Public Comments: WPF comments on proposed revised consent decree re: Uber; requests FTC to hold workshop to determine standards for privacy assessments
In comments to the FTC regarding a proposed revised consent decree with Uber Technologies, Inc., WPF urged the FTC to clarify what the term “assessment” means in the context of a consent decree with a company. The comments note that the requirement for an assessment is not the same as the requirement for an audit. WPF requested that the FTC clarify its use of the term.
Further, WPF requested the FTC to establish formal standards for privacy assessments.
We wrote:
We request that the Commission establish formal standards for privacy assessments. It would be useful if the Commission held a public workshop on the subject of privacy assessments, with a goal of developing a staff report on the standards, content, and procedures for privacy assessments. There is also a need for clear rules governing the public disclosure of privacy assessments (or audits) mandated by the Commission.
FTC consent decrees with companies are particularly important to ensure improved data protection for consumers. If assessments are the vehicle to ensure compliance, then those assessments need known and clearly defined standards.