Internet Industry Needs to Work on Privacy Concerns, Regulators Say

The FTC is “going to try self-regulation first” when privacy concerns arise, Leibowitz said. He pointed to a recent survey of privacy policies for apps directed to children. When the FTC found that many apps had bad or nonexistent privacy policies, the agency realized it “needs to educate these folks,” he said. The commission conducted education outreach followed by warning letters, he said. “If we have to, we might bring some cases.” Leibowitz wants to educate these companies first, he said. “It’s the kind of thing we haven’t announced but are effectively doing."

Regulation that might suppress innovation is not the answer, said California Attorney General Kamala Harris: “I'm reluctant to think that we will do anything unnecessarily to suppress [innovation] because of our fear of the unknown.” While it’s important to keep vulnerable people safe amid a world of online innovation, she said, “I think we should pause and not succumb to that reflex” to regulate. Formulating and implementing regulation “takes a very long time,” she said, and governments don’t have enough information to regulate on big data practices at this point. While companies are eager to collect big data, she said, many of them are often unsure about what they will do with it. Governments should wait to learn more to ensure that “we are not reactive without fully thinking out the potential that is both positive and negative” of big data, she said. Big data refers to the practice of using multiple datasets often across multiple computers or servers to identify trends.

Instead, governments and industry members should work together, Harris said. She described a recent situation where her office brought Apple and Google in to discuss privacy with mobile applications, calling it a “beautiful and rare example of industry and government working together.” This kind of “coordination and collaboration with the industry” is going to be necessary “if government is going to be relevant on this issue and helpful,” Harris said. Companies are willing to come to the table to discuss privacy concerns, she said, because they know they will have to. “Something like [the Stop Online Piracy Act] is going to happen again” where Congress offers legislation that makes the industry howl -- but industry can preempt that by coming to the table with regulators, she said. “They're going to either be on board with it, or it’s going to happen to them."

Policy discussions should involve the people who are going to be the next major players in the technology industry, said Brad Burnham, co-founder of Union Square Ventures, a venture capital fund. “New incumbents” like Google and Facebook get called into those meetings, he said, but “the next Google” doesn’t get a call. Because of the companies that are included, he said, “the policy that you're likely to create is one that suits those new incumbents.” Burnham suggested the FTC focus on encouraging young developers unaware of regulations to give their users information about the data collected on them. Pointing to the Department of Veterans Affairs’ Blue Button Initiative -- which allows veterans to download their health data -- Burnham suggested that developers release user data to their users in a read/write application programming interface. Other companies could then comprehensively advise users and parents of young users on what information is being collected and the details of each privacy setting, he said: “That’s developing a whole new market to solve the problem as opposed to requiring the 20-year-old” developers to figure out compliance issues.

Consumer distrust of data collecting practices is “an industry issue,” said Mozilla General Counsel Harvey Anderson. When users “trust the person who collects and uses their data, we don’t have the same issues.” That places the onus on industry members to change their data collection and use practices and attitudes about transparency, he said. “There’s an opportunity for the industry to do something different.”