Publishings

We the undersigned privacy scholars support the proposal of the Federal Communications Commission to apply and adapt the Communications Act’s Title II consumer protection provisions to broadband internet access services. We commend the Commission’s much-needed efforts to carry out its statutory obligation and to protect the privacy of broadband internet access customers. We agree with the Commission’s proposal and affirm the importance of giving consumers effective notice and control over their personal information by strengthening consumer choice, transparency and data security. In particular, we support the Commission’s proposal to require affirmative consent (opt-in) for use and sharing of customer data for purposes unrelated to providing communications services. As scholars who have studied, researched, taught, and thought about privacy in depth from a variety of perspectives, we believe it is important that Americans have their privacy protected as they access, use and reap the benefits of the internet, the most fundamental communications network of our times. Privacy is a core human need, and citizens should be able to access the internet without the fear of being watched or of having their data analyzed or shared in unexpected ways. Privacy protections are a vital part of life for free citizens in a democratic society, and make society as a whole more vibrant, equitable and just. There are many ways our privacy is under assault in our age of fast-moving technology, which makes it all the more important that we protect that privacy in our bedrock communications system. We welcome innovation and technological progress but do not believe in the necessity to advance them at the expense of privacy. Our fundamental right to privacy should not be sold off for short-term gains, and thus we urge the Commission to adopt its proposed rule, which would significantly advance privacy online. [see signatories in attachment]

Dear Chairman Upton and Ranking Member Pallone: We, the undersigned consumer and public interest groups, write regarding the “FTC Process and Transparency Reform Act of 2016,” a discussion draft advanced by the Subcommittee on Commerce, Manufacturing, and Trade to the full Committee that would alter the processes used by the Federal Trade Commission (FTC) to carry out its work. We are very concerned that the legislation would harm the FTC’s ability to crack down on scam artists and protect consumers from unfair, misleading, or anticompetitive business practices. Among other concerns, we are troubled that the legislation would: Thoroughly undermine the FTC’s enforcement capabilities. By allowing “[c]ompliance with any guidelines, general statement of policy, or similar guidance issued by the Commission” to be used as evidence of compliance with the law—rather than merely as evidence of a good­faith effort to comply with the law—the legislation could thoroughly undermine the Commission’s enforcement of the FTC Act. A company that is the target of an enforcement action or subject to a consent order could hunt for and cite a wide variety of general statements by the agency to evade liability for violating the law. Under these circumstances, the FTC might have to rescind the guidance it has given to businesses and consumers, and stop giving new guidance, in order to preserve its enforcement capabilities. Constrain the FTC’s authority to find that a business practice is unfair. By casting in statutory concrete portions of the FTC’s 35­year­old Policy Statement on Unfairness, but leaving out key context and references, the legislation would constrain and rigidify the agency’s authority to find that an act or practice is unfair. We are particularly concerned it would undermine the agency’s authority to find that an act or practice is unfair even though it may not directly cause physical effects, such as harassing late-night telephone calls. End investigations arbitrarily. By requiring the termination of any investigation after six months, unless the FTC sends the target of the investigation a written communication or votes to keep the investigation open, the legislation could result in critical investigations ending arbitrarily or their confidentiality being compromised. The FTC should have the flexibility to prioritize its time working on investigations in a manner consistent with the public interest, and to take the time necessary to determine how best to protect consumers. Weaken the FTC’s ability to prevent repeat offenses. By setting a shorter, eight-year standard length for FTC consent decrees, and requiring the FTC to justify continuing non­fraud decrees for more than five years, the legislation would weaken the FTC’s ability to prevent repeat offenses. The FTC can in most cases only fine a company—and thus penalize a repeat offense—for violating an order, not simply for re­committing the offense itself. The FTC’s work to promote competition and protect consumers from unfair or deceptive acts or practices is essential to the fair functioning of the marketplace. For over a century, the agency has stood up for the interests of consumers when threatened by unlawful behavior, such as predatory sales tactics, false advertising, price fixing, or abusive communications. The Commission—operating on a bipartisan basis and often via consensus—investigates consumer complaints and takes legal action as appropriate to stop illegal practices and deter others from engaging in them. As a result of these actions, consumers enjoy a far fairer, far more reasonable and dependable marketplace than otherwise would exist, and businesses operating fairly and honestly are rewarded with a more level playing field. We urge you not to report legislation to the full House that would undermine the FTC’s critical work. For any additional information, please contact William Wallace at Consumers Union, , 202-462-6262. Sincerely, Agriculture and Trade Policy Americans for Financial Reform Center for Democracy & Technology Center for Digital Democracy Center for Science in the Public Interest Common Sense Kids Action Constitutional Alliance Consumer Action Consumers for Auto Reliability and Safety Consumer Federation of America Consumer Federation of California Consumers Union Consumer Watchdog Families Rally for Emancipation and Empowerment Food & Water Watch Free Press Action Fund Funeral Consumers Alliance Georgia Watch Institute for Agriculture and Trade Policy (IATP) Knowledge Ecology International Massachusetts Consumers’ Council, Inc. Media Alliance National Association of Consumer Advocates National Consumer Law Center Privacy Times Public Citizen Public Good Law Center Public Health Advocacy Institute at Northeastern University School of Law U.S. PIRG Virginia Citizens Consumer Council Virginia Poverty Law Center World Privacy Forum

Alvaro Bedoya, Center for Digital Democracy, Common Sense Kids Action, Consumer Action, Consumer Federation of America, Consumer Watchdog, Privacy Rights Clearinghouse, and U.S. PIRG The “Privacy Best Practice Recommendations for Commercial Facial Recognition Use” that have finally emerged from the multistakeholder process convened by the National Telecommunications and Information Administration (NTIA) are not worthy of being described as “best practices.” In fact, they reaffirm the decision by consumer and privacy advocates to withdraw from the proceedings. In aiming to provide a “flexible and evolving approach to the use of facial recognition technology” they provide scant guidance for businesses and no real protection for individuals, and make a mockery of the Fair Information Practice Principles on which they claim to be grounded. That is not surprising. It was clear to those of us who participated in this process that it was dominated by commercial interests and that we could not reach consensus on even the most fundamental question of whether individuals should be asked for consent for their images to be collected and used for purposes of facial recognition. Under these “best practices,” consumers have no say. Instead, those who follow these recommendations are merely “encouraged” to “consider” issues such as voluntary or involuntary enrollment, whether the facial template data could be used to determine a person’s eligibility for things such as employment, healthcare, credit, housing or employment, the risks and harms that the process may impose on enrollees, and consumers’ reasonable expectations. No suggestions are provided, however, for how to evaluate and deal with those issues. If entities use facial recognition technology to identify individuals, they are “encouraged” to provide those individuals the opportunity to control the sharing of their facial template data – but only for sharing with unaffiliated third parties that don’t already have the data, and “control” is not defined. Just as there is nothing that “encourages,” let alone requires, asking individuals for consent for their images to be collected and used for facial recognition in the first place, there is nothing that “encourages” offering them the ability to review, correct or delete their facial template data later. The recommendations merely “encourage” entities to disclose to individuals that they have that ability, if in fact they do. Further, if facial recognition is being used to target specific marketing to, for example, groups of young children, there is no “encouragement” to follow even these weak principles. There is much more lacking in these “best practices,” but there is one good thing: this document helps to make the case for why we need to enact laws and regulations to protect our privacy. If this is the “best” that businesses can do to address the privacy implications of collecting and using one of the most intimate types of individuals’ personal data – their facial images – it falls so short that it cannot be taken seriously and it demonstrates the ineffectiveness of the NTIA multistakeholder process.