```

[Senate Hearing 112-791]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 112-791

 
                   THE NEED FOR PRIVACY PROTECTIONS:
 PERSPECTIVES FROM THE ADMINISTRATION AND THE FEDERAL TRADE COMMISSION

=======================================================================

                                HEARING

                               before the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                      ONE HUNDRED TWELFTH CONGRESS

                             SECOND SESSION

                               __________

                              MAY 9, 2012

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                  U.S. GOVERNMENT PRINTING OFFICE
81-793                    WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected].  

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                      ONE HUNDRED TWELFTH CONGRESS

                             SECOND SESSION

            JOHN D. ROCKEFELLER IV, West Virginia, Chairman
DANIEL K. INOUYE, Hawaii             KAY BAILEY HUTCHISON, Texas, 
JOHN F. KERRY, Massachusetts             Ranking
BARBARA BOXER, California            OLYMPIA J. SNOWE, Maine
BILL NELSON, Florida                 JIM DeMINT, South Carolina
MARIA CANTWELL, Washington           JOHN THUNE, South Dakota
FRANK R. LAUTENBERG, New Jersey      ROGER F. WICKER, Mississippi
MARK PRYOR, Arkansas                 JOHNNY ISAKSON, Georgia
CLAIRE McCASKILL, Missouri           ROY BLUNT, Missouri
AMY KLOBUCHAR, Minnesota             JOHN BOOZMAN, Arkansas
TOM UDALL, New Mexico                PATRICK J. TOOMEY, Pennsylvania
MARK WARNER, Virginia                MARCO RUBIO, Florida
MARK BEGICH, Alaska                  KELLY AYOTTE, New Hampshire
                                     DEAN HELLER, Nevada
                    Ellen L. Doneski, Staff Director
                   James Reid, Deputy Staff Director
                     John Williams, General Counsel
             Richard M. Russell, Republican Staff Director
            David Quinalty, Republican Deputy Staff Director
   Rebecca Seidel, Republican General Counsel and Chief Investigator

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on May 9, 2012......................................     1
Statement of Senator Rockefeller.................................     1
Statement of Senator Toomey......................................     2
Statement of Senator Kerry.......................................     4
Statement of Senator Klobuchar...................................    37
Statement of Senator Pryor.......................................    39
Statement of Senator Udall.......................................    43

                               Witnesses

Hon. Jon D. Leibowitz, Chairman, Federal Trade Commission........     6
    Prepared statement...........................................     8
Hon. Cameron F. Kerry, General Counsel, U.S. Department of 
  Commerce.......................................................    17
    Prepared statement...........................................    18
Hon. Maureen K. Ohlhausen, Commissioner, Federal Trade Commission    27
    Prepared statement...........................................    29

                                Appendix

Response to written questions submitted by Hon. John F. Kerry to:
    Hon. Jon D. Leibowitz........................................    47
    Hon. Maureen K. Ohlhausen....................................    49
Response to written questions submitted by Hon. Amy Klobuchar to:
    Hon. Jon D. Leibowitz and Hon. Maureen K. Ohlhausen..........    53
    Hon. Cameron F. Kerry........................................    53
Response to written questions submitted by Hon. John Thune to:
    Hon. Jon D. Leibowitz........................................    55
    Hon. Maureen K. Ohlhausen....................................    60
Response to written questions submitted by Hon. Marco Rubio to:
    Hon. Jon D. Leibowitz........................................    57
    Maureen K. Ohlhausen.........................................    61

                   THE NEED FOR PRIVACY PROTECTIONS:
 PERSPECTIVES FROM THE ADMINISTRATION AND THE FEDERAL TRADE COMMISSION

                              ----------                              

                         WEDNESDAY, MAY 9, 2012

                                       U.S. Senate,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 2:35 p.m. in room 
SR-253, Russell Senate Office Building, Hon. John D. 
Rockefeller IV, Chairman of the Committee, presiding.

       OPENING STATEMENT OF HON. JOHN D. ROCKEFELLER IV, 
                U.S. SENATOR FROM WEST VIRGINIA

    The Chairman. Good afternoon, and I apologize for being 5 
minutes late.
    Every day, tens of millions of Americans go online to 
search for information. They want to shop. They want to pay 
their bills, or they're accessing social networking. To state 
the obvious, the Internet has fundamentally transformed every 
aspect of our lives.
    What is less obvious is the level of information that is 
collected about us each time we visit a website or watch a 
video or send an e-mail or make a purchase.
    Now consumers have had no choice but to place an enormous 
amount of trust in the online world, trust that their 
information is safe, that it will be secure, and it will be 
used appropriately, whatever that means.
    But the incentive to misuse consumers' information is very 
great. A consumer's personal information is the currency, in 
fact, of the web.
    The value of this data has created untold riches for those 
who have successfully harnessed it. This is not necessarily 
bad, as it enables an enormous amount of content to be accessed 
for free and allows companies to offer a number of services for 
free.
    But unfettered collection of consumers' online data poses, 
to me, very significant risks.
    Right now, consumers have little or no choice in managing 
how their online information is collected and how it is used. 
Whatever limited choices they do have are often too difficult 
to use and muddled by complicated, wordy, privacy policies. 
It's, again, your classic health insurance comparison--tiny 
writing.
    Protecting consumer privacy is critical for companies, and 
I understand that. People need to trust the websites that they 
are visiting. But online companies are conflicted. They need to 
protect consumers' information, but they also need to be able 
to monetize their users' data.
    I am afraid that in the hypercompetitive online 
marketplace, the need to monetize consumers' data and profits 
will win out, probably almost every time, over privacy 
concerns.
    The administration and the Federal Trade Commission have 
both recently issued reports on the need for industry to do 
more, to protect consumer data, and give consumers control over 
how their personal information is used. They have worked to 
bring about industry consensus on voluntary actions. This is an 
interesting subject, which we will discuss further at another 
hearing.
    The administration's and the industry's actions are to be 
commended, with this respect. But I've learned over many years 
that self-regulation is inherently one-sided in many 
industries, in many times, in many eras, it's inherently one-
sided, and that consumers' rights always seem to lose out to 
the industry's needs.
    I believe consumers need strong legal protections. They 
need simple and easy-to-understand rules about how, what, and 
when their information can be collected and used. They need 
easy-to-understand privacy policies rather than pages of 
incomprehensible legalese.
    We should take up strong, consumer-focused privacy 
legislation this year. I do not believe that significant 
consensus exists yet on what that legislation should look like, 
but I will continue to work with my colleagues on legislation.
    As Chairman of this Committee, I will continue to work with 
the administration and the FTC, both represented here, to push 
the industry to develop and adhere to strong consumer privacy 
protections.
    I will continue to hold oversight hearings to make sure 
that the trust Americans have placed in these companies is 
being respected.
    I call now on the Ranking Member, my next-door neighbor.

             STATEMENT OF HON. PATRICK J. TOOMEY, 
                 U.S. SENATOR FROM PENNSYLVANIA

    Senator Toomey. Thank you very much, Mr. Chairman. And 
thank you for holding another hearing on the topic of privacy. 
It is a very important topic.
    As I have said in this committee in the past, I still 
remain skeptical of the need for Congress to pass privacy 
legislation, or, for that matter, for the FTC to have increased 
authority to enforce new privacy rules, regulations, or 
principles on the private sector.
    It seems to me that neither this committee nor the FTC nor 
the Commerce Department fully understands what consumers' 
expectations are when it comes to their online privacy. 
Consumer expectations of privacy can vary based on a particular 
application they're using or by the general privacy preference 
of any given individual consumer.
    It's important that companies have maximum flexibility to 
work with their customers to ensure their customers' needs and 
preferences are met, and that the application or service 
functions as consumers expect.
    As the recent FTC report correctly points out, companies 
are already currently competing on privacy and are promoting 
services as having stronger privacy protections than what is 
being offered by marketplace rivals, for instance. This is a 
sign of a healthy, functioning, and competitive market. This 
type of competition is something that we should be encouraging.
    Overly restrictive privacy rules and regulations handed 
down from Washington may threaten this innovation by shifting 
the incentives to compliance over competition. I don't think 
anyone desires such a result, which is why I caution my 
colleagues and the administration to proceed with caution.
    Proponents of Federal privacy legislation and of granting 
the FTC authority to regulate online activity really should 
clearly demonstrate the market failure and consumer harm that 
they seek to address.
    The benefits of online tracking and data collection are 
very clear. Facebook is free. Gmail is free. Google Maps is 
free. There are thousands of mobile device applications that 
are free.
    It's often said that information is the currency of the 
Internet. A detailed, cost-benefit analysis of a Do Not Track 
regulation or other new privacy rules would better inform our 
discussion. But to my knowledge, one has not been completed.
    We need to fully understand the impact these proposals will 
have on the marketplace and on the many online services 
consumers have come to expect for free or at a minimal cost.
    Less information available is very likely to result in 
fewer, free online services and an increase in pay walls. I 
think it's irresponsible for the Federal Government to require 
companies to radically alter a successful business model that 
has provided many consumer benefits without knowing all the 
facts first.
    I also question whether specific consumer harms currently 
occurring in the marketplace cannot be addressed under the 
FTC's current statutory authority. Section 5 of the FTC Act 
grants the Commission broad authority to investigate unfair or 
deceptive acts or practices, and the Commission has brought 
enforcement actions using this authority.
    In fact, the Commission highlights a number of these 
enforcement actions in the beginning of its recently released 
report.
    When the Commission sees what it believes to be unfair or 
deceptive practices, it has acted. Just yesterday, it was 
reported that the FTC and MySpace reached a privacy settlement 
that will subject the company to biennial privacy assessments 
for the next 20 years.
    In addition, Google and Facebook recently entered into 
consent decrees that subject the companies to outside audits 
for two decades. I have not yet heard a persuasive argument as 
to why the FTC needs even greater authority.
    And last, I find it interesting that the Commission seems 
very concerned about consumer trust in the private sector. 
Consumer trust is very, very important. But there's no one for 
whom it's more important than the company that's hoping to 
attract and maintain customers. So I think trust in the 
marketplace is something that the marketplace tends to sort out 
pretty well.
    Companies in all sectors of the economy have a powerful 
interest in building a strong, trusting relationship with their 
customers. If consumers don't trust company A, they quickly 
flee to company B. In the online space, this incentive is even 
stronger.
    The Internet has made leaving one company or service 
provider for another very easy. It can often be done at little 
or no cost. As one major online company likes to say, the 
Internet is where ``competition is one click away.''
    While this is an important topic and certainly worthy of 
our consideration, I do think it's premature to begin 
discussing specific legislative fixes or increased FTC 
authority when we don't fully know whether or not and to what 
extent the problem exists.
    I look forward to hearing from our witnesses today. I thank 
them for coming, and I thank you, Mr. Chairman.
    The Chairman. Thank you very much, Senator Toomey.
    And I call now on the Chairman of the Subcommittee that 
works this, and that is Senator John Kerry.

               STATEMENT OF HON. JOHN F. KERRY, 
                U.S. SENATOR FROM MASSACHUSETTS

    Senator Kerry. Thank you very much, Mr. Chairman. I 
appreciate it. And I certainly appreciate this hearing.
    And I think this hearing can help, as a couple of prior 
hearings have.
    I think the record is already fairly clear, Senator Toomey, 
if I may say, that a lot of the questions you've raised have 
actually been addressed in those hearings. And I think there's 
been a pretty powerful showing with respect to both the ability 
to have a privacy standard as well as the need for the privacy 
standard, without affecting those applications and the free 
access and all the other things you're talking about. And I 
think the record will reflect that.
    I'm delighted that we have the Chair of the Federal Trade 
Commission and one of the commissioners from the Commission 
here with us today.
    And obviously, I'm delighted to welcome my own brother, who 
carries either the burden or privilege of being so. But I'm 
glad that he's here today representing the Commerce Department. 
He's been working on this under two different secretaries now, 
as have many of us here on the Committee.
    So I know that in his capacity as the General Counsel, 
together with the Chair, they are going to set out today the 
final findings of both the Commerce Department and the Federal 
Trade Commission with respect to this question.
    It is not unimportant, I think, that both the Commerce 
Department and the Federal Trade Commission, frankly, together 
with most of the privacy experts in the country, have all come 
to the conclusion that we need to have a privacy law with 
respect to providing protection to individuals in commerce.
    And I think that the distinction, Senator Toomey, is that 
the privacy experts have all come to that conclusion. 
Obviously, some of the companies have not and don't share it. 
And the reason for that is very simple. In the information 
economy, the more that a company knows about you, the more 
valuable you are to them, whether you have consented to that or 
not. And they are collecting more than simply the information 
that you type in. And a lot of Americans aren't necessarily 
aware of that.
    These companies watch your behavior, and they measure your 
behavior--how long you linger on a site, your specific 
searches. A lot of people think they're just going in and 
searching privately. Somebody's watching you. Somebody's 
tracking you.
    You know, you wouldn't feel particularly good if you had a 
private investigator trailing you through the mall, looking at 
every single receipt that you get and everything you peruse and 
look at and ask for. That's essentially what's happening here.
    You don't have privacy. They analyze and enhance that data, 
and then they reach a conclusion about you.
    Using that information, these data scientists, are creating 
enormous wealth, often producing innovative products, we agree, 
and services. But there is nothing to stop them from doing the 
creation of those products and services with the consent of 
people who want to be part of that, or without necessarily the 
detail of those who do not.
    So what's the harm? Senator Toomey sort of asked the 
question today: what's the harm of what can happen to you 
without your knowledge, consent, or active participation, and 
where there are no limits to what can be collected and where 
you have no right to access what is being collected about you?
    It seems to me the more conservative position here is, 
frankly, to protect the individual in America, not to protect 
the right of people to invade your space without your knowing 
it.
    So if it's not properly secured, that information can 
actually harm you, number one, through identity theft. And even 
if it is properly secured, it can be used to categorize you 
inaccurately or in ways that you don't wish to be categorized, 
exposing you to either reputational harm or to unwanted 
targeting.
    For example, by analyzing your buying habits, a retailer 
may know that you're pregnant before you even tell anyone, may 
begin to send you advertising based on medical status, or on 
your ethnicity or on your age. And corresponding behavior can 
then be used to target you in different ways than other 
populations may be targeted, and maybe you don't want to be 
targeted or analyzed in that particular way.
    Or as in the case of the Google Wi-Fi collection, your 
private communications, including sensitive conversations, can 
be easily captured exposing aspects of your life to companies 
that are simply nobody's business.
    But when information collected about you is used to make 
your buying experience better or serve you better, you'll find 
a majority of the people have absolutely no problem consenting 
to that kind of use.
    But the collector ought to have the right to make that 
judgment, the value proposition with respect to the consumer.
    Most Americans don't have any awareness that there's no 
general law of privacy in commerce in the U.S. today governing 
these transactions. And when it's brought to their attention, 
they say they want one. Our largest trading partners have such 
laws built on the European standard.
    But I believe it's important for us to set our own 
standard, something that could, in fact, be more flexible and 
more stakeholder-driven and less punitive than what exists in 
Europe today, but just as capable of delivering strong privacy 
protections.
    So in keeping with the spirit that the United States 
normally doesn't wait for someone else to set the standard and 
then borrow it, we ought to be setting our own standard. The 
final agency reports that have been issued recently agree that 
we ought to lay out a blueprint of privacy principles for 
legislation.
    Senator John McCain and I have agreed on one approach. And 
I introduced that approach with him more than a year ago. It 
reflects each of the principles that are being put forward in 
the analyses today, as well as the concept of a safe harbor for 
a flexible application of the code of conduct to different 
kinds of businesses.
    I think all of us know that consumers in the United States 
are very smart. They'll consent to reasonable and useful data 
collection and use practices, particularly if they think it 
enhances their buying and life experience.
    But the most important principle we want to reinforce here 
is that the individual consumer has the right to make that 
decision.
    So can we get there? I think it's up to the members of this 
committee on both sides of the Committee. The bipartisan 
proposal that Senator McCain and I offered up is, as I said, 
it's not the only way to approach this. We're ready to 
negotiate. And I think we ought to compromise in this effort to 
reach sort of a fair standard.
    But we need to get down to that discussion, because we 
really can't afford another year of delay, which may in the end 
wind up putting America into a default position on this, which 
would be far less flexible, thoughtful, and sensitive to our 
own business interests.
    And I think that Americans ought to know that Congress 
believes that, in the digital age, every individual American 
has a right to an expectation of privacy.
    I hope we can find that way forward, Mr. Chairman.
    The Chairman. Thank you very much, Senator Kerry.
    I want to proceed now to our witnesses, and we'll have 
ample time for questioning, and other members will be coming 
and leaving.
    My preference of order would be to start with the Hon. John 
Leibowitz, who is the Chairman of the Federal Trade Commission. 
Then Hon. Ohlhausen, I'm going to skip over you to the guy who 
is General Counsel to the Department of Commerce, who is 
somehow related to Senator Kerry. And then come back to you as 
a cleanup. Is that all right?
    Ms. Ohlhausen. Certainly.
    The Chairman. So let's start with Chairman Leibowitz.

         STATEMENT OF HON. JON D. LEIBOWITZ, CHAIRMAN, 
                    FEDERAL TRADE COMMISSION

    Mr. Leibowitz. Thank you, Chairman Rockefeller, Senator 
Toomey, Senator Kerry, Senator Pryor, Senator Klobuchar, and 
Senator Ayotte. I appreciate the opportunity to present the 
Commission's testimony on consumer privacy, alongside our 
newest Commissioner, Maureen Ohlhausen, as well as my friend 
Cam Kerry.
    The Commission commends the recent privacy efforts by the 
Department of Commerce, as well as the bipartisan leadership 
your committee has shown on consumer privacy issues. Though 
most of my remarks today will concern privacy policy and 
especially Do Not Track, the FTC is primarily an enforcement 
agency, and Commissioner Ohlhausen will describe our recent 
enforcement efforts.
    Mr. Chairman, imagine a cash-strapped college student 
working part-time to keep up with tuition payments. To make 
ends meet, she applies online for a loan and obtains it at a 
favorable rate. But she also goes online because her father 
suffers from depression, so she wants to research symptoms and 
potential treatments.
    Soon after, in the mail, she receives another loan offer, 
this time from a payday lender at a much higher rate. In the 
evening, she spends time relaxing by catching up with friends' 
posts on a social network. While online, she notices she's 
receiving ads for medication for stress and depression, as well 
as more loan offers.
    Could the lender have sold the information about her need 
for money to payday lenders, who are now offering her loans? 
Could the fact that she researched depression be sold to or 
shared with potential employers or insurers? Can these 
exchanges of information occur without the consumers' consent 
or even awareness?
    The answer to all these questions is yes.
    Of course, the college student benefits from quick 
responses to loan applications, free access to health 
information, and an easy way to keep up with her friends and 
family.
    But as Senator Kerry noted in his opening statement, the 
vast majority of Americans simply have no knowledge that their 
financial, health, and other personal information may be sold 
to data brokers, lead generators, lenders, insurance companies, 
potential employers, and, really, just about anybody else. Most 
consumers are entirely unaware of the vast amounts data about 
them being collected, sold, and used both online and offline.
    Now, we at the Commission applaud--applaud--the Internet 
innovation that has created enormous benefits for consumers and 
the advertising ecosystem that has provided free content and 
services, the ones that we have all come to expect and enjoy. 
But as the Nation's privacy protection agency, we are also 
concerned that some practices by some companies may adversely 
affect Americans and their critical rights to privacy.
    At the FTC, we have been thinking about this issue for more 
than a decade. We recently released our final privacy report 
that sets forth what we in the public and private sectors 
should do to make sure that the right to privacy remains robust 
for all Americans.
    The short answer is the consumer should have more choice 
and more control. And to ensure that control, our report lays 
out three simple but powerful principles for companies to 
follow in handling personal data.
    This is guidance. It is not a regulation.
    First, incorporate privacy protections into products as 
they are developed. That is privacy by design. Second, offer 
consumers choice and control over how their data is collected 
and used. And third, provide more transparency; that is, better 
explanations to consumers about how their data is handled by 
companies.
    The final report also recommends that Congress consider 
enacting general privacy legislation, as well as specific 
statutes addressing data security and data brokers. Data 
brokers often hold a wealth of information about consumers but 
remain utterly invisible to them.
    In addition, our report calls for a Do Not Track mechanism, 
one that is easy to use and persistent, to enable consumers to 
control the collection of information about their activities 
across websites. And it's worth emphasizing here that your 
computer is your property.
    And as the first chairman I served with, Republican Deborah 
Majoras, used to say, ``people shouldn't be putting things in 
your computer without your consent.'' And I think that is 
fundamentally, a conservative notion.
    In the last year, industry has made strides toward 
finalizing a meaningful Do Not Track system, as you know, Mr. 
Chairman. Indeed, at this point, we are no longer asking 
whether Do Not Track will exist, but only how it will be 
implemented. We're optimistic that, with the encouragement of 
this committee and especially you, Mr. Chairman, a Do Not Track 
mechanism that allows consumers to control the collection of 
their browsing information, with limited exceptions--for 
example, to prevent fraud--will be in place by the end of the 
year.
    And just going back to the discussion between Senator 
Toomey and Senator Kerry, Do Not Track, of course, will be run 
by industry. It won't be run like the Government runs Do Not 
Call.
    Of course, vigorous enforcement remains a top priority for 
our agency, as Commissioner Ohlhausen will describe in more 
detail. Just this week, we announced a case against the social 
network MySpace. The FTC complaint alleged that MySpace shared 
personal user information with advertisers after promising that 
it would not. The proposed settlement order prohibits MySpace 
from making any privacy misrepresentations and requires it to 
create a comprehensive privacy program, and undergo third party 
audits. Simply put, this case, as well as others that we 
brought, stands for the proposition that we will hold companies 
accountable for their privacy commitments.
    We appreciate the leadership of you, Chairman Rockefeller, 
and this committee. And we look forward to continuing to work 
with Congress, the administration, industry, and other 
stakeholders, on privacy protection going forward. Thank you.
    [The prepared statement of Mr. Leibowitz follows:]

           Prepared Statement of the Federal Trade Commission

Introduction
    Chairman Rockefeller, Ranking Member Hutchison, and members of the 
Committee, I am Jon Leibowitz, Chairman of the Federal Trade Commission 
(``FTC'' or ``Commission'').\1\
---------------------------------------------------------------------------
    \1\ The views expressed in this statement represent the views of 
the Commission, with Commissioner J. Thomas Rosch dissenting and 
Commissioner Maureen K. Ohlhausen not participating. My oral 
presentation and responses to questions are my own and do not 
necessarily represent the views of the Commission or any other 
Commissioner.
---------------------------------------------------------------------------
    We are pleased to be testifying today alongside General Counsel 
Cameron Kerry of the Department of Commerce and the newest member of 
the FTC, Commissioner Maureen Ohlhausen. The Commission supports the 
privacy efforts and approach developed by the Department of Commerce, 
and we look forward to working with the Department of Commerce, the 
Administration, and Congress as they move forward in their efforts in 
this arena. Members of this Committee in particular have demonstrated 
that they understand how important it is that consumers'--and 
especially children and teens'--personal data be treated with care and 
respect.
    This is a critical juncture for consumer privacy, as the 
marketplace continues to rapidly evolve and new approaches to privacy 
protection are emerging in the United States and around the world. 
After careful consideration, the Commission recently released the final 
privacy report (``Final Report''). The Final Report sets forth best 
practices for businesses to guide current efforts to protect consumer 
privacy while ensuring that companies can continue to innovate. The 
Commission urges industry to use this guidance to improve privacy 
practices and accelerate the pace of self-regulation. Importantly, we 
have seen promising developments by industry toward a Do Not Track 
mechanism and we ask the Committee to continue to encourage industry to 
move towards full implementation. The Report also calls on Congress to 
consider enacting general privacy legislation. We reiterate today our 
call to Congress to enact legislation requiring companies to implement 
reasonable security measures and notify consumers in the event of 
certain security breaches, as well as targeted legislation that would 
provide consumers with access to information about them held by data 
brokers.
    Privacy has been a key part of the Commission's consumer protection 
mission for more than 40 years. Throughout, the Commission's goal has 
remained constant: to protect consumers' personal information and 
ensure that they have the confidence to take advantage of the many 
benefits offered by the dynamic and ever-changing marketplace. To meet 
this objective, the Commission has undertaken substantial efforts to 
promote privacy in the private sector through law enforcement, 
education, and policy initiatives. For example, since 2001, the 
Commission has brought 36 data security cases; more than 100 spam and 
spyware cases; and 18 cases for violation of the Children's Online 
Privacy Protection Act (``COPPA''). The Commission has also brought 
highly publicized privacy cases against companies such as Google and 
Facebook and, most recently, Myspace. The Commission has distributed 
millions of copies of educational materials for consumers and 
businesses to address ongoing threats to security and privacy. And the 
FTC continues to examine the implications of new technologies and 
business practices on consumer privacy through ongoing policy 
initiatives, such as the Commission's Final Report.
    This testimony begins by describing the Commission's Final Report. 
It then offers an overview of other recent policy efforts in the areas 
of privacy and data security and concludes by discussing the 
Commission's recent enforcement and education efforts.

II. Final Privacy Report
    The FTC recently released its Final Report, setting forth best 
practices for companies that collect and use consumer data.\2\ These 
best practices can assist companies as they develop and maintain 
processes and systems to operationalize privacy and data security 
practices within their businesses. To the extent these best practices 
exceed existing legal requirements, they are not intended to serve as a 
template for law enforcement or regulations under laws currently 
enforced by the FTC.\3\
---------------------------------------------------------------------------
    \2\ FTC, Protecting Consumer Privacy in an Era of Rapid Change: 
Recommendations for Businesses and Policymakers (Mar. 2012), available 
at http://www.ftc.gov/os/2012/03/1203
26privacyreport.pdf. Commissioner Rosch dissented from the issuance of 
the Final Privacy Report. He agrees that consumers ought to be given a 
broader range of choices and applauded the Report's call for targeted 
legislation regarding data brokers and data security. However, 
Commissioner Rosch has four major concerns about the privacy framework 
because he believes that: (1) in contravention of our promises to 
Congress, it is based on an improper reading of our consumer protection 
``unfairness'' doctrine; (2) the current state of ``Do Not Track'' 
still leaves unanswered many important questions; (3) ``opt-in'' will 
necessarily be selected as the de facto method of consumer choice for a 
wide swath of entities; and (4) although characterized as only ``best 
practices,'' the Report's recommendations may be construed as Federal 
requirements. See http://www.ftc.gov/os/2012/03/120326privacyreport.pdf 
at Appendix C.
    \3\ Information on the FTC's privacy initiatives generally may be 
found at business.ftc.gov/privacy-and-security.
---------------------------------------------------------------------------
    The Final Report supports the three key principles laid out in the 
preliminary staff report.\4\ Companies should adopt a ``privacy by 
design'' approach by building privacy protections into their everyday 
business practices. Such protections include providing reasonable 
security for consumer data, collecting only the data needed for a 
specific business purpose, retaining data only as long as necessary to 
fulfill that purpose, safely disposing of data no longer in use, and 
implementing reasonable procedures to promote data accuracy.
---------------------------------------------------------------------------
    \4\ The Commission received over 450 public comments from various 
stakeholders in response to the preliminary report, which were highly 
informative to the Commission as it refined the final framework.
---------------------------------------------------------------------------
    Companies also should provide simpler and more streamlined choices 
to consumers about their data practices. Companies do not need to 
provide choice before collecting and using consumers' data for 
practices that are consistent with the context of the transaction, the 
company's relationship with the consumer, or as required or 
specifically authorized by law. For all other data practices, consumers 
should have the ability to make informed and meaningful choices at a 
relevant time and context and in a uniform and comprehensive way. The 
Commission advocated such an approach for online behavioral tracking--
often referred to as ``Do Not Track''--that is discussed in more detail 
below.
    Finally, companies should take steps to make their data practices 
more transparent to consumers. For instance, companies should improve 
their privacy disclosures and work toward standardizing them so that 
consumers, advocacy groups, regulators, and others can compare data 
practices and choices across companies, thus promoting competition 
among companies. Consumers should also have reasonable access to the 
data that companies maintain about them, particularly for non-consumer-
facing entities such as data brokers, as discussed in more detail 
below. The extent of access should be proportional to the volume and 
sensitivity of the data and to its intended use.
    In addition, the Final Report makes general and specific 
legislative recommendations. The Report supports the development of 
general privacy legislation to ensure basic privacy protections across 
all industry sectors, and can inform Congress, should it consider such 
privacy legislation.\5\ The Commission recommends that any such 
legislation be technologically neutral and sufficiently flexible to 
allow companies to continue to innovate. In addition, the Commission 
believes that any legislation should allow the Commission to seek civil 
penalties to deter statutory violations. Such legislation would provide 
businesses with the certainty they need to understand their obligations 
as well as the incentive to meet those obligations, while also assuring 
consumers that companies will respect their privacy. We believe this 
approach would foster an environment that allows businesses to innovate 
and consumers to embrace those innovations without risking their 
privacy. The Final Report also calls on Congress to enact legislation 
requiring companies to implement reasonable security measures and 
notify consumers in the event of certain security breaches,\6\ as well 
as targeted legislation for data brokers, discussed below. We look 
forward to working with Congress and other stakeholders to craft this 
legislation.
---------------------------------------------------------------------------
    \5\ Earlier this year, the Administration released its final 
``White Paper'' on consumer privacy, recommending that Congress enact 
legislation to implement a Consumer Privacy Bill of Rights. See 
Consumer Data Privacy in a Networked World: A Framework for Protecting 
Privacy and Promoting Innovation in the Global Digital Economy (Feb. 
2012), available at http://www.whitehouse.gov/sites/default/files/
privacy-final.pdf.
    \6\ The Commission has long supported such Federal data security 
and breach notice laws. See, e.g., Prepared Statement of the FTC, Data 
Security: Hearing Before the H. Comm. on Energy and Commerce, Subcomm. 
on Commerce, Manufacturing, and Trade, 112th Cong. (June 15, 2011), 
available at http://www.ftc.gov/os/testimony/
110615datasecurityhouse.pdf; Prepared Statement of the FTC, Protecting 
Social Security Numbers From Identity Theft: Hearing Before the Before 
the H. Comm. on Ways and Means, Subcomm. on Social Security, 112th 
Cong. (Apr. 13, 2011), available at http://ftc.gov/os/testimony/
110411ssn-idtheft.pdf; FTC, Security in Numbers, SSNs and ID Theft 
(Dec. 2008), available at http://www.ftc.gov/os/2008/12/
P075414ssnreport.pdf; and President's Identity Theft Task Force, 
Identity Theft Task Force Report (Sept. 2008), available at http://
www.idtheft.gov/reports/IDTReport2008.pdf.
---------------------------------------------------------------------------
    The Report's recommendations broadly address the commercial use of 
consumer information, both online and offline, by businesses. Below, we 
highlight two specific issues addressed in the Report--Do Not Track and 
data brokers.

A. Do Not Track
    The Final Report advocates the continued implementation of a 
universal, one-stop mechanism to enable consumers to control the 
tracking of their online activities across websites, often referred to 
as ``Do Not Track,'' which the Commission first called for in December 
2010 and Chairman Rockefeller has sought through his legislative 
proposal.\7\ We recognize the benefits to such online data collection, 
including more relevant advertising and free online content that 
consumers have come to expect and enjoy. However, we have concerns that 
too many consumers either do not understand they are trading their 
privacy for free online content or have not made an informed choice to 
do so.
---------------------------------------------------------------------------
    \7\ Do Not Track is intended to apply to third-party tracking of 
consumers because third-party tracking is inconsistent with the context 
of a consumer's interaction with a website; by contrast, most first-
party marketing practices are consistent with the consumer's 
relationship with the business and thus do not necessitate consumer 
choice.
---------------------------------------------------------------------------
    The Commission commends industry efforts to improve consumer 
control over behavioral tracking in response to our calls. As industry 
explores technical options and implements self-regulatory programs, and 
as Congress examines Do Not Track, the Commission continues to believe 
that an effective Do Not Track system should include five key 
principles. First, a Do Not Track system should be implemented 
universally to cover all parties that would track consumers. Second, 
the choice mechanism should be easy to find, easy to understand, and 
easy to use. Third, any choices offered should be persistent and should 
not be overridden if, for example, consumers clear their cookies or 
update their browsers. Fourth, a Do Not Track system should be 
comprehensive, effective, and enforceable. It should opt consumers out 
of behavioral tracking through any means and not permit technical 
loopholes.\8\ Fifth, an effective Do Not Track system should go beyond 
simply opting consumers out of receiving targeted advertisements; it 
should opt them out of collection of behavioral data for all purposes 
other than those that would be consistent with the context of the 
interaction (e.g., preventing click-fraud or frequency capping for 
ads). Such a mechanism should be different from the Do Not Call program 
in that it should not require the creation of a ``Registry'' of unique 
identifiers, which could itself cause privacy concerns. And unlike the 
Do Not Call Registry, a Do Not Track mechanism should be implemented by 
the private sector.
---------------------------------------------------------------------------
    \8\ For example, the FTC brought an action against a company that 
told consumers they could opt out of tracking by exercising choices 
through their browsers; however, the company used Flash cookies for 
such tracking, which consumers could not opt out of through their 
browsers. In the Matter of ScanScout, Inc., FTC Docket No. C-4344 (Dec. 
21, 2011) (consent order), available at http://www.ftc.gov/os/caselist/
1023185/111221scanscoutdo.pdf.
---------------------------------------------------------------------------
    Early on, the companies that develop web browsers stepped up to the 
challenge to give consumers choices about how they are tracked online, 
sometimes known as the ``browser header'' approach. When consumers 
enable Do Not Track, the browser transmits the header to all types of 
entities, including advertisers, analytics companies, and researchers, 
that track consumers online. Just after the FTC's call for Do Not 
Track, Microsoft developed a system to let users of Internet Explorer 
prevent tracking by different companies and sites.\9\ Mozilla 
introduced a Do Not Track privacy control for its Firefox browser that 
an impressive number of consumers have adopted.\10\ Apple subsequently 
included a similar Do Not Track control in Safari.\11\
---------------------------------------------------------------------------
    \9\ Press Release, Microsoft, Providing Windows Customers with More 
Choice and Control of Their Privacy Online with Internet Explorer 9 
(Dec. 7, 2010), available at www.microsoft.com/presspass/features/2010/
dec10/12-07ie9privacyqa.mspx.
    \10\ The Mozilla Blog, Mozilla Firefox 4 Beta, Now Including ``Do 
Not Track'' Capabilities (Feb. 8, 2011), blog.mozilla.com/blog/2011/02/
08/mozilla-firefox-4-beta-now-including-do-not-track-capabilities/;
    Alex Fowler, Do Not Track Adoption in Firefox Mobile is 3x Higher 
than Desktop, Mozilla Privacy Blog (Nov. 2, 2011), http://
blog.mozilla.com/privacy/2011/11/02/do-not-track-adoption-in-firefox-
mobile-is-3x-higher-than-desktop/.
    \11\ Nick Wingfield, Apple Adds Do-Not-Track Tool to New Browser, 
Wall St. J., Apr. 13, 2011, available at http://online.wsj.com/article/
SB10001424052748703551304576261272308358858
.html. Google has taken a slightly different approach--providing 
consumers with a browser extension that opts them out of most 
behavioral advertising on a persistent basis. Sean Harvey & Rajas 
Moonka, Keep Your Opt Outs, Google Public Policy Blog (Jan. 24, 2011), 
http://googlepublicpolicy.blogspot.com/2011/01/keep-your-opt-outs.html.
---------------------------------------------------------------------------
    The online advertising industry, led by the Digital Advertising 
Alliance (``DAA''), has also led efforts by implementing a behavioral 
advertising opt-out program. The DAA's accomplishments are notable: it 
has developed a notice and choice mechanism through a standard icon in 
ads and on publisher sites; deployed the icon broadly, with reportedly 
over 900 billion impressions served each month; obtained commitments to 
follow the self-regulatory principles from advertisers, ad networks, 
and publishers that represent close to 90 percent of the online 
behavioral advertising market; and established an enforcement mechanism 
designed to ensure compliance with the principles.\12\ The DAA is also 
working to address one of the long-standing criticisms of its 
approach--how to limit secondary use of collected data so that the 
consumer opt-out extends beyond simply blocking targeted ads and to the 
collection of information for other purposes. The DAA has released 
principles that include limitations on the collection of tracking data 
and prohibitions on the use or transfer of the data for employment, 
credit, insurance, or health care eligibility purposes.\13\ The DAA is 
now working to fully implement these principles. Just as important, the 
DAA recently moved to address some persistence and usability criticisms 
of its icon-based opt out by committing to honor the tracking choices 
consumers make through their browser settings.\14\
---------------------------------------------------------------------------
    \12\ Peter Kosmala, Yes, Johnny Can Benefit From Transparency & 
Control, Self-Regulatory Program for Online Behavioral Advertising, 
http://www.aboutads.info/blog/yes-johnny-can-benefit-transparency-and-
control (Nov. 3, 2011); see also Press Release, Digital Advertising 
Alliance, White House, DOC and FTC Commend DAA's Self-Regulatory 
Program to Protect Consumers Online Privacy (Feb. 23, 2012), available 
at http://www.aboutads.info/resource/download/
DAA%20White%20House%20Event.pdf.
    \13\ Digital Advertising Alliance, About Self-Regulatory Principles 
for Multi-Site Data (Nov. 2011), available at http://www.aboutads.info/
resource/download/Multi-Site-Data-Principles
.pdf.
    \14\ Press Release, Digital Advertising Alliance, DAA Position on 
Browser Based Choice Mechanism (Feb. 22, 2012), available at http://
www.aboutads.info/resource/download/DAA
.Commitment.pdf.
---------------------------------------------------------------------------
    At the same time, the World Wide Web Consortium (``W3C''), an 
Internet standards-setting body, has convened a broad range of 
stakeholders to create an international, industry-wide standard for Do 
Not Track, including DAA member companies; other U.S. and international 
companies; industry groups; and public interest organizations. The W3C 
group has done admirable work to flesh out how to make a Do Not Track 
system practical in both desktop and mobile settings as reflected in 
two public working drafts of its standards.\15\ Some important issues 
remain, and the Commission encourages all of the stakeholders to work 
within the W3C group to resolve these issues.
---------------------------------------------------------------------------
    \15\ See Press Release, W3C, Two Drafts Published by the Tracking 
Protection Working Group (Mar. 13, 2012), available at http://
www.w3.org/News/2012#entry-9389; Press Release, W3C, W3C Announces 
First Draft of Standard for Online Privacy (Nov. 14, 2011), available 
at http://www.w3.org/2011/11/dnt-pr.html.en.
---------------------------------------------------------------------------
    While work remains to be done on Do Not Track, the Commission 
believes that the developments to date, coupled with legislative 
proposals, provide the impetus towards an effective implementation of 
Do Not Track. The advertising industry, through the DAA, has committed 
to deploy browser-based technologies for consumer control over online 
tracking, alongside its ubiquitous icon program. The W3C process, 
thanks in part to the ongoing participation of DAA member companies, 
has made substantial progress toward specifying a consensus consumer 
choice system for tracking that is practical and technically 
feasible.\16\ The Commission anticipates continued progress in this 
area as the DAA members and other key stakeholders continue discussions 
within the W3C process to work to reach consensus on a Do Not Track 
system in the coming months.
---------------------------------------------------------------------------
    \16\ A system practical for both businesses and consumers would 
include, for users who choose to enable Do Not Track, significant 
controls on the collection and use of tracking data by third parties, 
with limited exceptions for functions such as security de-identified 
data, and frequency capping. As noted above, a website's sharing of 
behavioral information with third parties is not consistent with the 
context of the consumer's interaction with the website and would be 
subject to choice. Do Not Track is one way for users to express this 
choice.
---------------------------------------------------------------------------
B. Data Brokers
    The Final Report recommends that companies provide consumers with 
reasonable access to the data maintained about them. The extent of such 
access should be proportionate to the sensitivity of the data and the 
nature of its use.
    The Final Report addresses the particular importance of consumers' 
ability to access information that data brokers have about them. Data 
brokers are companies that collect information, including personal 
information about consumers, from a wide variety of sources in order to 
resell such information for a variety of purposes, including verifying 
an individual's identity, differentiating one consumer's records from 
another's, marketing products, and preventing financial fraud. Such 
entities often have a wealth of information about consumers without 
interacting directly with them. Data brokers can compile data that can 
be used to benefit consumers, such as to help authenticate consumers in 
order to prevent identity theft or provide them with relevant offers 
and deals for products and services. However, consumers are often 
unaware of the existence of these entities, as well as the purposes for 
which they collect and use data.\17\
---------------------------------------------------------------------------
    \17\ As noted above, in connection with online tracking, it is 
generally inconsistent with the context of the interaction for a 
consumer-facing entity to share the consumer's data with a third party. 
Accordingly, such transfers of personal information would be subject to 
choice.
---------------------------------------------------------------------------
    The Commission has monitored data brokers since the 1990s, hosting 
workshops, drafting reports, and testifying before Congress about the 
privacy implications of data brokers' practices.\18\ Following a 
Commission workshop, data brokers created the Individual References 
Services Group (IRSG), a self-regulatory organization for certain data 
brokers that set forth principles to restrict availability to certain 
non-public information.\19\ The industry ultimately terminated this 
organization. Although a series of public breaches--including one 
involving ChoicePoint--led to renewed scrutiny of the practices of data 
brokers,\20\ there have been no meaningful broad-based efforts to 
implement self-regulation in this area in recent years.
---------------------------------------------------------------------------
    \18\ See, e.g., Prepared Statement of the FTC, Identity Theft: 
Recent Developments Involving the Security of Sensitive Consumer 
Information: Hearing Before the S. Comm. on Banking, Housing, and Urban 
Affairs, 109th Cong. (Mar. 10, 2005), available at http://www.ftc.gov/
os/testimony/050310idtheft.pdf; see also FTC Workshop, The Information 
Marketplace: Merging & Exchanging Consumer Data (Mar. 13, 2001), 
available at http://www.ftc.gov/bcp/workshops/infomktplace/index.shtml; 
FTC Workshop, Information Flows: The Costs and Benefits to Consumers 
and Businesses of the Collection and Use of Consumer Information (June 
18, 2003), available at http://www.ftc.gov/bcp/workshops/infoflows/
030618agenda.shtm.
    \19\ See FTC, Individual Reference Services, A Report to Congress 
(1997), available at http://www.ftc.gov/bcp/privacy/wkshp97/
irsdoc1.htm.
    \20\ See Prepared Statement of the FTC, Protecting Consumers' Data: 
Policy Issues Raised by ChoicePoint: Hearing before H. Comm. on Energy 
& Commerce, Subcomm. on Commerce, Trade, and Consumer Protection, Comm. 
on Energy & Commerce, 109th Cong. (Mar. 15, 2005), available at http://
www.ftc.gov/os/2005/03/050315protectingconsumerdata.pdf.
---------------------------------------------------------------------------
    To improve the transparency of the practices of data brokers, the 
Final Report proposes that data brokers, like all companies, provide 
consumers with reasonable access to the data they maintain. Because 
most data brokers are invisible to consumers, however, the Commission 
makes two additional recommendations as to these entities.
    The Commission has long supported legislation that would give 
access rights to consumers for information held by data brokers.\21\ 
For example, Senator Pryor and Chairman Rockefeller's S.1207 includes 
provisions to establish a procedure for consumers to access information 
held by data brokers.\22\ The Commission continues to support 
legislation in this area to improve transparency of the industry's 
practices.\23\
---------------------------------------------------------------------------
    \21\ See, e.g., Prepared Statement of the FTC, Legislative Hearing 
on H.R. 2221, the Data Accountability and Protection Act, and H.R. 
1319, the Informed P2P User Act: Hearing Before the H. Comm. on Energy 
and Commerce, Subcomm. on Commerce, Trade, and Consumer Protection, 
111th Cong. (May 5, 2009), available at http://www.ftc.gov/os/2009/05/
P064504peerto
peertestimony.pdf.
    \22\ Data Security and Breach Notification Act of 2011, S. 1207, 
112th Congress (2011); see also Data Accountability and Trust Act, H.R. 
1707, 112th Congress (2011); Data Accountability and Trust Act of 2011, 
H.R. 1841, 112th Congress (2011).
    \23\ See, e.g., Prepared Statement of the FTC, Data Security: 
Hearing Before the H. Comm. on Energy and Commerce, Subcomm. on 
Commerce, Manufacturing, and Trade, 112th Cong. (May 4, 2011), 
available at http://www.ftc.gov/opa/2011/05/pdf/
110504datasecurityhouse.pdf; Prepared Statement of the FTC, Data 
Security: Hearing Before the H. Comm. on Energy and Commerce, Subcomm. 
on Commerce, Manufacturing, and Trade, 112th Cong.(June 15, 2011), 
available at http://www.ftc.gov/os/testimony/
110615datasecurityhouse.pdf; Prepared Statement of the FTC, Protecting 
Consumers in the Modern World: Hearing Before the S. Comm. on Commerce, 
Science, and Transportation, 112th Cong. (June 29, 2011), available at 
http://www.ftc.gov/os/testimony/110629privacytestimonybrill.pdf.
---------------------------------------------------------------------------
    The Commission also recommends that the data broker industry 
explore the possibility of creating a centralized website where data 
brokers could identify themselves to consumers, describe how they 
collect consumer data, and disclose the types of companies to which 
they sell the information.\24\ The Commission staff intends to discuss 
with relevant companies how this website could be developed and 
implemented voluntarily, to increase the transparency and provide 
consumers with tools to opt out.\25\
---------------------------------------------------------------------------
    \24\ See, e.g., Tanzina Vega & Edward Wyatt, U.S. Agency Seeks 
Tougher Consumer Privacy Rules, N.Y. Times, Mar. 26, 2012, available at 
http://www.nytimes.com/2012/03/27/business/ftc-seeks-privacy-
legislation.html?pagewanted=all (`` `It's not an unreasonable request 
to have more transparency among data brokers.' '') (quoting Jennifer 
Barrett Glasgow, Chief Privacy Officer for Acxiom).
    \25\ The current website of the Direct Marketing Association (DMA) 
offers an instructive model for such a website. The DMA--which consists 
of data brokers, retailers, and others--currently offers a service 
through which consumers can opt out of receiving marketing 
solicitations via particular channels, such as direct mail, from DMA 
member companies. See DMAChoice, http://www.dmachoice.org/dma/member/
home.action.
---------------------------------------------------------------------------
III. Other Policy Initiatives
    In addition, the Commission holds public workshops and issues 
reports to examine the implications of new technologies and business 
practices on consumer privacy. We outline four notable examples below.
    First, in February 2012, the Commission released a staff report on 
mobile applications (``apps'') for children.\26\ The report found that 
in virtually all cases, neither app stores nor app developers provide 
disclosures that tell parents what data apps collect from children, how 
apps share it, and with whom. The report recommends that all members of 
the children's app ecosystem--the stores, developers and third parties 
providing services--should play an active role in providing key 
information to parents.\27\ The report also encourages app developers 
to provide information about data practices simply and succinctly. The 
Commission has already reached out to work with industry to provide 
parents with the information they need, and some industry participants 
have taken positive steps to improve disclosures going forward.
---------------------------------------------------------------------------
    \26\ FTC Staff Report, Mobile Apps for Kids: Current Privacy 
Disclosures are Disappointing (Feb. 2012), available at http://
www.ftc.gov/opa/2012/02/mobileapps_kids.shtm.
    \27\ News reports indicate that some companies, like Apple, are 
already working to limit certain types of data collection via apps. 
See, e.g., Kim-Mai Cutler, Amid Privacy Concerns, Apple Has Started 
Rejecting Apps That Access UDID, TechCrunch (Mar. 24, 2012), http://
techcrunch.com/2012/03/24/apple-udids/.
---------------------------------------------------------------------------
    To discuss how members of the mobile and online ecosystems can best 
disclose their data practices to consumers, the Commission will host a 
public workshop later this month.\28\ The workshop will address the 
technological advancements and marketing developments since the FTC 
first issued its online advertising disclosure guidelines known as 
``Dot Com Disclosures,'' \29\ including the advent of smartphones and 
tablets. The workshop will examine whether and how to revise the Dot 
Com Disclosures in the current online and mobile advertising 
environment and will include a specific panel on mobile privacy 
disclosures.\30\
---------------------------------------------------------------------------
    \28\ FTC Workshop, Dot Com Disclosures (May 30, 2012), available at 
http://www.ftc.gov/opa/2012/02/dotcom.shtm.
    \29\ FTC, Dot Com Disclosures (2000), available at http://
www.ftc.gov/os/2000/05/0005
dotcomstaffreport.pdf.
    \30\ In addition to examining mobile disclosures, the Commission 
continues to examine other privacy and security issues associated with 
the mobile ecosystem. See, e.g., FTC Workshop, Paper, Plastic . . . or 
Mobile?: An FTC Workshop on Mobile Payments (Apr. 26, 2012), available 
at http://www.ftc.gov/bcp/workshops/mobilepayments/.
---------------------------------------------------------------------------
    Second, the FTC hosted a workshop in December 2011 that explored 
facial recognition technology and the privacy and security implications 
raised by its increasing use.\31\ Facial detection and recognition 
technology has been adopted in a variety of new contexts, ranging from 
online social networks to digital signs and mobile apps. Commission 
staff sought comments on the privacy and security issues raised at the 
workshop, which it will address in a report in the coming months.
---------------------------------------------------------------------------
    \31\ FTC Workshop, Face Facts: A Forum on Facial Recognition 
Technology (Dec. 8, 2011), available at http://www.ftc.gov/bcp/
workshops/facefacts/.
---------------------------------------------------------------------------
    Third, as discussed in the Final Report, the FTC intends to examine 
the practices of large platforms such as Internet browsers, mobile 
operating system providers, Internet Service Providers, and large 
social media platforms that can collect data from numerous sources to 
build extensive profiles about consumers. Commission staff will host a 
workshop in the second half of 2012 to examine questions about the 
scope of such data collection practices, the potential uses of the 
collected data, and related issues.
    Finally, the Commission is undertaking a comprehensive review of 
the COPPA Rule in light of rapidly evolving technology and changes in 
the way children use and access the Internet.\32\ In September 2011, 
the Commission proposed modifications to the Rule intended to update 
the Rule to meet changes in technology, assist operators in their 
compliance obligations, strengthen protections over children's data, 
and provide greater oversight of COPPA safe harbor programs.\33\ For 
example, the Commission proposed adding geolocation information and 
cookies used for behavioral advertising to the definition of ``personal 
information,'' which would have the effect of requiring parental 
consent for collection of this information. In addition, the Commission 
proposed adding a new provision addressing data retention and deletion. 
The Commission received over 350 comments on its proposed amendments to 
the COPPA Rule, which are being reviewed by FTC staff.
---------------------------------------------------------------------------
    \32\ See Request for Public Comment on the Federal Trade 
Commission's Implementation of the Children's Online Privacy Protection 
Rule, 75 Fed. Reg. 17,089 (Apr. 5, 2010), available at http://
www.ftc.gov/os/fedreg/2010/april/P104503coppa-rule.pdf.
    \33\ The Commission's Notice of Proposed Rulemaking can be found at 
76 Fed. Reg. 59,804 (Sept. 15, 2011), available at http://www.gpo.gov/
fdsys/pkg/FR-2011-09-27/pdf/2011-24314
.pdf.
---------------------------------------------------------------------------
IV. Enforcement
    In addition to its engagement on the policy front, enforcement 
remains a top priority for the agency. To date, the Commission has 
brought 36 data security cases; almost 80 cases against companies for 
improperly calling consumers on the Do Not Call registry;\34\ 86 cases 
against companies for violating the Fair Credit Reporting Act 
(``FCRA'');\35\ more than 100 spam and spyware cases; 18 COPPA 
cases;\36\ and numerous cases against companies for violating the FTC 
Act by making deceptive claims about the privacy and security 
protections they afford to consumer data. Where the FTC has authority 
to seek civil penalties, it has aggressively done so. It has obtained 
$60 million in civil penalties in Do Not Call cases; $21 million in 
civil penalties under the FCRA; $5.7 million under the CAN-SPAM 
Act;\37\ and $6.6 million under COPPA. Where the Commission does not 
have authority to seek civil penalties, as in the data security and 
spyware areas, it has sought such authority from Congress.
---------------------------------------------------------------------------
    \34\ 16 C.F.R. Part 310.
    \35\ 15 U.S.C. Sec. Sec. 1681e-i.
    \36\ 15 U.S.C. Sec. Sec. 6501-6508.
    \37\ 15 U.S.C. Sec. Sec. 7701-7713.
---------------------------------------------------------------------------
    Two highly publicized privacy cases--against Google and Facebook--
will benefit more than one billion consumers worldwide. The Commission 
charged Google with deceiving consumers by taking previously private 
information--the frequent contacts of Gmail users--and making it public 
in order to generate and populate a new social network, Google 
Buzz.\38\ This, the Commission alleged, was done without the users' 
consent and in contravention of Google's privacy promises. As part of 
the Commission's decision and consent order, Google must protect the 
privacy of consumers who use Gmail as well as Google's many other 
products and services. Under the order, if Google changes a product or 
service in a way that makes any data collected from or about consumers 
more widely available to third parties, it must seek affirmative 
express consent to such a change. In addition, the order requires 
Google to implement a comprehensive privacy program and obtain 
independent privacy audits every other year for the next 20 years.
---------------------------------------------------------------------------
    \38\ Google, Inc., Docket No. C-4336 (Oct. 13, 2011) (final 
decision and consent order), available at http://www.ftc.gov/opa/2011/
10/buzz.shtm.
---------------------------------------------------------------------------
    The FTC's case against Facebook alleged numerous deceptive and 
unfair practices.\39\ These include the 2009 changes made by Facebook 
so that information users had designated private--such as their 
``Friends List'' or pages that they had ``liked''--became public. The 
complaint also charged that Facebook made inaccurate and misleading 
disclosures relating to how much information about users' apps 
operating on the site could access. For example, Facebook told users 
that the apps on its site would only have access to the information 
those apps ``needed to operate.'' The complaint alleges that in fact, 
the apps could view nearly all of the users' information, regardless of 
whether that information was ``needed'' for the apps' functionality. 
The Commission further alleged that Facebook made promises that it 
failed to keep: It told users it would not share information with 
advertisers, and then it did; and it agreed to make inaccessible the 
photos and videos of users who had deleted their accounts, and then it 
did not. Similar to the Google order, the Commission's consent order 
against Facebook prohibits the company from deceiving consumers with 
regard to privacy; requires it to obtain users' affirmative express 
consent before sharing their information in a way that exceeds their 
privacy settings; and requires it to implement a comprehensive privacy 
program and obtain outside audits. In addition, Facebook must ensure 
that it will stop providing access to a user's information after she 
deletes that information.
---------------------------------------------------------------------------
    \39\ Facebook, Inc., Matter No. 0923184 (Nov. 29, 2011) (proposed 
consent agreement), available at http://www.ftc.gov/opa/2011/11/
privacysettlement.shtm.
---------------------------------------------------------------------------
    Most recently, the Commission announced a settlement with the 
social network Myspace. The FTC complaint alleged that, despite 
promising its users that it would not share consumers' personal 
information with advertisers, Myspace provided advertisers with the 
``Friend ID'' of users who were viewing particular pages on the site. 
With the Friend ID, the advertiser could locate the user's Myspace 
personal profile to obtain his or her real name and other personal 
information. The advertiser could also combine the user's real name and 
other personal information with additional information to link broader 
web-browsing activity to a specific named individual. The proposed 
order prohibits Myspace from misrepresenting the privacy and 
confidentiality afforded to users' information, and requires Myspace to 
create a comprehensive privacy program and undergo third-party audits 
every other year for the next 20 years.
    Finally, the Commission continues to make children's privacy a 
priority, as demonstrated by a recent a settlement with RockYou, the 
popular social media gaming company.\40\ Despite its claims to have 
reasonable security, RockYou allegedly failed to use reasonable and 
appropriate security measures to protect consumers' private data, 
resulting in hackers gaining access to 32 million e-mail addresses and 
RockYou passwords. In addition, the Commission charged that RockYou 
collected personal information from approximately 179,000 children it 
knew to be under 13 without providing notice or obtaining parental 
consent, as required by COPPA and despite claims to the contrary. Under 
the Commission's settlement, RockYou must implement a data security 
program and undergo audits every other year for the next 20 years and 
pay a $250,000 civil penalty.
---------------------------------------------------------------------------
    \40\ See United States v. RockYou, Inc., No. CV 12 1487 (N.D. Cal. 
filed Mar. 26, 2012) (consent decree).
---------------------------------------------------------------------------
V. Education
    The FTC conducts outreach to businesses and consumers in the area 
of consumer privacy. The Commission's well-known OnGuard Online website 
educates consumers about many online threats to consumer privacy and 
security, including spam, spyware, phishing, peer-to-peer (``P2P'') 
file sharing, and social networking.\41\ Furthermore, the FTC provides 
consumer education to help consumers better understand the privacy and 
security implications of new technologies. For example, last year the 
Commission issued a guide that provides consumers with information 
about mobile apps, including what apps are, the types of data they can 
collect and share, and why some apps collect geolocation 
information.\42\
---------------------------------------------------------------------------
    \41\ See www.onguardonline.gov. Since its launch in 2005, OnGuard 
Online and its Spanish-language counterpart Alerta en Linea have 
attracted more than 25 million visits.
    \42\ See Press Release, FTC, Facts from the FTC: What You Should 
Know About Mobile Apps (June 28, 2011), available at http://
www.ftc.gov/opa/2011/06/mobileapps.shtm.
---------------------------------------------------------------------------
    The Commission has also issued numerous education materials to help 
consumers protect themselves from identity theft and to deal with its 
consequences when it does occur. The FTC has distributed over 3.8 
million copies of a victim recovery guide, Take Charge: Fighting Back 
Against Identity Theft, and has recorded over 3.5 million visits to the 
Web version.\43\ In addition, the FTC has developed education resources 
specifically for children, parents, and teachers to help children stay 
safe online. The FTC produced the brochure Net Cetera: Chatting with 
Kids About Being Online to give adults practical tips to help children 
navigate the online world.\44\ In less than one year, the Commission 
distributed more than 7 million copies of Net Cetera to schools and 
communities nationwide.
---------------------------------------------------------------------------
    \43\ See Take Charge: Fighting Back Against Identity Theft, 
available at http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/
idt04.shtm.
    \44\ See Press Release, FTC, OnGuardOnline.gov Off to a Fast Start 
with Online Child Safety Campaign (Mar. 31, 2010), available at 
www.ftc.gov/opa/2010/03/netcetera.shtm.
---------------------------------------------------------------------------
    Business education is also an important priority for the FTC. The 
Commission seeks to educate businesses by developing and distributing 
free guidance. For example, the Commission developed a widely-
distributed guide to help small and medium-sized businesses implement 
appropriate data security for the personal information they collect and 
maintain.\45\ The Commission also creates business educational 
materials on specific topics--such as the privacy and security risks 
associated with peer-to-peer file-sharing programs and companies' 
obligations to protect consumer and employee information from these 
risks \46\ and how to properly secure and dispose of information on 
digital copiers.\47\ These publications, as well as other business 
education materials, are available through the FTC's Business Center 
website, which averages one million unique visitors each month.\48\ The 
Commission also hosts a Business Center blog,\49\ which frequently 
features consumer privacy and data security topics; presently, 
approximately 3,500 attorneys and business executives subscribe to 
these e-mail blog updates.
---------------------------------------------------------------------------
    \45\ See Protecting Personal Information: A Guide For Business, 
available at www.ftc.gov/infosecurity.
    \46\ See Peer-to-Peer File Sharing: A Guide for Business, available 
at http://www.ftc.gov/bcp/edu/pubs/business/idtheft/bus46.shtm.
    \47\ See http://business.ftc.gov/documents/bus43-copier-data-
security.
    \48\ See generally http://business.ftc.gov/. The Privacy and Data 
Security portal is the most popular destination for visitors to the 
Business Center.
    \49\ See generally http://business.ftc.gov/blog.
---------------------------------------------------------------------------
    Another way the Commission seeks to educate businesses by 
publicizing its complaints and orders and issuing public closing and 
warning letters. For example, the Commission recently sent warning 
letters to the marketers of six mobile apps that provide background 
screening services.\50\ The letters state that some of the apps 
included criminal record histories, which bear on an individual's 
character and general reputation and are precisely the type of 
information that is typically used in employment and tenant screening. 
The FTC warned the apps marketers that, if they have reason to believe 
the background reports they provide are being used for employment 
screening, housing, credit, or other similar purposes, they must comply 
with the FCRA. The Commission made no determination as to whether the 
companies are violating the FCRA, but encouraged them to review their 
apps and their policies and procedures to ensure they comply with the 
Act.
---------------------------------------------------------------------------
    \50\ Press Release, FTC, FTC Warns Marketers that Mobile Apps May 
Violate Fair Credit Reporting Act (Feb. 7, 2012), available at http://
www.ftc.gov/opa/2012/02/mobileapps.shtm.
---------------------------------------------------------------------------
VI. Conclusion
    These policy, enforcement, and education efforts demonstrate the 
Commission's continued commitment to protecting consumers' privacy and 
security--both online and offline. As noted above, the Commission 
encourages Congress to develop general privacy legislation and to adopt 
targeted legislation addressing data brokers. We appreciate the 
leadership of Chairman Rockefeller and this Committee on these issues 
and look forward to continuing to work with Congress, the 
Administration, industry and other critical stakeholders on these 
issues in the future.

    The Chairman. Thank you, sir.
    The Honorable Cameron F. Kerry, General Counsel, U.S. 
Department of Commerce.

   STATEMENT OF HON. CAMERON F. KERRY, GENERAL COUNSEL, U.S. 
                     DEPARTMENT OF COMMERCE

    Mr. Kerry. Thank you, Chairman Rockefeller, Ranking Member 
Toomey, distinguished members of the Committee. I'm grateful 
for the opportunity to testify today about the administration's 
Blueprint for data privacy.
    This Blueprint is a framework to enhance consumer privacy 
while fostering economic growth, job creation, and exports for 
American businesses.
    The Federal Trade Commission has been a global leader in 
this area as well as a partner to the Department of Commerce 
and a valued adviser to the National Science and Technology 
Council in developing the Privacy Blueprint. So I welcome being 
able to join Chairman Leibowitz and Commissioner Ohlhausen at 
the witness table today.
    The explosion in the collection and storage and analysis of 
data and digital information offers new frontiers of knowledge 
and innovation and growth. But Senator Toomey asked the 
question, what is the market failure here? We are now at a 
tipping point that presents a dual market failure.
    First, while many companies earned trust as responsible 
stewards of consumers' personal information, it exceeds the 
ability of even the most sophisticated consumers to understand 
and control what information is collected about them. And 
second, this asymmetry allows outliers and outlaws that are not 
good stewards of information to take advantage of consumers' 
trust and lack of information.
    That is why a great many companies, consumer groups, the 
FTC, and the administration support baseline consumer privacy 
legislation. When it comes to sustaining trust in the digital 
economy, business and consumer and government interests 
converge.
    The administration's Privacy Blueprint articulates a 
Consumer Privacy Bill of Rights: individual control, 
transparency, respect for context, access and accuracy, 
security, and focused collection and accountability. And it 
calls for Congress to give these broad principles the force of 
law.
    We recommend two mechanisms to apply these principles. The 
first is giving the FTC the direct authority to enforce the 
individual provisions of the Bill of Rights as enacted, rather 
than relying entirely on its Section 5 authority, as currently 
framed.
    The second is authorizing the FTC to grant safe harbors 
from enforcement for codes of conduct that address how best to 
follow the Privacy Bill of Rights in specific contexts.
    The National Telecommunications and Information 
Administration of the Department of Commerce is carrying out 
the administration's Blueprint by initiating stakeholder-driven 
processes to develop codes of conduct. NTIA is reviewing 
recommendations on the first topic and on the process, 
including your comments, Chairman Rockefeller, thank you.
    NTIA should be selecting a topic and convening the first 
meetings very soon.
    In addition, I have asked a working group to put the 
administration's Privacy Blueprint into legislative language we 
are drafting. And we stand ready to work with this Committee 
and with other Members of Congress to put baseline privacy 
legislation into law.
    What we do here in America is paramount to U.S. consumers 
and companies, but we cannot ignore the global reach of the 
Internet. Europe is in the process of honing its approach to 
data privacy. Other countries around the world understand the 
need for rules of the road and are looking for models.
    We have the clear opportunity, as President Obama said in 
his preface to the Privacy Blueprint, to offer the world a 
dynamic model of how to provide strong privacy protection and 
enable ongoing innovation in new information technologies.
    Baseline privacy legislation will ground our system firmly, 
so America can be an example for the world and pave the way for 
privacy standards that are interoperable around the globe. 
Leading by example will encourage other countries to build 
multi-stakeholder processes, flexibility, and accountability 
into their commercial data privacy networks. This model will 
promote the free flow of information across national borders, 
which helps U.S. companies and U.S. consumers alike.
    Mr. Chairman, when I speak to international audiences, I 
point to the deeply held privacy values of Americans that are 
embedded in our Constitution and in privacy laws that couple 
statutory protection in areas like health records with strong 
enforcement by the FTC and by state attorneys general. And I 
get a lot of thank yous from companies for defending our 
system.
    But they want and they need more. They want the U.S. 
Congress to send a clear message to the world that the United 
States cares about privacy and will protect the privacy of 
consumers in all sectors.
    Mr. Chairman, I thank you again for the opportunity to be 
here today, to provide our views. And I welcome the Committee's 
questions.
    [The prepared statement of Mr. Kerry follows:]

     Prepared Statement of Hon. Cameron F. Kerry, General Counsel, 
                      U.S. Department of Commerce

Summary
    Commercial privacy protections have not kept pace with the 
explosive growth of the Internet. Consumers are deeply concerned about 
their privacy, but are unable to determine which companies respect 
their privacy and how their personal data are being collected, stored, 
and used. Similarly, American businesses need to determine and meet the 
privacy expectations of their customers in order to maintain their 
customers' trust, but still wish to innovate within these bounds. 
Consumers and American businesses share a strong interest in defining 
and protecting privacy interests to protect consumers, provide a level 
playing field for businesses, and build an environment of trust that 
benefits innovation and the digital economy.
    To this end, the Administration's Privacy Blueprint articulates a 
Consumer Privacy Bill of Rights--and calls on Congress to give this 
baseline privacy protection the force of law. The seven basic 
principles of the Privacy Blueprint (based on globally recognized Fair 
Information Practices) are: (1) individual control, (2) transparency, 
(3) respect for context, (4) security, (5) access and accuracy, (6) 
focused collection, and (7) accountability. The Administration supports 
giving the Federal Trade Commission (FTC) the authority to enforce the 
principles of the Privacy Bill of Rights, as codified. The FTC also 
should have the authority to provide safe harbors for companies that 
adopt context-specific codes of conduct that set forth how they will 
follow the Privacy Bill of Rights. Such codes of conduct should be 
developed through multistakeholder processes that include broad 
participation from all interested parties, including consumer groups 
and businesses.
    The Administration supports legislation that provides strong 
baseline privacy protections in a manner that promotes growth and 
innovation in the digital economy. Such legislation would allow 
businesses to implement privacy protections in ways that are specific 
and appropriate for their industries. It would avoid being too 
prescriptive or tailored to specific technologies, potentially stifling 
innovation and inhibiting the development of new products or services, 
or being so inflexible that it fails to cover the next generation of 
changes. Nor should legislation impose unnecessary burdens on our 
businesses. These considerations will help the United States strengthen 
consumer privacy protections while promoting continued innovation.

I. Introduction
    Chairman Rockefeller, Ranking Member Hutchison, and distinguished 
Committee Members, thank you for the opportunity to testify on behalf 
of the Department of Commerce about the Administration's recently-
released policy blueprint, Consumer Data Privacy in a Networked World: 
A Framework for Protecting Privacy and Promoting Innovation in the 
Global Digital Economy (the Privacy Blueprint, attached). I welcome 
this opportunity to discuss ways to enhance consumer privacy that will 
foster economic growth, job creation, and exports for American 
businesses.
    As President Obama said in the Privacy Blueprint ``[n]ever has 
privacy been more important than today, in the age of the Internet, the 
World Wide Web and smart phones.'' The need for privacy protections has 
grown in proportion to the expansion of the Internet itself. Every day, 
an increasing share of our commercial transactions, our social 
interactions, and our participation in public discussion depends on the 
Internet as a medium. The way we create and share our communications 
increasingly relies on new technologies that are networked--and 
increasingly raises new questions about how data associated with these 
communications are collected, stored, and used. Ultimately, sustaining 
the social and economic benefits of networked technologies depends on 
consumer trust. People must have confidence that companies will handle 
information about them fairly and responsibly.
    Privacy protections have not kept up with this explosion of 
Internet use and new technology. Due to inadequate protection of data, 
millions of Americans have their personal information exposed in data 
breaches every year. These breaches lead to concrete harm for 
consumers: for 12 consecutive years, identity theft has topped consumer 
complaints received by the FTC, accounting for 15 percent of all 
complaints.\1\
---------------------------------------------------------------------------
    \1\ FTC Releases Top Complaint Categories for 2011: Identity Theft 
Once Again Tops the List, Feb. 28, 2012, available at http://ftc.gov/
opa/2012/02/2011complaints.shtm.
---------------------------------------------------------------------------
    Consumers also lack transparency into how companies collect and use 
data. Not only is it a cliche to say nobody reads privacy policies, but 
studies have indicated that the effort would be hopeless, because an 
average user would have to devote 250 hours a year just to read the 
labyrinthine privacy policies of the websites they visit in a year.\2\ 
Even if those policies all provided a clear roadmap to companies' use 
of data, that is too much to ask; it is as much as 45 minutes of dense 
textual reading for each and every site visited in a day, a full one-
eighth of a working year, every year, just to read the privacy 
policies. All the promise of the Internet, and the benefits and 
efficiencies it can provide, would be dragged down by the anchor of 
privacy policies if we had to slog through all that, much less 
negotiate details of sub-optimal privacy policies or find alternative 
providers for services with unacceptable ones.\3\
---------------------------------------------------------------------------
    \2\ Aleecia M. McDonald and Lorrie Faith Cranor, The Cost of 
Reading Privacy Policies, I/S: A Journal of Law and Policy for the 
Information Society, 2008 Privacy Year in Review Issue, available at 
http://www.is-journal.org/.
    \3\ See http://mashable.com/2011/01/27/the-real-reason-no-one-
reads-privacy-policies-infogra
phic/.
---------------------------------------------------------------------------
    Instead, consumers are subject to terms and conditions they have 
not read or they decide not to use services that may be beneficial and 
innovative. Neither is a good result. In the first instance, consumers 
may give up information and rights without understanding the risks 
sufficiently. In the second instance, commerce and the adoption of 
useful technology are slowed. For example, recent articles about new 
cloud storage services have recounted how privacy concerns are 
affecting consumer adoption.\4\ In the end, some consumers may use 
cloud services without reading the privacy policies while others may 
shy away from such services completely.
---------------------------------------------------------------------------
    \4\ See e.g., PCWorld, Google Drive Privacy Policies Slammed, April 
28, 2012, available at http://www.pcworld.com/article/254600/
google_drive_privacy_policies_slammed.html.
---------------------------------------------------------------------------
    At the same time, businesses recognize the need and benefit of 
baseline privacy legislation. Such legislation would provide rules of 
the road that would facilitate the flow of information and trade 
globally while protecting consumers.\5\ As one commenter stated: 
``consumers want it, we believe companies need it, and the economy will 
be better for it.'' \6\
---------------------------------------------------------------------------
    \5\ See, Department of Commerce Internet Policy Task Force's 
report, Commercial Data Privacy and Innovation in the Internet Economy: 
A Dynamic Policy Framework, at 34, Dec. 2010, available at http://
www.ntia.doc.gov/files/ntia/publications/
iptf_privacy_greenpaper_12162010
.pdf.
    \6\ See id, (quoting Hewlett-Packard Comment at 2).
---------------------------------------------------------------------------
    The Privacy Blueprint seeks to help consumers navigate the 
patchwork of privacy expectations that currently exists as they 
traverse the Internet and to give businesses clearer rules of the road. 
The goal is both to protect consumers and to ensure that the Internet 
remains a platform of commerce and growth, and an economic driver for 
our country. This position may become jeopardized if privacy concerns 
are not addressed, as consumers across all age ranges report avoiding 
companies that do not sufficiently protect their privacy.\7\ And these 
concerns are spreading to quickly developing areas of technology, such 
as mobile computing.\8\
---------------------------------------------------------------------------
    \7\ See Harris Interactive/TRUSTe Privacy Index: Q1 2012 Consumer 
Confidence Edition, Feb. 13, 2012, available at http://www.truste.com/
about-TRUSTe/press-room/news_truste_
launches_new_trend_privacy_index (showing that U.S. adults who avoid 
doing business with companies that do not protect their privacy ranges 
from 82 percent, among 18-34 year olds, to 93 percent, among adults 55 
years old and older).
    \8\ See TRUSTe, More Consumers Say Privacy--Over Security--is 
Biggest Concern When Using Mobile Applications on Smartphones, Apr. 27, 
2011 (reporting results of survey of top 340 free mobile apps conducted 
jointly with Harris Interactive), available at http://www.truste.com/
blog/2011/04/27/survey-results-are-in-consumers-say-privacy-is-a-
bigger-concern-than-security-on-smartphones/.
---------------------------------------------------------------------------
    Consumers and American businesses share a strong interest in 
sustaining the trust that is essential to supporting innovation, 
keeping the Internet growing, and maintaining the growth of the digital 
economy. Consumers need ways to get a better understanding about what 
information is collected about them and how it may be used, as well as 
safeguards that ensure the information is adequately protected. 
Businesses need clearer benchmarks for good practices, and companies 
that handle personal data responsibly should be able to stand out from 
companies that behave carelessly.
    To this end, the Obama Administration has articulated the Consumer 
Privacy Bill of Rights and called on Congress to adopt this Bill of 
Rights in privacy legislation that will establish a minimum set of 
privacy protections for data collected about individual consumers. Such 
legislation would provide clear protections to consumers, a level 
playing field for businesses, and foster an environment of trust that 
will benefit both.
    The Administration is not alone in calling for a new law. A broad 
array of private sector stakeholders has expressed support for baseline 
consumer privacy legislation. Consumer advocacy groups and civil 
liberties organizations, for example, have called for baseline consumer 
privacy legislation. In addition, many businesses also have supported 
baseline privacy legislation because they see significant value in 
obtaining clear privacy guidelines that enable them to earn consumers' 
trust, and which may also enable them to comply with international 
expectations. These businesses include large technology leaders that 
handle significant amounts of personal information and have used 
personal data to provide innovative new products and services.
    My testimony today will cover the recommendations of the 
Administration's Privacy Blueprint. Looking ahead, it will focus on how 
legislation can implement the Privacy Bill of Rights, how Department of 
Commerce multistakeholder processes to develop codes of conduct in 
specific sectors will move forward, and what the Administration is 
doing to ensure that our privacy framework promotes growth and trade 
internationally for American companies.

II. The Consumer Privacy Bill of Rights
    In 2009, the Department of Commerce assembled an Internet Policy 
Task Force. This task force spent two years developing a blueprint for 
protecting consumer's privacy with extensive consultation of 
stakeholders including consumer advocacy groups, businesses, academics, 
and other government agencies. The task force began by using the 
information learned from consulting stakeholders to craft a Privacy and 
Innovation Notice of Inquiry (NOI).\9\ The NOI requested public comment 
on ways of improving privacy protections while still protecting 
technological innovations. The task force also organized a Privacy and 
Innovation Symposium on May 7, 2010.
---------------------------------------------------------------------------
    \9\ Department of Commerce, Notice of Inquiry on Information 
Privacy and Innovation in the Internet Economy, 75 Fed. Reg. 21226, 
Apr. 23, 2010, available at http://www.ntia.doc.gov/files/ntia/
publications/fr_privacynoi_04232010.pdf.
---------------------------------------------------------------------------
    The initial conclusions obtained from stakeholder discussions, the 
comments received in response to the NOI, and discussions from the 
symposium led to the publication in December 2010 of Commercial Data 
Privacy and Innovation in the Internet Economy: A Dynamic Policy 
Framework, often referred to as the Commerce Green Paper.\10\ This 
Green Paper proposed a privacy framework and invited further comments 
on the proposed approach. The framework was refined as a result of 
further comments and meetings with hundreds of stakeholders 
representing the full spectrum of privacy interests to come up with a 
final strategy. This was an effort that engaged agencies across the 
Executive Branch through the National Science & Technology Council 
Subcommittee on Commercial Privacy that I co-chaired, and benefited 
from the valuable partnership and advice of the Federal Trade 
Commission.
---------------------------------------------------------------------------
    \10\ The Privacy Blueprint builds on the Department of Commerce 
Internet Policy Task Force's report, Commercial Data Privacy and 
Innovation in the Internet Economy: A Dynamic Policy Framework, Dec. 
2010, available at http://www.ntia.doc.gov/files/ntia/publications/
iptf_
privacy_greenpaper_12162010.pdf.
---------------------------------------------------------------------------
    Based on our study, in February the White House released its 
Privacy Blueprint.\11\ This Privacy Blueprint calls for the passage of 
a Consumer Privacy Bill of Rights; for enforceable codes of conduct to 
implement that Bill of Rights developed by a spectrum of stakeholders 
from consumer groups, businesses, and others; and for active engagement 
with international partners to develop privacy protections that enable 
trustworthy transfer of data across national borders.
---------------------------------------------------------------------------
    \11\ The White House, Consumer Data Privacy in a Networked World: A 
Framework for Protecting Privacy and Promoting Innovation in a Global 
Digital Economy, Feb. 2012, available at http://www.whitehouse.gov/
sites/default/files/privacy-final.pdf (``Privacy Blueprint'').
---------------------------------------------------------------------------
    Apart from enforcement of consumer protection laws by the Federal 
Trade Commission and state attorneys general when privacy practices are 
unfair and deceptive, Federal privacy protections in the United States 
are based on a sectoral approach that provides privacy protections 
tailored to specific industries such as finance, health care, and 
education. Industries that are not subject to such specific privacy 
laws, however, account for large shares of daily Internet usage; these 
include search engines, social networking sites, behavioral 
advertisers, and location-based services. For industries that are not 
covered by more specific laws, the Privacy Blueprint calls for baseline 
privacy protections in the form of a Consumer Privacy Bill of Rights.
    The Consumer Privacy Bill of Rights articulates a set of principles 
that clarify to businesses and consumers alike what expectations the 
consumer should have from their Internet experience. The seven basic 
principles are:

   Individual Control: Consumers have a right to exercise 
        control over what personal data companies collect from them and 
        how they use it.

   Transparency: Consumers have a right to easily 
        understandable and accessible information about privacy and 
        security practices.

   Respect for Context: Consumers have a right to expect that 
        companies will collect, use, and disclose personal data in ways 
        that are consistent with the context in which consumers provide 
        the data.

   Security: Consumers have a right to secure and responsible 
        handling of personal data.

   Access and Accuracy: Consumers have a right to access and 
        correct personal data in usable formats, in a manner that is 
        appropriate to the sensitivity of the data and the risk of 
        adverse consequences to consumers if the data is inaccurate.

   Focused Collection: Consumers have a right to reasonable 
        limits on the personal data that companies collect and retain.

   Accountability: Consumers have a right to have personal data 
        handled by companies with appropriate measures in place to 
        assure they adhere to the Consumer Privacy Bill of Rights.

    These principles are based on globally recognized Fair Information 
Practice Principles (FIPPs), which originated in the Department of 
Health, Education and Welfare's 1973 report, Records, Computers, and 
the Rights of Citizens. Congress incorporated these principles into the 
Privacy Act of 1974. Since then, a consistent set of FIPPs has become 
the foundation for global privacy policy through, for example, the 
Organization for Economic Co-operation and Development's Guidelines on 
the Protection of Privacy and Transborder Flows of Personal Data 
(``OECD Privacy Guidelines'') and the Asia-Pacific Economic 
Cooperation's Privacy Framework. The Administration sought to remain 
consistent with these existing globally-recognized FIPPs as it 
developed the Consumer Privacy Bill of Rights.
    Many individuals and organizations that commented on the Commerce 
Department's Privacy and Innovation Green Paper noted that changes in 
the ways information is generated, collected, stored, and used called 
for some adaptation of existing statements of the FIPPs. The digital 
economy of the 21st Century, driven by distribution of devices and 
connectivity and vast increases in computing speed, storage capacity, 
and applications, is data-intensive, dynamic, and increasingly driven 
by consumers' active participation. We therefore updated the 
traditional FIPPs to suit the challenges posed by the digital economy. 
The most significant changes are found in the principles of Individual 
Control, Respect for Context, Focused Collection, and Accountability.

1. Individual Control
    The principle of Individual Control addresses two salient aspects 
of the networked world. First, networked technologies offer consumers 
an increasing number of ways to assert control over what personal data 
is collected. Companies should take advantage of these technologies by 
offering consumers, at the time of collection, usable tools and clear 
explanations of their choices about data sharing, collection, use, and 
disclosure.
    Second, the Individual Control principle calls on consumers to use 
these tools to take responsibility for controlling personal data 
collection, especially in situations where consumers actively share 
data about themselves, such as online social networks. In these cases, 
control over the initial act of sharing is critical. Consumers can take 
significant steps to reduce harms associated with the misuse of their 
data by using improved tools available to gain a better understanding 
of what personal data they are disclosing and to control their data.

2. Respect for Context
    The second noteworthy way in which the Consumer Privacy Bill of 
Rights adapts traditional FIPPs is reflected in the principle of 
Respect for Context. The basic premise of this principle is simple: the 
relationship between consumers and a company--that is, the context of 
personal data use--should help determine whether a specific use is 
appropriate and what kinds of consumer choices may be necessary. 
Factors such as what consumers are likely to understand about a 
company's data practices based on the products and services it offers, 
how a company explains the roles of personal data in delivering these 
products and services, research on consumers' attitudes and 
understandings, and feedback from consumers should also enter these 
assessments.
    The Respect for Context principle embodies the flexibility that is 
at the core of the Consumer Privacy Bill of Rights: it calls for strong 
protection when the context indicates--when sensitive personal 
information is at stake, for example--but personal data can flow 
relatively freely to support purposes that consumers reasonably 
anticipate in a given context.
    For example, suppose an online social network holds out its service 
as a way for individuals to connect with people they know and form ties 
with others who share common interests. In connection with this 
service, the provider asks new users to submit biographical information 
as well as information about their acquaintances. As consumers use the 
service, they may provide additional information through written 
updates, photos, videos, and other content they choose to post. The 
social network's use of this information to suggest connections that 
its users might wish to form is integral to the service and foreseeable 
from the social networking context. Seeking consumers' affirmative 
consent to use personal data for the purpose of facilitating 
connections on the service is therefore not necessary. By contrast, if 
the social network uses this information for purposes outside this 
social networking context, such as employment screening or credit 
eligibility, the Respect for Context principle would call for 
prominent, clear notice and meaningful opportunities for consumer 
choice. The Respect for Context principle will help protect consumers 
against these real harms that can arise when information is lifted out 
of one context and used unexpectedly in another.
    Similarly, explicit consent may not be required for the use of a 
consumer's address for the delivery of a product ordered online, but if 
that company sells the information to a third party such consent may be 
necessary. Requiring explicit consent in every case inures consumers to 
accepting all terms and conditions presented to them while limiting 
such consent to unexpected uses of consumer data empowers consumers.
    The sophistication of a company's customers is an important element 
of context. In particular, the unique characteristics of children and 
teenagers may warrant different privacy protections than are suitable 
for adults. Children are particularly susceptible to privacy harms.\12\ 
The Administration looks forward to exploring with stakeholders whether 
more stringent applications of the Consumer Privacy Bill of Rights--
such as an agreement not to create individual profiles about children, 
even if online services obtain the necessary consent from the child to 
collect personal data--are appropriate to protect children's privacy.
---------------------------------------------------------------------------
    \12\ See Federal Trade Commission, Protecting Consumer Privacy in 
an Era of Rapid Change: Recommendations for Businesses and 
Policymakers, at 63, March 2012 (``when health or children's 
information is involved, for example, the likelihood that data misuse 
could lead to embarrassment, discrimination, or other harms is 
increased.'').
---------------------------------------------------------------------------
3. Focused Collection
    The Focused Collection principle adapts the ``data minimization'' 
and ``collection limitation'' principles found in traditional FIPPs. 
Some existing versions of these principles provide a strict standard 
that makes personal data collection permissible only when it is kept to 
the minimum necessary to achieve specific, identified purposes. Such a 
one-size-fits-all standard is unworkable for the networked technologies 
and new data uses that enable the digital age.
    Familiar and increasingly essential Internet services, such as 
search engines, collect a wide range of data and use it in a wide 
variety of ways that cannot be predicted when the data is collected. 
Stores of information like these have the potential to provide new 
frontiers of human knowledge in addition to new pathways for intrusion 
on privacy. Such services may be consistent with the Focused Collection 
principle, provided they reflect considered decisions about what kinds 
of personal data are necessary to provide the services, how long the 
data needs to be retained, and what measures may be available to make 
retained data less likely to be associated with specific consumers. 
Focused collection will help protect consumers from harm associated 
with misuse of data that never needed to be collected or retained to 
begin with. The Focused Collection principle, however, does not relieve 
companies of any independent legal obligations, including law 
enforcement orders, that require them to retain personal data.

4. Accountability
    Finally, the Accountability principle emphasizes that the measures 
companies take to educate employees about using personal data, prevent 
lapses in their privacy commitments, and detect and remedy any lapses 
that occur are crucial to protecting consumer privacy. Accountability 
also assures that, when consumers feel harmed by the way their data is 
handled, their complaints can go to the entity responsible for handling 
that data. Accountability mechanisms also may provide a route toward 
greater global interoperability. The Administration is actively 
exploring how accountability mechanisms, which could be developed 
through a privacy multistakeholder process, could ease privacy 
compliance burdens for companies doing business globally.

III. Legislation

A. Codify Baseline Privacy Protection Principles
    The Privacy Bill of Rights establishes a set of expectations that 
consumers can use to understand what they should expect from businesses 
they deal with, and businesses can use to guide their privacy policies 
and practices. It establishes a benchmark that consumer and privacy 
groups, journalists, and policymakers can use to gauge privacy 
practices. Businesses that incorporate the Bill of Rights into their 
practices will help differentiate themselves as trustworthy stewards of 
personal information, enhancing competition based on privacy 
protection.
    These changes can begin without legislation, but the Administration 
urges Congress to strengthen baseline privacy protections for consumers 
and to support continued consumer trust in the digital economy by 
codifying the Consumer Privacy Bill of Rights as part of baseline 
commercial privacy legislation. The Consumer Privacy Bill of Rights 
sets forth fundamental protections that have been well received by both 
consumers and businesses, and legislation is supported by businesses as 
well as civil society.
    The Commerce Committee has a long history of avoiding technical 
mandates in legislation, which the Administration applauds. The 
principles in the Privacy Bill of Rights are intentionally broad to 
avoid technical mandates or excessively prescriptive requirements. The 
digital economy is constantly changing as are the risks and solutions 
to consumer privacy concerns. Legislation that is too prescriptive or 
that allows government to dictate specific technologies may stifle 
innovation and inhibit the development of new products or services. 
Similarly, legislation should not impose unnecessary burdens on all 
businesses to address a privacy concern that is relevant only to a 
subset of companies. Privacy legislation should be broad and flexible 
enough to cover existing services as well as future products and 
services that raise unforeseen concerns. Enactment of the Privacy Bill 
of Rights as a set of legally enforceable rights would provide strong 
baseline privacy protections and permit flexibility both in enforcement 
and in industry compliance.
    The Administration Privacy Blueprint recommends two mechanisms to 
apply the broad principles of the Privacy Bill of Rights to specific 
circumstances or practices. The first is enforcement of the Bill of 
Rights by the FTC and state attorneys general. The second is the 
development of legally enforceable codes of conduct through a voluntary 
multistakeholder process convened by the National Telecommunications & 
Information Administration (NTIA) of the Department of Commerce.

B. Grant Direct Enforcement Authority to the FTC
    The Administration supports giving the FTC the direct authority to 
enforce the individual provisions of the Consumer Privacy Bill of 
Rights as enacted in law rather than relying only on its authority 
under Section 5 of the FTC Act to address unfair and deceptive 
practices or acts. Under Chairman Leibowitz as well as under 
Republican-appointed chairs in the preceding decade, the FTC has 
developed a body of law as well as expertise in privacy using its 
Section 5 authority. Giving the FTC direct authority to enforce the 
Bill of Rights would give future direction to this body of law, 
strengthen protection of consumers, and permit the FTC to address 
emerging privacy issues through specific enforcement actions governed 
by applicable procedural safeguards.
    Baseline privacy protections enforced by the FTC would provide a 
level playing field for companies. Currently, a number of companies 
offer consumers strong privacy protections. Bad actors, however, are 
abusing the trust of consumers and using their information in ways not 
reasonably expected by their customers. Such actions undermine consumer 
trust in the digital economy to the detriment of businesses and 
consumers alike. Granting direct enforcement authority to the FTC would 
enable the Commission to take action against outliers and bad actors 
even if their actions do not violate a published privacy policy so as 
to constitute a deceptive practice or act.

C. Safe Harbor for FTC Approved Codes of Conduct Developed Through 
        Multistakeholder Processes
    The Administration also supports the use of multistakeholder 
processes to address consumer privacy issues that arise and change as 
quickly as networked technologies and the products and services that 
depend on them. These processes should be open to a broad range of 
participants, including companies, privacy advocates, academics, and 
civil and criminal law enforcement representatives, and facilitate 
their full participation to find creative solutions through consensus 
building. Specifically, the Privacy Blueprint directs the Department of 
Commerce, through the NTIA, to convene interested stakeholders to 
address consumer privacy issues in transparent, consensus-based 
processes that are open to all interested stakeholders.
    The Administration supports codifying this role for NTIA in 
baseline privacy legislation because legislation would reinforce NTIA's 
mission and its ability to convene stakeholders. Under the 
Administration's recommended framework, companies would face a choice: 
follow the general principles of the statutory Consumer Privacy Bill of 
Rights, or commit to following a code of conduct that spells out how 
those rights apply to their businesses. If the FTC determines that this 
code of conduct adequately implements the Consumer Privacy Bill of 
Rights, the FTC would forbear from enforcing the provisions of the 
Consumer Privacy Bill of Rights implemented in the code of conduct 
against companies that subscribe to it, so long as they live up to 
their commitment. This approach would provide greater certainty for 
companies and stronger incentives for all stakeholders to work toward 
consensus on codes of conduct, but it requires authority from Congress 
to work most effectively.
    There is a model for this safe harbor approach in the context of 
privacy in the Children's Online Privacy Protection Act of 1998 
(COPPA). The FTC has years of experience in implementing COPPA and the 
statute has been praised for providing parents with the tools they need 
to protect the privacy of children under 13.
    The expected outputs of these multistakeholder processes are 
context-specific codes of conduct that companies may choose to adopt as 
public commitments setting forth how they will follow the Privacy Bill 
of Rights. Once a company publicly commits to follow a code of conduct, 
the Administration expects that this commitment will be enforceable by 
the FTC and state attorneys general, just as companies' privacy 
policies and other promises are enforceable today.
    The multistakeholder approach to privacy will strike a balance 
between certainty for companies, strong protections for consumers, and 
the flexibility necessary to promote continued innovation. Implementing 
the general principles in the Consumer Privacy Bill of Rights, as 
enacted in legislation, across the wide range of innovative uses of 
personal data should allow for a flexible, fast-paced process to 
determine how to define concrete practices that embody the broader 
principles in a specific setting. This process must be capable of 
addressing consumer privacy issues that arise and change quickly in the 
networked world. In addition, it should focus on specific business 
settings to help stakeholders address concrete privacy issues and 
business requirements, leading to practices that protect privacy 
without discouraging innovation. The process must also allow a broad 
range of stakeholders, including consumer groups and privacy scholars 
to participate meaningfully so they can ensure the codes of conduct 
carry out the principles of the Privacy Bill of Rights. For consumer 
and privacy advocates, the privacy multistakeholder process provides an 
opportunity to influence these practices through direct engagement with 
companies.
    This vision draws from several successful examples of Internet 
policy development. Private-sector standards setting organizations, for 
example, are at the forefront of setting Internet-related technical 
standards. Groups such as the Internet Engineering Task Force (IETF) 
and the World Wide Web Consortium (W3C) use transparent 
multistakeholder processes to set Internet-related technical standards. 
These processes are successful, in part, because stakeholders share an 
interest in developing consensus-based solutions to the underlying 
challenges. Successful government-convened Internet policymaking 
efforts in the past also provide precedents for the multistakeholder 
approach proposed in the Privacy Blueprint. For example, the Executive 
Branch led the privacy discussions of the 1990s and early 2000s, which 
continue to be central to advancing consumer data privacy protections 
in the United States. More recently, the FTC has encouraged 
multistakeholder efforts to develop a ``Do Not Track'' mechanism, which 
would afford greater consumer control over personal data in the context 
of online behavioral advertising.
    Thoughtful and balanced baseline commercial privacy legislation is 
good for consumers and industry. As the digital economy opens the world 
to commerce and social interactions, the United States should provide 
the leadership necessary to promote consumer privacy and trust in a 
manner that promotes innovation and competition. We should not cede 
this role to other countries that may impose unnecessarily restrictive 
burdens on U.S. industry with little or no consumer benefit.
    The Administration is developing specific statutory suggestions to 
implement the Consumer Privacy Bill of Rights and welcome the 
opportunity to work with this Committee to enact baseline privacy 
legislation.

IV. Developing Enforceable Codes of Conduct through Multistakeholder 
        Processes
    The Administration has begun to take action to implement the 
Consumer Privacy Bill of Rights before baseline legislation is enacted. 
NTIA has begun to move ahead with stakeholder-driven processes to 
develop codes of conduct based on the Bill of Rights.
    Immediately after the Privacy Blueprint was issued, NTIA sought 
comment from stakeholders on two sets of questions: which substantive 
issue is suitable for an initial effort to develop an enforceable code 
of conduct, and what procedures should the process to address this 
issue follow. NTIA suggested a number of substantive issues that are 
relatively discrete and manageable with the potential to deliver 
significant benefits to consumers through a code of conduct. The 
request asked stakeholders to comment on the pros and cons of taking up 
these issues and to offer other issues that meet the criteria of 
definability and potential consumer benefit. NTIA also asked for input 
on procedures that will make the process manageable yet open to all 
interested stakeholders' participation, transparent, and consensus-
based.
    The comment period closed on Monday, April 2, and the Commerce 
Department is in the process of reviewing the submissions. NTIA 
received comments from consumer groups, businesses, academics, and 
Members of Congress, including the Chairman of this Committee.
    I anticipate that NTIA will soon select an initial topic and 
convene an initial public meeting to begin developing a code of 
conduct. Part of the business of this initial meeting will be for 
stakeholders to reach agreement on the procedures they will use to work 
together. While NTIA likely will provide some guidance and perspective, 
based on its participation in other multistakeholder processes as well 
as its review of comments on this process, NTIA will avoid imposing its 
judgment on the group.
    In other words, NTIA's role will be to convene stakeholders and 
facilitate discussions that ensure all voices are heard, but it will 
not be the decision-maker on the substantive elements of privacy codes 
of conduct. The government's role will be as a convener and a 
facilitator to forge consensus.

V. International Interoperability
    What we do here in America is of paramount importance to U.S. 
consumers and companies, but we cannot ignore the global dimensions of 
the Internet. The dynamism of the digital economy is linked directly to 
flows of data across borders. This is why an essential element of the 
Administration's Blueprint for consumer privacy is international 
engagement.
    Americans expect to follow blog posts and tweets from around the 
world. We expect our e-mail to pop-up nearly instantaneously without 
thinking about whether it crossed national borders to get there. We 
demand information, goods, and services 24 hours a day, 7 days a week, 
regardless of whether they are provided from across town or across the 
globe.
    In today's digital economy it is vital to maintain cross-border 
data flows to keep U.S. businesses tapped into the markets of the world 
and drive the continued growth of this sector. Over $8 trillion were 
exchanged over the Internet last year, and this amount is growing.\13\ 
The digital economy accounted for 15 percent of U.S. GDP growth over 
the five-year period from 2004 to 2009.\14\ Total retail e-commerce 
sales for 2011 reached an estimated $194.3 billion, 16.1 percent more 
than in 2010, and accounting for 4.6 percent of total retail sales 
versus 4.3 percent in 2010.\15\ We must ensure that American companies 
that are leaders in Internet technology, cloud computing, and e-
commerce, as well as innovative startups, have continued access to 
markets unimpeded by regulations that erect barriers to information 
flow at national borders and Balkanize the Internet. To do this, the 
United States must remain on the cutting edge of the digital economy in 
terms of both technology and policy-making as it relates to the 
Internet.
---------------------------------------------------------------------------
    \13\ Bipartisan Policy Center, FCC Chairman Julius Genachowski: 
Prepared Remarks on Cybersecurity; Feb. 22, 2012, http://
transition.fcc.gov/Daily_Releases/Daily_Business/2012/db0222/DOC-
312602A1.pdf, at 1.
    \14\ McKinsey Global Institute, Internet Matters: The Net's 
Sweeping Impact on Growth, Jobs, and Prosperity, May 2011, http://
www.mckinsey.com/Insights/MGI/Research/Technology_
and_Innovation/Internet_matters at 15-16.
    \15\ U.S. Census Bureau, Quarterly Retail E-Commerce Sales: Fourth 
Quarter 2011, Feb. 16, 2012, http://www.census.gov/retail/mrts/www/
data/pdf/ec_current.pdf, at 1.
---------------------------------------------------------------------------
    The Privacy Blueprint recognizes that international 
interoperability should start with mutual recognition of commercial 
data privacy frameworks. The Department of Commerce has been at the 
forefront of commercial privacy interoperability efforts, beginning 
with our negotiation of the U.S.-EU Safe Harbor Framework in 2000 and 
most recently with our leadership in the development of a system of 
Cross Border Privacy Rules in the Asia Pacific Economic Cooperation. 
Recently, Secretary Bryson and European Commission Vice President 
Reding reaffirmed their commitment to the U.S.-EU Safe Harbor Framework 
in a joint statement stating, ``[t]his Framework, which has been in 
place since 2000, is a useful starting point for further 
interoperability. Since its inception, over 3,000 companies have self-
certified to the Framework to demonstrate their commitment to privacy 
protection and to facilitate transatlantic trade. The European 
Commission and the Department of Commerce look forward to continued 
close U.S.-EU collaboration to ensure the continued operation and 
progressive updates to this Framework.''
    We look forward to exploring additional interoperability mechanisms 
with our European partners in particular, because they are in the midst 
of reviewing their privacy framework. Our European partners have taken 
note of our multistakeholder approach. Although domestically focused, 
the codes of conduct developed through the multistakeholder process 
could have global relevance, because consumers around the world are 
faced with similar privacy challenges.
    Alongside these international initiatives, privacy legislation will 
firmly ground our consumer data privacy system here so that we can set 
the best example for the world and set the stage for necessary mutual 
recognition by other countries. Leading by example will encourage other 
countries to build multistakeholder processes, transparency, and 
flexibility into their commercial data privacy frameworks. This will 
help foster the free flow of information, which will benefit U.S. 
companies and consumers alike. We should anchor our own consumer data 
privacy system in law to guarantee the international interoperability 
our companies and our citizens need.
    This is a critical time in the world of consumer data privacy. 
Europe is in the process of honing its approach to data privacy, and 
other countries around the world are starting to understand the need 
for rules of the road for the increasingly data-driven digital economy. 
We have a clear opportunity, as President Obama said to ``offer to the 
world a dynamic model of how to offer strong privacy protection and 
enable ongoing innovation in new information technologies.'' It is 
incumbent upon us to take the reins of the digital economy and ensure 
its forward momentum.

VI. Conclusion
    We ask Congress to give the Consumer Privacy Bill of Rights the 
force of law. These rights will provide protection for consumers and 
define comprehensible rules of the road for the rapidly growing 
marketplace for personal data. As envisioned in the Administration's 
Privacy Blueprint, the Consumer Privacy Bill of Rights would provide a 
set of standards that many responsible companies are already meeting, 
and legislation would serve to put these companies on a level playing 
field with those who are less careful with personal data.
    Mr. Chairman, thank you again for the opportunity to provide our 
views on legislation to protect consumer privacy and promote innovation 
in the 21st Century. We look forward to working with you and other 
stakeholders toward enactment of these consumer data privacy 
protections. I welcome any questions.

    The Chairman. Thank you very much, sir.
    Commissioner Ohlhausen, welcome.

 STATEMENT OF HON. MAUREEN K. OHLHAUSEN, COMMISSIONER, FEDERAL 
                        TRADE COMMISSION

    Ms. Ohlhausen. Thank you. Chairman Rockefeller, Ranking 
Member Toomey, and members of the Committee, I'm pleased to 
join Chairman Leibowitz, who is presenting FTC's testimony, and 
Cameron Kerry, General Counsel of the Department of Commerce.
    Privacy is an important topic for American consumers, and I 
commend you for holding this hearing. But let me say at the 
outset that my comments and the views expressed in this 
statement are my own and do not necessarily represent the views 
of the Commission or any other commissioner.
    As you know, my tenure as an FTC commissioner began on 
April 4, so while privacy is an issue in which I have 
tremendous interest and commitment, my views on privacy from 
the perspective of a commissioner are just over a month old.
    While I have read the March 2012 privacy report and formed 
some initial thoughts, I was not at the Commission during its 
development and release. I'm just now in the process of fully 
educating myself on the specifics of the report and thinking 
through the implications of its recommendations. So I'm not yet 
ready to commit myself to specific positions on all aspects of 
the privacy issues raised in the report.
    I am, however, happy to share some of my preliminary views 
on the best ways to safeguard consumer privacy, as well as my 
thoughts about where the Commission should deploy its 
resources.
    To start, I firmly believe that consumers should have the 
tools to protect their personal information through 
transparency and choice. As I said during my confirmation 
hearing, I support the FTC's strong record of enforcement in 
the area of privacy. The Commission's written testimony 
highlights many of our enforcement efforts relating to privacy 
and data security.
    The FTC has brought more than 100 spam and spyware cases, 
and more than 30 data security cases, including cases against 
ChoicePoint, CVS, and Twitter. We have also charged companies 
with failing to live up to their privacy promises, as in the 
highly publicized privacy cases against companies such as 
Google and Facebook, which together will protect the privacy of 
more than 1 billion users worldwide.
    As a commissioner, I will urge continuation of this strong 
enforcement record.
    As I also said in my confirmation hearing, I support 
enactment of data security legislation. The legislation should 
empower the FTC to promulgate regulations for the protection of 
personal data from unauthorized access, as do the current bills 
by Chairman Rockefeller and Chairman Pryor.
    As a parent, I am especially concerned about protecting our 
children's privacy in the face of rapid technological advances. 
I support the commission's multipronged approach in this area: 
enforcement, regulation, policy, research, and education.
    Since the enactment on the Children's Online Privacy 
Protection Act of 1998 (COPPA), the Commission has brought 18 
COPPA enforcement actions. In the ongoing proceeding to amend 
the rule, I will carefully consider the record as I formulate 
my views.
    Turning to the Commission's privacy report, I would like to 
commend some important aspects of it. It calls for a policy of 
privacy by design, by which companies build privacy protections 
into their everyday business practices. This helps minimize the 
risk of privacy breaches and concerns from the outset and 
should be considered a best practice by companies as they 
develop new products and services.
    Appropriate use of the notice and choice concept is also 
core to a sound privacy policy. And I support the report's 
recognition that there is no single best way to offer notice 
and choice in all circumstances. I also agree with the concept 
of reducing burdens on consumers and businesses by identifying 
circumstances for which choice is not necessary because the 
collection and use of consumer data is consistent with the 
context of the transaction or with the relationship with the 
consumer.
    As I have already noted, Congress has given the commission 
enforcement and policy tools to provide a strong framework with 
which we can protect American consumers. Some of my colleagues, 
however, have supported additional privacy legislation that 
would go beyond Section 5. The exact contours of such 
legislation are not yet defined, but my colleagues gave general 
guidance in the privacy report.
    The privacy report was clear, however, that the recommended 
legislation would reach practices that would not be challenged 
under the current interpretation of Section 5, however.
    I believe this gives me the opportunity to develop my own 
opinion on what else, in addition to Section 5, may be 
beneficial to consumers, such as whether additional general 
privacy legislation is needed. I will consult with FTC staff, 
my fellow commissioners, as well as many other stakeholders, to 
gather their views on what problems and possible solutions they 
see in the area of consumer privacy.
    Some of the issues I will examine are what harms are 
occurring now that Section 5 cannot reach, and how should harm 
be measured? As my colleague, Commissioner Rosch, noted in his 
dissent to the privacy report, the Commission has, in the past, 
specifically advised Congress that, absent deception, it will 
not enforce Section 5 against alleged intangible harm.
    And the FTC's own unfairness statement suggests that the 
focus should be on monetary, as well as health and safety 
harms, rather than on more subjective types of harm.
    Although the Commission's privacy report did not reject the 
fundamental insight of the harm-based approach, it appears to 
embrace an expansion of the definition of harm to include 
reputational harm or the fear of being monitored or other 
intangible privacy interests. As an initial matter, I have 
reservations about such an expansion.
    Even absent deception, financial and medical information is 
protected under current law, which likely reflects most 
consumers' expectations. In other areas, however, consumers 
appear to have diverse views about sharing information. Thus, 
it is important to proceed carefully to avoid impinging on many 
consumers' preferences.
    If a consumer is provided with clear notice prior to the 
collection of information, there is likely no basis for 
concluding that a consumer cannot make an informed choice.
    I would also like to find out more about the progress of 
the self-regulatory and technology-based efforts underway to 
provide consumers greater transparency in choice about the 
collection and use of their data.
    Finally, new restrictions may also have an effect on 
competition by favoring entrenched entities that already have 
consumer information over new entrants who need to obtain such 
information, or encouraging industry consolidation for purposes 
of sharing data. As a competition agency, the FTC should be 
sensitive to these concerns as well.
    Clearly, the technology sector is developing at lightning 
speed, and we now face issues unheard of even a few years ago. 
I wish to proceed cautiously in exploring the need for any 
additional general privacy legislation, however.
    I have concerns about the ability of legislative or 
regulatory efforts to keep up with the innovations and advances 
of the Internet without also imposing unintended, chilling 
effects on many of the enormous benefits consumers have gained 
from these advances, or without unduly curtailing the 
development in success of the Internet economy.
    Thank you for allowing me to participate in today's 
hearing. This committee has shown strong leadership in the area 
of consumer privacy, and I look forward to working with you to 
ensure that American consumers' privacy is protected. Thank 
you.
    [The prepared statement of Ms. Ohlhausen follows:]

       Prepared Statement of Maureen K. Ohlhausen, Commissioner, 
                        Federal Trade Commission

    Chairman Rockefeller and members of the Committee. I am pleased to 
join Chairman Leibowitz, who is presenting the FTC's testimony and 
Cameron Kerry, General Counsel at the Department of Commerce. This is 
an important topic for American consumers and I commend you for holding 
this hearing. Let me say at the onset of my comments that the views 
expressed in this statement are my own and do not necessarily represent 
the views of the Commission or any other Commissioner.
    As you know, my tenure as an FTC Commissioner began on April 4. So 
while privacy is an issue in which I have tremendous interest and 
commitment, my views on privacy from the perspective of a Commissioner 
are just over a month old. While I have read the March 2012 Privacy 
Report and formed some initial thoughts, I was not at the Commission 
during its development and release. I am just now in the process of 
fully educating myself on the specifics of the report and thinking 
through the implications of its recommendations. So, I am not yet ready 
to commit myself to specific positions on all aspects of the privacy 
issues raised in the Report.
    I am, however, happy to share some of my preliminary views on the 
best ways to safeguard consumer privacy as well as my thoughts about 
where the Commission should deploy its resources. To start, I firmly 
believe that consumers should have the tools to protect their personal 
information through transparency and choices. As I said during my 
confirmation hearing, I support the FTC's strong record of enforcement 
in the area of privacy. The Commission's written testimony highlights 
many of our enforcement efforts relating to privacy and data security. 
The FTC has brought more than a hundred (100) spam and spyware cases 
and more than thirty (30) data security cases, including cases against 
ChoicePoint, CVS, and Twitter. We have also charged companies with 
failing to live up to their privacy promises, as in the highly 
publicized privacy cases against companies such as Google and Facebook, 
which together will protect the privacy of more than one billion users 
worldwide. As a Commissioner, I will urge continuation of this strong 
enforcement record.
    As I also said in my confirmation hearing, I support enactment of 
data security legislation. The legislation should empower the FTC to 
promulgate regulations for the protection of personal data from 
unauthorized access, as do the current bills by Chairman Rockefeller 
and Chairman Pryor.
    As a parent, I am especially concerned about protecting our 
children's privacy in face of rapid technological advances. I support 
the Commission's multi-prong approach in this area: enforcement, 
regulation, policy research, and education. Since the enactment of the 
Children's Online Privacy Protection Act of 1998, the Commission has 
brought eighteen (18) COPPA enforcement actions. In the ongoing 
proceeding to amend the rule, I will carefully consider the record as I 
formulate my views.
    Turning to the Commission's Privacy Report, I would like to commend 
some important aspects of it. It calls for a policy of ``privacy by 
design'' by which companies build privacy protections into their 
everyday business practices. This helps minimize the risk of privacy 
breaches and concerns from the outset and should be considered a best 
practice by companies as they develop new products and services.
    Appropriate use of the ``notice and choice'' concept is also core 
to a sound privacy policy, and I support the Privacy Report's 
recognition that there is no single best way to offer notice and choice 
in all circumstances. I also agree with the concept of reducing burdens 
on consumers and businesses by identifying circumstances for which 
choice is not necessary because the collection and use of consumer data 
is consistent with the context of the transaction or with the 
relationship with the consumer.
    As I have noted, Congress has given the Commission the enforcement 
and policy tools to provide a strong framework with which we can 
protect American consumers. Some of my colleagues, however, have 
supported additional privacy legislation that would go beyond Section 
5. The exact contours of such legislation are not yet defined, but my 
colleagues gave general guidance in the privacy report. The privacy 
report was clear that the recommended legislation would reach practices 
that would not be challenged under current Section 5, however.
    This gives me the opportunity to develop my own opinion on what 
else in addition to Section 5 may be beneficial to consumers, such as 
whether additional general privacy legislation is needed. I will 
consult with FTC staff, my fellow Commissioners, as well as many other 
stakeholders to gather their views on what problems and possible 
solutions they see in the area of consumer privacy.
    Some of the issues I will examine are:

        What harms are occurring now that Section 5 cannot reach and 
        how should harm be measured? As my colleague Commissioner Rosch 
        noted in his dissent to the Privacy Report, the Commission has 
        specifically advised Congress that absent deception, it will 
        not enforce Section 5 against alleged intangible harm, (FTC 
        letter to Ford and Danforth, 1984), and the FTC's own 
        unfairness statement suggests that the focus should be on 
        monetary as well as health and safety harms, rather than on 
        more subjective types of harm. Although the Commission's 
        Privacy Report did not reject the fundamental insights of the 
        harm-based approach, it appears to embrace an expansion of the 
        definition of harm to include ``reputational harm,'' or ``the 
        fear of being monitored,'' or ``other intangible privacy 
        interests'' (see Report at iii, 20, 31), and, as an initial 
        matter, I have reservations about such an expansion.

        Thus, even absent deception, financial and medical information 
        is protected under current law, which likely reflects most 
        consumers' expectations. In other areas, however, consumers 
        appear to have diverse views about sharing information. Thus, 
        it is important to proceed carefully to avoid impinging on many 
        consumers' preferences. If a consumer is provided with clear 
        notice prior to the collection of information, there is likely 
        no basis for concluding that a consumer cannot make an informed 
        choice.

        I would also like to find out more about the progress of the 
        self-regulatory and technology based efforts underway to 
        provide consumers greater transparency and choice about the 
        collection and use of their data.

        Finally, new restrictions may also have an effect on 
        competition by favoring entrenched entities that already have 
        consumer information over new entrants who need to obtain such 
        information, or encouraging industry consolidation for purposes 
        of sharing data. As a competition agency, the FTC should be 
        sensitive to these concerns as well.

        Clearly, the technology sector is developing at lightning speed 
        and we now face issues unheard of even a few years ago. I wish 
        to proceed cautiously in exploring the need for any additional 
        general privacy legislation, however. I have concerns about the 
        ability of legislative or regulatory efforts to keep up with 
        the innovations and advances of the Internet without also 
        imposing unintended chilling effects on many of the enormous 
        benefits consumers have gained from these advances or without 
        unduly curtailing the development and success of the Internet 
        economy.

    Thank you for allowing me to participate in today's hearing. This 
Committee has shown strong leadership in the area of consumer privacy, 
and I look forward to working with you to ensure that American 
consumers' privacy is protected. I am happy to answer any questions.

    The Chairman. Thank you very much, Commissioner.
    I'll start with the questioning. I'll make this one to 
Chairman Leibowitz.
    The Digital Advertising Alliance has spent a lot of time 
developing its own consumer guidelines, and they have pledged 
to follow these guidelines and honor their customers' privacy 
concerns. And that's a good thing.
    But we all know, at least I know, that in spite of their 
good intentions, and you just see this so many times, whether 
it's a coal mine, whether it's natural gas, whether it's a 
telephone company, whatever, whatever, whatever, repeats and 
repeats, sometimes industries' self-regulatory efforts do not 
end up protecting consumers.
    In my experience, corporations are unlikely to regulate 
themselves out of profits. Let me give you an example.
    Back in the 1990s, consumers were getting bogus charges 
crammed, which you referred to, on their telephone bills. And 
one, I suppose, could say that consumers should understand 
everything on their telephone bills, and once they've read it 
in writing, if they can see the writing, they're so informed, 
and, therefore, their responsibilities have been replete.
    The big telephone carriers came to Congress at that time, 
back in the 1990s, and they told us that they would take care 
of this problem. They told us Congress didn't have to pass a 
law, and that they would eliminate cramming on its own.
    As you well know, Chairman Leibowitz, the telephone 
industries' efforts to stop cramming were a huge failure. But 
my question to you is why might the DAA's self-regulatory 
effort have a better chance of succeeding?
    Mr. Leibowitz. Well, let me just start by saying, as you 
know, we brought a major cramming case today. It was a contempt 
action against a company that we believe had violated an order.
    And when I heard Senator Toomey say ``a 20-year order,'' 
when I first got to the Commission, I wondered why do we have 
20-year orders? We have 20-year orders because this contempt 
action came 13 years after we put this company under order. We 
think it was more than $50 million in injury to consumers with 
bogus charges placed on their bills.
    So we want to work with you and this committee, in a 
bipartisan way, to stop cramming.
    With respect to the Digital Advertising Alliance, I think 
they have made meaningful progress, and I do think that Do Not 
Track will be available for consumers, I'm optimistic, by the 
end of the year, one way or another, with your support and with 
your efforts.
    I would say this, though. We have to make sure that Do Not 
Track, with a few enumerated exceptions for anti-fraud efforts, 
is about ``do not collect.'' It can't be, ``I can collect 
consumers' information but then I just won't target them with 
advertisements, but I will monetize it, I will sell it.''
    The Chairman. You cut it off at the starting point. You cut 
it off at the starting point.
    Mr. Leibowitz. I cut it off at the starting point?
    The Chairman. Yes.
    Mr. Leibowitz. Did you want me to----
    The Chairman. No, no forget it.
    Mr. Leibowitz. Right, sorry.
    Anyway, so I think we have to work on it.
    I will say this, going back to points that several of you 
have made, I was on a West Coast trip to the Bay Area, meeting 
with a bunch of technology companies, and they were wonderful. 
We talked about privacy. We talked about competition issues. 
This was just a few weeks ago. And all of them want to be 
helpful on privacy. A lot of them wanted to be helpful on Do 
Not Track.
    And indeed, we're not debating anymore about whether there 
will be a Do Not Track initiative. The industry alliance has 
said they will support a form of Do Not Track. The only 
question is precisely what will be in it and when it will be 
effectuated.
    But one of the things I heard is that companies are 
sometimes concerned that they want to do the right thing, but 
they don't want to be at a competitive disadvantage. And that's 
why I think your efforts are very, very helpful here.
    The Chairman. My time is not up.
    So you go back to the DAA, and they say they're going to do 
this on their own. But my understanding is that the DAA effort 
leaves some rather large loopholes, as you've observed at least 
to this point, and I'd like to know about that.
    Mr. Leibowitz. Well, I think it depends on what the 
exceptions might be to allowing consumers to opt out from third 
party tracking. So if it's just for anti-fraud purposes and 
perhaps for what's known as frequency capping, so people don't 
get the same ad sent to them over and over and over, that might 
be legitimate.
    If it applies to things like marketing research, it depends 
on how it's defined, because you certainly don't want a 
loophole that swallows up the commitment. That's why I think 
your hearing next week will be very important.
    The Chairman. Yes, we're going to have that hearing.
    Mr. Leibowitz. I know.
    The Chairman. Thank you.
    Senator Toomey?
    Senator Toomey. Thanks very much, Mr. Chairman.
    Just to be very clear, I think I know how you'll answer 
this, but Section 5 of the FTC Act does authorize and empower 
the Commission to make enforcement actions against a company 
that violates its own stated privacy policy.
    Do any of you believe that you lack sufficient enforcement 
authority in that regard and need any kind of legislative 
change, in that respect?
    Mr. Leibowitz. So I would say it's a terrific tool for us, 
but it doesn't do everything.
    We have brought a number of cases, as Commissioner 
Ohlhausen mentioned, about companies that have violated their 
privacy commitments to consumers, probably more than 40, 
including ones against Facebook and Google.
    Having said that, there are a lot of gaps in the law. So 
for example, we did a report on kids' privacy applications, 
``apps,'' that go to kids through either the Android Google 
system or through the Apple store.
    So these apps are great for kids, but only about a quarter 
of them had privacy policies. We can't mandate a privacy 
policy, but I think everyone understands that privacy policies 
would be a useful thing to have.
    Now, we've gone back, and we've talked to Apple and Google. 
And they want to work with us to ensure that there are privacy 
policies, so parents know what they're giving to their children 
when they're putting kids' apps on their iPhones or their 
smartphones.
    But part of the reason I think that the majority of the 
Commission is supportive of general privacy legislation, and 
you have to get it right of course, is because it would fill in 
gaps. Part of it is because I think a lot of businesses want 
more certainty that you can get when you're not taking a case-
by-case approach, which is what we have to do now.
    We do case-by-case, and we do policy. We don't really do 
regulations, except where it comes to kids' privacy, and that's 
because Congress gave us specific authority to.
    Ms. Ohlhausen. So that is one of the things that I want to 
examine, as I get more settled in as commissioner, is if there 
are things that the FTC's current authority can't reach.
    But initially, I would say if there's a deceptive statement 
in a privacy policy, that is a very straightforward case for 
the FTC, and it's successfully brought very many of them.
    Senator Toomey. And that was my question.
    Ms. Ohlhausen. OK.
    Mr. Leibowitz. Yes.
    Senator Toomey. So with respect to a violation of a stated 
policy, nobody feels as though there is any ambiguity or 
insufficient authority?
    Ms. Ohlhausen. Correct.
    Mr. Leibowitz. None.
    Senator Toomey. OK.
    I think everybody here acknowledges, but just to be clear, 
do you all agree that there are many companies operating on the 
Internet that actively compete on the basis of the privacy 
policies that they offer, that that is one of the features that 
they bring attention to?
    Mr. Leibowitz. I think that's a good point. And I think we 
have started to see that. And of course, you know, one side of 
our agency is consumer protection and the other side is 
competition, and so we like to see that.
    I believe when Google changed its privacy policy, 
effective, I think, at the beginning of March, Microsoft had 
full-page ads in the New York Times saying, you know, ``If you 
want more privacy protection, use Bing.''
    So, yes, we're starting to see that.
    Ms. Ohlhausen. I believe that companies are starting to 
compete on those issues. But of course, that has to be based on 
consumer interest. That's an attribute that consumers care 
about. So it's a little circular.
    Senator Toomey. Well, that's the nature of the beast. If 
there's a feature that is important to consumers, business, 
pursuing their own self-interest, will, in fact, try to attract 
consumers by providing that feature, and they will compete on 
that basis.
    I find your discussion about Do Not Track very interesting. 
As I understand it, this is an industry effort. This is not 
mandated by legislation.
    Mr. Leibowitz. Correct.
    Senator Toomey. It's not mandated by regulation. It's a 
voluntary approach, which you're commending and which the 
industry apparently sees as in its own interest to pursue.
    So what do you think of this dynamic, whereby an industry, 
presumably with input from consumers, discovers a process that 
works for both?
    Mr. Leibowitz. Well, on Do Not Track, I think the majority 
of the commission is very supportive of this process. They are 
making meaningful progress.
    Now I think part of that is because companies want to do 
the right thing. Part of it may be that the Chairman's 
legislation is out there, and I think it probably has a fair 
amount of support.
    But we see progress, and we're hopeful that, one way or 
another, we get to the finish line by the end of the year.
    Again, some of it depends on precisely what's in the Do Not 
Track effort, but we do commend their progress.
    Mr. Kerry. Senator Toomey, there is competition on privacy 
offerings. We would like to see more competition. Part of the 
reason to introduce a set of privacy principles, including 
transparency and control, is to create more of an active 
conversation between businesses and consumers, so consumers can 
make choices, understand the benefits.
    The problem with existing law today, the reason that we 
believe that additional FTC authority is required, is that too 
much hangs on privacy policies. And there's research out there 
that indicates that you have to spend 250 hours a year to read 
every single privacy policy for the average consumer. That's 
just not something that people are able to do.
    So people don't really have a choice about the contents of 
what's in a private policy. And as Chairman Leibowitz 
mentioned, there are companies out there that don't have 
privacy policies, and the existing authority doesn't reach 
those.
    So what the FTC found about mobile apps is consistent with 
a broader survey of the top 50 applications found. Only a third 
of them had privacy policies.
    So how do you deal with people that don't have privacy 
policies? There are no promises that you can hold them to under 
Section 5.
    Senator Toomey. I want to point out, if I could, in 
closing, the premise here is, of course, that consumers want 
these privacy features that you're advocating are not 
available. And so the premise is there's this huge untapped 
potential in the marketplace that nobody has been smart enough 
to figure out.
    Because if all of that is true, of course, there's a huge 
incentive for a company to simply offer those policies, 
advertise extensively, and then take all kinds of market share 
away from the not-so-clever competitors who haven't figured out 
that that's important to consumers.
    So I think that we ought to proceed very cautiously when 
that's an underlying assumption.
    The Chairman. I'll call on Senator Kerry, but I have to 
point out, Senator Toomey, that's an outstanding assertion, 
outstanding degree of faith in the knowledge and time of the 
people.
    Senator Kerry?
    Senator Kerry. Thank you, Mr. Chairman.
    Commissioner Ohlhausen, eBay, Hewlett Packard, Microsoft, 
Intel, Verizon, other industry leaders, support the legislation 
that Senator McCain and I have introduced. Obviously, these are 
all capable companies and important to consumers, et cetera.
    You said there might be an unintended chilling effect. They 
don't see an unintended chilling effect. They've signed up. 
They think this is important.
    Do you not have faith in the American consumer, if they're 
given choices, that they can make those choices? And what's the 
unintended chilling effect to the American consumer?
    Ms. Ohlhausen. Thank you, Senator Kerry. You raise a very 
important issue. And that's one of the things that I want to 
explore.
    As I said, I'm one month into my tenure, and this is one of 
the things I want to find out more about.
    But I do think that there is the possibility that companies 
that are already entrenched and have the data that they need to 
create their products may not have the same concerns as a new 
company that may have a new product that we haven't even 
thought of yet that may use consumer data in a different way.
    Senator Kerry. But they're all going to be held to the same 
standard. The issue here is the individual American consumers' 
privacy. I mean, they're all going to be held to the same 
standard.
    I mean you've set forth the idea that, conceivably, I think 
you have an economic or physical harm standard that you are 
applying. But the problem is, what happens if there is, you 
know, if no risk of economic or physical harm can be proven, 
but something very personal to people is exposed, a health 
issue, that they might have cancer? What if their sexuality is 
exposed? What if they might be having an affair or something, 
and that's exposed?
    That's damage. It's a violation of their privacy.
    How do you wind up with this sort of notion that it's only 
a physical or economic harm?
    Ms. Ohlhausen. Senator, what I was addressing was how the 
FTC has already said it would apply its unfairness authority, 
and what it has told Congress in the past what the limits were 
of that.
    For the FTC to recommend new legislation that would take 
into account additional harms is something that I think needs 
careful consideration.
    Senator Kerry. Well, that's what we're trying to give it. 
That's exactly what we're doing. We've been giving this careful 
consideration for 2 years now. It seems to me, we need to kind 
of break through here a little bit.
    Let me try to get further in that, because some of the 
argument from Senator Toomey and others is sort of this notion 
that somehow this is going to interfere with the freedom to 
create new apps and so on and so forth. I just don't see that.
    Consumers choosing how their information is going to be 
managed is not going to affect what people are going to offer. 
They're going to offer it with protections, I would assume.
    But let me ask specifically the other two witnesses, what 
other privacy principles, other than just this idea of 
transparency and choice? There are other privacy principles at 
stake here, like data retention limits, for instance, or 
purpose specification, et cetera.
    Can you talk about, either of you, sort of what the breadth 
of interests are here that go beyond just the transparency 
choice?
    Mr. Kerry. Thank you, Senator Kerry.
    As I said in my remarks to Senator Toomey, we can't depend 
just on notice and choice. You know, that is part of the 
problem with the existing system.
    The principles that we've outlined--transparency, respect 
for context, security--incorporate, I think, some of the 
additional principles that you have talked about.
    We articulated the principle of focused collection, which 
incorporates both use limitations and data minimization.
    Senator Kerry. Can you sort of break it down in a practical 
way of how that would affect somebody?
    Mr. Kerry. Well, the principle recognizes, and the reason 
we've articulated it a little bit differently than simply data 
minimization, is that, in the age of big data, there's a great 
deal of data collection that has public benefits, benefits to 
public health, to research, and often in unforeseen connections 
in data.
    So we don't want to discourage that, but what we do want to 
discourage, I think consistent with the principle of privacy by 
design, as the FTC has articulated it, is that people make 
conscious, considered decisions about what data they need to 
collect and what data they need to retain.
    Mr. Leibowitz. Yes, and if I could just followup, I think 
embedded in your approach are several important principles, one 
of them Mr. Kerry mentioned, which is privacy by design. 
Another one is more transparency, because that could be one of 
the benefits of having stakeholders involved in developing 
codes of conduct.
    We have found, and we discussed this in a previous hearing, 
we have found privacy policies in the mobile space that are 102 
clicks. Nobody reads that except our staff, who we asked to 
read it.
    And then the other thing, and this is part of the reason 
why I think businesses are so supportive of things like Do Not 
Track and of general privacy legislation is it creates a 
virtuous cycle. If consumers have more control, they generally 
feel like they have more trust in the Internet, and they engage 
in more commerce.
    And so I think part of the reason why companies support 
general privacy legislation is because it's the right thing to 
do. I think part of it is because it becomes a virtuous cycle.
    Now as my colleague Commissioner Ohlhausen has mentioned, 
you do have to watch out for barriers to entry, because on our 
competition side, you sometimes see the big guys doing things 
to make it tougher for new innovators. But we have not seen 
that problem on privacy issues thus far.
    The only other point I just wanted to mention is that we 
try not to take speculative harm into account when we bring 
cases. We do take reputational harm into account from time to 
time, and these are bipartisan, unanimous cases.
    So for example, in the Google Buzz order that we have, 
Google tried to jumpstart its first social network, Google 
Buzz, by taking confidential Gmail information, which they had 
said would remain private, and making it public.
    And by doing that, certain information, like the fact that 
someone might be seeing a psychiatrist and be communicating on 
Gmail with that psychiatrist, became known to other users.
    And so that kind of harm, where it's not speculative, I 
think is one that we do take into account under our statute.
    Senator Kerry. Well, I appreciate it.
    Thank you, Mr. Chairman. Let me just say, I think it's 
important--I mean, look, if you have that choice and 
transparency, you'd be better than you are today, there's no 
question about that. But you'd still have a problem, because 
people could still take your information, use it anyway they 
wish, store it indefinitely. And you wouldn't have any control 
over a third-party purchase or a third sale or, you know, 
what's the standard by which that information is going to be 
kept? What happens to it after it has been there for a long 
period of time?
    There are a lot of things there where there's an 
expectation, I think, that has to be protected here, or people 
have to have a greater knowledge about, than just the choice of 
what they may do.
    The Chairman. Thanks, Senator Kerry.
    Senator Klobuchar?

               STATEMENT OF HON. AMY KLOBUCHAR, 
                  U.S. SENATOR FROM MINNESOTA

    Senator Klobuchar. Thank you very much, Mr. Chairman. 
Thanks for holding this hearing. Thanks to our witnesses.
    I wanted to first thank you, Chairman Leibowitz, for the 
work on cramming that I know you're doing. It has been 
something that I've been focused on for a while, along with our 
attorney general in Minnesota. And we've made some strides with 
some of the major telephone companies, as you know, agreeing 
for landlines to police this in a better way. And I saw 
yesterday you announced you're seeking a civil contempt ruling 
against the third-party billing company.
    So I want to thank you for that, even though it's exactly 
not on topic, it is kind of, but then move on to some other 
things.
    Today, I introduced, along with Senator Blumenthal and a 
few other Senators, and we have companion House legislation, a 
bill on password privacy, and it's called the Password 
Protection Act.
    And this of course came out of a number of us had gotten 
contacted by people who had been asked for passwords, and 
there's been some reports on it. And we worked, actually, with 
Facebook and Google and Twitter and a lot of the groups. And 
there seems to be some widespread support for putting some kind 
of a rule in place to make clear that at least the data that 
people intend to have be private is private, what I think 
former Justice Brandeis used to call the right to be left 
alone.
    With the new technology, it's very difficult for the laws 
to keep up. And I was just wondering what the FTC, and you, Mr. 
Kerry, what the Department of Commerce, is doing with regard to 
these issues and if you have things come up with password 
issues and the like?
    If you want to start?
    Mr. Leibowitz. Well, we have some concern, and we've 
expressed some concern, about the practice of employers asking 
for Facebook passwords. And we have communicated that to 
Facebook.
    It sounds like Facebook is working with you. They've also 
noted that this may not be consistent with their terms of 
service.
    And so it is something we are concerned about. It may be 
something, by the way, that isn't within our unfair deceptive 
acts or practices authority. It's an interesting question we 
were discussing today before I came up here.
    But we want to work with you going forward on your 
legislation.
    Senator Klobuchar. Very good.
    Mr. Kerry?
    Mr. Kerry. Thanks, Senator Klobuchar.
    Our proposals, frankly, focus on the relationship between 
consumers and the companies that they deal with, not with their 
employers.
    But I would say is that the use of that information by 
employers is reflective of one of the critical realities of 
where we are in the world of information today, that there is 
so much information out there about people. And the ability to 
collect and to aggregate that information has gotten so 
extensive that it is possible to learn things about people that 
constitute sensitive information, even though that sensitive 
information hasn't been put out there, you know, by itself.
    To take Chairman Leibowitz's example of somebody doing a 
search on health information, now, we protect health 
information under HIPAA. Health care providers have to protect 
that. But you could find, you know, by aggregating information, 
you can find out health information but not be subject to those 
protections.
    So the ability to aggregate information creates new risks 
of harm that haven't existed.
    Senator Klobuchar. Right. And it's the same with the 
information that might be under password, things about people's 
religious status, things you would not ask about in an 
interview that would be behind a password.
    So, you know, we're hoping, working with the business 
community, there will be some support here, too, as well as 
what the rules of the game are for them. And so we have been 
working on that.
    My last question is just about industry self-regulation. I 
think it is important to recognize the proactive steps industry 
has undertaken to set up and follow best practices, self-
regulatory agreements. Now we just need to get the word out, 
and make sure they are easy for consumers to use, if they want 
to.
    How are your agencies working with industry to help get the 
word out about consumers' right to privacy and how they can 
make privacy decisions that are right for them? Basically, how 
do you educate the public about the tools that are out there 
now, and in addition to what we may be working on, but what's 
out there now? And how are you working with self-regulation 
entities to make sure that these policies are consumer-
friendly?
    Mr. Leibowitz. Our report, ``Protecting Consumer Privacy in 
an Era of Rapid Change''--I think most of the members of this 
community are familiar with it--was drafted after working with 
stakeholders. We held numerous workshops. We put out a draft 
report, which companies generally liked. We also got more than 
460 comments from industry representatives, consumer groups, 
and various other people who had something to say. And some of 
those comments are very detailed and very, very helpful.
    I would say that the pace of self-regulation has been 
fairly uneven. And I think that even if you ask the best 
companies, companies with the best privacy practices, about 
that, they would say that's part of the reason why they are 
interested in things like Do Not Track standards and privacy 
legislation, is so that we will be migrating towards a more 
even playing field, and also one where consumers have more 
trust in the Internet, which, again, contributes to a virtuous 
cycle of more trust and more commerce online.
    Senator Klobuchar. OK, very good. I think I'm out of time. 
And I will get any other answers in writing from all of you, 
and also put in a question on cloud computing, something I'd 
like to ask you all about, so thank you very much.
    The Chairman. Thank you, Senator.
    Senator Pryor?

                 STATEMENT OF HON. MARK PRYOR, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Pryor. Thank you, Mr. Chairman.
    Let me start with you, if I may, Ms. Ohlhausen. I'm curious 
about your impression of the average Internet users' 
understanding and realization of the extent that his or her 
information is being collected, and then how it's being used, 
and how it might affect their lives.
    I'm just curious about your sense of how the average 
Internet user, how much he gets of all this.
    Ms. Ohlhausen. Well, thank you, Senator Pryor.
    That is one of the issues I'd like to find out more about 
as I talk to FTC staff and stakeholders. I do believe that 
there are consumer expectations that financial information will 
be secured, that medical information will be secured.
    But as you get away from some of those areas, I do think, 
for example, in first-party marketing issues, the FTC, in its 
online behavioral advertising and also in this privacy report, 
has noted that consumers do expect that the website that they 
are dealing with may be serving them ads, may be using 
information to market to them subsequently.
    As you move away from that paradigm of a one-on-one 
relationship, I think those are good questions that I would 
like to explore further.
    Senator Pryor. Mr. Leibowitz, let me ask you a three-part 
question.
    From your standpoint, first, are there adequate tools 
available? And second, are consumers sufficiently aware of 
those tools? And then third, are they exercising their choice 
and their controls?
    Mr. Leibowitz. That's a great series of questions.
    I would say for some things, adequate tools are available. 
So for example, if you want to go online, Mozilla, I believe 
Google, and possibly even Microsoft, offer browsers where you 
can go incognito. So that's an interesting way for consumers if 
they want to, and if they are aware, to use a tool that 
empowers them.
    I think the best companies generally are better about 
empowering consumers and giving them more tools and more 
information.
    But in some instances, consumers just aren't aware and this 
goes back to Senator Toomey's point. You know, we all would 
like to see more competition for privacy, but when you have 
privacy policies that are on the mobile space, that are dozens 
of clicks to read through, it's just hard to have competition 
without transparency and understanding what your tools might be 
and what your options are.
    And I'd also say this, some companies give better 
protections in the teen space, which I know some of you are 
concerned about. Others don't. And so we have encouraged 
companies--again, this is not a regulation, we don't regulate 
in that space--to give more opt-in approaches to teens, because 
as we all know, kids are sometimes tech savvy but judgment 
poor.
    Senator Pryor. Right.
    Yes, I actually was going to ask about teens next, Mr. 
Leibowitz, if we could go to that.
    And that is, I know that we don't require privacy policies 
right now. But should we require privacy policies when it comes 
to kids and teens?
    Mr. Leibowitz. I think that's something we would like to 
work with you on, because I think if you can encourage or 
require companies, again, because under the Children's Online 
Privacy Protection Act there are some specific obligations. As 
this committee knows, we're in the process of updating the 
COPPA obligations.
    I think that's a really good thing to have, so that teens 
understand some of the consequences. All too often, it's after 
they recognize the importance of privacy, which most consumers 
do recognize, if you look at any polling data, but all too 
often, teens recognize the importance of privacy only after 
they've sent or posted something or read something that caused 
some harm.
    So I want to work with you on that issue going forward.
    Senator Pryor. That would be great. And as we work on that, 
I'd love to get your thoughts on if, and if so, how, operators 
are misusing teens' personal information. I know you probably 
have some data, but a lot of anecdotal evidence on that.
    But let me get to Mr. Kerry, if I can, because I'm almost 
out of time here.
    And, Mr. Kerry, I know a few moments ago, when Senator 
Klobuchar was wrapping up, it looked like you had an answer for 
her and you had a document in your hand, you were maybe going 
to answer, so I'll give you a chance to do that.
    But first, let me ask about state attorneys general. Is it 
the administration's or the Department of Commerce's view that 
State AGs and the FTC should have the authority to seek civil 
penalties for violation of voluntary privacy commitments or 
codes of conduct?
    Mr. Kerry. Senator, we believe that state attorneys general 
along with the FTC should be the prime enforcement vehicle. 
It's important that that enforcement have some weight. We would 
certainly be glad, as we move forward, to work on legislative 
language, to work with you to look at how best to do that.
    Senator Pryor. And did you want to----
    Mr. Kerry. Sure, Senator Klobuchar had asked, I think, the 
question about building consumer awareness. The document I was 
getting out, Chairman Leibowitz held up his agency's report. 
The appendix in the White House Blueprint sets out the Consumer 
Privacy Bill of Rights. And in doing that, we tried to put it 
in plain and simple language, and put it into a stand-alone 
document that is something that consumers can use to understand 
what to expect from businesses as a tool to build consumer 
awareness.
    And that's something we will work to implement through the 
multistakeholder processes that we've now embarked on. I think 
it's important to say that those processes are not just self-
regulation. We want to involve all stakeholders, to involve 
consumer groups, so that the codes of conduct look out for the 
interests of everybody and not just the affected business 
community.
    The Chairman. It was interesting to me that in some of the 
comments that were made, people talked about breaking the 
Internet, as if this onslaught--and it was also interesting to 
me that some didn't talk at all about consumers. They talked 
about the rights of an Internet to be able to develop in any 
way, shape, or form that would be, and didn't get around to 
talking about the effects on consumers.
    So I want to get at this, Mr. Kerry, with you, and also 
with all three of you, actually.
    This breaking the Internet policy, that if we were to pass 
some legislation--I mean we've been working actually, Senator 
Kerry said, too, that's specific. We have been working on this 
for about 10 years on the Commerce Committee, without the vigor 
that we have been recently, but this is an ongoing process.
    So privacy laws already protect people's phone 
conversations. They protect people's television habits. Privacy 
laws protect people's medical records, their financial data. 
And clearly, our privacy is protected in other technologies 
where there is sensitive information.
    Now how does this--which is called protecting the American 
people in ways in which they have every right to expect to be 
protected and expect very thoroughly to be projected--do we get 
into breaking the Internet?
    It's unclear to me that in any way, by any of these types 
of things, do we attack the rights and privacy of the Internet 
in their own business.
    Mr. Kerry. Well, I'm pleased to answer that question, Mr. 
Chairman, because preserving the dynamism, the innovation, the 
economic growth that the Internet has been such a powerful 
instrument of has been absolutely a guiding premise of the work 
that we've done.
    And that's why the model that we've adopted doesn't follow 
a traditional rulemaking model. That simply doesn't work in the 
Internet environment. It doesn't operate at Internet speed.
    That's why we've incorporated in a multistakeholder model, 
building on top of a baseline, a floor of rights that consumers 
can expect that would apply across the board, regardless of the 
business, regardless of the sector, to develop a set of codes 
of conduct using the same structures of multistakeholder policy 
development standards, consensus, that have been so successful 
in the Internet space.
    The World Wide Web Consortium, the IEEE, these are the 
governing bodies of the Internet that have operated not as the 
product of any one government, but as a public-private 
partnership involving business, involving civil society.
    It's worked tremendously and successfully. It could work 
successfully in this space.
    Mr. Leibowitz. Yes, and if I could just follow up, Mr. 
Chairman?
    I think the General Counsel is exactly right. Privacy and 
innovation generally go hand in hand, and you can protect 
consumers and promote innovation.
    And with respect to Do Not Track, the proof of that is that 
the business community supports it and is supportive of moving 
forward with a Do Not Track option for consumers.
    The Chairman. But was it not--and I need to call on you, 
Commissioner.
    Ms. Ohlhausen. OK.
    The Chairman. But was it also not true that a number of 
companies got very enthusiastic about doing Do Not Track on 
their own right after your report came out?
    Mr. Leibowitz. I would say there was, among the browser 
companies like Microsoft and Mozilla and Apple, a lot of 
support for it. There continues to be. Again, there are a few, 
you know----
    The Chairman. I'm asking about the timing question. Am I 
wrong on that?
    Mr. Leibowitz. Yes, they were very supportive early on, and 
we think they have made progress since.
    The Chairman. No, that's not the question I asked.
    They came out in support right after your two reports came 
out.
    Mr. Leibowitz. Yes, yes. More of them also came out after 
the report; that is correct.
    The Chairman. Yes.
    Mr. Leibowitz. Yes, sir.
    The Chairman. Commissioner?
    The Chairman. We're still on breaking the Internet.
    Ms. Ohlhausen. Yes, I figured we were.
    So I think that's a very important issue and one that some 
commenters have raised concerns about.
    And in the debate, you get a wide array of views. People 
express great concerns about that, and other people have great 
concerns about consumer privacy.
    And I think the FTC generally has tried to strike the 
balance of meeting consumer expectations. So if consumers have 
protections and expect protections about their financial 
information and their medical information, I think the FTC has 
done a good job in bringing cases that advance those 
expectations for consumers. They are deception-based cases 
often, but occasionally there are fairness-based cases.
    So I think, for me, that's one of the most important things 
that I need to look at it is, is this going to meet consumer 
expectations, and is this going to meet consumer preferences, 
because consumers do also enjoy using a lot of the new 
benefits, new services, that the Internet offers.
    So if we have a solution that consumers ultimately end up 
unhappy with, because they've lost some of these services, 
these conveniences that the Internet has provided them, I'm not 
sure we're striking things in the right balance.
    But I think the important thing is to strike the right 
balance for the benefit of consumers.
    The Chairman. Thank you.
    Senator Udall?

                 STATEMENT OF HON. TOM UDALL, 
                  U.S. SENATOR FROM NEW MEXICO

    Senator Udall. Thank you, Mr. Chairman. And sorry I wasn't 
here earlier. As you know, we have so many things going on.
    The Chairman. We were all talking about it.
    [Laughter.]
    Senator Udall. Yes. I understand.
    And I hope you all forgive me, but an incredibly important 
subject. The Chairman always focuses, I think, on what the 
American people are concerned about.
    And I just hear a lot of discussion in New Mexico about 
this whole privacy issue. And I apologize if I'm going over any 
ground that you've already hit here.
    But I just had a couple of questions.
    Chairman Leibowitz, the FTC has recently settled privacy 
cases with well-known online companies used by millions of 
Americans. Could you explain how these settlements will benefit 
consumer online privacy and how have these settlements 
encouraged other companies to change or improve their privacy 
policies?
    Mr. Leibowitz. Well, if you are talking about our 
settlements with, say, Google, for Google Buzz, and Facebook, 
we found what we believed to be violations of the law. 
Essentially, those companies made commitments about keeping 
information private that we believe they did not keep, or they 
didn't honor their commitments. And so we brought cases against 
them and had settlements.
    In the settlements, they're required to be monitored. They 
have to engage in privacy by design. And most importantly, if 
you combine the Facebook and the Google matters, they protect 
more than a billion consumers worldwide. And if those companies 
want to change their privacy settings, they have to give 
consumers an opt-in going forward to do that.
    And then of course, when you are under order, we, unlike 
most attorneys general, and you've missed this discussion, but 
I know you were--who have fining authority, we do not have 
fining authority. But if you are under order, we can then fine 
you for second violation. We hope, of course, we don't see 
second violations here.
    Senator Udall. Yes.
    And, Mr. Kerry, you note in your testimony that the 
European Union is moving forward with data privacy regulations. 
Is there concern if Europe moves forward with privacy rules 
while the U.S. does nothing, that European regulations will 
essentially become the global norm that U.S. companies follow?
    Mr. Kerry. Senator, thank you, yes, that is a concern. It's 
a concern that we've heard from many companies.
    I said in my oral remarks that I defend the American system 
of privacy and the commitment that we have in our laws. But we 
do not want to let other countries set a default standard.
    There are certainly points in common between what we are 
proposing and what the European Commission has proposed. But 
there are also concerns that there are ways that that gets into 
prescribing technology and other kinds of prescriptions that 
could operate as barriers to entry, that could inhibit the free 
flow of information across international borders.
    So it is important to move forward here. I think we are 
here because our mission, as this committee knows well, is to 
promote the domestic and international commerce of the United 
States. We would not be promoting privacy legislation if it did 
not promote the foreign and domestic commerce of the United 
States.
    I think the fact that we are sitting here alongside 
Chairman Leibowitz, who has also proposed advocating for 
legislation, reflects the convergence of economic and business 
and consumer interests in this area.
    It's important to consumers. It's important to business. 
It's important to global commerce.
    Senator Udall. Thank you.
    Commissioner, do you have any thoughts on those two?
    Ms. Ohlhausen. Well, I do believe the international element 
of privacy regulation is very important. But I have to admit, 
it's something I need to educate myself on a little further 
before I could offer anything very useful at this point.
    Senator Udall. Thank you.
    Thank you, Chairman Rockefeller. I really appreciate it.
    The Chairman. Thank you, the Right Hon. Tom Udall of the 
State of New Mexico.
    I'd just like to close with a couple.
    We talk about the Digital Advertising Alliance is making it 
very clear they want to cooperate, and they appear to be doing 
so. But there are two areas where they still can collect 
information under their own definition. And I think one of 
those is market research, and the other is product development.
    Now, that doesn't take me to a series of blisses or sins, 
but I get very nervous when I read that about those two little 
snippets being able to swallow up the rule.
    What is it that allows them to get? And after your 
question, can you talk about what you are doing to make sure 
that they don't get that, if you can?
    Mr. Leibowitz. Well, I think from the perspective of the 
majority of the Commission, we entirely agree with you. Do Not 
Track has to mean ``do not collect'' if it's going to mean 
anything. There might be a few narrow, enumerated exceptions, 
for example, for anti-fraud purposes.
    But we are working with the Digital Advertising Alliance at 
this point. We think by the end of the year, I believe that one 
way or another, whether it's legislative or whether it's by 
virtue of resolving some of these matters--and of course, 
there's another forum, the World Wide Web Consortium, where a 
lot of the companies are working with technologists and 
consumer groups to come up with a standard and what it would 
entail.
    But one way or another, we believe that--I believe that--by 
the end of the year, there is going to be meaningful Do Not 
Track for American consumers, so they can opt out of third-
party advertisements, and that's critically important for 
consumers, if you want to have more trust, as the General 
Counsel said, in Internet commerce.
    The Chairman. I'd agree with that, and I guess I'll just 
close with this, that the statement was made here that it's in 
the nature of the Internet industry, the Web industry, 
whatever, to compete for the trust of consumers, and that in so 
doing, they will get the trust of consumers. And therefore, 
there's no need to even consider regulation.
    That does sort of go against my general theory of corporate 
America. I mean, in other words, if you talk about competition, 
that is some of the most, you know, cutthroat competition that 
exists going on in precisely that world at this time. People 
merging and swallowing and doing all kinds of things.
    It doesn't make sense to me that people would compete for 
something which is not in their economic interest, except as 
they are required to do so by a higher power, which understands 
that protection is not just what is already on the books, but 
protection is a part of the rule of law, so to speak, in 
America.
    Mr. Leibowitz. Well, if I can just respond to that. Imagine 
Commissioner Ohlhausen and I are competitors. And she wants to 
do the right thing, and I want to collect as much information 
as I possibly can and monetize it in every way I can. Well, 
she's at a competitive disadvantage, because I'm making more 
money while she is trying to protect consumers. And so that's--
--
    The Chairman. She's being virtuous.
    Mr. Leibowitz. She is being virtuous, and she is virtuous.
    [Laughter.]
    Mr. Leibowitz. And she's a wonderful member of the 
Commission already.
    [Laughter.]
    Ms. Ohlhausen. And if I'm a corporation, I would probably 
try to advertise the fact that I am virtuous and get consumers 
to come to my company rather than----
    Mr. Leibowitz. But of course, if the Leibowitz Corporation 
isn't playing along, and we're making more money, you know, 
it's not necessarily fair to the Ohlhausen Corporation.
    So, you know, you understand this. And that's why things 
like voluntary stakeholder-driven codes of conduct can be very, 
very useful. It's why, at the end of the day, we're hoping 
that--the Digital Advertising Alliance and the companies behind 
it represent, I think, 90 percent of all advertising on the 
Internet. When you get to 90 percent, if they're all making 
commitments not to collect--and again, a lot of those companies 
I believe, having talked to them individually, would be very 
comfortable with limitations on collection, the kind you and I 
envision. I think that would be very, very meaningful for 
consumers.
    Mr. Kerry. And if I could add that the trust that the 
Ohlhausen brand would build up would permit another company, we 
won't call it the Kerry Company, to operate under the radar, 
without respecting the same standards. That's why we need a 
baseline.
    The Chairman. Exactly.
    I thank all three of you very, very much. This is a new 
beginning in this whole area.
    And the floor is not an easy place, and the Senate is not 
an easy place to get legislation passed, as you may have 
noticed. But that doesn't stop us. We've got to do our work.
    And it's incredibly important work, particularly in this 
particular new age, controlling of the new age, set of business 
that we are dealing with.
    So I thank you and the hearing is adjourned.
    [Whereupon, at 4:05 p.m., the hearing was adjourned.]

                            A P P E N D I X

   Response to Written Questions Submitted by Hon. John F. Kerry to 
                         Hon. Jon D. Leibowitz

Principles that Require Protection
    Question 1. According to a survey from Consumer Reports, 71 percent 
of respondents from a recent survey said that they had concerns about 
companies distributing their information without permission, while 56 
percent said they had similar concerns about companies that hold onto 
data ``even when the companies don't need it anymore.'' Cases brought 
to date on privacy rely on the FTC's ability to protect people from 
deception. That is, a company cannot do something with your information 
that they told you they would not do. That is insufficient in the minds 
of many Americans as reflected in this poll since fighting deception is 
not a requirement for consent for collection or distribution and it 
does not place any limits on data retention. Deception is also silent 
on the other fair information practice principles including the right 
to access. Can you talk about why the other privacy principles like 
data retention limits and purpose specification are necessary and not 
simply a regime of notice and choice?
    Answer. Our report notes that ``privacy by design'' should include 
providing reasonable security for consumer data, collecting only the 
data needed for a specific business purpose, retaining data only as 
long as necessary to fulfill that purpose, safely disposing of data no 
longer in use, and implementing reasonable procedures to promote data 
accuracy. By implementing these principles, companies can shift the 
burden away from consumers who would otherwise have to seek out privacy 
protective practices and technologies. For example, in a pure ``notice 
and choice'' regime, consumers would have to sift through privacy 
policies to determine which companies maintain reasonable data 
security, and exercise choice by only doing business with those 
companies. Consumers should not bear this burden; instead, companies 
should make reasonable security the default.

Tracking and Your Property
    Question 2. For a company to track an individual's behavior and 
activities on the Internet, it has to put a tracking technology on a 
person's computer or smartphone. Do you believe it is the right of the 
collectors of information to place such tracking devices on a person's 
property and collect information without that person's knowledge or 
participation or collect information that has nothing to do with the 
service being provided and if not, what in the law stops that from 
happening today?
    Answer. Online tracking is a ubiquitous practice that is largely 
invisible to consumers, and numerous surveys show some level of 
consumer discomfort with online tracking. A person's computer or 
smartphone is his property, and consumers need to have the ability to 
learn what information is being collected and how it is used and 
shared--especially with respect to invisible data collection.
    A majority of the Commission continues to call for the 
implementation of a Do Not Track mechanism that would give consumers a 
choice about whether to be tracked. Although we have asked Congress to 
consider enacting general privacy legislation to set baseline 
standards, we have not called for Do Not Track legislation 
specifically, in part because industry has responded to our call and is 
making progress. I am optimistic that, by the end of the year, industry 
will have developed a Do Not Track mechanism that meets five criteria: 
it should be implemented universally; it should be easy to use; any 
choices offered should be persistent and should not be deleted if, for 
example, consumers clear their cookies or update their browsers; an 
effective Do Not Track system would opt them out of collection of 
tracking data, with some narrow exceptions like fraud detection; and a 
Do Not Track system should be effective and enforceable.

Who is Authorized to Share Your Data?
    Question 3. A Wall Street Journal examination of 100 of the most 
popular Facebook apps found that some seek the e-mail addresses, 
current location and sexual preference, among other details, not only 
of app users but also of their Facebook friends. Should consumers 
expect that things they share with a group of friends they choose on 
social networking sites in turn makes those friends authorized 
distributors of access to them and their information? Does that raise 
any concerns for you?
    Answer. We share your concern about the privacy of information 
collected through applications, particularly personal data such as 
photos and videos, address books, and location information. Many 
consumers are not aware of the extent of data being collected through 
apps and how that data is being used. In our case against Facebook, for 
example, we challenged the company's failure to disclose that a user's 
privacy settings did not prevent apps used by their friends from 
accessing personal information. Recent reports also highlight apps 
access and sharing practices--for example, a recent FTC staff report 
about children's mobile applications revealed that consumers are 
provided with very little information about applications' data 
collection and sharing practices. As a result, consumers are 
increasingly uneasy about the privacy of such information.
    The lack of transparency and choice in the app marketplace is an 
example of why the FTC believes that Congress should consider baseline 
privacy legislation that includes increased transparency, simpler 
choice, and privacy by design. In the meantime, we will continue to 
encourage everyone--stores, developers, and third parties--to step up 
their privacy efforts and provide meaningful privacy protections for 
consumers.
    At the same time, if consumers choose to share their information 
with hundreds of friends, they should be aware that those friends could 
actively further share their information, through oral conversations, 
e-mails, tweets, and the like. We have tried to educate consumers on 
safe social networking, and have developed materials for consumers, 
parents, teens, kids, and educators. Among other things, we tell 
consumers to be careful what they post online, because they may not be 
able to take it back.

Communication over Open WiFi
    Question 4. The FTC, the FCC, and the Department of Commerce 
concluded that Google violated no laws when it collected private 
communications transmitted over unencrypted WiFi connections. Should 
collectors respect fair information practice principles if that 
information is transmitted over a WiFi network or is that not necessary 
in this context?
    Answer. As a general matter, our privacy report recommends that 
companies implement privacy by design as part of best practices--which 
includes reasonable limits on data collection as well as implementing 
data security for the information that is collected.
    Section 5 of the FTC Act is a broad statute that allows us to 
accomplish a great deal, but we can only use it to challenge practices 
that are deceptive or unfair. We cannot use it for everything--for 
instance, in most circumstances we cannot mandate privacy policies 
under Section 5. This is why we believe Congress should enact data 
security legislation and consider implementing general privacy 
legislation to give baseline protections for all consumers.

Inconsistencies in Law
    Question 5. Today, we have laws governing privacy when a bank is 
collecting your information or when a doctor or hospital is collecting 
your information. We also have laws governing telephone companies 
tapping your communications or cable companies tracking your watching 
habits. Isn't similar or identical information collected and use 
without a governing framework on the Internet every day and what makes 
that disparity in law rational?
    Answer. Presently, there is some existing sector-specific 
legislation that already imposes privacy protections and security 
requirements through legal obligations. However, these laws do not 
necessarily apply to all business or all personal information, and as a 
result consumers may be vulnerable both online and offline. Because of 
these legislative gaps, our privacy report calls for Congress to 
consider general privacy legislation and sets forth a framework to 
encourage best practices by providing an important baseline for 
entities not subject to sector-specific laws. We believe that by 
implementing privacy by design, increased transparency, and better 
control, companies can promote consumer privacy and build trust in the 
marketplace.

The European Privacy Standard
    Question 6. What is your understanding of where the European 
privacy protection legal framework update stands and how does it 
compare to what your agencies have proposed?
    Answer. The European Commission proposed its revised privacy 
framework on January 25 of this year. The EU Parliament and the EU 
member states are currently reviewing that proposal. Part of the 
proposal is for a regulation to cover commercial and civil regulatory 
activities. The FTC has followed that part of the proposal very 
closely. FTC staff has shared views with European Commission 
counterparts, both before the proposed regulation's release in January 
and since, and our most senior officials have maintained an open 
dialogue with the various European stakeholders on a variety of privacy 
issues.
    As to how the European Commission proposal compares to the 
frameworks proposed by the Administration and the FTC, we are largely 
pursuing the same ultimate goals on both sides of the Atlantic. In 
fact, the frameworks show many similarities. These include promoting 
privacy-by-design, improving transparency, providing rights to access 
and rectify information, promoting the development of industry codes of 
conduct, strengthening data security, protecting children's privacy, 
and exploring the idea of giving consumers the ability to erase certain 
personal information that they have previously put on the Internet.
    Another point of comparison is the issue of comprehensive privacy 
legislation, which the Europeans have and which has been proposed for 
the United States commercial sector. We view such legislation as 
important for privacy protection in the U.S. that, in addition to 
protecting U.S. consumers, also helps to build an internationally 
interoperable framework for data transfers that both protect people and 
also encourage the free flow of information. The goal is not complete 
harmonization with the EU, but rather interoperability between 
different systems based on larger shared values and based on practical 
solutions to bridge differences in our respective regimes.
    Of course, we think there is also room for improvement in the 
proposed EU regulation. For example, we have discussed with our 
European colleagues the available mechanisms for commercial cross-
border data transfers between the EU and the U.S. We are also 
discussing the issue of cooperation between regulatory authorities, 
especially on enforcement matters. Our concern is to ensure that 
transfer restrictions on data in the proposed regulation do not unduly 
interfere with legitimate information exchanges and cooperation between 
regulatory authorities like the FTC and its counterparts.
                                 ______
                                 
   Response to Written Questions Submitted by Hon. John F. Kerry to 
                       Hon. Maureen K. Ohlhausen

Principles that Require Protection
    Question 1. According to a survey from Consumer Reports, 71 percent 
of respondents from a recent survey said that they had concerns about 
companies distributing their information without permission, while 56 
percent said they had similar concerns about companies that hold onto 
data ``even when the companies don't need it anymore.'' Cases brought 
to date on privacy rely on the FTC's ability to protect people from 
deception. That is, a company cannot do something with your information 
that they told you they would not do. That is insufficient in the minds 
of many Americans as reflected in this poll since fighting deception is 
not a requirement for consent for collection or distribution and it 
does not place any limits on data retention. Deception is also silent 
on the other fair information practice principles including the right 
to access.
    In your testimony, you state, ``I firmly believe that consumers 
should have the tools to protect their personal information through 
transparency and choices.''
    In light of the clear evidence that there are numerous collectors 
of information that provide the people on whom they are collecting 
information with neither transparency nor clear choices, would you 
support a law requiring the tools you believe consumers should have?
    Answer. Although a substantial portion of the FTC's privacy 
enforcement has been based on deception as your question indicates, 
there are other legal avenues available to the FTC in this area. Thus, 
if there is consumer harm occurring from sharing data with third 
parties, I would first consider whether we should make fuller use of 
existing FTC statutory authority. For instance, the Commission has 
routinely used its unfairness authority to reach conduct that did not 
involve a deceptive statement but caused substantial harm that is not 
outweighed by any countervailing benefits to consumers or competition, 
and that consumers themselves could not have avoided reasonably. A 
number of these cases involve the sharing of consumer information with 
third parties in a way that risked substantial consumer harm. For 
example, in 2004 the FTC used its unfairness authority to obtain a 
settlement from Gateway Learning Corporation for renting personal 
information provided by consumers on the Gateway Learning Website 
without seeking or receiving the consumers' consent.\1\ The FTC has 
also used its unfairness authority on multiple occasions to target 
companies that failed to use reasonable security measures to protect 
sensitive consumer data.\2\ the FTC also has actively enforced other 
statutes that prohibit sharing sensitive consumer data with third 
parties under certain circumstances, such as the Children's Online 
Privacy Protection Act (COPPA), the Fair Credit Reporting Act (FCRA), 
and the Gramm-Leach-Bliley Act (GLB).
---------------------------------------------------------------------------
    \1\ Decision and Order, In re Gateway Learning Corp., 138 F.T.C. 
443 (Sept. 10, 2004). In this case, the FTC claimed that the material 
revisions Gateway made to its privacy policy, and the retroactive 
application of those revisions to information it had previously 
collected from consumers constituted an unfair act or practice because 
the conduct caused substantial injury to consumers that was not 
outweighed by countervailing benefits to consumers of competition. The 
Complaint also alleged that the revisions were false and misleading.
    \2\ See Complaint, In re BJ's Wholesale Club, Inc., FTC File No. 
0423160 (Sept. 20, 2005) (The FTC alleged that BJ's Wholesale's failure 
to take appropriate security measures to protect its consumers' 
sensitive information constituted an unfair practice. The Complaint 
argued that BJ's security failures allowed unauthorized persons to 
access sensitive consumer information, and use that information to make 
fraudulent purchases.); Complaint, In re DSW, Inc., FTC File No. 
0523096 (Dec. 1, 2005) (The FTC alleged that DSW's failure to take 
reasonable security measures to protect sensitive consumer data was an 
unfair practice. According to the Complaint, DSW's data-security 
failures allowed hackers access to consumer's credit card, debit card, 
and checking account information.); Complaint, In re CardSystems 
Solutions Inc., FTC File No. 0523148 (Feb. 23, 2006) (The FTC alleged 
that CardSystem's failure to take appropriate security measures to 
protect sensitive information of its consumers constituted an unfair 
practice. The Complaint claimed that due to the security failures, a 
hacker was able to gain access to sensitive consumer information that 
enabled him to counterfeit cards to make fraudulent purchases.)
---------------------------------------------------------------------------
    I am aware of concerns about data brokers that monetize and sell 
consumer data to other companies in ways that may be invisible to 
consumers. The FTC's recent Privacy Report, which issued before I 
arrived at the Commission, described three types of data brokers: (1) 
those whose products and services are used for eligibility decisions, 
such as credit, employment or insurance and whose practices are already 
covered by the FCRA; (2) data brokers who collect and sell consumer 
data for marketing purposes; and (3) data brokers whose products are 
used for purposes other than marketing and FCRA-regulated eligibility 
purposes. Some of these uses include fraud prevention or risk 
management to verify the identity of consumers.
    When developing an appropriate approach to the regulation of third 
party data collection, it is important to protect consumers from 
harmful practices while still permitting beneficial uses, such as fraud 
prevention and, in many cases, marketing. Several data security bills 
have included provisions that seek to provide consumers transparency 
and choice about information practices, and I will evaluate these 
proposals carefully.

    Question 2. How would you apply your commitment to transparency and 
choices in the case of companies that do not collect information 
directly from the consumer but buy it from other collectors or harvest 
it from publicly available information?
    Answer. As stated above, if there is consumer harm occurring from 
sharing data with third parties, I would explore whether we should 
undertake enforcement using existing FTC deception and unfairness 
authority, as well as other statutes such as COPPA, the FCRA, HIPAA, 
and Gramm-Leach-Bliley. I would also evaluate current industry 
practices of third party data collectors, including any self-regulatory 
programs. Finally, I will consider whether there is consumer harm 
occurring that cannot be reached by current enforcement and self-
regulatory programs to determine if additional protections are 
necessary.

Tracking and Your Property
    Question 3. For a company to track an individual's behavior and 
activities on the Internet, it has to put a tracking technology on a 
person's computer or smartphone. Do you believe it is the right of the 
collectors of information to place such tracking devices on a person's 
property and collect information without that person's knowledge or 
participation or collect information that has nothing to do with the 
service being provided and if not, what in the law stops that from 
happening today?
    Answer. It is my understanding that tracking for online behavioral 
advertising is typically done through the placement of a cookie on a 
device (such as a computer, tablet, or smartphone) to collect 
information about sites visited by a user. I believe that sites and 
services that place such cookies should provide consumers clear notice 
of this practice. Consumers should have the right to decline to accept 
such cookies for marketing purposes. I also understand that many sites 
and browsers provide consumers with a variety of tools that allow them 
to express their preferences regarding tracking mechanisms. The FTC has 
brought enforcement actions against entities that have failed to honor 
such consumer choices. For instance, in 2011 the FTC obtained 
settlements from two online behavioral advertising networks, 
challenging the companies' privacy policies that allegedly deceptively 
tracked online activities, even after consumers opted out of such 
tracking.\3\ It is my further understanding that several self-
regulatory organizations offer consumers a blanket opt-out from 
receiving targeted ads for marketing purposes.
---------------------------------------------------------------------------
    \3\ See Complaint, In re Chitika, Inc., FTC File No, 1023087 (March 
14, 2011) (alleging that Chitika's opt-out mechanism in its privacy 
policy, which allowed consumers to ``opt-out'' of having cookies placed 
on their browsers and receiving targeted ads but only lasted for 10 
days, was deceptive); Complaint, In re ScanScout, Inc., FTC File No. 
1023185 (Nov. 8, 2011) (alleging that ScanScout's claim that consumers 
could opt-out of receiving targeted ads by changing their computer's 
web browser settings was deceptive because ScanScout used Flash 
cookies, which could not be blocked by browser settings).
---------------------------------------------------------------------------
Data Security vs. Data Privacy
    Question 4. Commissioner Ohlhausen, in your testimony, you support 
enactment of data security legislation, stating ``the legislation 
should empower the FTC to promulgate regulations for the protection of 
personal data from unauthorized access.'' If that is appropriate, and I 
agree that it is, why shouldn't the FTC have authority to promulgate 
regulations to protect personal data from unauthorized acquisition from 
the individual in question in the first place, an authority it does not 
have today and one you state it should only have after a risk to harm 
is exposed?
    Answer. I believe that it is necessary to strike the right balance 
in regulating the collection and use of consumer information by 
legitimate actors, and focusing on consumer harm is an important part 
of this balance. There is an important distinction between a data 
breach and the collection and use of consumer information by a first 
party, as the FTC's Self-Regulatory Principles for Online Behavioral 
Advertising from 2009 and recent privacy report recognize. In the case 
of a data breach, there are no benefits to consumers or legitimate 
businesses or to competition from allowing data to be stolen and 
possibly used for fraudulent purposes. Requiring reasonable precautions 
against such breaches will enhance consumer welfare. By contrast, as 
the FTC has recognized in the guidance it has issued, consumers 
generally expect that first parties will collect and use their data. 
They also understand that they may receive benefits from the sharing of 
their data, such as free content or personalized services. Although 
there may be inappropriate sharing of information with third parties in 
some circumstances, there are also beneficial uses such as fraud 
prevention, risk management to verify the identity of consumers, and 
marketing. Because prohibiting these beneficial uses may reduce 
consumer welfare and harm competition, we should evaluate whether 
certain practices are causing consumer harm and whether consumers would 
be, on balance, better off if these practices were prohibited.

    Question 5. Is it your position that the breach of personal data on 
a company's database should not be illegal if the information does not 
pose a provable economic harm? For example, should data breach 
legislation cover the hacking of a database of magazine subscriptions 
that would expose a person's sexual orientation or religious 
affiliation, or does that fail to meet the harm prerequisite?
    Answer. If an entity that collects consumers' personal information 
has promised to protect such information and fails to take reasonable 
precautions resulting in a breach, that failure is actionable under the 
FTC's current deception authority regardless of resulting economic 
harm. As for the FTC's unfairness authority, which includes a harm 
standard, the FTC has long recognized that harm to consumers is not 
limited solely to economic consequences and may include other factors, 
such as health and safety risks. It may also include a broader class of 
sensitive personal information. For instance, in 2007 the district 
court affirmed the FTC's action against Accusearch alleging the 
unauthorized disclosure of consumers' phone records was likely to cause 
substantial injury, including unwarranted risk to their health and 
safety, from stalkers and abusers, and was unfair. \4\
---------------------------------------------------------------------------
    \4\ FTC v. Accusearch, Inc. No. 06-CV-105-D, 2007 U.S. Dist. LEXIS 
74905 (D. Wyo. Sept. 28, 2007), aff'd 570 F.3d 1187 (10th Cir. 2009).
---------------------------------------------------------------------------
    However, not every breach of data can be given the same weight, and 
the FTC has required companies to take reasonable precautions based on 
the sensitivity of the data the entity holds. Protecting against all 
breaches is close to impossible. Thus, in determining what breaches 
should be a law violation, the breadth of consumer harm must be 
considered in light of the costs of preventing a breach. I support the 
goals of data security legislation proposed by members of this 
Committee.

Who is Authorized to Share Your Data?
    Question 6. A Wall Street Journal examination of 100 of the most 
popular Facebook apps found that some seek the e-mail addresses, 
current location and sexual preference, among other details, not only 
of app users but also of their Facebook friends. Should consumers 
expect that things they share with a group of friends they choose on 
social networking sites in turn makes those friends authorized 
distributors of access to them and their information? Does that raise 
any concerns for you?
    Answer. Social networking is increasingly popular and it is clear 
that many consumers feel comfortable freely sharing their personal 
information and preferences with a large group of friends and 
acquaintances. As social networking becomes the norm in our society, I 
think consumers need to be aware that the information they share on 
these sites can be easily passed on by their friends and acquaintances. 
Educating consumers so that they are aware of the risks as well as the 
benefits of sharing information of social networking sites allows 
consumers to make informed choices that reflect their preferences. The 
FTC has an active consumer education program and has created and widely 
disseminated a Net Cetera guide for youth online behavior. Also, as you 
know, the FTC has brought several enforcement cases (Google, Facebook 
and Twitter) in the social network arena to ensure that consumer 
preferences are respected.

Communication over Open WiFi
    Question 7. The FTC, the FCC, and the Department of Commerce 
concluded that Google violated no laws when it collected private 
communications transmitted over unencrypted WiFi connections. Should 
collectors respect fair information practice principles if that 
information is transmitted over a WiFi network or is that not necessary 
in this context?
    Answer. As suggested in the FTC's letter to Google closing the 
wireless network investigation, a company collecting data in any 
fashion, including when transmitted through a WiFi network, is in a 
better position to ensure the privacy and security of that data when it 
follows best practices, such as collecting only the information 
necessary to fulfill a business purpose and disposing of the 
information that is no longer necessary to accomplish that purpose. 
Additionally, it is advisable that any company collecting data 
institute adequate internal review processes to identify risks to 
consumer privacy resulting from the collection and use of information 
that is personally identifiable or reasonably related to a specific 
consumer. Because there was no misrepresentation and Google did not use 
the information it collected and promised to destroy it, it would have 
been difficult to meet the deception or harm requirements for a 
violation of the FTC Act.

Inconsistencies in Law
    Question 8. Today, we have laws governing privacy when a bank is 
collecting your information or when a doctor or hospital is collecting 
your information. We also have laws governing telephone companies 
tapping your communications or cable companies tracking your watching 
habits. Isn't similar or identical information collected and used 
without a governing framework on the Internet every day and what makes 
that disparity in law rational?
    Answer. There are a variety of statutes, such as HIPAA, the FCRA, 
and Gramm-Leach-Bliley, that govern the collection and use of 
consumers' financial and medical information in many circumstances, 
including over the Internet. The FTC has also brought a variety of 
enforcement actions under its deception and unfairness authority to 
protect consumers' financial, medical, and other sensitive information 
from unauthorized release or usage both online and offline. If there is 
harm occurring from sharing consumers' financial or medical data or the 
content of their online communications without their knowledge or 
consent, I would explore whether we should undertake enforcement using 
existing FTC deception and unfairness authority, as well as other 
statutes such as COPPA, the FCRA, HIPAA, and Gramm-Leach-Bliley. I 
would also evaluate the current industry practices of third party data 
collectors, including any self-regulatory programs. Finally, I will 
also consider whether there is consumer harm occurring that cannot be 
reached by current enforcement and self-regulatory programs to 
determine whether additional protections are necessary.

The European Privacy Standard
    Question 9. What is your understanding of where the European 
privacy protection legal framework update stands and how does it 
compare to what your agencies have proposed?
    Answer. Regarding the question of where the European privacy legal 
framework update stands, I agree with Chairman Leibowitz's response 
relating to the status of the EU's privacy update.
    With response to the second part of the question, I was not on the 
Commission during the release of the FTC's Privacy Report and am in the 
process of educating myself about the extent of the EU Privacy and 
Electronic Communications Directive update`s interoperability with the 
U.S. privacy framework.
                                 ______
                                 
    Response to Written Question Submitted by Hon. Amy Klobuchar to 
          Hon. Jon D. Leibowitz and Hon. Maureen K. Ohlhausen

    Question. The United States has been a leader in cloud computing--
as the use of ``the cloud'' continues it is important to work with 
foreign countries with consumers of cloud computing or house data 
storage centers. We need to make sure they have strong security 
standards, enforcement, and consumer protections in place. This 
international component is mentioned in both reports--what work have 
you done so far to move forward on this cooperation? And are you 
working with the Department of State?
    Answer. The FTC has promoted strong security standards, 
enforcement, and consumer protections for cloud computing in several 
ways. First, the FTC has made substantial efforts to improve 
enforcement cooperation with its foreign counterparts in the area of 
consumer protection and privacy generally. The passage of the U.S. SAFE 
WEB Act in 2006, which strengthened the FTC's ability to share 
information with and provide investigative assistance to foreign law 
enforcement authorities, has been a key part of these efforts. The Act 
is scheduled to sunset in 2013; we have urged Congress to renew the 
legislation permanently to ensure that we have the tools necessary to 
cooperate with our foreign partners on such issues of mutual interest. 
Among those issues are ones involving cloud computing.
    Second, we play a leadership role in several international 
enforcement networks that address issues relevant to cloud computing. 
One example is the Global Privacy Enforcement Network, which we 
launched jointly with several foreign counterparts. Our aim is to 
facilitate more practical cooperation among privacy enforcement 
authorities on matters, including cloud computing, that cross borders. 
Agencies from twenty countries now participate.
    Third, we have worked to support enforceable codes of conduct to 
leverage private sector efforts with enforcement to provide strong yet 
flexible protections for cross-border data transfers. In the Asia-
Pacific Economic Cooperation forum (or APEC), for example, the FTC and 
the Department of Commerce have worked with other economies to develop 
the APEC Cross-Border Privacy Rules system, which provides baseline 
privacy protections supported by an enforcement backstop. APEC is also 
exploring the system's application in the context of cloud computing. 
In the transatlantic context, the FTC provides the enforcement support 
for the ``Safe Harbor'' system enabling data transfers from the 
European Union to the United States, and has recently brought several 
cases to vindicate the integrity of this framework.
    Fourth, we also work closely with the Department of State and other 
U.S. agencies in developing strong and sensible international policies 
in this area. FTC staff participate with State in such fora as the 
OECD's Working Party on Information Security and Privacy. We have also 
worked with the Department of State in the U.S.-EU information society 
dialogue, where several issues related to cloud computing are being 
addressed. We also have extensive bilateral exchanges with our foreign 
counterparts, and routinely solicit their input for FTC conferences. 
One example is the FTC's 2009 conference on securing personal data in 
the global economy, conducted in conjunction with OECD and APEC, which 
analyzed data-security issues in a global information environment where 
data can be stored and accessed from multiple jurisdictions.
    We believe that data security, consumer protection and privacy 
enforcement are critical to the success of any platform, including 
cloud computing, and we will continue to reach out to our foreign 
partners to ensure that these issues are properly addressed.
                                 ______
                                 
    Response to Written Question Submitted by Hon. Amy Klobuchar to 
                         Hon. Cameron F. Kerry

    Question. The United States has been a leader in cloud computing--
as the use of ``the cloud'' continues it is important to work with 
foreign countries with consumers of cloud computing or house data 
storage centers. We need to make sure they have strong security 
standards, enforcement, and consumer protections in place. This 
international component is mentioned in both reports--what work have 
you done so far to move forward on this cooperation? And are you 
working with the Department of State?
    Answer. Because cloud computing touches on many important economic 
and policy interests, the United States government's approach is to 
bring to bear a wide array of agencies and coordinate their efforts. 
Issues regarding cloud computing are often raised in meetings of the 
National Science and Technology Council, particular within the 
Committee on Technology's Subcommittees on Privacy and Global Internet 
Governance. The Subcommittee on Privacy, which I co-chair along with 
Assistant Attorney General Christopher Schroeder of the Department of 
Justice's Office of Legal Policy, has a working group entirely focused 
on international engagement. This working group is led by members of 
the State Department, the International Trade Administration (ITA, a 
bureau of Commerce), and the National Telecommunications and 
Information Administration (NTIA, a bureau of Commerce), and has 
representatives on it from Defense, Homeland Security, Federal Trade 
Commission, Office of Science and Technology Policy, Office of the 
Director of National Intelligence, National Security Staff, United 
States Trade Representative, Treasury, and more than a dozen other 
agencies.
    Commerce works closely with State and other Administration agencies 
on the international components of cloud computing. State's efforts in 
this area are spearheaded by Ambassador Philip Verveer, coordinator for 
International Communications Information Policy. Ambassador William 
Kennard, Chief of the U.S. Mission to the European Union and former 
Chairman of the Federal Communications Commission, has also been 
extremely engaged.
    Within Commerce, the National Institute of Standards and Technology 
(NIST), as part of its Cloud Computing Program, has assumed a 
technology leadership role in advancing Cloud Computing 
interoperability, portability and security standards, guidelines, and 
technology. NIST works in a collaborative model with over 2500 
individuals and organizations from academia, industry, standards 
organizations, United States federal, state and local governments, and 
the international community to provide a neutral objective basis for 
understanding and addressing the underlying technical challenges 
related to the emerging model of cloud computing. In this program, NIST 
has worked very closely with the Department of State, Department of 
Homeland Security, and other Commerce bureaus to open a dialogue with 
the international community, and has been very effective in this role. 
For example, in NIST's 2012 Cloud Computing Forum & Workshop held in 
Washington, D.C. on June 5-7, senior government officials from Canada, 
the People's Republic of China, and Japan presented views on the 
benefits of cloud computing for public services, along with United 
States CIO Steve Van Roekel, in a session moderated by Ambassador 
Verveer. This event was open to the public and had 500 registered 
attendees. In this same event, NIST hosted a standards panel that 
included international standards organizations. NIST has contributed to 
and participates in international standards bodies along with United 
States industry.
    State, Commerce, Justice, and other agencies are also examining 
cloud computing issues as they arise as topics for discussion in 
multilateral forums, such as the Organization for Economic Co-operation 
and Development and Asia-Pacific Economic Cooperation (APEC). Ensuring 
the free flow of data across borders is an important priority in any 
new trade agreement, such as the TransPacific Partnership.
    State and Commerce are cooperating on cloud discussions with the 
Government of Japan to discuss ways in which cooperation can improve 
commerce, healthcare, consumer safety, and disaster preparedness 
between our nations. Also, Commerce recently held its first meeting 
with China's Ministry of Commerce on cloud computing in April 2012 in 
order to learn more about China's plans in this area.
    One of the major obstacles we face in cloud computing is a popular 
misconception around the world that United States laws grant law 
enforcement more and easier access to personal data stored in the cloud 
than the laws of peer countries. These unfounded concerns run the risk 
of hindering the ability of United States companies to compete to 
provide cloud computing solutions, particularly in Europe.\1\ 
Therefore, an important part of the work of the U.S. government is to 
educate other governments and citizens about existing privacy 
protections for personal data in the United States. State, the Justice 
Department, and Commerce have been engaged in education and outreach 
efforts in Europe, South America, Asia, and Australia to improve 
understanding of our privacy protections for data stored in the cloud. 
Contrary to the mistaken impressions occasionally voiced by foreign 
governments, the United States legal framework for protection of civil 
liberties in the context of legitimate law enforcement access offers a 
high level of privacy protection. We continue to raise this issue 
publicly and in bilateral interactions with our allies to be sure that 
United States cloud computing providers are not unfairly discriminated 
against in their efforts to offer services around the world.
---------------------------------------------------------------------------
    \1\ See, e.g., David Rauf, PATRIOT Act Clouds Picture for Tech, 
Politico (Nov. 29 2011) (available at http://www.politico.com/news/
stories/1111/69366.html); Loek Essers, European Data Concerns Cloud 
Outlook for U.S. Vendors: The Dutch Government May Block Bids from U.S. 
Cloud Vendors, IDG News Service (Sept. 16 2011) (available at https://
www.networkworld.com/news/2011/091611-european-data-concerns-cloud-
outlook-250988.html); Lothar Determann, Data Privacy in the Cloud: A 
Dozen Myths and Facts, The Computer and Internet Lawyer vol. 28 no. 11 
(Nov. 2011) (available at http://www.bakermckenzie.com/files/
Publication/85bf0767-55d0-4679-879d-85987d26b725/Presentation/
PublicationAttachment/96b0c239-5feb-46e9-811c-87c66f224629/
ar_california_clouddataprivacy_nov11.pdf).
---------------------------------------------------------------------------
    International discussions about cloud computing and cross border 
data transfers are too often grounded in myths about the United States 
legal system that misrepresent our fundamental commitment to privacy 
and the extensive privacy protections we provide, at the expense of our 
ability to advocate for international cooperation on creating 
interoperable standards and protections. While the consumer privacy 
framework in the United States is strong,\2\ Congress can improve 
existing consumer privacy protections in ways that benefit consumers, 
foster greater trust in both the Internet and cloud computing, and 
strengthen our businesses' ability to compete at home and in foreign 
markets. The baseline privacy protection legislation outlined in the 
Administration's Privacy Blueprint would help to achieve these goals.
---------------------------------------------------------------------------
    \2\ See foreword, Consumer Data Privacy in a Networked World: A 
Framework for Protecting Privacy and Promoting Innovation in the Global 
Digital Economy (Feb. 23 2012) (available at http://www.whitehouse.gov/
sites/default/files/privacy-final.pdf).
---------------------------------------------------------------------------
                                 ______
                                 
     Response to Written Questions Submitted by Hon. John Thune to 
                         Hon. Jon D. Leibowitz

Problems with Empowering State Attorneys General to Enforce Federal Law 
        with Regard to Privacy
    Question 1. Mr. Leibowitz, one of the provisions proposed in 
various pieces of privacy legislation deals with state attorneys 
general being empowered to enforce Federal law with regard to data 
security. A likely result if such a provision were to be enacted into 
law is that state attorneys general would delegate their Federal 
enforcement power to private contingency fee lawyers. I believe the 
problem with this approach is that the goals of plaintiffs' lawyers 
might conflict with a state official's duty to protect the public 
interest. Plaintiffs' lawyers will be motivated to maximize fees at the 
expense of the taxpayer. There have also been troubling instances of 
state attorneys general hiring favored contingency fee lawyers rather 
than having a transparent and competitive bidding process. Litigation 
brought by state attorneys general should be motivated by the public 
good, not by private profit.
    Mr. Leibowitz, with respect to proposed data privacy legislation 
empowering state attorneys general to enforce Federal law, do you 
believe that the legislation should ensure there is adequate 
supervision of state attorneys general at the Federal level to assure 
consistent enforcement of Federal law throughout the United States? Do 
you believe that state attorneys general empowered to enforce Federal 
law regarding data security should be restricted from delegating this 
power to contingency fee lawyers? If not, do you believe that if 
contingency fees lawyers are employed, the process to hire them should 
take place in a transparent manner with competitive bidding?
    Answer. We support the ability of state attorneys general to 
enforce any Federal privacy laws, but the Commission has not taken a 
position on the methods by which the states use their enforcement 
authority.
    The FTC often collaborates with the states in our privacy and data 
security investigations. For example, in our case against Lifelock the 
company agreed to pay $11 million to the FTC and $1 million to a group 
of 35 state attorneys general to settle charges that the company used 
false claims to promote its identity theft protection services. This 
joint settlement is just one example of our strong cooperative efforts 
with the states, and we look forward to working with them on future 
efforts in the areas of privacy and data security. This sort of 
collaboration helps ensure that enforcement actions are complementary 
and consistent. Another means of ensuring consistent enforcement of 
Federal law is carefully crafting the standards in any legislation to 
minimize the potential for inconsistent interpretations. We would be 
happy to work with the Committee on any such proposed legislation.
    While I support the ability of state attorneys general to enforce 
any Federal data security laws, the Commission has not taken a position 
on the methods by which the states use their enforcement authority.

Definition of Data Broker

    Question 2. Mr. Leibowitz, the FTC Privacy Report released a few 
months ago applauded the Digital Advertising Alliance's self-regulatory 
privacy program. However, the FTC's Privacy Report also calls for 
legislation to regulate data brokers, but offers no guidance for what 
constitutes a data broker. As it stands, nearly all of industry engages 
in business or practices that might constitute data brokerage, and 
legislation would have a sweeping impact on many, if not all companies.
    Mr. Leibowitz, how would you define what a data broker is? I'd like 
to hear your answer here today, but would also like to have your 
written answer for the record.
    Answer. We would be happy to work with this Committee as it 
considers legislation concerning data brokers to determine a consensus 
definition of data brokers. When we developed our privacy report, we 
considered data brokers to be companies that monetize and sell consumer 
data to other companies in ways that are often invisible to consumers. 
Our report described three types of data brokers. First, there are 
those whose products and services are used for eligibility decisions, 
such as credit, employment or insurance; these companies' practices are 
covered by the Fair Credit Reporting Act (FCRA). Second, there are data 
brokers who collect and sell consumer data for marketing purposes. 
Finally, there are data brokers whose products are used for purposes 
other than marketing and FCRA-regulated eligibility purposes. Some of 
these uses include fraud prevention or risk management to verify the 
identity of consumers.

    Question 2a. Mr. Leibowitz, why do you believe legislation is 
necessary despite the success of industry's self-regulatory program?
    Answer. I believe that industry is making progress on self-
regulation in some areas. For example, industry has made great strides 
in implementing a Do Not Track mechanism, but more work remains to be 
done. But there clearly are other areas that deserve more attention. 
The data broker industry is an example of an area where self-regulatory 
efforts have lagged. As our Privacy Report notes, there have been no 
successful self-regulatory efforts by the data broker industry since 
the 1990s--despite the highly-publicized ChoicePoint breach and growing 
public concerns. Given the fact that data brokers are largely invisible 
to consumers yet can have a dramatic impact on their lives, we have 
called for targeted legislation to give consumers reasonable access to 
the data such entities maintain about them, and we are working with 
data brokers to explore creating a centralized website to increase 
transparency about their practices and give consumers choices.
    The mobile industry is another area where self-regulation is 
lagging. As detailed in a recent FTC staff report about children's 
mobile applications (``apps''), consumers are provided with very little 
information about applications' data collection and sharing practices. 
Our report found that in virtually all cases, neither app stores nor 
app developers provide disclosures that tell parents what data apps 
collect from children, how apps share it, and with whom.

FTC Privacy Report and Cost-Benefit Analysis

    Question 3. The section of the FTC Privacy Report discussing the 
cost-benefit analysis of privacy regulation is disturbingly thin. The 
report acknowledges that ``imposing new privacy protections will not be 
costless'' but makes no attempt to determine what those costs are. 
Moreover, the proposed benefits to companies are unquantified and 
anecdotal at best. Businesses are better able to determine and maintain 
the value of consumer trust in the marketplace than is the FTC. Under 
the Regulatory Impact Analysis of the Office of Management and Budget, 
agencies are supposed to consider the qualitative and quantitative 
costs and benefits of a proposed regulation and any alternatives. That 
seems particularly important, given that Internet advertising alone 
directly employs 1.2 million Americans. How do we ensure a 
comprehensive cost/benefit analysis of privacy regulation or 
enforcement activity given that the FTC doesn't seem to have done that 
here?
    Answer. As we noted in our report, we agree that it is important to 
consider costs and benefits associated with our recommendations. 
However, empirical, quantitative analyses are particularly challenging 
in this area. The value consumers place on not being tracked as they 
use the Internet or the costs to them of potential embarrassment or 
harm arising from unknown or unanticipated uses of information cannot 
be easily calculated.
    It is important to note, however, that the Commission's Final 
Privacy Report did not and was not intended to set forth a new 
regulation or serve as a template for law enforcement. Instead, it 
focused on articulating best practices for companies that collect and 
use consumer data. The best practice recommendations in the report are 
designed to be flexible to permit and encourage innovation. Companies 
can implement the privacy protections recommended in the report in a 
manner proportional to the nature, sensitivity, and amount of data 
collected as well as to the size of the business at issue.
    In addition, many companies have already implemented many of these 
practices, and we plan to work with industry to facilitate even broader 
adoption in the future. Further, it is noteworthy that a number of 
leading companies have also asked Congress to consider enacting 
baseline privacy legislation to provide legal certainty to industry and 
to build trust with consumers. To the extent that Congress decides to 
move forward on baseline privacy legislation, the Commission notes that 
the best practices it recommends in the final report can inform the 
deliberations.

Risk of Stifling the Internet Economy

    Question 4. A report commissioned by Interactive Advertising Bureau 
recently concluded that the Internet accounted for 15 percent of total 
U.S. GDP growth. If the Internet were a national economy, by 2016 it 
would rank as the fifth largest economy in the world. The advertisement 
supported Internet contributes $300 billion to the U.S. economy and has 
created about 3 million U.S. jobs. At a time of sustained, grim 
economic news, the Internet has remained one of the bright spots of the 
United States economy and that trend is continuing. I'm worried that if 
we try to rush a quick-fix on the issue of privacy, rather than 
thoughtfully and carefully dealing with the issue, we'll stifle that 
important economic advantage we have here in America. How do we make 
sure that we don't stifle the Internet economy, but still protect 
consumers? How do you balance these interests?
    Answer. Our report articulates best practices for companies that 
collect and use consumer data. We also recommend--in part in response 
to calls from leading companies--that Congress consider enacting 
baseline privacy legislation to provide more legal certainty to 
industry and to build trust with consumers. All of these 
recommendations are the result of our extensive work with all 
stakeholders, and we look forward to working with Congress to make sure 
that we appropriately balance these interests.
    We believe that companies will still be free to innovate--for 
example, they can find new ways to target ads without tracking or with 
less tracking, and consumers can continue to receive targeted ads if 
they so choose. Our recommendations simply seek to give consumers 
clear, understandable, relevant choices about their information. This 
conversation will build more confidence in the marketplace and 
encourage growth.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. Marco Rubio to 
                         Hon. Jon D. Leibowitz

    Question 1. The FTC has endorsed the concept of Do Not Track (DNT), 
and this feature has been implemented by some browsers and social 
network services. As you probably are aware, many stakeholders have 
pointed out that implementing DNT could be difficult and disrupt 
website operations. My concern is the potential unintended consequences 
if a DNT mechanism or policy is drafted or implemented poorly, or does 
not take fully into consideration how the mechanism works. We know that 
some social networks and service providers utilize tracking functions 
and collect data to track child predators or prevent underage children 
from joining a site or service. In these cases, data collection and 
tracking are being used in an effective way, hence the concern if DNT 
is implemented poorly or prevents all data collection. Is the FTC 
taking these concerns into consideration? Is the FTC concerned about 
unintended harm if a broad DNT policy is implemented poorly?
    Answer. The Commission continues to support Do Not Track and 
believes an effective model with limited exceptions can be implemented 
successfully. As the Commission developed the Do Not Track 
recommendation, it was certainly cognizant of unintended consequences 
and crafted an approach designed to address concerns like those you 
identify. For example, in the scenario you describe about a social 
network collecting information about its own users for public safety or 
criminal purposes, our framework would likely consider this practice to 
be an acceptable first party practice that is not within the scope of a 
Do Not Track mechanism. Do Not Track is not intended to prevent or 
address legitimate data collection and use by first parties with direct 
relationships with consumers but is designed to address data collection 
activities by third parties.
    With respect to third party tracking, we have stated that any Do 
Not Track mechanism should be universal, easy, persistent, enforceable, 
and cover most collection, with some narrow exceptions like fraud 
detection. Industry has responded to our call for Do Not Track and is 
making great progress. There are currently broad-based discussions 
taking place on implementation of Do Not Track to ensure that the 
implementation is effective and not overbroad. We plan to closely 
monitor these discussions and are optimistic that an effective Do Not 
Track mechanism will be in place by the end of the year.

    Question 2. As a father of four young children, I am concerned 
about their safety online, and I want to ensure that children are 
protected when they use the Internet and new technologies. I understand 
that the FTC is currently engaged in another review of the Children's 
Online Privacy Protection Act. Can you update me on the status of that 
review? At this point, do you believe that Congress needs to update 
that Act?
    Answer. Children's privacy is a top priority for the Commission. We 
received over 350 comments in response to our proposed changes to the 
COPPA Rule and are working through them. There are many complicated 
issues, and we want to be sure we get it right. We hope to have the 
Rule finalized by the end of the year.

    Question 3. In the FTC's Privacy Report there is a section on the 
articulation of privacy harms. In it, the FTC ultimately concludes that 
the ``range of privacy-related harms is more expansive than economic or 
physical harms or unwarranted intrusions and that any privacy framework 
should recognize additional harms that might arise from unanticipated 
uses of data.'' (p. 8)
    Is the FTC implying or concluding that any unanticipated use of 
data is wrong? Is the FTC implying or advocating for the ability to 
take enforcement actions against harms that ``might arise''? Or is the 
FTC already doing this? 1Do you think the FTC has blanket authority to 
regulate all uses of data?
    Answer. The Commission's Final Privacy Report did not conclude that 
any unanticipated use of data was wrong or that the FTC had authority 
to regulate all uses of data. Rather, the report noted the concern that 
some unanticipated data uses could cause harm. The report described 
harms arising from the unexpected and unconsented to revelation of 
previously-private information, including both sensitive information 
(e.g., health, financial, children's information, precise geolocation 
information) and less sensitive information (e.g., purchase history, 
employment history) to unauthorized third parties. As one example, in 
the Commission's case (and consent) against Google, the complaint 
alleged that Google used the information of consumers who signed up for 
Gmail to populate a new social network, Google Buzz. The creation of 
that social network in some cases revealed previously private 
information about Gmail users' most frequent e-mail contacts. 
Similarly, the Commission's complaint against Facebook (and proposed 
consent) alleged that Facebook's sharing of users' personal information 
beyond their privacy settings was harmful.
    Another harm the report identified is the erosion of consumer trust 
in the marketplace. Businesses frequently acknowledge the importance of 
consumer trust to the growth of digital commerce, and surveys support 
this view. For example, in the online behavioral advertising area, 
survey results show that consumers feel better about brands that give 
them transparency and control over advertisements. Companies offering 
consumers information about behavioral advertising and the tools to opt 
out of it have also found increased customer engagement. In its comment 
to the Commission's Draft Privacy Report, Google noted that visitors to 
its Ads Preference Manager are far more likely to edit their interest 
settings and remain opted in rather than to opt out. Similarly, Intuit 
conducted a study showing that making its customers aware of its 
privacy and data security principles--including restricting the sharing 
of customer data, increasing the transparency of data practices, and 
providing access to the consumer data it maintains--significantly 
increased customer trust in its company.
    Ultimately, the value consumers place on not being tracked online 
or the costs to them of potential embarrassment or harm arising from 
unknown or unanticipated uses of information cannot be easily 
determined. What we do know is that businesses and consumers alike 
support increased transparency of data collection and sharing 
practices. Increased transparency will benefit both consumers and 
industry by increasing consumer confidence in the marketplace.
    Finally, nothing in the report changes our existing authority to 
enforce the FTC Act. We can only bring actions involving unfair or 
deceptive practices. A practice is deceptive if (1) it is likely to 
mislead consumers acting reasonably under the circumstances, and (2) it 
is material, that is, likely to affect consumers' conduct or decisions 
regarding the product at issue. A practice is unfair if it causes or is 
likely to cause harm to consumers that: (1) is substantial; (2) is not 
outweighed by countervailing benefits to consumers or to competition; 
and (3) is not reasonably avoidable by consumers themselves. In order 
to prevail in a case under the FTC Act, we must demonstrate to a judge 
that the case meets these rigorous standards.

    Question 4. As you are aware, over the last year, members of the 
Commerce Committee have asked numerous times about the scope of the 
FTC's Section 5 authority. With respect to Sec. 5, in follow-up answers 
you provided to the Committee after your last appearance here you said:
    While the vast majority of [the FTC's] antitrust enforcement 
actions involve conduct that falls within the prohibitions of the 
Sherman or Clayton Acts, the Commission has a broader mandate, which it 
discharges by challenging, under Section 5, conduct that is likely to 
result in harm to consumers or to the competitive process. . . The 
Commission's recent use of Section 5 demonstrates that the Commission 
is committed to using that authority in predictable ways that enhance 
consumer welfare.
    You say that you are ``committed to using that authority in 
predictable ways.'' However, I would note that while the Commission has 
held workshops on the scope of its Section 5 authority in recent years, 
it has never issued a formal report or guidelines from those workshops 
that would give clear direction to the business community about the 
types of cases that the Commission will pursue outside the traditional 
Sherman Act constraints.

    Question 4a. Do you plan on issuing such formal guidelines? If so, 
when can we expect to see those guidelines? If not, why?
    Answer. I agree that businesses and consumers benefit whenever we 
are able to improve the clarity and predictability of the laws we 
enforce, including Section 5. It is worth noting that Congress, in 
formulating the antitrust laws and Section 5, decided that common law 
development of competition law was preferable to trying to produce a 
list of specific violations, recognizing that no such list could be 
adequate over varying times and circumstances. Congress consciously 
opted for a measure of flexibility in competition law.
    However, sources of guidance do exist. Although the Supreme Court 
has never squarely articulated the precise boundaries of our Section 5 
authority, the case law, complaints, and consent agreements identify 
the types of conduct to which the FTC has applied its stand-alone 
Section 5 authority in the past. Recent cases, including Intel, U-Haul, 
and N-Data, further illuminate the kinds of conduct the Commission has 
challenged as unfair methods of competition under Section 5. In 
addition, a wealth of information is contained in the transcripts and 
submissions from our October 2008 workshop on the use of Section 5 as a 
competition statute.
    The scope of our Section 5 enforcement authority is inherently 
broad, in keeping with Congressional intent to create an agency that 
would couple expansive jurisdiction with more limited remedies, and it 
is firmly tethered to the protection of competition. The FTC has used 
its Section 5 authority judiciously in the recent past. We will not 
hesitate, however, to use Section 5 to combat unfair methods of 
competition that are within the scope of our jurisdiction.
    My fellow Commissioners and I continue to consider the best way to 
further clarify the bounds of our Section 5 authority, be it a report, 
guidelines, or some other approach. This will remain a priority during 
the remainder of my term as Chairman.

    Question 5. In your written testimony you state that privacy 
legislation would provide ``businesses with the certainty they need to 
understand their obligations.'' Putting the legislation aside, I like 
that you are advocating for providing certainty for businesses. But in 
looking at the Privacy Report, I am concerned that the Commission is 
embracing an expanded definition of harm under Section 5 to include 
``reputational harm,'' or ``the fear of being monitored,'' or ``other 
intangible privacy interests.'' These seem like vague concepts--and I 
think this expanded harm-based approach would only create more 
uncertainty. Your testimony and the report appear to be in contrast in 
this instance. Do you agree? Why or why not?
    Answer. We do not believe the harms we identify in the report and 
describe in the context of our recent enforcement actions are vague or 
uncertain. The backlash that followed Google's rollout of its Buzz 
social network and the Facebook changes that were the subject of our 
consent orders was immediate. Consumers clearly understood the 
likelihood of harm arising from these changes, and the companies should 
not have been surprised by the reaction. Thus, we do not believe our 
continuing use of Section 5 of the FTC Act, even without baseline 
legislation, will lead to uncertainty or confusion. We are obligated to 
consider certain specific factors in determining whether a violation of 
Section 5 exists and will continue to do so in our enforcement actions. 
Nevertheless, we believe that businesses can benefit from having clear 
rules of the road for commercial data practices that would provide even 
more certainty as to their obligations.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. John Thune to 
                       Hon. Maureen K. Ohlhausen

Problems with Empowering State Attorneys General to Enforce Federal Law 
        with Regard to Privacy
    Question 1. Ms. Ohlhausen, one of the provisions proposed in 
various pieces of privacy legislation deals with state attorneys 
general being empowered to enforce Federal law with regard to data 
security. A likely result if such a provision were to be enacted into 
law is that state attorneys general would delegate their Federal 
enforcement power to private contingency fee lawyers. I believe the 
problem with this approach is that the goals of plaintiffs' lawyers 
might conflict with a state official's duty to protect the public 
interest. Plaintiffs' lawyers will be motivated to maximize fees at the 
expense of the taxpayer. There have also been troubling instances of 
state attorneys general hiring favored contingency fee lawyers rather 
than having a transparent and competitive bidding process. Litigation 
brought by state attorneys general should be motivated by the public 
good, not by private profit.
    Ms. Ohlhausen, with respect to proposed data privacy legislation 
empowering state attorneys general to enforce Federal law, do you 
believe that the legislation should ensure there is adequate 
supervision of state attorneys general at the Federal level to assure 
consistent enforcement of Federal law throughout the United States?
    Answer. I support data security legislation and believe that state 
attorneys general should have enforcement authority. However, as you 
suggest, the legislation must be carefully crafted to ensure that there 
are clear statutory guidelines by which companies can implement their 
data security systems and Federal supervision of the efforts of the 
state AGs. The FTC works frequently and effectively with many state AGs 
and that model of cooperation to benefit consumers should apply here as 
well.

    Question 2. Do you believe that state attorneys general empowered 
to enforce Federal law regarding data security should be restricted 
from delegating this power to contingency fee lawyers? If not, do you 
believe that if contingency fees lawyers are employed, the process to 
hire them should take place in a transparent manner with competitive 
bidding?
    Answer. All law enforcement should be motivated by the public good, 
considering consumer harm, appropriate allocation of scare resources, 
and litigation costs, and among other factors. Transparency is also an 
important public goal, as is fostering competition in the procurement 
of goods and services for government use. Any Federal legislation 
should encourage transparency and competition at all levels of 
government but should also avoid being overly prescriptive regarding 
how states may conduct their legitimate functions.
Definition of Data Broker
    Question 3. The FTC Privacy Report released a few months ago 
applauded the Digital Advertising Alliance's self-regulatory privacy 
program. However, the FTC's Privacy Report also calls for legislation 
to regulate data brokers, but offers no guidance for what constitutes a 
data broker. As it stands, nearly all of industry engages in business 
or practices that might constitute data brokerage, and legislation 
would have a sweeping impact on many, if not all companies. How would 
you define what a data broker is? I'd like to hear your answer here 
today, but would also like to have your written answer for the record.
    Answer. The FTC's recent Privacy Report, which issued before I 
arrived at the Commission, considered data brokers to be companies that 
monetize and sell consumer data to other companies in ways that may be 
invisible to consumers. The Privacy Report described three types of 
data brokers: (1) those whose products and services are used for 
eligibility decisions, such as credit, employment or insurance and 
whose practices are covered by the Fair Credit Reporting Act (FCRA); 
(2) data brokers who collect and sell consumer data for marketing 
purposes; and (3) data brokers whose products are used for purposes 
other than marketing and FCRA-regulated eligibility purposes. Some of 
these uses include fraud prevention or risk management to verify the 
identity of consumers. When developing an appropriate definition of a 
data broker, it is important to protect consumers' personal information 
from harmful uses while still permitting beneficial uses, such as fraud 
prevention.

    Question 3a. Why do you believe legislation is necessary despite 
the success of industry's self-regulatory program?
    Answer. I believe that data security and breach notification 
legislation would be appropriate to protect against the unauthorized 
access of consumer information but I have not endorsed the Privacy 
Report's call for general privacy legislation.
    I think that the best way to safeguard consumer privacy is to give 
consumers the tools they need to protect their personal information 
through transparency and choices. The self-regulatory programs appear 
to have made considerable strides in giving consumers control over who 
accesses their information and how it is used for marketing purposes. 
The proposed self-regulation, however, is not aimed at protecting 
against the unauthorized access of personal data by parties, such as 
hackers, and thus would not address the types of harms that data 
security legislation seeks to prevent.

FTC Privacy Report and Cost-Benefit Analysis

    Question 4. The section of the FTC Privacy Report discussing the 
cost-benefit analysis of privacy regulation is disturbingly thin. The 
report acknowledges that ``imposing new privacy protections will not be 
costless'' but makes no attempt to determine what those costs are. 
Moreover, the proposed benefits to companies are unquantified and 
anecdotal at best. Businesses are better able to determine and maintain 
the value of consumer trust in the marketplace than is the FTC. Under 
the Regulatory Impact Analysis of the Office of Management and Budget, 
agencies are supposed to consider the qualitative and quantitative 
costs and benefits of a proposed regulation and any alternatives. That 
seems particularly important given that Internet advertising alone 
directly employs 1.2 million Americans. How do we ensure a 
comprehensive cost/benefit analysis of privacy regulation or 
enforcement activity given that the FTC doesn't seem to have done that 
here?
    Answer. With privacy, as with all public policy issues within the 
FTC's jurisdiction, to produce the best result for consumers we should 
conduct a careful analysis of the likely costs and benefits of any 
proposed regulation. The Privacy Report, which was issued before I 
started at the Commission, discusses costs and benefits in general 
terms but does not contain a cost/benefit analysis. I believe that a 
review of what consumers and competition are likely to lose and gain 
from any new regulation would be helpful to ensuring the best outcome 
for consumers. For example, in the case of advertising, the FTC has 
consistently recognized the crucial role that truthful non-misleading 
information contained in advertising plays not just in informing 
consumers but also in fostering competition between current 
participants in the market and lowering entry barriers for new 
competitors. I believe that we should consider factors regarding the 
possible effects of reducing information available in market for 
consumers and competitors when analyzing the likely effects of new 
privacy regulations.

Risk of Stifling the Internet Economy

    Question 5. A report commissioned by Interactive Advertising Bureau 
recently concluded that the Internet accounted for 15 percent of total 
U.S. GDP growth. If the Internet were a national economy, by 2016 it 
would rank as the fifth largest economy in the world. The advertisement 
supported Internet contributes $300 billion to the U.S. economy and has 
created about 3 million U.S. jobs. At a time of sustained, grim 
economic news, the Internet has remained one of the bright spots of the 
United States economy and that trend is continuing. I'm worried that if 
we try to rush a quick-fix on the issue of privacy, rather than 
thoughtfully and carefully dealing with the issue, we'll stifle that 
important economic advantage we have here in America. How do we make 
sure that we don't stifle the Internet economy, but still protect 
consumers? How do you balance these interests?
    Answer. The best way to ensure a proper balance of the interests in 
the Internet economy and consumer protection is for the FTC to continue 
its carefully targeted enforcement against deceptive and unfair acts 
and practices on the Internet while proceeding cautiously in exploring 
the need for additional generally privacy legislation and promoting 
self-regulatory efforts aimed at providing access and choice to 
consumers. For example, I support a careful analysis of consumer harms 
that are not currently being addressed by enforcement or self-
regulation before recommending any additional privacy legislation.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. Marco Rubio to 
                       Hon. Maureen K. Ohlhausen

    Question 1. The Internet has had a transformative impact on 
society, both in America and around the world. One of the great things 
about the Internet and something that has contributed to its success is 
the fact that many of the most popular services and sites that 
consumers use are free, and they have remained free because of online 
advertising, including behavior based advertising. More and more in our 
economy, the ability to tailor services to more efficiently and 
effectively meet consumers' needs is driven by the collection of data 
and the delivery of tailored ads. And these industries create jobs and 
contribute greatly to our economy. Do you agree that the FTC should 
balance these considerations when implementing privacy policies? How is 
the FTC doing this?
    Answer. Yes, I agree that the FTC should balance these 
considerations. Because the FTC's ultimate goal is to optimize consumer 
welfare, when implementing privacy policies, close attention needs to 
be paid to potential outcomes and whether agency activity is actually 
improving consumer welfare. Consumer data can help firms to better 
understand the needs of their customers and to develop new and 
innovative products and services. The FTC has also recognized the 
crucial role that truthful non-misleading advertising plays in 
fostering competition between current participants in the market and 
lowering entry barriers for new competitors, resulting in overall 
benefits for consumers. Therefore, any potential competitive effects 
resulting from new privacy restrictions, such as a firms' ability to 
efficiently and effectively meet consumers' needs, should be considered 
against the benefit that consumers may derive from these policies. It 
is important to balance the actual privacy-enhancing benefits with the 
costs of such proposals in order to ensure the best outcome for 
consumers.

    Question 2. As you know, certain telecommunications providers are 
subject to dual regulation by both the FTC and FCC. And depending on 
the service and technology, companies may be subject to multiple 
sections of the Telecommunications Act, or none at all. Do you think 
this dual regulation leads to confusion or negatively impacts some 
providers? Do you think that the Congress should look at eliminating 
dual regulation?
    Answer. Generally, confusion can be avoided by making narrowly 
tailored, well-defined regulations that retain the focus of the 
agencies' missions. In the instances where dual regulation is 
contradictory, overly broad, or no longer represents industry 
conditions, eliminating dual regulation may be beneficial. For example, 
I support eliminating the FTC's common carrier exemption, which was 
based on the existence of a pervasively regulated, monopoly 
telecommunications industry that no longer reflects the state of the 
industry.

                                  

```