Spatially Speaking
Blog Home All Blogs
Search all posts for:   


View all (210) posts »

Action Alert: FTC Privacy Rules -- Complying with Onerous Federal Regulations

Posted By John Palatiello, Wednesday, February 20, 2013

At the Winter Meeting, I gave a presentation on "Privacy".

In that presentation, I challenged everyone with a homework assignment -- to read the final report of the Federal Trade Commission (FTC), "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations For Businesses and Policymakers,".

When the FTC issued its original draft report for public comment, MAPPS responded and mobilized dozens of individuals and member firms to do the same. The membership took action to the point where an FTC official said the geospatial issue attracted more comments than any other aspect of the Commission’s draft.

The issue was that FTC proposed to protect the privacy of individual citizens’ "sensitive” data, including "precise geolocation data” that included, for example, an address. However, FTC did not define the term "precise geolocation data” and the report recommended that before any firm could collect, store, or use such data, it would be required to "provide prominent disclosures and obtain affirmative express consent before using consumer data in a materially different manner than claimed when the data was collected..."

MAPPS called compliance with requirement "impractical to the point of impossible" for geospatial firms. The proposed regulatory language threatened information that is collected by private firms and government entities to perform E-911 and emergency response management, environmental protection, homeland security, mortgage foreclosure monitoring/early warning systems, master planning, and many other tasks that are conducted by geospatial professionals.

When issuing its final report, FTC only provided a single footnote to address the geospatial community’s concerns. It said, "With respect to use of geolocation data for mapping, surveying or similar purposes, if the data cannot reasonably be linked to a specific consumer, computer, or device, a company collecting or using the data would not need to provide a consumer choice mechanism. Similarly, if a company takes reasonable measures to de-identify smart grid data and takes the other steps outlined above, the company would not be obligated to obtain consent before collecting or using the data.”

MAPPS has been working with allies, such as other geospatial associations in the Coalition of Geospatial Organizations (COGO – and the federal government’s Federal Geographic Data Committee (FGDC – and the National Geospatial Advisory Committee (NGAC - to convince the FTC that it has not adequately addressed the geospatial community’s concerns and has established an untenable standard.

Call to Action

In its final report, the FTC urged the private sector to "accelerate the pace of its self-regulatory measures to implement the Commission’s final privacy framework. Although some companies have excellent privacy and data security practices, industry as a whole must do better.” It went on to offer the following ominous warning, "to the extent that strong privacy codes are developed, the Commission will view adherence to such codes favorably in connection with its law enforcement work. The Commission will also continue to enforce the FTC Act to take action against companies that engage in unfair or deceptive practices, including the failure to abide by self-regulatory programs they join.”

The report also said, "the Commission calls on individual companies, trade associations, and self-regulatory bodies to adopt the principles contained in the final privacy framework, to the extent they have not already done so. For its part, the FTC will focus its policy efforts on the five areas identified (in the report) … vigorously enforce existing laws, work with industry on self-regulation, and continue to target its education efforts on building awareness of existing data collection and use practices and the tools to control them.”

What should we do? Please view my presentation and the full FTC Report.

What are your suggestions for self-regulation? What should be the "privacy code” for MAPPS members? What are the "existing data collection and use practices” in the geospatial profession? Is it practical to "provide prominent disclosures and obtain affirmative express consent before using consumer data in a materially different manner than claimed when the data was collected..."?

Again, while MAPPS fights the FTC regulations, we must prepare to meet the standards the Commission has set so that if our effort to change the Commission’s view is not successful, you the members are in compliance with this federal regulatory requirement and not subject to an enforcement action by the FTC.

If you have comments and suggestions please include them below.


Subscribe to Spatially Speaking

MAPPS members login to the MAPPS website and subscribe to the blog to get the latest alerts! Not a member? Subscribe to our RSS feed.

This post has not been tagged.

Share |
Permalink | Comments (0)