FTC Sees Some Potential Problems With FCC Privacy Rules

Comments on the FCC’s privacy NPRM were due at the agency Friday, and weren't expected to result in major changes in the final rules (see 1605270022). The FCC by our deadline already had logged more than 53,000 comments in docket 16-106, most of them only a few sentences. CTA also objected, calling the proposed rules “onerous and prescriptive.”

The FTC found some areas of concern with the proposed rules. For example, the FTC said an FCC proposal to include any data that is “linkable” under the definition of “personally identifiable information” could unnecessarily limit the use of data that isn't a risk to consumers. “While almost any piece of data could be linked to a consumer, it is appropriate to consider whether such a link is practical or likely in light of current technology,” the FTC said.

The FTC also questioned aspects of FCC-proposed “opt-in” requirements, requiring broadband customers to opt-in to some use of data. The NPRM “proposes to distinguish between first-party and affiliate marketing of communications-related services on the one hand, and other first-party uses and sharing with third parties on the other,” the FTC said. “It creates a bright line for industry to follow, which may facilitate compliance and law enforcement.”

There are disadvantages to the FCC approach, the FTC said. “This approach does not reflect the different expectations and concerns that consumers have for sensitive and non-sensitive data,” it said. “It could hamper beneficial uses of data that consumers may prefer, while failing to protect against practices that are more likely to be unwanted and potentially harmful. For example, consumers may prefer to hear about new innovative products offered by their [ISPs], but may expect protection against having their sensitive information used for this or any other purpose.” The FCC should consider the FTC’s long-standing approach that “calls for the level of choice to be tied to the sensitivity of data and the highly personalized nature of consumers’ communications in determining the best way to protect consumers,” the agency said.

“The NPRM is a draconian approach to privacy that imposes a sweeping opt-in consent requirement for using customer information to market anything beyond a very narrow category of communications-related services offered by an ISP and its corporate affiliates,” Tribe said in the study. “The proposed new rules could prohibit an ISP from using information about its own customer (including non-sensitive information) to offer a discounted bundle of its own services to that customer or to offer accessories that are compatible with her devices without her prior opt-in consent.”

The proposed rules are counter to “fundamental First Amendment limits on the Commission’s authority to regulate customer information,” Tribe wrote. He questioned whether they would survive a court challenge based on other First Amendment cases decided by the Supreme Court. “At minimum, they raise a host of grave constitutional questions and should not be adopted,” he said.

USTelecom separately filed a comment by ex-FTC Commissioner Joshua Wright that also takes the FCC to task, on economic grounds. Wright is a lawyer and economist, and works at Wilson Sonsini. The FCC’s “one-size-fits-all regulatory regime is not calibrated to the sensitivity of consumer data or to the potentiality for a given use to result in consumer harm,” Wright wrote. The proposed rules ignore “the multi-sided nature of the market” and don’t consider the “economic costs and benefits affecting consumers, ISPs, and innovation,” he said. Consumers would pay higher prices for broadband and “there would be a greater rate of irrelevant and inefficient advertising, and reduced innovation and experimentation in the online ecosystem,” Wright said.

CTIA said the rules will do little to protect consumers. The proposed rules “fail to account for the sensitivity of data and the need for companies to adapt to changing technologies and consumer expectations,” it said. “The proposed rules will harm competition in the digital advertising market, by placing ISPs, who are new entrants to this market, at a competitive disadvantage.”

CTA questioned why the FCC is moving forward on tough rules that apply only to ISPs. “This proposed departure from the consistent framework that governs the entire Internet ecosystem will directly harm consumers, undermine their trust in the Internet ecosystem, and stifle innovation, and will do so without a corresponding benefit to consumer privacy,” CTA commented. "The proposal is not just bad law -- it is also bad policy."

FCC proposals “exceed the Commission’s statutory authority, are overbroad, and would undermine and supersede the time-tested, balanced and demonstrably effective privacy protection regime created and enforced by the far more experienced FTC,” ITTA said. The rules are far stricter than others in place elsewhere in the U.S., ITTA said. The group said that the NPRM “does not consider its practical consequences on the providers who will have to comply, under shortened deadlines, or on consumers who will be bombarded with notifications, consent requests and ‘breach’ notices for information that those consumers may regard as trivial and/or unintelligible.”

“Instead of pursuing its ill-advised proposal, the Commission should work towards harmonizing the FCC rules with the FTC’s proven approach,” Mobile Future said.

Net Competition said the regulations would confuse consumers. “The FCC is trying to force-fit inherently-irreconcilable, telephone closed-ecosystem privacy rules into its opposite -- a broadband open-system Internet,” it said in a blog post. “This approach is so convoluted and confusing there is no way for an average consumer to understand what part of their privacy is or is not now protected by the FCC and what part is or is not protected by the FTC.”