Source: http://www.techlawjournal.com/alert/2010/12/05.asp
Timestamp: 2019-04-18 10:47:00+00:00

Document:
TLJ Daily E-Mail Alert No. 2,169, December 5, 2010.
December 5, 2010, Alert No. 2,169.
12/2. The Federal Trade Commission (FTC) released a document [122 pages in PDF] titled "Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers". It proposes, among other things, an online do not track regime.
FTC Chairman Jonathan Leibowitz, a Democratic appointee, praised the document in his statement.
In contrast, FTC Commission Thomas Rosch, a Republican appointee, wrote that "the Report is flawed. ... In short, to the extent that privacy notices have been buried, incomplete, or otherwise ineffective -- and they have been -- the answer is to enhance efforts to enforce the ``notice´´ model, not to replace it with a new framework."
FTC Commissioner William Kovacic, the other Republican appointee, wrote that "I regard some of staff's recommendations -- notably, the proposal for a Do-Not-Track system -- to be premature."
This document proposes a new legal regime. And, it requests comments by January 31, 2011. However, the FTC does not propose any rules, and this is not a notice of proposed rulemaking (NPRM) within the meaning to the Magnuson Moss Warranty Act (which established the procedure to be followed by the FTC in promulgating rules implementing Section 5 of the FTC Act) or the Administrative Procedure Act (APA).
The FTC has no specific statutory mandate to write online privacy rules. The FTC's enforcement activities with respect to online privacy and security to date rest upon Section 5 of the FTC Act, which is codified at 15 U.S.C. § 45. It generally prohibits "unfair or deceptive acts or practices in or affecting commerce".
This proposal states that the FTC's "goal in the privacy arena has remained constant: to protect consumers' personal information and ensure that they have the confidence to take advantage of the many benefits of the ever-changing marketplace. In recent years, the FTC has sought to advance this objective using two primary models: the ``notice-and-choice model,´´ which encourages companies to develop privacy notices describing their information collection and use practices to consumers, so that consumers can make informed choices, and the ``harm-based model,´´ which focuses on protecting consumers from specific harms -- physical security, economic injury, and unwanted intrusions into their daily lives."
It adds that "the notice-and-choice model, as implemented, has led to long, incomprehensible privacy policies that consumers typically do not read, let alone understand. Likewise, the harm-based model has been criticized for failing to recognize a wider range of privacy-related concerns, including reputational harm or the fear of being monitored."
This document proposes, and requests comments on, "a new framework for addressing the commercial use of consumer data" that would apply to both "online and offline commercial entities that collect, maintain, share, or otherwise use consumer data that can be reasonably linked to a specific consumer, computer or device".
Most significantly, this document proposes a "Do Not Track" regime. It states that this would "involve the placement of a persistent setting, similar to a cookie, on the consumer's browser signaling the consumer's choices about being tracked and receiving targeted ads".
The FTC also proposes a consumer access to data mandate. It advocates "providing consumers with reasonable access to the data that companies maintain about them, particularly for companies that do not interact with consumers directly, such as data brokers."
Leibowitz, who worked for a large industry group before his appointment to the FTC, stated that his industry critics on this issue are "highly-paid professional naysayers".
12/2. The House Commerce Committee's (HCC) Subcommittee on Commerce, Trade and Consumer Protection held a hearing titled "Do-Not-Track Legislation: Is Now The Right Time?".
Rep. Bobby Rush (D-IL), the Chairman of the Subcommittee, stated that with a do not track mechanism, "consumers could advise would-be trackers unambiguously and persistently that they do not wish to be followed by digital snoopers and spies across web sites and their various fixed and mobile computing devices". See, opening statement.
Rep. Rush is the sponsor of HR 5777 [LOC | WW], the "Building Effective Strategies To Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards Act" or "BEST PRACTICES Act". For more on this and other bills, see story titled "Pending Privacy Bills" in TLJ Daily E-Mail Alert No. 2,143, October 20, 2010.
See also, prepared testimony of Daniel Weitzner (National Telecommunications and Information Administration), prepared testimony of David Vladeck (Federal Trade Commission), prepared testimony of Susan Grant (Consumer Federation of America), prepared testimony of Joe Pasqua (Symantec), prepared testimony of Joan Gillman (Time Warner Cable), prepared testimony of Eben Moglen (Columbia University), and prepared testimony of Daniel Castro (Information Technology and Innovation Foundation).
The Subcommittee did not hear testimony from the Interactive Advertising Bureau (IAB), or other groups involved in online marketing.
The NTIA's Weitzner wrote that "browser developers provided their users with the means to block and manage cookies in a variety of ways."
He also wrote that "members of the online advertising industry developed common principles about the collection and use of tracking information, and the industry is rolling out a system to help consumers manage their tracking preferences online. To the extent that these tools provide effective protection for individual choices, government properly avoids regulations that would otherwise restrict the flow of information".
He also stated that in light of browsers' cookie blocking function, "greater consumer education about tools already available might be all that is needed. But many users want more nuanced choices. That is, users might be happy to have certain Web sites collect and store some information about browsing habits when it serves the users' interests, but they might want to avoid other tracking or profiling that they consider intrusive or simply of no benefit to them."
He concluded that "the best approach to achieving the important goals motivating the Do-Not-Track concept is through a voluntary, multi-stakeholder process, backed up, in the end, by FTC enforcement of the privacy commitments made to consumers through such a system."
David Vladek, Director of the FTC's Bureau of Consumer Protection, wrote that the FTC supports a legal regime under which "consumers would be able to choose whether to allow the collection and use of data regarding their online searching and browsing activities". He added that this must be an "enforceable requirement". Also, "Such a universal mechanism could be accomplished through legislation or potentially through robust, enforceable self-regulation."
He elaborated that, unlike the do not call regime for phone calls, the do not track regimes would not involved a registry. Rather, there should be a "browser-based mechanism through which consumers could make persistent choices".
He also wrote that the FTC urges the Congress "to consider whether a uniform and comprehensive choice mechanism should include an option that enables consumers to control the types of advertising they want to receive and the types of data they are willing to have collected about them, in addition to providing the option to opt out completely."
He also argued that "industry efforts to implement choice on a widespread basis have fallen short".
And finally, he wrote that if Congress does choose to enact legislation, the FTC wants rulemaking authority under the Administrative Procedure Act (APA).
The Congress has given the FTC APA rulemaking authority on a statute by statute basis. However, its Section 5 rule making process is found in Section 18 of the FTC Act, which is codified at 15 U.S.C. § 57a. Section 18 affords procedural fairness to affected parties, while the APA allows for less open and transparent, and more political and arbitrary, rulemakings. FCC rulemakings, for example, are bound only by the APA.
Grant (CFA) advocated do not track legislation.
Pasqua (Symantec) wrote that "while online privacy and security together are a critical foundation to trust on the Internet, the creation of a Do-Not-Track registry would be unlikely to advance these goals"
Castro (ITIF) wrote that a do not track "mandate would impose unnecessary costs that would ultimately be borne by consumers, result in more intrusive and less relevant advertising for consumers, and, if widely adopted, significantly harm the current funding mechanism for the Internet ecosystem, resulting in less free content and fewer free services online. In short, a Do Not Track requirement would do more harm than good and for that reason ITIF urges the federal government to not go forward with this approach."
12/1. Rep. Doug Lamborn (R-CO), Rep. Tom Price (R-GA), Rep. Roscoe Bartlett (R-MD), and Rep. Trent Franks (R-AZ) introduced HR 6471 [LOC | WW], the "EMP Weapons Accountability Assessment Act", a bill to require the Director of National Intelligence (DNI) to submit a report on the foreign development of electromagnetic pulse (EMP) weapons.
An EMP weapon is a nuclear bomb, detonated at high altitude, and at a great distance from the intended targets, for the purpose of generating a huge electromagnetic pulse that would disrupt or damage unshielded computer systems and other electronics. Such a detonation, to achieve disruption in the US, would not have to take place in the US, or have any degree of accuracy.
The bill provides that the "Director of National Intelligence shall submit to the appropriate congressional committees a report ... on the research, development, testing, and deployment programs of foreign countries relating to -- (A) electromagnetic pulse weapons; (B) delivery systems for EMP weapons; and (C) platforms for carrying EMP weapons delivery systems".
The bill would not require the DNI to study the possible consequences of such an attack upon the US.
The bill was referred to the House Intelligence Committee (HIC). None of the bill's original sponsors are current members.
The bill defines an "electromagnetic pulse weapon" as "an explosive weapon that generates electromagnetic fields that have a high likelihood of damaging electrical power systems, electronics, information systems, and other infrastructure that depends on such systems".
The House Armed Services Committee (HASC) held a hearing on July 10, 2008, on EMP attacks. William Graham, Chair of the Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack, wrote in his prepared testimony that "A high-altitude electromagnetic pulse results from the detonation of a nuclear warhead at altitudes in the range of about 40 to 400 kilometers above the Earth's surface. The immediate effects of EMP are disruption of, and damage to, electronic systems and electrical infrastructure. EMP is not reported in the scientific literature to have direct physiological effects on people."
11/30. The Supreme Court issued its opinion [12 pages in PDF] in County of Los Angeles v. Humphries, a case regarding the consequences of state electronic databases that contain false and damaging. In this opinion, the Supreme Court ruled in favor of the County of Los Angeles on one narrow issue. However, this opinion leaves untouched the Court of Appeals' holding that the state statute violated the due process rights of Craig and Wendy Humphries.
California maintained an electronic database, which the Court of Appeals wrote has a "high error rate", "perhaps as high as fifty percent". A state statute also required certain government agencies (including the County of Los Angeles) and private sector entities to use and rely upon this database. The state provided no recourse to individuals wrongfully listed in this database. They were allowed no opportunity to have their information corrected.
The Humphries filed a complaint in U.S. District Court (CDCal) against the County of Los Angeles, and various county and state officials, alleging, among other things, violation of 42 U.S.C. § 1983, asserting violation of the due process clause of the 14th Amendment. They sought declaratory and injunctive relief, and damages.
Section 1983 provides a federal cause of action against states for violation of Constitutional rights. It provides, in part, that "Every person who, under color of any statute, ordinance, regulation, custom, or usage, of any State or Territory or the District of Columbia, subjects, or causes to be subjected, any citizen of the United States or other person within the jurisdiction thereof to the deprivation of any rights, privileges, or immunities secured by the Constitution and laws, shall be liable to the party injured in an action at law, suit in equity, or other proper proceeding for redress ...".
The District Court granted summary judgment to the defendants. The Court of Appeals reversed.
The Court of Appeals held in its January 15, 2009 opinion [53 pages in PDF] that when the government creates and maintains an electronic database with individually identifiable information, and also mandates that various government and private sector parties access and rely upon information in this database in issuing licenses, permitting employment, or allowing the exercise of certain rights, then the individuals listed in that database have a due process right to challenge information in that database. See also, story titled "9th Circuit Holds Government Database With No Redress Process Violates Due Process" in TLJ Daily E-Mail Alert No. 1,895, February 9, 2009.
The just released Supreme Court opinion does not reverse the holding that the state statute is unconstitutional. Rather, the Supreme Court addressed the narrow issue of the liability of the County of Los Angeles under 42 U.S.C. § 1983 to pay attorneys fees to the plaintiffs. The Court of Appeals order it to pay $60,000. The Supreme Court reversed and remanded.
However, it is the prospect of financial liability that incents states respect the Constitutional rights of individuals.
This case is County of Los Angeles, et al. v. Craig and Wendy Humphries, Supreme Court of the U.S., Sup. Ct. No. 09–350, a petition for writ of certiorari to the U.S. Court of Appeals for the 9th Circuit, App. Ct. No. 05-56467. The Court of Appeals heard an appeal from the U.S. District Court for the Central District of California, D.C. No. CV-03-00697-JVS, Judge James Selna presiding. Judge Jay Bybee wrote the opinion of the Court of Appeals, in which Judges Milan Smith and Richard Mills (USDC/CDIL) joined.
See also story titled "Courts of Appeals Address Reliance Upon Government Databases" in TLJ Daily E-Mail Alert No. 1,926, April 14, 2009.
12/3. The U.S. Court of Appeals (DCCir) issued its opinion in Kristin Brooks Hope Center v. FCC, holding that the Federal Communications Commission (FCC) acted arbitrarily and capriciously when it reassigned the petitioners toll free hotline numbers to another entity. The Court of Appeals vacated and remanded. This case is Kristin Brooks Hope Center v. FCC and USA, U.S. Court of Appeals for the District of Columbia, App. Ct. No. 09-1310, an petition for review of a final order of the FCC. Judge Williams wrote the opinion of the Court of Appeals, in which Judges Henderson and Randolph joined.
12/3. The Republican Business Council (RBC) wrote in a letter to House Republicans that it endorses Rep. Cliff Stearns (R-FL) to be the Chairman of the House Commerce Committee (HCC) in the 112th Congress. The RBC is based in Rep. Stearns' district.
11/30. Rep. Joe Barton (R-TX), who also wants to be Chairman of the House Commerce Committee (HCC), issued a release touting his ties to the Tea Party.

References: § 45
 § 57
 v. 
 § 1983
 § 1983
 v. 
 v. 
 v.