02-12264. Agency Information Collection Activities; Proposed Collection; Comment Request; Extension

AGENCY:

Federal Trade Commission (“FTC”).

ACTION:

Notice.

SUMMARY:

The FTC has submitted to the Office of Management and Budget (OMB) for review under the Paperwork Reduction Act (PRA) information collection requirements contained in its Children's Online Privacy Protection Act Rule (“COPPA Rule” or “Rule”). The FTC is seeking public comments on its proposal to extend through June 30, 2005 the current PRA clearance for information collection requirements contained in the Rule.

DATES:

Comments must be submitted on or before June 17, 2002.

ADDRESSES:

Send written comments to the Office of Information and Regulatory Affairs, Office of Management and Budget, New Executive Office Building, Room 10202, Washington, DC 20503, ATTN.: Desk Officer of the Federal Trade Commission (comments in electronic form should be sent to [e-mail]), and to Secretary, Federal Trade Commission, Room H-159, 600 Pennsylvania Ave., NW., Washington, DC 20580 (comments in electronic form should be sent to [e-mail]). All comments should be captioned “COPPA Rule: Paperwork comment,” as prescribed below.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information or copies of the proposed information requirements should be addressed to Elizabeth Delaney, Attorney, Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, Room S-4002, 601 Pennsylvania Ave., NW., Washington, DC 20580, [phone].

SUPPLEMENTARY INFORMATION:

Under the PRA (44 U.S.C. 3501-3520), Federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. On March 6, 2002, the FTC sought comment on the information collection requirements associated with the COPPA Rule, 16 CFR Part 312 (OMB Control Number: 3084-0117). See 67 FR 10211 (March 6, 2002). No comments were received. Pursuant to the OMB regulations that implement the PRA (5 CFR Part 1320), the FTC is providing this second opportunity for public comment while seeking OMB approval to extend the existing paperwork clearance for the Rule.

If a comment contains nonpublic information, it must be filed in paper form, and the first page of the document must be clearly labeled “confidential.” Comments that do not contain any nonpublic information may instead be filed in electronic form (in ASCII format, WordPerfect, or Microsoft Word) as part of or as an attachment to email messages directed to the following email box: [e-mail] Such comments will be considered by the Commission and will be available for inspection and copying at its principal office in accordance with section 4.9(b)(6)(ii) of the Commission's rules of practice, 16 CFR 4.9(b)(6)(ii).

The COPPA Rule prohibits unfair and deceptive acts and practices in connection with the collection and use of personally identifiable information from and about children on the Internet. Under the terms of the Act, the Commission's rules must:

(1) Require each website and online service operator directed to children, and any website or online service operator with actual knowledge that it is collecting personal information from children, to provide notice of how it collects, uses and discloses such information and, with exceptions, to obtain the prior consent of the child's parent in order to engage in such collection, use and disclosure;

(2) Require the operator to provide the parent with notice of the specific types of personal information being collected from the child, to give the parent the opportunity to forbid the operator at any time from further collecting, using, or maintaining such information, and to provide reasonable means for the parent to obtain the information;

(3) Prohibit a child's participation in a game, a prize offer, or other activity from being conditioned on the child's disclosure of more personal information than is “reasonably necessary” for the child to participate in that activity; and

(4) Require web site and online service operators to establish procedures that protect the confidentiality, security and integrity of personal information collected from children.^[1]

The above-described “notice” requirements do not mandate the maintenance or reporting of any records or other information for or on behalf of the government. Nonetheless, the FTC seeks OMB approval because the aforementioned provisions constitute “collection(s) of information” under the PRA.^[2] Likewise, the FTC seeks OMB clearance regarding the information collected under the Rule's safe harbor provisions because, while the submission by operators of such requests to the agency is voluntary, the Rule includes specific information requirements that all such requesters must provide to receive Commission approval.^[3] Thus, the safe harbor provisions include a “collection of information” under the PRA and implementing OMB regulations. See 44 U.S.C. 3502(3)(A), 5 CFR 1320.3(c).

Estimated annual hours burden: 2,065 hours.

FTC staff projects an estimated 30 new web entrants each year will fall within the Rule's coverage and that each will require, on average, 60 hours per year to craft a privacy policy, design a mechanism to provide the required notice, and post it online.^[4] Accordingly, staff estimates that newly affected entities will require approximately 1,800 hours to comply with these requirements of the Rule.^[5] Consistent with staff's prior estimated apportionment (5:1) of legal (lawyers or similar professionals) and technical (computer programmers) time spent on compliance,^[6] staff estimates that 1,500 hours of this total would be time spent by lawyers (developing the notice policy) and 300 hours would be attributable to computer programmers' efforts (posting the policy on the website).

With regard to the Rule's safe harbor provisions, staff estimates, based on industry input, that it would require, on average, 265 hours per new safe harbor program applicant to prepare and submit their safe harbor proposal in accordance with section 310.12(c) of the Rule. Industry sources have also advised staff that all of this time would be attributable to lawyers' time and costs. Based on past experience and industry input, staff believes that no more than one applicant per year will submit a request. Staff believes, however, that most of the records listed in the Rule's safe harbor provisions consist of records that marketing and online industry representatives have kept in the ordinary course of business preceding the Rule. PRA “burden” does not include effort expended in the ordinary course of business independent of a regulatory requirement. 5 CFR 1320.3(b)(2). Any incremental burden, such as that for maintaining the results of independent assessments under section 312.10(d)(3), would be, in staff's view, de minimis. Accordingly, staff estimates that total hours per year for start-up efforts and for safe harbor applications would be approximately 2,065 hours (1,800 + 265).

Labor costs: Labor costs are derived by applying appropriate hourly cost figures to the burden hours described above. Staff conservatively assumes hourly rates of $75 and $25, respectively, for lawyers and computer programmers.^[7] Based on these inputs, staff further estimates that the associated annual labor costs for new entrants would be $120,000 [(1,500 hours × $75/hour for legal) + (300 hours × $25/hour for technical)] and $19,875 for safe harbor applicants [265 hours × $75/hour for legal × one application per year] for a total labor cost of $140,000, rounded to the nearest thousand.

Non-labor costs: Since websites will already be equipped with the computer equipment and software necessary to comply with the Rule's notice requirements, the sole costs incurred by the websites are the aforementioned estimated labor costs. Similarly, retention of the records the Rule's safe harbor recordkeeping provisions specify should entail de minimis costs beyond what operators incur independent of the Rule in the ordinary course of business.

William E. Kovacic,

General Counsel.

Footnotes

1.  15 U.S.C. 6502(b)(1)(A)-(D).

2.  44 U.S.C. 3502(3), (13); 5 CFR 1320.3(c) (identical questions or reporting requirements directed to ten or more persons). The Commission does not seek OMB approval for the COPPA requirement that state attorneys general notify the Commission when filing a civil action under the Commission's Rule, since the Rule does not incorporate that statutory requirements. See 15 U.S.C. 654(2)(A). Likewise, the Commission does not seek OMB approval for the portion of section 312.5 of the Rule that requires operators to ensure they have parental consent before collecting information from children, since the Rule does not require that operators report or maintain any records of such consent on behalf of the government. See 5 CFR 1320.3(c),(m).

3.  See section 312.10(c). Under section 312.10, operators will be deemed to be in compliance with the Rule if they meet the terms of industry self-regulatory guidelines approved by the Commission after notice and comment.

4.  The hours estimate per new entrant is the same that staff projected in its initial PRA analysis published in the notice of proposed rulemaking. See 64 FR 22750, 22761 (April 27, 1999). Staff also retains its prior projection that roughly 30 new children's sites subject to the Rule would be posted each year. Although staff cannot determine with any degree of certainty the number of new entrants potentially subject to the Rule, it believes its empirical estimate is reasonable. Moreover, the Commission received no prior comments challenging staff's prior PRA analysis notwithstanding its receipt of numerous comments on the Rule itself. Accordingly, staff retains those estimates for the instant PRA analysis.

5.  Website operators that have previously created or adjusted their sites to comply with the Rule will incur no further burden associated with the Rule, unless they opt to change their policies and information collection in ways that will further invoke the Rule's provisions. Moreover, staff believes that existing COPPA-complaint operators who introduce additional sites beyond those they already have created will incur minimal, if any, incremental PRA burden. This is because such operators already have been through the start-up phase, and can carry over the results of that work to the new sites they create.

6.  See http://www.ftc.gov/​os/​1999/​9906/​childprivsup.htm (text of the PRA supporting statement sent to OMB contemporaneous with publication of the proposed rule).

7.  Previously, staff's stated estimates for such labor, were $65.33/hour for legal and $23.18 for computer programmers, based on adding ten percent to 1996 statistics found in “Occupational Compensation Survey: National Summary, 1996,” U. S. Department of Labor, Bureau of Labor Statistics. In September 2001, however, the Department of Labor published its “National Compensation Survey: Occupational Wages in the Untied States, 2000,” which integrates data from the Occupational Compensation Survey, the Employment Cost Index, and the Employee Benefits Survey. According to this more recent compilation, the mean hourly earnings of lawyers and computer programmers, based on a survey of all 50 states from June 1999 to April 2001, was $38.70 and $23.33, respectively. More generally, regarding most other Commission information collection activities that invoke the PRA, Commission staff has estimated lawyer's national average hourly rates to be $75, which staff will also apply here. The $25 estimate for computer programmers is merely a rough rounding based on the above-noted data.