Privacy by Design

Today, Senators John Kerry and John McCain introduced the much-anticipated “Commercial Privacy Bill of Rights Act of 2011,” a bill that would require businesses that collect, use, store or transfer consumer information to implement strong privacy protections in the development of their products and to provide consumers with meaningful choices about how their data is collected, used, and shared. 

As its name suggests, the bill is structured around a set of consumer “rights,” including:

  • The right to security and accountability, which the legislation would protect by authorizing the FTC to require strong data protections and the implementation of “privacy by design” by all companies;
  • The right to notice and individual participation, which would be protected by authorizing the FTC to make rules requiring clear and concise notice of privacy practices (and material changes to those practices) and providing consumers with choices about the ways in which their data is collected, used, and shared; and
  • The rights to data minimization, constraints on distribution, and data integrity, which the bill would protect by imposing limitations on the amount of information a company may collect, the period of time such information may be retained, and on the uses of information transfered by one company to another. 

Continue Reading “Commercial Privacy Bill of Rights Act” Introduced in Senate

Two of the country’s largest video rental services, Netflix and Redbox, have been sued for allegedly violating the federal Video Privacy Protection Act (“VPPA”).  The plaintiffs in both suits contend that the rental services stored information about their rental histories for long after that information had ceased being “necessary” to provide the services for which customers had signed up, in violation of the VPPA.  The Netflix complaint also alleges that the company unlawfully maintained the information even after customers had cancelled subscriptions to the service.

One central issue in both cases will be the question of the point at which information collected by a company is “no longer necessary for the purpose for which it was collected” — specifically, with respect to Netflix, whether it was reasonable for it to retain subscriber information after cancellation of the service.  

The answer to this question about the substantive requirements of the VPPA may also have ramifications beyond the law of video privacy.  As we have previously detailed, the FTC’s recent staff report on consumer privacy recommended that businesses do more to incorporate substantive privacy protections at every stage of a product’s lifecycle.  The FTC, which characterized this approach as “privacy by design,” stressed the importance of limited data retention.Continue Reading Netflix, Redbox Sued for Allegedly Violating Renters’ Privacy

On the heels of last week’s release of a proposed consumer privacy report by the FTC, a group of businesses that track online behavior announced that they will give consumers access to information collected about their interests.  The Open Data Partnership will also allow consumers to edit this online profile information. …

Continue Reading Open Data Partnership Will Give Consumers Access To Online Profiles

The FTC today released its long-anticipated privacy report, “Protecting Consumer Privacy in an Era of Rapid Change.”  The report proposes a new privacy framework that would apply broadly to online and offline commercial entities that collect, maintain, share, or otherwise use consumer data that can be reasonably linked…

Continue Reading FTC Announces Proposed Framework for Regulating Consumer Privacy