On the heels of its recent settlement with Verizon over the carrier’s targeted digital advertising tactics, the FCC is proposing new privacy rules that would make Internet service providers – including cable and phone companies – seek permission from users before sharing their personal data with advertisers.
The rules proposed by FCC Chairman Tom Wheeler on Thursday would separate the use and sharing of consumer information into three categories – inherent consent, opt-out and opt-in – and outline the transparency, choice and security requirements for each.
What’s in the proposed rules?
Under Wheeler’s proposal, consumers would give inherent consent to service providers upon the initiation of a customer relationship to use their personal data to provide broadband services and marketing related to the type of broadband service received. So, for example, service providers can use customer data to bill for the use of their services, ensure emails are sent to their proper destinations and to suggest service upgrades.
In the second information category, the proposal would also allow providers to use customer data to market other communications-related services and share that information with their affiliates to market the same unless the consumer specifically opts out.
All other uses and sharing of consumer data would require specific “opt-in” consent from consumers, according to the proposal.
The proposal would also require providers to safeguard customer information from unauthorized use or disclosure and adopt risk management practices, including personnel training and strong authentication requirements.
Additionally, the proposal would institute new data breach notification standards that would require providers to notify impacted customers within 10 days of the breach discovery, the FCC within seven days of discovery and the FBI and U.S. Secret service within seven days of discovery in instances affecting more than 5,000 customers.
The rules would apply to those, like Verizon, AT&T and Comcast, who provide Internet access to consumers, but not to companies, like Facebook and Google, that operate on the Internet itself.
In a Thursday op-ed in the Huffington Post, Wheeler touted the proposal as another step in the right direction for transparency and consumer choice.
“This isn’t about prohibition; it’s about permission,” Wheeler wrote. “Simply by using the Internet, you have no choice but to share large amounts of personal information with your broadband provider…That’s why establishing baseline privacy standards for ISPs is a common sense idea whose time has come. The bottom line is that it’s your data. How it’s used and shared should be your choice.”
Industry reaction
Carriers and industry groups on Thursday pushed back against the proposed rules, arguing the FCC is overstepping its bounds and stepping into Federal Trade Commission (FTC) territory.
“It is unfortunate that privacy activists have successfully convinced the FCC to ignore the benefits of FTC privacy oversight,” Information Technology and Innovation Foundation (ITIF) telecommunications policy analyst Doug Brake said in a statement. “The greater flexibility under the FTC enforcement framework allows room for new business models that could support expensive, next generation networks with revenue other than consumers’ monthly bills. Instead, this vocal minority, who places a much higher price on their privacy than the average consumer, seeks to foreclose on the current balance of privacy with other important values.”
In a nearly prescient post on AT&T’s Public Policy Blog on Wednesday (which came in response to the aforementioned Verizon settlement), Senior Vice President of Federal Regulatory Bob Quinn said increased privacy rules from the FCC would be superfluous in light of the “active and aggressive” enforcement of consumer protections from the FTC. Additionally, Quinn said, such rules would add to the burden that has already been placed on providers but leave Internet companies unencumbered.
“Limiting ISPs’ ability to compete with ad supported business models – which are overwhelmingly favored by consumers – is bad for consumers and ultimately bad for broadband investment in this country,” Quinn wrote. “But time and time again, the FCC appears to want to place its thumb on the scale in favor of Internet companies and against the companies that invest in broadband infrastructure in this country.”
But the reaction spectrum wasn’t all doom and gloom – at least not from consumer groups and privacy advocates.
Consumer Action director of national priorities Linda Sherry on Thursday released a statement applauding Wheeler’s introduction of the proposal, saying the new rules would “ensure that consumers who sign up for broadband don’t have to sign away their rights to privacy.”
Wheeler’s proposal will go before the full Commission for a vote on March 31. If adopted, the proposal will then be opened up for a period of public comment.
Filed Under: Industry regulations