[powerpress]

In this podcast, we talk with Howard Waltzman of the 21st Century Privacy Coalition on what the Congressional Resolution of Disapproval means for the present and future of Internet privacy regulation. While the debate over the resolution is often framed as a battle between ISPs and the rest of the Internet, in reality the resolution was strongly supported by edge service providers and advertisers. Internet advertising and marketing depend on access to personal preference data, and in turn advertising pays for most of the “free” services we enjoy on the Internet today.

Waltzman’s key points:

• For the first 20 years of the Internet, the Federal Trade Commission had oversight over the online activities of all participants in the Internet ecosystem… but the FCC stripped the FTC of that authority in early 2015 when they classified ISPs as common carriers.
• The FCC was explicit in the Open Internet Order that ISPs would be subject to Section 222 of the Communications Act which governs the privacy practices of telecommunications carriers. They said they would issue rules…which proved to be controversial.
• The FTC filed very detailed comments explaining a number of significant concerns with the FCC’s approach to privacy…The FCC’s final rules did not address the modifications sought by the FTC.
• The FTC’s approach takes into account both the sensitivity of the information and the consumer’s relationship with the business. The FCC blew up both of those approaches.
• The FCC’s approach – treating sports scores and weather updates as if they’re as sensitive as health and financial information – ignores reality.
• Putting consumers further away from innovative new services is very anti-consumer.
• We’d like to see a uniform, unified system for online privacy protection that takes into account the sensitivity of the data being collected rather that who collects it.
• Peter Swire – Clinton’s Internet czar who was brought in by President Obama to tackle Internet surveillance post-Snowden– put out a detailed paper explaining why ISPs don’t have a unique or comprehensive insight into consumers’ online habits.
• The reason the Internet is a great, mostly free environment is that it’s mostly an advertising-supported environment. The idea that the ISPs could do something that’s not being done already begs for a lot of education.
• It wasn’t just ISPs who supported the resolution of disapproval, it was the entire Internet ecosystem – it was edge providers, it was advertisers, it was everyone who is a part of this great successful medium who said the approach the FCC wanted to take would really break the Internet.
• We should absolutely be focusing on data security as well as privacy expectations. All companies should take steps to protect the security of collected data holistically in a comprehensive way.
• The FCC’s rules on data security didn’t recognize an encryption exemption for stored data. The FCC simply lacks expertise on privacy and security and that was evidenced in how flawed their rules were.

The Trouble with the FCC’s Privacy Rules

As we’ve said here before, many regard the FCC’s privacy rules as an attempt to extend its authority over the entire Internet in order to put an end to the data collection and analysis activities that currently fund most of the Internet. This is quite a trick since the FCC only has jurisdiction over carriers, who do very little – if any – data collection and ad placement today.

The plan – if this view is correct – is to impose severe restrictions on data collection by ISPs in the hope that the FTC would follow the FCC’s lead and impose more severe limits on data collection by the edge services and tracker networks that probably account for more than 99% of advertising and marketing-related data collection today.

This is a “tail wagging the dog” scenario. Even if it were successful, it’s probable that its results would be disastrous: more ads on the Internet, most junk ads on the Internet, and less revenue to support new ventures.

The FCC is Not an Expert on Advertising

Whether this scenario accurate or not, the history of the privacy regulations shows that the FCC lacks significant expertise with the advertising market. Sensitivity is important in meaningful data collection regulations, but the FCC disregarded it.

The FTC privacy framework has always recognized that data collection rules have to be framed in terms of the relationships between consumers and businesses as well as with respect to sensitivity. The success of the advertising-based business model is evident in the rich set of services the Internet offers to consumers.

Claiming to be pro-consumer as the FCC did in drafting regulations that are almost certain to choke off revenue to services valued by consumers is a serious disconnect. The Internet is only able to provide the services it does because of the revenue raised by advertisers.

It’s quite fortunate that the Agency gets a second bite at the apple.