[Senate Hearing 114-564]
[From the U.S. Government Publishing Office]
S. Hrg. 114-564
HOW WILL THE FCC'S PROPOSED PRIVACY
REGULATIONS AFFECT CONSUMERS
AND COMPETITION?
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED FOURTEENTH CONGRESS
SECOND SESSION
__________
JULY 12, 2016
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
U.S. GOVERNMENT PUBLISHING OFFICE
24-204 PDF WASHINGTON : 2017
__________________________________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Publishing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED FOURTEENTH CONGRESS
SECOND SESSION
JOHN THUNE, South Dakota, Chairman
ROGER F. WICKER, Mississippi BILL NELSON, Florida, Ranking
ROY BLUNT, Missouri MARIA CANTWELL, Washington
MARCO RUBIO, Florida CLAIRE McCASKILL, Missouri
KELLY AYOTTE, New Hampshire AMY KLOBUCHAR, Minnesota
TED CRUZ, Texas RICHARD BLUMENTHAL, Connecticut
DEB FISCHER, Nebraska BRIAN SCHATZ, Hawaii
JERRY MORAN, Kansas EDWARD MARKEY, Massachusetts
DAN SULLIVAN, Alaska CORY BOOKER, New Jersey
RON JOHNSON, Wisconsin TOM UDALL, New Mexico
DEAN HELLER, Nevada JOE MANCHIN III, West Virginia
CORY GARDNER, Colorado GARY PETERS, Michigan
STEVE DAINES, Montana
Nick Rossi, Staff Director
Adrian Arnakis, Deputy Staff Director
Rebecca Seidel, General Counsel
Jason Van Beek, Deputy General Counsel
Kim Lipsky, Democratic Staff Director
Chris Day, Democratic Deputy Staff Director
Clint Odom, Democratic General Counsel and Policy Director
C O N T E N T S
----------
Page
Hearing held on July 12, 2016.................................... 1
Statement of Senator Thune....................................... 1
Letter dated July 11, 2016 to Hon. John Thune, Hon. Bill
Nelson, Hon. Fred Upton, Hon. Frank Pallone, Hon. Greg
Walden and Hon. Anna Eshoo from Laurence H. Tribe, Carl M.
Loeb Universty Professor and Professor of Constitutional
Law, Harvard Law School; Richard A. Epstein, Laurence A.
Tisch Professor of Law, The New York University of Law, The
Peter and Kirsten Bedford Senior Fellow, The Hoover
Institution, The James Parker Hall Distinguished Service
Professor of Law Emeritus and Senior Lecturer, The
University of Chicago; Robert Corn-Revere, Partner, Davis
Wright Tremaine LLP; Robert D. Atkinson, President,
Information Technology and Innovation Foundation; Jane
Bambauer, Associate Professor of Law, University of
Arizona, James E. Rogers College of Law; Babette Boliek,
Associate Professor of Law, Pepperdine University School of
Law; Fred H. Cate, Distinguished Professor and C. Ben
Dutton Professor of Law, Indiana University Maurer School
of Law; James C. Cooper, Associate Professor of Law and
Director, Program on Economics and Privacy, Scalia Law
School, George Mason University; Justin (Gus) Hurwitz,
Assistant Professor of Law, Nebraska College of Law; Mark
A. Jamison, Director and Gunter Professor, Public Utility
Research Center, University of Florida; Daniel A. Lyons,
Associate Professor of Law, Boston College Law School;
Geoffrey A. Manne, Executive Director, International Center
for Law and Economics; David W. Opderbeck, Professor of
Law, Seton Hall University Law School and Director, Gibbons
Institute of Law, Science and Technology; and Paul H.
Rubin, Samuel Candler Dobbs Professor of Economics, Emory
University................................................. 62
Letter dated July 11, 2016 to Hon. John Thune and Hon. Bill
Nelson from Gary Shapiro, President and CEO, Consumer
Technology Association; Jim Halpert, President and CEO,
Internet Commerce Coalition; Jonathan Spalter, Chair,
Mobile Future; Scott Belcher, CEO, Telecommunications
Industry Association; Meredith Attwell Baker, President and
CEO, CTIA; Genevieve Morelli, President, ITTA; Michael
Powell, President and CEO, National Cable and
Telecommunications Association; and Walter B. McCormick,
Jr., President and CEO, USTelecom.......................... 64
Paper entitled ``The Curious Absence of Economic Analysis at
the Federal Communications Commission: An Agency in Search
of a Mission'' by Gerard R. Faulhaber and Hal J. Singer.... 67
Statement of Senator Nelson...................................... 3
Statement of Senator Blunt....................................... 131
Statement of Senator Schatz...................................... 132
Statement of Senator Markey...................................... 134
Statement of Senator Moran....................................... 137
Statement of Senator Klobuchar................................... 139
Statement of Senator Daines...................................... 141
Statement of Senator Gardner..................................... 143
Statement of Senator Heller...................................... 145
Statement of Senator Blumenthal.................................. 147
Witnesses
Hon. Jon Leibowitz, Partner, Davis, Polk & Wardwell and Co-
Chairman, 21st Century Privacy Coalition....................... 4
Prepared statement........................................... 6
Dean C. Garfield, President and CEO, Information Technology
Industry Council (ITI)......................................... 14
Prepared statement........................................... 15
Paul Ohm, Professor, Georgetown University Law Center and Faculty
Director, Georgetown Center on Privacy and Technology.......... 20
Prepared statement........................................... 22
Matthew M. Polka, President And CEO, American Cable Association.. 28
Prepared statement........................................... 29
Peter Swire, Huang Professor of Law and Ethics, Scheller College
of Business, Georgia Institute of Technology................... 35
Prepared statement........................................... 37
Article dated May 2016 entitled ``Online Privacy and ISPS:
ISP Access to Consumer Data is Limited and Often Less than
Access by Others'' by Peter Swire.......................... 48
Appendix
Response to written questions submitted by Hon. Deb Fischer to:
Paul Ohm..................................................... 155
Dean C. Garfield............................................. 155
Matthew M. Polka............................................. 156
HOW WILL THE FCC'S PROPOSED PRIVACY
REGULATIONS AFFECT CONSUMERS
AND COMPETITION?
----------
TUESDAY, JULY 12, 2016
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 10:04 a.m. in
room SR-253, Russell Senate Office Building, Hon. John Thune,
Chairman of the Committee, presiding.
Present: Senators Thune [presiding], Nelson, Cantwell,
Blunt, Rubio, Klobuchar, Ayotte, Blumenthal, Heller, Schatz,
Markey, Fischer, Sullivan, Moran, Manchin, Johnson, Peters,
Gardner, and Daines.
OPENING STATEMENT OF HON. JOHN THUNE,
U.S. SENATOR FROM SOUTH DAKOTA
The Chairman. Good morning. This hearing will come to
order.
The protection of privacy on the Internet is vital.
Protection from identity theft, protection from deeply private
information: this is important to us as citizens and as
consumers, and it's fundamental for allowing the Internet and
the information economy to thrive, and thrive they have.
Internet usage has increased 900,000 percent since the
Telecom Act of 1996, and to meet that demand, the broadband
industry has invested $1.4 trillion. This growth occurred under
the Federal Communications Commission's light regulatory
treatment of the Internet as an information service, and under
the careful eye of the Federal Trade Commission, which, with
limited exceptions, was responsible for protecting consumer
privacy on the Internet. The FTC has brought over 500 cases
protecting the privacy and security of consumer information,
including cases where companies were alleged to have
deceptively tracked consumers online or to have shared privacy
consumer data with unauthorized third parties.
The FTC has been the leader in protecting consumer privacy,
but with the FCC's 2015 Open Internet Order, all of that
changed. Broadband Internet Access Service, or BIAS, was
reclassified as a telecommunications service, which, in turn,
meant the FTC lost its jurisdiction over the privacy policies
of BIAS providers.
So now, after having forced the FTC off the field for
broadband providers, the FCC has proposed a novel regulatory
scheme for the newly reclassified providers. But the FCC's
rules would apply only to certain parts of the Internet, and
that is a source of significant concern. Both the Obama
administration and the FTC have endorsed a consistent privacy
regime across the digital landscape. Indeed, the FTC staff
filed comments with the Commission stating, ``The FCC's
proposed rules, if implemented, would impose a number of
specific requirements on the provision of BIAS services that
would not generally apply to other services that collect and
use significant amounts of consumer data. This outcome is not
optimal.''
For those of you not familiar with bureaucrat-speak, let me
tell you this, when they say, ``this outcome is not optimal,''
it's pretty strong stuff for one agency to say about another.
I share the FTC's concern, and by overwhelming majority, so
do the American people. Progressive Policy Institute polling
shows that 94 percent of Internet users believe that all
companies collecting data online should follow the same
consumer privacy rules so that consumers can be assured that
their personal data is protected regardless of the company that
collects or uses it.
I am concerned that at any particular time consumers will
not have reasonable certainty of what the rules are and how
their privacy decisions apply. At home on Wi-Fi? At home on a
smartphone? Using your smartphone on a friend's Wi-Fi? Using
the Internet at a library? Each of these could have very
different privacy implications for a consumer because of the
FCC's proposed piecemeal approach to privacy.
There are other problems for consumers as well. Will the
Commission's proposed rules make it more or less likely that
BIAS providers will be able to provide better and more
innovative services that could benefit consumers? And of
particular importance to our rural communities, how are small
BIAS providers going to be able to comply with the Commission's
proposed regulations? Most of the rural carriers in South
Dakota have between 2,000 and 5,000 broadband subscribers. How
are they supposed to pay for the additional staff, software
licenses, training, and other expenses that would be required
to comply with the Commission's proposed rules?
The FCC's push for a separate regulatory scheme for BIAS
providers is based in significant part on their claim that ISPs
are the most important and extensive conduits of consumer
information, and thus have access to very sensitive and very
personal information. I am not so sure about that. It appears
that many companies that are not broadband providers have
access to information about consumers that is more personal and
more sensitive than much of what ISPs can access, yet those
entities are not covered by the Commission's proposal.
Is the FCC, which is a novice when it comes to regulating
Internet privacy, the right agency to protect us from identity
theft and to protect our private information? Do we want to
have inconsistent privacy protection for consumers, with
distinctions based upon how the Commission chooses to classify
services under the Communications Act, an act that never
envisioned the FCC dealing with online privacy or
cybersecurity? Would consumers and companies be better off with
the FCC's proposal?
The witnesses we have before us today represent a broad
variety of backgrounds and are true experts on these issues.
And I look forward to your answers to these and other questions
that you are asked here today.
With that, I would yield to our distinguished Ranking
Member, the Senator from Florida, Senator Nelson, for an
opening statement.
STATEMENT OF HON. BILL NELSON,
U.S. SENATOR FROM FLORIDA
Senator Nelson. Thank you, Mr. Chairman.
If we all share the same goal of how to best protect
consumer online privacy, then it seems that we are bifurcated
in our approach to this because in looking at the FCC's
proposed privacy rules, both sides of the debate come at these
questions with preconceived notions about how best to achieve
this goal. On the one side, we are told that the FCC should not
be adopting any rules for broadband providers because we are
not also applying those same rules to every online player. On
the other side, we're told that the FCC should adopt the most
stringent rules possible in order to prohibit broadband
providers from using any consumer data.
Well, it seems to me that the question is ultimately how to
preserve the benefits of online commerce, but in a way that
takes into account consumers' right to know about and, when
appropriate, control the collection and use of their personal
information. So putting aside the claims of regulatory
overreach or power grabs, isn't it clear the FCC is the expert
agency for regulating communications networks, including
broadband networks? It is an expert oversight agency with
flexible forward-looking authority to protect consumers.
If the content is governed by the FTC under the fair and
deceptive practices standard, isn't it right for the FCC, as it
has over the past several years and as I have pushed, to also
use its authority to protect privacy? We need regulators who
are not afraid to use their authority when necessary, to
protect consumer privacy, but also we need the regulators to
know when to exercise that authority in a restrained manner.
Now, this is a difficult balance, but that doesn't mean
that an agency should defer or otherwise be reluctant to do
what it believes is in the best interest of protecting
consumers. The FCC is still in the middle of a rulemaking to
sort all of this out.
Thank you, Mr. Chairman, for calling this hearing so that
we can hear all the attitudes about the FCC's proposals and
alternative approaches, but at the end of the day, I can tell
you this Senator is going to side with the consumers in
whichever approach that I can conclude best protects the
privacy of broadband subscribers.
Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Nelson.
We've got a great panel today to hopefully shed some light
on this subject. And on my left and your right is Mr. Jon
Leibowitz, a Partner at Davis, Polk & Wardwell, and a Co-Chair
of the 21st Century Privacy Coalition. He is also a former
Chairman of the Federal Trade Commission.
Next to him is Mr. Dean Garfield, who is the President and
CEO of the Information Technology Industry Council.
Professor Paul Ohm of Georgetown University Law Center.
And Mr. Matthew Polka. He is the President and CEO of the
American Cable Association.
And Professor Peter Swine [sic], the Huang Professor of Law
and Ethics for the Scheller College of Business at the Georgia
Institute of Technology.
We're delighted to have all of you with us today. Thank you
for being here. We look forward to hearing from you and asking
you some questions. And we'll start, as I said, on my left, and
your right, with Mr. Leibowitz. So please proceed with your
remarks. And if you could all confine it as close to possible
with 5 minutes, we would very much appreciate it.
Thank you.
STATEMENT OF HON. JON LEIBOWITZ, PARTNER, DAVIS, POLK &
WARDWELL AND CO-CHAIRMAN, 21ST CENTURY PRIVACY COALITION
Mr. Leibowitz. Thank you, Chairman Thune, Senator Nelson,
other distinguished members of the Committee. I appreciate you
inviting me to testify today on behalf of the 21st Century
Privacy Coalition, which I chair with former Representative
Mary Bono.
Our Coalition is comprised of the Nation's leading
communications companies, which have a strong interest in
bolstering consumers' trust in online services. We believe the
best way to ensure protection of consumer privacy is through a
comprehensive and technology-neutral framework based on the
type of data being collected and how it is used rather than on
the type of entity collecting the data. And that is exactly the
approach that the Obama administration has endorsed and the FTC
has taken in decades, as you know, of robust privacy
enforcement.
The FTC has held hundreds of companies, large and small,
accountable for breaking their privacy commitments to
consumers, and by taking a largely enforcement-based approach
rather than setting out prescriptive rules, the FTC has
powerfully protected privacy while permitting the type of high-
tech innovation that has yielded huge benefits to all
Americans. And when the FTC has done a rulemaking--so think
about Do Not Call or the Children's Online Privacy Protection
Act, as Senator Klobuchar and Senator Markey know, they have
been successful. Indeed, the FTC approach has been so
successful that in 2012 the White House called on the FTC to be
solely responsible for protecting the privacy of every American
across every industry, and that, of course, includes ISPs.
As we know, last year the FTC's sister agency, the FCC,
reclassified Internet service providers as common carriers, as
part of the Open Internet Order. That decision removed ISPs
from the FTC's jurisdiction. Having assumed sole jurisdiction
to protect privacy among broadband users, the FCC is reasonably
engaged in rulemaking. After all, we want to have a cop on the
beat. And our Coalition was initially encouraged by Chairman
Wheeler's stated aim to craft the proposed privacy rules in a
manner, and I quote, consistent with the FTC's thoughtful,
rational approach, and with the core principles of the FTC's
2012 private report in mind.
But the FCC's proposed rules, as currently drafted, are
very different from FTC practice and policy. Instead, the
proposed rules impose a restrictive set of requirements on
broadband providers that don't apply to other entities that
collect much or more consumer online data. The ISP's specific
rules don't provide clear benefits to consumers, they don't
protect privacy in the way that they should, they may
themselves be unconstitutional, and more troubling, or at least
as troubling, these restrictive requirements represent a
fundamental change in the U.S. approach to privacy, a change
that should not be made lightly or without the input of all
stakeholders. Indeed, the FCC has not identified any consumer
harms that warrant a vast departure from the FTC's successful
approach.
So the goals may be laudable, I have no doubt they are, but
the draft rules betray a fundamental lack of understanding
regarding how the Internet ecosystem works. Indeed, the FCC's
proposed rules may well discourage the very broadband
innovation that the FCC is statutorily obligated to promote,
thereby harming the very consumers it's supposed to benefit.
Let me highlight four salient flaws in the FCC's proposal.
First, it is not technology-neutral. It would impose
prescriptive rules on only a subset of the Internet ecosystem,
and by doing so, diminish broadband providers as a potential
competitive force to benefit consumers.
Second, the FCC's proposal would impose opt-in consent
requirements for non-sensitive data and basic everyday business
practices, like first-party marketing. For example, an ISP,
absent an opt-in consent, would be prohibited from marketing
its own home security, music streaming, or energy management
services to its own customers using its own customer lists,
that makes no sense at all, nor would prohibiting a typical
working-class family of four from accepting a discount in
exchange for an ISP using customer information, even if that
information isn't shared with anybody else. Consumers should be
able to make their own choices as long as they are informed
choices. Choice is really supposed to be what the Internet is
about.
Third, the NPRM, as drafted, would miss the opportunity to
create consumer benefits from de-identified data.
And, fourth, the proposal would impose an unrealistic
timeline for breach notification and mandate massive
overnotification that could cause consumers to ignore truly
important messages from their ISP or from others.
And don't take my word for it, as you pointed out, Senator
Thune, my former agency, the FTC, has referred to aspects of
the NPRM as, ``not optimal.'' In the FTC's comments on the FCC
proposal, comment to the FCC, there are 28 separate instances
where the FTC raises concerns about the FCC's approach.
If I could make one suggestion to the FCC, it would be
this: listen to the FTC and consider whether the FCC proposal
is in tension with the U.S. successful NIST cybersecurity
framework or could undermine the EU-U.S. Privacy Shield as it
works its way through the European Parliament.
Mr. Chairman, I ask for an additional 30 seconds and then I
will end. Thank you.
But with that said, let me make one last point: Final rules
are often more balanced than proposed ones. I think you made
this point, Senator Nelson. We may see a lot of improvement
when the NPRM moves to completion. But even if you don't
believe the FCC's current proposal is a solution in search of a
problem, it would nevertheless create inconsistent standards
across the Internet, confuse consumers, and undermine
innovation that benefits consumers as well. And there are
serious questions about whether it would withstand
constitutional scrutiny.
For all these reasons, the 21st Century Privacy Coalition's
view is that the FCC should adopt the FTC's time-tested and
proven approach, a privacy framework that has largely been
embraced by the Obama administration.
Thank you. I'm happy to answer questions.
[The prepared statement of Mr. Leibowitz follows:]
Prepared Statement of Hon. Jon Leibowitz, Partner, Davis, Polk &
Wardwell and Co-Chairman, 21st Century Privacy Coalition
Chairman Thune, Ranking Member Nelson, other distinguished Members
of the Committee, thank you for inviting me to testify at this
important hearing. My name is Jon Leibowitz and, along with former
Representative Mary Bono, I serve as Co-Chair of the 21st Century
Privacy Coalition.
Our group is comprised of the Nation's leading communications
companies, which have a strong interest in bolstering consumers' trust
in online services and confidence in the privacy and security of their
personal information. We believe that consumers should enjoy the same
robust protections throughout the Internet ecosystem. I offer testimony
today regarding the FCC's ongoing broadband privacy rulemaking on
behalf of our group.
As consumers' online activity grows in size and scope, it is more
important than ever that consumers have a clear notion of how their
data is being used and shared, and what is being done to protect their
data from hackers and other bad actors. Since the Internet's inception,
the Federal Trade Commission (``FTC'') has been the main privacy cop
enforcing these essential consumer protections. But last year, the
FTC's sister agency--the Federal Communications Commission (``FCC'')--
reclassified Internet Service Providers (``ISPs'') as common carriers
subject to Title II of the Communications Act, removing ISPs from the
FTC's jurisdiction. Having assumed sole jurisdiction over the privacy
practices of ISPs, the FCC is currently engaged in a rulemaking to set
out a privacy framework for ISPs.
The 21st Century Privacy Coalition was encouraged by FCC Chairman
Wheeler's stated aim to craft the proposed broadband privacy rules in a
manner ``consistent with [the] FTC's thoughtful, rational approach,''
and with the core principles of the 2012 FTC Privacy Report,
``Protecting Consumer Privacy in an Era of Rapid Change:'' privacy-by-
design; choice; and transparency. Our group believes that an FCC
rulemaking consistent with the FTC's privacy framework would ensure
that privacy enforcement remains both robust and technology neutral--
that is, based on the sensitivity of data collected and how that data
is used, rather than on the type of entity collecting the data. This
would protect consumers while continuing to facilitate and encourage
innovation and competition on the Internet.
Such an approach also would better reflect the privacy and data
security principles promoted by the Obama Administration after
extensive research and outreach to stakeholders. In its 2012 Report
``Consumer Data Privacy In a Networked World: A Framework for
Protecting Privacy and Promoting Innovation in the Global Digital
Economy,'' the Administration advocated for ``a level playing field for
companies, a consistent set of expectations for consumers, and greater
clarity and transparency.'' Moreover, the Report also recognizes that
most first-party marketing is consistent with the context of the
provider-consumer relationship, and that ``[c]ompanies should be able
to infer consumer consent to collect personal data for these limited
purposes.'' And the Report encourages companies to develop privacy
protections based upon the ``sensitivity of the personal data that they
collect, use, or disclose.'' In addition, the National Institute of
Standards and Technology (``NIST'') Cybersecurity Framework has been
highly lauded as an effective means of fostering increased security
across a multiplicity of industries by placing a priority on risk
management and flexible standards, rather than prescriptive and
inflexible a priori rules.
Unfortunately, while some parts of the FCC's proposed rules are
consistent with the Obama Administration and FTC approach, in many
important areas the rules deviate sharply from that approach,
demonstrating both the FCC's lack of experience in the privacy area,
and its failure to fully consider and test the likely impact of its
proposed rule on consumers and ISPs alike during the course of its
drafting process. Thus, we agree that, as the FTC noted, the FCC's
approach is ``not optimal.''
The FCC has proposed regulations for ISPs that go well beyond those
imposed upon the rest of the Internet economy, and which, if adopted,
would undercut benefits to the very consumers such rules seek to
protect. Yet the FCC has failed to identify any harms or particular
problems posed by ISPs that necessitate a divergence from the effective
privacy framework that has applied to ISPs for years.
The FCC's proposed rules do not reflect the economic and
technological realities of the Internet ecosystem, which bears little
to no resemblance to the traditional voice services market that the FCC
has regulated under its Title II authority. In addition, it is
inapposite to attempt to analogize the ISP industry to banks or health-
care companies to which sector-specific laws apply. Online data is
collected and exchanged by many entities other than ISPs.
In the Internet ecosystem, myriad entities have access to and use
consumers' online information to provide customers free, advertising-
supported content and services, and a wide array of customized
capabilities and offerings. Data-driven insights and offerings are a
key driver of the growth of the Internet economy and the source of
considerable innovation and benefits for consumers. Unfortunately, the
FCC's proposed rules will make it much harder for ISPs to deliver these
benefits, particularly compared to other online entities. For example,
the NPRM would restrict consumer choice by prohibiting efforts by ISPs
to promote broadband access by offering discounted service in exchange
for targeted marketing. Thus, if enacted in its current form, the NPRM
would harm, rather than benefit, consumers.
In fact, ISPs are new entrants in the online advertising market,
where ten companies, none of which are ISPs, hold over seventy percent
of the market. The proposed rules would curtail ISPs' ability to enter
that market and provide sorely needed competition. Under a reasonable
reading of proposed rules set forth in the NPRM, ISPs would not be able
to market their own non-communication-related products--like cloud
services, music streaming, or a home security system--to their own
customers without such customers' prior opt-in consent. The FCC must
avoid an outcome in which ISP marketing practices that are clearly
consistent with consumer expectations are restricted in a way that
undermines consumer choice and eliminates opportunities for consumers
to save money on products offered by an existing service provider.
These marketing restrictions are also inconsistent with marketing laws
already on the books--including CAN-SPAM and Do-Not-Call--in which
Congress struck a balance between privacy and the dissemination of
information to consumers by setting up opt-out regimes.
Moreover, the proposed rules threaten to create not only consumer
confusion, but also frustration and disruption of their online
experiences. In a recent survey published by the Progressive Policy
Institute, 94 percent of consumers agreed that ``[a]ll companies
collecting data online should follow the same consumer privacy rules so
that consumers can be assured that their personal data is protected
regardless of the company that collects or uses it.'' In addition,
because the United States has highlighted the FTC's approach to privacy
in its negotiations with the European Union regarding cross-border data
transfers, including the so-called Privacy Shield, there are concerns
on both sides of the Atlantic that FCC divergence from the FTC privacy
framework could undermine the Privacy Shield in the European Court of
Justice as well as other U.S. international privacy negotiations. As
the Obama Administration and FTC have long recognized, a truly
consistent approach is critical to the continued growth of the
Internet, to avoiding consumer confusion and misunderstanding regarding
the uses of their data, as well as to permitting online innovation and
competition to continue to flourish. The FCC's approach, as currently
drafted, fails to achieve these important goals. This is an outcome
that the FCC should abandon before adopting final rules.
Further, the FCC's approach suffers from multiple constitutional
infirmities and is unlikely to withstand court scrutiny. Rather than
embark on such an approach just to be rebuked by the courts, the FCC
should redraft its proposal to take into consideration the FTC's
successful approach to privacy and to respect the constitutional
boundaries of the FCC's authority.
The FTC Approach
Privacy has long been a cornerstone of the FTC's consumer
protection mission, and all of us who worked at the FTC are proud of
the work we did to both protect consumer privacy and to ensure that
consumers continue to benefit from the high-tech innovation and
competition that has revolutionized modern life. As consumers migrate
more and more of their lives online, the FTC has worked to ensure both
that consumer privacy is safeguarded while providing companies with the
flexibility to use data in ways that benefit consumers and foster
competition and innovation.
The FTC has a proven track record of success, built on robust
enforcement, including over 500 successful privacy enforcement actions;
occasional regulation such as the initial 1999 and subsequent 2010
rulemakings on the Children's Online Privacy Protection Act; and
thoughtful policy initiatives like the 2012 Privacy Report, a multi-
year endeavor that incorporated the findings of iterative policy
workshops beginning in 2006, a draft Privacy Report in 2010, and over
450 comments from consumer and industry advocates, technology and
policy experts, and the public. Indeed, when the FTC published its
comprehensive Privacy Report in 2012, its approach received praise from
many consumer and privacy groups, and some criticism from businesses.
For example, the privacy organization Electronic Frontier Foundation
praised the FTC for ``creat[ing] strong guidelines for protecting
consumer privacy choices,'' while the Information Technology and
Innovation Foundation criticized the FTC, raising concern about
``important trade-offs and costs'' associated with the FTC framework.
In the four years since the publication of the FTC's Privacy
Report, in which there have been continued developments in the way
consumers access and use the Internet itself, the FTC has held more
workshops and issued additional reports and guidance tailored to
specific sectors, technologies, and practices to account for changes in
the services offered over the Internet, and in the data collection and
tracking technologies used by various entities within the Internet
ecosystem. Despite these changes, the framework established in 2012 and
the principles within the framework not only remain the same, but are
even more resonant.
The 2012 Privacy Report presents a single, comprehensive framework
that companies should consider and implement when collecting, using,
and maintaining consumer data. These principles are:
(1) Privacy by Design: calling on companies to provide reasonable
security for consumer data, to limit the collection of consumer
data to what is consistent in a context of a particular
transaction, to implement reasonable data retention and
disposal policies, and to maintain reasonable accuracy of
consumer data;
(2) Consumer Choice: encouraging companies to offer consumers the
ability to make decisions about the collection and use of their
personal data in a timely and contextual manner; and
(3) Transparency: encouraging companies to increase the transparency
of their information collection and use practices through
easily-readable privacy statements and consumer education.
The FTC furthers these principles through robust enforcement rather
than prescriptive regulation. It goes after companies when they break
their privacy commitments to consumers or take actions that cause
consumers real harm. This approach is flexible and promotes high-tech
innovation, and it has held hundreds of companies, large and small,
accountable when they cause real harm to consumers without
countervailing benefits to consumers or competition.
Importantly, in addition to creating a comprehensive framework for
both online and offline data collection and use, the FTC Report
highlighted the importance of a technology-neutral approach to privacy:
Even after thoroughly studying the data collection and use practices of
ISPs and other large platform providers, the FTC concluded that ``[a]ny
privacy framework should be technology neutral.'' In other words,
privacy enforcement should not depend upon the type of company using or
collecting consumer data or the particular technology being used to do
so. Indeed, the FTC specifically examined the question of whether large
platform providers--a category that includes ISPs, but also social
networks, operating systems, browsers, and advertising platforms--
should be subject to more stringent privacy obligations and, after a
comprehensive inquiry, declined to take such a step. Instead, the FTC
framework focuses on the sensitivity of the data collected and how
those data are used. Consistent application of the principles is
designed to provide consumers with clear and uniform privacy and data
security protections, regardless of the particular product or service
being used. The Administration has supported the FTC's policy of
technology neutrality for privacy and the goal of a harmonized privacy
framework for the entire Internet ecosystem.
Finally, it is worth noting that the comments the FTC filed in the
FCC's privacy proceeding, based largely on its 2012 Privacy Report,
were unanimously supported by all three sitting commissioners. There is
more enduring impact, and often more legitimacy, from bipartisan
regulatory action.
The FCC's Proposed Rules
The FCC's stated principles of transparency, consumer choice, and
data security are framed as matching the principles at the heart of the
FTC's framework and other privacy regimes in the United States and
globally. And certain specific proposals in the NPRM are also
consistent with the FTC approach. For example, the FCC's call for
notice and consent to consumers of retroactive material changes to data
collection and use is consistent with the FTC's framework and
enforcement.
But, as the FTC staff noted in its comments on the FCC's proposal,
``the FCC's proposed rules, if implemented, would impose a number of
specific requirements on the provision of [broadband] services that
would not generally apply to other services that collect and use
significant amounts of consumer data. This is not optimal.''
In effect, the FCC proposal amounts to a de facto rejection of the
FTC's technology neutral treatment of ISPs under the same set of
standards applicable throughout the Internet ecosystem. Instead, the
FCC's proposed rules require a broad default opt-in requirement for the
use and sharing of customer data, with limited exceptions, rather than
narrowly tailoring its opt-in to the collection and use of sensitive
customer data. The FCC is also much more restrictive with regard to
first-party uses of information, which enable companies to improve
their service and apprise their customers of offers and products of
interest to them. The FCC should recognize the FTC's experience and
heed the latter's concerns with the NPRM.
The breadth of data covered by the proposal, and the highly
restrictive nature of the permissions regime employed by the FCC,
creates a serious risk of unforeseen consequences that could adversely
affect Internet capabilities and operations as well as disrupt consumer
expectations. During the development of the 2012 Privacy Report, FTC
staff addressed the potential impact of various proposals and ideas
through extensive ``stress testing,'' whereby staff held scores of
meetings with industry and consumer groups alike to test particular
components in order to determine whether the desired outcome would be
achieved. The FCC should conduct similar meetings to fully understand
the effects of its proposed requirements, which have the potential to
disrupt not only the broadband industry, but the entire Internet
ecosystem, including competition in the online advertising market. What
follows is a discussion of specific differences between the FCC
proposed rules and the FTC approach.
Scope
The FCC's Notice of Proposed Rulemaking (``NPRM'') applies onerous
privacy and security requirements to a sweeping range of information
that is not sensitive, such as IP and MAC addresses, as well as any
other information that is ``linked or linkable to'' a user or device.
This differs from the FTC approach, which sought to calibrate the
framework's obligations to incentivize the strongest protections for
the most sensitive data.
The FCC's treatment of de-identified data is particularly
problematic. Because de-identified data does not present a risk to
consumer privacy or security, the FTC framework does not govern the
notice, use, disclosure, security, or notification of breach of
anonymized or de-identified individual data, as long as such data
cannot be reasonably linked to a particular consumer, computer, or
device. The FCC's proposal appears to confuse the FTC's guidance on the
``reasonable linkability'' standard and the appropriate steps companies
can take to minimize such linkability with a standard for aggregation,
which is but one way to de-identify data. The NPRM would limit the
exception for de-identified data only to data that is both aggregated
and de-identified.
By discouraging companies from investing in resources and tools to
de-identify data, the FCC's proposal actually exacerbates--rather than
mitigates--risks to consumer privacy. For example, as discussed below
the proposed breach notification rules would require ISPs to notify
consumers if there is an incident in which IP addresses are
compromised. Because IP addresses on their own cannot be used to
identify, let alone contact, an individual, the proposed rule would
force ISPs to associate IP addresses with appropriate customer contact
information to comply, increasing the likelihood that any incident
results in the release of information that could be used to harm
consumers. But both the Administration and FTC policies encourage
providers to dissociate such data to minimize the potentially harmful
effects of any security incident.
Finally, by including broad categories of non-sensitive data within
the scope of the NPRM's definition of customer proprietary information,
the FCC invites irrational outcomes by placing burdensome requirements
on ISPs that serve no discernible consumer privacy interest. For
example, under a reasonable reading of the rule, ISPs must provide
notice of data breaches to law enforcement and customers even under
circumstances where there is no risk of harm to consumers. ISPs would
also be prohibited from using their own customer lists to e-mail
consumers about their own non-communications-related products and
services.
Application
As noted above, in the 2012 Report, the FTC stated: ``[A]ny privacy
framework should be technologically neutral.'' There is widespread
agreement on this point among consumer and industry advocates alike. At
the FTC's December 2012 workshop, ``The Big Picture: Comprehensive
Online Data Collection,'' Maneesha Mithal, Associate Director of the
Privacy Division at the FTC noted this consensus in her closing
remarks, describing ``the need for tech neutrality'' as an area of
consensus and emphasizing that ``[w]e can't be picking winners and
losers in this space.''
Moreover, since 2012, the precipitous rise of encryption and the
proliferation of networks and devices have limited the scope of
customer data available to ISPs, while other companies operating online
have gained broader access to consumer data across multiple contexts
and platforms. For example, today, nearly half of Internet traffic is
encrypted, dramatically limiting the information visible to ISPs, and
an estimated 70 percent will be encrypted by the end of this year. This
sea change in only four years drives home the importance of technology
neutral privacy frameworks. Because the FCC is not in a position to
dictate privacy rules for the entire Internet ecosystem, it should
strive to harmonize its proposed rules with the FTC framework, and
carefully consider the consequences of failing to do so. Unfortunately,
the NPRM seems to be unaware of marketplace developments in the last
several years as well as the harms caused by a bi-furcated privacy
framework.
Choice and Context
In its comments, FTC staff leveled criticism at the FCC's proposed
consumer choice rules and recommended ``that the FCC consider the FTC's
longstanding approach, which calls for the level of choice to be tied
to the sensitivity of data and the highly personalized nature of
consumers' communications in determining the best way to protect
consumers.'' In particular, the FTC has never considered all web
address information to be sensitive. Such a conclusion would have major
implications for the entire Internet ecosystem.
The FCC's proposed restrictive choice mandates that selectively
target ISPs prevent consumers from accessing new products and services
and potentially confuse them, but provide no benefits to consumers.
They also constrain ISPs' ability to compete with edge providers, and
likely will discourage broadband investment in a manner contrary to the
FCC's mandate to promote such investment.
Under the FTC framework, when a consumer does business with a
company, there are certain uses of the consumer's information by the
company for which consumer choice is implied because such use is
consistent with ``the context of interaction between a business and the
consumer.'' This implied consent covers uses and disclosures for
product or service fulfillment, internal operations, most first-party
marketing, and more. As the FTC commented ``[o]pt-in consent should be
required for use and sharing of contents of consumer communications and
sensitive data for purposes other than those for which consent is
implied.'' The Administration's 2012 report, also recognizes that
``companies may infer consent to use personal data to conduct marketing
in the context of most first-party relationships.'' Opt-in consent is
limited to truly ``sensitive data'' and technologies that use ``all or
substantially all'' customer data.
The FTC framework calls for a consumer opt-out for almost all
online tracking, not an opt-in. According to the FTC, ``[o]pt-out is
sufficient for use and sharing of non-sensitive data.'' The FCC
proposal is a vast departure from this guidance.
Rather than narrowly tailoring a requirement for opt-in consent to
truly ``sensitive data,'' the proposed rules would impose a broad opt-
in requirement upon ISPs for the use or disclosure of a wide swath of
consumer data for an extensive range of practices--including practices
for which the FTC requires no choice at all because consent is implied.
The notion that a bright-line opt-in requirement should apply to the
collection of online information would represent a wholesale revision
of U.S. privacy laws and would risk harm to the overall health of the
Internet by constraining the beneficial use of data.
The FCC's proposed rules disregard the context of the interaction
between the consumer and the service provider. In today's economy, a
company's relationship with its customers involves more than just
providing service. It also requires understanding the ways in which
services are used, identifying areas for improvement, and making
consumers aware of product offers and enhancements that may interest
them. By ignoring the balance between privacy and data-driven insights
and innovation, the FCC's approach actually makes consumers worse off.
The FTC does not require companies to provide any choice to present
advertising to their own customers, except where that advertising was
presented by tracking a user's online activity across other companies'
websites or intentionally using sensitive information collected from
its customers. Under the FCC's proposal, however, any use of customer
information that is not relevant to marketing a communications-related
service would require opt-in consent from the customer. Indeed, under
the proposed rules, an ISP would likely not be able to market its own
non-communication-related products--like a home security system, cloud
services, or music streaming--to its own customers without their prior
opt-in consent, regardless of the marketing channel used and despite
the fact that this type of first-party marketing is certainly
consistent with consumer expectations, and, indeed, with the
significant benefits consumers have received from lower bundled prices
and innovative new offerings for many years.
The FCC's overbroad opt-in proposal has the potential to stifle
innovation and competition in the online advertising marketplace and
undermine benefits to consumers. As the FTC has recognized, the ability
to effectively monetize online data has yielded astounding benefits to
consumers. But consumers presented with an opt-in notice are likely to
choose the path of least resistance. That is, many consumers will click
``no'' to avoid devoting time and energy to understanding an opt-in
request. However, when opt-in requirements are the rule rather than the
exception, and consumers take this approach in aggregate, everyone
loses out on the benefits of reduced-cost or free products and services
subsidized by the effective monetization of online data. While ISPs
rely primarily on subscription fees, limiting their ability to
effectively use customer data in turn limits a potential avenue for
reducing the cost of broadband Internet access to consumers. Consistent
with the FTC's technology-neutral approach, ISPs should be able to use
information in a manner consistent with consumer expectations and in a
way that correlates to how the rest of the Internet ecosystem provides
choice. Requiring over-inclusive opt-in consent mechanisms would unduly
restrict ISPs from participating in the same Internet marketplace the
FTC has found to provide benefits to both consumers and competition.
The FCC's NPRM also departs fundamentally from FTC guidance and
questions the core principle of customer notice and choice by
suggesting that it could be appropriate to prohibit ISPs from offering
discounted services in exchange for being able to offer targeted
marketing. Many of us may decide that the price to pay to avoid
personalized marketing is worthwhile, and so long as ISPs provide
sufficient information to enable an informed choice, consumers
themselves should be able to choose how to value their own privacy. The
FCC should not interfere with consumer choice.
The application of a broad opt-in requirement for non-sensitive
information as proposed by the FCC would create an isolated privacy
regime for ISPs that bears little correlation with consumer data
practices used in virtually every other sector. Deviating from the
FTC's privacy framework overall, but especially from the FTC's emphasis
on determining consumer choices based upon the sensitivity of the
information, the context of a consumer's interaction with a company,
and the consumer's expectations, will inevitably result in consumer
confusion over illogical, disparate standards applied to the same set
of data. Ultimately, while the FCC Privacy NPRM purports to be based
significantly on the FTC privacy framework, it is far more restrictive
in all of the above respects, without providing any clear benefits to
consumers or identifying harms it is trying to address. Rather than pay
lip service to the FTC's well-tested approach to privacy, the FCC
should actually heed the FTC's advice and harmonize the former's
privacy regime with the latter's.
Data Security and Breach Notification
The FCC's proposed data security provisions, requiring ISPs to take
reasonable measures to protect customer data, are consistent at a high
level with the approach set out in the FTC Report. However, their
prescriptive and static nature are at direct odds with the NIST
Cybersecurity Framework, which has been voluntarily adopted by a wide
swath of industry and reflects flexible and reasonable standards that
emphasize business-driven responses and solutions to cyber threats over
prescriptive regulatory measures. Specifically, the FCC should replace
its strict liability data security standard with a reasonableness
standard. In addition, these requirements should be more narrowly
tailored to apply to customer information that carries a risk of harm
in the event of a breach.
The proposed FCC breach notification rules would require ISPs to
notify consumers of a breach of a very broad new definition of
``customer proprietary information,'' much of which includes categories
of data that do not pose any risk of harm to customers in the event of
a breach, such as IP and MAC addresses and de-identified data. While
the concept of breach notification is consistent with the approach the
FTC and most states have taken, the proposed implementation by the FCC
for innocuous data and to notify only ten days after discovery of the
breach is very different and far more cumbersome.
The FTC has long supported requirements for companies to notify
consumers of security breaches in appropriate circumstances, such as
when information has been compromised that can lead to harms such as
financial loss or identity theft. The FTC has advocated that ``any
trigger for providing notification should be sufficiently balanced so
that consumers can take steps to protect themselves when their data is
at risk, while avoiding over-notification, which may confuse consumers
or cause them to ignore the notices they receive.''
The proposed rules, as currently drafted, would mandate over-
notification. As the FTC staff notes in its comments on the proposed
rules, the FCC should limit its notification requirement to a
``narrower subset of personal information than `customer proprietary
information' '' as the FCC has proposed that term to be defined in
order to avoid over-notification to consumers. As the FTC staff
asserts, ``when consumers receive `a barrage of notices' they could
`become numb to such notices, so that they may fail to spot or mitigate
the risks being communicated to them.' '' The NPRM states that the FCC
intends to avoid this outcome, but major changes are required to the
breach notification provision to achieve this goal. Otherwise, the FCC
will jeopardize, rather than enhance, data security.
The proposed rules also contain an unrealistic timeline for
customer notification, requiring ISPs to notify customers of a breach
no later than ten days after the discovery of a breach. The FTC's
Health Breach Notification Rule requires companies to notify affected
consumers ``without unreasonable delay'' and within 60 calendar days
after the breach is discovered. Under the most restrictive time
requirements among the general state breach notification laws--there is
currently a patchwork of 47 state laws--an entity is required to
provide notice ``as expeditiously as practicable and without
unreasonable delay but no later than 30 days after determination of
breach, consistent with time necessary to determine scope of the
breach, identify individuals affected, and restore the reasonable
integrity of the system,'' and with a 15-day extension granted for
``good cause shown.'' The FTC staff comments suggest an outer limit of
between 30 and 60 days, which it views as ``adequate for companies
while protecting consumers.'' When finalizing its breach notification
rules, the FCC should take these realities into consideration.
Constitutional Flaws In the FCC's Proposal
Fundamentally, the NPRM's requirements would impose a substantial
burden on speech because they would preclude ISPs from engaging in
important and relatively routine communications with their customers.
As discussed above, the NPRM would impose an opt-in consent requirement
for the use or sharing of information, including non-sensitive
information, by ISPs and their affiliates to market a broad category of
non-communications related services. While this requirement is also the
wrong policy outcome, it would prevent the type of targeted speech from
which consumers benefit, and would prevent speech which will continue
to be permitted for non-ISPs.
In order to pass constitutional muster, such a burden on commercial
speech must satisfy each element of the three-part test set out in
Central Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n, 447 U.S. 557
(1980), which asks whether (1) ``the government interest is
substantial''; (2) ``the regulation directly advances the governmental
interest asserted''; and (3) ``it is not more extensive than necessary
to serve that interest.'' Harvard Professor Laurence H. Tribe has
concluded that the NPRM fails on each prong of the Central Hudson
test.\1\
---------------------------------------------------------------------------
\1\ Laurence Tribe and Jonathan Massey, The Federal Communication
Commission's Proposed Broadband Privacy Rules Would Violate the First
Amendment, at 4 (May 27, 2016), http://www.ctia.org/docs/default-
source/defaultdocument-library/ctia-ncta-ust-file-tribe-paper.pdf.
---------------------------------------------------------------------------
First, in Professor Tribe's view, the government has not
articulated a substantial interest in restricting ISPs ability to use
customer information already in its possession, particularly where that
information is not disclosed to third parties. Second, as discussed
above, the NPRM completely ignores the fact that, even if the proposed
highly burdensome rules are imposed on ISPs, myriad edge providers will
continue to collect and share the same type of consumer information. As
Professor Swire notes in his testimony, edge providers often collect
more consumer information than ISPs and the former represent the
dominant players in the online advertising market. For this reason,
Professor Tribe has concluded that this asymmetry demonstrates that the
NPRM cannot be considered to directly advance an important governmental
interest. And third, Professor Tribe has concluded that the NPRM's
proposed opt-in rule is not narrowly tailored because a less obtrusive
opt-out rule would serve any legitimate government interest in
protecting consumers from first-party marketing.
The FCC is already familiar with the Central Hudson constraints on
the restrictions the agency may impose pursuant to Section 222 of the
Communications Act (47 U.S.C. Sec. 222). In U.S. West Communications,
Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999), the U.S. Court of Appeals
for the 10th Circuit struck down the FCC's attempt at regulations
governing Customer Proprietary Network Information (``CPNI'') with
respect to voice communications. In that case, the court determined
that the collection and sharing of CPNI among affiliates constituted
speech and that the FCC's opt-in regime did not satisfy intermediate
First Amendment scrutiny. As Professor Tribe notes, the proposals in
the NPRM ``represent a much larger burden on speech and are far less
tailored to any substantial governmental interest.'' (emphasis in
original) \2\ Because the NPRM's proposed opt-in requirement poses a
substantial burden on speech and is not tailored to any substantial
governmental interest, it is susceptible to a constitutional challenge.
---------------------------------------------------------------------------
\2\ Id.
---------------------------------------------------------------------------
Conclusion
Mr. Chairman, thank you for holding this hearing today. Our
Coalition commends you and Senator Nelson for devoting the Committee's
attention to this critically important issue. It is through the
exercise of your crucial oversight authority that Congress can right
the course of agency rulemakings that have veered away from mainstream,
practical policy goals.
In reviewing the record in the FCC's privacy proceeding, the
breadth and depth of the objections to the proposed rules are striking.
A diverse set of parties, ranging from civil rights groups, academics,
researchers, security specialists, start-ups, advertisers, ISPs,
equipment companies, software providers, IT providers, edge entities,
and other Federal agencies all raise important and substantive concerns
about key features of the FCC's proposal. Indeed, separate and apart
from ISP objections to the FCC's proposal, there is very little support
in the record for these rules from any entity that is in any way
involved in network operations, management or security, or otherwise
involved--either as an ISP or an edge provider--in providing services
to broadband consumers. The FCC's proposal is so troubling that a
number of parties that are clearly outside the scope of the proposed
rules (as well as competitors in the marketplace) nonetheless felt
compelled to submit comments due to the proposal's potentially
disruptive effects on the Internet ecosystem as a whole. I think this
is something that should give policy-makers--both here and at the FCC--
pause. And it certainly counsels against rushing ahead to adopt an
entirely new set of rules that depart so dramatically from the proven
and effective FTC framework that governed ISPs online activities prior
to reclassification.
As the FCC formalizes its privacy and data security rules, the
agency should hold ISPs to the same robust privacy standards to which
the FTC successfully held them for many years--and to which the FTC
still holds the rest of the Internet ecosystem. A truly consistent
approach will ensure a comprehensive, technology-neutral privacy
framework that provides consumers the strong protections and choices
they need and deserve, while reducing consumer confusion regarding what
protections apply. At the same time, a consistent approach will promote
the types of competition and innovation that fuel our economy. Such an
approach will also demonstrate that the United States views the FTC
approach to privacy as the preeminent model for consumer protection,
which will help provide confidence to our trading partners that their
own consumers will enjoy robust privacy protections under U.S. law.
As someone who has been involved in more than a handful of
rulemakings, it is important to point out that final rules are often
more balanced than proposed ones. But the FCC's current proposal fails
to achieve its own goals. Instead, it would create inconsistent
standards across the Internet, harm and confuse consumers, and
undermine innovation. The NPRM is of questionable constitutionality and
does not reflect a reasoned approach to consumer privacy. For all these
reasons, the 21st Century Privacy Coalition's view is that the FCC
should ensure that any rules it adopts hew closely to the FTC's time-
tested and proven approach, which is consistent with the Obama
Administration's approach to privacy and data security, and abandon its
overly prescriptive, asymmetric rules.
The Chairman. Thank you, Mr. Leibowitz.
Mr. Garfield.
STATEMENT OF DEAN C. GARFIELD, PRESIDENT AND CEO, INFORMATION
TECHNOLOGY INDUSTRY COUNCIL (ITI)
Mr. Garfield. Good morning. Chairman Thune, Ranking Member
Nelson, members of the Committee, on behalf of 60 of the most
dynamic and innovative companies in the world, we thank you for
inviting us to present at this hearing.
This hearing is both timely and important. The companies
that we represent that are members of ITI reflect the full
cross-section of the tech sector, from servers to software and
service, from social media to search. Those companies do not
fall within the ambit of the FCC's Open Internet Order and so
are not covered by the proposed rules.
We are not here to choose sides between distinct regulatory
agencies. Instead, what we present is our perspective on how to
ensure that this vibrant ecosystem remains innovative and
vibrant. I've submitted my testimony for the record, so rather
than repeat it, I would like to hone in on three things: one,
our perspective on privacy and cybersecurity; two, our views on
the flaws of the FCC's approach; and, third, a path forward.
I've chosen to focus on privacy and cybersecurity first
because for our companies, they are first principles that are
foundational. No two issues are more important to building and
retaining trust with our customers, and we treat them
accordingly. Privacy and security, by design, are not
catchphrases in the tech sector, they're truly reflective of
the commitment we place on privacy and security from the design
phase to the delivery.
The commitment of our companies to privacy and security is
complemented by a rich, robust, well-developed privacy
ecosystem that works. Jon alluded to much of it. In addition to
the work of our companies, we have self-regulatory standards.
We have the enforcement from the FTC and State attorney
generals and, importantly, constant and consistent feedback
from our companies that help to inform the approach that we
take. The problem with the FCC's approach is that it parachutes
into this rich, robust, well-developed ecosystem and assumes
that it needs to rework all of the rules whole cloth. That
presumption is faulty. For example, as Jon noted, the
definition of PII is uniquely broad and bolts onto it a binary
and rigid framework that's likely to prove unworkable. As well,
around consent and choice, the FCC proposes an opt-in approach
and to put its fingers on the thumb of the scale with no
evidence that it's likely to work more effectively for
consumers.
The FCC takes the same approach on cybersecurity, where
rather than following the leadership of the experts at NIST,
that have focused on a risk-based approach that's grounded in
standard global standards, it instead adopts an approach that's
mechanical and focused on mandates. The rules, or the proposed
rules, around data breach are reflective of that. There is
little evidence that the approach proposed by the FCC will be
more workable, and it's completely inconsistent with the
approach that's being taken at the state level today.
Our suggestion, or my testimony, should not be read to
suggest that the FCC does not have a role here. Senator Nelson,
the point you made resonates. We do not intend to suggest that
the FCC's evaluation of these issues and attempt to find
resolution of them is mistaken. What we intend to suggest is
that the approach that they've taken is one that's inconsistent
with best practices and what we know works.
And so what we suggest as a path forward is that the FCC
should take on board the comments that it's receiving, revise
the existing NPRM to one that's more consistent with the well-
established privacy and security framework that exists today,
largely guided by the FTC and NIST, and then come back with
further comments so that we end up with something and rules in
place that will help to advance the innovation ecosystem rather
than to stymie them.
I see that I have a few minutes remaining. I would just
like to really thank the folks who are sitting behind me who
are responsible for this testimony. My comments are really an
embodiment of the thoughts that they've helped us to develop.
Thank you.
[The prepared statement of Mr. Garfield follows:]
Prepared Statement of Dean C. Garfield, President and CEO,
Information Technology Industry Council (ITI)
Chairman Thune, Ranking Member Nelson, and members of the
Committee, thank you for the opportunity to testify today. I am Dean
Garfield, President and CEO of the Information Technology Industry
Council (ITI), and I am pleased to testify before your committee today
on the important topic of how the Federal Communications Commission's
(FCC or the ``Commission'') proposed broadband privacy regulations
could impact consumers and competition.\1\
---------------------------------------------------------------------------
\1\ Protecting the Privacy of Customers of Broadband and Other
Telecommunications Services, WC Docket No. 16-106, Notice of Proposed
Rulemaking, FCC 15-138 (April 1, 2016) (``Broadband Privacy NPRM'').
---------------------------------------------------------------------------
ITI shares the Commission's interest in, and respects its efforts
to, protect the privacy of consumers of broadband Internet access
services. Privacy is of paramount concern to our member companies, many
of whom are providers of information technology and Internet services,
because it is at the core of the trust relationship with our customers.
Though the FCC lacks the authority to regulate our member companies who
are the ``edge providers'' of ``over the top'' internet-based services
referred to in its Notice of Proposed Rulemaking (``NPRM''), we are
nonetheless concerned with the approach taken by the Commission in a
number of respects. We therefore welcome your interest and engagement
on this subject.
ITI is the global voice of the tech sector. We are the premier
advocate and thought leader in the United States and around the world
for the information and communications technology (ICT) industry, and
this year we are pleased to be commemorating our centennial. ITI
represents 61 of the world's leading ICT companies,\2\ and we advocate
globally for policies that advance U.S. leadership in technology,
promote innovation, open access to new and emerging markets, protect
and enhance consumer choice, and foster increased global competition.
ITI's members comprise leading technology and innovation companies from
all corners of the ICT sector, as well as companies using technology to
fundamentally evolve their businesses, including wireless and wireline
network equipment providers, computer hardware and software companies,
mobile computing and communications device manufactures, Internet and
digital service providers, and network security providers. ITI's member
companies are also at the forefront of developing next-generation
wireless communications equipment, infrastructure, networks, and
services, along with the content, applications, and new uses that will
be enhanced as mobile service evolves and advances. In other words,
many of our members are the ``edge providers'' referred to in the FCC's
proposal.
---------------------------------------------------------------------------
\2\ For more information on ITI, including a list of its member
companies, please visit: http://www.itic.org/about/member-
companies.dot.
---------------------------------------------------------------------------
Privacy is of paramount concern to our member companies. Protecting
our customers' personally identifiable information (PII) and their
privacy, along with providing robust security, are essential to earning
citizens' trust in the global technology marketplace. Innovating to
protect privacy and security and to strengthen consumers' trust in the
global digital infrastructure and Internet services are core to our
companies' business practices and philosophies. Privacy is thus
critical to our members' success, an essential component of our
businesses, and impacts our ability to grow and innovate in a future
heralding continued advances in the Internet of Things, Big Data, and
beyond. Consequently, ITI has been a leading voice in advocating
effective approaches to privacy, both domestically and globally.
The Internet has thrived--and privacy has been protected--under the
Federal Trade Commission's (FTC) approach to privacy, which is grounded
in the Fair Information Practices Principles (``FIPPs''). This
framework applies to all entities under the FTC's jurisdiction who
collect and use consumer data. We believe the FCC's primary objective
should be to closely harmonize with the existing FTC framework any
Internet Services Provider (ISP) or broadband privacy rules it
ultimately adopts. While the FCC has concluded that the regulation of
Broadband Internet Access Services (BIAS) providers is uniquely within
its purview following the FCC's decision to reclassify broadband as a
Title II service, irrespective of whether that order is ultimately
upheld in the courts, there is nothing in that decision that
necessarily warrants a departure from the FTC's successful approach to
privacy based on effective notice to consumers and a meaningful choice
as to how their data is used. Unfortunately, the FCC intends to proceed
in another direction, proposing a series of onerous privacy and data
security rules that are out of step with established policy, law, and
practice in this area.
I will focus my testimony on four areas: (1) The FCC's lack of
legal authority to regulate ITI's companies, including ``OTT'' or
``Edge'' providers; (2) the inconsistency of the FCC's proposed privacy
regulations with consumer expectations; (3) the broader inconsistency
of the FCC's proposed privacy regulations with existing privacy
authorities, frameworks and enforcement regimes, as embodied in the
FTC's well-established approach to privacy; and (4) ITI's concern that
the proposed rules will establish negative precedents that will
ultimately adversely impact consumers, businesses, and the global
policy ecosystem.
On this latter point, I will highlight our concerns regarding how
several of the specific rules proposed by the FCC are out of step with
current law and practice, including: (1) the unreasonably short and
inflexible breach notification periods; (2) the overbroad and
unnecessary definition of personally identifiable information; (3) the
overly burdensome consumer choice and consent framework; and (4) the
prescriptive, inflexible data security requirements that are misaligned
with current industry practice and Federal and state policymaking.
The FCC Lacks the Authority to Regulate ITI's Companies
By and large, ITI's companies do not offer broadband Internet
access service as a core part of their businesses, and could not be
categorized as such given the definitions for BIAS and BIAS providers
in the Open Internet Order and these proposed broadband privacy rules.
Given this, ITI's companies are not subject to the FCC's
jurisdiction under Title II, even after the FCC reclassified broadband
Internet access service as a telecommunications service under Title II,
nor is there a valid legal argument which could subject our companies
to Title II regulation under the Open Internet Order adopted last year.
The FCC specifically defines BIAS to mean ``[a] mass-market retail
service by wire or radio that provides the capability to transmit data
to and receive data from all or substantially all Internet endpoints,
including any capabilities that are incidental to and enable the
operation of the communications service, but excluding dial-up Internet
access service. This term also encompasses any service that the
Commission finds to be providing a functional equivalent of the service
described in the previous sentence, or that is used to evade the
protections set forth[.]'' The FCC defines a ``broadband Internet
access service provider'' as a person or entity engaged in the
provision of broadband Internet access service. Furthermore, the
Commission specifically notes over-the-top services and service
providers--a category into which many ITI member companies fit--are not
broadband Internet access service providers and were not captured under
the Open Internet Order nor the Broadband Privacy Notice of Proposed
Rulemaking. In fact, in the Open Internet Order the Commission went out
of its way to emphasize that while broadband Internet access service
providers may offer over-the-top services, over-the-top providers of
voice over Internet protocol, Internet protocol messaging services, and
Internet video providers are separate and distinct from broadband
Internet access providers.
There are well-founded consumer, business, and economic reasons to
rationalize why Internet and IT services providers and network
operators including broadband services providers are treated
differently from a regulatory perspective. From a consumer choice
standpoint, there are significant differences between OTT services
providers or Internet companies and BIAS providers. Consumers have
traditionally had limited choices when it comes to choosing a BIAS
provider for purposes of acquiring broadband or Internet service.
Indeed, broadband access itself is increasingly considered a
fundamental right by many--it is necessary for basic services at all
levels of government, educational opportunities, workforce
opportunities, and numerous other basic needs. Once a consumer has a
broadband connection, however, consumers can easily choose amongst many
different OTT applications and Internet service options, including
choosing to discontinue one service, switch to another service, or
subscribe to several comparable services simultaneously. And certainly,
these types of services are not considered a right; rather, inherent in
their multiplicity is the very concept of choice.
Additionally, there are significant differences between the
business and economic models of ISPs and edge service providers.
Internet companies providing content or services to consumers have
different economic interests than ISPs. For instance, consumers
typically pay for broadband services whereas much of the content and
many of the services provided to consumers over the Internet are ad-
supported and thus provided to consumers free of charge. This
relationship has not changed under the reclassification of broadband
Internet access service, nor has the legal and regulatory authority
governing that relationship. Internet companies' relationship with
their customers and the use of their customers' data has been and
remains subject to FTC enforcement.
ITI's perspective on this matter is solely driven by years of
experience in engaging with, and helping to develop, the domestic and
global privacy policy frameworks we operate under today.
The FCC's Proposed Data Privacy Rules are Inconsistent with Consumer
Expectations
As I described above, ISPs and edge providers are very differently
situated from the perspectives of consumers both in terms of how their
business models are implemented and in terms of the regulatory reach of
the FCC. The fact that there are fundamental differences between ISPs
and Internet companies and those differences have historically given
rise to different regulatory and enforcement regimes, however, does not
give license to creating data privacy rules that are inconsistent with
consumer expectations. Rather, how the FCC regulates data should be
determined by what is best for consumers, whether consumers are
suffering identifiable and quantifiable harms, and whether gaps exist
in the current regulatory and enforcement regime.
Additionally, sound privacy policy for one entity in the Internet
ecosystem should be sound policy for all others. The FCC has not made
the case to justify the type of expansive and prescriptive regulatory
regime contemplated by the NPRM--a significant departure from the
current FIPPs-based approach undertaken by the FTC.
Fundamentally, if the FCC seeks to ensure the goals articulated in
the NPRM of protecting consumer privacy, it must carefully weigh
consumer interests and expectations. Unfortunately, the proposed
regulations contain no indication that consumer interests--in
particular whether they are suffering any harm under the current
regulatory approach--demand expansive new regulations in this area.
Consumers have embraced today's thriving internet, fueled by
responsible data practices governed by the existing regulatory
framework, and they have come to expect a seamless online experience
across multiple devices that delivers convenience while also protecting
their privacy. The current online ecosystem subsidizes online offerings
that consumers value, promotes innovation, and grows the economy. There
is simply no record of consumer harm supportive of the FCC's proposal
for such restrictive regulations. In other words, the FCC's proposal
should embrace a more measured approach. Consumer expectations have
also not been factored into the FCC's analysis. Indeed, as Commissioner
O'Reilly points out in his dissent, ``there is no need for the Notice
to describe consumer expectations because it is irrelevant to the FCC's
analysis.''
The FCC's Proposed Data Privacy Rules are Inconsistent with Existing
Privacy Frameworks and Enforcement Regimes
We believe what would most benefit consumers is an approach that is
consistent with existing privacy frameworks grounded in the FIPPs and
consistent with existing privacy enforcement regimes. Consumers and
industry benefit when one agency takes the lead on privacy regulation
and enforcement because regulatory consistency permits continued
innovation without bias among sectors. The FTC has a long history of
addressing and enforcing privacy-related issues across industries.
Indeed, the FTC has shown much leadership over the years as the
enforcer on digital ecosystem issues, for both technical and legal
reasons, and it remains well-situated to provide such leadership into
the future.
Specifically, existing voluntary self-regulatory standards
supported by FTC enforcement are the appropriate tool to govern the
dynamic and interrelated online content and advertising ecosystem.
Currently, online data collection and use are governed by robust
industry self-regulatory regimes that subject the industry to the
jurisdiction of the FTC and state attorneys general. These regimes are
regularly updated to reflect new business models, which reflect the
responsible data practices so essential for the continued success of
the Internet economy. Enforceable, voluntary, self-regulatory codes
remain best suited to promote consumer privacy protections while
allowing these legitimate data practices to flourish.
Further, the FTC's enforcement authority provides effective legal
safeguards for online data practices. In addition to industry self-
regulation, the FTC robustly enforces consumer privacy and data
security standards using its authority to address ``unfair or deceptive
acts or practices'' under Section 5 of the FTC Act. The FTC has used
this authority to enforce company commitments to customers, to comply
with industry self-regulatory requirements, and to protect consumers
from harmful practices. State attorneys general typically follow FTC
positions to actively enforce similar laws at the state level. These
legal frameworks already provide consistent, meaningful consumer
protections which can apply across industries, including to the
practices the FCC now seeks to regulate. There is no need to create a
new framework such as that proposed by the FCC because the FTC has
well-established principles in this area.
Nonetheless, if the FCC is ultimately found to possess the
requisite authority to regulate broadband privacy and follows through
on its intent to do so, it should make certain that any such efforts
are consistent with existing robust privacy frameworks and enforcement
authorities, particularly those of the FTC. One way to ensure this sort
of consistency is for the FCC to work closely with the FTC to harmonize
its privacy rules for broadband ISP consumers with the framework that
protects consumers of those online businesses or services falling under
the jurisdiction of the FTC. In addition, the FCC and FTC should work
closely together to help the communities within their purview--
broadband ISPs and businesses providing service over the internet,
respectively--to clearly understand the applicable rules to enable good
faith compliance.
The FCC's Privacy Proposal is Out of Step with Current Law and
Practice, and would Establish Precedents that Will Negatively
Impact
Consumers, Companies, and the Internet Ecosystem
Rather than adopt a regime aligned with the FTC's well-established
approach to privacy, the privacy regime proposed by the FCC in the NPRM
departs from the FTC framework in significant and material respects. We
are particularly concerned that the prescriptiveness of the proposed
regulatory approach could have precedential effects that would
negatively impact the rest of the Internet ecosystem, including the
tech sector. While it is hard to say for certain what the implications
on other sectors will be if the FCC moves forward with the NPRM and
adopts standards that diverge from those the FTC has already
established for customer information, we believe the existence of
multiple sets of privacy rules will, at a minimum, send a troubling
message to governments and businesses internationally. Additionally,
I'd like to point out four specific components of the FCC's proposal
that are out of step with currently established policy and practice and
raise significant concerns for both consumers and businesses.
The Breach Notification Periods are Unreasonably Short and
Inflexible. The FCC proposes extremely short data breach notification
periods in the NPRM--entities suffering a breach would be required to
provide notice within seven days to the Commission, FBI, and Secret
Service, and within 10 days to customers (NPRM 75), without regard to
whether the breach creates a significant risk of customer harm. Such
notices would need to be provided regardless of whether a breach is
malicious or inadvertent, which is an element in determining whether a
risk of harm exists (NPRM 75).
First, the FCC's data breach proposal fails to include a risk
analysis, and therefore will contribute to notice fatigue at best or
incite unnecessary panic at worst. Additionally, the proposal fails to
account for breaches of data that are rendered not actionable through
technology, such as encryption, or for inadvertent but innocent
breaches, such as an employee accidentally opening the wrong file.
Notifying individuals that their information has been compromised is an
important step that enables them to take protective measures.
Notification to consumers, however, is not productive if all data
breaches result in notifications. If over-notification becomes
commonplace, consumers will have difficulty distinguishing between
notices and determining which ones warrant them to take action.
Notification should be made to consumers if an organization has
determined there is a significant risk of identity theft or financial
harm. Upon receipt of such a notice, consumers can then implement
measures to help avoid being financially damaged.
Second, the proposal does not afford organizations adequate time to
remediate any discovered vulnerabilities or to conduct thorough
investigations to ascertain the nature and scope of any breach before
notifying customers or government agencies of a breach of data. Unless
vulnerabilities are addressed prior to making the breach incidents
public, organizations and their customers are susceptible to further
harm by wrongdoers. Because the NPRM does not afford organizations
adequate time to investigate the scope and nature of breach incidents,
the NPRM not only encourages over-notification by organizations, but it
creates a standard of notification that would be counterproductive
should the alleged breach prove a false alarm or if the breach does not
create a significant risk of identity theft. A tremendous amount of
forensics, decision-making, and clerical and legal work is required
before ascertaining the nature and scope of a breach, assessing the
risk of harm, or in determining the appropriate form of notification
based on the organization's relationship with the effected customer.
More fundamentally, the FCC proposes to regulate breach
notification in a way that is contrary to the existing state
notification regimes and the proposals under consideration by Congress.
Recognizing the sophistication of today's hackers and the challenging
nature of a post-data breach forensic investigation, a breach
notification regime must provide realistic, flexible, and workable time
requirements. ITI has long advocated for Congress to establish a
uniform but flexible approach to data breach notification that notifies
customers where there is a significant risk of identity theft or other
financial harm. Such a uniform approach not only eases compliance
burdens for businesses, but it reduces or eliminates confusion for
consumers.
The Proposed PII Definition is Overbroad and Unnecessary. The FCC
proposes to define PII as ``any information that is ``linked or
linkable to an individual.'' (NPRM 60). This is an overly broad
definition that subsumes the entirety of the Customer Proprietary
Network Information (``CPNI'') category that the FCC proposes to expand
elsewhere in the NPRM. As a result, both the proposed PII and CPNI
definitions expansively include data elements that have never before
been considered PII under U.S. law, such as Internet protocol addresses
or other unique identifiers necessary for the functioning of connected
Internet devices, application usage data, persistent online identifiers
(cookies), and Internet browsing history--data that is highly unlikely
to contribute to a risk of concrete harm such as identity theft. (NPRM
62-63).
First, it is unclear why the Commission endeavors to define PII at
all, rather than just focusing on the CPNI data clearly within its
statutory ambit. Further, the Commission acknowledges that BIAS
providers may not actually collect all of the categories of information
included within the proposed expansive definitions, yet the FCC
proposes to regulate the collection of such data anyway. The potential
unintended consequences of these overly and unnecessarily broad
definitions are quite concerning, particularly since many of the types
of data captured by the proposed definitions are integral to providing
Internet services to consumers, including securing Internet
transactions.
Exhibiting some awareness of the potential unintended consequences
that could flow from such a broad PII definition, the FCC proposes a
number of exceptions to the definition of PII. For example, the NPRM
exempts from the definition of PII data collected by entities ``to
protect themselves or others from cybersecurity threats or
vulnerabilities.'' (NPRM 117). We are concerned this exception may
not be nearly broad enough to adequately help protect the Internet
ecosystem. To illustrate, the definition suggests that companies would
only be allowed to collect such information to counteract specific
threats. This belies the reality that some of this information, such as
unique IDs, must be collected and shared by companies as part of their
cybersecurity risk management programs in order to prevent
cybersecurity intrusions from happening. Indeed, the trajectory of
Federal policymaking in this area over the past several years has been
to encourage both continuous monitoring by organizations and the
sharing of cybersecurity threat information to counteract cyber
threats. The approach here is illustrative of the overall flawed
approach to, and treatment of, PII in the FCC's proposal.
The Proposed Consumer Choice and Consent Framework is Overly
Burdensome and Restrictive. The consent standard proposed by the FCC is
both overly burdensome and restrictive. Generally, the FCC has proposed
to restrict most collection, use, and disclosures of data with an
``opt-in'' consent standard, which it acknowledges may cause ``notice
fatigue'' for consumers (NPRM 141). The Commission further
acknowledges the ``burden of [their] proposed customer choice
framework'' on businesses, particularly on smaller entities (NPRM
151). The proposed choice framework is also out of step with current
policy and practice.
Experience shows that an opt-out or implied consent standard is an
effective mechanism to effectuate consumer privacy preferences with
respect to non-sensitive online data while allowing legitimate
practices, including advertising, to continue. We urge the FCC to
follow the FTC approach of permitting an opt-out approach for use of
consumer data in most instances, with an opt-in approach reserved for
uses of the most sensitive consumer data.
The Proposed Data Security Requirements are Prescriptive,
Inflexible, and Misaligned with Both Industry Approaches and Federal
Cybersecurity Policies. In the NPRM, the FCC proposes both general data
security requirements for BIAS providers and ``specific types of
practices they must engage in to comply with the overarching
requirement.'' (NPRM 167).
While the Commission acknowledges any proposed security
requirements must ``allow for flexibility for practices to evolve as
technology advances,'' and claims it does not propose ``to specify
technical measures for implementing the data security requirements,''
(NPRM 176), it nonetheless proposes a series of increasingly
prescriptive security requirements. For example, the Commission
proposes to not only require regular Graham-Leach-Bliley-like risk
assessments (NPRM 180) at a frequency to-be-determined (NPRM 183),
but it also asks whether the FCC should prescribe specific risk-
management requirements on BIAS providers, and how the risk assessments
themselves should be conducted. (NPRM 182) These proposed
requirements contradict existing cybersecurity public policy--such as
that embedded in the Framework for Improving Critical Infrastructure
Cybersecurity (``Cybersecurity Framework'')--that risk management is a
continuous process demanding flexibility in order to provide reasonable
protections in light of the nature and scope of the activities of a
given company, including the sensitivity of the data it handles, its
threat profile, and the size and complexity of the relevant data
operations of the company. Another example can be found in the series
of proposed specific authentication measures the Commission proposes to
prescribe (NPRM 191-200).
Indeed, the structure of the entire security section appears
contrary to many of the core concepts of risk management (e.g.,
voluntariness, flexibility, etc.) as throughout the NPRM the Commission
asks a series of ``should we require this'' and ``should we require
that'' questions. This is a fundamentally flawed approach, out of step
with the approach embodied in the Cybersecurity Framework and the
consensus standards and best practices included within. We agree with
Commissioner O'Reilly's dissenting statement that the proposed
prescriptive security rules are inconsistent with the voluntary
approach embodied in the Framework and are indeed ``alarming.''
Conclusion
Members of the Committee, ITI and our member companies are pleased
you are examining the important issue of how the FCC's proposed
broadband privacy regulations may impact consumers and competition. We
share both the FCC's and your interest in protecting the privacy of
consumers of broadband Internet access services. As noted above,
however, we are concerned with the approach taken by the Commission in
a number of respects. We have raised our concerns directly with the
Commission by submitting comments on the NPRM, urging the agency to
reconsider promulgating data privacy rules that are inconsistent with
consumer expectations or existing privacy authorities, frameworks and
enforcement regimes, such as embodied by the FTC's longstanding
approach to privacy. We appreciate the opportunity to reiterate these
concerns today, including our belief that the privacy regime proposed
by the FCC is out of step with current law and practice and would
establish precedents that will negatively impact not only consumers but
companies and the Internet ecosystem as a whole. Please consider ITI a
resource on these important issues moving forward, and do not hesitate
to contact us with any questions regarding this submission.
Thank you for the opportunity to appear before you today.
The Chairman. Thank you, Mr. Garfield.
Professor Ohm.
STATEMENT OF PAUL OHM, PROFESSOR, GEORGETOWN
UNIVERSITY LAW CENTER AND FACULTY DIRECTOR,
GEORGETOWN CENTER ON PRIVACY AND TECHNOLOGY
Mr. Ohm. Chairman Thune, Ranking Member Nelson, and
distinguished members of the Committee, it's really my
privilege to be here today to discuss a very important topic
with you. The basic principle at stake is a very old one. The
Postal Service cannot track the letters you send or open your
letters in order to sell that information to marketers. Without
your consent, your telephone company cannot track the phone
numbers you dial or listen in on your conversations in order to
sell that information to advertisers. We should have the same
rule for ISPs, and without your consent, they should not be
able to sell your reading habits and your physical location to
advertisers.
So to help protect this very old basic principle, the FCC
has proposed the rule we are discussing today. I want to say
three things about the rule. I believe it is unambiguously
authorized by law, it is a wise rule, and it is a measured
rule. Let me take those in turn.
Now that the D.C. Circuit has ruled that reclassification
of broadband service into Title II was within the power of the
FCC, it's incumbent on the FCC to elaborate what this means for
broadband providers, including rules for customer privacy. And
nobody in the debate disputes that Congress enacted Section 222
of the Telecommunications Act to obligate telecommunications
providers, such as telephone companies, to respect the privacy
of their customers. It makes a straightforward reading of the
statute to extend this obligation to ISPs as well. Because this
is a straightforward reading, the burden should be on those who
would rewrite the statute, or even worse, ask the FCC to
disregard it, rather than the agency that's merely trying to
apply it.
Number two, and I want to spend the most of the time on
this, Why is the law wise? Congress's act reflects the well-
reasoned conclusion that telecommunications providers owe a
heightened level of privacy to their customers. I've already
explained the historical antecedent for this with our Postal
Service and our telephone companies. Three other factors
support this conclusion: visibility, choice, and sensitivity.
Visibility. Your ISP sits at a privileged place in the
network. They are the bottleneck between you and the Internet.
You cannot access the Internet but by sending information
through this bottleneck, and with this privileged location,
they can be a part of every website or online destination that
you visit. For unencrypted websites, this visibility is
unparalleled, comprehensive, and complete, but even for
websites that use encryption, the ISP's view is only partially
obscured, they can see the domain names of the websites you
visit, how often you return to these websites, how much
information you exchange with these websites. It is a very,
very complete and privileged location.
Number two, choice. Most Americans today, as you well know,
do not have a meaningful choice when it comes to fixed
broadband service. The situation is specifically and especially
difficult in rural America, and I'm glad, Chairman Thune, you
raised rural America, where only 13 percent of residents have
more than one choice for high-speed fixed broadband. And even
for those Americans who do happen to have more than one choice,
switching costs make it quite difficult to switch their ISP.
Finally, sensitivity. With the visibility providers have
and given the lack of your choice for exit, your provider can
compile a detailed list of what you read, with whom you
communicate, what you say, and, increasingly, where you go. And
because storage is cheap, ISPs can record all of this vital
sensitive information about you across years and eventually
across decades. Privacy scholars have long tried to properly
come up with a metaphor to characterize what we should think
about a data base like this about every person in this room.
Some have referred to them as digital dossiers. Others have
talked about the right to intellectual privacy we ought to
enjoy. My contribution to the metaphor debate has been to
describe the database of ruin, the idea that there is now a
corporate database in the celestial cloud that contains at
least one fact about every member of our society that you would
not want your worst enemy to know.
These four factors together--history, choice, visibility,
and sensitivity--led Congress in 1996 to do what it had done
several times before. Simply put, in the American privacy law
system, when we identify a sector or a context that has unique
privacy risks like we have in telecommunications, we create a
sectoral privacy law. We did this for health information in
HIPAA, we did this for education information in FERPA, and,
indeed, we did this in Section 222 of the Telecommunications
Act.
Finally, why do I believe that the FCC proposal is
measured? Number one, the FCC proposal does not propose a ban.
You might be excused from misunderstanding that based on some
of the heated rhetoric that has come from critics of the
proposal. You are not prohibited from any conduct under this
rule. This is simply a disagreement about the type of user
consent we ought to require before your ISP can look over your
shoulder and record everything you do in order to sell it to
advertisers. The FCC decided to require prior, informed,
expressed consent before they could undertake this type of
activity. I think this is the only sensible choice. And I'm
happy to talk with you more about why during Q&A.
Last, the proposal preserves the necessary conditions for
competition by treating all providers alike. When Google
operates as a broadband provider, as it now does in Kansas City
through Google Fiber, they are required to follow the
strictures of Section 222. When Verizon acquires American
Online in order to bolster its advertising business, as it did
last year, they are no longer regulated for that activity under
Section 222. The playing fields are level.
In closing, we do not have many privacy laws in this
country. Section 222 is one of the few. And given the
powerlessness your constituents feel and all Americans feel
about this state of affairs, we ought to be bolstering and
supplementing our privacy law, not cutting back on one of the
very few that we have on the books.
Thank you again for your invitation.
[The prepared statement of Mr. Ohm follows:]
Prepared Statement of Paul Ohm, Professor, Georgetown University Law
Center and Faculty Director, Georgetown Center on Privacy and
Technology
Chairman Thune, Ranking Member Nelson, and Members of the
Committee, I appreciate the opportunity to discuss with you the Federal
Communications Commission's (FCC) proposal to protect the privacy of
the customers of broadband Internet access service (BIAS).
I am a Professor at the Georgetown University Law Center and a
Faculty Director of the Center on Privacy and Technology at Georgetown.
I specialize in information privacy, computer crime law, and technology
and the law. I make these comments to you in my independent, academic
capacity.
In 1996, Congress enacted section 222 of the Telecommunications Act
of 1996, delegating to the FCC the power to promulgate rules to protect
the information held by telephone companies and other
telecommunications providers covered by Title II of the Act. Under this
clear statutory authority, the FCC has proposed new rules requiring
BIAS providers to respect and protect the privacy of their customers,
in the wake of the agency's decision to reclassify these providers into
Title II, a reclassification recently found to be a proper exercise of
the FCC's power by a panel of the Court of Appeals for the D.C.
Circuit.
The FCC has acted appropriately and wisely. The application of
section 222 to BIAS providers represents not only a straightforward
implementation of the law but also a laudable exercise of privacy
theory and policy. I support these conclusions not only through my
academic work \1\ and the work of other scholars, but also by
leveraging the experience I have gained as a former Senior Policy
Advisor to the Federal Trade Commission (FTC) on privacy issues,
Department of Justice computer crimes prosecutor, and professional
network systems administrator.
---------------------------------------------------------------------------
\1\ This testimony builds on several articles I have written on
information privacy, most notably on Paul Ohm, The Rise and Fall of
Invasive ISP Surveillance, 2009 U. Ill. L. Rev. 1417 (2009). A full
list of my published works is available online at http://paulohm.com/
scholarship.shtml.
I have recently filed two public documents commenting on the FCC's
NPRM. See Statement of Paul Ohm Before the Subcommittee on
Communications and Technology, Committee on Energy and Commerce, U.S.
House of Representatives (June 14, 2016), available at http://
paulohm.com/projects/testimony/PaulOhm20140614FCCPrivacyRules.pdf and
Reply Comments of Paul Ohm Before the Federal Communications Commission
in the Matter of Protecting the Privacy of Customers of Broadband and
Other Telecommunications Services, WC Docket No. 16-106 (June 22,
2016), available at https://www.fcc.gov/ecfs/filing/10622254783425.
---------------------------------------------------------------------------
In this testimony, I make four points:
Section 1: The Telecommunications Act of 1996 obligates
telecommunications providers to serve as important gatekeepers
of privacy, a sensible choice then and now, one that continues
to protect important values in today's online environment.
Section 2: The proposed FCC rules will decrease overall
consumer confusion by creating a clear, bright line of privacy
protection.
Section 3: Rather than ban any behavior, the proposed rules
will create and preserve opportunities for innovation and
competition. Importantly, BIAS providers will retain the
ability to compete directly with edge providers subject to the
same privacy rules as any other company.
Section 4: There remains a significant need to strengthen
privacy rules for online actors other than BIAS providers. The
Federal Trade Commission (FTC) does not have all of the
authority or resources required to solve all online privacy
problems.
1 The Statute Treats BIAS Providers as the Gatekeepers of Individual
Privacy
Our Federal laws protect privacy on a sector-by-sector basis and in
piecemeal. The FTC Act provides an essential backstop across many
industries, but there are limits to its approach, as I will discuss
later. In narrowly circumscribed contexts, Congress has seen fit to
create heightened privacy obligations. HIPAA protects the privacy of
some health information, FERPA does the same for some education
records, and the Fair Credit Reporting Act protects some credit
reports, to name only three examples. In the same way, Congress
reaffirmed in the Telecommunications Act of 1996 (1996 Act) that
certain telecommunications providers would be subject to heightened
privacy obligations. This was a measured and appropriate choice at the
time, and it remains even more so today, even in light of
reclassification.
There are four reasons why it is essential to provide heightened
protection for the privacy of information gathered by the companies
that serve as our gatekeepers to the rest of the Internet: history,
choice, visibility, and sensitivity. Each of these reasons contributes
an answer to the question: why was Congress correct to require
communications gatekeepers to respect the privacy of their customers?
Let me elaborate each of these reasons in turn.
1.1 History
The first reason to subject BIAS providers to special privacy rules
is history. Since the dawn of intermediated communications, we have
almost always required our common carriers to respect the privacy of
what they have carried. It was so for the postal service in the
nineteenth century, the telephone service early in the twentieth
century, and parcel delivery services in more recent years. Time,
experience, and theory demonstrate why we must enact laws to create the
conditions that allow people to have faith in the privacy, security,
and confidentiality of the information and goods they entrust to
intermediaries like these.
Congress enacted privacy protections in the original Communications
Act of 1934 and restated and perhaps even broadened those protections
in the 1996 Act. We are not working from a legal blank slate. Too much
of the commentary around the FCC rules ignores the--perhaps
inconvenient for some--fact that Congress has spoken quite clearly on
this matter. The law protects what it protects, and the burden should
be on those who would rewrite the statute, not on the agency that
implements it.
1.2 Choice
It is also appropriate for Congress to protect the privacy of
information sent through a BIAS provider because of the relative lack
of choice consumers enjoy for BIAS services. Today, most people in the
United States have only a single broadband Internet service provider to
choose from.\2\ Even when there is a nominal choice, high switching
costs in the form of time, effort, hassle, and contractual lock-in make
it difficult for a privacy-sensitive consumer to change providers in
search of a more privacy-respecting alternative.
---------------------------------------------------------------------------
\2\ FCC 2016 Broadband Progress Report, 31 FCC Rcd 699
(``Approximately 51 percent of Americans have one option for a provider
of 25 Mbps/3 Mbps fixed broadband service.'').
---------------------------------------------------------------------------
1.3 Visibility
Every BIAS provider sits at a privileged place in the network, the
bottleneck between the customer and the rest of the Internet. This
favorable position gives it a unique vantage point, from which it
enjoys the ability to see at least part of every single packet sent to
and received from the rest of the Internet.
No other entity on the Internet possesses the same ability to see.
If you are a habitual user of the Google search engine, Google can
watch you while you search, and it can follow you on the first step you
take away from the search engine. After that, it loses sight of you,
unless you happen to visit other websites or use apps or services that
share information with Google. If you are a habitual Amazon shopper,
Amazon can watch you browse and purchase products, but it loses sight
of you as soon as you shop with a competitor. Habitual Facebook users
are watched by the company when they visit Facebook or use websites,
apps or services that share information with Facebook, but they are not
visible to Facebook at any other times.
When users interact with websites or use apps or devices that do
not support encryption or do not enable it by default, a BIAS
provider's ability to spy is complete and comprehensive. While it is
true that BIAS providers can view less about its users' visits to
websites that deploy encryption, it is a regrettable fact that millions
of websites, including many of the most popular ones, still do not
enable encryption by default.\3\
---------------------------------------------------------------------------
\3\ Upturn, What ISPs Can See: Clarifying the Technical Landscape
of the Broadband Privacy Debate, March 2016, https://
www.teamupturn.com/reports/2016/what-isps-can-see (reporting that more
than 85 percent of popular sites in health, news, and shopping
categories do not encrypt browsing by default).
---------------------------------------------------------------------------
Even for user visits to websites that deploy encryption, a BIAS
provider retains a significant ability to observe. When you visit a
website protected by the most widespread form of encryption in use,
https or http over TLS, even though your BIAS provider cannot tell
which individual page you are visiting on the website, it still can
tell the domain name of the website you are communicating with, how
often you return, roughly how much data you send and receive, and for
how long each visit lasts.
Compare the richness of this information to the information a
telephone company can see, which although subjected to the heightened
protection of section 222, is relatively limited by comparison. In the
1996 Act, Congress decided to impose significant limits on what
telephone companies could do with the list of numbers an individual
customer dials. This made good sense because even though this list did
not literally expose the contents of communications, it nevertheless
testified to something very private, individual, and important about
our habits and associations. The list of websites visited by an
individual (including how often and how long she visits each site) is
even more private, individual, and sensitive than those older lists of
telephone contacts.
1.4 Sensitivity
Perhaps the most important reason to protect the information a BIAS
provider can obtain is the intrinsic sensitivity of this
information.\4\ A BIAS provider can gather at least three types of
information we have long deemed sensitive: communications, reading
habits, and location.
---------------------------------------------------------------------------
\4\ See Paul Ohm, Sensitive Information, 88 S. Cal. L. Rev. 1125
(2015) (providing a detailed review of the use in privacy laws of the
concept of sensitive information).
---------------------------------------------------------------------------
Our laws have long recognized the sensitivity of our
communications. Under the Fourth Amendment, almost nothing receives the
heightened protection for privacy given to the content of our
conversations. Federal and state statutes vigorously protect both the
content of and the metadata associated with communications. We reveal
intimate portraits of ourselves through what we say to our friends,
family, and associates. A BIAS provider can readily access the content
and metadata of communications, particularly sent across unencrypted
services.
A BIAS provider can also build a fairly complete dossier of our
reading habits across time. The list of websites an individual visits,
available to a BIAS provider even when https encryption is used,
reveals so much more than a member of a prior generation would have
revealed in a composite list of every book she had checked out, every
newspaper and magazine she had subscribed to, every theater she had
visited, every television channel she had clicked to, and every
bulletin, leaflet, and handout she had read. Nobody has been able until
now to watch us read individual articles, calculate how long we linger
on a given page, and reconstruct the entire intellectual history of
what we read and watch on a minute-by-minute, individual-by-individual
basis.
Professor Neil Richards describes the right we should enjoy to
``intellectual privacy.'' \5\ He argues that the law ought to protect
vigorously the record of what we read and write. His writing supplies a
powerful and well-reasoned justification for treating BIAS providers
precisely as the 1996 Act does.
---------------------------------------------------------------------------
\5\ Neil Richards, Intellectual Privacy: Rethinking Civil Liberties
in the Digital Age (2015).
---------------------------------------------------------------------------
Finally, with the rise of mobile broadband, BIAS providers now also
track our location across time in a finely granular manner. Never
before has anybody compiled such a complete accounting of the precise
comings-and-goings of so many of us.
So much of us can be revealed to a company that compiles a finely
wrought accounting of where we have traveled, what we have read, with
whom we have engaged, and what we have said. BIAS providers might
respond that they want this information only to reduce us into
marketing categories to sell and resell. I derive no comfort from that
justification.
1.5 Privacy for All
The four reasons for holding BIAS providers to high privacy
standards--history, choice, visibility, and sensitivity--each implicate
the same, difficult question: will privacy be enjoyed by every
American, regardless of wealth or station in life, or only by America's
privileged few? For each of these factors, the need for meaningful
privacy protections for broadband customers is even stronger from the
perspective of mainstream and marginalized Americans.
For example, when it comes to visibility, some have argued that we
need not worry about the privacy threat to a given consumer from any
single ISP because the average American owns 6.1 devices and accesses
the Internet using at least three different networks: one each for
home, mobile, and work.\6\ These arguments ignore the lived reality for
the many Americans who rely on only a single smartphone with a single
connection as their lifeline to the Internet, and as a group tend to be
less wealthy, younger, and disproportionately members of minority
groups than the general population.\7\ Also, the average American
worker does not have access to a Virtual Private Network (VPN) provided
by an employer, the way some white collar workers do, and so is left
looking for clunkier, costlier alternative technologies if she wants to
shield her online activities from her provider.
---------------------------------------------------------------------------
\6\ E.g., Comments of the United States Telecom Association, WC
Docket No. 16-106 at 4; Comments of Mobile Future, WC Docket No. 16-106
at 6. These commenters uniformly rely on statistics cited in a report
by a team of attorneys from Georgia Tech and Alston & Bird, Peter
Swire, et al., Online Privacy and ISPs at 3 (May 2016) [hereinafter
Broadband for America Report].
\7\ Pew Research, Chapter One: A Portrait of Smartphone Ownership,
U.S. Smartphone Use in 2015, April 1, 2015, http://www.pewinternet.org/
2015/04/01/chapter-one-a-portrait-of-smart
phone-ownership/.
---------------------------------------------------------------------------
The problem of insufficient choice, the next factor, is
particularly stark for rural Americans, many of whom have only a single
available provider to access the network. While 44 percent of Americans
in urban areas have more than one available provider offering 25 Mbps/
3Mbps fixed broadband, only 13 percent of Americans in rural areas can
say the same.\8\ Protecting only information deemed ``sensitive'' tends
to underprotect Internet users with idiosyncratic or non-majoritarian
sensitivities, such as members of minority religions, racial or ethic
groups, or marginalized political viewpoints. Finally, history suggests
that we protect the privacy of the telephone system (and the mail
system before it) as a reflection of how important these networks are
for average Americans seeking basic access to employment, social
interaction, and benefits, which is even more true today for the
Internet. This argument weighs much more heavily for those without
stable employment or social support than for those who enjoy greater
stability, wealth, and political power.
---------------------------------------------------------------------------
\8\ FCC 2016 Broadband Progress Report, 31 FCC Rcd 699, 86
(2016).
---------------------------------------------------------------------------
We should reject arguments that would set information policy based
only on the conditions of urban and wealthier Internet users who have
relatively more (but still very little) service choice, more devices,
more connections, better access to privacy tools, and whose
sensitivities conform to society's default standards. Privacy should be
available to all.
2 The FCC's Proposed Rule Will Decrease Consumer Confusion
The FCC has proposed a simple, bright-line rule for the privacy of
information transiting a BIAS provider's network: a BIAS provider may
not use its customer's private information for purposes unrelated to
the provision of service unless and until the informed consumer
consents to those uses. The burden of communicating the purported
benefits of uses of information rests on the party best positioned to
make that case, the BIAS provider itself. This approach mirrors the
approach the law takes in other sectors where the information at stake
is especially sensitive or private, including healthcare, banking, and
education.
Contrast the straightforward nature of this proposal with the
``notice-and-choice'' background rules that apply to otherwise
unregulated online actors. Notice-and-choice regimes rest on the
fiction that Internet users read and understand the hundreds of Terms
of Service and Privacy Policy documents with which they are presented
online each year.\9\ Each one of these lawyer-drafted and densely-
worded documents sets idiosyncratic ground rules for acceptable
provider behavior for a single site or service alone. Even when
companies break their own ground rules, they cannot be held to account
unless the FTC or a state Attorney General notices, pursues, and proves
the deception or unfairness.
---------------------------------------------------------------------------
\9\ Two noted privacy experts, Aleecia McDonald and Lorrie Faith
Cranor (currently Chief Technologist of the Federal Trade Commission),
estimate that it would take the average person 244 hours per year to
read the privacy policies of all sites and apps they used. Aleecia M.
McDonald and Lorrie Faith Cranor, The Cost of Reading Privacy Policies,
4 I/S: J L & Pol Info Soc'y 540, 560 & table 7 (2008), available at
https://lorrie.cranor.org/pubs/readingPolicyCost-author
Draft.pdf.
---------------------------------------------------------------------------
This crazy cacophony is somehow the ideal framework that BIAS
providers urge the FCC to embrace, in the dubious name of reducing
consumer confusion. The FCC's proposed default rule is much simpler and
comprehensible: no unexpected uses of your information. A BIAS provider
can diverge from the default, but only if it explains to you in clear,
non-deceptive terms what it intends to do and receives your informed,
express consent. To argue that this will increase rather than decrease
consumer confusion not only defies good sense but also fails to give
the consumer his or her due respect.
3 By Allowing Data Uses with Consent, the FCC's Proposed Rule Benefits
Consumers Without Unduly Burdening Providers or Competition
In section 222, Congress made clear that covered providers could
continue to use any information they could access ``with the approval
of the customer.'' Faithfully applying this provision, the FCC proposes
to allow any uses of information after prior customer consent. Neither
Congress nor the FCC has enacted or even proposed a ban on uses of
information, although you might think otherwise based on the
characterizations of many of the covered providers.
Put plainly, this debate is not about prohibiting conduct. Stripped
of this confusion, this is simply a disagreement about the type of user
consent we ought to require for conduct that at least some consumers
find objectionable. In my reply comment to the FCC, I pointed out that
the difference between the proposed opt-in rule and an alternative opt-
out rule is not nearly as stark a difference as some have stated.\10\
Recent research suggests that companies in other industries subjected
to opt-in requirements have managed to convince large numbers of users
to choose to opt in.\11\ I do not doubt that BIAS providers will try to
replicate these results.
---------------------------------------------------------------------------
\10\ Reply Comments of Paul Ohm Before the Federal Communications
Commission in the Matter of Protecting the Privacy of Customers of
Broadband and Other Telecommunications Services, WC Docket No. 16-106
(June 22, 2016), available at https://www.fcc.gov/ecfs/filing/
10622254783425.
\11\ Id. citing Lauren E. Willis, When Nudges Fail: Slippery
Defaults, 80 U. Chi. L. Rev. 1155 (2013).
---------------------------------------------------------------------------
The new rules also preserve other level playing fields to
facilitate unburdened competition. BIAS providers like Verizon or
Comcast can acquire (and have acquired) edge provider services such as
content publishers, search engines, and social networking sites. A BIAS
provider that launches or acquires a search engine will be able to use
the information it takes from its search engine customers in the
relatively unrestricted manner the law currently provides for that
industry. Likewise, if a traditional edge provider like Google creates
or acquires a broadband Internet service, such as the Google Fiber
service, it will fall for those purposes within Title II of the
Communications Act and thus be subject to the FCC's privacy rules. In
either case, any two companies competing in the same market will be
subjected to precisely the same rules under precisely the same terms.
4 The Need to Enhance Privacy in Other Contexts
Of course, the FCC's new privacy rule will not solve all of the
privacy problems we face. We need to raise our privacy standards across
other parts of the online ecosystem as well. We ought to increase the
resources we provide to the FTC and enhance its power to police
deceptive and unfair privacy practices. We also ought also to consider
imposing new and more stringent rules for industry segments striving to
develop the kind of pan-Internet view that BIAS providers structurally
enjoy or that handle vast amounts of sensitive information, as BIAS
providers do.
4.1 The FTC Cannot Go It Alone
It was my privilege to serve the FTC as a Senior Policy Advisor on
privacy issues from 2012 to 2013. I was convinced during my service and
continue to feel today that the FTC has become an important bulwark of
privacy in a tumultuous time of change. We should view the FTC as the
irreducible floor of online privacy protection, and we should do what
we can to give the FTC additional resources to raise that floor.
But the FTC simply cannot go it alone. The rise of the FTC as a
capable and well-respected privacy regulator does not mean we should
dismantle sectoral privacy regulation. The FTC's jurisdiction and
enforcement activity cannot supplant the Department of Health and Human
Service's role under HIPAA, the Department of Education's role under
FERPA, or the Consumer Financial Protection Bureau's role under
numerous financial privacy laws. Likewise, the fact that the FTC has
been very active and successful policing privacy online does not mean
we should discourage the FCC from protecting privacy under Section 222
using its distinctive approaches and capabilities.
For all of the amazing strides the FTC has taken to become an
expert in online data collection, the FCC has had a much longer time to
develop expertise in the protection of network access subscribers. With
this head start, the FCC has unparalleled experience ensuring that the
Nation's communications networks function in a way that is reliable and
trustworthy and crafting regulations that promote the buildout of
networks. Nobody has more experience and staff expertise on these
matters than the FCC.
Moreover, the FCC's clear statutory mandate in Section 222 is
specific and proactive, in contrast to the FTC's mandate in Section 5
of the FTC Act, which is far more general and reactive. Fortunately,
these two mandates work together, as nothing in the proposed FCC rule
will subject any company to conflicting FTC rules and vice versa. It is
to the credit of the staff of these two agencies that they have entered
into a Memorandum of Understanding committing to work together in their
common privacy endeavors.
4.2 The Need to Strengthen Other Privacy Laws
As I have argued above, it is a combination of history, choice,
visibility, and sensitivity that justifies subjecting BIAS providers to
the same kind of special privacy rules we have enacted for doctors,
schools, credit agencies, and other industries. A sectoral approach to
privacy law continues to be a desirable approach.
It is true that other online entities are beginning to rival BIAS
providers on at least some of these critical dimensions.\12\ Other
entities traffic in location information, a category Congress ought to
consider protecting as especially sensitive. Social networking sites
carry exceptionally sensitive information and exhibit network effects
and insufficient data portability that limit customer choice and exit.
Finally, advertising networks strive to attain a BIAS-provider-like
visibility across the Internet.
---------------------------------------------------------------------------
\12\ Peter Swire, et al., Online Privacy and ISPs (May 2016).
---------------------------------------------------------------------------
Congress should examine whether any other industry segment has
implicated individual privacy along these dimensions so much that they
have begun to rival doctors, schools, credit agencies, or BIAS
providers. But once it identifies such an example, the answer will not
be to decrease privacy law across industries, the answer will be to
enact another new, measured and narrow sectoral privacy law, perhaps
one modeled on the FCC's rules.
5 Conclusion
Given the deep concern many of your constituents feel about their
lack of control of information about them; given the calls and e-mails
you no doubt receive after every significant data breach or other
privacy debacle; given the survey after survey which bear witness to
the breadth and depth of concern American citizens have about this
state of affairs; and given the critical importance of an Internet we
can trust for commerce, communications, and innovation, this is not the
time to roll back one of the very few privacy protections we have for
online activity. We should be strengthening not weakening the privacy
of online activity. All American Internet users owe owe our thanks to
Congress and the Federal Communications Commission for taking modest,
sensible, and legally authorized steps toward enhancing the protection
we enjoy.
The Chairman. Thank you, Professor Ohm.
Mr. Polka.
STATEMENT OF MATTHEW M. POLKA, PRESIDENT AND CEO, AMERICAN
CABLE ASSOCIATION
Mr. Polka. Thank you, Chairman Thune, Ranking Member
Nelson, and members of the Committee, for inviting me to
testify about the Federal Communications Commission's proposed
privacy regulations and their effect on consumers and
competition. Today I would like to focus on four essential
points.
First, American Cable Association members are already
subject to a host of privacy and data security obligations,
take those obligations seriously, and have an excellent track
record of compliance. We, too, are consumers and so understand
the need for privacy protections.
Second, to best serve the interests of broadband consumers,
the FCC should adopt a privacy and data security regime that is
consistent with the FTC's framework. It has proven valuable and
workable for all interests.
Third, we fear that the FCC's proposed privacy and data
security rules would impose needless, unduly burdensome
obligations on smaller broadband providers, chilling investment
and innovation, all with little consumer benefit.
And fourth, should the FCC nonetheless proceed and adopt
rules in line with its proposals, it should ease the burden on
small broadband providers by providing tailored exemptions,
extending compliance deadlines, and streamlining its rules.
The American Cable Association represents 750 smaller cable
operators, incumbent telephone companies, municipal utilities,
competitors, and other local providers which offer service in
all 50 States. Eighty percent of our members serve fewer than
5,000 customers. Fifty percent serve fewer than 1,000. Most
have 10 or fewer employees and cannot afford to dedicate
employees solely to regulatory compliance.
As I said at the outset, ACA members must comply, and have
complied, with numerous privacy and data security obligations,
several of which were the work of this committee. These two
longstanding provisions include the Communications Act, Section
631, for cable services enacted in 1984, and Section 222, the
Consumer Proprietary Network Information rules, also known as
CPNI, for voice and now broadband services, enacted in 1996.
These also include Section 5 of the Federal Trade Commission
Act for non-common carrier services and the laws of the states
where providers operate. Complying with all of these
requirements imposes a significant burden on smaller providers,
but ACA members understand their duty and their legal
obligations to protect the confidentiality of their customers'
information.
Because ACA members are subject to so many time-tested
privacy and security obligations, they had hoped that the FCC,
in crafting CPNI regulations to cover broadband, would have
proposed a regime consistent with requirements already on the
books. In fact, ACA joined with other industry organizations
last year to present to the FCC a privacy framework that would
promote the goals of transparency, choice, data security, while
retaining consistency with the FTC's framework.
Our privacy proposal would protect consumers and equally
regulate all participants in the Internet ecosystem. It would
also enable smaller providers to comply without undue burdens.
Unfortunately, the FCC insisted on blazing an entirely new path
by proposing novel, complex, and overly burdensome
requirements. In comments filed recently with the FCC, the
Small Business Administration's Office of Advocacy said that
smaller providers will be subject to onerous obligations.
In our view, these obligations would chill investment and
innovation while providing uncertain consumer benefits. Even
more importantly, these rules would apply only to broadband
providers, a mere subset of players in the Internet ecosystem.
This would lead to customer confusion as well as distort the
market through asymmetric regulation. The FCC should revise its
approach, reassess the costs and benefits of its proposal, and
seek to blend it with the FTC's approach.
In closing, ACA members have spent decades protecting their
customers' privacy and data security. As the FCC moves to craft
new rules for broadband, we seek to bring to bear our
experience and the previous efforts of this committee and other
government bodies to build a sound and lasting regulatory
regime. And we promise to continue our efforts to develop a
solution that works for all.
Thank you.
[The prepared statement of Mr. Polka follows:]
Prepared Statement of Matthew M. Polka, President and CEO,
American Cable Association
Thank you, Chairman Thune, Ranking Member Nelson, and Members of
the Committee, for inviting me to testify on behalf of the American
Cable Association (ACA) and its members about the steps we are taking
to protect the privacy and security of our customers' personal
information and our thoughts on the Federal Communications Commission's
(FCC's or Commission's) proposed privacy and data security rules for
broadband Internet access service (broadband service).
In my testimony, I will focus on four points. First, ACA members
are already subject to a host of privacy and data security obligations,
take those obligations seriously, and have an excellent track record of
compliance. Because they too are consumers, ACA members understand
consumers' expectations and the need for privacy protections. Second,
to best serve the interests of broadband consumers, the FCC should
adopt a privacy and data security framework that is consistent with the
Federal Trade Commission's (FTC's) approach, which has proven valuable
and workable for all interests. Third and most unfortunately, we fear
that the FCC's proposed privacy and data security rules would impose
needless, unduly burdensome obligations on smaller broadband providers,
chilling investment and innovation, all with little consumer benefit.
And finally, if the FCC nonetheless proceeds and adopts rules in line
with its proposals, it should ease the burdens on small providers by
providing tailored exemptions, extending compliance deadlines, and
streamlining its rules.
I. Background on ACA's Members
ACA represents approximately 750 small and medium-sized cable
operators, incumbent telephone companies, municipal utilities, and
other local providers, which provide service in all fifty states. ACA
members provide a variety of services to their residential and business
customers, including voice, cable service, broadband, and various non-
common-carrier services, such as home security, PC support, e-mail, and
data center services. Eighty percent of ACA members serve fewer than
5,000 subscribers, and roughly fifty percent serve fewer than 1,000
subscribers. Half of ACA's members have ten or fewer employees, with
typically just one or two engineers or individuals with technical
expertise, and these employees perform many duties within their
companies. Few have in-house personnel dedicated to privacy and data
security compliance. Yet, they take all necessary steps to comply with
today's regulatory mandates, even though it is a challenge and cuts
into their ability to upgrade systems and to offer new products and
services.
Consequently, ACA urges Congress and the Commission to continue to
seek to balance actions that would impose new obligations with the
resource capabilities of smaller providers. Skewing that balance
against broadband providers--as the Commission proposes to do--imperils
investments in high performance networks and information services so
critical for consumers and our economy.
II. ACA Members Are Already Subject to A Host of Privacy and Data
Security Rules, Take Those Obligations Seriously, and Have
an Excellent Track Record of Compliance
ACA members must comply and have complied with numerous privacy and
data security obligations, several of which were the work of this
Committee. ACA members that provide cable service must comply with
Section 631 of the Cable Communications Policy Act of 1984 (the Cable
Act).\1\ ACA members that provide voice services--whether traditional
circuit-switched voice or interconnected voice over Internet Protocol
(VoIP)--must comply with Section 222 of the Communications Act of 1934,
and its implementing rules related to customer proprietary network
information (CPNI).\2\ ACA members that provide broadband service must
comply with the FCC's transparency rule (which requires disclosure of
privacy policies), and since the 2015 Open Internet Order, the FCC has
asserted that they must comply with Section 222 (notwithstanding
ongoing challenges to the agency's authority to do so). ACA members
that provide non-common-carrier information services, a term which
until recently applied to broadband service, must also comply with
Section 5 of the Federal Trade Commission Act, which prohibits ``unfair
or deceptive acts or practices,'' including those related to privacy
and data security. Further, our members are subject to the laws and
rules of the states in which they operate, including but not limited to
data breach notification laws.\3\ In addition, to the extent that they
interact with institutions handling sensitive information such as
banks, hospitals, and schools, they often must assume obligations--by
statute, rule, or contract--to protect such information.
---------------------------------------------------------------------------
\1\ Cable operators have been subject to Section 631 for over 30
years. Section 631 includes a robust set of requirements, including
annual subscriber notices, a customer consent framework, access rights,
and a private right of action.
\2\ Section 222 and its implementing rules are designed to protect
the confidentiality of individually identifiable CPNI, a narrow
category of information that includes information about a customer's
use of the network (e.g., call detail records) and information
contained within customer bills. The CPNI rules include a three-tiered
notice and consent regime, data security safeguards, a breach
notification rule, and annual certifications. Beginning in 2014, the
FCC began to read Section 222 more broadly to protect ``customer
proprietary information,'' a category of information that according to
the FCC includes both CPNI as well as all personally identifiable
information. ACA and others have challenged the Commission's broad
interpretation of the statute as unlawful.
\3\ Every state has a law prohibiting deceptive practices, and most
have laws prohibiting unfair practices, similar to the FTC's Section 5
prohibition. See, e.g., Conn. Gen. Stat. Sec. 42-110b(a); Fla. Stat.
Ann. Sec. 501.204; Mass. Gen. Laws Ch. 93A, Sec. 2(a); S.D. Codified
Laws Sec. 37-24-6(1). Further, 47 states have enacted data breach
notification laws. See, e.g., Conn. Gen Stat. Sec. 36a-701b; Fla. Stat.
Sec. Sec. 501.171, 282.0041, 282.318(4)(j)(1); Mass. Gen. Laws
Sec. 93H-1 et seq. Moreover, several states have enacted additional
privacy and data security requirements. See, e.g., Fla. Stat.
Sec. 501.171; 201 CMR 17.00. For example, Massachusetts requires
companies to ``develop, implement, and maintain a comprehensive
information security program that is written in one or more readily
accessible parts and contains administrative, technical, and physical
safeguards,'' with granular requirements that every such information
security program must include. See 201 CMR 17.00.
---------------------------------------------------------------------------
Complying with all of these privacy and data security laws is a
significant burden for smaller providers, but they understand their
responsibilities and have taken the necessary steps to ensure they
comply. ACA members notify their subscribers of their privacy practices
through welcome packages, annual notifications, and website privacy
policies. Our members also provide opportunities for customers to make
choices about how service providers use or share their information and
give all the necessary information to make an informed choice. They
also understand the importance of effective personnel training, as well
as the need to ensure that agents and independent contractors--e.g.,
billing and customer service companies--protect the confidentiality of
customer information.
ACA members employ reasonable physical, technical, and
administrative data security practices to protect against breaches of
customer information. For example, ACA members have established robust
authentication requirements, such as password protection for access to
customer information or, for small-town providers, requiring customers
to authenticate themselves in person with proper identification. In
addition, our members are responsible in their duties to comply with
the recordkeeping and reporting obligations of the FCC's existing
privacy and data security rules, including obligations to keep records
of customer approval status and marketing campaigns, as well as annual
certification obligations. We have been active in the FCC's
Communications Security, Reliability and Interoperability Council
Working Group IV proceeding, which is intended to assist companies with
implementing voluntary cybersecurity measures for the communications
sector that respect the unique challenges that small and medium-sized
providers face.
The privacy and data security actions described above and others
that smaller providers undertake do not exist in a vacuum--they are
just one part of an increasingly complex web of legal and regulatory
obligations with which providers must comply, including law
enforcement, disabilities access, copyright, emergency alert service,
universal service, and open Internet obligations, as well as a variety
of state and local regulations.
ACA members have an excellent track record in protecting the
confidentiality of their customers' information and complying with
privacy and data security laws and rules. Indeed, in the decade during
which the FTC exercised its authority over broadband providers--
conducting innumerable investigations and actions against companies
related to privacy and data security--we are not aware of a single
action against a smaller broadband provider for the sorts of privacy
and data security practices that the FCC seeks to regulate pursuant to
its proposals. Such a long run free of major incidents reinforces the
view that a new and more intrusive privacy and data security regime is
not needed to protect consumers.
III. To Best Serve the Interests of Broadband Consumers, the FCC Should
Adopt a Privacy and Data Security Framework That Is Consistent
With the FTC's Approach, Which Has Proven Valuable and Workable
for All Interests
Until the FCC classified broadband service as a Title II
telecommunications service in the 2015 Open Internet Order, all
industry participants in the Internet ecosystem were subject to the
jurisdiction of the FTC. The FTC's approach combines a flexible
statutory provision--Section 5 of the FTC Act--with heightened
obligations for limited categories of sensitive information (e.g.,
children's information, health information, or financial information).
As such, the FTC's approach has at its core the concepts of
flexibility, context specificity, and technological neutrality. This
framework has enabled the Internet ecosystem to flourish to the benefit
of consumers, edge providers, and broadband providers alike. Further,
by avoiding hyper-prescriptive rules and focusing instead on the
reasonableness of providers' practices and the truthfulness and
completeness of their representations to their customers, the FTC's
framework lessens the compliance burdens on smaller providers.
In contrast, the FCC proposes to cleave the Internet ecosystem in
two by subjecting one set of participants--broadband providers--to a
different and more burdensome privacy and data security regime, while
another set--including edge providers--remain subject to the FTC's
approach. The FCC is proposing these rules despite the fact that the
large edge providers can know more about a user's activity and, unlike
broadband providers, often employ business models that depend on the
collection, use, and sharing of their customers' personal information.
For smaller broadband providers, which lack scale, such business models
are rarely in our members' strategic plans.
In advance of the FCC issuing its proposals, ACA and several trade
associations proposed a framework that would protect consumers and
promote the FCC's goals of transparency, choice, and data security
while retaining consistency with the FTC's framework. Such an approach
would protect consumers and avoid entity-based regulation that would
create consumer confusion and stifle innovation. Consumers expect their
data will be subject to consistent privacy standards based upon the
sensitivity of the information and how it is used, regardless of which
entity in the Internet ecosystem uses that data. Indeed, FTC staff has
stated that ``any privacy framework [for broadband providers, operating
systems, browsers, and social media] should be technology neutral,''
and has argued that the FCC's failure to propose a consistent privacy
regime is ``not optimal.''
We recommended that to maintain consistency with the FTC's
framework, the FCC should adopt rules based on the following
principles:
Transparency. A broadband (telecommunications service)
provider should provide notice, which is neither deceptive nor
unfair, describing the CPNI that it collects, how it will use
the CPNI, and whether and for what purposes it may share CPNI
with third parties.
Respect for Context and Consumer Choice. A broadband
provider may use or disclose CPNI as is consistent with the
context in which the customer provides, or the provider
obtains, the information, provided that the provider's actions
are not unfair or deceptive. For example, the use or disclosure
of CPNI for the following commonly accepted data practices
would not warrant a choice mechanism, either because customer
consent can be inferred or because public policy considerations
make choice unnecessary: product and service fulfillment, fraud
prevention, compliance with law, responses to government
requests, network management, first-party marketing, and
affiliate sharing where the affiliate relationship is
reasonably clear to consumers. Consistent with the flexible
choice mechanisms available to all other entities in the
Internet ecosystem, broadband providers should give consumers
easy-to-understand choices for non-contextual uses and
disclosures of their CPNI, where the failure to provide choice
would be deceptive or unfair. The provider should consider the
sensitivity of the data and the context in which it was
collected when determining the appropriate choice mechanism.
Data Security. A broadband provider should establish,
implement, and maintain a CPNI data security program that is
neither unfair nor deceptive and includes reasonable physical,
technical, and administrative security safeguards to protect
CPNI from unauthorized access, use, and disclosure. Providers'
CPNI data security programs should provide reasonable
protections in light of the nature and scope of the activities
of the company, the sensitivity of the data, and the size and
complexity of the relevant data operations of the company.
Data Breach Notifications. A broadband provider should
notify customers whose CPNI has been breached when failure to
notify would be unfair or deceptive. Given that breach
investigations frequently are ongoing at the time providers
offer notice to customers, a notice that turns out to be
incomplete or inaccurate is not deceptive, as long as the
provider corrects any material inaccuracies within a reasonable
period of time of discovering them. Broadband providers have
flexibility to determine how and when to provide such notice.
Our proposal would meet consumers' privacy needs while allowing
them to take advantage of products and services they expect from their
service provider and would avoid inconsistent and burdensome oversight.
Moreover, it would ensure a level playing field between edge providers
and broadband providers, promoting an innovative and competitive
broadband ecosystem.
Our proposal also would improve the ability of smaller providers to
comply without incurring undue costs or other burdens. As I explained
earlier, smaller providers work to ensure that they use customer
information consistent with their customers' expectations. Since these
providers are already familiar with the FTC framework, they would not
have to incur material additional costs to bring their policies,
processes, and systems into compliance if the FCC adopts rules
consistent with this framework.
Our proposal also is superior because the consumer choice
provisions align with consumer expectations by respecting the context
of customer-carrier interactions. This will enable small providers to
offer new and innovative services to their customers, increasing
consumer choice and competition.
The data security rule in our proposal also contains a robust
general security standard that requires ``physical, technical, and
administrative'' security safeguards while including the size of the
company as a factor in determining whether particular safeguards are
reasonable. As such, in the event that smaller providers grow, the
rules will require more sophisticated processes commensurate with their
larger operations. Additionally, our framework enables the FCC to
establish best practices through multi-stakeholder processes.
Finally, our proposed data breach notification rule is superior to
the FCC's proposed rule because it provides flexible deadlines that
will not overburden small providers and a safety valve for good faith
disclosures so that small providers can avoid counterproductive strict
liability enforcement actions associated with inflexible and overly
prescriptive regimes.
IV. The FCC's Proposals Would Needlessly Impose Unduly Burdensome and
Costly Restrictions on Small Providers, Chilling Investment and
Innovation With Minimal Additional Consumer Benefit
The FCC proposes a set of privacy and data security rules that, if
adopted, would be one of the most complex in the United States. Let me
highlight just some of the new notice, customer approval, data
security, and data breach notification obligations the FCC proposes to
impose on smaller broadband providers.
Proposed Notification Rules. The proposed notification rules
would prescribe, in minute detail, when, where, how, and how
often providers must notify their subscribers about their
privacy and data security practices, which would require
smaller providers incur legal costs to draft and update privacy
notices, administrative costs to deliver the notices, and
technical costs to post the notices ``persistently'' on the
provider's website, mobile app, and any functional equivalent.
Proposed Customer Approval Rules. The proposed customer
approval rules would replace the long-standing, context-
specific, and consumer-friendly opt-out regime of the FTC with
an incredibly complex and restrictive three-tiered framework
that would erect unnecessary barriers to collecting, using, or
sharing customer information by requiring opt-in consent in
many situations that are well within consumer expectations.
Proposed Data Security Rules. The proposed data security
rules would replace the FTC's reasonable security standard with
a general strict liability rule requiring providers to
``ensure'' the confidentiality, security, and integrity of
customer information, irrespective of the sensitivity of that
information and ignoring the fact that most agencies recognize
that there is no such thing as perfect security. The proposed
data security rules also would impose exacting operational
requirements on broadband providers, such as: requiring regular
risk management assessments; appointing ``senior officials'' to
oversee providers' privacy and data security practices;
implementing third party oversight mechanisms; and conducting
training for personnel, agents, and affiliates.
Proposed Data Breach Notification Rules. The proposed data
breach notification rules would impose a strict, seven-day
turnaround time from discovery of the breach to notify the FCC
and law enforcement about any data breach, and a ten-day
turnaround for notifying affected customers, regardless of
whether the breach was intentional or whether consumer harm is
reasonably likely. The result of this proposed breach
notification rule will be over-notification, often including
incomplete or evolving facts, which will confuse consumers,
breed unnecessary distrust in the Internet ecosystem, and work
to undermine the ``virtuous circle'' of demand for Internet
services, deployment of broadband infrastructure, and
innovation.
Unlike the existing CPNI rules, the proposed rules would not be
limited to ``customer proprietary network information''--the narrow set
of information that Section 222 was drafted to address--but rather
would apply to all ``customer proprietary information,'' a broad,
amorphous term that appears nowhere in the Communications Act and
covers everything from the make and model of a user's modem to an
individual's public demographic information. Further, unlike the
existing CPNI rules, the proposed rules would apply to all past,
present, and prospective customers of a broadband provider. The FCC
even seeks comment on whether to expand the definition of customer to
include minors, members of a group plan, or other individual users who
can access a shared account. By extending the universe of covered
information and individuals, smaller providers will need to manage
significantly more information, dramatically increasing the costs and
burdens of compliance.
To meet all of these new, extensive obligations, smaller broadband
providers would need at least to:
Develop and implement new data security controls, website
policies, and customer approval tracking systems;
Hire and train dedicated privacy and data security staff;
Provide additional customer notices, including data breach
notifications that would increase customer confusion and
``notice fatigue'';
Retain attorneys and consultants for such activities as
regulatory analysis, contract negotiation, risk management
assessments, and preparing required policies, forms, training,
and audits;
Ensure compliance for call centers, billing software, and
others that interface with customer proprietary information;
and
Divert scarce resources from innovation and infrastructure
deployment to regulatory compliance.
These new costs would be most burdensome for smaller providers,
decreasing their ability to innovate, upgrade systems, and compete
while increasing costs, confusion, and inconvenience for their
customers. Indeed, the Office of Advocacy for the Small Business
Administration (SBA) told the FCC that its ``proposed rules will be
disproportionately and significantly burdensome for small Broadband
Internet Access Service (BIAS) providers,'' arguing that ``the FCC
failed to comply with the [Regulatory Flexibility Act's] requirement to
quantify or describe the economic impact that its proposed regulations
might have on small entities,'' and ``[t]he FCC has provided no
estimate of the paperwork hours required to comply with the
regulations.''
V. If the FCC Adopts Its Proposed Rules, It Should Take Steps to Ease
the Burden on Smaller Providers Through Exemptions to the More
Onerous Elements of the Rules, Extensions of the Applicable
Compliance Deadlines, and Streamlined Regulations
If the FCC rejects our proposal in favor of its prescriptive, ex
ante privacy and data security framework, it should, consistent with
similar privacy regimes:
Exempt smaller providers from prescriptive specific data
security requirements (while maintaining a flexible general
data security standard) and add ``the size of the BIAS
provider'' to the factors that the FCC must consider when
assessing the reasonableness of a BIAS provider's security
program;
Exempt smaller providers from the more onerous elements of
its customer approval framework by grandfathering existing
customer consents and exempting smaller providers from the
requirement to obtain additional approval where they do not
share sensitive personal information with third parties for
marketing purposes;
Exempt smaller providers from several elements of the FCC's
proposed data breach notification rule (as applied to voice and
broadband services) by exempting smaller providers from the
specific notification deadlines in favor of an ``as soon as
reasonably practicable'' standard; and
Exempt smaller providers from any customer dashboard
requirements that it adopts pursuant to its notice and choice
regulations.
These exemptions address and reduce the burdens that the proposed
privacy rules would have on smaller providers, and align with the SBA
Advocacy Office's request that the FCC adopt ``exemptions for small
BIAS providers wherever practicable.''
The FCC also should extend the deadlines for smaller providers to
comply with any new privacy and data security rules by at least one
year beyond any general compliance deadline (i.e., the date at which
larger providers must comply with the rules). The FCC should commit to
initiate a subsequent rulemaking together with or immediately after any
order that results from this proceeding to determine whether to further
extend the deadline and/or establish additional exemptions, and should
further commit to rule on whether to extend the deadline or establish
additional exemptions prior to the expiration of the general compliance
deadline. The FCC often has extended effective dates for small entities
in the context of its consumer protection regulations, including: (1) a
three-year waiver for certain analog-only cable systems to comply with
the emergency information rule; (2) a two-year delay to comply with the
User Guide Requirements of the FCC's accessibility rules; (3) a one-
year extension of the compliance deadline for the FCC's open Internet
enhanced transparency rule, which it subsequently extended for another
year; and (4) a six-month extension to implement requirements of the
2007 CPNI Order.
Moreover, the FCC should rationalize and streamline its proposed
rules to ensure that they are not too burdensome for smaller broadband
providers by:
Developing, with industry and other stakeholders,
standardized notices with safe harbor protection that small
providers can use to reduce enforcement risks, as well as the
need to pay for outside counsel, consultants, and developers;
Streamlining its proposed customer approval requirements to
better align with consumer expectations and avoid disrupting
existing customer relationships;
Adopting a general data security standard and working with
industry to establish and update best practices rather than
imposing prescriptive data security rules;
Tailoring any data breach notification requirements to ease
burdens on broadband providers, including by adopting flexible
deadlines for breach notification, limiting notifications to
situations where consumer harm is reasonably likely, creating a
one-stop-shop for breach reporting, and preempting state breach
notification laws; and
Harmonizing its rules within Section 222, but not across
statutory provisions including Section 631 of the Cable Act,
which would undermine consumer expectations and would upend
providers' existing compliance regimes.
While a suite of extensions, exemptions, and rationalized rules
would not be as effective as adopting rules consistent with the FTC
framework, it would address the concerns of smaller providers and many
others in the record--including the SBA--that the FCC's proposed rules
go too far without adequately considering the burdens of its proposals
on smaller providers.
ACA members have a strong record of protecting consumer data and
complying with myriad state and Federal privacy and data security laws.
Based on this experience, we urge the Commission to adopt the time-
tested privacy framework employed by the FTC. It has proven valuable
for consumers and imposes important but reasonable obligations on
smaller broadband providers. We look forward to working with the
Committee and the Commission as this process moves forward.
The Chairman. Thank you, Mr. Polka.
Next up is Professor Swire. And I apologize, I
mispronounced your name----
Mr. Swire. It's happened before.
[Laughter.]
The Chairman.--during my introduction. That was from me not
wearing these (referencing glasses). But, Professor Swire,
please proceed.
STATEMENT OF PETER SWIRE, HUANG PROFESSOR OF LAW AND ETHICS,
SCHELLER COLLEGE OF BUSINESS, GEORGIA INSTITUTE OF TECHNOLOGY
Mr. Swire. Thank you, Chairman Thune, and Ranking Member
Nelson and members of the Committee. And thank you for the
opportunity to testify today on the FCC's proposed privacy
rule. As you said, my name is Peter Swire, not Swine. I teach
at George Tech.
Today I'm testifying about a major research project that my
co-authors and I issued this year called ``Online Privacy and
ISPs.'' It's 125 pages. It has pretty color illustrations. We
tried to set out the facts for how this stuff works. Before our
report came out, many of those supporting stronger privacy
rules signed a letter stating that ISPs, ``have a comprehensive
view of consumer behavior,'' and they said, ``that ISPs have a
unique view in the online ecosystem because they connect the
users to the Internet.''
And our report documented two factual findings. First, ISP
visibility into consumer online information is far from
comprehensive and will likely continue to decline, and the
biggest reason is the huge growth in encryption.
Second, ISPs appear to lack unique insights into users'
Internet activity. The biggest reason is that the data the ISPs
see is generally not as detailed and insightful as that
available to others in the Internet ecosystem. These two
conclusions are surprising to many people on first encounter
for understandable reasons based in history, but the facts have
changed over time and will continue to do so.
My own work here began when the FCC invited me to testify
over a year ago at their workshop on broadband consumer
privacy. That day, the debates were about comprehensive and
unique access, and I believe getting more facts would be
useful.
I'll say just a word about my own role in this discussion.
During 2009 and 2010, I worked in the White House on the
National Economic Council. As part of that job, I signed what
is sometimes called the ``Obama Pledge,'' I will not engage in
any lobbying of Federal officials while President Obama is in
office. As a consequence, all of my writing about this privacy
rulemaking has been factual, and I do not and have not
advocated for any policy outcome.
As a related point, I know why I think our research has
been helpful to those with different views about the policy
issues here. For those who believe the proposed rule is too
strict, and we heard several people today already, our research
has corrected important misperceptions that policymakers might
have had, and now we can decide based on current facts rather
than previous impressions. And for those who support the FCC's
proposed rules, such as Professor Ohm, I believe our research
has also been useful. Before the working paper, much of the
advocacy for the rule was based on factual claims that have not
stood up to scrutiny, especially the claim that ISPs, because
of their place in the ecosystem, see everything about a user's
activity. Without the working paper, supporters of the rule
faced a real risk the rule would be based on inaccurate facts,
thus exposing the rule to risk of reversal in judicial review.
And I believe the factual record now before the Commission is
more nuanced and complete than it would have been.
So turning to these facts and the issue of whether there is
comprehensive access, the most cited findings in our working
paper concern the recent and rapid and historic rise in
encrypted communications for the typical user. Just two years
ago, in 2014, in February, 13 percent of the bits going through
the U.S. backbone were encrypted. By this January, that number
had soared to 49 percent, half the bits, and we expect it to be
70 percent by the end of this year.
And with the shift to HTTPS, which is the secure protocol,
there are two main effects. First of all, the content gets
encrypted. This is again for a majority of bits now today. And
for years, the biggest privacy concern about ISPs is what was
called ``deep-packet inspection,'' and that was because ISPs
technically can go deep into the packet to see the full content
and not just the header. For encrypted communications, deep-
packet inspection doesn't work anymore, it's encrypted, they
can't get in.
Second, blocking of detailed URLs. HTTPS also blocks ISP
access to the detailed URLs. With encryption, the ISP sees
something like ``www.example.com,'' but along with blocking
content, encryption blocks all the details, such as
``www.example.com/sensitivemedical
condition.'' So a lot of the details get blocked, and that
applies broadly to our e-mails now and social networks and web
search.
The other topic is to discuss briefly whether ISPs have
unique data, maybe because they're the bottleneck, as Professor
Ohm mentioned, and whether they have unique insights. My
written remarks discuss five categories of data: domain names,
location information, IP addresses, subscriber information, and
NetFlow or IPFIX information.
Sticking with domain names as the example, ISPs can see the
general domains, such as ``example.com,'' but so can a lot of
others, and that's sort of the point here. The user's operating
systems see it, the user's browser, the app that he or she is
using, the advertising network, all the people with cookies in
the system. Advertisers also have third parties who sell
profiles based on where people surf. And so the point when it
comes to domain names is that compared to other Internet
actors, ISPs access only the domain names, that's third best,
not as good as the content or the detailed URLs that others
see.
So in conclusion, at a factual level, there are greater
limits in ISP visibility than most people had assumed, and I
had assumed when I began the research, and the FCC should base
its conclusions on the ecosystem we have today and going
forward rather than a simplified view of what ISPs used to be
able to see.
My thanks to the Committee for the opportunity to speak
here, and I look forward to your questions.
[The prepared statement of Mr. Swire follows:]
Prepared Statement of Peter Swire, Huang Professor of Law and Ethics,
Scheller College of Business, Georgia Institute of Technology
Chairman Thune, Ranking Member Nelson, and Members of the
Committee, thank you for the opportunity to testify today on ``How Will
the FCC's Proposed Privacy Regulations Affect Consumers and
Competition?'' I am Peter Swire, the Huang Professor of Law and Ethics
at the Scheller College of Business at Georgia Tech. I have worked
intensively on privacy and cybersecurity issues in government,
academia, and practice for over twenty years. A biography is attached
to the end of this testimony.
In February of this year, my co-authors and I issued the 125-page
Working Paper called ``Online Privacy and ISPs: ISP Access to
Information is Limited and Often Less Than That of Others.'' \1\ My
testimony today, based on reply comments filed this week with the
FCC,\2\ focuses on two principle factual findings arising from that
research project:
---------------------------------------------------------------------------
\1\ Peter Swire, Justin Hemmings, and Alana Kirkland, Online
Privacy and ISPs: ISP Access to Consumer Data is Limited and Often Less
than Access by Others (Feb. 29, 2016) available at http://
www.iisp.gatech.edu/working-paper-online-privacy-and-isps.
\2\ https://www.fcc.gov/ecfs/filing/107062066122504/document/
10706206612250467ca.
(1) ISP visibility into consumer online information is far from
---------------------------------------------------------------------------
comprehensive, and will likely continue to decline; and
(2) ISPs appear to lack unique insights into users' Internet
activity.
These two conclusions, in my experience, are surprising to many
people on first encounter. For understandable reasons based in history,
many observers have believed that ISPs do have comprehensive and unique
insights into users' Internet activity. Our research has sought to
provide an accurate factual basis for consideration by the FCC and
other policymakers about these topics. As discussed further below, we
have researched the facts about ISP activity, and I do not take any
position on the policy issues facing the FCC concerning broadband
privacy.
This testimony first discusses the context for our research
project. It next discusses the limits on the comprehensiveness of ISP
visibility into consumer behavior, notably due to the historic rise in
encrypted communications. It concludes by examining claims that ISPs
have unique insight into users' Internet activity.
1. The Context for the Research Project
I briefly discuss the origins of the research project in 2015, and
the chronology of work product through the testimony today.
A. The Origins of the Research Project
My research into ISP access to user data began with the request
from the Federal Communications Commission to participate in its April
28, 2015, Public Workshop on Broadband Consumer Privacy.\3\ In
connection with that Workshop, I was asked by a senior FCC official
about a prominent dispute during the workshop--advocates for stricter
privacy regulation essentially argued that ISPs have ``comprehensive''
access to consumer online information, while the ISPs instead
emphasized the limited data to which they have access. In response, I
answered that this was actually a factual question--research could
illuminate the extent to which ISPs do or do not have ``comprehensive''
access.
---------------------------------------------------------------------------
\3\ My statement is at https://peterswire.net/wp-content/uploads/
Swire_FCC-testimony
_CPNI_04_27_15.pdf.
---------------------------------------------------------------------------
My research project has sought to shed light on the
``comprehensive'' access and related issues. As disclosed from the
start, in addition to funding from Georgia Tech-related sources,
funding also came from Broadband for America, a trade association that
includes major ISPs. At each stage, my co-authors and I have had
complete editorial discretion--the views expressed are our own. To
underscore our commitment to accurate research, we have asked for
public comments about any factual inaccuracies. Our Working Paper in
February 2016 held up very well to scrutiny. Our May 2016 comments to
the FCC included detailed responses to comments, including deletion of
two sentences (out of the 125-page report) that we concluded we could
not support.
As someone who has often previously provided policy recommendations
concerning privacy issues, I provide some detail about why my work on
this topic has been factual rather than making any policy
recommendations about what the FCC should do in its privacy rulemaking.
I am under binding obligations that arise from my role as Special
Assistant to President Obama for Economic Policy in 2009-2010. As a
condition of that employment, I signed what is sometimes called the
``Obama Pledge''--I will not engage in any lobbying of Federal
officials while President Obama remains in office. As a consequence, my
writing about the FCC privacy rulemaking has been factual, and I do not
and have not advocated for any policy outcome in the proceeding.
As a related point, I note the role that our research has played
both for those concerned the FCC's proposed privacy rule is too strict
as well as those who support the FCC's proposed rule. For those
concerned that the FCC's proposed rule is too strict, I believe our
research has served a distinctly useful role--the public debate had
often assumed that ISPs have comprehensive insights into user online
activity, but in fact that is not so. The research, most clearly
concerning the rising use of encryption, thus has corrected important
misperceptions, prompting policymakers to decide based on current facts
rather than false impressions. For those who support the FCC's proposed
rule, I submit that our research has also served a distinctly useful
role. Prior to our Working Paper, a substantial part of the advocacy
for the rule had been based on factual claims that have not stood up to
scrutiny, especially the claim that ISPs, due to their place in the
Internet ecosystem, see ``everything'' about a user's Internet
activity. In the absence of our Working Paper, proponents of the rule
faced a risk that the rule would be based on inaccurate facts, thus
exposing the rule to the risk of reversal during the process of
judicial review.
B. The Chronology Related to the Research Project
Here is the chronology related to our research project:
1. As discussed above, in April 2015, the FCC invited me to
participate as a panelist in its Public Workshop on Broadband
Internet Privacy. The Workshop notably featured the debate
about the extent to which ISPs have ``comprehensive'' access to
user online information. Shortly thereafter, we began our
research project on the topic.
2. In January 2016, over fifty public interest groups signed a
letter urging the FCC to enact a broadband privacy rule,
stating that ISPs have a ``comprehensive view of consumer
behavior,'' and ``have a unique role in the online ecosystem''
due to their role in connecting users to the Internet (emphasis
supplied).\4\
---------------------------------------------------------------------------
\4\ Letter from Access, et al., to Tom Wheeler, Chairman, Federal
Communications Commission (Jan. 20, 2016) available at https://
www.publicknowledge.org/assets/uploads/documents/
Broadband_Privacy_Letter_to_FCC_1.20.16_FINAL.pdf.
3. In February, we issued the Working Paper on ``Online Privacy and
ISPs: ISP Access to Information is Limited and Often Less Than
That of Others.'' \5\ We submitted a slightly revised version
as initial comments to the FCC, including with an appendix that
documents that our initial draft is factually accurate based on
expert review.\6\
---------------------------------------------------------------------------
\5\ Peter Swire, et al., Online Privacy and ISPs: ISP Access to
Consumer Data is Limited and Often Less than Access by Others (Feb. 29,
2016) available at http://www.iisp.gatech.edu/working-paper-online-
privacy-and-isps.
\6\ Comment of Peter Swire, In the Matter of: Protecting the
Privacy of Customers of Broadband and Other Telecommunications
Services, WC Docket No. 16-106 (May 24, 2016) available at https://
www.fcc.gov/ecfs/filing/60001926727.
4. Several comments in the wake of our Working Paper modified the
claim that ISPs have a ``comprehensive'' view to a revised
statement that ISPs have a ``comprehensive view of unencrypted
traffic,'' \7\ (emphasis supplied) an important change because
a majority of non-video Internet traffic is already encrypted
today and there are strong trends toward greater encryption.
Comments also emphasized types of data where ISPs may have
unique advantages, such as the time of user log-in and the
number of bits uploaded and downloaded.
---------------------------------------------------------------------------
\7\ See, e.g., FCC Overreach: Examining the Proposed Privacy Rules:
Hearing Before the Subcomm. on Commc'ns and Tech. of the H. Comm. on
Energy and Commerce, 114th Cong. 3 (2016) (statement of Paul Ohm,
Prof., Georgetown University Law Center) (``When users interact with
websites or use apps or devices that do not support encryption or do
not enable it by default, a BIAS provider's ability to spy is complete
and comprehensive.'') (emphasis added) available at https://
energycommerce.house.gov/hearings-and-votes/hearings/fcc-overreach-
examining-proposed-privacy-rules, Examining the Proposed FCC Privacy
Rules: Hearing Before the Subcomm. on Privacy, Tech. and the Law of the
S. Comm. on the Judiciary, 114th Cong. 1 (2016) (statement of Tom
Wheeler, Chairman, Federal Communications Commission) (``. . . an ISP
has a broad view of all of its customers' unencrypted online
activity'') (emphasis added) available at http://
www.judiciary.senate.gov/meetings/examining-the-proposed-fcc-privacy-
rules, Comments of Public Knowledge, et al., In the Matter of:
Protecting the Privacy of Customers of Broadband and Other
Telecommunications Services, WC Docket No. 16-106, 19-22 (May 27, 2016)
(discussing why traffic remains largely unencrypted) available at
https://www.fcc.gov/ecfs/filing/60001974141/document/60002080037.
5. On July 6, we submitted reply comments to the FCC, providing
additional facts and insights to support our view that ISPs
lack comprehensive knowledge of or unique insights into users'
Internet activity.\8\ The key parts of the reply comments are
laid out in this testimony today. As with our February Working
Paper, the reply comments and this testimony take no position
on what rules should apply to ISPs and other players in the
Internet ecosystem going forward. As we did in February, we
will receive comments on the Georgia Tech Institute of
Information Security and Privacy Website, and publish edits or
corrections if needed.
---------------------------------------------------------------------------
\8\ https://www.fcc.gov/ecfs/filing/107062066122504/document/
10706206612250467ca.
---------------------------------------------------------------------------
2. ISP Visibility into Consumer Online Information is Far From
Comprehensive, and Will Likely Continue to Decline
Our February Working Paper informed the public debate by
documenting how encryption is limiting the possibility of ISP's viewing
much of the content and the detailed URLs accessed by consumers. The
trend toward greater encryption has continued since February, including
the recent Apple announcement that apps in the iOS ecosystem must be
encrypted by the end of 2016. The growing use of encryption and other
developments mean that ISP visibility is likely to continue to decline
during the period when any new FCC broadband privacy rule would go into
effect.
A. The Trend Toward Encryption is Continuing
The most-cited findings of our Working Paper concern the recent and
rapid rise in encrypted connections for the typical user, most notably
by use of the HTTPS (secure HTTP) protocol. As we reported in our
Working Paper, HTTPS traffic in the U.S. Internet backbone was 13
percent in February 2014. That number rose to 49 percent by January
2016, an historic shift. Sandvine estimates that figure will grow to 70
percent of global Internet traffic by the end of 2016,\9\ and
encryption will become increasingly ubiquitous in the next five to ten
years.\10\ Some of the continuing growth in encrypted bits is due to
the decision of high-volume video providers such as Netflix to shift to
encryption. As discussed in the Working Paper, however, a majority of
non-video traffic is already encrypted, including widespread encryption
for potentially revealing activities such as e-mail, text messages,
video conversations, social networks, and web search.
---------------------------------------------------------------------------
\9\ ``2016 Global Internet Phenomena, Latin America & North
America,'' Sandvine, 1, Jun. 2016 (``Sandvine forecasts that 70 percent
of global Internet traffic will be encrypted in 2016, with many
networks expected to exceed 80 percent'') available at https://
www.sandvine.com/trends/global-internet-phenomena/.
\10\ Larry Downes, The Downside of the FCC's New Internet Privacy
Rules, Harvard Business Review (May 27, 2016) available at https://
hbr.org/2016/05/the-downside-of-the-fccs-new-internet-privacy-rules.
---------------------------------------------------------------------------
The Working Paper provides diagrams and detailed explanations of
what changes with the shift from HTTP to the encrypted HTTPS protocol.
The shift to HTTPS has two main effects, the shift to encrypted content
and blocking of detailed URLs.
i. The shift to encrypted content. Based on my professional
experience, the most prominent privacy concerns about ISPs for
the past twenty years have been about ``deep-packet
inspection'' (DPI). When an ISP uses DPI, then the ISP can go
``deeply'' into the packet, examining the full content in
contrast to the header information about where the packet
should go. Privacy experts have long expressed concerns that
ISP examination of all of a user's content could reveal a great
deal of sensitive personal information.\11\ Notably, for
encrypted communications, DPI does not work. Even if ISPs
sought to profile customers based on content, the use of HTTPS
blocks the ISP's access to the content.\12\ In short, the rise
of HTTPS provides technical assurances that address the
longest-voiced privacy concern about ISPs.
---------------------------------------------------------------------------
\11\ See, e.g., Center for Democracy and Technology, Online
Behavioral Advertising: Discussing the ISP-Ad Network Model (Sep. 18,
2008) available at https://cdt.org/insight/online-behavioral-
advertising-discussing-the-isp-ad-network-model/, Declan McCullagh, Web
Monitoring for Ads? It may be Illegal, C/Net (May 19, 2008) available
at http://www.cnet.com/news/web-monitoring-for-ads-it-may-be-illegal/,
Grant Gross, ISP Backs off of Behavioral Ad Plan, PCWorld (Jun. 24,
2008) available at http://www.pcworld.com/article/147508/article.html.
\12\ Professor Nick Feamster, in his comments to the FCC, said
``DPI is typically not widely deployed in many ISP networks,'' and,
``contrary to some conventional beliefs, ISPs often do not retain much
of the data that they collect because the cost of doing so can be
substantial.'' Taken together with the increasing prevalence of HTTPS,
these comments from Professor Feamster provide the basis for concluding
that DPI going forward is much less of a privacy concern than has often
been asserted in ISP privacy debates. Comment of Nick Feamster, In the
Matter of: Protecting the Privacy of Customers of Broadband and Other
Telecommunications Services, WC Docket No. 16-1606, 6 (May 27, 2016)
available at https://www.fcc.gov/ecfs/filing/60001973502/document/
60002079367.
Professor Feamster discusses other possible privacy risks in his
comments, which are discussed below.
ii. Blocking of detailed URLs. Along with blocking ISP access to
content, HTTPS blocks ISP access to detailed URLs. By contrast,
ISPs continue to see the domain itself, such as
www.example.com. Compared to the domain, detailed URLs
typically reveal more granular detail about a user's interests
and communications. For a news site, the detailed URL is
typically more revealing (www.OnlineNewspaper.com/
PoliticalNewsStory) than the domain itself
(www.OnlineNewspaper.com). As another example, the major search
engines have shifted to HTTPS. With HTTP search, information
known as ``HTTP refer'' would reveal the search terms to the
ISP. With HTTPS search, however, ISPs can no longer see the
search terms. As Professor Neal Richards has explained, more
granular information provides greater risks to what he calls
``Intellectual Privacy,'' or the ability of the organization
gathering the data to make inferences about a person's
interests and personality.\13\ Consistent with this view,
Federal courts have found content and detailed URLs deserving
of stricter legal protection under the Electronic
Communications Privacy Act than the domain itself.\14\
---------------------------------------------------------------------------
\13\ Neil Richards, Intellectual Privacy: Rethinking Civil
Liberties in the Digital Age (2015).
\14\ In Re: Google Inc. Cookie Placement Consumer Privacy
Litigation, 806 F.3d 125, 138 (3rd Cir. 2015) available at http://
www2.ca3.uscourts.gov/opinarch/134300p.pdf.
---------------------------------------------------------------------------
Comments made after release of the Working Paper have agreed with
the growth of encryption and the fact that HTTPS blocks content and
detailed URLs, and have focused instead on other points. A report from
Upturn, for instance, correctly states that while HTTPS is prevalent on
some of the most popular websites, the majority of total websites
remain unencrypted, including a large percentage of health, news, and
shopping sites.\15\ In considering these statistics, we note that the
number of bits transferred is an important measure of whether users'
communications are typically encrypted, including for important
communications such as e-mails, search, and social networks. Users do a
large portion of their Internet activity on the most popular such
sites, where encryption has often already been adopted.
---------------------------------------------------------------------------
\15\ ``What ISPs Can See: Clarifying the Technical Landscape of the
Broadband Privacy Debate,'' Upturn, 3-4, Mar. 2016, available at
https://www.teamupturn.com/reports/2016/what-isps-can-see.
---------------------------------------------------------------------------
News and a wide variety of other sites that rely on display
advertising. Change is occurring for sites that rely on display
advertising, including news sites, where encryption adoption has been
slow to date. The announcement this April that Wired Magazine is
shifting to HTTPS is instructive. Wired Magazine has reported that
every advertisement placed on a page must be delivered via HTTPS for
the page to work properly.\16\ Wired Magazine is thus staging its
deployment of HTTPS, working with its advertising providers to make the
transition. This effort by Wired Magazine as an early adopter is a
promising sign that display advertising-based sites will shift to
HTTPS. Once an advertising company has upgraded to HTTPS to serve Wired
Magazine and other early adopters, there is a positive spillover
effect--the advertising company can then support HTTPS for the other
news, shopping, health, and other sites where it places display
advertisements.
---------------------------------------------------------------------------
\16\ Zack Tollman, We're Going HTTPS: Here's How Wired is Tackling
a Huge Security Upgrade, Wired (Apr. 28, 2016) available at https://
www.wired.com/2016/04/wired-launching-https-security-upgrade/.
---------------------------------------------------------------------------
In considering the prevalence of encryption under any FCC broadband
privacy rule, policymakers should move beyond a static view of the
state of encryption today, and consider the overall trend toward
increasingly ubiquitous deployment of encryption, including for the
``long tail'' of websites that have lower user traffic.
In 2016, signs of the expansion of encryption include:
Apple is requiring HTTPS for iOS applications. In June,
Apple announced at its Worldwide Developers Conference that app
developers will be required to connect over HTTPS servers when
transferring data online.\17\ App developers must make these
changes by January 1, 2017, and new apps will not be listed on
the App Store unless they are encrypted.
---------------------------------------------------------------------------
\17\ Kate Conger, Apple Will Require HTTPS Connections for iOS Apps
by the End of 2016, TechCrunch (Jun. 14, 2016) available at https://
techcrunch.com/2016/06/14/apple-will-require-https-connections-for-ios-
apps-by-the-end-of-2016/.
Progress for the Let's Encrypt Project, to make implementing
HTTPS easier. The Let's Encrypt project is a free, automated,
and open certificate authority.\18\ The organization hosts a
support community for those seeking to implement Let's Encrypt
certificates and to navigate the obstacles to encrypting a
website.\19\ In March, Let's Encrypt issued its one millionth
certificate and reported a rate of growth of 100,000
certificates per week.\20\ The success of the project, thanks
in part to the support of numerous sponsors from public
interest groups and technology companies,\21\ is raising
encryption adoption for smaller websites.\22\
---------------------------------------------------------------------------
\18\ About, Let's Encrypt (last visited Jun. 24, 2016) available at
https://letsencrypt.org/about/.
\19\ Let's Encrypt Community Support, Let's Encrypt (last visited
Jun. 24, 2016) available at https://community.letsencrypt.org/.
\20\ Josh Aas, Our Millionth Certificate, Let's Encrypt (Mar. 8,
2016) available at https://letsencrypt.org/2016/03/08/our-millionth-
cert.html.
\21\ Current Sponsors, Let's Encrypt (last visited Jun. 24, 2016)
available at https://letsencrypt.org/sponsors/.
\22\ https://letsencrypt.org/2016/03/08/our-millionth-cert.html.
WordPress has enabled HTTPS by default for hosted content.
WordPress announced in April that it will provide HTTPS by
default for hosted content, providing increasingly available
and accessible encryption for the ``long tail'' of sites.\23\
By utilizing the Let's Encrypt project, WordPress was able to
automatically deploy and manage HTTPS for the over 1 million
custom domains hosted through the company.\24\ The announcement
by WordPress illustrates the growth of encryption and how
encryption is becoming easier to implement. In addition, with
26.3 percent of all content management systems running
WordPress,\25\ the shift would appear to provide a competitive
advantage for WordPress compared to other hosting services,
incentivizing other services to offer easy-to-use encryption
tools.
---------------------------------------------------------------------------
\23\ HTTPS Everywhere: Encryption for All WordPress.com Sites,
WordPress (Apr. 8, 2016) available at https://en.blog.wordpress.com/
2016/04/08/https-everywhere-encryption-for-all-
wordpress-com-sites/.
\24\ Id.
\25\ Darren Pauli, WordPress Pushes Free Default SSL for Hosted
Sites, The Register (Apr. 11, 2016) available at http://
www.theregister.co.uk/2016/04/11/wordpress_pushes_free_default
_ssl_encrypts_26_of_the_webs_cmses/.
The Federal Trade Commission has emphasized the importance
of encrypting Internet of Things (IoT) devices. In January, an
FTC report strongly recommended encryption of confidential
consumer information transmitted by IoT devices.\26\ The FTC
gave notice that companies face the risk of enforcement action
if they fail to encrypt their devices and communications.\27\
The public threat of enforcement action provides an incentive
for companies to deploy encryption for the IOT, where
encryption adoption has previously lagged.
---------------------------------------------------------------------------
\26\ ``Internet of Things: Privacy & Security in a Connected
World,'' Federal Trade Commission, 27-28 (Jan. 2015) available at
https://www.ftc.gov/system/files/documents/reports/federal-trade-
commission-staff-report-november-2013-workshop-entitled-internet-
things-privacy/150127iotrpt.pdf.
\27\ Id. at 30.
As discussed above, Wired.com's switch to full HTTPS will
make it easier for news and a wide variety of other display
---------------------------------------------------------------------------
advertising-supported sites to follow suit.
Our original Working Paper provided extensive additional
information about the trend toward prevalent use of encryption.\28\ As
one notable example:
---------------------------------------------------------------------------
\28\ Peter Swire, et al., Online Privacy and ISPs: ISP Access to
Consumer Data is Limited and Often Less than Access by Others, 28-30
(Feb. 29, 2016) available at http://www.iisp
.gatech.edu/working-paper-online-privacy-and-isps.
Google Search ranks HTTPS higher. In 2014, Google announced
it would use HTTPS as a ranking signal as part of its ``HTTPS
Everywhere'' campaign. In light of Google's large market share
in search, website owners thus have an incentive to enable
HTTPS in order to gain better search rankings and subsequent
page views. Together with developments such as the ``Let's
Encrypt'' campaign, this means that even small website owners:
(i) have an incentive to use HTTPS; and (ii) increasingly have
the ability to do so.
B. The Rise of Mobile and Other Reasons for Limits on ISP Visibility
Beyond encryption, our Working Paper discussed other limits on ISP
visibility into consumer online information, notably the shift toward
mobile access to the Internet. Historically, many consumers did most or
all of their Internet access from home, using an unencrypted connection
through a single ISP. We believe that this mental model of Internet use
is a reason that many people have believed that an ISP does have a
``comprehensive'' view of its customers' Internet activity. The rise of
smartphones, tablets, and other mobile computing, however, places
limits on an ISP's ability to gain such a view, in addition to the
limits that come from prevalent encryption:
Mobile is becoming the leading way to access the Internet.
As our Working Paper noted, the number of mobile Internet-
enabled devices today is as large as traditional laptops and
desktops combined,\29\ and the market share of desktop
computers is continuing to fall.\30\ Today, the great majority
of Internet users own mobile devices.\31\
---------------------------------------------------------------------------
\29\ Angela Moscaritolo, Tablets to Make Up Half the PC Market in
2014, PCMag (Nov. 26, 2013) available at http://www.pcmag.com/article2/
0,2817,2427623,00.asp.
\30\ Robert McMillan, PC Sales Continue to Fall, Wall St. J. (Jul.
9, 2015) available at http://blogs.wsj.com/digits/2015/07/09/pc-sales-
continue-to-fall/, Jordan Weissman, The End of the Home Computer: Why
PC Sales Are Collapsing, The Atlantic, (Apr. 11, 2013), available at
http://www.theatlantic.com/business/archive/2013/04/the-end-of-the-
home-computer-why-pc-sales-are-collapsing/274899/.
\31\ At the beginning of 2015, one study showed that 91 percent of
users owned a desktop or laptop. Smartphone use has climbed sharply, to
80 percent. In addition to desktops, laptops, and smartphones, nearly
50 percent of users reported owning a tablet. See Jason Mander, 80
percent of Internet users own a smartphone, GlobalWebIndex (Jan. 5,
2015) available at http://www.globalwebindex.net/blog/80-of-internet-
users-own-a-smartphone.
Mobile traffic is offloaded to WiFi networks. By 2014, an
estimated 46 percent of all data traffic shifted to WiFi
networks,\32\ growing to an estimated 60 percent of all mobile
data traffic by 2020.\33\ The ISP that connects the WiFi
network to the Internet (WiFi ISP) is often different from the
ISP that connects the mobile user to the Internet (subscriber
ISP). In such cases, the subscriber ISP has no visibility into
the subscriber's Internet activity connected through the WiFi
network.\34\
---------------------------------------------------------------------------
\32\ ``Cisco Visual Networking Index, Forecast and Methodology,
2014-2019 Working Paper,'' Cisco (May 27, 2015) available at http://
www.cisco.com/cen/us/solutions/collateral/service-provider/ip-ngn-ip-
next-generation-network/white_paper_c11-481360.html.
\33\ ``Juniper Mobile Data Onload & Offload Report,'' Juniper (Jun.
2015) available at http://www.juniperresearch.com/researchstore/
enablingtechnologies/mobile-data-onload-offload/wifi-small-cell-
network-strategies.
\34\ If the Wifi ISP and subscriber ISP are the same, then that ISP
can generally detect that the individual is using the same MAC address
to connect to the ISP.
Consumers switch carriers. According to FCC statistics, 82
percent of mobile broadband Internet users have a choice of at
least four providers, and 98.8 percent have at least
two.\35\According to the FCC, between a fifth and a third of
wireless subscribers switch their carriers annually.\36\
Consumers also switch wireline carriers, with one out of six
subscribers switching wireline providers every year, and 37
percent of subscribers switching every three years.\37\
Switching carriers cuts off the visibility of the old carrier,
splitting the user's Internet history.
---------------------------------------------------------------------------
\35\ ``Seventeenth Annual Mobile Wireless Competition Report,''
Federal Communications Commission, DA 14-1862 51, rel. Dec. 18, 2014,
available at https://apps.fcc.gov/edocs_public/attachmatch/DA-14-186
2A1.pdf; ``2015 Broadband Progress Report and Notice of Inquiry on
Immediate Action to Accelerate Deployment,'' Federal Communications
Commission, FCC 15-10 109, rel. Feb. 4, 2015, available at https://
apps.fcc.gov/edocs_public/attachmatch/FCC-15-10A1.pdf.
\36\ ``Annual Report and Analysis of Competitive Market Conditions
with Respect to Mobile Wireless, Including Commercial Mobile Services:
Fifteenth Report,'' Federal Communications Commission (Jun. 27, 2011)
available at https://apps.fcc.gov/edocs_public/attachmatch/FCC-11-
103A1.pdf.
\37\ ``Broadband Decisions: What Drives Consumers to Switch-or
Stick with-Their Broadband Internet Provider,'' Federal Communications
Commission (Dec. 2010) available at https://apps.fcc.gov/edocs_public/
attachmatch/DOC-303264A1.pdf.
Consumers access the Internet through multiple mobile
carriers. Any given ISP loses visibility into the subscriber's
Internet activity as the user moves between cellular
connections and WiFi hotspots during the day. For example, they
may connect using their home and work WiFi, then free WiFi in a
coffee shop, then WiFi at a friend's house, any of which may
---------------------------------------------------------------------------
use different ISPs.
In conclusion about whether ISPs have ``comprehensive'' visibility
into user Internet activity, the prevalence of encryption and the shift
to mobile computing put important limits today on ISPs' visibility. In
addition, the role of both encryption and mobile computing will
continue to grow in the coming years, during the period when any new
rule would enter into effect.
3. ISPs Appear to Lack Unique Insights Into Users' Internet Activity
Public debate about privacy and ISPs has featured comments that
ISPs ``play a unique role in the online ecosystem'' \38\ and their
position as an Internet ``bottleneck'' gives them unique access to
privacy sensitive insights about users.\39\ To clarify the role that
ISPs play in the online ecosystem, our Working Paper explained the
roles played by other online actors, including their access to
sensitive personal information, devoting separate chapters to: social
networks; search engines; webmail and messaging; mobile and other
operating systems; interest-based advertising; and browsers, Internet
video, and E-commerce.
---------------------------------------------------------------------------
\38\ Letter from Access, et al., to Tom Wheeler, Chairman, Federal
Communications Commission (Jan. 20, 2016) available at https://
www.publicknowledge.org/assets/uploads/documents/
Broadband_Privacy_Letter_to_FCC_1.20.16_FINAL.pdf.
\39\ FCC Overreach: Examining the Proposed Privacy Rules: Hearing
Before the Subcomm. on Commc'ns and Tech. of the H. Comm. on Energy and
Commerce, 114th Cong. 3 (2016) (statement of Paul Ohm, Prof.,
Georgetown University Law Center) available at http://docs
.house.gov/meetings/IF/IF16/20160614/105057/HHRG-114-IF16-Wstate-OhmP-
20160614.pdf.
---------------------------------------------------------------------------
In the reply comments and this testimony, we examine sources of
data, raised by commenters, which are potentially available to ISPs.
For each source of data, we look at the visibility to others--other
actors in the online ecosystem often have access to the same or
comparable data as that available to ISPs. We also look at the insights
available from data seen by the ISPs. Looking at each category of data,
the data available to ISPs appears to offer the same as or less insight
than the data used by other actors. For instance, ISPs sometimes see
``third-best'' information: they can see the basic domain name a user
visits (such as www.example.com) but not the encrypted content (what
example.com sends to the user) or the detailed Uniform Resource Locator
(URL) (such as www.example.com/InterestingPageTitle). Others in the
Internet ecosystem, meanwhile, see the content and detailed URLs.
Before discussing the relevant categories of data, I note the
difference between having access to unique data and having access to
unique insights about users. Any two companies, at some level, have
unique data--they have at a minimum different customer lists and
different specific interactions with their customers. For purposes of
informing the record about online privacy, the discussion here provides
detail about the uniqueness or lack thereof of several categories of
data available to ISPs. Our analysis here and in the Working Paper
primarily focuses, however, on whether ISPs have unique insights about
their customers--to what extent their position in the online ecosystem
may mean that ISPs can learn more about consumers than others can. For
commercial businesses, the focus on insight is key. These insights are
what provide economic value, including for internal proprietary
purposes, to sell more valuable advertisements, or to sell to other
parties such as data brokers. To date, of the top 10 ad-selling
companies, which earn over 70 percent of the total online advertising
dollars, none gained their current position by providing broadband
Internet service.\40\ For the reasons discussed below, ISPs, based on
our review, appear to lack unique insights about consumer online
activity because other players in the Internet ecosystem can collect
the same (or equivalent) information.
---------------------------------------------------------------------------
\40\ Peter Swire, et al., Online Privacy and ISPs: ISP Access to
Consumer Data is Limited and Often Less than Access by Others, 4 (Feb.
29, 2016) available at http://www.iisp.gatech.edu/working-paper-online-
privacy-and-isps.
---------------------------------------------------------------------------
I next examine categories of Internet activity data identified by
commenters, which are sometimes or always available to ISPs. For each
category, I provide: (i) the type of data; (ii) a description of who
other than ISPs has visibility, including in some cases data being
considered already ``public''; (iii) discussion of the quality of
insights that the available data may provide about users; and, (iv)
other discussion.
Domain names. As discussed above, with HTTPS, general domain
information is visible to the ISP (such as www.example.com),
while the content (what www.example.com sends to the user) or
the detailed URL (such as www.example.com/InterestingPageTitle)
are not for encrypted traffic.
Visibility to others: Many or all of the domain names
a user visits are available to others, including the user's
operating system, the user's browser or application, and
advertising networks and other third parties with cookies
or services that are present on the page being visited.\41\
Third parties sell profiles of users based on the domains
and/or detailed URLs they visit.
---------------------------------------------------------------------------
\41\ Moreover, the domain resolution process was expressly designed
to be public. Comment of Manos Antonakakis, et al., In the Matter of:
Protecting the Privacy of Customers of Broadband and Other
Telecommunications Services, WC Docket No. 16-106, 6 (May 27, 2016)
available at https://www.fcc.gov/ecfs/filing/60001973444/document/
60002079307.
Insights: The domain names a user visits are not as
revealing as the content accessed or full URLs. Some domain
names, however, can reveal information that would be
considered sensitive by most privacy experts, such as
www.SensitiveHealthSite.com or
---------------------------------------------------------------------------
www.UnusualPoliticalViews.com.
Discussion: Compared to other Internet actors, ISP
access to domain names can be seen as ``third-best''
information, less revealing than content or detailed URLs.
With HTTPS, ISPs cannot see encrypted content or detailed
URLs, whereas that more detailed information is available
to others, including the operator of the page being
visited, the operating system, and the browser or
application.
Location information. As discussed in the Working Paper,
mobile carriers can estimate a user's location through the
process of ``trilateration,'' based on the distance from the
user to three or more cell towers.\42\
---------------------------------------------------------------------------
\42\ Peter Swire, et al., Online Privacy and ISPs: ISP Access to
Consumer Data is Limited and Often Less than Access by Others, 70-72
(Feb. 29, 2016) available at http://www.iisp
.gatech.edu/working-paper-online-privacy-and-isps.
Visibility to others: Commercial services today
principally determine location based on information from
the global positioning system (GPS) or Bluetooth. When GPS
is switched on, at a minimum the operating system can
determine location. A large number of popular mobile apps
gather detailed location information. Third parties sell
profiles based on location information. Moreover, mobile
operating systems and apps can collect trilateration
results using the known locations of cell towers and WiFi
---------------------------------------------------------------------------
networks.
Insights: Most privacy experts consider precise
location history to be sensitive information.
Discussion: As discussed in our Working Paper,
trilateration results in rough location information
compared to GPS or Bluetooth location tracking, which is
significantly more precise and available to the user's
device, operating system, and any application or service
with access to those sensors.\43\
---------------------------------------------------------------------------
\43\ Id.
Subscriber information. ISPs often learn subscriber
information, such as name, address, credit card information,
---------------------------------------------------------------------------
and Social Security number.
Visibility to others: Many players in the online
ecosystem gain access to data such as name, address, and
credit card information. Companies that seek information
under the Fair Credit Reporting Act (such as for lending,
employment, or insurance purposes) also learn Social
Security number. A company that has name and address can
often purchase additional profiling information, a process
that Jules Polonetsky of the Future of Privacy Forum calls
``the democratization of data.'' \44\
---------------------------------------------------------------------------
\44\ Comment of The Future of Privacy Forum, In the Matter of:
Protecting the Privacy of Customers of Broadband and Other
Telecommunications Services, WC Docket No. 16-1606, 14-16 (May 27,
2016) available at https://www.fcc.gov/ecfs/filing/60001981713/
document/6000208
9525.
Insights: Many privacy experts, along with the FTC in
its report on Data Brokers,\45\ have expressed concerns
about the amount of personal information that can be
purchased when a company knows subscriber information such
as name and address.
---------------------------------------------------------------------------
\45\ ``Data Brokers: A Call for Transparency and Accountability,''
Federal Trade Commission, 47-49 (May 2014) available at https://
www.ftc.gov/system/files/documents/reports/data-brokers-call-
transparency-accountability-report-federal-trade-commission-may-2014/
140527data
brokerreport.pdf.
Discussion: The insights that ISPs can gain from
subscriber information are available to many others in the
---------------------------------------------------------------------------
Internet ecosystem.
IP addresses. ISPs use Internet Protocol addresses to
connect an individual device to the Internet. IP addresses are
assigned by the ISP.\46\
---------------------------------------------------------------------------
\46\ Number Resources, Internet Assigned Numbers Authority (last
visited Jul. 5, 2016) available at https://www.iana.org/numbers.
Visibility to others: IP addresses are visible to
every carrier between the customer and the relevant content
provider. Operating Systems, websites, applications,
content/website providers, browser plug-ins, and software
development kits can all collect IP address
information.\47\ E-commerce sites can combine IP addresses
of visiting customers with the names and addresses of those
customers, along with purchase history. Logs of IP
addresses are commonly used for purposes other than
marketing, including for cybersecurity. Third parties sell
correlations of IP addresses with cookies and other
information. All these channels enable other actors to
replicate IP address information that an ISP can access
through providing its services.
---------------------------------------------------------------------------
\47\ See, e.g., View IP Address, Chrome Web Store (last visited
Jul. 5, 2016) available at https://chrome.google.com/webstore/detail/
view-ip-address/mfhcchbdblkggcenfmmpgkpgphfhfc
be?hl=en.
Insights: IP addresses can give clues to information
such as a user's location, commonly visited sites, and
usage patterns (including time of log-in, amount uploaded
---------------------------------------------------------------------------
and downloaded, and some information on protocols used).
Discussion: Many of the insights that ISPs can gain
from IP addresses are available to many others in the
Internet ecosystem.
IPFIX Data/Netflow. The Internet Protocol Flow Information
Export (IPFIX)\48\ and NetFlow \49\ are protocols for
monitoring network traffic.\50\ For any individual IP flow, or
``sequence of packets sent from a particular source to a
particular. . .destination,'' \51\ IPFIX can be used to record
and store the start and end time for the flow, the number of
bytes and packets in the flow, the protocol/type of connection
(e.g., TCP or UDP), and the source and destination of the
flow.\52\
---------------------------------------------------------------------------
\48\ IPFIX is a protocol developed by the Internet Engineering Task
Force as an open, universal standard for exporting Internet Protocol
flow information and as an alternative to Cisco's proprietary NetFlow
protocol. See RFC 5102--Information Model for IP Flow Information
Export, Internet Engineering Task Force (Jan. 2008) available at
https://tools.ietf.org/html/rfc5102.
\49\ NetFlow is Cisco's proprietary protocol for exporting Internet
Protocol flow information. The term ``NetFlow'' is often used
interchangeably with IPFIX to refer to this type of protocol.
Introduction to Cisco IOS NetFlow--A Technical Overview, Cisco (May 29,
2012) available at https://www.cisco.com/c/en/us/products/collateral/
ios-nx-os-software/ios-netflow/prod_white
_paper0900aecd80406232.html.
\50\ See id.
\51\ See RFC 3697--IPv6 Flow Label Specification, Internet
Engineering Task Force (Mar. 2004) available at https://tools.ietf.org/
html/rfc3697.
\52\ Id.
Visibility to others: IP flow information is visible to
each: network operator; ISP; transit provider; Internet
backbone provider; and edge provider along the path between the
end-user and the destination. The same IP flow information, as
well as additional information, is visible to the user's
operating system and applications. For other members of the
ecosystem, this data can be aggregated through purchase from
and sale to data brokers, including data linked to the IP
addresses of a service's users.\53\
---------------------------------------------------------------------------
\53\ Oracle, Little Blue Book: A Buyer's Guide, 84 (Dec. 2014)
available at http://www.bluekai.com/bluebook/assets_20150102/bluekai-
little-blue-book.pdf.
Insights: Access to IPFIX/Netflow data may in some instances
provide ``side channel'' information from these flows that can
help in inferring end-user behavior such as whether they are
browsing the web, streaming a video, or chatting with someone
online. Comments state it is possible to ``identify certain web
page visits'' or ``information about what those packets likely
contain'' \54\ from the IP flow information; to do this appears
to require ``finger printing'' each website of interest \55\
and the collection of a high fraction of the flows. In
addition, concerning the statement that such information is
stored as a ``permanent record of these individual
transactions,'' \56\ Professor Nick Feamster reports that IPFIX
normally samples one out of every 1,000 packets for traffic
statistics.\57\ Thus, ``many short flows may not be recorded
whatsoever.'' Sampling this data would be an inefficient way to
profile users compared to analysis of the actual content
available to the operators of pages that users visit and
others. Similarly, given the volume of connections and volume
of websites, we are not aware of a business justification for
creating a ``permanent record'' of all of IPFIX data for an
ISP's users nor for maintaining an archive of website
fingerprints (which change often and dynamically).
---------------------------------------------------------------------------
\54\ ``What ISPs Can See: Clarifying the Technical Landscape of the
Broadband Privacy Debate,'' Upturn, 8, (Mar. 2016) (``It is possible to
uniquely identify certain web page visits or otherwise reveal
information about what those packets likely contain.'') available at
https://www.teamupturn.com/reports/2016/what-isps-can-see.
\55\ Chen, Shuo; Side-Channel Leak in Web Applications: a Reality
Today, a Challenge Tomorrow; https://www.microsoft.com/en-us/research/
wp-content/uploads/2016/02/WebAppSideCha
nnel-final.pdf
\56\ FCC Overreach: Examining the Proposed Privacy Rules: Hearing
Before the Subcomm. on Commc'ns and Tech. of the H. Comm. on Energy and
Commerce, 114th Cong. 52 (2016) (testimony of Paul Ohm, Prof.,
Georgetown University Law Center) available at http://docs.house.gov/
meetings/IF/IF16/20160614/105057/HHRG-114-IF16-Transcript-20160614.pdf.
\57\ Comment of Nick Feamster, In the Matter of: Protecting the
Privacy of Customers of Broadband and Other Telecommunications
Services, WC Docket No. 16-1606, 3-4 (May 27, 2016) available at
https://www.fcc.gov/ecfs/filing/60001973502/document/60002079367.
Feamster also states: ``even though IPFIX records contain no
information about the actual content of communication, information such
as volumes, sources, and destinations can sometimes reveal private
information about user behavior.'' The discussion here has pointed out
that access to the content of communications will provide greater
insights than partial information about the types of data Feamster
describes. Id. at 4.
Discussion: Professor Feamster also states: ``even though
IPFIX records contain no information about the actual content
of communication, information such as volumes, sources, and
destinations can sometimes reveal private information about
user behavior.'' This data, along with other ``side channel''
inferences, is an example of what we believe is ``third-best''
advertising data--inferences based on information that provides
less insight than content or detailed URLs. We are not aware of
any evidence that these methods are currently widely used, let
alone profitable,\58\ for advertising. This data, however, is
useful for purposes including network management, network
security, and research.\59\
---------------------------------------------------------------------------
\58\ ``What ISPs Can See: Clarifying the Technical Landscape of the
Broadband Privacy Debate,'' Upturn, 8 (Mar. 2016) available at https://
www.teamupturn.com/reports/2016/what-isps-can-see.
\59\ Comment of Nick Feamster, In the Matter of: Protecting the
Privacy of Customers of Broadband and Other Telecommunications
Services, WC Docket No. 16-1606, 4 (May 27, 2016) (``Network operators
may also share IPFIX data with researchers. I use IPFIX data collected
at interconnection points to analyze utilization patterns. In another
project related to DoS mitigation, we are using IPFIX data to better
understand traffic attack patterns. In the past, we have also used
IPFIX traffic traces from access ISPs to design and validate algorithms
to detect botnets, large networks of compromised machines. Most
recently, I have been using IPFIX data collected at the interconnection
points from seven access ISPs in the United States--covering 50 percent
of the U.S. broadband subscriber population--to explore the
characteristics and patterns of utilization between access ISPs and
edge providers. Interestingly, this type of project that provides
exactly the type of insight and analysis that the FCC is increasingly
paying attention to. Preventing ISPs from sharing this type of data
with researchers would impede progress on this research.'') available
at https://www.fcc.gov/ecfs/filing/60001973502/document/60002079367.
---------------------------------------------------------------------------
Conclusion
In conclusion about whether ISPs have ``unique'' visibility into
user Internet activity, the discussion here has pointed out the many
places where other players in the Internet ecosystem receive the same
(or equivalent) information about user actions. Concerning unique
insights into user behavior, ISPs in many instances have access to data
that is less revealing than content or other information about user
activity available to the companies providing services to the user.
In conclusion, I thank the Committee for the opportunity to testify
today, and would be glad to answer any questions.
Background of the witness
I am the Huang Professor of Law and Ethics at the Georgia Tech
Scheller College of Business, with appointments by courtesy with the
College of Computing and School of Public Policy. Consistent with
university consulting rules, I am Senior Counsel with Alston & Bird,
LLP.
I have been immersed in privacy and cybersecurity issues for two
decades. In 2015, the International Association of Privacy
Professionals, among its over 20,000 members, awarded me its Privacy
Leadership Award. In 2013, I served as one of five members of President
Obama's Review Group on Intelligence and Communications Technology.
Prior to that, I was co-chair of the global Do Not Track process for
the World Wide Web Consortium. I am Senior Fellow with the Future of
Privacy Forum.
Under President Clinton, I served as Chief Counselor for Privacy,
in the U.S. Office of Management and Budget. In that role, my
activities included being White House coordinator for the HIPAA medical
privacy rule, serving as White House representative to the privacy
rulemaking process under the Gramm-Leach-Bliley Act, and helping
negotiate the U.S.-E.U. Safe Harbor agreement for trans-border data
flows. Under President Obama, I served as Special Assistant to the
President for Economic Policy in 2009-2010.
I have testified on privacy and other issues before almost a dozen
committees in the U.S. Congress, and worked closely with the Federal
Trade Commission and other Federal agencies on privacy and
cybersecurity issues. In 2011, the Federal Communications Commission
asked me to summarize and comment on the day's proceedings for its
Workshop on Location Information. Further information is available at
www.peterswire.net.
Attachment
Complete article can be found at: http://www.iisp.gatech.edu/sites/
default/files/images/online--privacy--and--isps.pdf
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairman. Thank you, Professor Swire.
Before I begin with questions, I want to submit a few items
for the record of today's hearing. I received two letters that
I believe contribute greatly to this topic. The first letter is
signed by constitutional scholar Laurence Tribe and 13 other
law professors, economists, and experts. They support strong
protections for consumers in the online space, but they have
significant concerns with the FCC's proposal, and, instead,
they suggest that the Commission adopt rules modeled after the
FTC's longstanding and highly successful approach, their words.
The second letter, signed by the heads of eight trade
associations representing both the technology sector and the
telecom industry, also argues for the FCC to harmonize its
effort with the existing FTC framework, in order to minimize
consumer confusion and provide flexibility for the marketplace
to innovate.
[The letters referred to follow:]
International Center for Law & Economics
July 11, 2016
VIA EMAIL
Hon. John Thune,
Chairman,
Committee on Commerce, Science, and Transportation.
Hon. Bill Nelson,
Ranking Member,
Committee on Commerce, Science, and Transportation.
Hon. Fred Upton,
Chairman,
Committee on Energy and Commerce.
Hon. Frank Pallone,
Ranking Member,
Committee on Energy and Commerce.
Hon. Greg Walden,
Chairman,
Subcommittee on Communications and Technology,
Committee on Energy and Commerce.
Hon. Anna Eshoo,
Ranking Member,
Subcommittee on Communications and Technology,
Committee on Energy and Commerce.
Re: Letter from legal scholars and economists concerning the Federal
Communications Commission's Broadband Privacy NPRM
Dear Senators Thune and Nelson, Congressmen Upton, Pallone and Walden,
and Congresswoman Eshoo:
We, the undersigned experts in the law and economics of the
Internet, have significant concerns with the proposal of the Federal
Communications Commission (``Commission'' or ``FCC'') to adopt new data
privacy and security rules for broadband Internet access service
providers (``ISPs'') under Title II of the Communications Act.
We support strong consumer protection and believe that the
Commission has a role to play in protecting consumers' data privacy and
security. For several reasons, however, we find that the proposed rules
take the wrong approach and would harm consumers, competition, and
innovation.
As a fundamental matter, the proposed rules do not reflect the
technological and economic nature of the Internet environment, in which
ISPs are just one of many types of entities that have access to and can
use consumers' online information to provide services, including access
to ad-supported content. The proposed rules would single out ISPs for
heightened regulation, imposing strict opt-in consent requirements on
their use and disclosure of customer information.
By contrast, other online entities--such as social media networks,
operating systems, browsers, data brokers, and search engines--would
operate under the Federal Trade Commission's (``FTC's'') strong but
flexible opt-out consent regime, which would allow them to continue
collecting, using, and sharing information about consumers' online
activities for a variety of commercial purposes. The FTC's framework
focuses on stopping practices that truly harm consumers, allowing
companies ample space to develop innovative and beneficial products and
services.
As a result, the FCC's proposed rules would not only distort the
marketplace in ways that are likely to increase costs to consumers, but
also mark an unprecedented and unwarranted departure from the
successful balance that has governed the Internet economy for the past
couple of decades and which has led to substantial innovation,
investment, competition, and growth.
Moreover, the asymmetrical regulatory framework that would be
created by the proposed rules likely would confuse consumers and
negatively affect the Internet economy. Specifically, the Commission's
proposal to require ISPs to obtain opt-in consent before using or
disclosing consumers' data for most activities is diametrically opposed
to the approach that the FTC has taken for decades and to which
consumers have become accustomed. Consumers may not understand that the
choices they make through their ISPs' opt-in mechanism do not apply to
other participants in the Internet ecosystem, even though these other
participants will be collecting exactly the same data and using it for
exactly the same purposes (e.g., online advertising) as ISPs.
In addition, the free flow of data is the lifeblood of the Internet
economy. The proposed heightened consent requirements, however, would
impede consumers' access to information about new online services and
cost-savings that may be of interest to them and therefore would reduce
ISPs' incentives to develop new services, reducing competition and
innovation online.
The Commission's failure to take these costs into account
exemplifies its broader failure to conduct a full economic analysis of
the proposed rules.
Finally, the Commission's proposed choice rules are
unconstitutional because they would uniquely prohibit ISPs' use and
disclosure of information for marketing purposes without obtaining
consumers' opt-in consent. By treating ISPs differently from other
online entities, the proposed rules would create a discriminatory,
speaker-based regime. Such a regime is presumptively invalid and
subject to strict scrutiny, which the proposed rules could not
withstand. Nor could the proposed rules survive intermediate scrutiny:
by requiring opt-in consent for most first-party marketing and other
activities, regardless of the potential for consumer harm, they are not
narrowly tailored to advance a substantial governmental interest.\1\
---------------------------------------------------------------------------
\1\ See also Professor Laurence H. Tribe and Jonathan Massey, ``The
Federal Communications Commission's Proposed Broadband Privacy Rules
Would Violate the First Amendment,'' WC Docket No. 16-106 (May 27,
2016) (white paper detailing how the FCC's proposed rules would violate
the First Amendment in various respects and should not be adopted).
---------------------------------------------------------------------------
Fortunately, there is another path forward. The Commission should
adopt rules modeled after the FTC's longstanding and highly successful
approach, which the FTC staff highlighted in its comments filed in this
proceeding. This technology-neutral approach--which applies an opt-in
consent requirement to the use and sharing of sensitive information
such as financial, health, children's, and precise geolocation data as
well as social security numbers, plus robust notice and opt-out choice
for other data uses--would provide strong, time-tested, and consistent
privacy protections for consumers across the Internet ecosystem while
fostering continued innovation, competition, investment, and growth.
Respectfully submitted,
(Affiliations provided for identification purposes only)
Laurence H. Tribe
Carl M. Loeb University Professor & Professor of Constitutional Law
Harvard Law School
Richard A. Epstein
Laurence A. Tisch Professor of Law, The New York University School of
Law
The Peter and Kirsten Bedford Senior Fellow, The Hoover Institution
The James Parker Hall Distinguished Service Professor of Law Emeritus
and Senior Lecturer, The University of Chicago
Robert Corn-Revere
Partner
Davis Wright Tremaine LLP
Robert D. Atkinson
President
Information Technology and Innovation Foundation
Jane Bambauer
Associate Professor of Law
University of Arizona
James E. Rogers College of Law
Babette Boliek
Associate Professor of Law
Pepperdine University School of Law
Fred H. Cate
Distinguished Professor and C. Ben Dutton Professor of Law
Indiana University Maurer School of Law
James C. Cooper
Associate Professor of Law and Director, Program on Economics & Privacy
Scalia Law School, George Mason University
Justin (Gus) Hurwitz
Assistant Professor of Law
Nebraska College of Law
Mark A. Jamison
Director and Gunter Professor, Public Utility Research Center
University of Florida
Daniel A. Lyons
Associate Professor of Law
Boston College Law School
Geoffrey A. Manne
Executive Director
International Center for Law & Economics
David W. Opderbeck
Professor of Law, Seton Hall University Law School
Director, Gibbons Institute of Law, Science & Technology
Paul H. Rubin
Samuel Candler Dobbs Professor of Economics
Emory University
______
July 11, 2016
Hon. John Thune,
Chairman,
Senate Committee on Commerce, Science, and Transportation,
Washington, DC.
Hon. Bill Nelson,
Ranking Member,
Senate Committee on Commerce, Science, and Transportation,
Washington, DC.
Dear Chairman Thune and Ranking Member Nelson:
We write to applaud the Committee for your efforts to examine the
Federal Communication Commission's (``FCC'') proposed broadband privacy
rules. Now that the reply comment period in the FCC's proceeding has
closed, this hearing is a timely and important venue for considering
the deep flaws that we, and many other commenters, have identified in
the FCC's lead proposal. In the months since the FCC unveiled its
proposed rules, a diverse set of stakeholders has criticized the
proposals because they would impose unnecessary costs on consumers, put
a drag on innovation and competition, and make it harder for broadband
Internet access service providers (``ISPs'') to work with the
government and third-party partners to ensure the security,
reliability, and integrity of the service. The record before the FCC
adds depth and breadth to these criticisms and raises additional
arguments, including important constitutional concerns. It is clear
that the FCC's proposed rules are both inconsistent with consumer
expectations and clash with the important policies that have
successfully guided the Internet economy for almost two decades under
both Democratic and Republican administrations.
Title II of the Communications Act in no way requires the FCC to
adopt prescriptive privacy rules that would single out one subset of
the broader online ecosystem for heightened and inconsistent regulation
that ignores the sensitivity of the information at issue. As comments
from current and former Federal Trade Commission (``FTC'')
Commissioners, civil rights organizations, economists, legal scholars,
and companies ranging from advertisers to home efficiency companies
have noted, the FTC's consumer privacy framework is much better suited
for the dynamic, innovative, and highly competitive Internet economy--
in which ISPs play an important but limited role. At the center of the
FTC's framework and the Obama Administration's reports and legislative
proposals is the idea that companies should be transparent with
consumers, provide them with choices that are appropriate for the
sensitivity of data or use in question, and maintain reasonable data
security safeguards.
Consistent with that approach, before the FCC initiated the
broadband privacy proceeding, a broad industry coalition of ISPs, tech
companies, equipment providers, and others joined together to urge the
FCC to adopt a framework based on the broad principles of transparency,
respect for context, and choice. The coalition's proposal, which is
attached to this letter, emphasized that ``[c]onsumers should have
consistent and predictable privacy protections for the information they
deem private and sensitive, no matter how or with whom they share it.''
In other words, we support privacy protections that address the
potential for genuine consumer harm, allow consumers to exercise
appropriate control over how information about them is used and shared,
and provide the flexibility that is necessary to promote innovation and
competition. The FCC's proposed rules, however, are inconsistent with
the flexible framework that the FTC enforces against many other players
in the Internet economy; and the proposed rules offer no material
improvement to consumer privacy protections.
The staff of the FTC's Bureau of Consumer Protection recently made
the same point in their comments to the FCC, noting that creating
special rules for ISPs ``is not optimal'' and that the rigid proposed
rules ``could hamper beneficial uses of data that consumers may prefer,
while failing to protect against practices that are more likely to be
unwanted and potentially harmful.'' We agree: privacy rules that hamper
innovation and competition while also failing to meet consumers'
expectations are ``not optimal,'' to say the least.
The FCC's proposed rules are also seriously out of step with the
technology-neutral approach--applied to both ISPs and non-ISPs--that
that has guided the Administration's many efforts on privacy and
cybersecurity policy, with great success. For example, the
Administration's Consumer Privacy Bill of Rights emphasized the
importance of common principles that apply across the ecosystem, in
particular the need to harmonize the standards that apply to
communications companies with the standards that apply to the rest of
the Internet economy. The Consumer Privacy Bill of Rights framework
provides a ``clear statement of basic privacy principles that apply to
the commercial world, and a sustained commitment of all stakeholders to
address consumer data privacy issues as they arise from advances in
technologies and business models.'' Similarly, the Administration's
Cybersecurity Framework was ``created through collaboration between
government and the private sector, uses a common language to address
and manage cybersecurity risk in a cost-effective way based on business
needs without placing additional regulatory requirements on
businesses.'' This is the right approach for the innovative, dynamic,
competitive Internet economy.
The FCC's proposal to go in a radically different direction also
raises serious constitutional concerns. Professor Laurence Tribe, a
pre-eminent scholar of the U.S. Constitution, concluded that the
``profound mis-matches'' between the goals of the FCC proposal and its
actual effects if adopted would violate the First Amendment in several
ways. According to Professor Tribe, because the proposal ``singles out
broadband ISPs for extremely burdensome regulation'' while leaving a
wide range of other participants in the Internet economy under
different rules, it is the kind of speaker-based restriction that would
face strict scrutiny under the First Amendment. Professor Tribe also
concluded that the proposal would be unconstitutional even under the
more lenient standard that applies to commercial speech. The time-
proven effectiveness of the legal standards that the FTC enforces
demonstrates that a much less restrictive alternative is available to
the FCC.
Put simply, the ``profound mis-match'' between the FCC's highly
restrictive proposal and the surrounding legal, economic, and
technological landscape is bad policy and constitutionally problematic.
We appreciate the Committee's important recognition of this issue
and the need for Congressional oversight. We are hopeful that your
examination of these issues will lead to an FCC approach that closely
harmonizes FCC privacy rules with the existing FTC framework and is
consistent with the Administration's guiding principles for privacy and
security in the Internet economy. Doing so would protect consumer
privacy, minimize consumer confusion resulting from inconsistent
regulations, permit new entry into the online advertising market, and
provide the flexi-
bility the online marketplace needs in order to continue to innovate
and evolve as it has done for many years under such a regime.
Sincerely,
Gary Shapiro
President and CEO
Consumer Technology Association
Jim Halpert
President & CEO
Internet Commerce Coalition
Jonathan Spalter
Chair
Mobile Future
Scott Belcher
CEO
Telecommunications Industry Association
Meredith Attwell Baker
President and CEO
CTIA
Genevieve Morelli
President
ITTA
Michael Powell
President & CEO
National Cable & Telecommunications Association
Walter B. McCormick, Jr.
President & CEO
USTelecom
The Chairman. There is also a new paper published by Gerard
Faulhaber, former Chief Economist at the FCC, and Hal Singer, a
Senior Fellow at the George Washington School of Public Policy.
Their paper is titled, ``The Curious Absence of Economic
Analysis at the Federal Communications Commission: An Agency in
Search of a Mission.'' And while it focuses primarily on the
Commission's failure to ground its recent regulations in
economic reasoning, Faulhaber and Singer offer some valuable
insight in this case about the FCC's privacy proposal, and
particularly noting the complete lack of any cost-benefit
analysis by the Commission in this proceeding.
So I want to as well submit that for the record.
[The information referred to follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairman. As I mentioned in my opening statement, 94
percent of Americans prefer that all companies collecting data
online follow the same consumer privacy rules, and so the
question for any of you really is the FCC is, as I've said,
nonetheless proposing to create a privacy regime for ISPs
that's wholly distinct from the privacy rules governing all
other companies on the Internet. So do any of you believe that
consumers expect or want to have their online activity
subjected to privacy rules that differ depending on the type of
company collecting their information?
Mr. Ohm.
Mr. Ohm. Absolutely. I think companies--consumers do expect
that health care companies, for example, when interacting with
a consumer on the Internet, are obligated to follow different
rules. I think parents, and I'm a parent of young children,
hope that websites are obligated to follow different rules when
it comes to the sensitivity of information collected from
children. I think the same is said when our children go to
school and use Google Docs: we hope that the companies that are
engaging in contracts with our school districts are obligated
to follow special privacy rules. And as I said in my opening
statement, I think ISPs belong in this group as well for the
reasons that I've already laid out.
This speaks to something that we've heard in this debate,
that the FCC rule will somehow confuse consumers. I think I
give the American consumer a lot of credit, right? The notice
and choice regime that the FTC use, which is exalted by almost
everybody in this debate, is frankly a pretty complex system of
reading privacy policy after privacy policy after privacy
policy, trying to manipulate privacy settings. It's a really,
really straightforward thing. In contrast to that, what the FCC
proposes is a bright line opt-in consent for certain uses of
information that are unexpected. Thanks.
The Chairman. Mr. Leibowitz.
Mr. Leibowitz. Yes. Can I just respond to the last point?
And I have the greatest respect for Professor Ohm. He worked
for the FTC when I was there, he helped out with the Children's
Online Privacy Protection Act, and he did a great job. But
first of all, the FTC approach is not complicated, it is
simple. It prohibits unfair or deceptive acts or practices, and
if you--which means if you're a company and you don't honor
your privacy commitment, the FTC will go after you. And the FTC
has brought cases against Google, against Facebook, against
Dish Network for not honoring its privacy commitments.
The second point I'd make--I just want to come back to the
consumer confusion issue--90 percent of consumers, according to
a study--this might have been what you cited, Mr. Chairman--by
the Progressive Policy Institute, and I'll put this in the
record after the hearing, believe that consumers should be
under the same rules, and those same--and those same rules--and
the reason isn't just because of consumer confusion, although
that's a reason, the reason is because consumers benefit when
there is competition between ISPs and other technology
companies, and the FCC has an ability to take the FTC approach
and turn it into rules. And that's why I think Mr. Garfield's
idea of having them put out a second draft, because the draft
that they've put out is full of--it makes--I believe they have
policy choices or the Coalition believes, and it is riddled
with just mistakes, would be a good idea. You don't write a
bill--you don't write a bill, introduce it one day and go to
the floor the next day. It gets beveled by this committee, it
gets tested and stress-tested, and that's what the FCC should
do. This is a big part of industry. You want to get this right.
They're not very close yet. They need to do a better job.
Mr. Garfield. Yes, I would add that the problem is not
simply that it's distinct, and there's a problem there, as Mr.
Leibowitz has pointed it, it's also that it ignores what is
proven to be effective and workable over decades. And so
replacing something with something that's likely to not be
workable is making change for change's sake without any
evidence that will improve the nature of things for consumers.
The Chairman. Mr. Leibowitz, has the FCC identified any
specific harm or particular problems posed by ISPs that require
a different privacy framework from what the FTC has applied to
ISPs for years?
Mr. Leibowitz. No, I don't believe it has, Mr. Chairman,
and, indeed, you know, it would be easy for the FCC to take the
FTC's approach embodied in the 2012 report, which, by the way,
was criticized by some businesses and supported by a lot of
consumer groups, and just focus on the really important thing,
where consumers need protection, which is sensitive data.
The Chairman. Mr. Polka, while the FCC's proposals would
place significant additional burdens on all broadband
providers, as you pointed out, there are burdens that I think
probably disproportionately affect smaller providers, like
those serving much of South Dakota and rural America, who may
have only hundreds or perhaps a few thousand broadband
consumers.
Would you think the FCC's proposed regulations lead to more
and better broadband service options for rural American
households, or might they lead to less? And maybe you could
elaborate a little bit, too, some of the burdens and how they
do disproportionately affect providers in our part of the
world.
Mr. Polka. We believe it would lead to less with a chilling
effect on investment and deployment, which is something none of
us want. I mean, we're all here in Washington where we're
encouraging greater deployment of broadband in smaller markets,
rural areas. And the fact of the matter is you can look at our
members and say that they're good actors. They've been member
companies that have supported privacy and protected the privacy
of their customers for decades.
And, in fact, our member companies have been part of the
solution. We're the ones that have delivered broadband out to
the smaller markets in rural areas where the large companies
simply won't come. So we are part of that solution in reaching
those hard-to-reach communities.
But what we're talking about here is really the challenge
of balancing the need for privacy and privacy regulations with
the ability to deliver important broadband services in rural
markets in rural areas, in smaller markets, and in competitive
areas, and that's where I think the balance is necessary with
the FCC's rules.
When we look at changing the nature of what has been a
consistent longstanding policy that is applied to consumers in
the broadband--Internet ecosystem for years and now changing
that and changing their expectations, I think we're asking for
trouble.
As your previous question alluded to, consumers expect
privacy to apply across the board. If you create two different
systems of privacy regulation, the consumer is going to think
there is just one standard. They might be surprised on the
other end, where there's a lesser standard, to realize that
maybe their privacy isn't protected as maybe they assumed it
would be when they're dealing with their ISP.
The Chairman. Thank you. My time has expired.
Senator Nelson.
Senator Nelson. Thank you, Mr. Chairman.
I have been struck listening to your testimony, and I thank
you for it, I think it's very reasoned. What we have been going
through over the past several years in trying to protect the
privacy of American citizens and American persons from
intrusion by the government, and, thus, we have set up this
long case history that if you want to get something in
somebody's house, you have to go to a judge, if you're the
government, to get that. So, too, then in this new world of the
Internet and telephone calls, we have said that if the
government wants to get content of those communications, it has
to go to a specially set-up court to handle intelligence
matters, the FISA court.
Now, if that is true and now we move from government
wanting to get your content over to corporations wanting to get
your content, Professor Swire, is that the reason that half the
people are now encrypting their communications?
Mr. Swire. Well, a big reason for the shift in encryption--
and I was on the President's NSA Review Group and we worked a
lot on those FISA kinds of things--a big reason is that
American-based companies that operate overseas were facing a
lot of loss of confidence overseas, folks didn't want to use
U.S.-based services, and one of the ways that American-based
tech companies have responded is by upping the level of
encryption in a lot of different places.
Senator Nelson. But you said in your testimony, as I
understood it----
Mr. Swire. Yes.
Senator Nelson.--that it is the consumers that are choosing
to encrypt their communications.
Mr. Swire. It happens at the service level. So Gmail a few
years ago wasn't encrypted, and now it is. Facebook a few years
ago wasn't encrypted, and now it is. It's complicated for us,
as individuals, to set up an encryption system, but it's by
default, then it works, and what's happened for consumers is in
the last few years the defaults have shifted a lot more toward
encryption.
Senator Nelson. OK. Professor Ohm.
Mr. Ohm. Yes, no, it's a great question and it's a really
interesting one. I spent four years at the Justice Department
as a computer crime prosecutor----
Senator Nelson. In essence, my question to you is----
Mr. Ohm. Yes, yes.
Senator Nelson.--do we not have an obligation since we're
protecting American citizens and American persons from the
government intrusion of their content, do we not have an
obligation to protect from the commercial intrusion of their
content?
Mr. Ohm. Yes, it speaks to the Chairman's question about
consumer expectations, right? Privacy is in shambles
everywhere. The consumers and the citizens feel a lot of
anxiety about this, and again I'm guessing that you hear this
from your constituents. One measure of this is kind of clamor
for encryption. And, by the way, some of that encryption may
be, ``Please encrypt your service so my ISP can't look over
shoulder,'' which feeds the FCC's impetus, not cuts against it,
right? And for these reasons--and, in fact, in some of my work,
I've even documented how the line between these two systems of
surveillance is actually quite blurry, and that a lot of
government surveillance is sometimes abetted by massive data
bases that are held by corporations.
But to get to your basic point, I couldn't agree more. Like
if we want parity, we should have parity in all ways, including
parity in the understanding that information, when it's sent
through an intermediary that you have to use, you have no
option not to use an ISP, will have a modicum of measured level
of modest privacy support on top of that.
Mr. Garfield. What we're talking about is not a choice
between protection or no protection. What we're talking about
is the framework for that protection, and should it be grounded
in well-established principles or reinvented whole cloth by the
FCC?
Senator Nelson. Well, what we're talking about, when you
look at it from the consumer's standpoint, is, should the
consumer have the authority, by giving their consent or not, to
control the invasion of their content? That's what we're
talking about.
Mr. Garfield. Right. But opt-in and opt-out are both giving
consumers choice and consent. What we're talking about is
whether the agency gets to define which is----
Senator Nelson. But as a practical matter, that doesn't
work that way.
Mr. Ohm. Right. And if I may, Senator Nelson, it goes
directly to your question, the Wiretap Act and FISA, which you
referenced, they do have consent exceptions, but they're prior
consent exception just like the FCC's opt-in rule. Imagine if
it weren't so. Imagine if the baseline rule was all of our
communications could be wiretapped unless we found some obscure
government website and opted out. Right? So this goes exactly
to the question that you were asking.
Mr. Leibowitz. But the other thing I just wanted to mention
is you are talking about sensitive data, and I think we all
agree there should be protections for sensitive data. That was
the FTC's approach, and we believe that could be the FCC's
approach, but that is not the approach they have now, it's for
all data. And keep in mind that right now over the top 10 ad
sites and 70 percent ad-selling companies and 70 percent of
online advertising revenue, much of it driven by rich data
collection. It's not ISPs, it's everybody else in the Internet
ecosystem. And so everyone should be under the same--every
company should be under the same rules to protect the kind of
data you want protected.
Senator Nelson. Well, I'll get into it later on. But thank
you, Mr. Chairman.
But let me just tell you some country boy logic. One
person's sensitive data is not another person's sensitive data.
And so the question here to me is, Should the consumer have the
choice of whether they want that data shared with the
commercial sector?
The Chairman. Thank you, Senator Nelson.
Senator Blunt.
STATEMENT OF HON. ROY BLUNT,
U.S. SENATOR FROM MISSOURI
Senator Blunt. And following up on that thought, Mr.
Leibowitz, why would you have two different standards?
Mr. Leibowitz. Well----
Senator Blunt. Even if you do establish this data,
sensitive data standard, why would you have one standard for
one group of data providers and another standard for another
group of data providers?
Mr. Leibowitz. Well, I think you're absolutely right, and
in the FTC's 2012 report, which was widely praised by consumer
groups and had some praise and some criticism by businesses, we
called for the same standards to be imposed on all large-
platform providers, large-platform providers meaning both ISPs
and other collectors of data, if those standards were to be
applied at all, because we think that's what's critical, and
technology neutrality, which I think is the point that you're
going to.
Senator Blunt. It seems to me, Mr. Garfield, that that's
the fundamental debate we ought to be having here, is if we
determine the issue of sensitive data, why would it only apply
in one sector of the way we transmit this information? I mean,
everything from my flashlight on my iPhone, I believe if there
is a way to disconnect that from the location finder, I don't
know what it is, so if I turn on that flashlight, somebody
knows where I am, or at least it's been registered in a way
that somebody could find out where I was, and that kind of data
isn't even considered in this FCC discussion. Is that right?
Mr. Garfield. Correct. The FCC's proposed rules would only
apply to companies that provide broadband internet access
services and that are otherwise covered by the Open Internet
Order and so would not apply to many of the companies that I
represent.
Our advocacy--there are important differences between
network operators and our companies, but our advocacy today is
not suggesting that there shouldn't be protection, it is
actually making the point that you're making, which is we have
rules that have been working for the last--at least the last 3
decades, and rather than rewrite those rules with no
foundation, no data to suggest that they would help consumers
more, less rely on the rules that are well established that
have been working that have been developed by the FTC.
Senator Blunt. Mr. Polka, I believe your group of
companies, the American Cable Association, is largely small and
rural cable providers.
Mr. Polka. Right.
Senator Blunt. What would be discussed here? Does that
impact the ability of your companies to provide the higher
levels of Internet and communication that we think everybody
needs to have?
Mr. Polka. It would because it adds layers of complexity
regarding privacy compliance. And in saying that, I'm not
saying at all that our members are not strictly committed to
protecting the privacy of their customers, it's just that these
rules have a tradeoff effect in terms of providing broadband
service in smaller markets.
When you're talking about small companies in southeast
Missouri that I know of, such as BOYCOM Communications or
Fidelity Communications or SEMO Communications, that have less
than a couple of thousand subscribers, the FCC would be asking
them to maintain a strict liability of ensuring privacy
protection, which even the FTC has said is undoable. It's
impossible to meet that standard, not to mention the revision
of policies, the revision of consents that are asked of
consumers who opted out to provide consent for commercial
reasons, which they enjoy, now to an opt-in over non-sensitive
data that would necessitate the addition of legal time,
consultant time, man-hours. The FCC itself hasn't even
determined the cost-benefit analysis of these rules on smaller
operators, let alone larger ISPs, and I think it's a big issue
in terms of----
Senator Blunt. And in rural areas, it costs more to add
customers----
Mr. Polka. Absolutely.
Senator Blunt.--that are further spaced apart, and you're
saying this is just another reason not to make that additional
investment to further expand your liability for very little
impact on your company in a positive way? Is that----
Mr. Polka. What this would cause is a shift of resources
from investment and deployment into regulatory compliance for
smaller businesses, and that means less deployment of broadband
in smaller markets, rural areas, slower speeds, maybe less
capacity. And in addition, because of the customer confusion,
maybe customer anger over consents that they now have to give
that they didn't have to give before, more consents, and in
such a way, creating, you know, fatigue on the part of a
consumer to say, ``Well, I just give up. I don't even want the
service any longer.'' We don't want to see that happening in
our markets.
Senator Blunt. Thank you.
The Chairman. Thank you, Senator Blunt.
Senator Schatz.
STATEMENT OF HON. BRIAN SCHATZ,
U.S. SENATOR FROM HAWAII
Senator Schatz. Thank you, Mr. Chairman.
Professor Ohm, it seems to me that one of the basic
questions is, what is it that makes an ISP different from
another Internet company? And the Title II part is easy, that
was sort of pursuant to a legal strategy, the Open Internet
Order. Set that aside for a moment. Your assertion, and I find
it persuasive, is that ISPs occupy a unique place in the
Internet ecosystem, and especially for people in rural areas
and actually people in D.C. who have very few choices in terms
of how they get on the Internet.
So I want you to talk a little bit about that, and then I
want to give a chance for Mr. Leibowitz to respond, and then,
additionally, I want you to respond to Professor Swire's data
point regarding encryption because it seems to me that this
unique place in the ecosystem becomes somewhat less critically
essential if you're talking about 70 percent encryption
eventually and going up and up and up, which is to say,
intuitively, I don't want to necessarily let an ISP have all of
my data, and yet if all they know is that I went to Facebook, I
went to the Star-Advertiser back home, I went to Gmail, that I
do not find to be, to repeat Mr. Leibowitz's term, particularly
personally sensitive.
So I want you to address, first of all, what is it that
makes an ISP special? And how do you respond to the contention
that increasing encryption may diminish that argument?
Mr. Ohm. Absolutely, and thank you for the question. There
are actually two ways to take on the first question. I think
they're both consistent with one another. The first is simply
the choice point again, that if you have an operating system,
as Professor Swire suggested in his testimony, that is bucking,
frankly, their industry norms and beginning to build a dossier
on you as well. Well, first of all, it will have a press outcry
when this is revealed; second, you have a choice to switch
operating systems. It's even an easier choice if it's your
browser that is doing the untoward spying, but when it's your
Internet service provider, as you say, for rural Americans, for
people who live on tribal lands, and for urban dwellers, that's
not really a meaningful choice.
Second, it goes directly to Senator Blunt's----
Senator Schatz. So you're not necessarily talking about
current bad behavior, but potential future bad behavior.
Mr. Ohm. Potential future, yes.
Senator Schatz. Fairly.
Mr. Ohm. I strongly believe that we don't need to wait for
Pearl Harbors and data out--you know, dead bodies before we
decide in anticipation to regulate something, right? And I
think that's the decision that was made by this body in 1996.
Second, it goes to Senator Blunt's question about, Why have
two standards? Right? As I said earlier, we have numerous
privacy standards about online space itself. One reason why not
to have two standards is because Congress hasn't gotten around
to regulating----
Senator Schatz. Well, I'll just interject there and point
out that if you ask a person whether they think that there
should be one standard, the assumption of the respondent in the
poll is that it would be one high standard----
Mr. Ohm. Right.
Senator Schatz.--not one high standard and one low
standard. So I don't find that particularly persuasive at all.
Mr. Ohm. Yes, no, no. And if I can say one more thing
agreeing with you on that, I have all the respect in the world
for Professor Swire's work. You can read his report to say
everybody is collecting information in ways that consumers
don't know, don't expect, don't appreciate. Right? And so you
could read it, and I think he's even said this, you can even
read it as a full-throated defense for more privacy law in
different sectors. Right?
Senator Schatz. Can I get you to respond to the encryption
question and then kick it over to Mr. Leibowitz?
Mr. Ohm. Absolutely, absolutely. So encryption is
spreading, but as the report from Upturn, which has been widely
cited, has said, 85 percent of the most widely used websites
still don't encrypt. It's a sad fact in 2016.
The second thing is you were talking about a rather anodyne
list of websites that you may not care if people know about,
but it doesn't require much imagination to come up with the
websites we might care more about. This person is visiting the
NRA website reliably, this person is visiting Planned
Parenthood, this person is visiting Black Lives Matter related
websites. Right? There's a long tail of sensitivity, and
sensitivity is often in the eye of the beholder.
Senator Schatz. OK. Go ahead.
Mr. Leibowitz. So I will yield 30 seconds of my time to
Professor Swire at the end so that he can talk about why----
Senator Schatz. That gives you 10 seconds.
[Laughter.]
Mr. Leibowitz.--why ISPs are not unique. Then I will only
yield 15 seconds of my time.
[Laughter.]
Mr. Leibowitz. But I think the important answer--and I can
see you're struggling with this, and I think all of us are
struggling with this, is you can have similar--rules ought to
be technology-neutral to the extent that they can, and if
you're going to have a higher level of scrutiny--right?--for
the things that consumers are concerned about and that they
need to be protected about, then it should be the kind of
sensitive data like health, like financial information, and
like information that involves children--right?--which is what
the FTC did in its role, which Senator Markey was very involved
in, on the Children's Online Privacy and Protection Act.
And so all we are saying from a 21st Century Privacy
Coalition approach, Privacy Coalition approach, is have the
FCC's rules reflect more of the FTC's policies, which is
enforcement plus restrictions on sensitive data and technology
neutrality to the extent that you can do it, and then I'll turn
it----
Senator Schatz. With the Chair's permission, we'll go to
Professor Swire for just a couple of seconds.
Mr. Swire. I don't think I have really much to add.
Senator Schatz. OK. Thank you.
[Laughter.]
The Chairman. That is a first in front of this committee.
[Laughter.]
The Chairman. I have Senator Markey up next.
STATEMENT OF HON. EDWARD MARKEY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Markey. Thank you, Mr. Chairman, very much. And I
guess I would argue that where you go online all day long, and
we've learned from recent surveys that adults and children are
pretty much online all day long, but where you go online all
day long is as sensitive as your health information. It is as
sensitive. I mean, that's the profile of who you are as a human
being in the United States in 2016. OK? If that information is
not considered to be sensitive, then all of us have every bit
of information being gathered about us, about what we're doing
all day long, every single day, as being out there and kind of
being determined to be not sensitive, not sensitive, just kind
of a product, just information that can be sold to people. And
I think that's what the heart of this whole matter is all
about.
So historically, the telephone company was viewed as a
company that if you got on the phone and you called that
department store or you called this or you called that place,
we had laws that said the telephone company can't sell that
information, where you went, who you are. Right? And beginning
now, with this new FCC regulation that's been upheld, well,
this broadband access is now considered to be a common carrier
like a telephone company was, so now the FCC has the ability to
regulate it.
And so as you're looking at the issue again and you're
saying, OK, so what should the protections be? What should this
common carrier be allowed to do with all of this information,
which is essentially who we are as people? Now, what that
company did that you called with your information, that's one
issue, and we have to deal with that, but this is a separate
issue. What does the telephone company do? Because essentially
there's just a telephone company and a cable company. You don't
have a choice. If you're going to be online, you have to pick
one or the other, and in many places, you can just pick one.
So, Professor Ohm, can you talk a little bit about that
transferring over of what the expectations are of ordinary
Americans and the protection of this profile of who they are as
a human being?
Mr. Ohm. There are so many studies, including a
particularly distressing one about a survey of American
authors, that show that people hesitate to surf the Web in the
way they would like to because they're worried about where that
information may end up. Now, it may be that for some of the
people, they're worried about the government, and for others,
they're worried about corporations, but that chilling effect
has been documented and it has a sort of deleterious effect and
influence on expectations that you've been describing.
And the other thing I can tell you is I couldn't agree more
with your assessment of all of this information being
sensitive. I would be so bold as to say it probably could
justify a ban on the sort of behavior we're talking about, but
that's not what Congress did in 1996, and it's not what the FCC
has done in its rule. It's a very measured rule, and I would
love to say more about that, but it doesn't go to the extreme--
--
Senator Markey. Then say a little bit about that because
what they're talking about is giving consumers more power to
choose if their sensitive information can be used or shared by
the ISPs, require the ISPs to adopt ADA security protections
and notify consumers if a breach occurs, and promote
transparency by mandating that the ISPs disclose what they
collect about consumers. So what's wrong with that?
Mr. Ohm. Absolutely. It's a modest set of requirements. It
overlaps in significant part with the FTC report of 2012 that
Mr. Leibowitz has talked about several times. As I hear Mr.
Polka's testimony, and I'm very sympathetic to the idea that
small businesses need to be accommodated by regulations, I
heard him say repeatedly this his companies are responsibly
already doing right by their consumers when it comes to privacy
and security. I'm guessing most of them are not selling data en
masse to advertisers. This rule will have modest effect on
them, and if there is something that's disproportionate, then
the FCC ought to accommodate that.
Senator Markey. Yes. So this essentially says there's a
bill of rights, that is, that each American knows what the
rules are going in----
Mr. Ohm. Yes.
Senator Markey.--rather than hoping that the FCC brings a
case later on saying, ``You know, that was really an unfair and
deceptive practice.''
Mr. Ohm. Well, and I'm sorry to disagree just a little bit.
I wish it were more of a bill of rights. This is merely an
opportunity for a contractual, meaningful contractual,
conversation with your ISP, but you're not afforded any rights,
right? They can say in some meaningful ways, ``The deal we're
offering you is not a very good deal, but here's the deal we're
offering.''
Senator Markey. ``Here's the deal.''
Mr. Ohm. Yes. But, again, I totally agree. It's a modest
measured approach to privacy on this----
Senator Markey. There's kind of an argument here, well,
this is kind of like a radical departure from what's been going
on for the last 20 years, and what you're saying is it's not at
all.
Mr. Ohm. Yes.
Senator Markey. It's modest.
Mr. Ohm. Absolutely.
Senator Markey. It's reasonable. It gives the consumer some
rights, some sense of expectations about what they can expect,
but it's in their relationship with the ISP, with the telephone
company and cable company, and then they can decide what they
want to do.
Mr. Ohm. And, quite importantly, they're having a public
NPRM. Congress is watching them very closely. They have strong
incentives, the agency does, not to do something that's
terribly radical, hence the modest approach.
Senator Markey. OK, great. Thank you.
Thank you, Mr. Chairman.
The Chairman. Mr. Leibowitz, did you want in on that?
Mr. Garfield?
Mr. Garfield. It is far from modest, and that's--moreover,
if you are, as Professor Ohm said, going to regulate
prospectively, I think it's incumbent upon you to bring forward
evidence to suggest that the alternative approach that you are
going to move forward with is one that will actually benefit
consumers.
Mr. Leibowitz. Yes.
Mr. Garfield. And in this NPRM, there is no zero data
suggestive of that, and that's why we think it's critically
important that there's a second NPRM that cabins--reacts to the
responses that have been given thus far to date, and that gives
consumers, as well as the public broadly, the opportunity to
react to what's being proposed.
Mr. Leibowitz. Yes, and I just want to say I do agree that
they should put out a second draft of this proposal. But having
said that, going back to your point about the
constitutionality, Senator Markey, when we were dealing with
phones, it was a closed universe of information, as you know.
Now we're dealing with data, and when you're dealing with data
and so little of it is collected by ISPs and so much of it is
collected by others, you have a problem under the Central
Hudson Test because you are treating different entities that do
the same thing differently. So that's the constitutional
infirmity.
I won't dwell on it much longer, but it's something that
I'm sure the FCC is thinking about, and the more that they make
their rules technology-neutral, I think the higher the decibel
level goes down, the more--and I think the less they have
constitutional infirmities.
Senator Markey. Well, again, I would leave it up to the
same lawyers at the FCC that were just upheld at the Circuit
Court to determine what is, in fact, constitutional or not, and
so far their record has been very good in terms of drawing
those lines right where they can be upheld.
The Chairman. Thank you, Senator Markey.
Senator Moran.
STATEMENT OF HON. JERRY MORAN,
U.S. SENATOR FROM KANSAS
Senator Moran. Thank you, Mr. Chairman.
Mr. Polka, I want to talk again about small business. In
fact, I was reading the question as written in front of me, and
it said we want to shield small business from the effects of
harmful government regulations. The reality is, as I think
about that statement, it's not the business we want to shield
from harmful government regulation, it's the consequence that
that harmful government regulation has to the consumer----
Mr. Polka. Certainly.
Senator Moran.--and that's particularly true for a state
like Kansas. You visited with the Senator from Missouri, knew
there are small companies. That is what dominates in our state.
It is also a state in which we still struggle to have broadband
services, a wide array, across our state, and some places have
virtually none.
So one of the things that we've thought about doing is to
consider giving legislative clarification that the FCC has
exemption and waiver authority to deal with those kinds of
issues. And my question is, Do you believe that to be necessary
and helpful? And if so, I assume you and others would work with
us to try to get it right?
Mr. Polka. Without question. Companies like Eagle
Communications out of Hays, Kansas, that are phenomenal
providers of broadband service, have worked because our
regulatory scheme has encouraged smaller businesses working
with their consumers to flourish to provide these services in
their marketplace. But under today's circumstances, it's
becoming increasingly more difficult to do the same things.
We're here today talking about privacy where, with all due
respect to my new friend, Professor Ohm, I wouldn't say it's an
easy transition from one set of rules we're under to the
proposed new rules, particularly for smaller providers. But
that's one set of rules where we're talking about the need to
shift resources from providing more services to meeting a
regulatory compliance burden. But at the same time we're
sitting here, there are at least three other major rulemakings
that are moving forward at the FCC that have the same impact,
implementation of the Title II Order, the FCC's rulemaking on
set-top box reform, and also the FCC's rulemaking on broadband
business data, otherwise known as special access. Each of these
in their own could have the kind of negative effects that we
fear that our members would have to suffer by shifting
resources from deployment to compliance and regulation.
Now, again, it's not a situation where our members are at
all saying, ``We're not up to doing our duty,'' but there is a
balance that you have to reach when you talk about providing
the service from a commercial perspective as well as protecting
the consumers, and we're here to hopefully be part of the
answer to that. But certainly any greater understanding by the
FCC or requirement for the FCC to even look at the impact on
smaller businesses would be enormously helpful to achieving
everything we want to achieve, which is more deployment in
smaller markets.
Senator Moran. Sir, you make a good point. It never seems
to me that it's one regulation or one event that causes small
business to struggle and/or fail, it's the series of things,
it's death by 1,000 cuts----
Mr. Polka. That's correct.
Senator Moran.--one more additional burden, and at some
point in time the proverbial straw broke the camel's back.
Let me talk to Mr. Garfield about the cross-border data
transfers, the EU Privacy Shield negotiations. I'm told it has
just been announced that there is an agreement. This agreement
is necessary, I suppose, because the EU and the U.S. have
fundamental differences in the way we look at privacy, ours
based upon our Constitution. It's my understanding that
Americans officials advocated standards based upon the
longstanding FTC guideline for privacy. What effect would occur
in those negotiations, the resulting agreement, if we now have
the FCC regulations, the new standard?
Mr. Garfield. Let me begin by thanking Congress for their
role in getting the Privacy Shield passed. The passage of the
Judicial Redress Act was critically important in getting that
done. To answer your question, I think it would add a layer of
confusion that would be unhelpful, and so the Privacy Shield
recognizes that there is some distinction between the privacy
regime in the U.S. and the security regime in the U.S. and
Europe, but that they're essentially equivalent, and that's a
recognition that the FTC's framework and principles are well
established. It would be highly ironic and certainly unhelpful
if, because of another regulatory agency, that agreement that
has just been put in place would be called in question because
we're now questioning whether the privacy regime in the U.S. is
one that's workable.
Senator Moran. Mr. Leibowitz, anything you want to add to
that?
Mr. Leibowitz. No. I absolutely agree that the Commerce
Department and others are relying on the FTC approach, and if
it's being questioned it's not strong enough, I think that it
does not potentially bode well as the Privacy Shield goes
through the European Union vote.
Mr. Garfield. If I may just add one other thing that makes
it particularly relevant, is that though the Privacy Shield has
been passed, our expectation is that it will continue to get
challenged in Europe, including in the courts, and so the
actions that are taken here will certainly have impact, not
only in Europe, but in other markets around the world.
Senator Moran. Thank you.
Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Moran.
Senator Klobuchar.
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you very much, Mr. Chairman. Thank
you. I've been going back and forth to a FOIA hearing in
Judiciary in the same area of information and issues, so I want
to thank you for this important hearing and all of you for
coming today.
I've been very involved in the broadband issue and, as has
the Chairman especially in the rural areas, trying to get
broadband out. We have many problems with a lot of our
businesses, small businesses, farmers having to go to
McDonald's parking lots to get any kind of access. So this
privacy concern with broadband is incredibly important, but to
some of them may be a luxury because they can't even get the
access yet. But for most people who have access, this is an
issue.
Senator Hoeven and I actually have worked hard to include
the Driver Privacy Act, it's part of the FAST Act that was
passed, to put in some privacy protections for data collected
in cars. I'm not going to focus on that as much today.
I guess I would start with you, Mr. Leibowitz, about data
breaches continuing to jeopardize the security of consumers'
personal information. Data breaches can have, as we know, long-
term financial consequences for consumers. How should we
determine, Mr. Leibowitz, what kind of threat should lead to a
consumer being notified of a data breach? We certainly had this
issue with Target, my hometown company, and others. How do we
ensure that consumers receive data breach information that's
useful to them?
Mr. Leibowitz. Well, I think that you have to have a harm
trigger because--and, of course, in the example of Target and
many of the 50 data breach cases that the FTC has brought, it
involved harm. But the FCC's approach for data breach doesn't
have a harm trigger at all. So our concern is under the
approach they have, there would be massive overnotification to
consumers, and consumers would become--would see so many
notifications, and this is a problem in other disciplines as
well that the FTC has commented on, that they won't look at the
real notification that they need to because they'll be swamped
with other notifications that don't really have meaning.
The other thing, less important because it's not consumer
related, but important nevertheless, is that a sort of a no
harm approach for the ISPs is in some contrast with the
cybersecurity framework that NIST has prepared, which is really
about protecting critical information.
Senator Klobuchar. I see. I get it. And you also argue
about the FCC proposal to prohibit Internet service providers
from allowing companies to pay for extra privacy protections,
and you state that many of us may decide that the price to pay
to avoid personalized marketing is worthwhile. Of course, not
all consumers have the financial means to make that decision.
How would you answer the criticism that allowing consumers to
pay for privacy will result in weaker privacy protections for
low-income consumers?
Mr. Leibowitz. Well, it's not certain. I mean, it's a
reasonable question to be raised, but it's not certain what
ISPs would do if this--and this is an actual prohibition, as
Professor Ohm knows, if this--or this would be, if they were
allowed discounts. It may just be collecting data and using it
with your similarly branded affiliates.
These are not--ISPs are not data brokers. No one, I think,
would ever propose something like that. And so I think the
approach should be give consumers real informed notice so they
know what they're being offered, if they're being offered a
discount, and let them make the decision. And if I'm a family
of four making $35,000 a year and living in Minnesota, and I
want, you know--I want home security service or I want music
streaming or I want energy efficiency, I should have the right
or the ability to make that determination. The FCC's approach
in that area, at least, seems to me very top-down and command-
and-control.
Senator Klobuchar. OK. Mr. Ohm, maybe you want to respond
to that? And do you think FCC regulation of broadband privacy
can complement the FTC's privacy work?
Mr. Ohm. Yes, thank you for both those questions. Number
one, when it comes to pay for privacy, as it's colloquially
called, it does really give me a lot of pause, the idea that
we've already talked a lot during this hearing about the
paucity of choice that you have for a broadband provider, the
idea that the only broadband service you could possibly have is
one where you have to pay extra if you want the privacy version
of it, is distressing to me and it's something that I hope the
FCC will strongly consider dealing with.
It speaks to, I think, a broader undercurrent in this
debate. I don't have a lot of time, so let me say it briefly,
which is, a lot of the arguments and criticism has come from
the perspective of the well-paid D.C. lawyer. For example, a
statistic that's used often is the average American has 6.1
devices and three ISPs. Well, that may be true for the average
American, but it's not true for a lot of Americans, and, in
fact, a Pew study shows that a lot of Americans who have one
device and one ISP are disproportionately younger, they're
poorer, and they're also representative of racial and ethnic
minority groups.
So as we think about the policy questions, I want to make
sure we're thinking about all Americans, not just the well-to-
do.
Second, if you could repeat the same question, if I have
time to answer this.
Senator Klobuchar. Go ahead, yes. It looks like Mr.
Leibowitz might want to respond.
Mr. Leibowitz. That might be a point of privilege. But,
look, I spent--as you know, I spent most of my career in public
service, and, look, don't take my word for the concerns about
the FCC's rule, just look at the FTC's unanimous comment where
it says some of the choices made by the FCC are not optimal,
and it cites 28 different instances where they're in
disagreement, in polite, diplomatic language. Don't take my
word for it, don't take an academic's word for it, we're all--I
think we are all articulate witnesses, I may be the one
exception, but, you know, look at what the FTC thinks they have
done--thank you--they have done--the FTC has been the Nation's
leading privacy agency for the last 30 years, they're informed,
they know what they're talking about. I would listen to them as
well and perhaps more than all of us together.
Mr. Ohm. I think I'm out of time, but I invite the
opportunity to talk about the FTC. I would love to do that.
Senator Klobuchar. Well, I guess that's open for my
colleagues to ask you, and maybe I'll follow up with some of
this in writing, including with you, Mr. Garfield.
Mr. Ohm. I appreciate it.
Senator Klobuchar. So thank you very much.
Mr. Ohm. Thank you.
The Chairman. Thank you, Senator Klobuchar.
Senator Daines.
STATEMENT OF HON. STEVE DAINES,
U.S. SENATOR FROM MONTANA
Senator Daines. Thank you, Mr. Chairman.
Mr. Polka, I appreciate you highlighting in your testimony
the burden that these privacy rules will place on small
businesses. In a state like Montana, population and geography
pose tremendous challenges for small ISPs. I think about
Blackfoot Communications. They're the sole provider for
Elliston, Montana, population 225. Do small carriers even have
the technical capability to engage in the conduct the FCC is
trying to prevent? And if they do, do they have any incentive
to do so?
Mr. Polka. Not really, Senator. The situation you talked
about is typical, the company you referred to is typical. I've
been inside the network operation centers, if you want to call
them that, a small room in a head-end for a smaller provider,
and they may have a board and a diagram up there, and that
diagram has either a red signal or a green signal. Green means
the network is operating. Red means there's a problem they have
to fix. That's about the level that our members are looking at
to make sure that they're able to provide broadband service to
their customers.
The fact of the matter is, is that our members, the smaller
providers, as I've said before, are in the business of trying
to deliver that network service to their customer for the
customer to then use as the customer sees fit. And typically
our members have not been engaged, even under today's rules, in
the kinds of information gathering that would require opt-in
consent by a consumer.
Senator Daines. Let me--I want to continue this discussion,
and I think there has been talk about some of the inconsistency
perhaps. I'm just--I'm concerned about as these regulatory
bodies try to move at the speed of government when the world is
moving the speed of business, how we're just always playing
catch-up, and as Wayne Gretzky famously said, ``Skate to where
the puck is headed, not where it's at.''
When I send an e-mail, I add a Snapchat perhaps to a story,
there are a number of entities collecting data. Snapchat is my
browser, the ISP, they all have access.
Mr. Leibowitz, the question is, Do you think consumers
expect that all entities involved in sending an e-mail,
snapping a photo, are held to the same privacy standards, and
does it make sense to treat any one of these actors different
than the other?
Mr. Leibowitz. No. I think from the perspective of the 21st
Century Privacy Coalition, and I think from the perspective of
the consumers themselves, you want the same rules applying
across the board.
Senator Daines. So I was struck--I think, Mr. Leibowitz,
you made a comment I think in the back-and-forth with regard to
online ad marketing. Ten companies hold 70 percent of the
market share, none of them are ISPs.
Mr. Leibowitz. That's correct.
Senator Daines. In looking at the cross-context chart in
Professor Swire's report, it's astonishing how much consumer
information in the ad space, the social network space, have
compared to the ISPs. I mean, look at our phones. And, by the
way, if you want to see the behaviors, watch members during a
hearing, where are they at? They're camped out and probably
oftentimes on apps even more so than surfing. And I think when
you look at where young people are headed now, where, you know,
there's now more daily Snapchat users than Twitter users here,
it just crossed in the last 30 days. I mean, just profound
quick shifts here, where they're not out there surfing, they're
camped out on apps oftentimes. I realize the FCC does not have
jurisdiction over the entire Internet ecosystem, but does it
make any sense to have very prescriptive rigid rules for ISPs
and more flexible rules for edge providers and apps when ISPs
only see a fraction of what the edge providers see?
Mr. Leibowitz. No, it doesn't, and I agree with you
entirely. And it goes to another point as well, which is the
constitutional question, because when you are treating the same
information differently, you--it raises concerns under the
seminal Central Hudson Test, which is a Supreme Court case from
1980.
Senator Daines. So, again, this is a concern where I think
they're chasing the ISP issue right now, but look to where are
consumers increasingly headed more so?
Mr. Leibowitz. Yes, I agree with you, and the only other
thing I would add is if you want to protect consumer privacy,
which is critically important, and because the ISP--because the
FCC invoked Title II, they took away jurisdiction from the FTC.
The FTC has no jurisdiction over common carriers. ISPs are now
designated common carriers and upheld under the D.C. Circuit
decision, may be appealed. Because of that, they have to do a
rule, but they should do an intelligent rule that is free from
mistakes. We don't think their rule is balanced.
Senator Daines. So let me get a point the FCC made, and
this is my last question. In the FCC's Notice of Proposed
Rulemaking, it offered a justification for its approach, and it
stated, and I quote, ISPs are the most extensive conduits of
consumer information and have access to very sensitive and very
personal information, end quote.
Professor Swire, does your research find this statement to
be true?
Mr. Swire. It depends on the word ``conduit.'' If they're
the only conduits, then they'll be the most extensive conduit.
So it might be a finely crafted sentence that you could
technically say is true.
Senator Daines. So are ISPs the most extensive conduits of
consumer information with access to highly sensitive
information?
Mr. Swire. They have access to location data, which is
considered sensitive information, but overall, the point of our
research is that there is a lot of other folks who also see it,
and so--look, ISPs do see a bunch of information, so do a lot
of the other companies you were talking about, and this
committee and everyone has to figure out overall how we're
going to handle that.
Senator Daines. OK. Thank you.
The Chairman. Thank you, Senator Daines.
Senator Gardner.
STATEMENT OF HON. CORY GARDNER,
U.S. SENATOR FROM COLORADO
Senator Gardner. Thank you, Mr. Chairman. And thank you to
the witnesses for being here today.
Mr. Polka, why don't I start with you a little bit? This
committee, if you look around at the composition of the
Committee, it's a very rural committee, many members come from
states that have the very, very sparse populated areas, at
least in part, if not whole, of the state. I live in a little
tiny town in the eastern plains, about 3,000 people. The
nearest big city is a town that's 60 miles away, and it's
10,000 people, and then you have to go another 60 miles after
that to get to a town that may be 100,000 people. So these
areas are very, very spread out, very rural. And, if Senator
Klobuchar was here, I would say that having a McDonald's is a
luxury.
[Laughter.]
Senator Gardner. That's something that many of our small
towns, we don't have. But we talk about a lot of regulations
here in Washington that have opt-outs and provisions, and then
to say, you know what, we're going to pass this rule, but we
understand there are small businesses that would be overly
adversely impacted by this, and so we're going to give an opt-
out for this. Look at the CFPB, I know there are conversations
about whether community banks and credit unions ought to be
tailored, regulations tailored, under CFPB, the regulations
under Dodd-Frank, to address smaller banks and financial
services. Here we are talking about, well, a new rule that
would opt out for smaller providers, but it just seems like
that opt-out never happens, the regulations pile on, and then
you end up with higher costs and less service in many areas. So
how many of these companies you're talking about have full-time
regulatory compliance officers?
Mr. Polka. Very few. As I said in my statement, most of our
member companies have about 10 employees. Maybe they have one
or one and a half technical people that are out actually
putting service into the home or maybe climbing a pole or doing
a service call or maybe fine-tuning things in the head-end, so
to speak, where all the signals come in. But it's very, very
difficult. That being said, our members, over the last couple
of decades, have worked to comply with Section 631, the Cable
Privacy Rule, Section 222, for phone service of the CPNI rules,
and they have worked to develop policies that have been open
and that have been--provided disclosure to their customers. And
they have worked to protect the sensitive data of their
customers, whether, as Mr. Leibowitz was saying, whether it's
banking information, school information, health care
information, et cetera.
But to do what the FCC is requiring, would require under
this rule, would go to a level of complexity that when we talk
about shifting resources would be enormous in terms of legal
time to revise policies, to revise notices, to send out notices
that consumers aren't expecting, to comply with higher
standards of data security, which, as the FTC has said, is
impossible to meet.
Senator Gardner. So take away time from expansion,
investment, upgrades----
Mr. Polka. Without question, and without even an idea yet
from the FCC how much time, man-hours, paperwork, or cost it
would take. And, frankly, from a small business perspective, I
would have hoped that the FCC might have done a little bit of
homework in that area before implementing these rules or moving
forward because, in our view, there is none, and it's not my
word, it's the Small Business Administration's Office of
Advocacy that said these would be overly burdensome for smaller
ISPs. That's a fear and a threat that our members face.
Senator Gardner. Thanks. Mr. Garfield, you spent a good
deal of your testimony arguing about the FCC's approach to
privacy being both inconsistent with consumer expectations and
inconsistent with existing privacy regulations at the Federal
Trade Commission, FTC. I've supported numerous pro-privacy
initiatives during my time in Congress, and I want to ensure my
constituents that--I want to ensure their private information
is protected. But do you believe the inconsistencies you
mentioned could actually undermine consumer privacy
protections? And if so, how might negative consumer reaction to
concerns with their personal privacy impact your member
companies' businesses?
Mr. Garfield. I made the point--thank you for the question,
Senator Gardner--in my testimony that privacy and security are
first principles for our companies, and so any rule or
regulation that undermines our ability to advance both is
highly problematic.
Connecting your second to your first, I think this
proceeding of the FCC is actually an opportunity, it's an
opportunity to do something that is not a framework based on
exemptions for small business or exemptions generally, but to
build on things that have worked in protecting consumer privacy
and to call on the well-established history that has been built
by the FTC. And so it's incredibly important, and I want to
ensure, and I think our companies in general want to ensure,
that we don't miss the opportunity to protect consumer privacy
in a way that's workable.
Senator Gardner. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Gardner.
Senator Heller.
STATEMENT OF HON. DEAN HELLER,
U.S. SENATOR FROM NEVADA
Senator Heller. Mr. Chairman, thank you.
And I'm another rural advocate over here, so I'll probably
go down the same line as the previous comments. But, frankly,
anything that you really want to ask has probably been
discussed here at one point or another. And I want to thank all
of our witnesses for being here, for your comments, for your
insight, because it has been very helpful.
You know, we do have an answer to all this, and we actually
saw this in this committee. We've already passed out the FCC
Reform Act. The purpose of the FCC Reform Act was to make sure
that the Commission, the FCC Commission, operates in a
transparent and effective manner. And this FCC Act had two
important principles, and one was that there would be a
conducted cost-benefit analysis, and we've discussed that, and
the Commission should demonstrate a market failure. And in
neither of these cases can I tell by any discussion that we've
had today that either of these have been the case.
Even the Chairman, even the Chairman of the FCC, last year
came in front of this committee and stated that consumers
deserve a uniform expectation of privacy, in front of this
committee he said that, and that the FCC will not be regulating
the edge providers differently from Internet service providers.
This is what the FCC Chairman said. So in March, there was a
vote, a 3-to-2 vote, to switch that position. I'm wondering if
there is anybody here on this committee, Mr. Leibowitz, perhaps
yourself, that would tell me what has happened, what's the
change of heart, for the FCC to say exactly the opposite of
what they're doing today a year ago?
Now, it doesn't surprise me that the FCC changes or, for
that matter, Mr. Wheeler changes his mind because he changes
his mind on everything. I mean, we have seen this consistently
over and over and over again, that the Chairman of this
particular Commission changes his mind. Can someone tell me,
what has changed in the last year when this Chairman came, the
FCC Chairman, Wheeler, came in front of this committee and said
that the consumers deserve a uniform expectation of privacy?
Why has all this changed?
Mr. Leibowitz. Well, I mean, I can't tell you why. I'm a
former FTC Chairman, I'm not an FCC Commissioner----
Senator Heller. But he was agreeing with you. He was
agreeing with you a year ago.
Mr. Leibowitz. And in fairness to Chairman Wheeler, you
know, they could modify their rule to make it look more like
the FTC approach, that would be what the 21st Century Privacy
Coalition would encourage them to do. But I do hear you.
And I guess I would make one other point for those who have
watched the FTC. At the FTC, we didn't always have unanimity,
but we always strived to have it, and on important votes
involving rulemakings, involving major cases, we would
typically end up with unanimity or a supermajority, bipartisan
supermajority, and I think that makes rules much more enduring.
Senator Heller. I agree.
Mr. Leibowitz. And you know this, when you have a
bipartisan coalition, and all of you on this panel sitting here
have put them together, it makes the rules more legitimate, it
makes your bills more legitimate, your legislation, and it
helps them last longer.
Senator Heller. Well, I would just argue that transparency
is the difference between the FTC and the FCC. That is the
difference, is the transparency, and I think that's the reason,
the most important reason, why we pushed this FCC Reform Act,
Process Reform Act, is to make sure that we get this
transparency into the FCC.
I just want to touch on one other point before my time runs
out, and that is the Small Business Administration, their
advocacy office came out with concerns about this particular
proposal, and, Mr. Polka, I would like you to respond, but they
were knowing that the costs would include consulting fees,
attorneys fees, hiring and training in-house privacy personnel,
consumer notification costs, and probably opportunity costs, if
you want to do the economics behind that also. These are the
costs. So the question is, one, there hasn't been a cost-
benefits analysis because the FCC does not believe in a cost-
benefits analysis. But, two, do you believe that the FCC has
considered the economic harm to small providers like those in
my state of Nevada?
Mr. Polka. And not to mention what you said, but also risk
management assessments, which smaller providers don't do today,
which would take significant legal and consultant times as well
as other items.
I do not believe that the specific concerns of smaller
companies and the economic impact has been considered. And we
were very pleased to see that the SBA noted that from the
Office of Advocacy. Frankly, the rules relating to the FCC and
implementation of a rulemaking does require it, to do at least
some sort of analysis about the impact on smaller businesses.
The FCC in its rulemaking has asked questions about the impact
on smaller business, but to our knowledge, no type of cost-
benefit analysis, and as I said before, no estimation of man-
hours, paperwork hours, et cetera. And when we look at other
opportunity costs that would be shifted, one of the things that
the FCC would require us to a point would be a senior privacy
officer, senior data security officer, someone who has that
title within our company. As I said before, when you have 10 or
fewer employees, I think we're going to be looking around the
office to say, ``Do you want it?'' because it's going to be
hard to fill.
Mr. Swire. Can I just very briefly, as a point of
information, under HIPAA, there's a whole part of the HIPAA
rule called ``scalability,'' which is the Mayo Clinic has to be
super strict and big, but two doctors in a little office have a
different level of privacy and cybersecurity, and it may be,
and I don't think this was fully fleshed out in the FCC's
proposed rule, that there could be some learning done from 15
years of experience there and how to handle small versus large
organizations.
Mr. Polka. And that's consistent with what the FTC has done
over the years as well, to take size into account.
Senator Heller. Thank you. I want to thank all of the
witnesses.
Mr. Chairman, thank you.
The Chairman. Thank you, Senator Heller.
Senator Blumenthal.
STATEMENT OF HON. RICHARD BLUMENTHAL,
U.S. SENATOR FROM CONNECTICUT
Senator Blumenthal. Thanks, Mr. Chairman.
Mr. Leibowitz, you mentioned in your testimony how ISPs
want to enter the online advertising market, not really a new
phenomenon. You and I probably both recall, although you may
not because it may have been just a minor blip on your radar,
but in 2008, Charter Communications announced plans to launch a
pilot program in Newtown, Connecticut, that would target
advertising to subscribers based on their Internet traffic
through an invasive technique called deep-packet inspection.
I was Attorney General at the time. I sent a letter to
Charter with serious concerns about the legal and privacy
implications, and fortunately in this case, Charter reversed
course, abandoned the plan, and there was also, parenthetically
I should mention, a public outcry from consumers, consumer
advocates, and lawmakers, including none other than Congressman
Edward Markey, of the great state of Massachusetts, although he
may not remember it either because it was probably a minor blip
on his radar of many accomplishments in the area of consumer
protection.
So what I guess I'm asking you and Mr. Ohm is, is what the
ISPs are trying to do today different from what they were
trying to do in 2008? In what ways has the technology for
tracking a subscriber's browsing history and deep-packet
inspection, DPI, grown more sophisticated and potentially more
intrusive on consumer privacy since 2008 when Charter tried to
do it in Connecticut?
Mr. Ohm. So I welcome the question. It actually wasn't a
blip on my radar. I wrote I think the only extended Law Review
article analyzing the work of your office and others, in which
I came down pretty hard on ISPs for the moves that they were
making.
The Swire report does establish that deep-packet inspection
will not work to the same level of efficacy as it has in the
past with encrypted communications, but it's again important to
underscore that there are a lot of communications that remain
unencrypted, and deep-packet inspection remains a problem that
looms large on the horizon, and, in fact, today there is a rich
ecosystem of vendors just chomping at the bit to sell deep-
packet inspection systems to ISPs.
The second thing I would say is there was a time in the not
so distant past, in fact, 2008, 2009, where because of the
relative processing speeds of computers versus the speeds of
these fiber optic cables, it was really hard to do surveillance
on everybody all at once. That curve has completely flipped,
and today a company that really does want to compile a dossier
about every single one of their customers, even one with
relatively constrained resources, like a small ISP, can
absolutely off the shelf buy the technology to do something
like that.
Senator Blumenthal. Mr. Leibowitz, I would ask you the same
question also about perhaps the ISPs you represent voluntarily
committing to refrain from using deep-packet inspection.
Mr. Leibowitz. So I think that's a great question, and we
had discussions, and you were involved, and very successful, I
think, enforcement advocacy and jawboning, and the DPI never
got off the ground.
We addressed this issue in our 2012 FTC Privacy Report
because we thought that all large-platform providers, that is,
companies that collect data, including ISPs, shouldn't collect
sensitive information, so health information, financial
information, kids' information, and we talked about deep-packet
inspection. And, in fact, in 2012, ISPs--two ISPs committed,
and I'll get you this, and it is in our Privacy Report, two
ISPs committed to not using deep-packet inspection without
advanced opt-in consent. So we thought that was really
important to follow up on your work, and because we had
concerns about it at the FTC, as a commission.
So I think I would have to go back to our companies, but I
think if what's on the table is a prohibition on deep-packet
inspection, that would be great to know from the FCC, and a
second iteration of their draft, if they went in that
direction, I think would be tremendously meaningful.
Senator Blumenthal. Thank you. Well, I would very much like
to work with you on this issue, and as the FTC Chairman, you
certainly helped to make the FTC the primary champion of
privacy in the Federal Government, so I think your leadership
then and now is profoundly important. Thank you.
Mr. Garfield. If I may just add, your question speaks to
the importance of having an approach and a paradigm that has
some flexibility to it, which is part of the problem with the
FCC's approach, is that it's very much based on rigid,
mandatory, mechanical approach, unlike the approach the FTC has
taken and that NIST is taking when it relates to privacy and
cybersecurity.
Mr. Swire. Very briefly on deep-packet inspection. So three
points. This first is, as Professor Ohm said, there is some
good news here, which is where there is encryption, DPI doesn't
work. So some things have gotten better in life, even though we
don't usually notice that.
The second point is that deep-packet inspection has been
used by ISPs for cybersecurity purposes to look for signatures
in malware, and so whatever your views are on marketing, there
are some cybersecurity things to take into consideration about
that.
And the third and related point is there's comments by a
group of network researchers trying to improve overall network
performance who have said that having a research exception so
that it can really analyze the data has some public benefits.
So an across-the-board ban might run into cybersecurity and
research problems, so there should be some nuance as people
consider that.
Senator Blumenthal. Thank you.
The Chairman. Thank you, Senator Blumenthal.
Senator Markey, do you have other questions?
Senator Markey. May I, Mr. Chairman?
The Chairman. Yes.
Senator Markey. Thank you. Tell me, Professor Ohm, if you
could, how you view this issue of what information can ISPs
collect about consumers, and how can that information be used
to paint a detailed picture of their lives?
Mr. Ohm. I like when I talk to my students about this, I
like to ask them to imagine, if they will, a stream of
information just streaming behind you, always connected to you,
that in a very detailed way really does kind of amount to the
sum and substance of who you are. I think you actually said
this earlier in the hearing, right? This is detailed, this is
persistent, and it's very, very, very difficult to escape this,
right?
Senator Markey. So if a mother is searching for information
about her 13-year-old daughter's anorexia----
Mr. Ohm. Yes.
Senator Markey.--the ISP has that information.
Mr. Ohm. Absolutely, and----
Senator Markey. And so does the website that she went to--
--
Mr. Ohm. Of course.
Senator Markey.--but the ISP has the information as well.
Mr. Ohm. That's right, and it speaks to proposals that some
have suggested that the FCC just make this about what is
sensitive or not, right? But that is getting at this problem
the wrong way. I mean, it's better to categorically say that
this is intrinsically who you are, and, in fact, whether
something is sensitive or not really might vary minute to
minute, second to second.
Senator Markey. So if the mother or the daughter, the 13-
year-old, went to a religious website, the ISP has that
information.
Mr. Ohm. Right.
Senator Markey. Now, the daughter or the mother, they know
that they went to the religious website, so they know what
they're doing.
Mr. Ohm. Right.
Senator Markey. Now, the ISP has it as well.
Mr. Ohm. That's right. That's right.
Senator Markey. Is that sensitive?
Mr. Ohm. Absolutely. Not just that they visited it once,
but precisely to the second when they visited it, how much
information they downloaded from it, perhaps if it's not
encrypted, exactly what sub-page they were looking at, what
specific affliction or what specific religious question they
were interrogating the website about, and I think, as
importantly, how many times they revisit it, when they revisit
it, and the name of the game here in a big data world is to
correlate that with everything else in your life.
Senator Markey. So how about if I need a loan and I've gone
to one of those websites?
Mr. Ohm. Absolutely.
Senator Markey. I know I'm going to that website, I need a
loan, but the ISP knows it as well.
Mr. Ohm. And contrast this with 1996, when we were focused
a little bit more on telephone numbers, right? There was a tiny
bit of comfort from a privacy point of view in not knowing
exactly what you did when you called a particular number, and,
in fact, examples have been made, people call weather lines and
they call for the lottery numbers. On the Web, often the domain
name will reveal exactly what you are doing. In fact, I've
sometimes described it as a machine that preserves the very
last thought that you had in your head. So that's what's being
logged.
Senator Markey. So how can ISPs use the information in a
way that could harm the consumer?
Mr. Ohm. Yes, I mean, you know, the FTC itself has
documented in their Big Data report that they would like to
sell this information to data brokers, and just to be clear,
that's not what the FTC said about ISPs, but I'm talking about
the advertising ecosystem more generally, and they would like
to categorize you, and, you know, it might just be for
marketing purposes. It might be that you're the kind of person
who is more likely to be interested in this product because of
the things that you've been reading lately.
Senator Markey. And so how would the FCC's rules protect
that personal information that I just outlined amongst
thousands of other potential examples?
Mr. Ohm. Yes. In my mind, the most important, I would say,
feature of the rule is the fact that in an opt-in world, you
have the comfort of not having to think about this, that if
you're someone who is worried about this in any way, your
choice by default is not to be tracked or for the information
not to be used in this way. On the other hand, if you're
someone looking for a deal with your ISP, your ISP has ample
opportunity to sell that service to you, and you can opt in to
the tracking----
Senator Markey. In other words, the ISP says, ``Please give
us the right to sell all of your private information.''
Mr. Ohm. Yes.
Senator Markey. You have the right to give them the
permission.
Mr. Ohm. Absolutely. Like I said, there's no ban here. And,
in fact, I think ISPs are probably going to be successful
convincing some consumers to undergo programs like this, but
for the rest of the people, again, it's the comfort of the
bright line, it's the ability to live under the default rule,
which protects the expectation that a lot of consumers have and
to address the fears that a lot of----
Senator Markey. And I find that in general as kind of a
rule, there are some people, they have some disease, you know,
they're telling everyone about it.
Mr. Ohm. Right.
Senator Markey. OK?
Mr. Ohm. Yes.
Senator Markey. And there's an equal number of people
going, ''I'm not telling anybody about this. If you tell anyone
I have this disease, I'm going to kill you.`` Right?
Mr. Ohm. Right.
Senator Markey. So you should have that right, you know,
just to say, you know, if you want to brag about it, you know,
then you go and do it, but if you want to keep it a complete
secret, you should be able to do so as well, and this is the
option that the FCC is giving to people.
Mr. Ohm. I think it's not inaccurate at the end of the day
to boil down this rulemaking as, how can we best give the
opportunity for consumer choice, respect that consumer choice,
and at the same time allow ISPs to engage in innovative and
competitive economics?
Mr. Garfield. Professor Ohm, what you've eloquently argued
for in your writing and today is a reworking of the privacy
framework in the United States, and what I would humbly suggest
is that the appropriate place for that discussion to occur is
in Congress and not in an agency.
Mr. Ohm. And I would just submit that I think that debate
was had at least in part in 1996, when this Section 222 was
enacted, and, frankly, I think it's continuing to happen. The
House had a hearing on this last month. The Senate has a
hearing today. There is ample opportunity to amend the statute
if that's the will of this body, but the law on the books is
clear and unambiguous.
Senator Markey. I guess the way I would view it is you put
HIPAA on the books, you put FERPA on the books----
Mr. Ohm. So there, well, the law is there for the FCC to
act under.
Senator Markey. They're there as a section of the law, and
they're acting under that section of law, so it's not a
rewriting of the laws, it's an interpretation of the law
reflecting the change in technology, but not a change in the
authority under which they are operating.
Mr. Ohm. And Mr. Garfield is right, it's a distinctly
American phenomenon that we do not have a lot of privacy laws.
This body has been very deliberate about identifying those
opportunities, those moments, those industries, those contexts
where specific law is needed, and it did so when it comes to
telecommunications providers.
Senator Markey. And common carriers have always been.
Mr. Ohm. Absolutely.
Senator Markey. Since 1934 in this special category.
Mr. Ohm. That's right.
Mr. Garfield. It is true that the U.S. approach is
distinct, but the U.S. approach is not deficient, and so we
shouldn't confuse those two things. Even in Europe, which is
viewed as heightened privacy protection, is based on the same
FIPs framework that the United States is, and the Privacy
Shield that was just advanced is a reflection of the rough
equivalence of the approaches that are taken here in the United
States and Europe. So to suggest that just because the U.S. is
different in fact means it's distinct is counterfactual.
Senator Markey. Thank you.
Thank you, Mr. Chairman.
The Chairman. Thank you.
Mr. Leibowitz, do you have anything to add on that?
Mr. Leibowitz. No. I mean, I think yours is a principal
position, Senator Markey, as it always is, but, you know, the
vast majority of data collection online is by non-ISPs, and we
had a term for them at the FTC, for all collectors of data, we
called them ``cyberazzi.'' And the better approach to take,
from my perspective, and again we can disagree, and from the
21st Century Privacy Coalition's perspective, is try to keep
your approach technology-neutral, and when you can't, try as
much as possible to adopt the FTC approach, which you've been
supportive of and which has been tested for many years and
deemed reasonably successful.
Senator Markey. And again, I think that, while I agree with
you on all these social media sites in terms of the protections
which should be there, the ISP has a special relationship, it's
the only way you can get online. You don't have a choice. You
know? If you want to reach 1 million websites, you've got to go
through one company, and so that's a special relationship.
They're gathering everything. And so that's separate from an
individual decision which a consumer is making to go to that
social website or that one or that one. And so I just think
there is a distinction that exists because they control the
conduit. The content-conduit divide is quite profound, and
that's why this industry, this conduit industry, which is the
ISPs, but it was the telephone company as we were growing up,
was always under this special regime because everyone had to go
through the same company.
The Chairman. So, Mr. Leibowitz, is there any reason to
think that consumers under the FCC proposal, having been given
some greater control about how broadband providers use their
information, may feel a false sense of security that other
online entities are also going to be respecting those ISP-
related control decisions?
Mr. Leibowitz. Well, I mean, they may feel a false sense of
security, there may be consumer confusion. They may not
understand why they can't get discounted products from their
ISPs online without either an opt-in, or if it's for the
broadband itself, why they can't get it at all while they can
get it from everyone else in the Internet ecosystem. So, yes, I
think that's a possibility.
The Chairman. All right. Senator Blumenthal, do you have
any more questions?
Senator Blumenthal. I have just a couple of quick
questions, Mr. Chairman.
To ask a somewhat mundane question, I'm impressed--maybe I
should direct this to both you, Mr. Leibowitz, and any other
members of the panel who want to respond--that there is often
overlapping and disparate responsibility for enforcement of
privacy protections. The example that comes to mind is HIPAA.
The Department of Health and Human Services enforces the Health
Insurance Portability and Accountability Act, I'm saying it
just so I can remember what it stands for, HIPAA----
[Laughter.]
Senator Blumenthal.--the privacy rules that operate under
that statute and regulate the use and disclosure of protected
health information. The FTC exercises a complementary
jurisdiction over all the entities or individuals with access
to the personal medical information not covered by HIPAA, and
for many people, their introduction to HIPAA and to privacy
concerns is when they want information about a loved one and
find obstacles to obtaining it.
So my question is whether this system can be rationalized.
I know it sounds like mundane and somewhat nuts and bolts.
Would you say that the broadband privacy rule is analogous to
this issue?
Mr. Leibowitz. Well, yes, Senator, I do think it is, or at
least it was. So in the first Obama term, they came up with a
Consumer Privacy Bill of Rights, and they wanted the FTC to be
responsible for all privacy enforcement across the board, and
they wanted it to focus on sensitive information. It's now--the
answer is, yes, of course, it could be, but now with the FTC
having invoked Title II, it has created, it has designated ISPs
as common carriers, and so as common carriers, it can't
forebear back to the FTC in this area.
What it can do--and as you know, we need a cop on the beat
because when the FTC's jurisdiction was taken away, there was
no one left but the FCC. But what they can do, and it goes to
your point about DPI and sensitive information, is they can
make their rule sort of more rational and more reflective of
the FTC's approach. And, by the way, they have authority over
practices that are unjust and unreasonable, and that's not too
far from the unfair and deceptive statute that you worked with
when you were the Connecticut AG and that the FTC works with
all the time.
Mr. Ohm. So if I may, Chairman Leibowitz receives a lot of
well-deserved praise for the work that the agency did in
privacy. He made one horrible misstep while he was there, he
hired me----
Mr. Leibowitz. Not at all.
Mr. Ohm.--to be a Senior Policy Advisor for privacy issues.
I witnessed an agency that is operating at the top of its game,
and it's developed a well-earned reputation for being one of
the savviest privacy enforcers probably globally. At the same
time, there is nothing that the FCC is trying to do here which
is inconsistent with the FTC rules. There is no company that is
going to be told X by the FCC and Y by the FTC. In fact, some
companies will actually have engagement with both of the
agencies in a way that's complementary, not contradictory.
There's an MOU that the staff of the two agencies entered into
that kind of reflects this.
I think people have read far too much into this staff
comment, which 99 percent of it was supportive and offered
little tweaks, and there was one sentence in there which I
totally concede was mildly critical of the FCC.
And then the last thing I'll say, because I'm so glad you
brought us back to the HIPAA analogy, one way to I think, I
think, fairly characterize the way this debate has unfolded is
to say we have this law, it protects health information, it
obligates doctors and hospitals to respect it because we think
they ought to respect it, but in today's online ecosystem, it
turns out Fitbit knows a lot of health information about you.
Is the argument, is the result, really that we should now say,
you know what, there is no use regulating privacy of hospitals
and doctors any longer, that we ought to lower the standard of
privacy just because there are online actors who now have
comparable sets of information? I don't think so. I think that
would be an odd argument to try and make in the health context,
and I think it's equally odd in the online context.
Mr. Garfield. And the argument is not to lower, the
argument is to respect and recognize the work that's been done
from the agency that's well versed in this area.
Mr. Leibowitz. Yes, and I would just add one thing. You
have both probably read the FTC comment. You cited it, Chairman
Thune, at the beginning of the hearing. All I would say is go
back and read the FTC comment to the FCC. It uses the phrase,
and it's diplomatic, as it should be, but it uses the phrase
``not optimal,'' and I counted 28 separated instances where
they're in disagreement or where they question a potential
policy of the FCC. Don't take my word for it, don't take
Professor Ohm's word for it, don't take the very smart--don't--
--
[Laughter.]
Mr. Leibowitz.--I mean, listen to us because I think
collectively we have something to say, but go back and just
listen to the FTC.
The Chairman. I think it would be incredibly complicated to
have to answer to multiple agencies on this issue, but you
pointed out, Mr. Leibowitz, that the law clearly prohibits the
FTC from regulating communications common carriers. Is there
any clear limitation in law that prevents the FCC from
regulating the privacy practices of so-called edge providers?
Mr. Leibowitz. You would have to have a very expansive view
of Section 706 to try to do that and----
Mr. Garfield. You may get some arguments from us.
[Laughter.]
Mr. Leibowitz.--we would get some arguments from Mr.
Garfield about that.
Mr. Swire. Yes, I was going to say it may be challenged.
Mr. Leibowitz. I don't want to say they couldn't do it, and
I don't want to say this FCC couldn't do it. I think it would
be a bad policy, and I don't--you know, and I think it would be
just an extension of what we believe now is a flawed policy at
the FCC, and you would extend it from a small group of
collectors of information on the Internet to the vast and
overwhelming majority. So I think we have agreement on that.
Mr. Garfield. Yes, we do.
The Chairman. All right. Well, with that, we'll wrap up. We
thank you all very much for your insights and your input. And
we'll keep the hearing record open for 2 weeks during which
time Members are encouraged to ask or submit questions for the
record, and upon receipt, we're asking witnesses if they would
submit their answers to the Committee as soon as possible.
Thank you all very much. This hearing is adjourned.
[Whereupon, at 12:09 p.m., the hearing was adjourned.]
A P P E N D I X
Response to Written Question Submitted by Hon. Deb Fischer to
Paul Ohm
Question. Professor Ohm, you have said that it is important to keep
privacy protections in mind for rural Americans, because they may have
access to only one broadband provider. Living on a ranch in Cherry
County, Nebraska, I certainly understand the challenges facing rural
America when it comes to broadband availability. That said, I am not
clear how the number of broadband providers in a given area is related
to the level of privacy protection that is needed. Are you suggesting
that the providers that offer service to rural America should be
subject to more stringent privacy protections than other providers? It
seems like that would only hurt broadband deployment where we need it
most.
Answer. I did not mean to suggest that the privacy protections for
providers should vary based on the amount of choice consumers have in a
given region. I am sorry if I was not clearer about this. I think the
limited choice that most American consumers have for broadband service
strongly supports the need for special privacy rules for broadband
providers, such as those proposed by the FCC. A consumer who is unhappy
with the privacy practices of his or her broadband provider can often
not switch to a more privacy-respecting competitor, because there often
is no viable alternative on the market. This is especially a problem
for the millions of Americans with only one choice for broadband, a
population that includes many rural Americans and Americans living on
tribal lands.
The lack of choice in broadband service is only one justification
for the FCC's privacy rules. My testimony supplies at least three
others (history, visibility, and sensitivity). These reasons justify a
privacy rule for all providers, large and small, urban and rural, and
irrespective of whether consumers in a covered region have one
provider, two providers, or more. I once again applaud the FCC for
proposing a strong privacy rule, one that implements Congress's intent
in Section 222 of the Communications Act.
______
Response to Written Questions Submitted by Hon. Deb Fischer to
Dean C. Garfield
Question 1. Mr. Garfield, as you know, the number of mobile devices
in this country is growing at an exponential rate. The Internet of
Things has the potential to grow our economy and make our workforce
more productive. As we talk about the Internet of Things, concerns are
inevitably raised about how we can protect the privacy of the data that
is sent from device to device. While these are important concerns, I
also worry that overly restrictive privacy regulations will stifle
development of the Internet of Things. Do you believe that is the case
for the FCC's proposed regulations?
Answer. I would like to begin by thanking you for your leadership
on the Internet of Things and the DIGIT Act. That legislation
recognizes the important and transformational impact the IoT will have
in our communities, our economy, and society at large when we consider
safety, health, and other applications we cannot yet fathom. We would
agree that overly restrictive privacy regulations could, and likely
will, prevent investment, innovation, and experimentation in the IoT.
As you know given your significant work on IoT, in applications
where data that identifies individuals is collected, the collection,
use, sharing, and protection of such data are already subject to
existing laws. For instance, IoT manufacturers fall within the
jurisdiction of the Federal Trade Commission (FTC) and are thus subject
to its unfair or deceptive acts or practices authority under Section 5
of the Federal Trade Commission Act. Grounded in Fair Information
Practices Principles (FIPPs), the FTC's approach to privacy helped
enable the Internet to thrive and, as a consequence, ITI companies have
been able to offer an expanding range of services and applications
(including IoT applications), often times free or at a nominal expense
to consumers. Depending on the data collected and the actors involved,
other statutory authorities may also be applicable to IoT products or
services. There are certain protections for health information under
the Health Insurance Portability and Accountability (HIPAA) Act and the
Health Information Technology for Economic and Clinical Health (HITECH)
Act, while the Graham-Leach-Bliley (GLB) Act and the FTC's Safeguards
Rule govern the protection of information held by financial
institutions.
In addition to being overly prescriptive and not grounded in the
FIPPS, which guides privacy frameworks around the globe, the FCC's
proposed rule also subjects the same data to different requirements
based on which sector collects the data. We believe this is a bad
precedent and will limit not just IoT development but innovation by
companies that may operate in multiple spaces such as broadband
Internet access service providers who may also offer IoT products or
applications, or online content or services.
Question 2. Mr. Garfield, in your testimony you describe how the
FTC and state attorneys general work together to create a meaningful
system of enforcement and consumer protection. For example, state
attorneys general typically enforce laws addressing ``unfair or
deceptive acts or practices'' at the state level, while the FTC will do
the same on the Federal level. Under the new privacy regime proposed by
the FCC, what will be the role of state attorneys general? Will their
authority be changed in any way?
Answer. The NPRM specifically proposes to ``preempt state laws only
to the extent they are inconsistent with any rules adopted by the
Commission.'' \1\ If a state regulation or law conflicts with the
Commission's final rule, the role of that state's Attorney General
would be significantly diminished in that he or she would no longer be
able to bring an enforcement action against broadband providers for
violations of such existing state regulation or law until the state
regulator or legislature acts to bring the rule or law into alignment
with the FCC's rule. Further, states may continue to enforce or adopt
new regulations or laws that are more restrictive than the FCC's rule
so long as compliance with both the state regulation or law and the
Federal regulation is feasible.
---------------------------------------------------------------------------
\1\ Protecting the Privacy of Customers of Broadband and Other
Telecommunications Services, WC Docket No. 16-106, Notice of Proposed
Rulemaking, FCC 16-39, 276-77 (Apr. 1, 2016).
---------------------------------------------------------------------------
______
Response to Written Question from Hon. Deb Fischer to
Matthew M. Polka
Question. Mr. Polka, in his written testimony, Professor Ohm said
that it is important to keep privacy protections in mind for rural
Americans, because they may have access to only one broadband provider.
Living on a ranch in Cherry County, Nebraska, I certainly understand
the challenges facing rural America when it comes to broadband
availability. That said, I am not clear how the number of broadband
providers in a given area is related to the level of privacy protection
that is needed. It seems like putting more stringent requirements on
rural providers would only hurt broadband deployment where we need it
most. Do you have thoughts on this point?
Answer. As a threshold matter, Professor Ohm is incorrect that
rural consumers may have access to only one broadband provider. In
virtually every community and in all but the most remote areas,
consumers can access at least two wireline broadband providers, four
wireless broadband providers, and two satellite broadband providers. In
addition, as I discussed at the hearing, the question is not whether or
not consumers get privacy protections. Of course, they do. The question
is how to develop and implement robust privacy protections for customer
proprietary network information consistent with other public interest
objectives, including, as you state, enhancing broadband deployment.
Broadband Internet access providers have been subject to the Federal
Trade Commission's privacy regime for many years, and it has
successfully protected consumers and proven workable for providers.
Rather than create extensive new requirements from whole-cloth, the
Federal Communications Commission should use this model as the basis
for its rules.
[all]
This page intentionally left blank.
This page intentionally left blank.
This page intentionally left blank.