Today the FTC is releasing a major report on privacy. Privacy geeks will read the whole thing–and should, because it represents a lot of careful thinking by folks in the agency.
But if you’re a techie who doesn’t have time to read it all, let me point you to a few of the parts you’ll probably find most interesting.
When you’re reading, keep in mind that the report does not by itself establish any new laws or regulations. It summarizes current law and asks Congress to consider new laws in certain areas, but most of the discussion is about best practices that the FTC thinks well-intentioned companies will want to follow. These best practices are organized in a three-part framework: privacy by design, which means building privacy into your products and practices from the beginning; simplified choice for consumers; and greater transparency about data practices.
With that said, here are four sections of the report that might be of special interest to techies:
- De-identified data (pp. 18-22): Data that is truly de-identified (or anonymous) can’t be used to infer anything about an individual person or device, so it doesn’t raise privacy concerns. Of course, it’s not enough just to say that data is anonymous, or that it falls outside some narrow notion of PII. But beyond that, figuring out whether your dataset is really de-identified can be challenging. If you’re going to claim that data is de-identified, you need to have a good reason–the report calls it a “reasonable level of justified confidence”–for claiming that the data does not allow inferences about individuals. What “reasonable” means–how confident you have to be–depends on how much data there is, and what the consequences of a breach would be. But here’s a good rule of thumb: if you plan to use a dataset to personalize or target content to individual consumers, it’s probably not de-identified.
- Sensitive data (pp. 47-48): Certain types of information, such as health and financial information, information about children, and individual geolocation, are sensitive and ought to be treated with special care, for example by getting explicit consent from users before collecting it. If your service is targeted toward sensitive data, perhaps because of its subject matter or target audience, then you should take extra care to provide transparency and choice and to limit collection and use of information. If you run a general-purpose site that incidentally collects a little bit of sensitive information, your responsibilities will be more limited.
- Mobile disclosures (pp. 33-34): The FTC is concerned that too few mobile apps disclose their privacy practices. Companies often say that users accept their data practices in exchange for getting a service. But how can users accept your practices if you don’t say what they are? A better disclosure would tell users not only what data you’re collecting, but also how you are going to use it and with whom you’ll share it. The challenging part is how to make all of this clear to users without subjecting them to a long privacy policy that they probably won’t have time to read. FTC staff will be holding a workshop to discuss these issues.
- Do Not Track (pp. 52-55): DNT gives users a choice about whether to be tracked by third parties as they move across the web. In this section of the report, the FTC reiterates its five criteria for a successful DNT system, reviews the status of major efforts including the ad industry’s self-regulatory program and the W3C’s work toward a standard for DNT, and talks about what steps remain to get to a system that is practical for consumers and companies alike.
There’s a lot more in the report, and I expect to write more in the future about privacy issues raised by the report. For now, I welcome your comments on this post, or the report generally.
