The online privacy bill introduced yesterday is a step in the right direction, according to both online ad industry players and privacy advocates. While a similar bill draft from Virginia Rep. Rick Boucher floated in May was largely met with negativity from both sides, the bill sponsored by Rep. Bobby Rush of Illinois is seen by industry and consumer privacy wonks as a starting framework from which to craft legislation that balances consumer protection and rights with industry goals.
Still, both sides are troubled by aspects of the bill, which will be discussed Thursday during a House hearing.
At first pass, Mike Zaneis, Interactive Advertising Bureau’s Public Policy VP, saw the bill as a step in the right direction. In particular, he said a safe harbor provision in the Rush bill for companies participating in an industry self-regulatory program – such as one the IAB and a coalition of advertising trade groups are developing – is “a huge concession to the industry’s work towards building an [online behavioral advertising] self regulatory program.”
Rush’s bill is “much more palatable than the Boucher proposal,” said Zaneis. The bill establishes the Federal Trade Commission as the agency responsible for setting processes for implementation and compliance with provisions. Rush’s H.R. 5777 “advances the discussion,” said Jeff Chester, executive director of the Center for Digital Democracy. The CDD is part of a coalition of privacy and consumer rights groups lobbying to strengthen consumer protections in the bill. “The key conclusion about the Boucher bill was that it wasn’t clear that the Federal Trade Commission would have clarity around rulemaking authority,” he said, suggesting the Rush bill does provide more clarity.
Chester indicated that privacy advocates are pleased with stipulations that give states and individuals the ability to take civil action against companies that collect, store, and use consumer data that they believe are in violation of requirements to provide opt-out consent for collection and use of personal information. However details of that provision, removing liability for some companies, may not be considered adequate by consumer protection advocates. The bill gives safe harbor from private legal action to companies in compliance with the would-be self-regulatory program.
The bill calls for the program – subject to FTC approval – to require companies collecting and using consumer data to provide a “clear and conspicuous opt-out mechanism” prohibiting said companies from disclosing personal data to third parties. The bill also suggests that industry self-regulation could provide a tool for consumers to manage preferences, including “online behavioral advertising preferences.”
It also requires establishment of procedures for compliance assessment of companies in the program, as well as establishment of consequences for failure to comply. Those might include public notice of noncompliance, suspension or expulsion from the program, or referral to the FTC for enforcement, states the bill.
The FTC would be required to set up guidelines and processes for the program no later than 18 months after enactment of the law. The bill also calls on the FTC to conduct a consumer education campaign to notify people of their related rights.
Chester called the fact the bill gives the FTC control over setting parameters a good thing. “We recognize there’s a role for safe harbor,” Chester said, adding, “We also believe in and support a role for online advertising.” One concern among privacy advocates lies in the amount of leeway government gives the digital ad industry. Overall, suggested Chester, the bill should help reduce the amount of user data collected and give consumers more control over that collection and data usage.
Although additional progress on the bill could be made during a House subcommitee hearing scheduled for Thursday, it is likely that not much more will be done before Congress breaks for recess between August 9 and September 12. Even if the bill does eventually become law, it would not take effect for two years after its enactment.