Winter Meeting, I gave a presentation on "Privacy".
In that presentation, I challenged everyone with a homework
assignment -- to read the final report of the Federal Trade Commission (FTC), "Protecting
Consumer Privacy in an Era of Rapid Change: Recommendations For Businesses and
When the FTC issued its original draft report for public comment, MAPPS responded and mobilized dozens of
individuals and member firms to do the same.
The membership took action to the point where an FTC official said the
geospatial issue attracted more comments than any other aspect of the
The issue was that FTC proposed to protect the privacy of
individual citizens’ "sensitive” data, including "precise geolocation data”
that included, for example, an address.
However, FTC did not define the term "precise geolocation data” and the
report recommended that before any firm could collect, store, or use such data,
it would be required to "provide prominent disclosures and obtain affirmative
express consent before using consumer data in a materially different manner
than claimed when the data was collected..."
MAPPS called compliance with requirement "impractical
to the point of impossible" for geospatial firms. The proposed regulatory language threatened
information that is collected by private firms and government entities to
perform E-911 and emergency response management, environmental protection,
homeland security, mortgage foreclosure monitoring/early warning systems,
master planning, and many other tasks that are conducted by geospatial
When issuing its final report, FTC only provided a single
footnote to address the geospatial community’s concerns. It said, "With respect to use of geolocation
data for mapping, surveying or similar purposes, if the data cannot reasonably
be linked to a specific consumer, computer, or device, a company collecting or
using the data would not need to provide a consumer choice mechanism.
Similarly, if a company takes reasonable measures to de-identify smart grid
data and takes the other steps outlined above, the company would not be
obligated to obtain consent before collecting or using the data.”
MAPPS has been working with allies, such as other geospatial
associations in the Coalition of Geospatial Organizations (COGO – www.cogo.pro) and the federal government’s
Federal Geographic Data Committee (FGDC – www.fgdc.gov)
and the National Geospatial Advisory Committee (NGAC - www.fgdc.gov/ngac) to convince the FTC that
it has not adequately addressed the geospatial community’s concerns and has
established an untenable standard.
Call to Action
In its final report, the FTC urged the private sector to "accelerate
the pace of its self-regulatory measures to implement the Commission’s final
privacy framework. Although some companies have excellent privacy and data
security practices, industry as a whole must do better.” It went on to offer the following ominous
warning, "to the extent that strong privacy codes are developed, the Commission
will view adherence to such codes favorably in connection with its law
enforcement work. The Commission will also continue to enforce the FTC Act to
take action against companies that engage in unfair or deceptive practices,
including the failure to abide by self-regulatory programs they join.”
The report also said, "the Commission calls on individual
companies, trade associations, and self-regulatory bodies to adopt the
principles contained in the final privacy framework, to the extent they have
not already done so. For its part, the FTC will focus its policy efforts on the
five areas identified (in the report) … vigorously enforce existing laws, work
with industry on self-regulation, and continue to target its education efforts
on building awareness of existing data collection and use practices and the
tools to control them.”
What should we do? Please view my presentation and the
full FTC Report.
What are your suggestions for self-regulation? What should be the "privacy code” for MAPPS
members? What are the "existing data collection and use practices” in the
geospatial profession? Is it practical
to "provide prominent disclosures and obtain affirmative express consent before
using consumer data in a materially different manner than claimed when the data
Again, while MAPPS fights the FTC regulations, we must
prepare to meet the standards the Commission has set so that if our effort to
change the Commission’s view is not successful, you the members are in
compliance with this federal regulatory requirement and not subject to an enforcement
action by the FTC.
If you have comments and suggestions please include them
Subscribe to Spatially Speaking
MAPPS members login to the MAPPS website and subscribe to the blog to get the latest alerts! Not a member? Subscribe to our RSS feed.