[PDF Download]
 

Comments of
Thomas A. Schatz
President
Citizens Against Government Waste

May 26, 2016

     Citizens Against Government Waste (CAGW) is a private, nonprofit, nonpartisan organization dedicated to educating the American public about waste, mismanagement, and inefficiency in government.  On behalf of the more than 1.2 million members and supporters of CAGW, I offer the following comments to the March 31, 2016 notice of proposed rulemaking (NPRM) on Protecting the Privacy of Customers of Broadband and Other Telecommunications Services. 

      When the Federal Communications Commission (FCC) approved the Open Internet Order on February 26, 2015 and reclassified Internet service providers (ISPs) as Title II common carriers, the agency disrupted the comprehensive privacy protection framework at the federal level for Internet users, including ISP customers.[1]  Previously, such privacy was protected by the Federal Trade Commission (FTC) under Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive practices in the marketplace.[2] 

     The regulation of online privacy and data security are extremely complex and technical issues requiring careful thought and consideration.  Unfortunately, the NPRM is exceptionally broad and raises hundreds of questions, making it difficult for stakeholders to provide adequate responses in the short time period allotted for comments and reply comments. 

     If the Open Internet Order is upheld in federal court, and jurisdiction over ISP privacy is retained by the FCC, the privacy regime should be modeled after the privacy protection framework currently in use by the FTC.  Indeed, FTC commissioners have weighed in with concerns over the NPRM.  On March 30, 2016, FTC Commissioner Maureen Ohlhausen called the provisions of the NPRM “overly broad,” suggesting that the rules would add confusion to privacy protections that the FTC already handles on a case-by-case basis.[3]  In comments presented to the FCC on May 23, 2016, former FTC Chairman Jon Leibowitz noted that while some parts of the NPRM are consistent with the FTC’s privacy framework, “in many important areas it overshoots the mark, proposing regulations for broadband providers that go well beyond those imposed upon the rest of the Internet economy and which, if adopted, would undercut benefits to the very consumers it seeks to protect.”[4] 

     The NPRM seeks to impose a highly prescriptive privacy regime on ISPs, including requiring them to obtain opt-in consent from consumers for the use of a broad range of data for marketing purposes and other typical online practices for which consent is normally assumed.   Compliance with the proposed customer consent requirements, which could increase both overhead costs of provisioning broadband and customer costs, is an onerous and unnecessary burden on broadband providers.  These restrictive rules would prevent ISPs from having the flexibility to adapt to changing technologies and adversely impact innovation and development of new business models and services for the benefit of consumers on the Internet.  These same standards would not apply to other entities doing business over the Internet, which are subject to the FTC’s privacy jurisdiction under the unfair and deceptive practices umbrella.  The FCC should endorse a technology neutral, level playing field approach to privacy that ensures consistency for the commercial use of consumer data.

     The NPRM is 145 pages long, with numerous detailed provisions, technical questions, and requests for comments that require more time than allotted in the existing comment and reply comment periods in order to formulate a thoughtful and well-researched response.  However, if this process moves forward, the FCC should follow the FTC’s lead on consumer privacy protection and implement a similar framework for ISPs, rather than creating a new and stricter privacy regulations and enforcement structure proposed in the NPRM.