FTC explains standard for online protecting privacy

The Federal Trade Commission’s (FTC) standard for protecting privacy focuses on any information that can “reasonably be connected to a device or a person,” according to an agency official.

Maneesha Mithal, the associate director of the FTC’s privacy division, said FTC decisions and enforcement actions will serve a kind of case law to help companies understand what information to protect and how.

She said she isn’t concerned that a hazy definition of protected information could lead to a chilling effect on innovation, and said that industry should be able to make the right calls — not the FTC.

"As a government agency, we aren't the ones who have our fingers on the pulse of technology," Mithal said during an event sponsored by the Congressional Internet Caucus Advisory Committee.

The standard was adopted by the FTC in March but is identical to a staff report that commissioners signed off on in December 2010.

It takes a broader view of what information is deserving of regulatory protection. Previous rules and regulations focused on securing personally identifiable information such as names, Social Security numbers and addresses.

Mithal stressed that the FTC’s new privacy report shouldn’t be seen as an alternative to a proposal from the White House, calling the two papers "complementary and consistent."

The main difference, she said, is the administration's policy plan is more focused on implementation, while the FTC report provides "a little more guidance" to industry.

Mithal caused a stir at the event when she seemed to indicate the FTC would take action against app developers who don't create privacy policies for their products.

Asked whether she thought the FTC had authority to take action in such cases, Mithal said, "stay tuned."

CORRECTION: An earlier version of this story incorrectly suggested the FTC has shifted its position on how to protect privacy online. The FTC has operated under the same policy since December 2010.