|The final FTC report tries to regulate "precise geolocation data" without defining it and also contains other language of concern to the geospatial community.|
Have you read the final report of the Federal Trade Commission (FTC), "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations For Businesses and Policymakers"? If not, you should.
In that report, FTC proposed to protect the privacy of individual citizens’ "sensitive” data, including "precise geolocation data” such as addresses. However, FTC did not define the term "precise geolocation data,” and the report recommended that before any firm could collect, store or use such data, it would be required to "provide prominent disclosures and obtain affirmative express consent before using consumer data in a materially different manner than claimed when the data was collected."
Compliance with this requirement is impractical to the point of impossible for geospatial firms. The proposed regulatory language threatens information that is collected by private firms and government entities to perform E-911 and emergency response management, environmental protection, homeland security, mortgage foreclosure monitoring/early warning systems, master planning, and many other tasks that are conducted by geospatial professionals.
When issuing its final report, the FTC provided only a single footnote to address the geospatial community’s concerns: "With respect to use of geolocation data for mapping, surveying or similar purposes, if the data cannot reasonably be linked to a specific consumer, computer, or device, a company collecting or using the data would not need to provide a consumer choice mechanism. Similarly, if a company takes reasonable measures to de-identify smart grid data and takes the other steps outlined above, the company would not be obligated to obtain consent before collecting or using the data.”
The FTC urged the private sector to "accelerate the pace of its self-regulatory measures to implement the Commission’s final privacy framework. Although some companies have excellent privacy and data security practices, industry as a whole must do better.” It went on to offer the following ominous warning: "To the extent that strong privacy codes are developed, the Commission will view adherence to such codes favorably in connection with its law enforcement work. The Commission will also continue to enforce the FTC Act to take action against companies that engage in unfair or deceptive practices, including the failure to abide by self-regulatory programs they join.”
The report also said, "The Commission calls on individual companies, trade associations, and self-regulatory bodies to adopt the principles contained in the final privacy framework, to the extent they have not already done so. For its part, the FTC will focus its policy efforts on the five areas identified (in the report) … vigorously enforce existing laws, work with industry on self-regulation, and continue to target its education efforts on building awareness of existing data collection and use practices and the tools to control them.”
What can we do?
In a presentation on privacy issues at the MAPPS Winter Conference, I provided a legal and historic perspective on the topic and highlighted recent legislation that includes “geolocation” language or otherwise impacts the work done by geospatial professionals. MAPPS has been working with allies, such as other geospatial associations in the Coalition of Geospatial Organizations (COGO) as well as the federal government’s Federal Geographic Data Committee (FGDC) and the National Geospatial Advisory Committee (NGAC) to convince the FTC that it has not adequately addressed the geospatial community’s concerns and has established an untenable standard. Privacy will be one of the topics addressed at the MAPPS Federal Programs Conference March 12-13. We must remain vigilant and work together to make our voices heard on this crucial issue.
Everyone involved in collecting, managing and applying geospatial data should take note. If our efforts to change the Commission’s view are not successful, you will be required to comply with this federal regulatory requirement or be subject to an enforcement action by the FTC. Read the final FTC report and share your comments below.