WHITE HOUSE FACT SHEET: "SAFEGUARDING AMERICAN CONSUMERS & FAMILIES"

FROM:  THE WHITE HOUSE 

FACT SHEET: Safeguarding American Consumers & Families

Today, President Obama will build on the steps he has taken to protect American companies, consumers, and infrastructure from cyber threats, while safeguarding privacy and civil liberties.  These actions have included the President’s 2012 comprehensive blueprint for consumer privacy, the BuySecure initiative—launched last year— to safeguard Americans’ financial security, and steps the President took earlier this year by creating a working group of senior administration officials to examine issues related to big data and privacy in public services and the commercial sector.

In an increasingly interconnected world, American companies are also leaders in protecting privacy, taking unprecedented steps to invest in cybersecurity and provide customers with precise control over the privacy of their online content.  But as cybersecurity threats and identity theft continue to rise, recent polls show that 9 in 10 Americans feel they have in some way lost control of their personal information — and that can lead to less interaction with technology, less innovation, and a less productive economy.

At the Federal Trade Commission offices today, President Obama will highlight measures he will discuss in the State of the Union and unveil the next steps in his comprehensive approach to enhancing consumers’ security, tackling identity theft, and improving privacy online and in the classroom.  These steps include:

Improving Consumer Confidence by Tackling Identity Theft

The Personal Data Notification & Protection Act: The President is putting forward a new legislative proposal to help bring peace of mind to the tens of millions of Americans whose personal and financial information has been compromised in a data breach.  This proposal clarifies and strengthens the obligations companies have to notify customers when their personal information has been exposed, including establishing a 30-day notification requirement from the discovery of a breach, while providing companies with the certainty of a single, national standard.  The proposal also criminalizes illicit overseas trade in identities.

Identifying and Preventing Identity Theft:  To give consumers access to one of the best early indicators of identity theft, as well as an opportunity to improve their credit health, JPMorganChase and Bank of America, in partnership with Fair Isaac Corporation (FICO), will join the growing list of firms making credit scores available for free to their consumer card customers.  USAA and State Employees’ Credit Union will also offer free credit scores to their members, and Ally Financial is further widening the community of companies taking this step by making credit scores available to their auto loan customers.  Through this effort over half of all adult Americans with credit scores will now have access to this tool to help spot identity theft, through their banks, card issuers, or lenders.
Safeguarding Student Data in the Classroom and Beyond

The Student Digital Privacy Act: The President is releasing a new legislative proposal designed to provide teachers and parents the confidence they need to enhance teaching and learning with the best technology — by ensuring that data collected in the educational context is used only for educational purposes.  This bill, modeled on a landmark California statute, builds on the recommendations of the White House Big Data and Privacy review released earlier this year, would prevent companies from selling student data to third parties for purposes unrelated to the educational mission and from engaging in targeted advertising to students based on data collected in school – while still permitting important research initiatives to improve student learning outcomes, and efforts by companies to continuously improve the effectiveness of their learning technology products.

New Commitments from the Private Sector to Help Enhance Privacy for Students:  Today 75 companies have committed to the cause, signing a pledge to provide parents, teachers, and kids themselves with important protections against misuse of their data.  This pledge was led by the Future of Privacy Forum and the Software & Information Industry Association, and today the President challenged other companies to follow their lead.

New Tools from the Department of Education to Empower Educators Around the Country and Protect Students: The Department of Education and its Privacy Technical Assurance Center play a critical role in protecting American children from invasions of privacy. Today, we are announcing a forthcoming model terms of service, as well as teacher training assistance that will enhance our ability to help ensure educational data is used appropriately and in accordance with the educational mission.

Convening the Public and Private Sector to Tackle Emerging Privacy Issues

Voluntary Code of Conduct for Smart Grid Customer Data Privacy: Today the Department of Energy and the Federal Smart Grid Task Force are releasing a new Voluntary Code of Conduct (VCC) for utilities and third parties aimed at protecting electricity customer data — including energy usage information.  This Code reflects a year of expert and public consultation, including input from industry stakeholders, privacy experts, and the public.  As companies begin to sign on, the VCC will help improve consumer awareness, choice and consent, and controls on access.

Promoting Innovation by Improving Consumers Confidence Online

Consumer Privacy Bill of Rights Legislation: Online interactions should be governed by clear principles — principles that look at the context in which data is collected and ensure that users’ expectations are not abused.  Those were the key themes of the Administration’s 2012 Consumer Privacy Bill of Rights, and today the Commerce Department announced it has completed its public consultation on revised draft legislation enshrining those principles into law.  Within 45 days, the Administration will release this revised legislative proposal and today we call on Congress to begin active consideration of this important issue.

These actions build on steps the President has already taken to support consumer privacy and fight identity theft, including:

Making Federal Payments More Secure to Help Drive the Market Forward: In October, as part of his BuySecure Initiative, the President issued an Executive Order laying out a new policy to secure payments to and from the Federal government by applying chip and PIN technology to newly issued and existing government credit cards, as well as debit cards like Direct Express, and upgrading retail payment card terminals at Federal agency facilities to accept chip and PIN-enabled cards. This accompanied an effort by major companies like Home Depot, Target, Walgreens, and Walmart to roll out secure chip and PIN-compatible card terminals in stores across the country.

New Measures to Prevent Identity Theft: The President also announced new steps by the government to assist victims of identity theft, including supporting the Federal Trade Commission in their development of a new one-stop resource for victims at IdentityTheft.gov and expanding information sharing to ensure Federal investigators’ ability to regularly report evidence of stolen financial and other information to companies whose customers are directly affected.

FTC TESTIFIES BEFORE CONGRESS ON GEOLOCATION PRIVACY AND SECURITY

FROM:  U.S. FEDERAL TRADE COMMISSION

FTC Testifies on Geolocation Privacy

June 4, 2014

The Federal Trade Commission testified before Congress o
n the Commission's efforts to address the privacy concerns raised by the tracking of information about consumers’ location, as well as proposed legislation to protect the privacy of geolocation data.

Delivering testimony before the Senate Judiciary Committee’s Subcommittee for Privacy, Technology and the Law, Jessica Rich, Director of the FTC Bureau of Consumer Protection, outlined the FTC’s ongoing efforts to protect the privacy of consumers’ geolocation information through enforcement, policymaking, and consumer and business education.

Precise geolocation data is sensitive personal information increasingly used in consumer products and services, the testimony states. These products and services make consumers’ lives easier and more efficient, but the use of geolocation information can raise concerns because it can reveal a consumer’s movements in real time and provide a detailed record of a consumer’s movements over time.

“Geolocation information can divulge intimately personal details about an individual. Did you visit an AIDS clinic last Tuesday? What place of worship do you attend? Were you at a psychiatrist's office last week? Did you meet with a prospective business customer?” the testimony states.

Geolocation information may be sold to companies to help build profiles about consumers without their knowledge or consent, or it could be accessed by cybercriminals, hackers or through surreptious means such as “stalking apps.”

The FTC has used its enforcement authority under Section 5 of the FTC Act to take action against companies engaged in unfair or deceptive practices involving geolocation information. Last month, for example, the Commission entered into a settlement with the mobile messaging app Snapchat, resolving FTC allegations that Snapchat made multiple misrepresentations to consumers about the disappearing nature of messages sent through its service, as well its transmission of users’ geolocation information. The FTC has raised similar allegations involving undisclosed collection and transmission of location data as part of  privacy complaints against a popular flashlight app, as well as a national rent-to-own retailer and one of its software vendors, the testimony states.

In addition to its enforcement activities involving geolocation information, the Commission has conducted studies, held workshops, and issued reports on mobile privacy disclosures, mobile apps directed to kids, and other topics that elucidate best practices for companies collecting, using, and sharing geolocation information, the testimony says.

The testimony also notes the FTC’s ongoing efforts to educate consumers and businesses about protecting the privacy of geolocation information. For instance, the Commission recently released an updated version of ''Net Cetera: Chatting with Kids About Being Online," and it has released guidance directed to businesses operating in the mobile arena to help educate them on best practices to handle sensitive information, such as geolocation information.

The testimony also provides the Commission’s initial views on the Location Privacy Protection Act of 2014, proposed legislation that seeks to improve the transparency of geolocation services and give consumers greater control over the collection of their geolocation information. The FTC supports the goals of the LPPA, and believes it is an important step forward in protecting consumers’ sensitive geolocation information, the testimony states.

In particular, the testimony highlights three important LPPA provisions that are consistent with the Commission’s views:

The bill defines “geolocation information” as information that is “sufficient to identify the street name and name of the city or town” in which a device is located. This definition is consistent in many respects with the definition of “geolocation information” in the Commission's COPPA Rule.

The LPPA requires that an entity collecting consumer geolocation information disclose its collection of such information. The Commission has recommended that companies make their data collection practices more transparent to consumers.
The LPPA requires affirmative express consent from consumers before a covered entity may knowingly collect or disclose geolocation information, and the Commission supports that approach.

In addition, the testimony notes that the LPPA gives the Department of Justice sole enforcement authority and rulemaking authority, in consultation with the FTC. As the federal government’s leading privacy enforcement agency, the testimony recommends that the Commission have rulemaking and enforcement authority with regard to the civil provisions of the LPPA, and that DOJ have enforcement authority for the criminal provisions.

The Commission vote approving the testimony and its inclusion in the formal record was 5-0.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them.