Before the Federal Trade Commission CONSUMER PRIVACY 1997 --
P954807 COMMENT; and BELL ATLANTIC AND NYNEX COMMENTS AND REQUEST TO PARTICIPATE Bell Atlantic and NYNEX are pleased to submit these comments in response to the Federal Trade Commission's Notice regarding Session Two -- Consumer Online Privacy. In addition, Bell Atlantic and NYNEX wish to notify the FTC that they are interested in participating in the FTC's workshop on Session Two. I. COMMERCIAL WEB SITES OPERATED BY BELL ATLANTIC AND NYNEX Bell Atlantic and NYNEX operate a number of commercial Web sites, including corporate "Home Pages" for the corporate parents as well as affiliates including NYNEX CableComms, Bell Atlantic Internet Solutions, and Bell Atlantic NYNEX Mobile. In addition, Bell Atlantic and NYNEX each operate electronic directories on the World Wide Web. A. Bell Atlantic/NYNEX Web Sites Both Bell Atlantic and NYNEX operate electronic yellow pages Web sites. BigYellow, NYNEX Interactive Technology's offering, is an interactive directory with over 16 million business listings nationwide. Users can search for a listing by business name or business type in any state across the nation, or access the hundreds of related links that are updated regularly. Users can also search for a residential listing.(1) Through BigYellow, businesses can promote their products and services by publishing product lists, descriptions, photos, and audio/visual marketing messages. Businesses can also have a direct link to their home pages. In addition, BigYellow provides consumers with valuable shopping and location information while saving them time and energy. Bell Atlantic Interactive Yellow Pages, the Bell Atlantic Electronic Publishing Inc. electronic directory offering, provides a broad range of local community information for the Mid-Atlantic region such as information on neighborhoods, business climate and transportation options. In addition, there is government information, and "Special Interest" areas of leisure travel, home improvement and business information. Also included is a link to the BigYellow Web site. Advertisers can purchase banner advertising and enhanced interactive listings, allowing them to promote their products and services and closely target their messages to users. In addition, Bell Atlantic offers the complete line of BigYellow advertising products to businesses throughout the Bell Atlantic region. Bell Atlantic and NYNEX, as well as their affiliates, also operate corporate "Home Pages." These Web sites contain general information about the companies, including recent news releases, descriptions of products and services, information on philanthropic programs, information on employment opportunities, stock quotes, information on executives, information on how to order services and how to contact the company to give feedback, etc. B. Personal Information Today, the only information Bell Atlantic and NYNEX obtain about individual users online with their Web site is information supplied by the user for a specific purpose. For example, users of NYNEX's Web site can generate a job application, order a telecommunications service, or submit a request for a philanthropic grant, while online with NYNEX's Home Page. NYNEX uses that information only for the purpose for which the user submitted it -- that is, to process the order, consider the job application, or consider the applicant for a grant. Bell Atlantic and NYNEX also obtain aggregated information about the use of their Web sites. NYNEX's Web sites track the number of users -- not their identities -- that access the sites. This information alone is useful to advertisers on the electronic yellow pages, because it enables them to learn whether anyone is viewing their advertising. It is also useful to NYNEX as a provider of Home Pages. At the same time, this aggregate information, which does not identify any user, does not raise any privacy concerns.(2) Bell Atlantic just completed the installation of a usage tracking system which has the capability of collecting information about top browsers, top domains, top entry and exit pages and the top paths users take while navigating the site. All of the information is aggregated and is used to identify areas of highest use, navigational enhancements and type of use. The software collects this information by using "cookie" technology, which assigns the user a number without ascertaining the user's identity. A user has the opportunity to either accept or reject a cookie being set.(3) If the user does not want a cookie set, it will not preclude the user from accessing the application but the user's visit will not be recorded precisely. The tracking software will instead use algorithms to track the visit. The tracking software will be able to collect navigation path, domain, organization and browser information regardless of whether the cookie is accepted or not accepted. Again, none of the information Bell Atlantic obtains using "cookie" technology is on an individual basis. It is all aggregate, and does not implicate privacy concerns. In the future, NYNEX and Bell Atlantic plan to expand their capabilities for obtaining information about the users of their Web sites, in order to improve the services they can offer users and advertisers. For example, BigYellow is examining the possibility of asking users to "register," that is, to provide information about their interests so that targeted advertising can be provided to them when they access BigYellow. BigYellow is also planning to add the capability to perform transactions, in which case it will be obtaining users' credit information for purposes of the transaction. Another technology BigYellow is considering is the ability to track a user as the user navigates BigYellow, again for the purpose of targeting advertising for that user. This "tracking," like that Bell Atlantic has begun using, would be performed using "cookie" technology to assign the user a number, without learning the customer's identity. Bell Atlantic is also looking into providing transaction capability which will allow users to purchase products online. This initiative will require obtaining users' credit information for purposes of transactions. In addition, Bell Atlantic and NYNEX plan to make their corporate Home Pages more interactive and less passive. For example, the companies are exploring enabling customers to review their telephone bills or ask for repairs through the Home Pages. These services will require the user to provide certain information to identify himself or herself, as well as to allow the companies to respond appropriately. All of these ways of obtaining and using information about users are necessary in order to provide valuable services to them. It is critically important that the development of these types of interactive services not be chilled by the imposition of unnecessary regulations, particularly in light of the efforts interactive service providers are making to "self-regulate" in order to protect users' privacy. C. Self-Regulation: Privacy Protection Policies Bell Atlantic and NYNEX have developed and implemented internal policies that ensure that they respect and protect the privacy of customer information. Our policies give customers choices, flexibility and control over how we use individual information. Copies of the NYNEX Privacy Principles, and Bell Atlantic's Residential Customer Information Privacy Principles, are attached.(4) NYNEX and Bell Atlantic plan to develop a common set of Privacy Principles once they complete their merger. In the process, we also plan to update our privacy policies to apply them to the online environment. In addition, as active members of the Interactive Services Association, Bell Atlantic and NYNEX have participated in the formation of industry guidelines regarding the protection of consumer information online. Even in their current forms, Bell Atlantic's and NYNEX's privacy policies require them to consider consumer privacy when planning and introducing new services, and to inform customers of the privacy implications of these services. When Bell Atlantic and NYNEX begin to obtain individual information about the users of their Web sites and use that information in new ways, the companies must, under their existing privacy policies:
These policies, in the online context, would mean informing users up front, in clear language that is not "fine print," if individual information will be obtained about them, and how that information will be used. These policies also would require Bell Atlantic and NYNEX to give these customers the ability to choose not to have individual information collected, used, or disclosed to another company. II. GOVERNMENT ROLE IN PRIVACY PROTECTION For more than a century, customers have counted on Bell Atlantic and NYNEX to respect and protect the privacy of customer information. We intend to continue our tradition of protecting customer privacy as we move into new online businesses. We perceive it as simply good business to maintain high standards for the protection of individual privacy. Users want focused information in an easily searchable format which conforms to their individual requirements. To better serve our customers, we should be allowed to collect information, voluntarily supplied, from customers to help facilitate the customization of their online experience. This information will also help advertisers in providing the type of product and service information which will meet the needs of the customers. In Bell Atlantic's and NYNEX's views, government should not impose regulations to govern the practices of commercial Web sites regarding the privacy of information about their users. We believe the industry and many individual companies have already developed policies for dealing responsibly with online privacy concerns. Government should not impose restraints on uses of information that would enable the industry to provide targeted products and services which consumers have indicated they want. Instead, government should continue, with workshops such as this, to have a prominent role in informing the industry and consumers about developments in this area. And, of course, government should itself adopt the policies for protecting consumer information that have been developed by industry.(5) Respectfully submitted, ____________________ For Bell Atlantic _____________________ April 15, 1997 For NYNEX The NYNEX Privacy Principles Message from the Chairman It's hardly news that technology is changing the way companies do business -- and changing the way they collect and use information about customers. Used responsibly, that information can help companies serve customers better. But with advances in data processing come growing concerns -- by customers and policymakers -- about maintaining the privacy of individual customer information. At NYNEX, we take these concerns very seriously. We're a company built on a century-old tradition of customer service and trust, and we're working hard to uphold that tradition. That's why we have established a set of Privacy Principles that define our commitment to safeguarding customer privacy. We feel that these guidelines -- among the most progressive in the industry -- balance customer concerns about privacy with their interest in receiving good service and useful new products from us. This is especially important at a time when emerging telecommunications services present us with new business opportunities and new challenges to protecting customer privacy. We recognize that some of our customers are more concerned than others about the information we obtain about them. Our nine Principles give customers choices, flexibility and control over how we use that information. And the Principles guide our employees in handling customer information so that private information remains private. The NYNEX Privacy Principles are being actively communicated to our key stakeholders, and the message is straightforward: We expect our employees to protect the privacy of our customers, and encourage our partners and suppliers to do the same. At NYNEX, we're committed to safeguarding privacy. We're putting customers first -- and that's the key to success in this new kind of marketplace. I encourage you to review the Principles outlined in this brochure. If you have questions or comments, or would like more information, contact Dennis Wax, NYNEX's Privacy Advocate, on (518) 396-1020. His address is 158 State Street, Room 1010A, Albany, NY 12207. Ivan Seidenberg The NYNEX Privacy Principles Explaining the Guidelines The goal of the NYNEX Privacy Principles is simple: balance our customers' concerns about privacy with their interest in receiving good service and useful new products from us. While the Principles apply to all NYNEX businesses, they may be implemented in different ways depending on the business unit and customer expectations. For example, residential customers of our telephone services have higher privacy expectations than, say, businesses that advertise in our Yellow Pages directories. 1. NYNEX uses individual customer information for its business purposes only. NYNEX provides services that reach deep into the personal and business lives of our customers -- people who have come to trust us with their account, billing and communications records. We limit the information we obtain about customers to what's needed in the normal course of providing service. And we give customers control and choices over how that information is used. Access to customer information is limited to employees who need it to perform their jobs -- and they follow strict guidelines when handling that information. Advanced security procedures also are in place to help safeguard privacy. 2. NYNEX informs customers how information it obtains about them is used, as well as their options regarding its use. NYNEX will publish a "Privacy Statement" for customers that describes the type of information a NYNEX business unit obtains about customers, how it's used, when it might be disclosed, the stringent measures we employ to protect it and ways the customer can restrict the use or disclosure of that information. 3. NYNEX gives customers opportunities to control how and if it uses individual information about them to sell them NYNEX products and services. Our customers have a large measure of control over how we use their individual information to sell them new products and services. While NYNEX will sometimes use that information to promote our products and services, we won't call customers who have expressed a preference not to be called for marketing purposes. In addition, customers may arrange to restrict NYNEX from using information about their phone service to offer them information services or customer equipment. But NYNEX does use aggregated information about customers for our own general marketing and planning purposes -- so that we can, for example, develop, test and market new products and services that meet the needs of a group of customers. 4. NYNEX enables customers to control how and if it discloses individual information about them to other companies -- except as required by law or to protect the safety of customers, employees or property. Subject to legal and safety exceptions, NYNEX won't share individual information with unaffiliated companies, or with affiliates that haven't agreed to protect customer information -- unless we either obtain customer consent or give the customer an opportunity to "opt-out" (to choose not to have their information disclosed). An example of when NYNEX is required by law to disclose information to an unaffiliated entity: We provide billing name and address information to a customer's long-distance carrier. We're committed to ensuring that all NYNEX business units and their employees comply with the Privacy Principles. So, individual customer information generally may be disclosed to other NYNEX business units -- or affiliated companies that have agreed to comply with the Principles -- without giving a customer the specific opportunity to opt-out. 5. NYNEX strives to provide customers with access to information it has obtained about them and allows them to correct errors in that information. It's our responsibility to give customers access to the information we have about them. And we use sophisticated data processing technology to help ensure that the information is accurate. 6. NYNEX considers privacy when planning and introducing new services and informs customers of the privacy implications of these services. At NYNEX, we're committed to expanding the world of communications and multimedia for customers -- a world of wireline and wirefree solutions ... voice, video and data services ... information and entertainment. We will investigate the privacy implications these new services may have and build safeguards into services before they're introduced. And we will alert customers about the effect on privacy the new services may have. 7. All NYNEX employees are responsible for safeguarding individual customer information. NYNEX's Code of Business Conduct, which is distributed to all employees, clearly states our policy: We must protect the privacy of all forms of customer communications -- whether they are voice, data or image transmissions. The Code makes equally clear that employees who fail to follow the Principles will face disciplinary action, which can include dismissal. Every NYNEX business unit is responsible for communicating the Privacy Principles to their employees and outlining specific steps for safeguarding privacy. 8. NYNEX complies with all applicable privacy laws and regulations wherever it does business. Customer and policymaker perceptions of privacy can change over time. We will regularly examine -- and update, if necessary -- the NYNEX Privacy Principles. Not only will NYNEX comply with all applicable privacy laws, but we'll carefully monitor stakeholder needs and expectations. And NYNEX will work with policymakers to ensure that we continue to safeguard privacy, giving customers choices, flexibility and control. 9. Each NYNEX company is responsible for implementing these Principles and informing customers about its privacy practices. NYNEX encourages companies related to but not wholly owned by NYNEX to adopt these Principles. Every NYNEX business unit will: Evaluate their particular needs and determine how to best implement the Principles; Develop their own privacy policies and procedures based on the Principles; Inform their employees of the policies and train them in the proper procedures; and Develop a customer statement informing customers how personal customer information is used and how they can control its use and disclosure. The NYNEX Public Policy Council -- the leadership team responsible for shaping the strategic direction of NYNEX -- will ensure that business units comply with the Principles. NYNEX expects any vendors and consultants we hire to observe these privacy rules. They must abide by the Principles when conducting work for us, and will be held accountable for their actions. BELL ATLANTIC INFORMATION
PRIVACY CODE
BELL ATLANTIC RESIDENTIAL
CUSTOMER 1. INFORMATION COLLECTION AND USE Bell Atlantic only collects that information about our residential customers that helps to provide them with current and additional services. This information is also used to protect residential customers against telecommunications fraud, to conduct industry or consumer surveys, and to maintain good customer relations. For example:
2. DISCLOSURE OF PERSONAL INFORMATION Bell Atlantic considers "personal information" to be information about specific residential customers other than names, addresses or telephone numbers. We provide personal information to non-Bell Atlantic entities only for business purposes such as to allow long-distance companies and other telephone companies to bill for telecommunications services and to prevent fraud, at the residential customer's request or as required by law. For example:
3. CUSTOMER EDUCATION AND EMPOWERMENT Bell Atlantic is committed to providing our residential customers with access to the information we have about them. Our Service Consultants are trained to answer customer questions. They will also provide explanations of how such information is used and how to correct any inaccuracies if they occur. In addition, Bell Atlantic actively seeks consumer and expert opinions to assure that we continue to meet our residential customers' expectations for privacy protection. For example:
4. INFORMATION MANAGEMENT AND SECURITY Bell Atlantic's Corporate Compliance Officer is responsible for ensuring that all Bell Atlantic business units and their employees comply with our privacy principles. We have incorporated a review of privacy issues in our new product development process and conduct periodic privacy reviews. In addition, we pledge to use advanced technology and information-management techniques to assure that information we have about our residential customers is accurate, secure and confidential, and to ensure that our employees comply with our privacy policy. For example:
5. PUBLIC POLICY PARTICIPATION Bell Atlantic participates in and supports consumer, government and industry efforts to identify and resolve privacy issues, and to provide privacy protection related to new telecommunications services. Bell Atlantic also supports the development of international standards to protect personal information and its proper use on a worldwide basis. Our External Affairs department is responsible for coordination of Bell Atlantic's public policy participation. For example:
6. FUTURE PRODUCTS, SERVICES AND CONSUMER EXPECTATIONS Bell Atlantic is committed to building a "full service network" to provide access to new interactive, multimedia services. Although many of these services are in the early stages of development, we pledge to evaluate any potential privacy impacts of these services before they are deployed. Bell Atlantic recognizes that societal changes and advances in technology may change the public's privacy expectations. Therefore, these principles will be evaluated and revised, as necessary, to ensure that they continue to meet high standards for privacy protection and quality residential customer service. January 1995 1. Web sites such as BigYellow, and Bell Atlantic and NYNEX electronic white pages products, provide only published name, address and telephone number information about individual consumers. These products do not raise privacy concerns because they do not contain sensitive information. For these reasons, Bell Atlantic and NYNEX decided not to participate in Session One, which focuses on "look-up" databases containing sensitive individual information. 2. Some advertisers whose Home Pages are "linked" to the electronic yellow pages Web sites allow users to make purchases or interact in other ways with their Web site. In this scenario, NYNEX does not obtain the user's information. 3. By setting his or her browser, the user can automatically accept all cookies, reject all cookies, or receive announcements allowing case by case determinations as to whether to accept or reject. 4. NYNEX's Privacy Principles, which were submitted to the FTC last year, have changed in only very minor respects since then. 5. Regulation, if warranted at all, should be along the lines of the industry's self-regulatory guidelines and principles. |
Bell
Atlantic's Privacy Policy: With these
principles, Bell Atlantic is forming a
partnership with our residential customers for
the proper and positive uses of personal
information. These principles express our
voluntary commitment to assuring strong and
meaningful consumer information privacy
protection in an era of rapidly changing
communications technology and applications. The
examples listed under the principles are meant to
give our residential customers a sense of how
these principles have been applied and are
intended to be illustrative, not all inclusive.
Residential customers can call the Bell Atlantic
service and billing office if they have any
questions.