FTC calls for legislation to give consumers access to data collected about them

The Federal Trade Commission, the main government agency responsible for protecting privacy, called Monday for legislation that would give consumers access to information collected about them by data brokers similar to the rights they now have to review information amassed by credit reporting agencies.

The recommendation came as the FTC issued the final version of a privacy-policy framework it put forward for comment in December 2010. But the initial version, which also called on industry to create an easily available "do not track" mechanism to protect online privacy, stopped short of urging specific actions by Congress.

FTC Chairman Jon Leibowitz said Monday self-regulation appeared to be working to create a do-not-track option for consumers, although he suggested congressional interest offered an extra incentive.

"We are confident that consumers will have an easy-to-use and effective do not track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don't," Leibowitz said. The latest version of the Firefox browser already allows users to turn off Web-browsing histories and advise websites that "I do not want to be tracked."

But the FTC said there was a need for broad privacy legislation and specific protections to address problems such as lax data security and the activities of data brokers - "companies that, without the consent or even knowledge of most consumers, collect and traffic in the data we leave behind as we travel through virtual and brick-and-mortar worlds," Leibowitz said.

The FTC report said companies should be held responsible for what it called "privacy by design," defined as practices that "build in privacy at every stage of product development." Like the new "Consumer Privacy Bill of Rights" that President Obama announced last month, the FTC's framework focuses on the transparency of information-handling practices and on consumer expectations that arise from the context in which personal information is requested.

Ioana Rusu, regulatory counsel at Consumers Union, said expectations about privacy were routinely confounded by the data-brokerage industry, in which little-known companies such as Axciom collect and trade data about consumers. Information from brokers can be used directly for marketing or combined with data from other sources to build more detailed profiles of individual consumers.

"The FTC is basically saying it's really problematic that entities that have no real relationship with consumers are amassing huge amounts of information about them," Rusu said. "The consumer doesn't have any way of controlling that information, or even knowing that it exists or what it's being used for."

Consumers' expectations are also at the heart of a lawsuit against Google Inc. filed in Philadelphia last week. The suit contends that people who use Google's online services or who own mobile devices based on its Android operating system are being harmed by a new, unified privacy policy that Google implemented on March 1.

The suit says Google seeks to boost its online advertising revenue by mingling data from the dozens of free services it offers, such as its search engine, Gmail, and YouTube.

The suit says, "Google's new privacy policy is nothing more than Google's effort to garner a larger market share of advertising revenue by offering targeted advertising capabilities that compete with or surpass those offered by social networks, such as Facebook, where all of a consumer's personal information is available in one site."

A Google spokesman declined to comment on the suit, saying the company had not yet had time to review it. But Google, which says it has made few changes in its underlying data-handling practices, has criticized other class actions prompted by its unified policy.

"We believe these cases are without merit, and we intend to defend them vigorously," Google said in response to the earlier suits. "Our updated privacy policy makes our privacy practices easier to understand, and it reflects our desire to create a seamless experience for our signed-in users. We undertook the most extensive notification effort in Google's history, and we're continuing to offer choice and control over how people use our services."

Contact Jeff Gelles at 215-854-2776 or jgelles@phillynews.com. Read his blog at www.philly.com/consumer.