by Cathy Bump

On February 9, TRUSTe announced that it had revoked its privacy seal from Gratis Internet, parent company of FreeiPods.com, FreeDesktopPC.com, FreeHandBags.com, and FreeFlatScreens.com. TRUSTe is pleased to report, however, that several days later, the company agreed to work with TRUSTe to resolve all outstanding issues and to reapply for certification.

As outlined in our press release, FreeiPods was not in compliance with various standards of our seal program. These included not informing TRUSTe of material changes to its privacy policy or practices, not meeting requirements related to collection of children’s information, and failing to cooperate with TRUSTe to resolve complaints and violations in a timely manner. It is generally the goal of our program to resolve issues such as these short of termination. We consider keeping sealholders in our program, and working with them to get back into compliance with our standards, to be often the best way to help and protect consumers.

TRUSTe’s mission is to build trusting relationships. The satisfactory resolution of customer complaints can help build a foundation for such trust between a company and its customers. Companies are not infallible, but they have a choice to either take the opportunity to resolve issues and thereby potentially earn trust or to turn their backs on customers. Our goal to help them do the former, and to assist them in meeting our standards for the benefit of their customers.

We take seriously the concern -- heard from both sealholders and consumer advocates -- that the confidentiality provisions of our license agreement may restrict our ability to provide a more complete description of the violations case such as this. Our license agreement in its current form is designed to protect TRUSTe members’ confidential, competitive information in order to encourage full disclosure of practices during our certification and in any investigations. However, we are exploring ways to improve the balance in the future between complete disclosure to consumers and the need for licensee confidentiality.

This termination demonstrates clearly the role TRUSTe plays in Internet privacy. We are not a regulatory agency like the Federal Trade Commission, which sets regulations and has broad authority to investigate and impose fines, nor are we a state attorney general’s office, which is empowered to pursue criminal or civil penalties on behalf of a class of citizens.

TRUSTe is in a position, however, to act promptly and assertively in response to complaints, even individual ones. We have a strict set of standards, which are continually adapted in light of the changing online and regulatory environments. These standards set a baseline based on the Fair Information Principles, and TRUSTe expends significant effort to help companies bring their practices, polices, and business processes into alignment with those standards, with the end result of offering consumers informed choice regarding the use of their personal information. Those standards are enforced through monitoring and investigations -- sometimes resulting from consumer complaints to our Watchdog dispute resolution system, at other times resulting from our own monitoring efforts. We pride ourselves on our transparent and fair compliance program, and on the fact that we address every consumer Watchdog complaint that we receive. To drive compliance with these standards, we license the use of the TRUSTe Privacy Seal . . . and to enforce compliance we may revoke that seal.

TRUSTe has significantly increased its active monitoring and compliance activities over the past three years. We now do automated monitoring of Web site compliance for all companies in our program and have begun monitoring Watchdog complaints for spikes in frequency and severity. Some improvements are based on operational learning, such as monitoring complaint levels for the Bonded Sender email program. We take adherence to our procedures and processes extremely seriously, and all of those processes are intended to be fair and transparent. They can all be reviewed on our Web site.

While self-regulation has limitations, the reality is that law enforcement, attorneys general, state privacy offices, and regulators do not have the resources to police all companies. Nor do they have the resources to consistently help a single customer of a Web site resolve a problem related to the misuse of his or her personal information. Rather, they rightfully tend to focus on the egregious violators.

While the penalties TRUSTe can impose or reveal publicly may not satisfy everybody, consumers nonetheless benefit every day when, in the course of certifying a company, we require it to put notice of use and an opt-out at the point of data collection, or we escalate an unsubscribe request, or, as in the case of Batteries.com, we mediate the resolution of a sharing violation. They also benefit on an ongoing basis from our continual licensee monitoring program. That is why the enforcement action taken by TRUSTe in the case of Gratis Internet exemplifies the effect consumers can have -- with TRUSTe’s help -- to change the privacy attitudes and practices of Web site operators for the better.

Cathy Bump is vice president of policy and legal at TRUSTe.

 

Ponemon Institute