Due to the past lack of success of self-regulation in this space, we urge the FTC to rely on a mandatory scheme instead of self-regulation, which has been a proven failure. The World Privacy Forum published a report documenting and analyzing various issues regarding the current self-regulatory regime. [3] Instead of reviewing those issues again here, we incorporate the report in our comments by reference and note that the issues documented in the report are largely continuing. One of the primary concerns we have is that long-term patterns of consumer profiling are being ingrained in online activities, business practices, and business processes.

We have no complaint about legitimate advertising; our complaint is with intrusive and difficult- to-detect (or nearly impossible to detect) profiling of consumers that is part of certain kinds of advertising practices. The laxity and opacity of the current dysfunctional self-regulatory system rewards the worst actors, which has had the result of creating an unappealing and unfortunate race to the bottom among some businesses. Now we have come to the point where we are seeing business models built on inappropriate opacity with concomitant highly intrusive consumer snooping. For example, we note the rise of a model where Internet Service Provider (ISP)-level profiling activities have been launched without sufficient transparency regarding which ISPs are allowing the profiling activities, or regarding consumer notice, among other issues. [4]

We have read the various comments of some industry members stating that regulation or a mandatory scheme in the area of online advertising would break the Internet, or somehow restrict or reduce large quantities of compelling content that are currently free to consumers based on advertising support. Again, advertising is not the problem. It is the deep and detailed profiling of consumers that is the problem.

We believe that a much-improved balance may be found in the area of online and other forms of digital advertising. Advertising accompanied by good practices and respect for consumers and their privacy is more than welcome. A better balance will allow advertisers the freedom of commercial speech, and will allow continued support of free content while still providing for the protection of consumers in an area currently lacking in fair play and characterized by uneven, even absent enforcement.

The importance of simplifying and unifying enforcement in a fractured market

In the past decade, advertising technologies have become much more sophisticated and the targeting of consumers is more refined. It is no surprise, then, that the corresponding business models built in part or in whole on these technologies are in flux, which creates a certain amount of policy “churn.” A good example comes from newer entrants to the marketplace that profile consumers at the ISP level. [5]

While the NAI has been the primary centralized entity that manages various aspects of the current self-regulatory regime to date, other self-regulatory regimes exist. It is not unlikely that additional new regimes will appear on the horizon and gain momentum. While the display of interest in self-regulation by industry is welcome, having multiple self-regulatory frameworks creates enforcement challenges, among other practical issues such as the temptation to comply with the weakest self-regulatory regime. We want to avoid a race to the bottom.

The FTC should enforce any self-regulatory scheme directly

Direct enforcement by the FTC of a mandatory scheme and direct FTC collection of consumer complaints is the only realistic way of encouraging a single, simplified enforcement framework and a unified enforcement mechanism applicable to all players. It is crucial that enforcement does not become a victim of a patchwork quilt of self- regulatory efforts, which could compete with each other in unproductive ways and potentially contribute to lax or missing enforcement.

The World Privacy Forum urges the FTC to move any enforcement of mandatory or self- regulatory principles to the FTC directly, and to make each company directly responsible for its own actions under FTC Act §5. This will accomplish many productive goals, including accommodating rapid changes in technology, a variety of business models, and the variety of platforms (web, mobile web, email, and so on), that are extant. There is no reason that any company acting in the best interests of consumers should have a problem with this shift in enforcement.

III. Request for a Separate Rulemaking Regarding Sensitive Medical Information

The World Privacy Forum respectfully requests a separate and formal rulemaking procedure regarding what constitutes sensitive medical information. Medical information is a complex topic area with non-trivial regulatory overlaps with HIPAA and with FDA oversight. [6]

Current efforts underway at the Department of Health and Human Services and elsewhere focusing on electronic medical information need to be played out without premature intrusion by network advertisers that do not understand the complexity of the health care field and its regulatory structure, and do not understand the breadth of the negative impact an improper definition of this can have on consumers.

There is a risk that a rush toward advertising using medical records or other health care information will fatally undermine consumer willingness to adopt greater use of information technology for medical information. See the recent World Privacy Forum report, Personal Health Records: Why Many PHRs Threaten Privacy. [7]

To list just a very small selection of ongoing activities:

• The Secretary’s Advisory Committee on Genetics, Health, and Society is currently studying and deliberating on the issue of direct-to-consumer advertising of genetic tests. This Committee has already worked to recommend and facilitate the publication of a key joint FTC – CDC – FDA consumer alert about advertisements containing misleading claims regarding direct-to-consumer genetic tests, At Home Genetic Tests: A Healthy Dose of Skepticism May be the Best Prescription. [8]

In its most recent draft report on this issue from winter 2007, the SACGHS notes:

Direct-to-consumer advertising of genetic tests and consumer-initiated genetic testing have the potential for adverse patient outcomes and cost implications for the healthcare system. There is a gap in knowledge concerning the extent of this impact. SACGHS recommends an examination of these issues:

Some suggest that a search query does not reveal a health status. Search queries cannot be evaluated fairly in isolation. As the AOL data breach made painfully clear, a collection of queries can be quite revelatory. So much so, in fact, that in regards to the AOL data breach, anonymous AOL searchers were able to be identified by name using their search queries alone. Given that searches can take place on many types of web sites and may even be embedded in certain applications, the collection of sensitive medical information in these and other online contexts poses significant threats to uninformed consumers.

After consumers’ medical information has been collected, the proverbial Pandora has left her box, and mischief in uses of the information can occur with little or no recourse or oversight. Most, if not all, of the medical information disclosed or inferred is available under current law for use and redisclosure without limit.

Companies with a strong commercial interest in maximizing advertising dollars should not be the sole deciders about what constitutes medically sensitive information. There is a significant array of other interests in the health care sector including clinicians, vendors, payers, providers, patient groups, and other key players. All will want to and deserve to weigh in on what constitutes medically sensitive data, and it is important that all stakeholders should have the opportunity to do so.

A number of serious, deliberative regional and national processes are already underway looking at electronic medical information. The World Privacy Forum strongly encourages the FTC to conduct an entirely separate rulemaking on this matter, one which incorporates much more input from the private health care sector, the public health care sector, including HHS, CMS, and others, and draws from a much broader set of business and interest groups. To do less than this will jeopardize the policy work being done right now in this area.

It is unlikely that a definitive agreement could be reached on collection and use of medically sensitive data if the definition is not set. However, that being said, the World Privacy Forum notes that some information, such as information on genetically-linked diseases which have the potential for impact on blood relatives beyond the individual making the initial data disclosure, should not be collected at all.

IV. Comments on the Scope of the Proposed Principles

The World Privacy Forum believes that the proposed principles provide a starting place, but do not provide a complete protective scheme for consumers. We request that the principles be expanded to incorporate the full cohort of Fair Information Practices as articulated by the OECD. We know that the FTC is aware that the eight principles of Fair Information Practices are acknowledged nearly world wide, and we will not repeat the entire set of FIPs here.

However, we note that consumer access to all data being held about them by companies, correction rights, purpose specification, collection limitation, and the rest of the FIPs are all highly relevant to behavioral advertising and should all be included in any future set of principles.

V. Request for a Consumer Advisory Board

The World Privacy Forum requests that the FTC convene an independent consumer advisory board tasked with a focus on behavioral advertising. The consumer board should include consumer representatives from national, state, and local non-profit groups, representatives from privacy-focused non-profit groups, state representatives from either consumer protection bureaus or representatives of state Attorneys General offices, and neutral technical experts who have privacy and security technical-side expertise but who do not have a financial stake in the outcome.

The board should receive detailed reports from regulated companies regarding compliance for review, and should be able to hold formal or informal hearings or sessions where they can learn more about various topics of interest and applicability.

One of the functions of the board should be to assist in keeping any scheme up to date with current trends, and to provide a means of communicating to the public regarding various issues in this arena.

VI. Request for Increased Specificity

It will be difficult to move forward with any scheme without a precise definition of what constitutes personally identifiable information, behavioral targeting, and so forth. Without precise definitions, it will be too easy for industry players to bend or ignore the rules.

Regarding the definition of personally identifiable information, the World Privacy Forum supports the definition arrived at by a consensus of consumer groups in 2007:

Personally Identifiable Information — Personally identifiable information (PII) consists of any information that can, directly or indirectly:

(1) identify an individual, including but not limited to name, address, IP address, SSN and/or other assigned identifier, or a combination of unique or non-unique identifying elements associated with a particular individual or that can be reasonably associated with a particular individual, or

(2) permit a set of behaviors or actions to be consistently associated with a particular individual or computer user, even if the individual or computer user is never identified by name or other individual identifier. Any set of actions and behaviors of an individual, if those actions create a uniquely identified being, is considered PII because the associated behavioral record can have tracking and/or targeting consequences.

Non-Personally Identifiable Information — Non-Personally Identifiable information (Non-PII) is:

(1) aggregated data not associated with any individual or any individual identifier, or

(2) any individual level data that is not PII. [12]

The inclusion of IP address in the definition of personally identifiable information (PII) is important. After hearing from a range of industry and consumer representatives, the EU Article 29 WG has interpreted the EU Data Privacy Directive as including IP address in the definition of PII. IP addresses are already being used and are likely to become the tracking tool of choice for advertisers and behavioral trackers.

It is an important decision which highlights the need to recognize at a regulatory level the increased identifiability of information that was previously regarded as aggregate or non- identifiable. This is just one part of a larger trend toward increased indentifiability or targeting of individuals, a topic that needs further exploration in the context of behavioral advertising. [13]

Although this kind of approach represents a modulation of the FTC’s current approach, we request that the FTC consider newer ways of approaching these complex and challenging issues. We do not believe a pure harm-based approach will be a sure enough guide in this area, and the stakes are too high for failure.

Comments on Specific Proposed Principles

VIII. Comments on Principle 1: Transparency and Consumer Control

The World Privacy Forum supports this principle in the broadest sense. We have additional suggestions to refine the principle.

The World Privacy Forum supports privacy policies. We believe they are crucially important for both businesses and consumers for a number of very good reasons. Any regime the FTC considers should require a disclosure of privacy policy. However, we also acknowledge that despite their importance and utility, privacy policies are problematic when used as the sole vehicle for consumer notice.

Minimum disclosure data sets for policies

Given the complexity of this field and the opacity of the language industry sometimes uses to describe fairly invasive data collection practices, we believe a privacy notice should have a bare minimum standard that is met, and this standard should be consistently applied across all business models. We suggest the adoption of minimum disclosure data sets to assist in this.

The idea is that a minimum disclosure data set will set a baseline standard of disclosure across the regulated industry. The data set will allow for a flexible yet standardized approach that allows consumers the ability to more easily and readily comprehend and compare actual practices of companies. This will go far to correct the hazy language currently extant in some of the privacy policies of behavioral marketers. It will also serve to reward companies who are attempting to be good actors and working to protect consumer privacy. To date, an effective consumer tool for privacy comparison has been lacking in this space.

Minimum disclosure data sets should contain the following mandatory elements:

• Disclosure of all entities collecting data at a web site, portal, or other relevant digital medium: This should be inclusive of Web 2.0 materials, which can have embedded applications and interactions from third parties. If data is being collected, then the collection should be disclosed.
• Disclosure of what data is being collected: There needs to be a precise disclosure of what is being collected from consumers.
• Disclosure of the why the data is being collected: For what purpose will the data be used? Will the data be used to determine a price point for an item, or interest on a line of credit? This needs to be disclosed to the consumer, so as to allow consumers who have received offers based on profiling activities to find the best possible offer or to request the best possible price available, regardless of profile, geography, or other factors.
• Disclosure of what other businesses or entities will be using or receiving the data: One of the difficulties with many current behavioral advertising policies is that the policies describe secondary data use in glowing but nebulous terms such as “business partners,” “marketing partners,” and so on. Businesses need to disclose what other businesses are getting the data.

The importance of consumer access in transparency and consumer control

Transparency will be greatly assisted by meaningful, complete consumer access to data held on them by companies. The EU Article 29 WG decision regarding search engines interprets the EU data protection directive as granting consumer access to all profiling information held on consumers by search engines, including data merged with other profiling data.

In discussions of the topic of consumer access to data companies hold on them, companies usually object strenuously without addressing the interests of consumers whose profiles they maintain. We see no fundamental difference in the need for transparency of behavioral profiles and credit reports. Both influence how consumers are treated in the marketplace.

If decisions about a consumer are being made based on a profile, then consumers need to know what the contents of that profile are should they desire to see it.

The importance of transparency regarding collection technologies and methods

In our report on the failure of the current self-regulatory scheme, we noted that Flash cookies, Silverlight cookies, and other mechanisms exist to circumvent current technological-based means of opting-out. [15] Those mechanisms still exist, and more will follow. Any means in use of collecting information from consumers needs to be readily transparent to that consumer.

IX. Comments on Principle 2: Security and Data Retention.

Regarding data retention, we urge the FTC to indicate a specified duration of time for data retention, which should not exceed six months. We have heard the industry arguments regarding the need for longer data retention periods, but they make little sense. At present, there is a lack of balance between consumer interests and industry interests in this area. Shorter retention periods will restore some of the needed balance in favor of consumers.

X. Comments on Principle 3: Affirmative express consent for material changes to existing privacy promises.

The World Privacy Forum supports this principle strongly. One of the salient weaknesses with privacy policies as a consumer protection mechanism is the ability of a company to change the policy in the blink of an eye. We agree, however, with the FTC that there are good reasons that businesses may have to occasionally update and change a privacy policy. This proposed principle is balanced between consumers’ interests in reliable protection and business’ interests in flexibility.

The only comment we offer is in regard to consent and withdrawal of consent. We are aware that the FTC is familiar with the myriad problems of consent, particularly as mediated electronically, through its enforcement of the Fair Credit Reporting Act (FCRA). In light of the mischief that can occur around consumer consent, we urge the FTC to spell out specific guidelines regarding consent.

The situation we want to avoid is the proverbial pre-checked box at the bottom of an email or web page, or any other consent mechanism that is vague, confusing, misleading, not readily visible, or leads the consumer to a predetermined course of action toward consent without having adequate or fully accurate facts. We also are disinclined to accept as meeting the definition of express consumer consent a mere statement of consent on a privacy policy, eg, “if you use this web site, you have consented to …”

We also request that the FTC incorporate the right for consumers to withdraw their consent. This right can be implemented in the electronic medium, as we have seen with the implementation of the FCRA. There is no reason that consumers cannot be offered the ability to withdraw consent. A consumer should be able to formally withdraw consent using a comparable mechanism that was used to obtain the consent in the first place. Neither consent nor withdrawal of consent should be mediated through a cookie.

We reiterate that in particular, the definition of medically sensitive data needs a separate and formal rulemaking process that is much more deliberative, involves significantly more stakeholders from the public and private aspects of the health care sector, and takes into account the deliberative activities taking place on this very issue at other agencies.

What constitutes express consent?

We offer a comment about collection of sensitive information with consumer consent. We reiterate our concerns about what constitutes express consent, discussed elsewhere in these comments. We are concerned that consent will be nothing more than a click- through that most consumers do not notice. In matters of sensitive information where there is the potential for life-consequences, express consent needs to be carefully and clearly defined, and should be mandatory, not voluntary.

Trafficking in consent

There should be express prohibitions of trafficking in consumer consent where one company acquires consent and then transfers the consent to others (subsidiaries, affiliates, or others).

The issue of disallowing certain data collections

The FTC asked whether or not sensitive data should not be used at all for behavioral targeting. If data is determined to be in a sensitive category, then it should be unavailable for any kind of targeting due to the significant concerns it raises and the high potential for life-impacts the secondary uses of the data could pose. We believe curtailing use after collection is not realistic, and therefore we side with not collecting it in the first place.

We reserve a final decision about what constitutes medically sensitive information until more information and facts are brought forward, with the exception of genetically linked disease, which is a category we believe should not be collected at all due to the high risk potential and due to the fact that blood relatives can be implicated as well as the consumer.

XII. Comments regarding “Next Steps: Request for Comment”

The FTC asked for comment on costs and benefits for offering choice for behavioral advertising. We find in reviewing the harms that have already come to consumers in the area, for example, of fraudulent weight loss advertising, and the potential for harms that can come to consumers in the area of genetically linked profiling and tracking, that the benefits outweigh the perceived costs to an extraordinary degree. If the experience of weight loss advertising is replicated only in part with a broader set of consumer products and services, the losses to consumers could be staggering and could outweigh any legitimate commercial benefits.