Obama Administration calls for 'Privacy Bill of Rights'

By Cecilia Kang

The Obama administration released recommendations Thursday to better protect consumer privacy on the Internet, creating baseline guidelines for how companies treat user data and emboldening federal agencies to enforce privacy protections.

A consumers' "Privacy Bill of Rights" would create a privacy policy office in the Commerce Department and for the first time would establish clear guidelines for what kind of information can be collected about users and how companies can use the data, a Commerce report says. That framework also gives clearer limitations on data use and would increase audits to hold companies accountable for their practices.

The report, which follows similar guidelines released weeks ago by the Federal Trade Commission, comes amid the growing concerns of lawmakers, consumers and privacy groups that Internet users are increasingly giving more information about their preferences and personal profiles without adequate protections.

"Self-regulation without stronger enforcement is not enough," said Commerce Secretary Gary Locke in a statement. "Today's report is a road map for considering a new framework that is good for consumers and businesses."

At the same time, the agency said it wants input from Web companies and advertisers who have resisted legislation or new rules that would hamper their activity online.

Commerce stopped short of endorsing the FTC's recommended Do Not Track program, which would allow consumers to sign up for browser-based technology so that their activity isn't followed by third parties online.

"There is a constant evolution of profiling and tracking and analysis technology, and we want to make sure tools of development keep up with those technologies," said Daniel Weitzner, associate administrator of policy at Commerce's National Telecommunications and Information Administration.

Commerce recommended privacy codes of conduct for companies that would step up enforcement measures by the FTC and include oversight over emerging technologies. Commerce also called for a privacy policy office within the agency to coordinate policy and protection measures with the FTC and White House.

Locke emphasized that U.S. regulators need to better coordinate their own privacy standards with those of Europe and other nations. The European Union, for example, has implemented laws that prevent companies from collecting certain information about users unless they expressly volunteer that data.

The Commerce Department also recommended updates to electronic privacy laws and a look at whether they should include privacy protection for cloud computing and location-based services. And it proposed a standard framework for how companies notify users of data breaches. Now companies follow their own guidelines for notification, which privacy groups say causes user confusion.

Some privacy advocates touted the report as an important step toward protecting consumers as data collection expands for behavioral advertisers and other businesses while federal agencies have struggled to keep up with those practices in the $10 trillion annual e-commerce industry.

The report calls for public feedback on the recommendations, and legal experts say components would have to be implemented through legislation.

"This is the first time that the administration has emphasized the need for comprehensive privacy protections, and that as of today it is a Wild Wild West out there for consumers and their privacy," said Chris Calabrese, legislative counsel at the ACLU. "We hope it will lead to strong administrative protections but Congress needs to act."

But the Center for Digital Democracy's executive director, Jeffrey Chester, said the report appears to give the advertising industry too much influence. The administration didn't endorse the FTC's Do Not Track mechanism, which has garnered much support by privacy advocates, he said.

"The FTC provides a serious framework in the new staff report, Do Not Track, rules for consumer transparency and control," Chester said. "Commerce has just given the U.S. data collection giants an early Christmas present."

Related story:

FTC recommends Do Not Track program for privacy