The Federal Trade Commission is calling for a new law that would allow people to review the vast amounts of information being collected about them as the Internet, smartphones and other technology make it easier to create digital dossiers of just about anyone’s life.

The proposal, outlined in an online privacy report released this week, is an unusually tough one from a consumer protection agency that prefers to coax companies into adopting voluntary principles. It comes a month after the Obama administration issued a proposed “Consumer Privacy Bill of Rights” and urged technology companies, consumer groups and others to work together on developing more safeguards.

As part of a 57-page report (“Protecting Consumer Privacy”) that also touched on other topics, the FTC said Congress needs to impose more controls over so-called “data brokers” that profit from the collection and sale of files containing sensitive information that can affect people’s ability to get a job or find a place to live. These data brokers range from publicly traded companies such as Acxiom Corp. to a hodgepodge of small, regional services that may only have two or three employees.

“Consumers are often unaware of the existence of these entities, as well as the purposes for which they collect and use data,” Monday’s report said.

Key Recommendations

The report’s key recommendations:

  1. Privacy by Design: Companies should build in consumers’ privacy protections at every stage in developing their products. These include reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy
  2. Simplified Choice for Businesses and Consumers: Companies should give consumers the option to decide what information is shared about them, and with whom. This should include a Do-Not-Track mechanism that would provide a simple, easy way for consumers to control the tracking of their online activities.
  3. Greater Transparency: Companies should disclose details about their collection and use of consumers’ information, and provide consumers access to the data collected about them.

Action Items

The five key “action items” in the report:

  • Do-Not-Track – The Commission commends the progress made in this area: browser vendors have developed tools to allow consumers to limit data collection about them, the Digital Advertising Alliance has developed its own icon-based system and also committed to honor the browser tools, and the World Wide Web Consortium standards-setting body is developing standards. “The Commission will work with these groups to complete implementation of an easy-to-use, persistent, and effective Do Not Track system,” the report says.
  • Mobile – The FTC urges companies offering mobile services to work toward improved privacy protections, including disclosures. To that end, it will host a workshop on May 30, 2012 to address how mobile privacy disclosures can be short, effective, and accessible to consumers on small screens.
  • Data Brokers – The Commission calls on data brokers to make their operations more transparent by creating a centralized website to identify themselves, and to disclose how they collect and use consumer data. In addition, the website should detail the choices that data brokers provide consumers about their own information.
  • Large Platform Providers – The report cited heightened privacy concerns about the extent to which platforms, such as Internet Service Providers, operating systems, browsers and social media companies, seek to comprehensively track consumers’ online activities. The FTC will host a public workshop in the second half of 2012 to explore issues related to comprehensive tracking.
  • Promoting Enforceable Self-Regulatory Codes – The FTC will work with the Department of Commerce and stakeholders to develop industry-specific codes of conduct. To the extent that strong privacy codes are developed, when companies adhere to these codes, the FTC will take that into account in its law enforcement efforts. If companies do not honor the codes they sign up for, they could be subject to FTC enforcement actions.

Misuse of Information

An investigation by The Associated Press last year found that data brokers often store incorrect or outdated information, including criminal records. In some cases, people are denied jobs because data brokers incorrectly report them as convicted felons. Widespread complaints about inaccurate records triggered a class-action lawsuit that culminated in one database company, HireRight Solutions Inc., to settle the case for $28.4 million last year.

The FTC is pushing for a law that would let consumers see their files and dispute personal data held by information brokers. It would be similar to current federal laws that guarantee consumers free access to their credit reports once a year.

“We would be happy to engage in a dialogue about what should be included in a law and what shouldn’t be,” said Jennifer Barrett Glasgow, Acxiom’s chief privacy officer. She predicted it could take at least three years to get a law approved. It took years of political haggling before the Fair Credit Reporting Act was amended in 2003 to include free annual access to credit reports.

The FTC is recommending that Congress base a data-broker law on a bill that was passed by the House in 2009, but died in the Senate. The FTC is also trying to persuade data brokers to create a centralized website where they identify themselves and disclose how they handle consumer information.

By focusing on data brokers, the commission is opening “an important new front in the battle to protect consumer privacy,” said Jeff Chester, executive director of the Center for Digital Democracy, a privacy rights group. “Today, consumers face an ever growing and largely invisible data apparatus that collects and pools their information.”

The FTC’s report also addressed the need for Web browsers and other key Internet services to offer simpler ways for consumers to prevent their online activities from being tracked and stored. That echoes a recommendation that the FTC first made in late 2010.

Although it has been gaining momentum, “Do Not Track” faces resistance because it threatens to undercut the growth of Internet advertising, which has become a more popular marketing vehicle as websites learn more about their visitors’ specific interests.

Nevertheless, the major Web browsers made by Microsoft Corp. Google Inc., Apple Inc. and the Mozilla Foundation have been working on features that enable users to block tracking. That still hasn’t prevented some Internet companies, including Google, from coming up ways to get around the blocking features built into some browsers. Google says its recently detected bypass of the privacy settings in Apple’s Safari browser was inadvertent.

If the Internet industry doesn’t voluntarily offer effective anti-tracking tools, FTC Chairman Jon Leibowitz has indicated the agency will urge Congress to pass a law to address that privacy issue, too.