[Federal Register Volume 68, Number 121 (Tuesday, June 24, 2003)]
[Notices]
[Pages 37494-37496]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-15911]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Privacy Act Notice

AGENCY: Federal Trade Commission (FTC).

ACTION: Final notice of new Privacy Act system of records.

-----------------------------------------------------------------------

SUMMARY: The FTC is establishing a new system of records under the 
Privacy Act of 1974, as amended. This system will include telephone 
numbers and other information of individuals who do not wish to receive 
telemarketing calls from telemarketers, sellers, and agents. These 
telephone numbers will be disclosed to companies to ensure compliance 
with the Commission's Telemarketing Sales Rule.

DATES: This system is final and effective as of June 24, 2003.

FOR FURTHER INFORMATION CONTACT: For information about this Privacy Act 
notice, you may contact Alex Tang, Attorney, Office of the General 
Counsel, FTC, 600 Pennsylvania Avenue, NW., Washington, DC 20580, (202) 
326-2447, [email protected]. For information about the National Do Not Call 
Registry, please contact David Torok, Attorney, Division of Marketing 
Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 
Pennsylvania Avenue, NW., Washington, DC 20580, (202) 326-3075, 
[email protected].

SUPPLEMENTARY INFORMATION: As required by the Privacy Act of 1974, as 
amended, the FTC previously published a notice of its proposal to 
establish a new agency system of records pertaining to individuals, to 
be called the ``National Do Not Call Registry System-FTC'' (FTC-IV-3). 
The FTC published its proposal in the February 27, 2002, edition of the 
Federal Register. See 67 FR 8986.
    The proposal outlined what personal information the system would 
collect from individuals, and how we would use, disclose and maintain 
that information. As explained in the proposal, the new records system 
is intended to help the FTC implement and enforce the do-not-call 
requirements of our Telemarketing Sales Rule, 16 CFR Part 310, as 
recently amended.\1\ Once it begins operating, the system, as we 
explained, will allow you, if you choose, to place your telephone 
number on our National Do Not Call Registry, so that telemarketers, 
sellers, and agents will know that you do not want to receive 
telemarketing calls from them.\2\ You will have the option of 
registering through a dial-in system from the telephone number that you 
wish to place on the Registry, or through the National Do Not Call 
Registry Web site that will be linked to our main Web site, http.//
www.ftc.gov, as described further below. Our Rule will require 
telemarketers, sellers, and agents that are subject to our Rule to 
check the Registry at least once every three months to make sure their 
do-not-call lists are current and consistent with the Registry at that 
time. This requirement should help ensure that you do not get unwanted 
telemarketing calls from these telemarketers, sellers, or agents.
---------------------------------------------------------------------------

    \1\ The Rule amendments were published earlier this year. See 68 
FR 4580 (Jan. 29, 2003).
    \2\ In this document, ``you'' means an individual who places his 
or her telephone number on the National Do Not Call Registry to 
indicate that he or she does not wish to receive telemarketing calls 
from telemarketers, sellers, or agents.
---------------------------------------------------------------------------

    Below, in final form, is the system notice that the Privacy Act 
requires us to publish for the system. Although we received no public 
comments in response to our proposal, we have taken this opportunity to 
make a few minor clarifications, which we summarize below.\3\
---------------------------------------------------------------------------

    \3\ In a separate document published elsewhere in today's 
Federal Register, we are proposing to amend the Privacy Act notice 
for this system to explain the extent, if any, that it will apply to 
information that telemarketers, sellers, and their agents separately 
submit in order to pay for access to the system and check their do-
not-call lists against the system. If you are an individual who 
registers your telephone number in our system, that separate 
proposed amendment, which would only affect the information that 
those companies submit, should not affect you.
---------------------------------------------------------------------------

    System name. We have added the word ``National'' to distinguish our 
Registry from do-not-call lists that some states or other organizations 
maintain. (We have made the same change in the address of the program 
manager for the system.)
    Categories of records in the system. Our proposal explained that 
the system would maintain your telephone number, as well as the date 
and time you place your number in the system or remove it from the 
system. We also proposed to ask you for your telemarketing preferences, 
zip code, or other voluntary information. As explained in the final 
system notice below, the system will still record your telephone number 
and the relevant date and time, as well as any other information 
automatically generated by the system, if you call in to register, 
verify, or delete your telephone number from the system. Our proposal 
explained that the system will use automatic number identification 
technology, also known as ``ANI,'' which is similar to ``caller ID,'' 
to verify your telephone number when you call from that number.
    If, however, you use the National Do Not Call Registry Web site to 
register, the Web site will instead ask you for an e-mail address to 
validate and confirm your registration, since ANI cannot be used in 
that case to verify your telephone number. Likewise, the Web site will 
ask you to supply an e-mail address if you use the Web site to verify 
that your telephone number is in the Registry, or to delete your number 
from it. (Of course, you may avoid giving us an e-mail address by using 
the dial-in method described above.) Thus, in this final system notice, 
we have clarified that ``other information that the individual may be 
asked to provide voluntarily'' means we will ask you to provide an e-
mail address if you use the Web site to register, or to obtain access 
to the system to verify or delete your telephone number from the 
system.\4\ We do not intend, however, to ask you for your telemarketing 
preferences, zip code, or other personal information, as our original 
proposal may suggest.
---------------------------------------------------------------------------

    \4\ As described in the notice, the system will maintain system 
information indefinitely or until it is no longer needed or it is 
deleted automatically. In the case of e-mail addresses, we 
anticipate that the information will be retained for no more than a 
year.
---------------------------------------------------------------------------

    Authority for maintenance of the system. We have updated this 
section to include the Do-Not-Call Implementation Act, Pub. L. No. 108-
10 (Mar. 11, 2003). Congress passed that law after we published our 
proposed system notice. The new law allows us to collect fees from 
telemarketers, sellers, and their agents in order to maintain and 
operate the system.
    Routine uses of your information. We are revising this section to 
make clear that the ``records'' that we may disclose to telemarketers, 
sellers, and agents for do-not-call purposes do not include e-mail 
addresses that we ask from individuals who register through the 
National Do Not Call Registry Web site. That information is collected 
only for purposes of registering, verifying, or deleting your telephone 
number from

[[Page 37495]]

the Registry, as explained earlier, and not for disclosure to 
telemarketers, sellers, or their agents.
    Notification procedure. Our proposal explained that, if you want to 
learn (i.e., confirm) whether our National Do Not Call Registry 
contains a record of your telephone number, we would require you to use 
a dial-in system or ``other system'' to obtain that notification. We 
are revising the language specifically to mention the National Do Not 
Call Registry Web site as an option to the dial-in system, as 
previously discussed.
    Record access procedures. Our proposal suggested that we might need 
to ask for e-mail addresses or other contact information so we could 
send a written acknowledgment if you ask us to delete your phone number 
from the Registry. The final version of the system will normally 
process deletions within 24 hours from when an individual submits such 
a request by telephone or through the National Do Not Call Registry Web 
site, so we are not required to send a written acknowledgment to an 
individual in those situations.\5\ The revised notice also clarifies 
that if you want access to any other information about your 
registration that the system may maintain, and the information is not 
available through the automated dial-in system or the Web site, you 
must submit your request in writing under the Commission's rules. (We 
are making the same clarification in the ``contesting record 
procedures'' section discussed below.)
---------------------------------------------------------------------------

    \5\ The Privacy Act requires agencies to send a written 
acknowledgment not later than 10 days after an individual submits a 
request to amend his or her record, which would include deleting a 
record from the system. See 5 U.S.C. 552a(d)(2)(A). The United 
States Office of Management and Budget, which is responsible for 
interpreting the Privacy Act, has explained that this requirement 
does not apply if the agency processes the request within the 10-day 
period that the law would allow for acknowledging the request. See 
40 FR 28948, 28958 (1975). If you use the National Do Not Call 
Registry Web site to register or to delete your telephone number 
from the system, however, the system will acknowledge your request 
by e-mail.
---------------------------------------------------------------------------

    Contesting record procedures. This section of the proposal referred 
only to the automated dial-in system. We are revising this section to 
include the National Do Not Call Registry Web site, as described 
earlier.
    Record source categories. In this section, we repeat that the 
system includes not only the information that you provide (i.e., your 
telephone number, plus your e-mail address, if you register through the 
National Do Not Call Registry Web site), but also information that the 
system itself automatically generates (e.g., the date and time you 
registered), as discussed earlier. We are also clarifying that some 
telephone numbers in our Registry may come from do-not-call lists that 
some states or other organizations separately maintain. See 68 FR at 
4641.
    Other revisions. The final notice also includes some additional 
cross-references and miscellaneous other revisions (such as the name of 
the FTC office that will manage the system, and changing 
``telemarketers and their agents'' to ``telemarketers, sellers, and 
their agents''), for clarity and precision.
    Privacy Impact Assessment. Section 208 of the E-Government Act of 
2002, Pub. L. No. 107-347, generally requires that agencies assess the 
privacy impact of collecting personally identifiable information online 
before initiating such a collection activity or developing or procuring 
the technology to do so. The above requirement did not take effect 
until after the Commission initiated and legally adopted the Rule 
amendments that established the National Do Not Call Registry, and 
after the Commission started developing and procuring the technology 
for accepting do-not-call registrations online. Nevertheless, we have 
assessed the privacy impact of the system as discussed below. (The 
Commission's Chief Information Officer or other designated official has 
reviewed this assessment.)
    1. What information will we be collecting? See above, and the 
discussion of ``Categories of records'' below.
    2. Why are we collecting this information? See above, and the 
discussion of ``Purpose(s)'' and ``Routine Uses'' below.
    3. How do we intend to use the information? See above, and the 
discussion of ``Purpose(s)'' and ``Routine Uses'' below.
    4. With whom will we share the information? See above, and the 
discussion of ``Purpose(s)'' and ``Routine Uses'' below.
    5. What notice or opportunities for consent will individuals have 
about what information we collect and how we share it? This notice 
explains what information we collect and how we share it. Whether you 
register and submit your information to us is completely up to you. If, 
however, you do not supply your phone number or other information we 
may need to process your request, we cannot put your telephone number 
in our National Do Not Call Registry.
    6. How will the information be secured? See the discussion of 
``Safeguards'' below. Our National Do Not Call Registry Web site will 
use secure socket layer (SSL) encryption. We also plan to use the same 
or comparable technology when telemarketers, sellers, and their agents 
access telephone numbers from the system.
    7. Does this create a system of records subject to the Privacy Act 
of 1974, as amended? Yes, as this notice describes.
FTC-IV-3

System Name:
    National Do Not Call Registry System-FTC (FTC-IV-3).

Security Classification:
    Not applicable.

System Location:
    Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, 
DC 20580. System records may be maintained, in whole or part, off-site 
by contractors.

Categories of individuals covered by the system:
    Individuals who notify the Commission that they do not wish to 
receive telemarketing calls.

Categories of records in the system:
    Telephone numbers of individuals who do not wish to receive 
telemarketing calls; information automatically generated by the system, 
including date and/or time that the telephone number was placed on or 
removed from the Registry; and other information that the individual 
may be asked to provide voluntarily (such as e-mail address, if the 
individual registers through the National Do Not Call Registry Web 
site).

Authority for maintenance of the system:
    Federal Trade Commission Act, 15 U.S.C. 41 et seq., Telemarketing 
and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. 6101-6108; Do-
Not-Call Implementation Act, Pub. L. No. 108-10 (2003).

Purpose(s):
    To maintain records of the telephone numbers of individuals who do 
not wish to receive telemarketing calls; to disclose such records to 
telemarketers, sellers, and their agents in order for them to reconcile 
their do-not-call lists with the Registry and comply with the do-not-
call provisions of the Commission's Telemarketing Sales Rule, 16 CFR 
Part 310; to enable the Commission and other law enforcement officials 
to determine whether a company is complying with the Rule; to provide 
statistical data that may lead to or be incorporated into law 
enforcement investigations and litigation; or for other

[[Page 37496]]

law enforcement, regulatory or informational purposes.

Routine uses of records:
    Records from this system may be disclosed as permitted by 5 U.S.C. 
552a(b), and, as authorized by 5 U.S.C. 552a(b)(3), in accordance with 
the routine uses announced by the Commission in Appendix I of its 
system notice applicable to all other agency Privacy Act systems of 
records (57 FR 45678), as may be revised and updated from time to time. 
Additional routine uses for records in this system are as follows, 
provided that no routine use specified either herein or in Appendix I 
shall be construed to limit or waive any other routine use published 
for this system:
    a. Telephone numbers, but not any e-mail addresses, submitted by 
individuals may be made available or referred on an automatic or other 
basis to telemarketers, sellers, and their agents for the purpose of 
determining or verifying that an individual does not wish to receive 
telemarketing calls;
    b. Records may be made available or referred on an automatic or 
other basis to other federal, state, or local government authorities 
for regulatory, compliance, or law enforcement purposes.

Disclosure to consumer reporting agencies:
    Not applicable.

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage:
    Stored in a computer database maintained on magnetic disks and 
tape, or other electronic systems determined by the Commission in 
consultation with staff or contractors.

Retrievability:
    Indexed by area code and phone number of individuals who have 
informed the Commission that they do not wish to receive telemarketing 
calls. May also be retrieved by other data, if any, compiled or 
otherwise maintained with the record.

Safeguards:
    Access to computerized records by electronic security precautions. 
Access is generally restricted to those agency personnel and 
contractors whose responsibilities require access, or to approved 
telemarketers, sellers, and their agents. (See also ``Purposes'' and 
``Routine Uses'' above to learn how information may be used or 
disclosed.)

Retention and disposal:
    Automated information retained indefinitely, until deleted pursuant 
to request by the subject individual, or deleted automatically after 
certain period of time, to be determined by the Commission.

System manager and address:
    National Do Not Call Registry Program Manager, Division of Planning 
and Information, Bureau of Consumer Protection, Federal Trade 
Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

Notification procedure:
    To obtain notification of whether the system contains a record 
pertaining to that individual (i.e., the individual's telephone 
number), individuals may be required to use a dial-in system or a 
designated Web site that will enable the identification and 
verification of their telephone numbers. Individuals filing written 
requests pursuant to 16 CFR 4.13 will be acknowledged and directed to 
use those automated systems.

Record access procedures:
    See notification procedures above. To request access to any 
information maintained with your registration that is not available to 
you through the automated dial-in system or the designated Web site, 
you must submit your request in writing under the Commission's Rules 
to: ``Privacy Act Request, Office of the General Counsel, Federal Trade 
Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.'' See 
16 CFR 4.13.

Contesting record procedures:
    See notification procedures above. Where an individual believes the 
system has erroneously recorded or omitted information that is 
collected and maintained by the system, the individual will be afforded 
the opportunity to register, change, or delete that information after 
the automated system identifies and verifies the telephone number from 
which the individual is calling, or the individual provides other 
requested identifying information if the individual is using the 
designated Web site. To contest the accuracy of any other information 
maintained on you that is not accessible to you through the automated 
dial-in system or Web site, you must submit your request in writing 
under the Commission's Rules to: ``Privacy Act Request, Office of the 
General Counsel, Federal Trade Commission, 600 Pennsylvania Avenue NW., 
Washington, DC 20580.'' See Commission Rule 4.13, 16 CFR 4.13.

Record source categories:
    Individuals who inform the Commission through the procedures 
established by the Commission that they do not wish to receive 
telemarketing calls. Some records may come from do-not-call lists that 
some states or other organizations separately maintain.

Exemptions claimed for the system:
    None.

    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 03-15911 Filed 6-23-03; 8:45 am]
BILLING CODE 6750-01-P