| Page Range | 57818-57820 | |
| FR Document | 2015-24350 |
[Federal Register Volume 80, Number 186 (Friday, September 25, 2015)] [Notices] [Pages 57818-57820] From the Federal Register Online [www.thefederalregister.org] [FR Doc No: 2015-24350] ======================================================================= ----------------------------------------------------------------------- FEDERAL TRADE COMMISSION Agency Information Collection Activities; Proposed Collection; Comment Request AGENCY: Federal Trade Commission (``FTC'' or ``Commission''). ACTION: Notice. ----------------------------------------------------------------------- SUMMARY: The FTC intends to ask the Office of Management and Budget (``OMB'') to extend for an additional three years the current Paperwork Reduction Act (``PRA'') clearance for information collection requirements contained in the Children's Online Privacy Protection Act Rule (``COPPA Rule'' or ``Rule''), which will expire on February 29, 2016. DATES: Comments must be filed by November 24, 2015. ADDRESSES: Interested parties may file a comment online or on paper, by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Write ``COPPA Rule: Paperwork Comment, FTC File No. P155408'' on your comment, and file your comment online at https://ftcpublic.commentworks.com/ftc/coppapra, by following the instructions on the web-based form. If you prefer to file your comment on paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW., Suite CC-5610 (Annex J), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW., 5th Floor, Suite 5610 (Annex J), Washington, DC 20024. FOR FURTHER INFORMATION CONTACT: Requests for additional information should be addressed to Miry Kim, Attorney, (202) 326-3622, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580. SUPPLEMENTARY INFORMATION: The COPPA Rule, 16 CFR part 312, requires commercial Web sites to provide notice and obtain parents' consent before collecting, using, and/or disclosing personal information from children under age 13, with limited exceptions. The COPPA Rule contains certain statutorily-required notice requirements that apply to operators of any Web site or online service directed to children, and operators of any Web site or online service with actual knowledge of collecting personal information from children. Covered operators must: provide online notice and direct notice to parents of how they collect, use, and disclose children's personal information; obtain the prior consent of the child's parent in order to engage in such collection, use, and disclosure, with limited exceptions; provide reasonable means for the parent to obtain access to the information and to direct its deletion; and, establish procedures that protect the confidentiality, security, and integrity of personal information collected from children. Burden Statement 1. Estimated Annual Hours Burden: 17,500 Hours \1\ --------------------------------------------------------------------------- \1\ This discussion and the associated burden estimates concern strictly recurring compliance obligations under the COPPA Rule. ``One-time'' adjustments associated with entities' initial steps to comply with the January 17, 2013 final amendments to the COPPA Rule, 78 FR 3972, already have been undertaken and accounted for in the FTC's previously published and cleared estimates associated with the final rulemaking. --------------------------------------------------------------------------- (a) New Entrant Web Operators' Disclosure Burden Based on public comments on the Commission's 2013 final amendments to the COPPA Rule,\2\ FTC staff estimates that the Rule affects approximately 280 new operators per year.\3\ Staff maintains its longstanding estimate that new web operators will require, on average, approximately 60 hours crafting a privacy policy, designing mechanisms to provide the required online privacy notice and, where applicable, the direct notice to parents.\4\ Applied to the estimated number of new operators per year, this yields a cumulative yearly total of 16,800 hours (280 new operators x 60 hours each). --------------------------------------------------------------------------- \2\ 78 FR at 4005. \3\ This consists of certain traditional Web site operators, mobile app developers, plug-in developers, and advertising networks. \4\ See, e.g., 78 FR at 4006; 76 FR 31334 (May 31, 2011); 73 FR 35689 (June 24, 2008); 70 FR 21107 (April 22, 2005). --------------------------------------------------------------------------- (b) Safe Harbor Applicant Reporting Requirements Operators can comply with the COPPA Rule by meeting the terms of industry self-regulatory guidelines that the Commission approves after notice and comment.\5\ While the submission of industry self-regulatory guidelines to the agency is voluntary, the COPPA Rule sets out the criteria for approval of guidelines and the materials that must be submitted as part of a safe harbor application. Staff estimates that it would require, on average, 265 hours per new safe harbor program applicant to prepare and submit its safe harbor proposal in accordance with section 312.11(c) of the Rule. In the past, industry sources have confirmed that this estimate is reasonable and advised that all of this time would be attributable to the efforts of lawyers. Given that several safe harbor programs are already available to Web site operators, FTC staff believes that it is unlikely that more than one additional safe harbor applicant will submit a request within the next three years of PRA clearance sought. Thus, annualized burden attributable to this requirement would be approximately 88 hours per year (265 hours /3 years) or, roughly, 100 hours, for the estimated one additional safe harbor applicant. --------------------------------------------------------------------------- \5\ See Section 312.11(c). Approved self-regulatory guidelines can be found on the FTC's Web site at http://www.ftc.gov/privacy/privacyinitiatives/childrens_shp.html. --------------------------------------------------------------------------- Staff believes that most of the records submitted with a safe harbor request would be those that these entities have kept in the ordinary course of business, and that any incremental effort associated with maintaining the results of independent assessments or other records under section 312.11(d)(3) also would be in the normal course of business. Under 5 CFR 1320.3(b)(2), OMB excludes from the definition of PRA burden the time and financial resources needed to comply with agency-imposed recordkeeping, disclosure, or reporting requirements that customarily would be undertaken independently in the normal course of business. (c) Annual Audit and Report for Safe Harbor Programs The COPPA Rule requires safe harbor programs to audit their members at least annually and to submit annual reports to the Commission on the aggregate results of these member audits. The burden for conducting member audits and preparing these reports likely will vary for each safe harbor program depending on the number of members. Commission staff estimates that conducting audits and preparing reports will require approximately 100 hours per program per year. Aggregated for one new safe harbor (100 hours) and seven existing (700 hours) safe harbor programs, this amounts to an estimated cumulative reporting burden of 800 hours per year. [[Page 57819]] (d) Safe Harbor Program Recordkeeping Requirements FTC staff believes that most of the records listed in the COPPA Rule's safe harbor recordkeeping provisions consist of documentation that such parties have kept in the ordinary course of business irrespective of the COPPA Rule. As noted above, OMB excludes from the definition of PRA burden, among other things, recordkeeping requirements that customarily would be undertaken independently in the normal course of business. In staff's view, any incremental burden, such as that for maintaining the results of independent assessments under section 312.11(d), would be marginal. 2. Estimated Annual Labor Costs: $5,342,500 Based on its experience with previously approved safe harbor programs, FTC staff anticipates that in-house counsel (primarily senior) will perform the legal tasks associated with safe harbor applications. Conversely, based on the 2013 rulemaking record, staff assumes that outside counsel will perform legal services tied to Rule compliance by new entrant web operators. For in-house legal costing, FTC staff applies to its analysis below an approximate mid-way between the mean hourly wage for lawyers ($64.17),\6\ as appearing within the most recent annual compilation available online from the Bureau of Labor Statistics, and what Commission staff believes more generally reflects a rough approximation of hourly attorney costs ($300) associated with Commission information collection activities: $185, rounded upward. --------------------------------------------------------------------------- \6\ See Occupational Employment and Wages--May 2014, Table 1 (National employment and wage data from the Occupational Employment Statistics survey by occupation, May 2014), available at http://www.bls.gov/news.release/ocwage.nr0.htm (hereinafter, ``BLS Table 1''). --------------------------------------------------------------------------- Regarding outside counsel costs, the National Law Journal noted in connection with its 2014 Billing Survey (``survey'') of law firms that the average rate for partner billing was ``about'' $500, and that the average associate billing rate was $306.\7\ Commission staff believes it reasonable to assume that the workload among law firm partners and associates for COPPA compliance questions could be competently addressed and efficiently distributed among attorneys at varying levels of seniority, but would be weighted most heavily to more junior attorneys. Thus, assuming an apportionment of two-thirds of such work is done by associates, and one-third by partners, a weighted average tied to the average firm-wide associate and average firm-wide partner rates, respectively, in the National Law Journal 2014 survey would be about $370 per hour. --------------------------------------------------------------------------- \7\ Cf. Civil Division of the United States Attorney's Office for the District of Columbia, United States Attorney's Office, District of Columbia, Laffey Matrix B 2014-2015, available at http://www.justice.gov/sites/default/files/usao-dc/legacy/2014/07/14/Laffey%20Matrix_2014-2015.pdf (updated ``Laffey Matrix'' for calculating ``reasonable'' attorney fees in suits in which fee shifting as statutorily authorized can be evidence of prevailing market rates for litigation counsel in the Washington, DC area; rates in table range from $255 per hour for most junior associates to $520 per hour for most senior partners). --------------------------------------------------------------------------- Labor costing for other assumed relevant categories (technical assistance, compliance officers) is detailed within the discussion below. (a) New Entrant Web Operators' Disclosure Burden Consistent with its past estimates, FTC staff assumes that the time spent on compliance for new operators and existing operators covered by the COPPA Rule would be apportioned five to one between legal (lawyers or similar professionals) and technical (e.g., computer programmers, software developers, and information security analysts) personnel. Staff therefore estimates that lawyers or similar professionals who craft privacy policies will account for 14,000 of the estimated 16,800 hours required. Computer programmers responsible for posting privacy policies and implementing direct notices and parental consent mechanisms will account for the remaining 2,800 hours. FTC staff estimates an hourly wage of $42 for technical assistance, based on BLS data.\8\ Accordingly, paired with the above-noted estimated rate for outside counsel assistance, associated labor costs would be $5,297,600 [(14,000 hours x $370/hour) + (2,800 hours x $42/hour)]. --------------------------------------------------------------------------- \8\ The estimated mean hourly wages for technical labor support ($42) is based on an average of the salaries for computer programmers, software developers, information security analysts, and web developers as reported by the BLS. See BLS Table 1. --------------------------------------------------------------------------- (b) Safe Harbor Applicant Reporting Requirements Previously, industry sources have advised that all of the labor to comply with these requirements would be attributable to the efforts of lawyers. Accordingly, applying the estimated time stated above for these tasks (100 hours, annualized and rounded up) to the above-noted assumed hourly wage for in-house counsel ($185) yields $18,500 in labor cost per year. (c) Annual Audit and Report for Safe Harbor Programs Commission staff assumes that annual reports will be prepared by compliance officers, at a labor rate of $33.\9\ Accordingly, applied to the above-stated estimates per year of 100 hours for a new safe harbor program and 700 hours, cumulatively, per year, for seven existing safe harbor programs, this amounts to $26,400 in aggregate yearly labor cost. --------------------------------------------------------------------------- \9\ See BLS Table 1 (compliance officers, $32.69). --------------------------------------------------------------------------- (d) Safe Harbor Program Recordkeeping Requirements For the reasons stated in 1.(d) above, associated labor costs, for PRA purposes, would be nil or marginal. 3. Estimated Annual Non-Labor Costs: $0 Because Web sites will already be equipped with the computer equipment and software necessary to comply with the Rule's notice requirements, the predominant costs incurred by the Web sites are the aforementioned estimated labor costs. Similarly, industry members should already have in place the means to retain and store the records that must be kept under the Rule's safe harbor recordkeeping provisions, because they are likely to have been keeping these records independent of the Rule. Capital and start-up costs associated with the Rule are minimal. Request for Comments Under the PRA, 44 U.S.C. 3501-3521, federal agencies must obtain approval from OMB for each collection of information they conduct or sponsor. ``Collection of information'' means agency requests or requirements that members of the public submit reports, keep records, or provide information to a third party. 44 U.S.C. 3502(3), 5 CFR 1320.3(c). As required by section 3506(c)(2)(A) of the PRA, the FTC is providing this opportunity for public comment before requesting that OMB extend the existing paperwork clearance for the COPPA Rule. (OMB Control Number 3084-0117). Comments must be received on or before the deadline specified above in the DATES section in order to be considered by the Commission. The FTC invites comments on: (1) Whether participation in the study is necessary, including whether the information will be practically useful; (2) the accuracy of our burden estimates, including whether the methodology and assumptions used are valid; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and [[Page 57820]] (4) ways to minimize the burden of the collection of information. You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before November 24, 2015. Write ``COPPA Rule: Paperwork Comment, FTC File No. 155408'' on your comment. Your comment--including your name and your state--will be placed on the public record of this proceeding, including to the extent practicable, on the public Commission Web site, at http://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries to remove individuals' home contact information from comments before placing them on the Commission Web site. Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, like anyone's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment doesn't include any sensitive health information, like medical records or other individually identifiable health information. In addition, don't include any ``[t]rade secret or any commercial or financial information . . . which is privileged or confidential'' as provided in section 6(f) of the FTC Act 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16CFR 4.10(a)(2). In particular, don't include competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns devices, manufacturing processes, or customer names. If you want the Commission to give your comment confidential treatment, you must file it in paper form, with a request for confidential treatment, and you have to follow the procedure explained in FTC Rule 4.9(c)).\10\ Your comment will be kept confidential only if the FTC General Counsel, in his or her sole discretion, grants your request in accordance with the law and the public interest. --------------------------------------------------------------------------- \10\ In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c), CFR 4.9(c), 16 CFR 4.9(c). --------------------------------------------------------------------------- Postal mail addressed to the Commission is subject to delay due to heightened security screening. As a result, we encourage you to submit your comments online. To make sure that the Commission considers your online comment, you must file it at https://ftcpublic.commentworks.com/ftc/coppapra, by following the instructions on the web-based form. When this Notice appears at http://www.regulations.gov/#!home, you also may file a comment through that Web site. If you file your comment on paper, write ``COPPA Rule: Paperwork Comment, FTC File No. 155408'' on your comment and on the envelope, and mail it to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW., Suite CC-5610 (Annex J), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW., 5th Floor, Suite 5610 (Annex J), Washington, DC 20024. If possible, submit your paper comment to the Commission by courier or overnight service. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before November 24, 2015. For information on the Commission's privacy policy, including routine uses permitted by the Privacy Act, see http://www.ftc.gov/ftc/privacy.htm. David C. Shonka Principal Deputy General Counsel. [FR Doc. 2015-24350 Filed 9-24-15; 8:45 am] BILLING CODE 6750-01-P
| Category | Regulatory Information | |
| Collection | Federal Register | |
| sudoc Class | AE 2.7: GS 4.107: AE 2.106: | |
| Publisher | Office of the Federal Register, National Archives and Records Administration | |
| Section | Notices | |
| Action | Notice. | |
| Dates | Comments must be filed by November 24, 2015. | |
| Contact | Requests for additional information | |
| FR Citation | 80 FR 57818 |