MRA Counters Privacy Proposals
January 3 2013
US research body the MRA has filed comments with the FTC objecting to proposals from the privacy group EPIC over a settlement with data firm Compete, Inc regarding web tracking violations. MRA says the proposals could seriously impact the whole research profession.
At the end of October 2012 the FTC proposed an agreement with Compete to settle charges that it 'violated federal law by using its web-tracking software that collected personal data without disclosing the extent of the information that it was collecting [and] allegedly failed to honor promises it made to protect the personal data it collected.' Three weeks later, on November 19th, comments suggesting extensions to the terms were submitted by the Electronic Privacy Information Center (EPIC).
MRA's comments, filed on December 21st, underline the association's concern that because Compete is a research company, the proposed changes would 'pose a threat to all research companies in the US'.
The FTC's settlement deal requires Compete and its clients to fully disclose the information collected, get consumers' express consent before collecting it in future, implement a comprehensive information security program and submit it to independent third-party audits every two years for 20 years. In addition to this, EPIC urged the FTC to:
- require Compete to implement Fair Information Practices similar to those contained in the Consumer Privacy Bill of Rights
- make Compete's independent privacy assessments publicly available
- clarify the scope of implicit deception in the context of privacy policies; and
- develop a best practices guide for anonymization techniques.
MRA says none of these would prove positive for the research profession. It opposed the explicit categorization of omission as a deception under Section 5 of the FTC Act, suggesting that whereas it may make sense to notify consumers of all privacy policy changes in areas like health and credit information or other data susceptible of identity theft, 'over-notification and excessively lengthy privacy policies' may already be causing consumers to stop paying close attention ... and growing more careless in how they handle their own privacy.'
EPIC's line on the de-identification of data points, says the MRA, to a situation where 'pretty much any piece of data is ultimately personally identifiable'. The association says that while the FTC could usefully be involved in the public debate over de-identification, 'it is not at all clear that FTC-issued 'best practices' would advance the debate at this point' - and they may well 'squelch the debate long before the issue gets properly hashed out.'
On the subject of consumers' control over their own information, the MRA notes that its own Code of MR standards 'already requires that researchers seek tailor-made approaches to transparency with regard to clients, research participants, and the public at large that are appropriate to different modes and methods of research.' EPIC's stated concerns focus on the sharing of data for advertising purposes, says the MRA, whereas 'the proposed broad application of consumer control over research use of data makes no sense'. Giving consumers such access 'could potentially be quite onerous, especially for smaller research companies', does not align with research's focus on 'broad groups, not individuals' and could potentially 'lead to a much greater threat of harm from data leakage and empower the kind of consumer tracking that concerns both EPIC and the FTC'. The required collection and checking of 'even more data' runs counter to EPIC and the FTC's interest in data minimization and limited data retention, says the body.
The MRA says EPIC 'has not made a reasonable case for why Compete's privacy audits should be publicized' - and has supported its arguments with reference to events and practices in very different sectors. Privacy audits, says the MRA, 'will contain plenty of trade secrets and delicate information' and their public airing would 'potentially interfere with core research processes, such as the classification of information, impair the overall performance of research and hurt the research business.'
The full wording of the MRA's objections can be found at
www.marketingresearch.org/sites/mra.cms.memberfuse.com/mra/files/pdfs/MRA-response_to_EPIC_comments-Compete_case-12-21-12.pdf .
All articles 2006-23 written and edited by Mel Crowther and/or Nick Thomas, 2024- by Nick Thomas, unless otherwise stated.
