Agency Information Collection Activities; Proposed Collection; Comment Request; Extension, 16015-16017 [E8-6211]

Agencies

• FEDERAL TRADE COMMISSION

[Federal Register Volume 73, Number 59 (Wednesday, March 26, 2008)]
[Notices]
[Pages 16015-16017]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-6211]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission (``Commission'' or ``FTC'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC is seeking public comments on its proposal to extend 
through July 31, 2011, the current Paperwork Reduction Act (``PRA'') 
clearance for information collection requirements contained in the

[[Page 16016]]

Children's Online Privacy Protection Act Rule (``COPPA Rule''), which 
will expire on July 31, 2008. The information collection requirements 
described below will be submitted to the Office of Management and 
Budget (``OMB'') for review, as required by the PRA.

DATES: Comments must be submitted on or before May 27, 2008.

ADDRESSES: Interested parties are invited to submit written comments. 
Comments should refer to ``FTC COPPA PRA Comment: FTC File No. 
P084511'' to facilitate the organization of comments. A comment filed 
in paper form should include this reference both in the text and on the 
envelope and should be mailed or delivered to the following address: 
Federal Trade Commission, Room H-135 (Annex J), 600 Pennsylvania Ave., 
N.W., Washington, D.C. 20580. Because paper mail in the Washington area 
and at the Commission is subject to delay, please consider submitting 
your comments in electronic form, as prescribed below. However, if the 
comment contains any material for which confidential treatment is 
requested, it must be filed in paper form, and the first page of the 
document must be clearly labeled ``Confidential.''\1\
---------------------------------------------------------------------------

    \1\ Commission Rule 4.2(d), 16 CFR 4.2(d). The comment must be 
accompanied by an explicit request for confidential treatment, 
including the factual and legal basis for the request, and must 
identify the specific portions of the comment to be withheld from 
the public record. The request will be granted or denied by the 
Commission's General Counsel, consistent with applicable law and the 
public interest. See Commission Rule 4.9(c), 16 CFR 4.9(c).
---------------------------------------------------------------------------

    Comments filed in electronic form should be submitted by following 
the instructions on the web-based form at https://
secure.commentworks.com/ftc-COPPARule. To ensure that the Commission 
considers an electronic comment, you must file it on the web-based form 
at the https://secure.commentworks.com/ftc-COPPARule weblink. If this 
notice appears at www.regulations.gov, you may also file an electronic 
comment through that website. The Commission will consider all comments 
that regulations.gov forwards to it.
    The FTC Act and other laws the Commission administers permit the 
collection of public comments to consider and use in this proceeding as 
appropriate. All timely and responsive public comments will be 
considered by the Commission and will be available to the public on the 
FTC website, to the extent practicable, at www.ftc.gov. As a matter of 
discretion, the FTC makes every effort to remove home contact 
information for individuals from the public comments it receives before 
placing those comments on the FTC website. More information, including 
routine uses permitted by the Privacy Act, may be found in the FTC's 
privacy policy at https://www.ftc.gov/ftc/privacy.htm.

FOR FURTHER INFORMATION CONTACT: Requests for additional information 
regarding this proceeding should be addressed to Mamie Kresses, (202) 
326-2070, Federal Trade Commission, Bureau of Consumer Protection, 
Division of Advertising Practices, 600 Pennsylvania Ave., N.W., Mail 
Drop NJ-3212, Washington, D.C. 20580.

SUPPLEMENTARY INFORMATION: Under the PRA, 44 U.S.C. 3501-3521, federal 
agencies must obtain approval from OMB for each collection of 
information they conduct or sponsor. ``Collection of information'' 
means agency requests or requirements that members of the public submit 
reports, keep records, or provide information to a third party. 44 
U.S.C. 3502(3), 5 CFR 1320.3(c). As required by section 3506(c)(2)(A) 
of the PRA, the FTC is providing this opportunity for public comment 
before requesting that OMB extend the existing paperwork clearance for 
the COPPA Rule, 16 CFR Part 312 (OMB Control Number 3084-0117). The 
COPPA Rule prohibits unfair and deceptive acts and practices in 
connection with the collection, use, and disclosure of personally 
identifiable information from and about children on the Internet.
    The FTC invites comments on: (1) whether the proposed collection of 
information is necessary for the proper performance of the functions of 
the agency, including whether the information has practical utility; 
(2) the accuracy of the agency's estimate of the burden of the required 
collection of information, including the validity of the methodology 
and assumptions used; (3) ways to enhance the quality, utility, and 
clarity of the information to be collected; and (4) ways to minimize 
the burden of the collection of information on those who are to 
respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques or 
other forms of information technology, e.g., permitting electronic 
submission of responses.
    Estimated annual hours burden: 2,000 hours (rounded to the nearest 
thousand)
    (a) Disclosure Requirements: 1,800 hours (rounded to the nearest 
hundred)
    The COPPA Rule contains certain statutorily-required notice 
requirements, which constitute a ``collection of information'' under 
the PRA:
    (1) the Rule requires each website and online service directed to 
children, and any website or online service with actual knowledge that 
it is collecting personal information from children, to provide notice 
of how it collects, uses, and discloses such information and, with 
exceptions, to obtain the prior consent of the child's parent in order 
to engage in such collection, use, and disclosure;
    (2) the Rule requires the operator to provide the parent with 
notice of the specific types of personal information being collected 
from the child, to give the parent the opportunity to forbid the 
operator at any time from collecting, using, or maintaining such 
information, and to provide reasonable means for the parent to obtain 
the information;
    (3) the Rule prohibits a child's participation in a game, a prize 
offer, or other activity from being conditioned on the child's 
disclosure of more personal information than is ``reasonably 
necessary'' for the child to participate in that activity; and
    (4) the Rule requires website and online service operators to 
establish procedures that protect the confidentiality, security, and 
integrity of personal information collected from children.
    The FTC staff retains its estimate that roughly 30 new web entrants 
each year will fall within the Rule's coverage and that, on average, 
new entrants will spend approximately 60 hours crafting a privacy 
policy, designing mechanisms to provide the required online privacy 
notice and, where applicable, the direct notice to parents.\2\ 
Accordingly, staff estimates that complying with the Rule's disclosure 
requirements will require approximately 1,800 hours (30 new web 
entrants x 60 hours per entrant). Consistent with prior estimates, FTC 
staff estimates that the time spent on compliance would be apportioned 
five to one between legal (lawyers or similar professionals) and 
technical (computer programmers) personnel. Staff therefore estimates 
that lawyers or similar professionals who craft privacy policies will 
account for 1,500 of the 1,800 hours required. Computer programmers 
responsible for posting privacy policies and

[[Page 16017]]

implementing direct notices and parental consent mechanisms will 
account for the remaining 300 hours.
---------------------------------------------------------------------------

    \2\ Although staff cannot determine with any degree of certainty 
the number of new entrants potentially subject to the Rule, it 
believes its estimate is reasonable. The Commission received no 
comments challenging staff's prior PRA analyses in its prior 
requests for renewed clearance for the Rule or when it most recently 
sought comment on the Rule itself (70 FR 21107, 21109, April 22, 
2005). Accordingly, staff retains those estimates for the instant 
PRA analysis. For the same reasons, staff retains its prior estimate 
of 60 hours per new entrant.
---------------------------------------------------------------------------

    Website operators that have previously created or adjusted their 
sites to comply with the Rule will incur no further burden associated 
with the Rule, unless they opt to change their policies and information 
collection in ways that will further invoke the Rule's provisions. 
Moreover, staff believes that existing COPPA-compliant operators who 
introduce additional sites beyond those they already have created will 
incur minimal, if any, incremental PRA burden. This is because such 
operators already have been through the start-up phase and can carry 
over the results of that to the new sites they create.
    (b) Voluntary Reporting Requirements for Safe Harbor Participants: 
100 hours (rounded to the nearest hundred)
    Operators can comply with the Rule by meeting the terms of industry 
self-regulatory guidelines that the Commission approves after notice 
and comment.\3\ While the submission of industry self-regulatory 
guidelines to the agency is voluntary, the Rule includes specific 
reporting requirements that all safe harbor applicants must provide to 
receive Commission approval. Staff retains its estimate that it would 
require, on average, 265 hours per new safe harbor program applicant to 
prepare and submit its safe harbor proposal in accordance with Section 
312.12(c) of the Rule. Industry sources have confirmed that this 
estimate is reasonable and advised that all of this time would be 
attributable to the efforts of lawyers. Given that several safe harbor 
programs are already available to website operators, FTC staff believes 
that it is unlikely that more than one additional safe harbor applicant 
will submit a request within the next three years of PRA clearance 
sought. Thus, annualized burden attributable to this requirement would 
be approximately 85 hours per year (260 hours / 3 years) or, roughly, 
100 hours. Staff believes that most of the records submitted with a 
safe harbor request would be those that these entities have kept in the 
ordinary course of business, and that any incremental effort associated 
with maintaining the results of independent assessments or other 
records under Section 312.10(d)(3) also would be in the normal course 
of business. In accordance with the regulations implementing the PRA, 
the burden estimate excludes effort expended for these activities. 5 
CFR 1320.3(b)(2).
---------------------------------------------------------------------------

    \3\ See Section 312.10(c). Approved self-regulatory guidelines 
can be found on the FTC's website at https://www.ftc.gov/privacy/
privacyinitiatives/childrens_shp.html.
---------------------------------------------------------------------------

    Accordingly, FTC staff estimates that total burden per year for 
disclosure requirements affecting new web entrants and reporting 
requirements for safe harbor applications would be approximately 2,000 
hours, rounded to the nearest thousand.
    Labor costs: Labor costs are derived by applying appropriate hourly 
cost figures to the burden hours described above. Staff conservatively 
assumes hourly rates of $150 and $35, respectively, for lawyers or 
similar professionals and computer programmers.\4\ Based on these 
inputs, staff further estimates that associated annual labor costs for 
new entrants would be $235,000 [(1,500 hours x $150 per hour for legal) 
+ (300 hours x $35 per hour for computer programmers)] and $15,000 for 
safe harbor applicants (100 hours per year x $150 per hour), for a 
total labor cost of $250,000.
---------------------------------------------------------------------------

    \4\ FTC staff estimates average legal costs at $150 per hour, 
which is roughly midway between Bureau of Labor Statistics (BLS) 
mean hourly wages shown for attorneys (approximately $55) in the 
most recent whole-year data available online (2006) and what staff 
believes may more generally reflect hourly attorney costs ($250) 
associated with Commission information collection activities. The 
$35 estimate for computer programmers is also conservatively based 
on the most recent whole-year data available online from the BLS 
(2006 National Compensation Survey and 2006 Occupational Employment 
and Wage Statistics).
---------------------------------------------------------------------------

    Non-labor costs: Because websites will already be equipped with the 
computer equipment and software necessary to comply with the Rule's 
notice requirements, the sole costs incurred by the websites are the 
aforementioned estimated labor costs. Similarly, industry members 
should already have in place the means to retain and store the records 
that must be kept under the Rule's safe harbor recordkeeping 
provisions, because they are likely to have been keeping these records 
independent of the Rule.

William J. Blumenthal
General Counsel
[FR Doc. E8-6211 Filed 3-25-08: 8:45 am]
BILLING CODE 6750-01-S