02-5330. Agency Information Collection Activities; Proposed Collection; Comment Request; Extension

AGENCY:

Federal Trade Commission (“FTC”).

ACTION:

Notice.

SUMMARY:

The FTC seeks public comments on its proposal to extend through June 30, 2005 the current Paperwork Reduction Act (“PRA”) clearance for information collection requirements contained in its Children's Online Privacy Protection Act Rule (“COPPA Rule” or “Rule”). That clearance expires on June 30, 2002.

DATES:

Comments must be submitted on or before May 6, 2002.

ADDRESSES:

Send written comments to Secretary, Federal Trade Commission, Room H-159, 600 Pennsylvania Ave., N.W., Washington, D.C. 20580. All comments should be captioned “COPPA Rule: Paperwork comment.” Comments in electronic form should be sent to: [e-mail], as prescribed below.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information or copies of the proposed information requirements should be addressed to Elizabeth Delaney, Attorney, Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, Room S-4002, 601 Pennsylvania Ave., NW, Washington, DC 20580, [phone].

SUPPLEMENTARY INFORMATION:

Under the PRA (44 U.S.C. 3501-3520), Federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. “Collection of information” means agency requests or requirements that members of the public submit reports, keeps records, or provide information to a third party. 44 U.S.C. 3502(3), 5 CFR 1320.3(c). As required by section 3506(c)(2)(A) of the PRA, the FTC is providing this opportunity for public comment before requesting that OMB extend the existing paperwork clearance for the COPPA Rule, 16 CFR Part 312 (OMB Control Number 3084-0117).

The FTC invites comments on: (1) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

If a comment contains nonpublic information, it must be filed in paper form, and the first page of the document must be clearly labeled “confidential.” Comments that do not contain any nonpublic information may instead be filed in electronic form (in ASCII format, WordPerfect, or Microsoft Word) as part of or as an attachment to email messages directed to the following e-mail box: [e-mail]. Such comments will be considered by the Commission and will be available for inspection and copying at its principal office in accordance with Section 4.9(b)(6)(ii) of the Commission's Rules of Practice, 16 CFR 4.9(b)(6)(ii)).

The COPPA Rule prohibits unfair and deceptive acts and practices in connection with the collection and use of personally identifiable information from and about children on the Internet. Under the terms of the Act, the Commission's rules must:

(1) Require each Web site and online service operator directed to children, and any Web site or online service operator with actual knowledge that it is collecting personal information from children, to provide notice of how it collects, uses and discloses such information and, with exceptions, to obtain the prior consent of the child's parent in order to engage in such collection, use and disclosure;

(2) Require the operator to provide the parent with notice of the specific types of personal information being collected from the child, to give the parent the opportunity for forbid the operator at any time from further collecting, using, or maintaining such information, and to provide reasonable means for the parent to obtain the information;

(3) Prohibit a child's participation in a game, a prize offer, or other activity from being conditioned on the child's disclosure of more personal information than is “reasonably necessary” for the child to participate in that activity; and

(4) require Web site and online service operators to establish procedures that protect the confidentiality, security and integrity of personal information collected from children.^[1]

The above-described “notice” requirements do not mandate the maintenance or reporting of any records or other information for or on behalf of the government. Nonetheless, the FTC seeks OMB approval because the aforementioned provisions constitute “collection(s) of information” under the PRA.^[2] Likewise, the FTC seeks OMB clearance regarding the information collected under the Rule's safe harbor provisions because, while the submission by operators of such requests to the agency is voluntary, the Rule includes specific information requirements that all such requesters must provide to receive Commission approval.^[3] Thus, the safe harbor provisions include a “collection of information” under the PRA and implementing OMB regulations. See 44 U.S.C. 3502(3)(A), 5 CFR 1320.3(c).

Estimated annual hours burden: 2,065 hours.

FTC staff projects an estimated 30 new web entrants each year will fall within the rule's coverage and that each will require, on average, 60 hours per year to craft a privacy policy, design a mechanism to provide the required notice, and post it online.^[4] Accordingly, staff estimates that newly affected entities will require approximately 1,800 hours to comply with these requirements of the Rule.^[5] Consistent with staff's prior estimated apportionment (5:1) of legal (lawyers or similar professionals) and technical (computer programmers) time spent on compliance,^[6] staff estimates that 1,500 hours of this total would be time spent by lawyers (developing the notice policy) and 300 hours would be attributable to computer programmers' efforts (posting the policy on the Web site).

With regard to the Rule's safe harbor provisions, staff estimates, based on industry input, that it would require, on average, 265 hours per new safe harbor program applicant to prepare and submit their safe harbor proposal in accordance with section 310.12(c) of the Rule. Industry sources have also advised staff that all of this time would be attributable to lawyers' time and costs. Based on past experience and industry input, staff believes that no more than one applicant per year (if that) will submit a request. Staff believes, however, that most of the records listed in the Rule's safe harbor provisions consist of records that marketing and online industry representatives have kept in the ordinary course of business preceding the Rule. PRA “burden” does not include effort expended in the ordinary course of business independent of a regulatory requirement. 5 CFR 1320.3(b)(2). Any incremental burden, such as that for maintaining the results of indepdenent assessments under section 312.10(d)(3), would be, in staff's view, de minimis. Accordingly, staff estimates that total hours per year for start-up efforts and for safe harbor application would be approximately 2,065 hours (1,800 + 265).

Labor costs: Labor costs are derived by applying appropriate hourly cost figures to the burden hours described above. Staff conservatively assumes hourly rates of $75 and $25, respectively, for lawyers and computer programmers.^[7] Based on these inputs, staff further estimates that the associated annual labor costs for new entrants would be $120,000 [(1,500 hours × $75/hour for legal) + (300 hours × $25/hour for technical.] and $19,875 for safe harbor applicants [265 hours × $75/hour for legal × one applicatioan per year] for a total labor cost of $140,000, rounded to the nearest thousand.

Non-labor costs: Sine Web sites will already be equipped with the computer equipment and software necessary to comply with the Rule's notice requirements, the sole costss incurred by the website are the aforementioned estimated labor costs. Similarly, industry members should already have in place the means to retain and store the records the Rule's safe habor recordkeeping provisions specify (and that members likely have been keeping indepdenent of the Rule).

John D. Graubert,

Acting General Counsel.

Footnotes

1.  15 U.S.C. 6502(b)(1)(A)-(D).

2.  44 U.S.C. 3502(3), (13); 5 CFR 1320.3(c) (identical questions or reporting requirements directed to ten or more persons). The Commission does not seek OMB approval for the COPPA requirement that state attorneys general notify the Commission when filing a civil action under the Commission's rule, since the rule does not incorporate that statutory requirement. See 15 U.S.C. 6504(2)(A). Likewise, the Commission does not seek OMB approval for the portion of section 312.5 of the Rule that requires operators to ensure they have parental consent before collecting information from children, since the Rule does not require that operators report or maintain any records of such consent on behalf of the government. See 5 CFR 1320.3(c), (m).

3.  See section 312.10(c). Under section 312.10 operators will be deemed to be in compliance with the Rule if they meet the terms of industry self-regulatory guidelines approved by the Commission after notice and comment.

4.  The hours estimate per new entrant is the same that staff projected in this initial PRA analysis published in the notice of proposed rulemaking. See 64 FR 22750, 22761 (April 27, 1999). staff also retains its prior projection that roughly 30 new children's sites subject to the rule would be posted each year. Although staff can not determine with any degree of certainly the number of new entrants potentially subject to the rule, it believes its empirical estimate is reasonable. Moreover, the Commission received no prior comments challenging staff's prior PRA analysis notwithstanding its receipt of numerous comments on the Rule itself. Accordingly, staff retains those estimates for the instant PRA analysis.

5.  Web site operators that have previously created or adjusted their sites to comply with the Rule will incur no further burden associated with the rule, unless they opt to change their policies and information collection in ways that will further invoke the Rule's provisions. Moreover, staff believes that existing COPPA-compliant operators who introduce additional sites beyond those they already have created will incur minimal, if any, incremental PRA burden. This is because such operators already have been through the startup phase, and can carry over the results of that to the new sites they create.

6.  See http://www.ftc.gov/​os/​1999/​9906/​childprivsup.htm (text of the PRA supporting statement sent to OMB contemporaneous with publication of the proposed rule).

7.  Previously, staff's stated estimates for such labor, were $65.33/hour for legal and $23.18 for computer programmers, based on adding ten percent to 1996 statistics found in “Occupational Compensation Survey: National Summary 1996,” U.S. Department of Labor, Bureau of Labor Statistics. In September 2001, however, the Department of Labor published its “National Compensation Survey: Occupational Wages in the United States 2000,” which integrates data from the Occupational Compensation Survey, the Employment Cost Index, and the Employee Benefits Survey. According to this more recent compilation, the mean hourly earnings of lawyers and computer programmers, based on a survey of all 50 states from June 1999 to April 2001, was $38.70 and $23.33, respectively. More generally, regarding most other Commission information collection activities that invoke the PRA, Commission staff has estimated lawyer's national average hourly rates to be $75, which staff will also apply here. The $25 estimate for computer programmers is merely a rough rounding based on the above-noted data.