NTIA Seeks Comment on New, Outcome-Based Privacy Approach

The RFC notes that there is a fragmented approach to privacy, both in the U.S. and worldwide, as a “growing number of foreign countries, and some U.S. states, have articulated distinct visions for how to address privacy concerns.” Such fragmentation increases regulatory costs and hinders innovation. Furthermore, the RFC says the current prescriptive approach “does not necessarily provide measurable privacy benefits” and leads to “long, legal, regulator-focused privacy policies and check boxes, which only help a very small number of users” and stymie innovation.

The RFC proposes seven desired outcomes that should underpin privacy protections: Transparency, control, reasonable minimization (of data collection, storage length, use, and sharing), security, access and correction, risk management, and accountability. According to the RFC, the outcome-based approach will provide greater flexibility, consumer protection, and legal clarity. The new approach also seeks to reduce fragmentation and increase harmonization and interoperability.

Additionally, the RFC describes eight overarching goals for federal action on privacy:

1. Regulatory harmonization

2. Legal clarity while maintaining the flexibility to innovate

3. Comprehensive application

4. Risk and outcome-based approach

5. Interoperability

6. Incentivize privacy research

7. FTC enforcement

8. Scalability

The NTIA is seeking comments on the listed outcomes and goals, as well as other issues such as if the FTC needs additional resources to achieve the goals.

Authored by Mark Brennan, Bret Cohen and Britanie Hall

The authors wish to thank Gregory Oshel for his assistance in preparing this article.