its nearest challenger.
Second-place Morrison & Foerster still is highly regarded, followed by Foley & Lardner and Privacy & Information Management Services. Hogan Lovells and Covington & Burling round out the law firms ranking in the top 10 of all firms.
What does this say about the corporate privacy agenda? Two things, I think: Regulatory compliance is still the first step to take for many companies, and the firms that were the best at assisting with this first step five years ago are still the go-to destinations for in-house privacy officers.
Other firms gaining ground
Even though law firms took six of the top 10 places, that was down from the last survey, in 2008, when they accounted for eight spots. Indeed, consulting firms now account for half of the top 12.
Which were the top consultancies? As in past years, it was a mix of large audit and accounting firms, such as PriceWaterhouseCoopers and Ernst & Young, and boutique shops.
The stronger showing of consultancies may reflect the emerging consensus in the privacy profession that doing privacy right is bigger than regulatory compliance. Particularly for industries such as healthcare and technology, which involve an intensive use of personal information, creating privacy-friendly products and services involves meeting customer and social expectations. "Organizations need to 'do' privacy better, faster and cheaper," noted Brian Tretick, managing director for Athena Privacy, a new boutique firm. "That means more formal, repeatable processes, automation and active monitoring."
The survey also showed that firms may be looking for services beyond traditional advice from experts. New entrants to the list of top vote-getters include service providers, a certification firm and a professional association. Among them:
• San Francisco-based Truste is the provider of the popular Web-privacy seal and a number of other privacy-verification products and services.
• Portland, Ore.-based ID Experts and Austin-based Debix provide data-breach response services.
• Toronto-based Nymity provides an information portal for privacy content.
•Seattle-based MediaPro offers computer-based training for privacy and security.
The International Association of Privacy Professionals organizes the best-attended privacy conferences and offers the CIPP certification for the privacy profession.
Friday, February 4, 2011
Shiny Objects
Rep. Speier to introduce 'do not track' bill next week
By Sara Jerome - The Hill 02/03/11 03:02 PM ET
Rep. Jackie Speier (D-Calif.) plans to introduce an online privacy bill next week directing the Federal Trade Commission (FTC) to begin a "do not track" program for online advertisers, a Speier aide told The Hill.
The program would enable consumers to "opt out" of tracking by online advertisers. The aide said the bill is narrowly tailored to address tracking issues only, rather than the broader question of online privacy. It provides a floor, rather than a ceiling, for privacy law, so it does not pre-empt additional legislation in the future.
Speier's office worked with a host of pro-privacy groups on the bill, including Consumer Watchdog, the Consumer Federation of America, Consumers Union and the Electronic Frontier Foundation, among others.
Rep. Bobby Rush (D-Ill.) is also planning to reintroduce his privacy bill next week. His bill does not include a "do not track" mechanism; however, it provides a safe harbor for marketers who participate in such a federal program if one is created. Speier's bill does not include a safe harbor.
The FTC released its own privacy report last year, throwing its weight behind a "do not track" system. David Vladeck, the FTC consumer protection director, told Congress in a December hearing that "do not track" legislation could help protect consumers, since many are unaware they are being tracked. It might also simplify individuals' efforts to keep their online data private.
By Sara Jerome - The Hill 02/03/11 03:02 PM ET
Rep. Jackie Speier (D-Calif.) plans to introduce an online privacy bill next week directing the Federal Trade Commission (FTC) to begin a "do not track" program for online advertisers, a Speier aide told The Hill.
The program would enable consumers to "opt out" of tracking by online advertisers. The aide said the bill is narrowly tailored to address tracking issues only, rather than the broader question of online privacy. It provides a floor, rather than a ceiling, for privacy law, so it does not pre-empt additional legislation in the future.
Speier's office worked with a host of pro-privacy groups on the bill, including Consumer Watchdog, the Consumer Federation of America, Consumers Union and the Electronic Frontier Foundation, among others.
Rep. Bobby Rush (D-Ill.) is also planning to reintroduce his privacy bill next week. His bill does not include a "do not track" mechanism; however, it provides a safe harbor for marketers who participate in such a federal program if one is created. Speier's bill does not include a safe harbor.
The FTC released its own privacy report last year, throwing its weight behind a "do not track" system. David Vladeck, the FTC consumer protection director, told Congress in a December hearing that "do not track" legislation could help protect consumers, since many are unaware they are being tracked. It might also simplify individuals' efforts to keep their online data private.
In Europe, a Right to Be Forgotten Trumps the Memory of the Internet
Why is it that two sprawling yet similar Western cultures -- those on both sides of the Atlantic -- respond so differently to Internet privacy?
A quarter-century after coming to the United States, Franz Werro still thinks like a European. The 54-year-old Georgetown law professor, born and raised in Switzerland, is troubled when ads in French automatically pop up on his American laptop. The computer assumes that's what he wants. We live naked on the Internet, Werro knows, in a brave new world where our data lives forever. Google your name, and you'll stumble onto drunken photos from college, a misguided quote given to a reporter five years ago, court records, ancient 1 a.m. blog comments, that outdated Friendster profile ... the list goes on, a river of data creating a profile of who you are for anyone searching online: friend, merchant, or potential future employer. Werro's American students rarely mind.
But America is not Europe, and despite our no-secrets age of WikiLeaks, Europe wants to enshrine a special form of privacy into law. Individuals should, according to many in Europe, possess what they call a "right to be forgotten" on the Internet.
How do you create a space where we're free to analyze the data but not free to abuse the data? We've been asking the wrong questions.
How would this even be possible? This developing right, authorities in several European countries suggest, would allow an individual to control and sometimes eliminate his or her data trail and allow him or her to ask Google to remove select search results -- a newspaper article, say, which once painted him or her in a bad light. A look at recent news events guarantees that this right will only become more relevant in 2011.
On January 19, Google refused Spain's request that the ubiquitous, California-based search engine remove 90 links. Many of the links Spain wanted to remove included newspaper articles and information from public record, often painting the plaintiffs in a bad light. Google called Spain's request "disappointing" in its official statement and emphasized that as a search engine, it should not be responsible for curating Internet content. Removing links would be expensive, Google argued in court, and violate the "objectivity" of the Internet search. Last November, the European Union announced data protection goals for 2011, which include "clarifying the so-called 'right to be forgotten', i.e. the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes" (PDF).
The EU explicitly said that users should have the right. It has already been heavily discussed and praised in countries such as France, whose President Sarkozy said last year: "Regulating the Internet to correct the excesses and abuses that come from the total absence of rules is a moral imperative!" France's leadership at the coming G8 summit also signifies more dialogue, as Sarkozy hopes to discuss the right on an international stage.
These European concerns rarely come up in the United States. People may worry about Facebook's privacy settings, but few would suggest an individual has a right to remove an offending Gawker post from Google's index. After all, who decides? A person might want an embarrassing photo removed from record, but what if the photo features not only that person but four others? The question of censorship is inevitable. The closest manifestation on this side of the Atlantic is likely a paper from the ACLU lobbying for a "right to delete" (PDF). Why, then, have our two sprawling yet similar Western cultures responded so differently to Internet privacy?
In Europe, the idea that privacy should overrule free expression is nothing new. Professor Franz Werro keenly highlights the historical difference in a 2009 academic paper and points to a 1983 case in Switzerland. Swiss TV had planned to air a documentary about a criminal from the 1930s. Swiss law, however, forbade the airing of the program -- the European court "held that the documentary would unjustifiably violate plaintiff's privacy right to keep his feelings as a son from being trampled." Yale law professor James Whitman sees the differing concepts of privacy as a battle between liberty and dignity (here, the PDF of his 2004 journal article).
Transatlantic clashes over privacy in recent years have included the use of Google's Street View in Germany, Switzerland, the Czech Republic, and elsewhere. German criminals sued Wikipedia in 2009 to have their names scrubbed. A little less than a year ago, an Italian court successfully sued Google for allowing a user to post offensive video. The fact that many of the Internet companies such as Facebook and Google are located in the United States (where, as Werro says, there is "fetishization" of the constitutional First Amendment of free speech) creates deeper problems in the courtroom, as it did in Google's recent refusal in Madrid.
American companies favor American law if possible, no matter what country they operate in. In Europe, the courts balance a right to a free press with rights of privacy, of personality, and of dignity, protected in Article 8 of the European Convention on Human Rights. In America, the implicit right to privacy always fell flat when running against the Supreme Court's fidelity to the First Amendment.
A right to be forgotten raises practical concerns as well as theoretical. "It's almost absurd to say we have the right to disappear from public domain," said Martin Abrams, a policy director with leading global privacy think tank Hunton & Williams. "We're really talking about the right not to be observed in the first place.... We've been focused on symptoms rather than the underlying issues."
"The Americans run their show, but can they impose their rights on the rest of the planet?
Abrams is far from enthusiastic about Europe's proposed right to be forgotten -- he'd rather people focus on what he considers the real issues of Internet accountability and the increasingly popular notion of "data stewardship" among corporations. Data will inevitably be out there, Abrams believes, and what matters now is a dialogue about how to retire certain data. There is great value, he emphasizes, in using Internet data to model the future and permit innovation -- he brings up positive examples of this, such as Google-supported HealthMap, which tracks infectious diseases around the globe by synthesizing public data. You can't go west and not be known anymore, Abrams believes, but we can move beyond a "rhetoric hump" and reach a more realistic and practical level of dialogue on data responsibility.
"How do you create a space where we're free to analyze the data but not free to abuse the data?" Abrams considers. "We've been asking the wrong questions."
And why is Europe asking questions about the right? Because, Abrams said, Europe is used to legally processing all its data, whereas America grants far more permissive rights of observation of behavior and its data -- which, when extended to the Internet, affect how companies observe and model our activity. The Europeans resist this digital observation without consent. But the European model runs strongly against American traditions of free press and expression. Up until now, the fight for the right to be forgotten has remained largely within the province of Europe. That can't last forever though -- especially given how many global Internet titans remain based in the U.S.
"The Americans run their show," Werro said, "but can they impose their rights on the rest of the planet?" Europeans are, Werro continues, equally sensitive to the use of personal images and especially the "merchantability" of personal data by corporations. A European sensibility would not, he added, easily accept the invasion of privacy that occurs so frequently in American media. He brings up Fox News, which to keep coverage of the Eliot Spitzer scandal alive, chased after the prostitute-in-question's grandfather at 9 p.m. on a Saturday.
Yet on both continents the discussion of Internet privacy is evolving. In December, the U.S. Department of Commerce recommended establishing a Privacy Policy Office, its potential role "acting as both a convener of diverse stakeholders and a center of Administration commercial data privacy policy expertise" to address what it calls "a continuum of risks to personal privacy" (PDF). Another U.S. goal is to establish "global privacy interoperability" to reduce the friction and costs American companies have been incurring as they face the "omnibus privacy laws" adopted in the European Union. In late January, both Google and Mozilla presented people with an option to opt out of being tracked online for advertising purposes.
These basic privacy concerns are universal, but the right to be forgotten -- and the potential precedent its adoption could set -- takes the concern over privacy many steps further. As in Madrid this January, the European sensibility is colliding in powerful ways directly with U.S.-based, transnational corporations bred on American values of both expression and profit. The fight is hardly over.
"I wonder at times," Werro said, "if this conception of privacy in Europe could be wiped out."
http://www.theatlantic.com/technology/archive/2011/02/in-europe-a-right-to-be-forgotten-trumps-objectivity-of-the-internet/70643/
A quarter-century after coming to the United States, Franz Werro still thinks like a European. The 54-year-old Georgetown law professor, born and raised in Switzerland, is troubled when ads in French automatically pop up on his American laptop. The computer assumes that's what he wants. We live naked on the Internet, Werro knows, in a brave new world where our data lives forever. Google your name, and you'll stumble onto drunken photos from college, a misguided quote given to a reporter five years ago, court records, ancient 1 a.m. blog comments, that outdated Friendster profile ... the list goes on, a river of data creating a profile of who you are for anyone searching online: friend, merchant, or potential future employer. Werro's American students rarely mind.
But America is not Europe, and despite our no-secrets age of WikiLeaks, Europe wants to enshrine a special form of privacy into law. Individuals should, according to many in Europe, possess what they call a "right to be forgotten" on the Internet.
How do you create a space where we're free to analyze the data but not free to abuse the data? We've been asking the wrong questions.
How would this even be possible? This developing right, authorities in several European countries suggest, would allow an individual to control and sometimes eliminate his or her data trail and allow him or her to ask Google to remove select search results -- a newspaper article, say, which once painted him or her in a bad light. A look at recent news events guarantees that this right will only become more relevant in 2011.
On January 19, Google refused Spain's request that the ubiquitous, California-based search engine remove 90 links. Many of the links Spain wanted to remove included newspaper articles and information from public record, often painting the plaintiffs in a bad light. Google called Spain's request "disappointing" in its official statement and emphasized that as a search engine, it should not be responsible for curating Internet content. Removing links would be expensive, Google argued in court, and violate the "objectivity" of the Internet search. Last November, the European Union announced data protection goals for 2011, which include "clarifying the so-called 'right to be forgotten', i.e. the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes" (PDF).
The EU explicitly said that users should have the right. It has already been heavily discussed and praised in countries such as France, whose President Sarkozy said last year: "Regulating the Internet to correct the excesses and abuses that come from the total absence of rules is a moral imperative!" France's leadership at the coming G8 summit also signifies more dialogue, as Sarkozy hopes to discuss the right on an international stage.
These European concerns rarely come up in the United States. People may worry about Facebook's privacy settings, but few would suggest an individual has a right to remove an offending Gawker post from Google's index. After all, who decides? A person might want an embarrassing photo removed from record, but what if the photo features not only that person but four others? The question of censorship is inevitable. The closest manifestation on this side of the Atlantic is likely a paper from the ACLU lobbying for a "right to delete" (PDF). Why, then, have our two sprawling yet similar Western cultures responded so differently to Internet privacy?
In Europe, the idea that privacy should overrule free expression is nothing new. Professor Franz Werro keenly highlights the historical difference in a 2009 academic paper and points to a 1983 case in Switzerland. Swiss TV had planned to air a documentary about a criminal from the 1930s. Swiss law, however, forbade the airing of the program -- the European court "held that the documentary would unjustifiably violate plaintiff's privacy right to keep his feelings as a son from being trampled." Yale law professor James Whitman sees the differing concepts of privacy as a battle between liberty and dignity (here, the PDF of his 2004 journal article).
Transatlantic clashes over privacy in recent years have included the use of Google's Street View in Germany, Switzerland, the Czech Republic, and elsewhere. German criminals sued Wikipedia in 2009 to have their names scrubbed. A little less than a year ago, an Italian court successfully sued Google for allowing a user to post offensive video. The fact that many of the Internet companies such as Facebook and Google are located in the United States (where, as Werro says, there is "fetishization" of the constitutional First Amendment of free speech) creates deeper problems in the courtroom, as it did in Google's recent refusal in Madrid.
American companies favor American law if possible, no matter what country they operate in. In Europe, the courts balance a right to a free press with rights of privacy, of personality, and of dignity, protected in Article 8 of the European Convention on Human Rights. In America, the implicit right to privacy always fell flat when running against the Supreme Court's fidelity to the First Amendment.
A right to be forgotten raises practical concerns as well as theoretical. "It's almost absurd to say we have the right to disappear from public domain," said Martin Abrams, a policy director with leading global privacy think tank Hunton & Williams. "We're really talking about the right not to be observed in the first place.... We've been focused on symptoms rather than the underlying issues."
"The Americans run their show, but can they impose their rights on the rest of the planet?
Abrams is far from enthusiastic about Europe's proposed right to be forgotten -- he'd rather people focus on what he considers the real issues of Internet accountability and the increasingly popular notion of "data stewardship" among corporations. Data will inevitably be out there, Abrams believes, and what matters now is a dialogue about how to retire certain data. There is great value, he emphasizes, in using Internet data to model the future and permit innovation -- he brings up positive examples of this, such as Google-supported HealthMap, which tracks infectious diseases around the globe by synthesizing public data. You can't go west and not be known anymore, Abrams believes, but we can move beyond a "rhetoric hump" and reach a more realistic and practical level of dialogue on data responsibility.
"How do you create a space where we're free to analyze the data but not free to abuse the data?" Abrams considers. "We've been asking the wrong questions."
And why is Europe asking questions about the right? Because, Abrams said, Europe is used to legally processing all its data, whereas America grants far more permissive rights of observation of behavior and its data -- which, when extended to the Internet, affect how companies observe and model our activity. The Europeans resist this digital observation without consent. But the European model runs strongly against American traditions of free press and expression. Up until now, the fight for the right to be forgotten has remained largely within the province of Europe. That can't last forever though -- especially given how many global Internet titans remain based in the U.S.
"The Americans run their show," Werro said, "but can they impose their rights on the rest of the planet?" Europeans are, Werro continues, equally sensitive to the use of personal images and especially the "merchantability" of personal data by corporations. A European sensibility would not, he added, easily accept the invasion of privacy that occurs so frequently in American media. He brings up Fox News, which to keep coverage of the Eliot Spitzer scandal alive, chased after the prostitute-in-question's grandfather at 9 p.m. on a Saturday.
Yet on both continents the discussion of Internet privacy is evolving. In December, the U.S. Department of Commerce recommended establishing a Privacy Policy Office, its potential role "acting as both a convener of diverse stakeholders and a center of Administration commercial data privacy policy expertise" to address what it calls "a continuum of risks to personal privacy" (PDF). Another U.S. goal is to establish "global privacy interoperability" to reduce the friction and costs American companies have been incurring as they face the "omnibus privacy laws" adopted in the European Union. In late January, both Google and Mozilla presented people with an option to opt out of being tracked online for advertising purposes.
These basic privacy concerns are universal, but the right to be forgotten -- and the potential precedent its adoption could set -- takes the concern over privacy many steps further. As in Madrid this January, the European sensibility is colliding in powerful ways directly with U.S.-based, transnational corporations bred on American values of both expression and profit. The fight is hardly over.
"I wonder at times," Werro said, "if this conception of privacy in Europe could be wiped out."
http://www.theatlantic.com/technology/archive/2011/02/in-europe-a-right-to-be-forgotten-trumps-objectivity-of-the-internet/70643/
Tuesday, February 1, 2011
Peter Swire: Getting Online Privacy Policy Right
Commerce Department Considers New Private Policy Office
By Peter Swire Center for American Progress January 28, 2011
Online privacy is drawing increasing attention from policy makers, the press, and the public due to rapid changes in social networking, online targeted advertising, and location-based services for smart phones.
Last month, the Department of Commerce asked for comment on its new green paper, entitled “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.” One important proposal in the green paper was to create a Privacy Policy Office in the Department of Commerce.
I have submitted comments explaining “Why the Federal Government Should Have a Privacy Policy Office.” The chief criticism of the proposal is that the new office would weaken privacy protection. In one vivid turn of phrase, Jeff Chester of the Center for Digital Democracy said: “Having the Commerce Department play a role in protecting privacy will enable the data collection foxes to run the consumer privacy henhouse.” Chester and other privacy advocates essentially argue that having the Commerce Department play a role in privacy policy will dilute the effectiveness of the Federal Trade Commission’s privacy efforts.
I disagree, and reach three conclusions, which I explain below. My comments also consider whether the new office should be placed in the Department of Commerce, as the green paper recommends, or else in the Executive Office of the President, where I served as chief counselor for privacy under President Clinton. I conclude that the important thing is to ensure an ongoing privacy policy capability in the executive branch, while a good case can be made for housing it either in the Commerce Department or the Executive Office of the President.
Why the Federal Government Should Have a Privacy Policy Office
These comments support the creation of a Privacy Policy Office in the executive branch, as called for in the Department of Commerce green paper, “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.”
The chief criticism of this proposal is that the office would weaken privacy protection. In one vivid turn of phrase, Jeff Chester of the Center for Digital Democracy said: “Having the Commerce Department play a role in protecting privacy will enable the data collection foxes to run the consumer privacy henhouse.” Mr. Chester and other privacy advocates essentially argue that having the Commerce Department play a role in privacy policy will dilute the effectiveness of the Federal Trade Commission’s privacy efforts.
I disagree. My comments support three conclusions:
Background on privacy and the department of commerce
Much as is occurring this year, the FTC and Commerce Departments played complementary roles in the mid- to late-1990s in developing privacy policy. At the Federal Trade Commission, privacy initiatives were pushed by Chairman Robert Pitofsky, Commissioners Mozelle Thompson and Christine Varney, and Director of the Consumer Protection Bureau Jodie Bernstein (along with her dedicated staff, led by David Medine). At the Commerce Department, Barbara Wellbery and Becky Burr played important roles, as did Administrator of the National Telecommunications and Information Administration Larry Irving, General Counsel Andy Pincus, Undersecretary for the International Trade Administration David Aaron, and Secretary William Daley. The history of the FTC’s involvement in this period has been well discussed in work by Kenneth Bamberger and Deirdre Mulligan.
The vital work in that period of the Department of Commerce has been less fully discussed.[1] In 1997, Secretary Daley personally hosted a major conference and report on “Privacy and Self-Regulation in the Information Age.” That conference engaged many of the persons, and developed many of the concepts, that shaped U.S. privacy policy in the following years.[2] The department then led the complex and ongoing negotiations with the European Union about how to reconcile the E.U. Data Protection Directive and U.S. law, culminating in the Safe Harbor agreement in 2000, which is still in effect today. For the Safe Harbor and in numerous other privacy issues, the department, including its International Trade Administration, brought expertise to bear on topics such as e-commerce, international trade, and how privacy fits into broader business practices.
In the summer of 1998, Vice President Al Gore announced that a privacy policy position would be created in the U.S. Office of Management and Budget. As discussed further below, I entered the role of chief counselor for privacy in early 1999, and worked closely with the Department of Commerce, the FTC, and other agencies until early 2001. Under President George W. Bush, the Commerce Department administered the Safe Harbor program, but did not play as visible a policy role on privacy.
Under President Obama, Secretary Gary Locke created the Internet Policy Task Force , which has published the green paper that is the subject of these comments, entitled “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.” The green paper states:
A complementary role for a privacy office in Commerce: The importance of clearance and international privacy issues
To assess the potential usefulness of the PPO, it helps to first understand some important roles played by the Federal Trade Commission in privacy protection:
The role of “clearance” is particularly important yet often little understood. In a 2000 document prepared for publication in the Stanford Law Review but not actually published, I went into some detail on the subject. To ensure a unified administration position, for congressional testimony, executive orders, and many other documents, drafts of documents are circulated among the various agencies and components of the Executive Office of the President. Once comments are received, discussions are sometimes needed to resolve differences of opinion, with appeal to more senior officials if differences are not resolved at lower levels. In addition to these structured clearance procedures, agency experts on an issue such as privacy often get engaged earlier in the policy planning process, in a variety of working groups and less-formal methods of sharing expertise and views.
In my experience, an independent agency, such as the FTC, has a sharply limited ability to participate in the Administration’s clearance process. On some occasions, a draft document may be shared with the FTC, often early in a policy process, for whatever input the commission may wish to offer. The decision making, however, is done by persons in the executive branch, notably the Executive Office of the President and cabinet agencies such as the Department of Commerce. There are important and long-standing reasons for this separation between independent and executive agencies—the separation avoids the appearance of political pressure on independent agencies. Separation is especially important for enforcement decisions—the FTC has true independence on what enforcement actions it brings, but the corollary is that the FTC is not “inside” the administration when it comes to creating administration policy. A variety of rules exist to limit the interaction of independent agencies and the executive branch; new White House officials, for instance, are briefed by counsel to exercise great caution in their interaction with independent agencies.
As an example of the constructive role in clearance played by the Department of Commerce, consider testimony in 2010 on the controversial question of whether and how to amend the Electronic Communication Privacy Act of 1986. ECPA is an important law for law enforcement—it sets forth the standards by which police and prosecutors can get access to emails and other electronic communications. ECPA, though, is also an important law about corporations and personal privacy. For corporations, ECPA sets the rules for what sorts of access to corporate databases should be permitted, under what circumstances and at what cost. For individuals whose records may be seen by law enforcement, ECPA creates the rules of the road for privacy protection, especially in our modern world when many records are stored in the “cloud” and thus at least potentially accessible to law enforcement.
ECPA thus provides one example of how multiple, compelling values can come into play in clearing the administration’s testimony to Congress. On September 22, 2010, both James Baker of the Department of Justice and Cameron Kerry of the Commerce Department testified before the Senate Judiciary Committee. Under the clearance rules, the testimony of both witnesses had to be shared in advance with the other, and the administration had to develop a common position. In my experience, sharing a draft document with an agency with a sharply different perspective is often extremely valuable—assumptions held in the initial agency get challenged, overstatements are modified, and the number of mistakes is reduced. Although I have no direct knowledge of the clearance process in this instance,[3] I think it quite possible that the presence of the Department of Commerce in the process helped create a more nuanced and privacy-protective administration position.
The ability of an independent agency such as the FTC to have a similar role in clearance is sharply limited. Based on my own experience, and on background discussions with people at the FTC, the FTC is not staffed well enough or situated close enough to the “inside” to engage on the day-to-day clearance of documents on the many law enforcement issues affecting commerce and privacy, including ECPA, the Communications Assistance to Law Enforcement Act, rules about encryption controls, and so forth.
From my time as chief counselor for privacy, the number of privacy issues addressed by federal agencies is far greater than realized by most people who have worked primarily on privacy with the FTC. I offer a list here as an illustration of the sorts of privacy issues that can arise in each of the cabinet departments. For many of the agency activities, there are important implications for commerce, providing a natural role for the Department of Commerce on commercial privacy issues. For others, the link to commerce is less direct, but a broad-based experience with privacy issues at the Department of Commerce will facilitate development of a sound administration position on privacy:
· Department of Agriculture. Migrant worker records
· Department of Defense and Veterans Affairs. Records of service members
· Department of Education. Education records, including for for-profit institutions
· Department of Energy. Smart grid
· Department of Health and Human Services. Medical records; many forms of human services records
· Department of Homeland Security. Numerous issues, including transportation safety and immigration
· Department of Housing and Urban Development. Public housing records
· Department of Interior. National park reservations and other services provided online
· Department of Justice. Numerous issues
· Department of Labor. Records of union membership
· Department of State. International privacy issues
· Department of Transportation. Smart roads
· Department of Treasury. Financial privacy; money laundering
Along with clearance, another role for the executive branch is to develop and announce the administration position in international settings. The green paper discusses the office’s role in international privacy activities, but is worth explaining a bit how this would complement any international activities by the FTC.
The FTC plays at least three roles on international privacy issues. First, the FTC is the designated enforcement agency for complaints under the U.S.-E.U. Safe Harbor. Second, the FTC’s overall privacy expertise and convening functions inform international discussions about privacy issues, and there has been international cooperation on enforcement actions. Third, last year the FTC for the first time received full member status in the closed session of data protection authorities at the International Conference of Data Protection and Privacy Commissioners. Executive branch officials continue to attend the closed session, as they have since 1999, but with “observer” status.
These important FTC international activities, however, do not replace the need for the executive branch to have policy capability about privacy. For instance, privacy and e-commerce issues arise in a wide range of bilateral and multilateral trade negotiations—because transborder data flows are such an important part of modern commerce, data-related issues can arise as one piece of many larger trade negotiations, which often involve the International Trade Administration of the Department of Commerce. Some multilateral fora persistently address privacy issues, such as the Asia-Pacific Economic Cooperation and the Organization for International Cooperation and Development. The U.S. delegations for these activities are led by the executive branch, with representation from the Commerce and State Departments.
More generally, the clearance process applies to developing and implementing the position of the United States in international negotiations. The FTC as an independent agency would have no basis for making representations, for instance, about what any executive branch agency would accept, including for law enforcement, homeland security, and non-privacy commercial issues. There is thus a sound basis for the green paper’s recommendation that the office “would work in concert with the Executive Office of the President as the Administration’s lead on international outreach for commercial data privacy policy.”
Whether privacy policy should be centered in the Commerce Department or the executive office of the president
I believe there is an extremely strong case in favor of developing an ongoing privacy policy capability in the executive branch. Privacy policy requires familiarity with a complex set of legal, technological, market, and consumer considerations. Good government thus calls for creating an institutional memory and a group of civil servants experienced in privacy policy. This privacy policy capability goes well beyond the need for federal agencies to comply with the Privacy Act and implement good practices for the personal information they hold.
Where to locate this privacy policy capability is less clear. In a 1998 book, Robert Litan and I discussed the question in detail, and concluded that a privacy policy office should be created in the Department of Commerce.[4] From 1999 until early 2001, by contrast, I served in the role of chief counselor for privacy in the U.S. Office of Management and Budget, and I have written reasons for supporting that approach as well.
The chief advantages and disadvantages are mirror images of each other. Placing the office in the Commerce Department allows for substantially greater staffing, increasing the chance that institutional expertise will accumulate through the ups and downs of public attention to privacy protection. The Commerce Department, however, will be only one of the various agencies that may have views on a particular privacy issue, increasing the risk that privacy will lose out in clearance. On the other hand, placing the policy leadership in OMB or elsewhere in the Executive Office of the President likely improves the possibility of effective coordination of privacy policy across the various agencies. Staffing, however, is always tight at the White House. The chief counselor for privacy, at most, had two full-time staff and one detailee from the Commerce Department.
One model worth considering is the position that Howard Schmidt now fills as cybersecurity coordinator. Mr. Schmidt is part of the national security staff, and also coordinates with the National Economic Council. My understanding is that a significant amount of support for the cybersecurity coordinator is provided by various agencies rather than directly by staff of the Executive Office of the President. A hybrid approach of this sort might achieve more effective privacy policy coordination while also retaining ongoing staffing.
This sort of role might also usefully integrate with the Privacy and Civil Liberties Oversight Board, for which President Obama recently nominated James Dempsey and Elizabeth Collins Cook. That board, to be effective, should have professional staff to carry out its task of working on privacy and civil liberties issues that affect anti-terrorist activities. As shown by the example of the Electronic Communications Privacy Act, anti-terrorist and law enforcement activities often have intricate interconnections with the commercial actors that own and operate most of the infrastructure for processing personal information. It quite possibly makes sense to permit dual tasking of personnel assigned to the board to work on privacy issues that concern commercial privacy. If this were done, an Executive Office of the President role for a privacy coordinator could be supported both by commercial privacy experts and persons assigned to the oversight board.
In short, various institutional choices might succeed for institutionalizing privacy policy in the executive branch. The privacy policy capability prior to 2009, and it is a good sign that the Department of Commerce green paper is reinvigorating the debate about how best to protect privacy policy while achieving other important goals.
Conclusion
In conclusion, the comments here show important tasks for a Privacy Policy Office in the executive branch, which would complement the FTC’s ongoing privacy activities. Notably, such an office would improve interagency clearance, and be important in developing and stating the position of the United States government in international settings. Based on my own discussions with people at the FTC, the FTC does not have the budget or institutional structure to attempt to participate in all of the issues touching on commercial privacy throughout the federal government.
Because these functions complement the existing activities of the FTC, the general effect of such an office would be to improve privacy policy expertise and capabilities, contrary to the concerns expressed by some privacy advocates that such an office would undermine privacy protections. In addition to the advantages described above, executive branch participation in development of industry codes of conduct permits expert input from a range of federal agencies and also brings those agencies up to speed on evolving technology. Another advantage is that an executive branch privacy capability can lend force to privacy legislative or other initiatives—when both the FTC and the administration work together on an issue, the combined effect is likely to be greater than when an independent agency such as the FTC acts alone. Because the administration is likely to be asked to provide its views on important legislation in any event, the existence of an ongoing privacy office in the executive branch will lead to better-informed privacy policy decisions by the administration.
The existence of such an office would also provide a more effective structure for the administration to weigh privacy concerns with other competing policy goals and values. The hope, which I believe is supported by experience, is that participation by privacy experts in executive branch decisions increases the likelihood of win-win situations, in which privacy goals are better achieved and other goals as well.
In short, the Department of Commerce deserves praise for advancing the idea of an ongoing Privacy Policy Office as part of its green paper.
Download this memo (pdf)
Download the memo to mobile devices and e-readers from Scribd
Peter Swire is the C. William O’Neill Professor of Law at the Moritz College of Law of the Ohio State University, and a Senior Fellow at the Center of American Progress. From 1999 through early 2001 he served as Chief Counselor for Privacy in the U.S. Office of Management and Budget. From 2009 through August, 2010 he served as Special Assistant to the President for Economic Policy, including on privacy and related technology issues.
Endnotes
[1] One reason may be the untimely death in 2003 of Barbara Wellbery, who worked tirelessly to address the issues of U.S. and E.U. relations in connection with the European Union Data Protection Directive and was instrumental to creation of the Safe Harbor privacy program that is now administered by the Department of Commerce.
[2] The conference invitation pushed me to write “Markets, Self-regulation, and Government Enforcement in the Protection of Personal Information,” my first article specifically on privacy issues.
[3] I served in the National Economic Council until August 2010, before the September 2010 testimony described in the text.
[4] Peter P. Swire and Robert E. Litan, None of Your Business: World Data Flows, Electronic Commerce, and the European Privacy Directive (Brookings, 1998), at 179-188.
To speak with our experts on this topic, please contact:
Print: Megan Smith (health care, education, economic policy)
202.741.6346 or msmith@americanprogress.org
Print: Anna Soellner (foreign policy and security, energy)asoellner@americanprogress.org
Print: Raúl Arce-Contreras (ethnic media, immigration)
202.478.5318 or rarcecontreras@americanprogress.org
Radio: Anne Shoup
202.481.7146 or ashoup@americanprogress.org
TV: Andrea Purse
202.741.6250 or apurse@americanprogress.org
Web: Erin Lindsay
202.741.6397 or elindsay@americanprogress.org
By Peter Swire Center for American Progress January 28, 2011
Online privacy is drawing increasing attention from policy makers, the press, and the public due to rapid changes in social networking, online targeted advertising, and location-based services for smart phones.
Last month, the Department of Commerce asked for comment on its new green paper, entitled “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.” One important proposal in the green paper was to create a Privacy Policy Office in the Department of Commerce.
I have submitted comments explaining “Why the Federal Government Should Have a Privacy Policy Office.” The chief criticism of the proposal is that the new office would weaken privacy protection. In one vivid turn of phrase, Jeff Chester of the Center for Digital Democracy said: “Having the Commerce Department play a role in protecting privacy will enable the data collection foxes to run the consumer privacy henhouse.” Chester and other privacy advocates essentially argue that having the Commerce Department play a role in privacy policy will dilute the effectiveness of the Federal Trade Commission’s privacy efforts.
I disagree, and reach three conclusions, which I explain below. My comments also consider whether the new office should be placed in the Department of Commerce, as the green paper recommends, or else in the Executive Office of the President, where I served as chief counselor for privacy under President Clinton. I conclude that the important thing is to ensure an ongoing privacy policy capability in the executive branch, while a good case can be made for housing it either in the Commerce Department or the Executive Office of the President.
Why the Federal Government Should Have a Privacy Policy Office
These comments support the creation of a Privacy Policy Office in the executive branch, as called for in the Department of Commerce green paper, “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.”
The chief criticism of this proposal is that the office would weaken privacy protection. In one vivid turn of phrase, Jeff Chester of the Center for Digital Democracy said: “Having the Commerce Department play a role in protecting privacy will enable the data collection foxes to run the consumer privacy henhouse.” Mr. Chester and other privacy advocates essentially argue that having the Commerce Department play a role in privacy policy will dilute the effectiveness of the Federal Trade Commission’s privacy efforts.
I disagree. My comments support three conclusions:
- 1. The office would provide important benefits to complement what the FTC does. As part of the executive branch, the office would make distinctive contributions to building privacy policy into the development and implementation of U.S. government positions for domestic and international policy. Relatedly, the office would be able to draw on the perspectives and expertise of other federal agencies far more effectively than can an independent agency such as the FTC.
2. The likely outcome with an office would be better protection of privacy than would occur without the office.
3. The likely outcome with an office would be better achievement of other policy goals than would occur without the office.
Background on privacy and the department of commerce
Much as is occurring this year, the FTC and Commerce Departments played complementary roles in the mid- to late-1990s in developing privacy policy. At the Federal Trade Commission, privacy initiatives were pushed by Chairman Robert Pitofsky, Commissioners Mozelle Thompson and Christine Varney, and Director of the Consumer Protection Bureau Jodie Bernstein (along with her dedicated staff, led by David Medine). At the Commerce Department, Barbara Wellbery and Becky Burr played important roles, as did Administrator of the National Telecommunications and Information Administration Larry Irving, General Counsel Andy Pincus, Undersecretary for the International Trade Administration David Aaron, and Secretary William Daley. The history of the FTC’s involvement in this period has been well discussed in work by Kenneth Bamberger and Deirdre Mulligan.
The vital work in that period of the Department of Commerce has been less fully discussed.[1] In 1997, Secretary Daley personally hosted a major conference and report on “Privacy and Self-Regulation in the Information Age.” That conference engaged many of the persons, and developed many of the concepts, that shaped U.S. privacy policy in the following years.[2] The department then led the complex and ongoing negotiations with the European Union about how to reconcile the E.U. Data Protection Directive and U.S. law, culminating in the Safe Harbor agreement in 2000, which is still in effect today. For the Safe Harbor and in numerous other privacy issues, the department, including its International Trade Administration, brought expertise to bear on topics such as e-commerce, international trade, and how privacy fits into broader business practices.
In the summer of 1998, Vice President Al Gore announced that a privacy policy position would be created in the U.S. Office of Management and Budget. As discussed further below, I entered the role of chief counselor for privacy in early 1999, and worked closely with the Department of Commerce, the FTC, and other agencies until early 2001. Under President George W. Bush, the Commerce Department administered the Safe Harbor program, but did not play as visible a policy role on privacy.
Under President Obama, Secretary Gary Locke created the Internet Policy Task Force , which has published the green paper that is the subject of these comments, entitled “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.” The green paper states:
- Recommendation #4: Using existing resources, the Commerce Department should establish a Privacy Policy Office (PPO) to serve as a center of commercial data privacy policy expertise. The proposed PPO would have the authority to convene multi-stakeholder discussions of commercial data privacy implementation models, best practices, codes of conduct, and other areas that would benefit from bringing stakeholders together; and it would work in concert with the Executive Office of the President as the Administration’s lead on international outreach for commercial data privacy policy. The PPO would be a peer of other Administration offices and components that have data privacy responsibilities; but, because the PPO would focus solely on commercial data privacy, its functions would not overlap with existing Administration offices. Nor would the PPO have any enforcement authority.
A complementary role for a privacy office in Commerce: The importance of clearance and international privacy issues
To assess the potential usefulness of the PPO, it helps to first understand some important roles played by the Federal Trade Commission in privacy protection:
- 1. Enforcement. The FTC has the power to bring enforcement actions against “unfair and deceptive trade practices,” and has negotiated consent decrees on privacy with both large and small companies.
2. Rulemaking.In specific areas, such as children’s online privacy and anti-spam measures, the FTC has explicit authority to issue rules under the Administrative Procedure Act. More broadly, the FTC could write rules under the more burdensome procedures created by the Magnuson-Moss Act, but it has not chosen to do so on privacy.
3. Convener.The FTC has brought together stakeholders in a variety of ways to discuss emerging online privacy issues, and in some instances catalyze industry self-regulatory codes of conduct.
4. Institutional expertise. Leading members of today’s FTC efforts were also active during the privacy debates of the 1990’s. The continuity of FTC staff has contributed to the commission’s institutional expertise on privacy issues.
5. Bully pulpit. Top FTC officials and staff direct the attention of companies toward emerging privacy issues.
The role of “clearance” is particularly important yet often little understood. In a 2000 document prepared for publication in the Stanford Law Review but not actually published, I went into some detail on the subject. To ensure a unified administration position, for congressional testimony, executive orders, and many other documents, drafts of documents are circulated among the various agencies and components of the Executive Office of the President. Once comments are received, discussions are sometimes needed to resolve differences of opinion, with appeal to more senior officials if differences are not resolved at lower levels. In addition to these structured clearance procedures, agency experts on an issue such as privacy often get engaged earlier in the policy planning process, in a variety of working groups and less-formal methods of sharing expertise and views.
In my experience, an independent agency, such as the FTC, has a sharply limited ability to participate in the Administration’s clearance process. On some occasions, a draft document may be shared with the FTC, often early in a policy process, for whatever input the commission may wish to offer. The decision making, however, is done by persons in the executive branch, notably the Executive Office of the President and cabinet agencies such as the Department of Commerce. There are important and long-standing reasons for this separation between independent and executive agencies—the separation avoids the appearance of political pressure on independent agencies. Separation is especially important for enforcement decisions—the FTC has true independence on what enforcement actions it brings, but the corollary is that the FTC is not “inside” the administration when it comes to creating administration policy. A variety of rules exist to limit the interaction of independent agencies and the executive branch; new White House officials, for instance, are briefed by counsel to exercise great caution in their interaction with independent agencies.
As an example of the constructive role in clearance played by the Department of Commerce, consider testimony in 2010 on the controversial question of whether and how to amend the Electronic Communication Privacy Act of 1986. ECPA is an important law for law enforcement—it sets forth the standards by which police and prosecutors can get access to emails and other electronic communications. ECPA, though, is also an important law about corporations and personal privacy. For corporations, ECPA sets the rules for what sorts of access to corporate databases should be permitted, under what circumstances and at what cost. For individuals whose records may be seen by law enforcement, ECPA creates the rules of the road for privacy protection, especially in our modern world when many records are stored in the “cloud” and thus at least potentially accessible to law enforcement.
ECPA thus provides one example of how multiple, compelling values can come into play in clearing the administration’s testimony to Congress. On September 22, 2010, both James Baker of the Department of Justice and Cameron Kerry of the Commerce Department testified before the Senate Judiciary Committee. Under the clearance rules, the testimony of both witnesses had to be shared in advance with the other, and the administration had to develop a common position. In my experience, sharing a draft document with an agency with a sharply different perspective is often extremely valuable—assumptions held in the initial agency get challenged, overstatements are modified, and the number of mistakes is reduced. Although I have no direct knowledge of the clearance process in this instance,[3] I think it quite possible that the presence of the Department of Commerce in the process helped create a more nuanced and privacy-protective administration position.
The ability of an independent agency such as the FTC to have a similar role in clearance is sharply limited. Based on my own experience, and on background discussions with people at the FTC, the FTC is not staffed well enough or situated close enough to the “inside” to engage on the day-to-day clearance of documents on the many law enforcement issues affecting commerce and privacy, including ECPA, the Communications Assistance to Law Enforcement Act, rules about encryption controls, and so forth.
From my time as chief counselor for privacy, the number of privacy issues addressed by federal agencies is far greater than realized by most people who have worked primarily on privacy with the FTC. I offer a list here as an illustration of the sorts of privacy issues that can arise in each of the cabinet departments. For many of the agency activities, there are important implications for commerce, providing a natural role for the Department of Commerce on commercial privacy issues. For others, the link to commerce is less direct, but a broad-based experience with privacy issues at the Department of Commerce will facilitate development of a sound administration position on privacy:
· Department of Agriculture. Migrant worker records
· Department of Defense and Veterans Affairs. Records of service members
· Department of Education. Education records, including for for-profit institutions
· Department of Energy. Smart grid
· Department of Health and Human Services. Medical records; many forms of human services records
· Department of Homeland Security. Numerous issues, including transportation safety and immigration
· Department of Housing and Urban Development. Public housing records
· Department of Interior. National park reservations and other services provided online
· Department of Justice. Numerous issues
· Department of Labor. Records of union membership
· Department of State. International privacy issues
· Department of Transportation. Smart roads
· Department of Treasury. Financial privacy; money laundering
Along with clearance, another role for the executive branch is to develop and announce the administration position in international settings. The green paper discusses the office’s role in international privacy activities, but is worth explaining a bit how this would complement any international activities by the FTC.
The FTC plays at least three roles on international privacy issues. First, the FTC is the designated enforcement agency for complaints under the U.S.-E.U. Safe Harbor. Second, the FTC’s overall privacy expertise and convening functions inform international discussions about privacy issues, and there has been international cooperation on enforcement actions. Third, last year the FTC for the first time received full member status in the closed session of data protection authorities at the International Conference of Data Protection and Privacy Commissioners. Executive branch officials continue to attend the closed session, as they have since 1999, but with “observer” status.
These important FTC international activities, however, do not replace the need for the executive branch to have policy capability about privacy. For instance, privacy and e-commerce issues arise in a wide range of bilateral and multilateral trade negotiations—because transborder data flows are such an important part of modern commerce, data-related issues can arise as one piece of many larger trade negotiations, which often involve the International Trade Administration of the Department of Commerce. Some multilateral fora persistently address privacy issues, such as the Asia-Pacific Economic Cooperation and the Organization for International Cooperation and Development. The U.S. delegations for these activities are led by the executive branch, with representation from the Commerce and State Departments.
More generally, the clearance process applies to developing and implementing the position of the United States in international negotiations. The FTC as an independent agency would have no basis for making representations, for instance, about what any executive branch agency would accept, including for law enforcement, homeland security, and non-privacy commercial issues. There is thus a sound basis for the green paper’s recommendation that the office “would work in concert with the Executive Office of the President as the Administration’s lead on international outreach for commercial data privacy policy.”
Whether privacy policy should be centered in the Commerce Department or the executive office of the president
I believe there is an extremely strong case in favor of developing an ongoing privacy policy capability in the executive branch. Privacy policy requires familiarity with a complex set of legal, technological, market, and consumer considerations. Good government thus calls for creating an institutional memory and a group of civil servants experienced in privacy policy. This privacy policy capability goes well beyond the need for federal agencies to comply with the Privacy Act and implement good practices for the personal information they hold.
Where to locate this privacy policy capability is less clear. In a 1998 book, Robert Litan and I discussed the question in detail, and concluded that a privacy policy office should be created in the Department of Commerce.[4] From 1999 until early 2001, by contrast, I served in the role of chief counselor for privacy in the U.S. Office of Management and Budget, and I have written reasons for supporting that approach as well.
The chief advantages and disadvantages are mirror images of each other. Placing the office in the Commerce Department allows for substantially greater staffing, increasing the chance that institutional expertise will accumulate through the ups and downs of public attention to privacy protection. The Commerce Department, however, will be only one of the various agencies that may have views on a particular privacy issue, increasing the risk that privacy will lose out in clearance. On the other hand, placing the policy leadership in OMB or elsewhere in the Executive Office of the President likely improves the possibility of effective coordination of privacy policy across the various agencies. Staffing, however, is always tight at the White House. The chief counselor for privacy, at most, had two full-time staff and one detailee from the Commerce Department.
One model worth considering is the position that Howard Schmidt now fills as cybersecurity coordinator. Mr. Schmidt is part of the national security staff, and also coordinates with the National Economic Council. My understanding is that a significant amount of support for the cybersecurity coordinator is provided by various agencies rather than directly by staff of the Executive Office of the President. A hybrid approach of this sort might achieve more effective privacy policy coordination while also retaining ongoing staffing.
This sort of role might also usefully integrate with the Privacy and Civil Liberties Oversight Board, for which President Obama recently nominated James Dempsey and Elizabeth Collins Cook. That board, to be effective, should have professional staff to carry out its task of working on privacy and civil liberties issues that affect anti-terrorist activities. As shown by the example of the Electronic Communications Privacy Act, anti-terrorist and law enforcement activities often have intricate interconnections with the commercial actors that own and operate most of the infrastructure for processing personal information. It quite possibly makes sense to permit dual tasking of personnel assigned to the board to work on privacy issues that concern commercial privacy. If this were done, an Executive Office of the President role for a privacy coordinator could be supported both by commercial privacy experts and persons assigned to the oversight board.
In short, various institutional choices might succeed for institutionalizing privacy policy in the executive branch. The privacy policy capability prior to 2009, and it is a good sign that the Department of Commerce green paper is reinvigorating the debate about how best to protect privacy policy while achieving other important goals.
Conclusion
In conclusion, the comments here show important tasks for a Privacy Policy Office in the executive branch, which would complement the FTC’s ongoing privacy activities. Notably, such an office would improve interagency clearance, and be important in developing and stating the position of the United States government in international settings. Based on my own discussions with people at the FTC, the FTC does not have the budget or institutional structure to attempt to participate in all of the issues touching on commercial privacy throughout the federal government.
Because these functions complement the existing activities of the FTC, the general effect of such an office would be to improve privacy policy expertise and capabilities, contrary to the concerns expressed by some privacy advocates that such an office would undermine privacy protections. In addition to the advantages described above, executive branch participation in development of industry codes of conduct permits expert input from a range of federal agencies and also brings those agencies up to speed on evolving technology. Another advantage is that an executive branch privacy capability can lend force to privacy legislative or other initiatives—when both the FTC and the administration work together on an issue, the combined effect is likely to be greater than when an independent agency such as the FTC acts alone. Because the administration is likely to be asked to provide its views on important legislation in any event, the existence of an ongoing privacy office in the executive branch will lead to better-informed privacy policy decisions by the administration.
The existence of such an office would also provide a more effective structure for the administration to weigh privacy concerns with other competing policy goals and values. The hope, which I believe is supported by experience, is that participation by privacy experts in executive branch decisions increases the likelihood of win-win situations, in which privacy goals are better achieved and other goals as well.
In short, the Department of Commerce deserves praise for advancing the idea of an ongoing Privacy Policy Office as part of its green paper.
Download this memo (pdf)
Download the memo to mobile devices and e-readers from Scribd
Peter Swire is the C. William O’Neill Professor of Law at the Moritz College of Law of the Ohio State University, and a Senior Fellow at the Center of American Progress. From 1999 through early 2001 he served as Chief Counselor for Privacy in the U.S. Office of Management and Budget. From 2009 through August, 2010 he served as Special Assistant to the President for Economic Policy, including on privacy and related technology issues.
Endnotes
[1] One reason may be the untimely death in 2003 of Barbara Wellbery, who worked tirelessly to address the issues of U.S. and E.U. relations in connection with the European Union Data Protection Directive and was instrumental to creation of the Safe Harbor privacy program that is now administered by the Department of Commerce.
[2] The conference invitation pushed me to write “Markets, Self-regulation, and Government Enforcement in the Protection of Personal Information,” my first article specifically on privacy issues.
[3] I served in the National Economic Council until August 2010, before the September 2010 testimony described in the text.
[4] Peter P. Swire and Robert E. Litan, None of Your Business: World Data Flows, Electronic Commerce, and the European Privacy Directive (Brookings, 1998), at 179-188.
To speak with our experts on this topic, please contact:
Print: Megan Smith (health care, education, economic policy)
202.741.6346 or msmith@americanprogress.org
Print: Anna Soellner (foreign policy and security, energy)asoellner@americanprogress.org
Print: Raúl Arce-Contreras (ethnic media, immigration)
202.478.5318 or rarcecontreras@americanprogress.org
Radio: Anne Shoup
202.481.7146 or ashoup@americanprogress.org
TV: Andrea Purse
202.741.6250 or apurse@americanprogress.org
Web: Erin Lindsay
202.741.6397 or elindsay@americanprogress.org
Tuesday, January 11, 2011
New Website Outlines Administration's National Strategy for Trusted Identities in Cyberspace
Following a forum on the Obama Administration’s efforts to enhance online security and privacy with U.S. Secretary of Commerce Gary Locke, White House Cybersecurity Coordinator Howard A. Schmidt, and Silicon Valley business and academic leaders at Stanford University on Friday, Jan. 7, a new website is now available with further information on the administration’s forthcoming National Strategy for Trusted Identities in Cyberspace (NSTIC).
NSTIC aims to help establish voluntary identity solutions and privacy-enhancing technologies that will improve the security and convenience of sensitive online transactions through the process of authenticating individuals, organizations, and underlying infrastructure - such as routers and servers. The Strategy was developed with substantial input from the private sector and the public. It calls for the effort to be led by the private sector, in partnership with the federal government, consumer advocacy organizations, privacy experts, and others.
Hosted at the Stanford Institute for Economic Policy Research (SIEPR) and co-sponsored by TechAmerica, TechNet, the Churchill Club, and the Team for Research in Ubiquitous Secure Technology (TRUST), Friday’s event also featured a panel discussion with industry and privacy experts on the current and future real world applications of trusted identities. Patrick Gallagher, Under Secretary of Commerce for Standards and Technology, and Director of the National Institute of Standards and Technology moderated the panel.
Learn more about NSTIC and see a webcast of the event at: http://www.nist.gov/nstic.
NSTIC aims to help establish voluntary identity solutions and privacy-enhancing technologies that will improve the security and convenience of sensitive online transactions through the process of authenticating individuals, organizations, and underlying infrastructure - such as routers and servers. The Strategy was developed with substantial input from the private sector and the public. It calls for the effort to be led by the private sector, in partnership with the federal government, consumer advocacy organizations, privacy experts, and others.
Hosted at the Stanford Institute for Economic Policy Research (SIEPR) and co-sponsored by TechAmerica, TechNet, the Churchill Club, and the Team for Research in Ubiquitous Secure Technology (TRUST), Friday’s event also featured a panel discussion with industry and privacy experts on the current and future real world applications of trusted identities. Patrick Gallagher, Under Secretary of Commerce for Standards and Technology, and Director of the National Institute of Standards and Technology moderated the panel.
Learn more about NSTIC and see a webcast of the event at: http://www.nist.gov/nstic.
Wednesday, January 5, 2011
Facebook Wants to Supply Your Internet Driver's License
By Simson Garfinkel Technology Review Wednesday, January 5, 2011
And new security measures protect everyone's data.
Although it's not apparent to many, Facebook is in the process of transforming itself from the world's most popular social-media website into a critical part of the Internet's identity infrastructure. If it succeeds, Facebook and Facebook accounts will become an even bigger target for hackers.
As security professionals debate whether the Internet needs an "identity layer"—a uniform protocol for authenticating users' identities—a growing number of websites are voting with their code, adopting "Facebook Connect" as a way for anyone with a Facebook account to log into the site at the click of a button.
Facebook introduced Connect back in July 2008, offering third-party websites tools to coordinate with the user information that Facebook holds, including logins. Thus websites had the option of allowing Facebook users to identify themselves with their Facebook identities.
So, for instance, the Web statistics vendor Alexa gives new users the choice of creating an account by entering a username and a password or by simply clicking the "Connect with Facebook" button. Well-known websites that also use Connect include the Internet Movie Database, Ask.com, and ESPN. Others will almost certainly jump on the bandwagon in 2011.
Facebook's identity system might very well supply something that VeriSign, Microsoft, Yahoo, and Google have all struggled to offer: a single "driver's license" for the Internet. (This leaves aside the question of whether it's a good thing for one company to hold such a position of power.)
A unique combination of factors makes Facebook well suited to being the repository for people's identities on the Internet. Unlike many popular websites, it requires users to register and log in. And Facebook's terms of service require that "users provide their real names and information"—indeed, Facebook has terminated accounts that were created with seemingly fake names or for fictional characters. Since Facebook users invest their accounts with a tremendous amount of durable personal content—including photographs, contact information, and connections to their social network—they are likely to keep a long-term relationship with the site.
This persistence of real identity puts Facebook in a position to solve one of the most pressing problems on the Internet today—the proliferation of user names and passwords.
Contrary to today's practice, there is no reason for most websites to force their users to create usernames and passwords. Most websites don't need or even want or need to manage the identities of their users—they simply want a way to reliably identify their users over time. Media websites, for instance, want to be able to attribute comments and limit spam. Personal-finance websites want to give users a way to monitor highly personal information securely—for example, a portfolio of stocks that the user might enter.
What's more, maintaining a user-identity infrastructure has its risks—as was made painfully clear last month when hackers broke into servers operated by Gawker Media and downloaded the user names and passwords for more than a million of Gawker's accounts. Even though the passwords were encrypted, many were easy to guess, so the accounts could be readily cracked, according to an analysis of the attack by security researchers at the University of Cambridge. Following the attack several unrelated websites, including LinkedIn and Woot, sent e-mail to their users warning them to change their passwords if these were the same ones as they used for Gawker.
Facebook Login lets any website on the planet use its identity infrastructure—and underlying security safeguards. It's easy to implement Facebook Login, simply by adding few lines of code to a web server. Once that change is made, the site's users will see a "Connect with Facebook" button. If they're already logged into Facebook (having recently visited the site), they can just click on it and they're in. If they haven't logged in recently, they are prompted for their Facebook user name and password.
An interesting side benefit for website operators is that Facebook Login provides the site with users' real names (in most cases) and optionallya variety of other information, such as the users' "friends" and "likes." Currently, Facebook doesn't charge websites to use its identity infrastructure or access this additional information, though Facebook certainly could in the future.
Facebook is already well acquainted with Internet security issues, simply because it holds personal data for more than 500 million people. The increased use of the Facebook platform for things beyond social media—a bank in New Zealand, for instance, announced in November that it would allow customers to access banking information on Facebook—obviously raises new concerns. And if the company extends its reach to offer a universal login on the Web, the challenges it's likely to face will become greater still.
Excerpted from Facebook Wants to Supply Your Internet Driver's License - Technology Review
http://www.technologyreview.com/web/27027/?ref=rss&a=f
--------------------------------------------------
Stefaan G. Verhulst
Chief of Research
Markle Foundation
10 Rockefeller Plaza, Floor 16
New York, NY 10020-1903
Tel. 212 713 7630
Cell 646 573 1361
http://www.markle.org
And new security measures protect everyone's data.
Although it's not apparent to many, Facebook is in the process of transforming itself from the world's most popular social-media website into a critical part of the Internet's identity infrastructure. If it succeeds, Facebook and Facebook accounts will become an even bigger target for hackers.
As security professionals debate whether the Internet needs an "identity layer"—a uniform protocol for authenticating users' identities—a growing number of websites are voting with their code, adopting "Facebook Connect" as a way for anyone with a Facebook account to log into the site at the click of a button.
Facebook introduced Connect back in July 2008, offering third-party websites tools to coordinate with the user information that Facebook holds, including logins. Thus websites had the option of allowing Facebook users to identify themselves with their Facebook identities.
So, for instance, the Web statistics vendor Alexa gives new users the choice of creating an account by entering a username and a password or by simply clicking the "Connect with Facebook" button. Well-known websites that also use Connect include the Internet Movie Database, Ask.com, and ESPN. Others will almost certainly jump on the bandwagon in 2011.
Facebook's identity system might very well supply something that VeriSign, Microsoft, Yahoo, and Google have all struggled to offer: a single "driver's license" for the Internet. (This leaves aside the question of whether it's a good thing for one company to hold such a position of power.)
A unique combination of factors makes Facebook well suited to being the repository for people's identities on the Internet. Unlike many popular websites, it requires users to register and log in. And Facebook's terms of service require that "users provide their real names and information"—indeed, Facebook has terminated accounts that were created with seemingly fake names or for fictional characters. Since Facebook users invest their accounts with a tremendous amount of durable personal content—including photographs, contact information, and connections to their social network—they are likely to keep a long-term relationship with the site.
This persistence of real identity puts Facebook in a position to solve one of the most pressing problems on the Internet today—the proliferation of user names and passwords.
Contrary to today's practice, there is no reason for most websites to force their users to create usernames and passwords. Most websites don't need or even want or need to manage the identities of their users—they simply want a way to reliably identify their users over time. Media websites, for instance, want to be able to attribute comments and limit spam. Personal-finance websites want to give users a way to monitor highly personal information securely—for example, a portfolio of stocks that the user might enter.
What's more, maintaining a user-identity infrastructure has its risks—as was made painfully clear last month when hackers broke into servers operated by Gawker Media and downloaded the user names and passwords for more than a million of Gawker's accounts. Even though the passwords were encrypted, many were easy to guess, so the accounts could be readily cracked, according to an analysis of the attack by security researchers at the University of Cambridge. Following the attack several unrelated websites, including LinkedIn and Woot, sent e-mail to their users warning them to change their passwords if these were the same ones as they used for Gawker.
Facebook Login lets any website on the planet use its identity infrastructure—and underlying security safeguards. It's easy to implement Facebook Login, simply by adding few lines of code to a web server. Once that change is made, the site's users will see a "Connect with Facebook" button. If they're already logged into Facebook (having recently visited the site), they can just click on it and they're in. If they haven't logged in recently, they are prompted for their Facebook user name and password.
An interesting side benefit for website operators is that Facebook Login provides the site with users' real names (in most cases) and optionallya variety of other information, such as the users' "friends" and "likes." Currently, Facebook doesn't charge websites to use its identity infrastructure or access this additional information, though Facebook certainly could in the future.
Facebook is already well acquainted with Internet security issues, simply because it holds personal data for more than 500 million people. The increased use of the Facebook platform for things beyond social media—a bank in New Zealand, for instance, announced in November that it would allow customers to access banking information on Facebook—obviously raises new concerns. And if the company extends its reach to offer a universal login on the Web, the challenges it's likely to face will become greater still.
Excerpted from Facebook Wants to Supply Your Internet Driver's License - Technology Review
http://www.technologyreview.com/web/27027/?ref=rss&a=f
--------------------------------------------------
Stefaan G. Verhulst
Chief of Research
Markle Foundation
10 Rockefeller Plaza, Floor 16
New York, NY 10020-1903
Tel. 212 713 7630
Cell 646 573 1361
http://www.markle.org
Subscribe to:
Posts (Atom)