2011-2904. Agency Information Collection Activities; Proposed Collection; Comment Request; Extension

AGENCY:

Federal Trade Commission (“Commission” or “FTC”).

ACTION:

Notice.

SUMMARY:

The FTC is seeking public comments on its proposal to extend through August 31, 2014, the current Paperwork Reduction Act (“PRA”) clearance for information collection requirements contained in the Children's Online Privacy Protection Act Rule (“COPPA Rule”), which will expire on August 31, 2011.

DATES:

Comments must be filed by April 11, 2011.

ADDRESSES:

Interested parties may submit written comments electronically or in paper form by following the instructions in the Request for Comments part of the SUPPLEMENTARY INFORMATION section below. Comments in electronic form should be submitted by using this weblink: https://ftcpublic.commentworks.com/​ftc/​coppapra (and following the instructions on the web-based form). Comments filed in paper form should be mailed or delivered to the following address: Federal Trade Commission, Office of the Secretary, Room H-113, 600 Pennsylvania Avenue, NW., Washington, DC 20580, in the manner detailed in the SUPPLEMENTARY INFORMATION section below.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information regarding this proceeding should be addressed to Mamie Kresses, Federal Trade Commission, Bureau of Consumer Protection, Division of Advertising Practices, 600 Pennsylvania Ave., NW., Mail Drop NJ-3212, Washington, DC 20580, [phone].

SUPPLEMENTARY INFORMATION:

The COPPA Rule, 16 CFR Part 312, requires commercial Web sites to provide notice and obtain parents' consent before collecting, using, and/or disclosing personal information from children under age 13, with limited exceptions.

Request for Comments

Under the PRA, 44 U.S.C. 3501-3521, Federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. “Collection of information” means agency requests or requirements that members of the public submit reports, keep records, or provide information to a third party. 44 U.S.C. 3502(3), 5 CFR 1320.3(c). As required by section 3506(c)(2)(A) of the PRA, the FTC is providing this opportunity for public comment before requesting that OMB extend the existing paperwork clearance for the COPPA Rule. (OMB Control Number 3084-0117). Comments must be received on or before the deadline specified above in the DATES section in order to be considered by the Commission.

The FTC invites comments on: (1) Whether the required collection of information is necessary for the proper performance of the functions of the agency, including whether the information has practical utility; (2) the accuracy of the agency's estimate of the burden of the required collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

Comments should refer to “COPPA Rule: FTC File No. P114504” to facilitate the organization of comments. Please note that your comment—including your name and your state—will be placed on the public record of this proceeding, including on the publicly accessible FTC Web site, at http://www.ftc.gov/​os/​publiccomments.shtm.

Because comments will be made public, you are solely responsible for ensuring they do not include any sensitive personal information, such as any individual's Social Security Number; date of birth; driver's license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. Comments also should not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, comments should not include any “[t]rade secret or any commercial or financial information which is * * * privileged or confidential.” See Section 6(f) of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). Comments containing matter for which confidential treatment is requested must be filed in paper form, must be clearly labeled “Confidential,” and must comply with FTC Rule 4.9(c).^[1]

Please consider submitting your comments in electronic form. Comments filed in electronic form should be submitted using the following weblink: https://ftcpublic.commentworks.com/​ftc/​copparulepra and following the instructions on the web-based form. To ensure that the Commission considers an electronic comment, you must file it on the web-based form at the weblink https://ftcpublic.commentworks.com/​ftc/​coppapra. If this Notice appears at http://www.regulations.gov/​search/​index.jsp,, you may also file an electronic comment through that Web site. The Commission will consider all comments that regulations.gov forwards to it.

The Commission will consider all timely and responsive public comments that it receives. Comments received will be available to the public on the FTC Web site, to the extent practicable, at http://www.ftc.gov/​os/​publiccomments.shtm. As a matter of discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC Web site. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy, at http://www.ftc.gov/​ftc/​privacy.shtm.

Burden Statement

Estimated annual hours burden: 6,100 hours.

(a) Disclosure Requirements: 6,000 hours.

The COPPA Rule contains certain statutorily-required notice requirements, which constitute a “collection of information” under the PRA. These are:

(1) Each Web site and online service directed to children, and any Web site or online service with actual knowledge that it is collecting personal information from children, must provide notice of how it collects, uses, and discloses such information and, with limited exceptions, must obtain the prior consent of the child's parent in order to engage in such collection, use, and disclosure;

(2) The operator must provide the parent with notice of the specific types of personal information being collected from the child and give the parent the opportunity to forbid the operator from collecting, using, or maintaining such information, and to provide reasonable means for the parent to obtain access to the information and to direct its deletion; and,

(3) Web site and online service operators must establish procedures that protect the confidentiality, security, and integrity of personal information collected from children.

The FTC staff estimates that roughly 100 new web entrants each year will fall within the Rule's coverage and that, on average, new entrants will spend approximately 60 hours crafting a privacy policy, designing mechanisms to provide the required online privacy notice and, where applicable, the direct notice to parents.^[2] Accordingly, staff estimates that complying with the Rule's disclosure requirements will require approximately 6,000 hours (100 new web entrants × 60 hours per entrant). Consistent with prior estimates, FTC staff estimates that the time spent on compliance would be apportioned five to one between legal (lawyers or similar professionals) and technical (computer programmers) personnel. Staff therefore estimates that lawyers or similar professionals who craft privacy policies will account for 5,000 of the 6,000 hours required. Computer programmers responsible for posting privacy policies and implementing direct notices and parental consent mechanisms will account for the remaining 1,000 hours.

Web site operators that have previously created or adjusted their sites to comply with the Rule will incur no further burden associated with the Rule, unless they opt to change their policies and information collection in ways that will further invoke the Rule's provisions. Moreover, staff believes that existing COPPA-compliant operators who introduce additional sites beyond those they already have created will incur minimal, if any, incremental PRA burden. This is because such operators already have been through the start-up phase and can carry over the results of that to the new sites they create.

(b) Voluntary Reporting Requirements for Safe Harbor Participants: 100 hours

Operators can comply with the Rule by meeting the terms of industry self-regulatory guidelines that the Commission approves after notice and comment.^[3] While the submission of industry self-regulatory guidelines to the agency is voluntary, the Rule includes specific reporting requirements that all safe harbor applicants must provide to receive Commission approval. Staff retains its estimate that it would require, on average, 265 hours per new safe harbor program applicant to prepare and submit its safe harbor proposal in accordance with Section 312.12(c) of the Rule. Industry sources have confirmed that this estimate is reasonable and advised that all of this time would be attributable to the efforts of lawyers. Given that several safe harbor programs are already available to Web site operators, FTC staff believes that it is unlikely that more than one additional safe harbor applicant will submit a request within the next three years of PRA clearance sought. Thus, annualized burden attributable to this requirement would be approximately 88 hours per year (265 hours ÷3 years) or, roughly, 100 hours. Staff believes that most of the records submitted with a safe harbor request would be those that these entities have kept in the ordinary course of business, and that any incremental effort associated with maintaining the results of independent assessments or other records under Section 312.10(d)(3) also would be in the normal course of business. In accordance with the regulations implementing the PRA, the burden estimate excludes effort expended for these activities. 5 CFR 1320.3(b)(2).

Accordingly, FTC staff estimates that total burden per year for disclosure requirements affecting new web entrants and reporting requirements for safe harbor applications would be approximately 6,100 hours.

Estimated annual cost burden:

1. Labor costs: Labor costs are derived by applying appropriate hourly cost figures to the burden hours described above. Staff assumes hourly rates of $150 and $36, respectively, for lawyers or similar professionals and computer programmers.^[4] Based on these inputs, staff further estimates that associated annual labor costs for new entrants would be $801,000 [(5,100 hours × $150 per hour for legal) + (1,000 hours × $36 per hour for computer programmers)] and $15,000 for safe harbor applicants (100 hours per year × $150 per hour), for a total labor cost of approximately $816,000.

2. Capital or other non-labor costs: Because Web sites will already be equipped with the computer equipment and software necessary to comply with the Rule's notice requirements, the predominant costs incurred by the Web sites are the aforementioned estimated labor costs. Similarly, industry members should already have in place the means to retain and store the records that must be kept under the Rule's safe harbor recordkeeping provisions, because they are likely to have been keeping these records independent of the Rule. Capital and start-up costs associated with the Rule are minimal.

Willard K. Tom,

General Counsel.

Footnotes

1.  The comment must be accompanied by an explicit request for confidential treatment, including the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. The request will be granted or denied by the Commission's General Counsel, consistent with applicable law and the public interest. See FTC Rule 4.9(c), 16 CFR 4.9(c).

2.  Although the FTC staff cannot determine with certainty the number of new entrants potentially subject to the Rule, the staff believes this estimate is reasonable based upon current trends. The staff retains its estimate of 60 hours per new entrant. This estimate has been published for comment in prior FTC notices regarding renewed clearance for the Rule, and the Commission has not received any comments challenging it. See, e.g., 73 FR 35689 (June 24, 2008); 70 FR 21107 (April 22, 2005).

3.  See Section 312.10(c). Approved self-regulatory guidelines can be found on the FTC's Web site at http://www.ftc.gov/​privacy/​privacyinitiatives/​childrens_​shp.html.

4.  FTC staff estimates average legal costs at $150 per hour, which is roughly midway between Bureau of Labor Statistics (BLS) mean hourly wages shown for attorneys (approximately $56) in the most recent whole-year data (2009) available online and what staff believes more generally reflects hourly attorney costs ($250) associated with Commission information collection activities. The $36 estimate for computer programmers is also based on the most recent whole-year BLS data available online. See National Compensation Survey: Occupational Earnings in the United States, 2009, at Table 3, available at http://www.bls.gov/​ncs/​ocs/​sp/​nctb1346.pdf.