2010 Sprint

Developer Conference
Maureen Cooney
Deputy Chief Privacy Officer and Senior Counsel
Sprint Office of Privacy
Oct. 26 – 28, 2010

Oct. 26 - 28
Consumer Privacy Issues
for Application Developers
Gaining Consumer Trust for Mobile Applications

Topics
• Baking Privacy into Application Development Lifecycle
• Privacy 101
• Washington Regulatory and Hill Update
• Privacy Hot Button Issues
• Current International Considerations

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
2 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy Protection
As part of the design planning process

Why is it important?
Baking Privacy into product and service
development builds consumer trust and protects
against key business risks:
• Reputational risks – Brand (yours and your partner’s)
• Consumer distrust or reticence to use services
• Corporate reticence to innovate and invest
• Legal risks
• Economic Harm

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
3 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Baking Privacy Into
Application Lifecycle Development
Build Trust and Confidence with Stakeholders

Privacy as a Lifecycle Development Element

• Identifying privacy risks
• Developing risk mitigation strategies
• Keeping in mind consumer expectations
> Innovative products and services
> Keeping data ‘under control’
> Accountability for information practices
> Consumer-friendly disclosures
> Means for consumer choice and redress

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
4 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy 101
Consumer Privacy as protection of identity, information,
from unwanted surveillance and unfair or deceptive
information practices

Information Privacy
Protected Information
• Personally identifiable
• Sensitive
• Data about an individual (behavioral, interest-based)
• Customer Propriety Network Information (CPNI)

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
5 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy 101 - continued
Privacy is cultural, although shared global principles

Consumer surveys show that U.S. Internet users’ top

three privacy concerns are 1) information sharing;
2) notice about practices; and 3) information storage.

Fair Information Practice Principles

• Notice/Awareness for consumers
• Choice/Consent
• Access to information/Participation by individuals
• Data Integrity/Security
• Enforcement/Effective Redress

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
6 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy 101 - continued
Who Regulates Privacy in the United States?

Privacy Regulators in the Commercial Space

• Federal Trade Commission (FTC)
• Federal Communications Commission (FCC)
• Health and Human Services (HHS)
• Food and Drug Administration (FDA)
• Department of Justice (ID Theft) (DOJ)
• Department of Homeland Security (DHS)
• Banking Regulators (Treasury, FDIC, FRB)
• State Attorney Generals
• Self Regulatory Voluntary Models - BBB, DMA, TRUSTe
© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
7 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy 101 - continued
Sampling of Laws in the US

• General: Section 5 of the Federal Trade Commission Act

> unfair or deceptive acts or practices in or
affecting commerce….
• Family: Children’s Online Privacy Protection Act
• Financial: Gramm Leach Bliley Act
• Medical: HIPAA, HITECH, Food and Drug Act
• Intrusions: CAN-SPAM Act, Do Not Call Implementation
Act, ECPA/CFTA
• Mobile/Telecom: Telephone Consumers Protection Act
• States: FTC-like Acts, California state law… requiring
privacy notices, Data Security laws, Massachusetts…
policies and practices

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
8 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Washington Regulatory Update
Emerging Privacy Regulation – centers on technology
and new business models
• FCC – FTC Task Force on Privacy
• Dec.1 – Generation Mobile Forum (FCC)
• FTC
• Roundtables (2009-2010) (report pending)
• Behavioral Advertising Guidance
• Review of the COPPA Rule (children’s privacy)
• HHS - HITECH/HIPAA Privacy Rules
• FDA considering downloadable software
as a ‘medical device’
• Draft Privacy and Security Legislation
• Chairmen Rush and Boucher

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
9 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy Hot Button Issues

• Behavioral Tracking
> Targeted Advertising
> Sensitive Information (Health and Other)
> Location Data
> Consumer Privacy Disclosures and Choice
• Privacy Controls, Preference Management and
Data Portability
• Data Security
• Children’s Privacy
• Accountability

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
10 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Behavioral Tracking
Behavioral Tracking
Overview: Privacy concerns about behavioral tracking
relate to the ubiquitous technological collection of data
about an individual, their interests, activities, movements,
associations, and sensitive data
• Need for transparency (Consumer Notice)
• What information is being collected,
used, and with whom it is shared
• Data Retention (what limits)
• Robustness of Security
• Fairness of a Profile developed
• Potential Harm / Opportunity for Redress

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
11 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Targeted Advertising
FTC, Hill and Industry Hot Button Issue 2009-2010
• Congressional Hearings and Draft Bills
• FTC Issued Guidance in February 2010
> Notice outside of a Privacy Policy
> Consumer Choice
> Sensitive Data (opt-in)
> Enforcement
> Redress
• Industry Association Principles and Icon Developed
(IAB, ANA, AAA, DMA, Better Business Bureau)
> http://www.aboutads.info/resource/download/seven-
principles-07-01-09.pdf
> Power i symbol –

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
12 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Sensitive Information
Collection and Sharing Requires Care – Consumer Opt-in

Still being defined, but generally includes:

• Health information
• Social security number and other unique identifiers
• CPNI
• Precise location data
• Children’s Information
• May include political or trade/labor union affiliations,
sexual preference data (applicable in Europe)

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
13 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Location Data
Applicable Guidance
• CTIA Wireless Guidelines
• FTC Guidance
• User Safety
• Appropriate Notice and Choice
> Does consumer permission to grant access to
location data suffice as notice and choice?
> Transparency about use, data sharing, retention
> Best practices are evolving to demonstrate when
tracking is taking place, who is requesting access to
the data, which applications are “on” and offering
consumer controls
> Precise location and call location data require
affirmative opt-in consent of a consumer
© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
14 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Consumer Privacy Disclosures & Choice
• FTC Guidance – better communications with consumers
> Just-in-time notices
> Pop-ups with consent function or information
> Icons
> Understandable privacy policies – new formats

• Challenges in the mobile environment

> Space limitations
> Achieving clarity in short notices, pop-ups
> Icons and symbols to demonstrate privacy practices
> Third Party Certifications

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
15 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Privacy Controls, Preference Management
and Data Portability
• “Privacy by Design” in development of software, hardware,
products and services anticipates building in ways to
empower a consumer to make effective choices about how
they want their information used and to provide mechanisms
to accomplish those choices
• Preference controls – privacy settings
• Preference management – assists in profile and data
use management
• Data portability – acknowledges the value of an
individual’s data shared with a platform or application
and allows the individual to retain information and
move it to other platforms and apps

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
16 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Data Security

• Who is accountable when downloading applications

• Notice of 3rd party activity & policies that apply
• Security in data collection, transfer, storage, destruction
and understanding of where data flows
• Authentication of users
• Data leakage (flows) and data retention
• Risks and controls using cloud architectures
• Continuing spotlight on Identity Theft

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
17 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
Children’s Privacy
FTC Online Privacy Protection Review

Children under 13 years of age …

• Review is focusing on:

> Implications raised by mobile communications and

interactive gaming, television and other i-media
> Concerns around behavioral tracking and profiling
> Whether it is necessary to expand definition of
personal information
> Parental rights to review and delete information
collected from children
> Verifiable consent / authentication

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
18 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.
International Considerations
All of the above and …

• Application certifications
• Data sharing limitations (cross-border)
• Third party accountability

© 2010 Sprint. This information is subject to Sprint policies regarding use and is the property of Sprint and/or its relevant affiliates and may contain restricted,
19 confidential or privileged materials intended for the sole use of the intended recipient. Any review, use, distribution or disclosure is prohibited without authorization.