World Wide Web Consortium (W3C) stakeholders should consider building short-term...

Stakeholders at the W3C should “consider whether after a short time frame, let’s say 30 days for instance,” companies should be required to render data unlinkable to individuals or devices “or to delete it altogether,” Brill said. “The FTC has always noted the importance of data minimization as a way to enhance data security,” Brill said. “Retention periods … promote good data security practices,” she said as one rationale for adopting them. “Second, appropriate retention periods will provide consumers with the certainty that their data will not be maintained indefinitely until companies can figure out how to monetize it,” she said. That in turn will help build trust between the industry and consumers, she said. The FTC recognizes that certain constituencies need exemptions from W3C privacy policies for security, fraud prevention and frequency capping -- limiting how many times the same person sees the same ad -- purposes, Brill said. But other W3C stakeholders have called for other exemptions for market research and product improvement purposes, she said. If allowed, such exemptions need to be clearly defined, she said. “We need to make sure these permitted usages are not given such broad meaning that they become exceptions that swallow the rule,” she said. “The advertising networks are the only ones who can make the case for such use. Without input from them, it will be hard to see how such uses can be justified when a consumer has opted out of tracking,” she said. It’s important these sorts of issues get resolved, Brill said. “So much progress has been made, and so much hard work [has gone] into this … it would be a shame if all that progress was wasted by an inability to resolve these remaining issues,” Brill said. “It wouldn’t benefit the industry and it wouldn’t benefit consumers.” Beyond the agency’s Do Not Track efforts, which involve limiting the ability of third-parties to track a person’s Internet usage across websites or applications, Brill said she has some concerns about the amount of personal information companies are collecting directly from users. “I do have concerns when the vast amount of information is used for purposes that either fit squarely within purposes that we as a society have said consumers ought to have heightened protections” for, or for purposes that fall close to those areas, such as employment, credit and housing, she said.