The Federal Trade Commission on Monday announced its intention to push through greater regulation over data collection companies that compile a wide range of personal and financial information about millions of consumers.  This is likely to mean that things can get dicey for cold callers and others buyers of data lists.

Among its recommendations, the FTC wants to allow people access to the information collect on them.  That is part of a sweeping set of guidelines put forth in the Commission’s final report on online consumer privacy.  In it, the FTC advocates enacting legislation that would provide more restrictions and transparency for these so-called data brokers, which create detailed user profiles of buyers based on their spending habits, both online and offline.  The brokers then sell the information to retailers and marketers.

In its report, the FTC also commended efforts by industry trade groups and technology companies to enact a "do not track" mechanism that allows consumers to choose not to have their personal data collected online.  But the commission called for businesses to "accelerate the pace" of self-regulation.  Many retailers and digital ad companies use that data to display specific ads online that are tailored to the buyer’s interests;  some of them will follow users around the Web.

Companies are resisting "do not track" legislation and instead contend they can discipline themselves.  Last month, federal regulators, members of advertising trade groups and technology companies announced their support for a consumer privacy bill of rights issued by the White House and agreed to honor a voluntary "do not track" system.

The report comes as consumer groups and privacy advocates are expressing increasing concern about the volume of consumer data that is being collected and how it is being used. These groups want legislation that gives users more control over the information collected on them.

The FTC said it intends to work with the White House and the Commerce Department on proposals they unveiled last month to develop voluntary industry-wide codes of conduct that the FTC can enforce.  The FTC also will push for legislation; while Jon Leibowitz, the chairman of the FTC, said the commission did not endorse any specific legislation, he mentioned a bill introduced in the Senate in April 2011 by John Kerry (D-Massachusetts) and John McCain (R-Arizona).

That bill seeks to require companies to tell consumers what data are being collected and allow them to opt out of the practice;  in addition, consumers would have the right to be required to opt in to the collection of sensitive information, like those related to medical conditions.

At least 2 other bills have also been introduced in Congress.  One, by Senator John D. Rockefeller 4th, Democrat of West Virginia, supports a mandatory "do not track" mechanism within every Internet browser.  Representative Jackie Speier, a California Democrat, proposed a bill with an opt-out mechanism for data collection, and Representatives Edward J. Markey, a Massachusetts Democrat, and Joe Barton, a Texas Republican, have offered a bill enhancing children’s privacy online, something the FTC report also supports.

None of that legislation is likely to make it into law in this Congressional session, however, given the heavy schedule of pending matters and re-election campaigns.  But Mr. Leibowitz said he expects it to occur early in the next Congress.  "If a real do-not-track option doesn’t come to fruition by the end of the year," he said, "there will be, I don’t want to say a tsunami of support for do-not-track legislation next Congress, but certainly a lot of support for the notion of do-not-track."

The FTC suggested the guidelines would not affect small business or companies that collect online data from 5,000 people or fewer and do not sell that data to third parties.  It would also loosen the guidelines for companies that collect data for the purposes consistent with the context of a user’s visit to a particular Web site.  For example, if a user visits a Web site to make a purchase, the company would be able to collect data on that user and would not be required to offer consumers the option to opt out of data collection.

"If companies adopt our final recommendations for best practices — and many of them already have — they will be able to innovate and deliver creative new services that consumers can enjoy without sacrificing their privacy," Mr. Leibowitz said in a statement. "We are confident that consumers will have an easy-to-use and effective do-not-track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don’t."

The commission announced two workshops to be held this year that will address data privacy on mobile devices and social media Web sites and by Internet service providers and operating systems. The agency also said it would work with the Department of Commerce to create enforceable self-regulatory codes of conduct for companies that collect data in specific sectors, such as mobile and social media.

[C-I Note: It's only a matter of time before the FTC and other regulators find that their efforts in going after the data-gathering firms has limited effectiveness.  That is when the spotlight will be placed on firms that purchase the lists and use them in a manner that can intrude on the privacy of the individuals on the lists.  Significant audits and sanctions will be handed out to the users, which will force them to discontinue their purchases of customer lists - and, in turn, will hurt the profits of the data collection companies.

Firms would be wise to begin preparing for the future - which can come in early 2013 - soon after the November elections.]

For further details:  [NYTimes, 3/26/12].