NTIA's Consumer Privacy Proposal is a Good Start but Needs Improvements

New America’s Open Technology Institute (OTI) filed comments with the National Telecommunications and Information Administration (NTIA) weighing in on the development of the administration’s approach to consumer privacy. The NTIA proposes seven different “outcomes” for a consumer privacy regime, with the ultimate outcome being a “reasonably informed user.” The NTIA also proposes to be guided by eight different goals. OTI commented on both the proposed outcomes and proposed goals.

The NTIA should focus its consumer privacy regime on its listed outcomes of data minimization, user controls, and strong enforcement. Data minimization—the practice of reducing the total amount of data collected, used, and stored—provides many benefits to both users and companies. It reduces 1) the amount of information companies have to convey to their users, 2) the risks associated with collecting and storing data including harms produced by data breaches, and 3) company costs associated with data processing. Further, user controls—including data portability and platform interoperability tools, as well as the ability to access, correct, and delete information that a company has on them—are necessary for “reasonably informed users” to control how their data is collected and used. Finally, strong enforcement is necessary to ensure that companies have incentives to follow the law.

Some of the NTIA’s identified goals are also contradictory or misplaced. While the NTIA’s proposal focuses on a comprehensive approach that would apply across sectors, it should allow for different requirements for broadband providers. Broadband providers are sufficiently different to merit privacy rules tailored to them, in part because they have nearly comprehensive access to all traffic that flows over their networks, including content. Moreover, an outcome-based approach to privacy would leave online companies with insufficient guidance on how to best comply with the law. The lack of clear, prescriptive rules disproportionately burdens small businesses, and makes it harder for enforcers to determine whether a company has violated the law. Ultimately, an outcome-based approach inadequately protects users, and undermines the system of accountability it seeks to create.

OTI commends the NTIA on its efforts to develop a high-level privacy regime. While the proposal covers many issues, several still need to be addressed. OTI looks forward to working with the NTIA on its proposal.