An Obama administration Internet privacy initiative marks the best chance for setting U.S. standards to shield personal information in the absence of Congressional legislation, consumer groups and lawyers said.
The White House called on companies such as Google Inc. (GOOG) and Facebook Inc. (FB) yesterday to work with privacy advocates to craft voluntary codes of conduct for handling consumer data based on a bill of rights for Web users, an effort that may bring the U.S. closer to European data-protection norms.
By enlisting industry in setting privacy guidelines, the administration is taking a flexible approach that would still create rules with teeth, Chris Wolf, a lawyer with Hogan Lovells LLP in Washington, said in an interview.
“It’s a huge step forward for both consumers and business,” Wolf said. “Consumers are expecting companies to do better, and companies are seeing some competitive advantage in distinguishing themselves as privacy champions.”
Businesses should adhere to principles for the handling of personal information, according to a White House report released yesterday. Those include providing understandable privacy policies; giving consumers control over the data collected on them; and handling that information securely.
“Consumers can’t wait any longer for clear rules of the road that ensure their personal information is safe online,” President Barack Obama said in a statement announcing the report. “As the Internet evolves, consumer trust is essential for the continued growth of the digital economy.”
The Commerce Department will meet with companies and consumer groups to develop voluntary standards for businesses based on those principles. The Federal Trade Commission, which has the authority to act when companies engage in unfair and deceptive trade practices, would enforce the standards, according to the report.
Marc Rotenberg, executive director of the Electronic Privacy Information Center, also known as EPIC, whose complaints about privacy breaches by Facebook and Google became the basis for 20-year settlement agreements with the FTC last year, said Obama’s initiative is positive for consumers.
“The President’s statement is perhaps the best articulation of the right to privacy of any president in U.S. history,” Rotenberg said in an e-mail. “The challenge ahead is implementation and enforcement.”
Revelations about privacy breaches during the past year have spurred calls from regulators and lawmakers in Washington for stronger protections of personal data online and on Internet-connected mobile devices.
Google, owner of the world’s most popular search engine, and Facebook, the world’s largest social network, are among Web companies facing scrutiny over their handling of consumer data used to power an online ad market projected by eMarketer Inc., a New York-based research firm, to reach $39.5 billion in the U.S. this year.
Privacy advocates have expressed concern that Internet companies are tracking consumers without permission to send targeted advertising based on their Web-browsing habits.
The administration announced an initiative by online advertisers to give people a uniform way to limit the data collected on them through settings in their Web browsers. The effort is led by the Digital Advertising Alliance, an association of online ad groups.
Google, Microsoft Corp. (MSFT), Yahoo! Inc. and AOL Inc. (AOL) are among companies that have agreed to comply when consumers choose to control online tracking, according to a White House statement accompanying the privacy report.
“This is an example of voluntary industry action to increase the trust of the Internet that is essential for the development of our economy going forward and lightens the burden of legislation,” Gene Sperling, director of the National Economic Council, said at a White House briefing yesterday.
The administration proposal creates a framework for a uniform, national approach to privacy while its use of vague language, such as “appropriate,” may be subject to interpretation, said Bob Blakley, a Round Rock, Texas-based analyst for technology research firm Gartner Inc.
“Unless some understanding is reached regarding what the standard of ‘appropriate’ is, there is the possibility that people will game the system,” Blakley said in an interview. “Companies will attempt to reduce the cost burden of complying with whatever guidelines emerge from this.”
Senator John Kerry, a Massachusetts Democrat who introduced a privacy-protection bill last year with Republican Senator John McCain of Arizona, welcomed the White House report and called on his colleagues to pass legislation.
“Since the 1990s, Congress has been talking about this issue and complaining about abuses but doing little to stop them,” Kerry said in an e-mailed statement. “Instead of continuing the now monthly exercise of publicly scolding companies, we need to make Congress establish common sense rules of the road that protect consumers.”
The framework outlined by the administration may help the U.S. more closely align its privacy policies with European regulations, Jim Halpert, a privacy lawyer with DLA Piper LLP in Washington, said in an interview.
“This is going to change the way companies think about consumer privacy and is a promising way to bridge some of the differences between the U.S. and Europe,” Halpert said. “There is a meaningful incentive to come up with international processes that develop codes of conduct that also pass muster under European data protection rules.”
The European Union announced an overhaul last month of the region’s 17-year-old privacy rules that would give data protection agencies in the EU’s 27 countries authority to sanction companies that violate proposed requirements for handling personal information.
The Obama administration report coincides with criticism of Google over the company’s plan to unify privacy settings for some 60 different services, including YouTube videos and mobile devices running on its Android software. The move takes effect March 1.
The National Association of Attorneys General criticized the company’s decision, saying the new policy doesn’t give consumers choices about pooling their data, according to a letter sent Feb. 22 to Google Chief Executive Officer Larry Page signed by 36 state attorneys general.
EPIC filed a lawsuit Feb. 8 seeking to compel the FTC to sue Google to block the changes, alleging that they violate a settlement agreement signed last year with the agency. Google says the changes will make privacy practices easier to understand and its services easier to use.
“We’ve undertaken the most extensive notification effort in Google’s history,” said Chris Gaither, a spokesman. “We’re continuing to offer choice and control over how people use our services.”