• by Wendy Davis  @wendyndavis, December 16, 2010

Online ad industry groups and consumer advocates should work together to develop enforceable self-regulatory privacy policies based on Fair Information Practices principles, the Department of Commerce recommended in a highly anticipated report released Thursday.

The 78-page report, which aims to set out a new framework for privacy policy, also calls for Federal Trade Commission enforcement of self-regulatory codes -- but stops short of recommending new legislation, and instead solicits comments about whether new laws are needed.

Codes built on Fair Information Practices could prove more restrictive than current paradigms, which only call for behavioral targeting companies and others who compile data about people's Web activity to notify consumers about the practice and allow them to opt out.

Fair Information Practices principles broadly call for data collectors to not only inform consumers about the practice, but also to specify the purpose for which data will be used and limit retention periods.

Commerce also proposed that the administration add a privacy czar who would convene industry groups, advocates and others in an effort to develop new self-regulatory codes.

The report comes at a time of increasing scrutiny on Capitol Hill of data collection by online ad companies and data brokers. Earlier this month, the FTC issued a report criticizing the industry's self-regulatory efforts and calling for a do-not-track mechanism. Additionally, Rep. Bobby Rush recently introduced a bill that would require Web companies to obtain users' consent to online tracking.

Reaction to Commerce's report was mixed, with some privacy experts saying the report marks a step forward and others saying it doesn't go far enough.

Jeff Chester, executive director of the Center for Digital Democracy, criticized the report as too vague. "They should have been able to clearly say what practices are right and wrong -- such as the extensive system of online behavioral tracking that stealthily shadows consumers -- whether on their personal computer or a mobile phone," he stated.

Chester, a critic of self-regulatory efforts, added that fair information practice principles "can be written in a way that ultimately endorses existing business practices for online data collection and targeting."

On the other hand, Jules Polonetsky, co-chair and director of the think tank Future of Privacy Forum, praised the report, saying that it creates "a better model for self-regulation" because, for the first time, consumer advocates would help shape the principles.

Linda Woolley, executive vice president of government affairs of the Direct Marketing Association, said the group was open to including consumers in discussions about voluntary privacy codes. "They should be involved," she said, adding that consumer representatives currently serve on DMA ethics committees. "It's not something that we're unfamiliar with."

The Center for Democracy & Technology's Justin Brookman, director of the privacy project, praised the report for setting out "a creative and flexible approach to develop enforceable privacy protections for consumers."

But he added that legislation is still needed. "Now it's time for Congress to step up and pass the legislation needed to enact a baseline consumer privacy law that is built on the strong recommendations contained in the Commerce and FTC privacy reports."

Sen Jay Rockefeller (D-W.Va.) said the report "highlights the need for greater privacy protections."

"Industry self-regulation has largely failed, and I hope that the Department of Commerce in its final report will reach the conclusion that legislation is necessary to protect consumers," he stated.