January 14, 2019

Comments of Engine regarding the National Institute of Standards and Technology’s

Request for Information on Developing a Privacy Framework

(Docket Number: 181101997-8997-01)

I. Introduction

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap

between policymakers and startups. Engine works with government and a community of thousands

of high-technology, growth-oriented startups across the nation to support the development of

technology entrepreneurship. Engine promotes an environment where technological innovation and

entrepreneurship can thrive by providing knowledge about the startup economy and helping to

construct smarter public policy. To that end, Engine conducts research, organizes events, and

spearheads campaigns to educate elected officials, the entrepreneur community, and the general

public on issues vital to fostering technological innovation.

As a non-profit, Engine works with a nationwide network of startups to understand how ongoing

policy debates affect new and small high-growth technology companies and how to best advocate on

behalf of the ever-changing and growing startup ecosystem in the U.S. Engine appreciates the

opportunity to submit comments on the Administration’s proposed approach to advancing

consumer privacy while protecting prosperity and innovation. The thriving U.S. startup ecosystem is

responsible for some of the most innovative products and services as well as the vast majority of net

job growth in the U.S.1 Creating burdens in the name of protecting users’ privacy without fully

understanding the actual privacy benefits and the very real threats to startups would risk

unnecessarily crippling one of the most important sectors in our economy.

II. General Comments

Engine appreciates the opportunity to submit comments in response to the National Institute of

Standards and Technology (NIST) Request For Information (RFI) on “Developing a

1

Kane, T. (2010). The Importance of Startups in Job Creation and Job Destruction. Retrieved from:

https://www.kauffman.org/-/media/kauffman_org/research-reports-and-covers/2010/07/firm_formation_

importance_of_startups.pdf
Privacy Framework.” The questions and points raised in the RFI indicate a sincere attempt to have a

nuanced conversation about how organizations can internally approach understanding, addressing,

and communicating privacy risks. This conversation is especially important for startups, which stand

to be disproportionately harmed by the ongoing loss of consumer trust in technology and

Internet-enabled products and services.

The national debate over consumer privacy has been largely dominated by discussions about the

headline-grabbing missteps of some of the largest Internet companies, but startups stand the most

to lose. If consumers lose trust in the Internet ecosystem, startups without established reputations

and relationships with consumers will be the first products and services abandoned by a wary public.

At the same time, if valid concerns about consumer privacy prompt reactionary policymaking,

startups without the vast legal and budgetary resources of the large technology companies won’t be

able to afford to navigate complex regulatory and legislative landscapes, effectively solidifying the

market power of the very companies that have prompted privacy concerns in the first place. Engine

appreciates NIST’s apparent recognition of this reality with its effort to put the Privacy Framework

in “common and accessible language.” Startups, especially in their early stages, often have limited

budgets to dedicate toward legal resources, and creating additional responsibilities and obligations

that only skilled—and expensive—lawyers understand will ensure that only the companies that can

afford those lawyers will be able to comply.

Engine also appreciates NIST’s goal of making the Privacy Framework “adaptable to many different

organizations, technologies, lifecycle phases, sectors, and uses” and “platform- and

technology-agnostic and customizable.” Startups can traverse sectors, lifecycle phases, and business

models, and no one-size-fits-all approach works for the thousands of small businesses that make up

the U.S. startup ecosystem. A photo editing app, an encrypted messaging service, a cloud storage

system for financial records, and a biometric data password keeper all have different needs,

concerns, and compliance obligations when it comes to consumer data. The Privacy Framework

should not treat them all the same.

Finally, Engine appreciates NIST’s recognition that the Privacy Framework should be developed “in

a manner consistent with its mission to promote U.S. innovation and industrial competitiveness”

while being mindful of how the framework will interplay with policymaking at the state, federal, and

global level. Thanks to the Internet, a small startup anywhere in U.S. can create and grow a business

with users all over the world. As startups expand across state lines and country borders, so too do

their obligations to varying, and sometimes conflicting, regulatory and legislative obligations. The
U.S. startup ecosystem and the innovative products and services it produces are the envy of the

world, and the federal government can work to keep it that way by ensuring that additional privacy

standards, even voluntary ones, can be integrated into existing privacy frameworks.

III. Conclusion

Engine appreciates the opportunity to provide feedback on the questions raised in the RFI. Engine

looks forward to working with NIST to develop a privacy framework that protects users’ privacy

while encouraging innovation and promoting the thriving U.S. startup ecosystem.