Agency Information Collection Activities

Federal Register: March 26, 2008 (Volume 73, Number 59)

Notices

Page 16015-16017

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

DOCID:fr26mr08-74

FEDERAL TRADE COMMISSION

Agency Information Collection Activities; Proposed Collection;

Comment Request; Extension

AGENCY: Federal Trade Commission (``Commission'' or ``FTC'').

ACTION: Notice.

SUMMARY: The FTC is seeking public comments on its proposal to extend through July 31, 2011, the current Paperwork Reduction Act (``PRA'') clearance for information collection requirements contained in the

Page 16016

Children's Online Privacy Protection Act Rule (``COPPA Rule''), which will expire on July 31, 2008. The information collection requirements described below will be submitted to the Office of Management and

Budget (``OMB'') for review, as required by the PRA.

DATES: Comments must be submitted on or before May 27, 2008.

ADDRESSES: Interested parties are invited to submit written comments.

Comments should refer to ``FTC COPPA PRA Comment: FTC File No.

P084511'' to facilitate the organization of comments. A comment filed in paper form should include this reference both in the text and on the envelope and should be mailed or delivered to the following address:

Federal Trade Commission, Room H-135 (Annex J), 600 Pennsylvania Ave.,

N.W., Washington, D.C. 20580. Because paper mail in the Washington area and at the Commission is subject to delay, please consider submitting your comments in electronic form, as prescribed below. However, if the comment contains any material for which confidential treatment is requested, it must be filed in paper form, and the first page of the document must be clearly labeled ``Confidential.''\1\

\1\ Commission Rule 4.2(d), 16 CFR 4.2(d). The comment must be accompanied by an explicit request for confidential treatment, including the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. The request will be granted or denied by the

Commission's General Counsel, consistent with applicable law and the public interest. See Commission Rule 4.9(c), 16 CFR 4.9(c).

Comments filed in electronic form should be submitted by following the instructions on the web-based form at https:// secure.commentworks.com/ftc-COPPARule. To ensure that the Commission considers an electronic comment, you must file it on the web-based form at the https://secure.commentworks.com/ftc-COPPARule weblink. If this notice appears at www.regulations.gov, you may also file an electronic comment through that website. The Commission will consider all comments that regulations.gov forwards to it.

The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. All timely and responsive public comments will be considered by the Commission and will be available to the public on the

FTC website, to the extent practicable, at www.ftc.gov. As a matter of discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC website. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy at http://www.ftc.gov/ftc/privacy.htm.

FOR FURTHER INFORMATION CONTACT: Requests for additional information regarding this proceeding should be addressed to Mamie Kresses, (202) 326-2070, Federal Trade Commission, Bureau of Consumer Protection,

Division of Advertising Practices, 600 Pennsylvania Ave., N.W., Mail

Drop NJ-3212, Washington, D.C. 20580.

SUPPLEMENTARY INFORMATION: Under the PRA, 44 U.S.C. 3501-3521, federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. ``Collection of information'' means agency requests or requirements that members of the public submit reports, keep records, or provide information to a third party. 44

U.S.C. 3502(3), 5 CFR 1320.3(c). As required by section 3506(c)(2)(A) of the PRA, the FTC is providing this opportunity for public comment before requesting that OMB extend the existing paperwork clearance for the COPPA Rule, 16 CFR Part 312 (OMB Control Number 3084-0117). The

COPPA Rule prohibits unfair and deceptive acts and practices in connection with the collection, use, and disclosure of personally identifiable information from and about children on the Internet.

The FTC invites comments on: (1) whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information has practical utility;

(2) the accuracy of the agency's estimate of the burden of the required collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

Estimated annual hours burden: 2,000 hours (rounded to the nearest thousand)

(a) Disclosure Requirements: 1,800 hours (rounded to the nearest hundred)

The COPPA Rule contains certain statutorily-required notice requirements, which constitute a ``collection of information'' under the PRA:

(1) the Rule requires each website and online service directed to children, and any website or online service with actual knowledge that it is collecting personal information from children, to provide notice of how it collects, uses, and discloses such information and, with exceptions, to obtain the prior consent of the child's parent in order to engage in such collection, use, and disclosure;

(2) the Rule requires the operator to provide the parent with notice of the specific types of personal information being collected from the child, to give the parent the opportunity to forbid the operator at any time from collecting, using, or maintaining such information, and to provide reasonable means for the parent to obtain the information;

(3) the Rule prohibits a child's participation in a game, a prize offer, or other activity from being conditioned on the child's disclosure of more personal information than is ``reasonably necessary'' for the child to participate in that activity; and

(4) the Rule requires website and online service operators to establish procedures that protect the confidentiality, security, and integrity of personal information collected from children.

The FTC staff retains its estimate that roughly 30 new web entrants each year will fall within the Rule's coverage and that, on average, new entrants will spend approximately 60 hours crafting a privacy policy, designing mechanisms to provide the required online privacy notice and, where applicable, the direct notice to parents.\2\

Accordingly, staff estimates that complying with the Rule's disclosure requirements will require approximately 1,800 hours (30 new web entrants x 60 hours per entrant). Consistent with prior estimates, FTC staff estimates that the time spent on compliance would be apportioned five to one between legal (lawyers or similar professionals) and technical (computer programmers) personnel. Staff therefore estimates that lawyers or similar professionals who craft privacy policies will account for 1,500 of the 1,800 hours required. Computer programmers responsible for posting privacy policies and

Page 16017

implementing direct notices and parental consent mechanisms will account for the remaining 300 hours.

\2\ Although staff cannot determine with any degree of certainty the number of new entrants potentially subject to the Rule, it believes its estimate is reasonable. The Commission received no comments challenging staff's prior PRA analyses in its prior requests for renewed clearance for the Rule or when it most recently sought comment on the Rule itself (70 FR 21107, 21109, April 22, 2005). Accordingly, staff retains those estimates for the instant

PRA analysis. For the same reasons, staff retains its prior estimate of 60 hours per new entrant.

Website operators that have previously created or adjusted their sites to comply with the Rule will incur no further burden associated with the Rule, unless they opt to change their policies and information collection in ways that will further invoke the Rule's provisions.

Moreover, staff believes that existing COPPA-compliant operators who introduce additional sites beyond those they already have created will incur minimal, if any, incremental PRA burden. This is because such operators already have been through the start-up phase and can carry over the results of that to the new sites they create.

(b) Voluntary Reporting Requirements for Safe Harbor Participants: 100 hours (rounded to the nearest hundred)

Operators can comply with the Rule by meeting the terms of industry self-regulatory guidelines that the Commission approves after notice and comment.\3\ While the submission of industry self-regulatory guidelines to the agency is voluntary, the Rule includes specific reporting requirements that all safe harbor applicants must provide to receive Commission approval. Staff retains its estimate that it would require, on average, 265 hours per new safe harbor program applicant to prepare and submit its safe harbor proposal in accordance with Section 312.12(c) of the Rule. Industry sources have confirmed that this estimate is reasonable and advised that all of this time would be attributable to the efforts of lawyers. Given that several safe harbor programs are already available to website operators, FTC staff believes that it is unlikely that more than one additional safe harbor applicant will submit a request within the next three years of PRA clearance sought. Thus, annualized burden attributable to this requirement would be approximately 85 hours per year (260 hours / 3 years) or, roughly, 100 hours. Staff believes that most of the records submitted with a safe harbor request would be those that these entities have kept in the ordinary course of business, and that any incremental effort associated with maintaining the results of independent assessments or other records under Section 312.10(d)(3) also would be in the normal course of business. In accordance with the regulations implementing the PRA, the burden estimate excludes effort expended for these activities. 5

CFR 1320.3(b)(2).

\3\ See Section 312.10(c). Approved self-regulatory guidelines can be found on the FTC's website at http://www.ftc.gov/privacy/ privacyinitiatives/childrens_shp.html.

Accordingly, FTC staff estimates that total burden per year for disclosure requirements affecting new web entrants and reporting requirements for safe harbor applications would be approximately 2,000 hours, rounded to the nearest thousand.

Labor costs: Labor costs are derived by applying appropriate hourly cost figures to the burden hours described above. Staff conservatively assumes hourly rates of $150 and $35, respectively, for lawyers or similar professionals and computer programmers.\4\ Based on these inputs, staff further estimates that associated annual labor costs for new entrants would be $235,000 [(1,500 hours x $150 per hour for legal)

+ (300 hours x $35 per hour for computer programmers)] and $15,000 for safe harbor applicants (100 hours per year x $150 per hour), for a total labor cost of $250,000.

\4\ FTC staff estimates average legal costs at $150 per hour, which is roughly midway between Bureau of Labor Statistics (BLS) mean hourly wages shown for attorneys (approximately $55) in the most recent whole-year data available online (2006) and what staff believes may more generally reflect hourly attorney costs ($250) associated with Commission information collection activities. The

$35 estimate for computer programmers is also conservatively based on the most recent whole-year data available online from the BLS

(2006 National Compensation Survey and 2006 Occupational Employment and Wage Statistics).

Non-labor costs: Because websites will already be equipped with the computer equipment and software necessary to comply with the Rule's notice requirements, the sole costs incurred by the websites are the aforementioned estimated labor costs. Similarly, industry members should already have in place the means to retain and store the records that must be kept under the Rule's safe harbor recordkeeping provisions, because they are likely to have been keeping these records independent of the Rule.

William J. Blumenthal

General Counsel

FR Doc. E8-6211 Filed 3-25-08: 8:45 am

BILLING CODE 6750-01-S